joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10091cb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov al, byte [edi + 0xe48]
test al, al
jne 0x10091ccd
push edi
call fcn.10091d10
add esp, 4
mov ecx, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
jle 0x10091d04
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xor edx, edx
mov ebx, esi
mov dl, byte [eax + ebp]
and ebx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edi + edx*4 + 0xa48]
xor esi, edx
inc eax
cmp eax, ecx
jl 0x10091cdd
pop ebp
pop ebx
mov eax, esi
pop edi
pop esi
ret
mov eax, esi
pop edi
pop esi
ret

Function at 0x10091d10
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor ecx, ecx
lea edx, [edi + 0xa48]
mov eax, ecx
mov esi, 8
test al, 1
je 0x10091d32
shr eax, 1
xor eax, 0xedb88320
jmp 0x10091d34
shr eax, 1
dec esi
jne 0x10091d25
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0x100
jl 0x10091d1e
mov byte [edi + 0xe48], 1
pop edi
pop esi
ret
Function at 0x1009c81d
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
add eax, 0xfffffffd
push esi
cmp eax, 9
push edi
ja case.0x1009c715.6
jmp dword [eax*4 + 0x1009c89c]
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1009c5e0
add esp, 4
and eax, 0xffff
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
pop edi
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x1c]
push edx
call fcn.1009c680
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
fild qword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret
mov esi, dword [esp + 0x1c]
push esi
call fcn.1009c680
xor edi, edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edi
push esi
fild qword [esp + 0x10]
fstp qword [esp + 0x10]
call fcn.1009c680
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edi
fild qword [esp + 0x18]
add esp, 8
fdivr qword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
push eax
call fcn.1009c5e0
movsx ecx, ax
add esp, 4
mov dword [esp + 0x1c], ecx
fild dword [esp + 0x1c]
pop edi
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x1c]
push edx
call fcn.1009c680
add esp, 4
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
pop edi
pop esi
add esp, 0x10
ret
mov esi, dword [esp + 0x1c]
push esi
call fcn.1009c680
mov dword [esp + 0x20], eax
push esi
fild dword [esp + 0x24]
fstp qword [esp + 0x10]
call fcn.1009c680
mov dword [esp + 0x24], eax
add esp, 8
fild dword [esp + 0x1c]
pop edi
pop esi
fdivr qword [esp]
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
push eax
call fcn.1009c680
push eax
call fcn.1009c6f0
add esp, 8
pop edi
pop esi
add esp, 0x10
ret
push ebp
push 0x1234
call dword [sym.imp.WS2_32.dll_ntohs]
mov ebp, dword [esp + 0x20]
xor ecx, ecx
cmp ax, 0x1234
sete cl
xor edx, edx
cmp word [ebp + 0x6244], 0x4949
sete dl
xor eax, eax
cmp edx, ecx
sete al
lea edi, [eax*8]
sub edi, eax
xor esi, esi
mov ecx, dword [ebp + 4]
mov eax, dword [ebp]
push ecx
call dword [eax + 0x1c]
mov edx, esi
add esp, 4
xor edx, edi
inc esi
cmp esi, 8
mov byte [esp + edx + 0xc], al
jl 0x1009c856
fld qword [esp + 0xc]
pop ebp
pop edi
pop esi
add esp, 0x10
ret
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov ecx, dword [eax]
push edx
call dword [ecx + 0x1c]
add esp, 4
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
pop edi
pop esi
add esp, 0x10
ret
Function at 0x100a4cb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
test eax, eax
je 0x100a4d55
mov eax, dword [esp + 0x14]
mov ecx, 0x100ff19c
imul eax, eax, 0x2e90edd
inc eax
mov dword [ecx], eax
add ecx, 4
cmp ecx, 0x100ff1ac
jb 0x100a4cc6
mov eax, dword [0x100ff1a4]
mov esi, dword [0x100ff19c]
mov ecx, dword [0x100ff1a8]
xor eax, esi
shr eax, 0x1f
