joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1035b0c0
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
lea ecx, [esp]
push esi
push eax
push ecx
call fcn.1035b080
push 0
push 0x80
push 3
push 0
push 3
lea edx, [esp + 0x18]
push 0xc0000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x1035b12f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1035b116
cmp eax, 3
ja 0x1035b116
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x1035b124
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x1035b140
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x10
mov al, 0x5c
push esi
mov byte [esp + 4], al
mov byte [esp + 5], al
mov byte [esp + 7], al
push 0
mov al, 0x6e
push 0x80
push 3
mov byte [esp + 0x15], al
mov byte [esp + 0x17], al
push 0
push 3
lea eax, [esp + 0x18]
push 0xc0000000
push eax
mov byte [esp + 0x22], 0x2e
mov byte [esp + 0x24], 0x53
mov byte [esp + 0x26], 0x74
mov byte [esp + 0x28], 0x6c
mov byte [esp + 0x29], 0x55
mov byte [esp + 0x2a], 0x73
mov byte [esp + 0x2b], 0x62
mov byte [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x1035b1e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x1035b1c7
cmp eax, 3
ja 0x1035b1c7
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov esi, dword [esi]
cmp esi, 0xffffffff
je 0x1035b1d5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8

Function at 0x10361890
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebx, 4
sub esi, ecx
lea eax, [edi + ecx]
lea edx, [esp + ebp + 0x10]
add edi, ebx
mov cl, byte [esi + eax]
mov byte [edx], cl
mov byte [eax], cl
add edx, 4
inc eax
dec ebx
jne 0x103618b3
inc ebp
cmp ebp, 4
jl 0x1036189b
cmp edi, 0xb0
jge 0x1036196a
mov ebp, 0x103402f8
xor eax, eax
lea ecx, [esp + 0x10]
inc eax
mov edx, eax
and edx, reloc.WSOCK32.dll_closesocket
jns 0x103618ee
dec edx
or edx, 0xfffffffc
inc edx
xor ebx, ebx
add ecx, 4
mov bl, byte [esp + edx*4 + 0x13]
mov dl, byte [ebx + 0x103400f8]
mov bl, byte [ecx - 4]
xor bl, dl
cmp eax, 4
mov byte [ecx - 4], bl
jl 0x103618de
mov al, byte [ebp]
mov cl, byte [esp + 0x10]
xor cl, al
add ebp, 4
mov byte [esp + 0x10], cl
mov esi, 1
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov dl, byte [eax - 1]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
add eax, 4
dec ecx
jne 0x10361928
inc esi
cmp esi, 4
jl 0x1036191f
xor esi, esi
lea eax, [esp + esi + 0x10]
mov ecx, 4
mov ebx, dword [esp + 0x24]
mov dl, byte [eax]
add eax, 4
mov byte [edi + ebx], dl
inc edi
dec ecx
jne 0x10361948
inc esi
cmp esi, 4
jl 0x1036193f
cmp edi, 0xb0
jl 0x103618d8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10361980
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebp
push esi
call fcn.10361a10
add esp, 8
lea edi, [ebp + 0x10]
mov ebx, 9
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x103400f8]
mov byte [eax + esi - 1], dl
jl 0x103619a0
push 0
push esi
call fcn.10361a40
push esi
call fcn.10361a90
push edi
push esi
call fcn.10361a10
add esp, 0x14
add edi, 0x10
dec ebx
jne 0x1036199e
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x103400f8]
mov byte [eax + esi - 1], dl
jl 0x103619d5
push 0
push esi
call fcn.10361a40
add ebp, 0xa0
push ebp
push esi
call fcn.10361a10
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10361a10
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push ebx
push esi
sub ecx, eax
mov esi, 0x10
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x10361a21
pop esi
pop ebx
ret

Function at 0x10361bb0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
lea eax, [ebp + 0xa0]
push eax
push esi
call fcn.10361a10
add esp, 8
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x103401f8]
mov byte [eax + esi - 1], dl
jl 0x10361bce
push 0x10
push esi
call fcn.10361a40
add esp, 8
lea edi, [ebp + 0x90]
mov ebx, 9
push edi
push esi
call fcn.10361a10
push esi
call fcn.10361c40
add esp, 0xc
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + esi]
inc eax
cmp eax, 0x10
mov dl, byte [ecx + 0x103401f8]
mov byte [eax + esi - 1], dl
jl 0x10361c0b
