joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10140240
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101803ab
call fcn.1006eb8a
mov eax, dword [0x1017d918]
mov dword [ebp - 8], eax
jmp 0x10140277
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10140290
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x1014028e
mov eax, dword [ebp - 8]
jmp 0x10140313
jmp 0x1014026f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1006e2ed
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10140310
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
cmp eax, 0xfe0
jbe 0x101402d3
mov eax, dword [ebp - 8]
mov ecx, dword [0x1017d918]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [0x1017d918], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006e2ed
mov esp, ebp
pop ebp
ret
Function at 0x10141de0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10176880]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10180533
call fcn.1006eb8a
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1017d900]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10141e4d
mov eax, dword [ebp - 0x30]
sub eax, 5
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [ebp - 0x24], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1006e2ed
test eax, eax
jne 0x10141e78
mov eax, 0xa
jmp 0x10141f7a
cmp dword [ebp + 0xc], 0
je 0x10141ec5
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x30]
add eax, 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [eax + 1], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10141ec3
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x48]
mov byte [eax + 1], 0xf9
jmp 0x10141f01
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10141eec
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.1006ea3b
add esp, 0xc
jmp 0x10141f01
push 5
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.1006ea3b
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1006e2ed
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1006e2ed
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1006e2ed
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10141fac]
call fcn.1006dfaf
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006db4f
add esp, 0x10c
cmp ebp, esp
call fcn.1006e2ed
mov esp, ebp
pop ebp
ret
Function at 0x10142100
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10176880]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10180533
call fcn.1006eb8a
push 0
push 4
call fcn.1006daa0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1014228b
mov dword [ebp - 0x30], 0x1c
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1006d96a
test eax, eax
je 0x10142278
cmp dword [ebp - 0x30], 0x10
jb 0x1014225c
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.1006e2ed
cmp dword [ebp - 0x24], eax
jne 0x1014225c
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.1006e2ed
cmp dword [ebp - 0x28], eax
je 0x1014225c
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x101421e3
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
mov esi, esp
push ecx
push 0
mov edx, dword [0x1017d4ac]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.1006e2ed
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x101421e1
jmp 0x10142278
jmp 0x1014223c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x1014223c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1017d4ac]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.1006e2ed
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x10142226
jmp 0x10142278
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [ebp - 0x28]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 0x30], 0x1c
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1006d0d7
test eax, eax
jne 0x10142161
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1006e2ed
push edx
mov ecx, ebp
push eax
lea edx, [0x101422bc]
call fcn.1006dfaf
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006db4f
add esp, 0x100
cmp ebp, esp
call fcn.1006e2ed
mov esp, ebp
pop ebp
ret
Function at 0x10142560
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10180533
call fcn.1006eb8a
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10142100
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x1014263b
mov dword [ebp - 8], 0
jmp 0x101425cc
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1014263b
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1006e2ed
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10142639
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1006e2ed
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.10143340
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1006e2ed
jmp 0x101425c3
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006e2ed
mov esp, ebp
pop ebp
ret

Function at 0x101436f0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10180533
call fcn.1006eb8a
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x101437ac
mov dword [ebp - 8], 0
jmp 0x10143733
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x1014378e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1006e2ed
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1014378c
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1006e2ed
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1006e2ed
jmp 0x1014372a
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x1017d4ac]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1006e2ed
