joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118db
Capabilities:
Packed with generic packer

Disassembly:
mov word [esp + 4], 0xc910
lea esp, [esp + 0x14]
jb fcn.004145ff
adc ebp, dword [0xe8f80000]
test byte [ecx], al
add byte [eax], al
clc
call fcn.00411a76
xchg ebx, eax
and al, 3
add byte [edx - 0x3d48f2b3], 0xaf
jg 0x41194a
movsb byte es:[edi], byte [esi]
sbb eax, 0xa112d2c1
lds esp, [esi + 0x36]
and dword [ebp - 0x76a2518a], 0x4d9d5c56
adc al, 0xb8
jmp 0x411966
jmp 0x41ee98
scasd eax, dword es:[edi]
xchg ebx, eax
fsubr st(5), st(0)
inc edi
mov cl, 0xdf
adc al, 1
xchg ebx, eax
mov ebp, 0x877319e5
push ebp
loop 0x411944
add eax, 0x50e5c993
xchg byte [ecx], dh
or cl, al
insd dword es:[edi], dx
jp 0x4118e8
mov eax, 0xfe151653
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
in eax, 0xc3
pop ds
cmp cl, byte [ebp - 0x316cc0c9]
in eax, 0xad
stosd dword es:[edi], eax
xchg ebx, eax
scasd eax, dword es:[edi]
in eax, 0xa6
sbb byte [ebp + 0x5141fb77], bl
xchg ebx, eax
invalid

Function at 0x411b46
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], al
mov byte [esp + 4], 0x44
lea esp, [esp + 0x30]
je 0x41818a

Function at 0x41444e
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push edi
push ecx
mov ebx, eax
mov edx, 1
xor edi, edi
lea eax, [ebx + edx*4]
call fcn.0040eb2d
lahf
adc edx, edx
sahf
rcr edi, 1
sub ecx, 1
jmp loc.0041fb09

Function at 0x41453d
Capabilities:
Packed with generic packer

Disassembly:
bswap eax
jmp 0x41ea71
mov ebx, dword [esp + 4]
pushal
movzx ecx, al
mov cl, 0x55
pushfd
mov ecx, dword [esp + 0x2c]
push 0xe94a0263
pushfd
lea esp, [esp + 0x38]
jmp 0x40ec15

Function at 0x414596
Capabilities:
Packed with generic packer

Disassembly:
lahf
lea eax, [edx*8 + 0x19b2efbf]
lea eax, [ebx + edx*4]
pushfd
pushal
lea esp, [esp + 0x24]
call fcn.0040eb2d
push 0xac781835
pushal
jmp 0x418291
pushfd
adc dl, dl
pushfd
pushfd
pushal
lea esp, [esp + 0x30]
jae 0x411b58
xchg ah, ch
adc cl, al
aaa
rol bh, cl
pop ebx
not eax
pop ecx
neg ah
mov byte [ebp - 2], dl
aas
cmc
shld ax, bx, cl
cmp ecx, 4
jmp 0x414a48
pushal
pushfd
lea esp, [esp + 0x48]
jae 0x411b58
sar al, 5
pop ebx
cmc
aas
pushfd
mov ecx, dword [esp + 4]
lea esp, [esp + 8]
jmp 0x40d13c
pushfd
lea esp, [esp + 8]
jb fcn.00414e18
sar eax, cl
and al, 0xd2
clc
cmp ecx, 0xa
movsx ax, bl
movzx eax, al
call fcn.0041624b
lea esp, [esp + 4]
call fcn.0040eb2d
push ecx
jmp 0x419f6d
not ax
mov eax, ecx
push ebp
jmp 0x4144d3
adc dl, dl
jmp 0x40ebfa
jmp 0x40d48b

Function at 0x414791
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x3c]
jmp loc.0041ff12

Function at 0x414b2a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x34]
je 0x41818a
jmp loc.0041f404

Function at 0x414e25
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [edi*4 + 0x22c8b16d]
mov dword [esp + 8], ebx
jmp 0x4158aa
pop eax
jmp 0x4158cd
bswap eax
lea eax, [loc.0040e37f]
jmp loc.0041e22f

Function at 0x414f40
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [ebp - 0x15], 0
jmp loc.0041e98e

Function at 0x4153a7
Capabilities:
Packed with generic packer

Disassembly:
push 0x3b806ce1
lea esp, [esp + 0x30]
jmp loc.0041ed3d
Function at 0x4154b1
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push 0x94e9a975
xchg dword [ebp - 0x24], eax
pushfd
jmp loc.0041f624

Function at 0x415cb7
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.0041f442
jmp 0x41187c