push 0x10
push esi
call fcn.10361a40
add esp, 8
sub edi, 0x10
dec ebx
jne 0x10361bf9
push ebp
push esi
call fcn.10361a10
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10361c40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
xor edi, edi
lea eax, [esp + edi + 0x14]
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
sub eax, ecx
mov esi, 1
mov dword [esp + 0x10], eax
lea edx, [esi - 2]
and edx, 3
add edx, edi
mov al, byte [edx + ebp]
push eax
push 9
call fcn.10361b60
lea ecx, [esi + 1]
mov bl, al
and ecx, 3
add ecx, edi
mov dl, byte [ecx + ebp]
push edx
push 0xd
call fcn.10361b60
xor bl, al
mov eax, esi
and eax, 3
add eax, edi
mov cl, byte [eax + ebp]
push ecx
push 0xb
call fcn.10361b60
mov edx, dword [esp + 0x28]
xor bl, al
mov eax, dword [esp + 0x40]
mov cl, byte [edx + eax]
push ecx
push 0xe
call fcn.10361b60
add esp, 0x20
xor bl, al
mov eax, dword [esp + 0x28]
inc esi
mov byte [eax], bl
lea edx, [esi - 1]
inc eax
cmp edx, 4
mov dword [esp + 0x28], eax
jl 0x10361c66
add edi, 4
cmp edi, 0x10
jl 0x10361c4d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ebp], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
pop edi
mov dword [ebp + 0xc], eax
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x1036f4b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x1036f4d3
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.1036f1a0
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.1036f1f0
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.1036f290
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.1034d600
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x10340b54
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1036f583
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.1036f480
test ax, ax
je 0x1036f54d
and eax, 0xffff
mov byte [esp + eax + 8], 0
cmp byte [esp + 8], 0x30
jne 0x1036f56f
mov al, byte [esp + 9]
and al, 0xdf
cmp al, 0x58
jne 0x1036f56f
lea ecx, [esp + 0xa]
push esi
push ecx
call fcn.1034d710
test al, al
jne 0x1036f583
jmp 0x1036f57e
lea edx, [esp + 8]
push esi
push edx
call fcn.1034d670
test al, al
jne 0x1036f583
mov word [esi], 0
mov ax, word [esi]
test ax, ax
je 0x1036f59e
cmp ax, 0xffff
je 0x1036f59e
pop esi
mov eax, 1
pop ebx
add esp, 0x40
ret 8
pop esi
xor eax, eax
pop ebx
add esp, 0x40
ret 8
Function at 0x1036f5b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x40
push ebx
mov bx, word [esp + 0x48]
push esi
mov esi, dword [esp + 0x50]
cmp bx, 4
mov word [esi], 0
jbe 0x1036f5d3
pop esi
xor al, al
pop ebx
add esp, 0x40
ret 8
lea eax, [esp + 0x28]
push 0x10
push eax
call fcn.1036f1a0
lea ecx, [esp + 0x38]
push 0x10
push ecx
call fcn.1036f1f0
lea edx, [esp + 0x18]
push 0x10
push edx
call fcn.1036f290
lea eax, [esp + 0x18]
add bl, 0x31
push eax
call fcn.1034d600
and eax, 0xffff
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0xc]
mov byte [esp + eax + 0x1c], bl
push 0x10
push edx
lea eax, [esp + 0x24]
push 0x10340b54
lea ecx, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1036f67e
lea edx, [esp + 8]
push 0x2c
push edx
call fcn.1036f480
test ax, ax
je 0x1036f67e
and eax, 0xffff
mov cl, byte [esp + eax + 9]
and cl, 0xdf
cmp cl, 0x54
jne 0x1036f67e
cmp byte [esp + eax + 0xa], 0x3a
jne 0x1036f67e
lea edx, [esp + eax + 0xb]
push esi
push edx
call fcn.1034d670
test al, al
je 0x1036f679
mov ax, word [esi]
cmp ax, 1
jl 0x1036f679
cmp ax, 7
jle 0x1036f67e
mov word [esi], 0
xor eax, eax
cmp word [esi], ax
pop esi
pop ebx
setne al
add esp, 0x40
ret 8

Function at 0x1036f690
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push 0x10
push eax
call fcn.1036f1a0
lea ecx, [esp + 0x24]
push 0x10
push ecx
call fcn.1036f1f0
lea edx, [esp + 0x14]
push 0x10
push edx
call fcn.1036f350
lea eax, [esp + 0x44]
push 0x10
push eax
call fcn.1036f310
lea ecx, [esp + 4]
lea edx, [esp + 0x34]
push ecx
push 0x10
push edx
lea eax, [esp + 0x20]
push 0x10340b54
lea ecx, [esp + 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x1036f700
lea edx, [esp + 0x34]