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006e2ed
mov esp, ebp
pop ebp
ret
Function at 0x10143ee0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101805f7
call fcn.1006eb8a
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10143f48
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x10143f48
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x10143f48
xor eax, eax
jmp 0x10143f89
mov dword [ebp - 8], 1
jmp 0x10143f5a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x10143f84
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10143f82
xor eax, eax
jmp 0x10143f89
jmp 0x10143f51
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1006e2ed
mov esp, ebp
pop ebp
ret
Function at 0x100135b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
jmp 0x100135ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100135d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100135c0
mov eax, 1
add ebx, ebx
jne 0x100135e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100135d8
jne 0x100135f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100135d8
xor ecx, ecx
sub eax, 3
jb 0x10013608
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1001367a
mov ebp, eax
add ebx, ebx
jne 0x10013613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x10013620
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x10013644
inc ecx
add ebx, ebx
jne 0x10013630
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10013625
jne 0x10013641
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10013625
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10013664
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10013655
jmp 0x100135c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10013664
add edi, ecx
jmp 0x100135c6
pop esi
mov edi, esi
mov ecx, 0x557
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10013682
cmp byte [edi], 6
jne 0x10013682
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10013687
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x100136ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13640]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x136e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100136b4
mov ecx, edi
jns 0x100136e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x136f0]
or eax, eax
je 0x100136f9
mov dword [ebx], eax
add ebx, 4
jmp 0x100136d1
call dword [esi + 0x136ec]
mov ebp, dword [esi + 0x136f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10013733
sub esp, 0xffffff80
jmp 0x1000c004
Function at 0x412fd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x412ff2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412ff9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412fe8
mov eax, 1
add ebx, ebx
jne 0x41300b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413000
jne 0x41301c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413000
xor ecx, ecx
sub eax, 3
jb 0x413030
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4130a2
mov ebp, eax
add ebx, ebx
jne 0x41303b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413048
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41306c
inc ecx
add ebx, ebx
jne 0x413058
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41304d
jne 0x413069
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41304d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41308c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41307d
jmp 0x412fee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41308c
add edi, ecx
jmp 0x412fee
pop esi
mov edi, esi
mov ecx, 0x3b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4130aa
cmp byte [edi], 1
jne 0x4130aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4130af
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x41311e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13208]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13244]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4130dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1324c]
or eax, eax
je 0x413118
mov dword [ebx], eax
add ebx, 4
jmp 0x4130f9
call dword [esi + 0x13248]
mov ebp, dword [esi + 0x13250]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x413152
sub esp, 0xffffff80
jmp 0x401130
Function at 0x9c0e80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x563000]
push edi
jmp 0x9c0e9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9c0ea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c0e90
mov eax, 1
add ebx, ebx
jne 0x9c0eb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9c0ec4
jne 0x9c0ee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c0ee3
dec eax
add ebx, ebx
jne 0x9c0ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x9c0ea8
add ebx, ebx
jne 0x9c0edf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9c0f35
xor ecx, ecx
sub eax, 3
jb 0x9c0efb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9c0f6a
sar eax, 1
mov ebp, eax
jmp 0x9c0f06
add ebx, ebx
jne 0x9c0f06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c0ed4
inc ecx
add ebx, ebx
jne 0x9c0f14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9c0ed4
add ebx, ebx
jne 0x9c0f21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9c0f16
jne 0x9c0f32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9c0f16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9c0f54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9c0f46