lea edx, [ecx + ecx]
or eax, edx
mov dword [0x100ff1a8], eax
mov eax, 0x100ff1a0
mov ecx, dword [eax - 4]
mov edx, dword [eax + 4]
mov esi, dword [eax]
xor ecx, edx
mov edx, dword [eax + 8]
add eax, 4
xor edx, esi
shl ecx, 1
shr edx, 0x1f
or ecx, edx
cmp eax, 0x100ff38c
mov dword [eax + 8], ecx
jb 0x100a4cff
mov esi, dword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [0x100ff138], ecx
mov eax, dword [ecx*4 + 0x100ff19c]
push eax
call esi
mov ecx, dword [0x100ff138]
mov dword [ecx*4 + 0x100ff19c], eax
inc ecx
cmp ecx, 0x7f
mov dword [0x100ff138], ecx
jb 0x100a4d30
jmp 0x100a4d5b
mov ecx, dword [0x100ff138]
mov eax, dword [esp + 0xc]
mov edx, eax
dec eax
test edx, edx
je 0x100a4db2
mov edx, dword [esp + 8]
push ebx
push edi
lea esi, [eax + 1]
lea eax, [ecx - 0x3f]
lea edi, [ecx + 1]
and eax, 0x7f
and edi, 0x7f
and ecx, 0x7f
add edx, 4
mov eax, dword [eax*4 + 0x100ff19c]
mov ebx, dword [edi*4 + 0x100ff19c]
xor eax, ebx
mov dword [ecx*4 + 0x100ff19c], eax
mov ecx, dword [edx - 4]
xor ecx, eax
mov dword [edx - 4], ecx
mov ecx, dword [0x100ff138]
inc ecx
dec esi
mov dword [0x100ff138], ecx
jne 0x100a4d6f
pop edi
pop ebx
pop esi
ret
Function at 0x100a7969
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
xor esi, esi
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x78]
add eax, edi
mov ecx, dword [eax + 0x20]
mov ebx, dword [eax + 0x1c]
add ecx, edi
mov ebp, dword [eax + 0x24]
add ebx, edi
mov eax, dword [eax + 0x18]
add ebp, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
test eax, eax
je 0x100a79ba
mov ecx, dword [ecx + esi*4]
add ecx, edi
call fcn.100a7920
cmp eax, dword [esp + 0x10]
je 0x100a79c4
mov ecx, dword [esp + 0x18]
inc esi
cmp esi, dword [esp + 0x14]
jb 0x100a799f
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
movzx eax, word [ebp + esi*2]
mov eax, dword [ebx + eax*4]
add eax, edi
jmp 0x100a79bc
Function at 0x100ae670
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x24]
xor ebp, ebp
mov edx, dword [esi + 4]
mov ax, word [esi + 0x6244]
mov ecx, dword [esi]
push ebp
push edi
push edx
mov dword [esp + 0x18], ebp
mov word [esp + 0x24], ax
call dword [ecx + 8]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push ecx
call dword [eax + 0x1c]
add esp, 0x10
test eax, eax
jne 0x100ae853
mov eax, dword [esi + 4]
mov edx, dword [esi]
push eax
call dword [edx + 0x1c]
add esp, 4
sub eax, 0x4d
jne 0x100ae853
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push edx
call dword [ecx + 0x1c]
add esp, 4
sub eax, 0x52
jne 0x100ae853
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push ecx
call dword [eax + 0x1c]
mov edx, eax
push esi
shl edx, 8
add edx, eax
mov word [esi + 0x6244], dx
call fcn.1009c680
mov ecx, dword [esi + 4]
lea edi, [eax + edi + 8]
mov eax, dword [esi]
push ecx
mov dword [esp + 0x30], edi
call dword [eax + 0x18]
add esp, 0xc
cmp eax, edi
mov dword [esp + 0x20], eax
jge 0x100ae834
push ebx
xor edi, edi
mov ebx, 4
mov eax, dword [esi + 4]
mov edx, dword [esi]
push eax
call dword [edx + 0x1c]
shl edi, 8
add esp, 4
or edi, eax
dec ebx
jne 0x100ae71e
push esi
call fcn.1009c680
add esp, 4
cmp edi, 0x505244
mov dword [esp + 0x18], eax
je 0x100ae7d1
cmp edi, 0x545457
je 0x100ae7b2
cmp edi, 0x574247
jne 0x100ae7ff
push esi
call fcn.1009c680
lea ecx, [esi + 0x6495]
push str.A200
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, eax
add esp, 0xc
neg edi
sbb edi, edi
and edi, 3
xor ebx, ebx
push esi
call fcn.1009c5e0
mov edx, ebx
and eax, 0xffff
sar edx, 1
mov dword [esp + 0x18], eax
xor edx, ebx
fild dword [esp + 0x18]
add esp, 4
xor edx, edi
inc ebx
fstp dword [esi + edx*4 + 0xe6bc]
cmp ebx, 4
jl 0x100ae785
