joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x10024c48
lea edi, [edx + eax*2]
xor ebx, ebx
movzx esi, byte [edx + 1]
cmp byte [edx], ch
lea edx, [edx + 2]
lea eax, [ebx + esi]
jne 0x10024c40
cmp ebx, eax
ja 0x10024cb6
cmp eax, dword [ebp + 0x10]
ja 0x10024cc2
add ebx, dword [ebp + 0xc]
nop word cs:[eax + eax]
nop
test esi, esi
je 0x10024c42
dec esi
cmp byte [ebx], cl
lea ebx, [ebx + 1]
jne 0x10024c30
jmp 0x10024c9f
ja 0x10024c48
cmp edx, edi
mov ebx, eax
jne 0x10024c02
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x10024ca3
mov esi, dword [ebp + 0x14]
movzx ecx, cx
mov al, 1
add edx, esi
nop dword [eax]
movzx ebx, byte [esi]
lea edi, [esi + 1]
test bl, bl
js 0x10024c80
mov esi, edi
sub ecx, ebx
jns 0x10024c97
jmp 0x10024ca5
cmp edi, edx
je 0x10024cac
movzx edi, byte [esi + 1]
and ebx, 0x7f
add esi, 2
shl ebx, 8
or ebx, edi
sub ecx, ebx
js 0x10024ca5
xor al, 1
cmp esi, edx
jne 0x10024c60
jmp 0x10024ca5
xor eax, eax
jmp 0x10024ca5
mov al, 1
and al, 1
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10056fa0
call fcn.10049530
push 0x10056fb0
push eax
push ebx
call fcn.10049970
push 0x10056fb0
push dword [ebp + 0x10]
push eax
call fcn.10049950

Function at 0x10027d51
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, 0x100
push edi
mov edi, dword [esp + 0x14]
add edx, esi
mov eax, dword [edi + 0x18]
mov ecx, edx
shr ecx, 7
add ebx, ebx
and ecx, 1
mov dword [edi + eax*4 + 0x20], ecx
mov ecx, esi
and ecx, ebx
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
add edx, edx
lea ecx, [eax*2]
mov eax, dword [edi + 0x18]
add ecx, ebp
mov dword [edi + eax*4 + 0x108], ecx
mov eax, ebx
inc dword [edi + 0x18]
xor eax, edx
not eax
and esi, eax
cmp edx, 0x10000
jb 0x10027d6c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10028448
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
xor eax, eax
push esi
mov esi, dword [esp + 0x10]
inc eax
shl eax, cl
push edi
xor edi, edi
add esi, eax
mov eax, dword [esp + 0xc]
mov edx, esi
shr esi, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [eax + esi*2]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x1004c568]
add edi, ecx
cmp esi, 1
jne 0x1002845f
mov eax, edi
pop edi
pop esi
ret
Function at 0x1002df4c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
not ebx
push edi
cmp esi, 8
jbe 0x1002e00c
jmp 0x1002df7c
movzx eax, byte [edx]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1004e798]
inc edx
dec esi
test dl, 7
jne 0x1002df68
mov edi, esi
and edi, 0xfffffff8
add edi, edx
and esi, 7
jmp 0x1002e008
xor ebx, dword [edx]
add edx, 4
mov dword [ebp + 0x10], edx
add dword [ebp + 0x10], 4
mov edx, dword [edx]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x1004eb98]
xor ecx, dword [eax*4 + 0x1004ef98]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x1004fb98]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1004ff98]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x1004e798]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x1004f798]
movzx eax, dl
mov edx, dword [ebp + 0x10]
xor ecx, dword [eax*4 + 0x1004f398]
movzx eax, bl
xor ecx, dword [eax*4 + 0x10050398]
mov ebx, ecx
cmp edx, edi
jb 0x1002df8d
test esi, esi
je 0x1002e028
movzx eax, byte [edx]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1004e798]
inc edx
sub esi, 1
jne 0x1002e010
pop edi
not ebx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x1002e031
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x1c]
not ebx
push edi
mov edi, dword [esp + 0x18]
not esi
cmp edi, 4
jbe 0x1002e0f9
mov dword [esp + 0x18], edx
test dl, 3
je 0x1002e083
movzx eax, byte [edx]
movzx ecx, bl
shrd ebx, esi, 8
xor ecx, eax
shr esi, 8
xor ebx, dword [ecx*8 + 0x10050798]
xor esi, dword [ecx*8 + 0x1005079c]
inc edx
dec edi
test dl, 3
jne 0x1002e05b
mov dword [esp + 0x18], edx
mov ebp, edi
and ebp, 0xfffffffc
add ebp, edx
and edi, 3
jmp 0x1002e0f5
mov edx, dword [edx]
xor edx, ebx
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ebx, dword [ecx*8 + 0x10050f98]
mov ecx, dword [ecx*8 + 0x10050f9c]
xor ebx, dword [eax*8 + 0x10051798]
xor ecx, dword [eax*8 + 0x1005179c]
mov eax, edx
shr eax, 0x18
xor ebx, dword [eax*8 + 0x10050798]
xor ecx, dword [eax*8 + 0x1005079c]
movzx eax, dl
mov edx, dword [esp + 0x18]
xor ebx, dword [eax*8 + 0x10051f98]
xor ecx, dword [eax*8 + 0x10051f9c]
xor ebx, esi
xor ecx, 0
add edx, 4
mov esi, ecx
mov dword [esp + 0x18], edx
cmp edx, ebp
jb 0x1002e08f
test edi, edi
je 0x1002e120
movzx eax, byte [edx]
movzx ecx, bl
shrd ebx, esi, 8
xor ecx, eax
shr esi, 8
xor ebx, dword [ecx*8 + 0x10050798]
xor esi, dword [ecx*8 + 0x1005079c]
inc edx
sub edi, 1
jne 0x1002e0fd
not esi
not ebx
pop edi
mov edx, esi
mov eax, ebx
pop esi
pop ebp
pop ebx
ret

Function at 0x1002e239
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x20
push 0x1004bf80
lea eax, [esi + 0x40]
push eax
call fcn.10034390
and dword [esi + 0x60], 0
add esp, 0xc
and dword [esi + 0x64], 0
pop esi
ret
Function at 0x10030afe
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
push 8
pop ecx
mov esi, dword [edi + 0xaa4]
lea ebp, [edi + 0xaac]
mov eax, dword [edi + 0xaa8]
sub ecx, esi
and eax, dword [esp + 0x14]
xor edi, edi
shr edx, cl
mov ecx, esi
shl eax, cl
add edx, eax
imul eax, edx, 0x600
add ebp, eax
cmp byte [esp + 0x1c], 0
jne 0x10030b50
push dword [esp + 0x24]
push 8
push ebp
call fcn.10028448
add esp, 0xc
mov edi, eax
jmp 0x10030ba5
mov edx, dword [esp + 0x24]
mov esi, 0x100
push ebx
mov ebx, dword [esp + 0x24]
add edx, esi
add ebx, ebx
mov ecx, esi
and ecx, ebx
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x1004c568]
add edi, eax
mov eax, ebx
xor eax, edx
not eax
and esi, eax
cmp edx, 0x10000
jb 0x10030b60
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x10031e78
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x10]
push esi
xor esi, esi
push edi
inc esi
mov ecx, dword [esp + 0x14]
add esi, esi
mov edi, ebx
shr ebx, 1
and edi, 1