lea eax, [esp + 0x44]
push edx
push eax
call fcn.1034d4b0
mov ecx, dword [esp + 0x5c]
mov byte [ecx], al
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x50
ret 8

Function at 0x1036f710
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x30
lea eax, [esp]
push 0x10
push eax
call fcn.1036f1a0
lea ecx, [esp + 0x20]
push 0x10
push ecx
call fcn.1036f1f0
lea edx, [esp + 0x10]
push 0x10
push edx
call fcn.1036f2d0
lea eax, [esp]
lea ecx, [esp + 0x10]
push eax
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor edx, edx
mov ecx, dword [esp + 0x34]
test eax, eax
setne dl
mov word [ecx], ax
mov al, dl
add esp, 0x30
ret 4
Function at 0x1036f770
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x70
lea eax, [esp]
push esi
mov esi, dword [esp + 0x78]
push 0x10
push 0
push eax
mov word [esi], 0
call fcn.1034d620
lea ecx, [esp + 0x14]
push 0x10
push ecx
call fcn.1036f1a0
lea edx, [esp + 0x34]
push 0x10
push edx
call fcn.1036f1f0
lea eax, [esp + 0x24]
push 0x10
push eax
call fcn.1036f240
lea ecx, [esp + 0x44]
push 0x10
push ecx
call fcn.1036f3a0
lea edx, [esp + 0x54]
push 0x10
push edx
call fcn.1036f430
lea eax, [esp + 0x64]
push 0x10
push eax
call fcn.1036f3f0
lea ecx, [esp + 0x14]
lea edx, [esp + 4]
push ecx
push 0x10
push edx
lea eax, [esp + 0x30]
push 0x10340b54
lea ecx, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1036f85e
lea edx, [esp + 0x44]
lea eax, [esp + 4]
push edx
push eax
call fcn.1034d4b0
test al, al
je 0x1036f81f
xor eax, eax
mov word [esi], 2
cmp word [esi], ax
pop esi
setne al
add esp, 0x70
ret 4
lea ecx, [esp + 0x54]
lea edx, [esp + 4]
push esp
and al, 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10004610
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x1000466d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10004630
mov eax, dword [esi]
jmp 0x1000474b
cmp eax, 0x4e0
jb 0x1000474b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10004686
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x100046d1
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0xf07450
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, eax
lea ebx, [ebx + ebx*4 + 0x3711]
mov dl, byte [esi]
nop
shr eax, 8
xor dl, bl
and edi, 0xff
mov byte [esi], dl
xor edi, edx
inc esi
xor eax, dword [edi*4 + 0xf07050]
dec ecx
jne fcn.00f07450
ret
Function at 0x412f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x412f9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412fa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412f90
mov eax, 1
add ebx, ebx
jne 0x412fb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412fa8
jne 0x412fc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412fa8
xor ecx, ecx
sub eax, 3
jb 0x412fd8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41304a
mov ebp, eax
add ebx, ebx
jne 0x412fe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412ff0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413014
inc ecx
add ebx, ebx
jne 0x413000
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412ff5
jne 0x413011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412ff5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413034
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413025
jmp 0x412f96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413034
add edi, ecx
jmp 0x412f96
pop esi
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x41309c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15330]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x153ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413051
mov ecx, edi
jns 0x413080
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x153f4]
or eax, eax
je 0x413096
mov dword [ebx], eax
add ebx, 4
jmp 0x41306e
call dword [esi + 0x153f0]
mov ebp, dword [esi + 0x153f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4130d0
sub esp, 0xffffff80
jmp 0x403ac6

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x423300