jmp 0x100ae7ff
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push ecx
call dword [eax + 0x18]
push eax
push esi
call fcn.100ae080
mov edx, dword [esp + 0x34]
add esp, 0xc
mov dword [esi + 0x658c], edx
jmp 0x100ae7ff
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push 1
push 8
push ecx
call dword [eax + 8]
push esi
call fcn.1009c5e0
mov bp, ax
push esi
and ebp, 0xffff
call fcn.1009c5e0
add esp, 0x14
and eax, 0xffff
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov edx, dword [esi]
push 0
lea eax, [ecx + eax + 8]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [edx + 8]
mov eax, dword [esi + 4]
mov edx, dword [esi]
push eax
call dword [edx + 0x18]
mov ecx, dword [esp + 0x38]
add esp, 0x10
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x100ae717
pop ebx
mov cx, word [esp + 0xc]
mov dx, word [esp + 0x18]
mov word [esi + 0x65f8], bp
mov word [esi + 0x65fa], cx
mov word [esi + 0x6244], dx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x100afd10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push 0
push ecx
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edx
call dword [eax + 8]
push esi
call fcn.1009c680
add esp, 0x10
cmp eax, 0xff
ja 0x100afe64
mov ecx, eax
dec eax
test ecx, ecx
je 0x100afe4c
push ebx
inc eax
push ebp
push edi
mov dword [esp + 0x14], eax
push esi
call fcn.1009c5e0
mov di, ax
push esi
and edi, 0xffff
call fcn.1009c5e0
mov edx, dword [esi]
mov bx, ax
mov eax, dword [esi + 4]
and ebx, 0xffff
push eax
call dword [edx + 0x18]
add esp, 0xc
cmp edi, 0x100
mov ebp, eax
jne 0x100afda2
push esi
call fcn.1009c5e0
push esi
mov word [esi + 0x65f8], ax
call fcn.1009c5e0
add esp, 8
mov word [esi + 0x65fa], ax
jmp 0x100afe29
cmp edi, 0x121
jne 0x100afdd8
push esi
call fcn.1009c5e0
push esi
mov word [esi + 0x65fc], ax
call fcn.1009c5e0
add esp, 8
cmp ax, 0x10bc
mov word [esi + 0x65fe], ax
jne 0x100afe29
mov word [esi + 0x65fe], 0x10bf
jmp 0x100afe29
cmp edi, 0x130
jne 0x100afdf7
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push edx
call dword [ecx + 0x1c]
add esp, 4
sar eax, 7
mov dword [esi + 0x65b0], eax
jmp 0x100afe29
cmp edi, 0x2ff0
jne 0x100afe29
xor edi, edi
push esi
call fcn.1009c5e0
and eax, 0xffff
add esp, 4
mov dword [esp + 0x18], eax
mov eax, edi
fild dword [esp + 0x18]
xor eax, 1
inc edi
cmp edi, 4
fstp dword [esi + eax*4 + 0xe6bc]
jb 0x100afe01
mov edx, dword [esi + 4]
mov ecx, dword [esi]
add ebp, ebx
push 0
push ebp
push edx
call dword [ecx + 8]
mov eax, dword [esp + 0x20]
add esp, 0xc
dec eax
mov dword [esp + 0x14], eax
jne 0x100afd4c
pop edi
pop ebp
pop ebx
mov ax, word [esi + 0x65b0]
mov cx, ax
shl word [esi + 0x65fc], cl
shr word [esi + 0x65fe], cl
pop esi
ret
Function at 0x100b75b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x100b75e0
push esi
call fcn.100b7c80
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x100b75d9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100b7663
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x100b764f
mov eax, dword [esi + 8]
test eax, eax
je 0x100b7604
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x100b764b
cmp eax, 2
je 0x100b764f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100b75f7
cmp eax, 3
je 0x100b762a
cmp eax, 1
jne 0x100b75f7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100b75f7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100b75f7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.100b7690
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x100b7683
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.100b7690
add esp, 4
pop esi
ret

Function at 0x100b8700
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 0xc]