movzx edx, word [esi + ecx]
mov ecx, edi
neg ecx
shr edx, 4
shr ecx, 4
add esi, edi
and ecx, 0x7f
xor edx, ecx
movzx ecx, byte [edx + 0x1004c568]
add eax, ecx
sub ebp, 1
jne 0x10031e89
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10038a62
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x10038aa1
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10038aa1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10038aa1
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10038aa1
cmp dword [ecx + 0x74], 0xe
jbe 0x10038aa1
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1003cbe5
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003cb67

Function at 0x1003deac
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10059310
push 0x10059308
push str.FlsAlloc
push 0x1f
call fcn.1003dd48
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003dee0
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004a1ac]
call esi
jmp 0x1003dee6
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1003df2a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10059320
push 0x10059318
push str.FlsGetValue
push 0x21
call fcn.1003dd48
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003df61
push dword [ebp + 8]
mov ecx, esi
call dword [0x1004a1ac]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x1003df69
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10059328
push 0x10059320
push str.FlsSetValue
push 0x22
call fcn.1003dd48
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1003dfa3
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1004a1ac]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x1003f5d1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1003f66e
push ebx
push esi
call fcn.1003f59a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1003f52e
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1003f61b
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003f66d
push edi
push eax
call fcn.1003c209
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1003f63b
call fcn.1003c1cf
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003f66c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1003f52e
add esp, 0x20
test eax, eax
jne 0x1003f65a
push edi
call fcn.1003c1cf
jmp 0x1003f662
push ebx
call fcn.1003c1cf
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10048380
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100483ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100483ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10048dd0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x10048e4c
mov eax, dword [entry1]
lea edi, [esi + 0xc]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push edi
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [ebp - 0x10], eax
jne 0x10048e88
cmp dword [ebp - 0x14], 0
je 0x10048e6e
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x10048ea5
mov ebx, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x10060a6c]
nop dword [eax + eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x10060a6c], esi
jne 0x10048e30
push 0
push 0
push edi
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov eax, ebx
jmp 0x10048e80
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x10048ee1
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x10048e72
mov eax, dword [ebp - 0x10]
jmp 0x10048e80
mov eax, dword [esi]
jmp 0x10048e7f
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.kernel32.dll_TlsFree]
mov eax, esi
dec eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x10]
mov edx, 0x1005467c
push 0x10054988
push eax
call fcn.100489c0
push 0
push 4
push edi
call dword [sym.imp.kernel32.dll_InitOnceComplete]
mov dword [ebp - 0x2c], 0x1005493c
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], str.___rustc_ab5bda1aa70f707014e2e691e43bc37a8819252alibrarycore_srcio_borrowed_buf.rs
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push 0x10054978
push eax
call fcn.10049570
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x1005493c
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], str.___rustc_ab5bda1aa70f707014e2e691e43bc37a8819252alibrarycore_srcio_borrowed_buf.rs
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
call fcn.10048990
int3
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x41b130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x41b152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41b159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41b148
mov eax, 1
add ebx, ebx
jne 0x41b16b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41b160
jne 0x41b17c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b160
xor ecx, ecx
sub eax, 3
jb 0x41b190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41b202
mov ebp, eax
add ebx, ebx
jne 0x41b19b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41b1a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41b1cc
inc ecx
add ebx, ebx
jne 0x41b1b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41b1ad
jne 0x41b1c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41b1ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41b1ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41b1dd
jmp 0x41b14e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41b1ec
add edi, ecx
jmp 0x41b14e
pop esi
mov edi, esi
mov ecx, 0x34
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41b20a
cmp byte [edi], 3
jne 0x41b20a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41b20f
lea edi, [esi + 0x19000]
mov eax, dword [edi]
or eax, eax
je 0x41b287
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x229e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22a24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41b23c
mov ecx, edi
jns 0x41b26b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22a2c]
or eax, eax
je 0x41b281
mov dword [ebx], eax
add ebx, 4
jmp 0x41b259
call dword [esi + 0x22a28]
mov ebp, dword [esi + 0x22a30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41b2bb