jmp 0x9c0e96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9c0f54
add edi, ecx
jmp 0x9c0e96
pop esi
mov edi, esi
mov ecx, 0x40d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9c0f72
cmp byte [edi], 0x11
jne 0x9c0f72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9c0f77
lea edi, [esi + 0x5b9000]
mov eax, dword [edi]
or eax, eax
je 0x9c0fef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa9c844]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa9c9c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9c0fa4
mov ecx, edi
jns 0x9c0fd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa9c9c4]
or eax, eax
je 0x9c0fe9
mov dword [ebx], eax
add ebx, 4
jmp 0x9c0fc1
call dword [esi + 0xa9c9d4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9c1020
cmp al, 0xef
ja 0x9c1013
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9c0ff5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9c1002
mov ebp, dword [esi + 0xa9c9c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9c1054
sub esp, 0xffffff80
jmp 0x4204f7
Function at 0x410a85
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ret
push 0xffffffffffffffff
lea edx, [ebx + 6]
push dword [edx + 0x36]
lea esi, [edx - 6]
add dword [esp], ebx
inc edi
pop ecx
add edx, dword [ecx + 0x78]
add esi, dword [edx + 0x1a]
pop ecx
add ecx, 1
lea eax, [eax]
lodsd eax, dword [esi]
nop
cld
lea edi, [eax + ebx + 4]
cmp dword [edx + 0x12], ecx
lea eax, [eax]
lea ecx, [ecx]
mov ebp, ebp
je 0x410a55
cmp eax, ebx
and al, 0xff
xor eax, eax
imul eax, eax, 0xf
clc
push eax
movzx eax, byte [edi - 4]
sahf
cmp eax, esi
clc
neg eax
lea edi, [edi - 0xe]
jmp 0x410d63
mov esi, esi
sub edi, 0xfffffff1
add dword [esp], eax
pop eax
lea edx, [edx]
nop
cmp byte [edi - 4], 0xa
ja 0x410ab9
nop
mov eax, 0x643e4222
xor dword [esp - 4], eax
mov eax, dword [esp + 4]
sub dword [esp - 4], eax
cld
jne 0x410a9c
nop
cld
add edx, 0x1b
and al, al
push dword [edx - 5]
pop edi
add ecx, ecx
test eax, esi
add edi, ebx
sub eax, 0xdf3e1996
add al, 0x9c
cld
add ecx, ebx
mov esi, dword [edx + 3]
add eax, 0x4f623145
mov ax, word [ecx + esi]
cwde
inc ecx
dec ecx
not dh
test ecx, ecx
push dword [edi + eax*4]
inc edx
inc ecx
add dword [esp], ebx
pop esi
mov eax, dword [esp]
add esp, 8
jmp eax
Function at 0x40176f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401779
repz ret
jmp fcn.00401a16

Function at 0x5112de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x5112fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5112ec
add dl, dl
jne 0x511306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x511352
xor eax, eax
add dl, dl
jne 0x511313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x5113ef
add dl, dl
jne 0x511322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x51132d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x511338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x511343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x51134d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x5112f2
mov eax, 1
add dl, dl
jne 0x511360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x51136b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x511357
sub eax, 2
jne 0x51139a
mov ecx, 1
add dl, dl
jne 0x511380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x51138b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x511377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5112f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x5113b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x5113bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x5113a8
cmp eax, 0x7d00
jae 0x5113df
cmp eax, 0x500
jb 0x5113da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5112f2
cmp eax, 0x7f
ja 0x5113e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5112f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x51140b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5112f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x25814905
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x25814914
pop dword [ebp - 0x28]
mov eax, 0x5b2a1255
add eax, 0xca5736bf
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x47baf83c
sub dword [ebp - 0x38], 0xf968b2f1
mov dword [ebp - 0x34], 0x44e57cef
sub dword [ebp - 0x34], 0x12b230aa
mov dword [ebp - 0x30], 0x92b54c93
add dword [ebp - 0x30], 0xb996f79b
mov dword [ebp - 0x2c], 0x53a61973
sub dword [ebp - 0x2c], 0x53a61973
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x9e54ff67
add dword [ebp - 0x38], 0xd61d69ef
mov dword [ebp - 0x34], 0x471602c0
add dword [ebp - 0x34], 0xfa565eb5
mov dword [ebp - 0x30], 0xf7581947
add dword [ebp - 0x30], 0x6c175325
mov dword [ebp - 0x2c], 0x7c7782d3
sub dword [ebp - 0x2c], 0x7c7782d3
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xbcffec0f
add eax, 0x6881e471
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3e6ff
push 0
call eax
mov ecx, 0x4f8b
xor esi, esi
add esi, eax
mov edi, 0xbabbe20c
add edi, 0x6ac6b3f4
add edi, dword [ebp - 0x28]
mov ebx, 0x943cbe28
sub ebx, 0x7dd4f137
xor dword [ebp - 0x10], edx
mov edx, dword [edi]
add dword [ebp - 0x18], ecx
add edx, ebx
xor dword [ebp - 4], 0xec68fa10
mov dword [esi], edx
sub dword [ebp - 0x10], eax
add esi, 0x88184001
add esi, 0x77e7c003
add edi, 0xa6899081
add edi, 0x59766f83
loop 0x25814a2d
add eax, 0x130ff
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4f8090a3
sub ecx, 0x2a0090a3
add ecx, dword [ebp - 0x28]
call ebx
leave
ret