cmp ecx, 0xc
jb 0x100b87ba
mov eax, dword [esp + 8]
cmp byte [eax], 0x41
jne 0x100b87ba
cmp byte [eax + 1], 0x64
jne 0x100b87ba
cmp byte [eax + 2], 0x6f
jne 0x100b87ba
cmp byte [eax + 3], 0x62
jne 0x100b87ba
cmp byte [eax + 4], 0x65
jne 0x100b87ba
push ebx
xor ecx, ecx
mov cl, byte [eax + 7]
push ebp
push esi
push edi
mov edi, ecx
xor edx, edx
mov dl, byte [eax + 8]
xor ecx, ecx
mov cl, byte [eax + 9]
mov esi, dword [esp + 0x14]
shl edi, 8
add edi, edx
mov ebp, ecx
xor edx, edx
xor ecx, ecx
mov dl, byte [eax + 0xa]
mov cl, byte [eax + 0xb]
shl ebp, 8
add ebp, edx
xor edx, edx
mov dl, byte [eax + 5]
xor ebx, ebx
mov bl, byte [eax + 6]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi]
mov dword [ecx + 0x1c], edi
shl edx, 8
add ecx, 0x18
add edx, ebx
mov ebx, dword [esp + 0x1c]
push 1
mov dword [ecx], edx
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], ebx
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x4c
mov ecx, dword [esi]
call dword [ecx + 4]
add esp, 8
mov byte [esi + 0x108], 1
mov byte [esi + 0x109], bl
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 4]
push 1
push eax
mov edx, dword [eax]
mov dword [edx + 0x14], 0x4e
mov edx, dword [esp + 0x18]
add ecx, edx
mov edx, dword [eax]
mov dword [edx + 0x18], ecx
mov ecx, dword [eax]
call dword [ecx + 4]
add esp, 8
ret
Function at 0x100bbd60
Capabilities:
Query environment variable

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov dword [edi + 4], ebx
call fcn.100714e0
push 0x54
push edi
mov dword [esp + 0x18], eax
call fcn.100c3200
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x100bbda4
push edi
call fcn.1008e420
mov eax, dword [edi]
push edi
mov dword [eax + 0x14], 0x36
mov ecx, dword [edi]
mov dword [ecx + 0x18], ebx
mov edx, dword [edi]
call dword [edx]
add esp, 8
mov dword [esi], fcn.100bbea0
mov dword [esi + 4], fcn.100bbff0
mov dword [esi + 8], fcn.100bc0a0
mov dword [esi + 0xc], fcn.100bc150
mov dword [esi + 0x10], 0x100bc200
mov dword [esi + 0x14], 0x100bc270
mov dword [esi + 0x18], 0x100bc2e0
mov dword [esi + 0x1c], 0x100bc460
mov dword [esi + 0x20], 0x100bc650
mov dword [esi + 0x24], fcn.100bc840
mov dword [esi + 0x28], 0x100bc940
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 0xc]
mov ecx, 2
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x40]
mov dword [eax - 8], ebx
mov dword [eax], ebx
sub eax, 4
dec ecx
jne 0x100bbe06
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
cmp eax, ebx
je 0x100bbe98
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push ecx
push edx
push str._ld_c
push eax
mov byte [esp + 0x24], 0x78
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x100bbe98
mov al, byte [esp + 0x14]
cmp al, 0x6d
je 0x100bbe61
cmp al, 0x4d
jne 0x100bbe85
mov eax, dword [esp + 0xc]
pop edi
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop esi
pop ebx
pop ecx
ret
mov eax, dword [esp + 0xc]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4eaad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x98000]
push edi
or ebp, 0xffffffff
jmp 0x4eaaf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4eaaf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eaae8
mov eax, 1
add ebx, ebx
jne 0x4eab0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4eab1c
jne 0x4eab3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eab3b
dec eax
add ebx, ebx
jne 0x4eab28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4eab00
add ebx, ebx
jne 0x4eab37
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4eab8d
xor ecx, ecx
sub eax, 3
jb 0x4eab53
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4eabc2
sar eax, 1
mov ebp, eax