sub esp, 0xffffff80
jmp 0x401910
Function at 0x42e000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
jmp 0x42e01a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42e021
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42e010
mov eax, 1
add ebx, ebx
jne 0x42e033
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42e028
jne 0x42e044
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e028
xor ecx, ecx
sub eax, 3
jb 0x42e058
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42e0ca
mov ebp, eax
add ebx, ebx
jne 0x42e063
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42e070
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42e094
inc ecx
add ebx, ebx
jne 0x42e080
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42e075
jne 0x42e091
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e075
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42e0b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42e0a5
jmp 0x42e016
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42e0b4
add edi, ecx
jmp 0x42e016
pop esi
mov edi, esi
mov ecx, 0xa52
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42e0d2
cmp byte [edi], 9
jne 0x42e0d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42e0d7
lea edi, [esi + 0x2b000]
mov eax, dword [edi]
or eax, eax
je 0x42e146
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e9c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ea20]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42e104
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ea28]
or eax, eax
je 0x42e140
mov dword [ebx], eax
add ebx, 4
jmp 0x42e121
call dword [esi + 0x2ea24]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x42e177
cmp al, 0xef
ja 0x42e16a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x42e14c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x42e159
mov ebp, dword [esi + 0x2ea2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42e1ab
sub esp, 0xffffff80
jmp 0x40b216
Function at 0x4fd920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xca000]
push edi
or ebp, 0xffffffff
jmp 0x4fd942
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4fd949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fd938
mov eax, 1
add ebx, ebx
jne 0x4fd95b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4fd96c
jne 0x4fd98b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fd98b
dec eax
add ebx, ebx
jne 0x4fd978
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4fd950
add ebx, ebx
jne 0x4fd987
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4fd9dd
xor ecx, ecx
sub eax, 3
jb 0x4fd9a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fda12
sar eax, 1
mov ebp, eax
jmp 0x4fd9ae
add ebx, ebx
jne 0x4fd9ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fd97c
inc ecx
add ebx, ebx
jne 0x4fd9bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4fd97c
add ebx, ebx
jne 0x4fd9c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4fd9be
jne 0x4fd9da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4fd9be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4fd9fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4fd9ee
jmp 0x4fd93e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4fd9fc
add edi, ecx
jmp 0x4fd93e
pop esi
mov edi, esi
mov ecx, 0x15e7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fda1a
cmp byte [edi], 0x13
jne 0x4fda1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fda1f
lea edi, [esi + 0xf8000]
mov eax, dword [edi]
or eax, eax
je 0x4fda97
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xfe3b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xfe4dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fda4c
mov ecx, edi
jns 0x4fda7b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xfe4e4]
or eax, eax
je 0x4fda91
mov dword [ebx], eax
add ebx, 4
jmp 0x4fda69
call dword [esi + 0xfe4e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fdac8
cmp al, 0xef
ja 0x4fdabb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fda9d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fdaaa
mov ebp, dword [esi + 0xfe4e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fdafc
sub esp, 0xffffff80
jmp 0x437fa4
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1388058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x13881a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x138807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x138806a
add dl, dl
jne 0x1388089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x13880dc
xor eax, eax
add dl, dl
jne 0x1388096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x138817d
add dl, dl
jne 0x13880a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13880b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13880bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13880c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x13880d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1388075
mov eax, 1
add dl, dl
jne 0x13880ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x13880f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x13880e1
sub eax, ebx
mov ebx, 1
jne 0x1388128
mov ecx, 1
add dl, dl
jne 0x138810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1388119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1388105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1388075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x138813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x138814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1388136
cmp eax, 0x7d00
jae 0x138816d
cmp eax, 0x500
jb 0x1388168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1388075
cmp eax, 0x7f
ja 0x1388170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1388075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x138819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1388075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10