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x42331a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x423321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x423310
mov eax, 1
add ebx, ebx
jne 0x423333
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x423328
jne 0x423344
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423328
xor ecx, ecx
sub eax, 3
jb 0x423358
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4233ca
mov ebp, eax
add ebx, ebx
jne 0x423363
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423370
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423394
inc ecx
add ebx, ebx
jne 0x423380
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423375
jne 0x423391
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423375
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4233b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4233a5
jmp 0x423316
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4233b4
add edi, ecx
jmp 0x423316
pop esi
mov edi, esi
mov ecx, 0x446
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4233d2
cmp byte [edi], 0xd
jne 0x4233d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4233d7
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x42344f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423404
mov ecx, edi
jns 0x423433
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23058]
or eax, eax
je 0x423449
mov dword [ebx], eax
add ebx, 4
jmp 0x423421
call dword [esi + 0x23054]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x423480
cmp al, 0xef
ja 0x423473
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x423455
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x423462
mov ebp, dword [esi + 0x2305c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4234b4
sub esp, 0xffffff80
jmp 0x404883
Function at 0x70fa20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa6000]
mov dword [edi + 0xe7710], 0xcc2f6d20
push edi
jmp 0x70fa4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x70fa51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70fa40
mov eax, 1
add ebx, ebx
jne 0x70fa63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70fa74
jne 0x70fa93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70fa93
dec eax
add ebx, ebx
jne 0x70fa80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x70fa58
add ebx, ebx
jne 0x70fa8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x70fae5
xor ecx, ecx
sub eax, 3
jb 0x70faab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x70fb1a
sar eax, 1
mov ebp, eax
jmp 0x70fab6
add ebx, ebx
jne 0x70fab6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70fa84
inc ecx
add ebx, ebx
jne 0x70fac4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70fa84
add ebx, ebx
jne 0x70fad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x70fac6
jne 0x70fae2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x70fac6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x70fb04
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x70faf6
jmp 0x70fa46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x70fb04
add edi, ecx
jmp 0x70fa46
pop esi
mov edi, esi
mov ecx, 0x3717
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x70fb22
cmp byte [edi], 0x11
jne 0x70fb22
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x70fb27
lea edi, [esi + 0x305000]
mov eax, dword [edi]
or eax, eax
je 0x70fb9f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x331054]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3311f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x70fb54
mov ecx, edi
jns 0x70fb83
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3311fc]
or eax, eax
je 0x70fb99
mov dword [ebx], eax
add ebx, 4
jmp 0x70fb71
call dword [esi + 0x3311f8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x70fbd0
cmp al, 0xef
ja 0x70fbc3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x70fba5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x70fbb2
mov ebp, dword [esi + 0x331200]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x70fc04
sub esp, 0xffffff80
jmp 0x493a78