jmp 0x4eab5e
add ebx, ebx
jne 0x4eab5e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eab2c
inc ecx
add ebx, ebx
jne 0x4eab6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4eab2c
add ebx, ebx
jne 0x4eab79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4eab6e
jne 0x4eab8a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4eab6e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4eabac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4eab9e
jmp 0x4eaaee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4eabac
add edi, ecx
jmp 0x4eaaee
pop esi
mov edi, esi
mov ecx, 0x7163
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4eabca
cmp byte [edi], 0xe
jne 0x4eabca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4eabcf
lea edi, [esi + 0xe7000]
mov eax, dword [edi]
or eax, eax
je 0x4eac47
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeefd8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xef104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4eabfc
mov ecx, edi
jns 0x4eac2b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xef108]
or eax, eax
je 0x4eac41
mov dword [ebx], eax
add ebx, 4
jmp 0x4eac19
call dword [esi + 0xef110]
mov ebp, dword [esi + 0xef10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4eac7b
sub esp, 0xffffff80
jmp 0x47f2c7
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7c8179e9
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x33d7625b
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x43e256
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x43e256
lcall 0x5de5, 0x8b10c483
jmp loc.00969540
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1825750
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x600000]
push edi
or ebp, 0xffffffff
jmp 0x1825772
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1825779
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1825768
mov eax, 1
add ebx, ebx
jne 0x182578b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x182579c
jne 0x18257bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18257bb
dec eax
add ebx, ebx
jne 0x18257a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1825780
add ebx, ebx
jne 0x18257b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x182580d
xor ecx, ecx
sub eax, 3
jb 0x18257d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1825842
sar eax, 1
mov ebp, eax
jmp 0x18257de
add ebx, ebx
jne 0x18257de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18257ac
inc ecx
add ebx, ebx
jne 0x18257ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x18257ac
add ebx, ebx
jne 0x18257f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x18257ee
jne 0x182580a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x18257ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x182582c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x182581e
jmp 0x182576e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x182582c
add edi, ecx
jmp 0x182576e
pop esi
mov edi, esi
mov ecx, 0x1cc29
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x182584a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x182584f
lea edi, [esi + 0x921000]
mov eax, dword [edi]
or eax, eax
je 0x18258b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9a192c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9a1a58]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1825875
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9a1a5c]
or eax, eax
je 0x18258b1
mov dword [ebx], eax
add ebx, 4
jmp 0x1825892
call dword [esi + 0x9a1a6c]
mov ebp, dword [esi + 0x9a1a60]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x18258eb
sub esp, 0xffffff80
jmp 0x12d1cd4