Function at 0x41624b
Capabilities:
Packed with generic packer

Disassembly:
setae ah
mov eax, 3
pushfd
lea esp, [esp + 8]
jb fcn.00414e18
rcr eax, cl
aam 0x4e
bts ax, di
bts eax, 0xd
mov eax, 6
pushal
jmp loc.0041ec1d

Function at 0x4162d8
Capabilities:
Packed with generic packer

Disassembly:
mov esp, esi
pushfd
push esi
push dword [esp]
lea esp, [esp + 0xc]
jmp fcn.004145ff
mov dword [esp + 0x1c], ebx
push dword [esp + 4]
push esi
pushfd
pushfd
lea esp, [esp + 0x2c]
call fcn.0041736d
pushal
jmp 0x4147ea

Function at 0x416906
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x41833f
mov dword [esp + 8], 0x40db7c
jmp loc.0041e2b7

Function at 0x41736d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
aad 0xae
sub esp, 0xfffffff8
sub al, cl
push esi
not ax
aam 0x5f
push edi
bt edx, ecx
push ebx
inc eax
stc
cmc
push edx
shl ax, cl
mov eax, dword [ebp + 8]
bt ecx, 0x1c
test dl, 0xba
test eax, eax
pushal
jmp 0x41664a
rcl ah, cl
xor al, 0xaf
push ebp
inc ah
sar al, 1
xor ah, 0x33
mov ebp, esp
shl ah, 1
pushal
jmp 0x412130

Function at 0x417618
Capabilities:
Packed with generic packer

Disassembly:
cmc
shl eax, 4
cmp ah, bl
stc
pushal
add eax, edx
pushfd
jmp 0x40d3e7

Function at 0x417747
Capabilities:
Packed with generic packer

Disassembly:
bt ebp, 0xc
jmp 0x414726

Function at 0x4177ce
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
jmp loc.0041ea9c
pushfd
lea eax, [ebx + edx*4]
jmp 0x416da2

Function at 0x417b43
Capabilities:
Packed with generic packer

Disassembly:
mov edx, edi
aaa
shrd ax, cx, cl
sub ax, si
sub edx, dword [ebp + 0xc]
xor al, dh
push 0xabb3b010
and edx, 3
push eax
mov eax, ecx
push 0x2194bac5
clc
jmp 0x41f681

Function at 0x417cfe
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
jae 0x411b58
bswap cx
pushal
mov ebx, dword [esp + 0x20]
push edi
mov ecx, dword [esp + 0x28]
pushfd
push dword [esp]
push esi
lea esp, [esp + 0x38]
jmp 0x40ec15
jmp 0x40ef96
adc dl, dl
jmp 0x41415f

Function at 0x417d3c
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x34]
jae 0x411b58
bswap cx
setno cl
pop ebx
not ch
push 0x4c6cfbf
not ch
mov ecx, dword [esp + 4]
push ebx
pushfd
pushfd
lea esp, [esp + 0x14]
jmp 0x40ec15

Function at 0x4182a7
Capabilities:
Packed with generic packer

Disassembly:
pushfd
not al
jmp 0x40d44d
test dh, 1
call fcn.0040eaa7
pushal
movzx esi, dl
rep stosd dword es:[edi], eax
movzx di, cl
movzx si, bl
mov esi, dword [ebp + 8]
jmp 0x40ed62
Function at 0x418388
Capabilities:
Packed with generic packer

Disassembly:
test ah, dh
add esp, 0x28
jnp 0x40e2f7
cmp bh, 0xa7
add edi, eax
clc
sub ecx, 1
pushal
pushfd
lea esp, [esp + 0x24]
jne 0x41471f
stc
movsx cx, cl
clc
pushfd
mov dword [ebp - 0x1c], edi
sbb ch, 0xc
and di, bx
push dword [esp]
mov edi, dword [ebp + 0xc]
inc ch
sub eax, eax
bsr dx, ax
mov byte [ebp - 2], al
or ecx, edi
shrd edx, esi, cl
add ch, bh
call fcn.0040f31a
lodsb al, byte [esi]
rcl ch, 4
not di
ror al, 6
inc cx
neg al
movzx cx, cl
bswap cx
rol al, 7
cmp dh, 0xfd
cmc
sbb ch, ah
shrd di, si, 8
neg al
rol di, 4
bswap di
sal di, 4
xor eax, eax
pushfd
push 0xaaf01c00
call fcn.004146fd
cmc
cmc
add edi, eax
cmp ah, 0xd2
jle 0x4184a0
cmp ah, 0xee
sub ecx, 1
call fcn.004143b4
push esp
lodsb al, byte [esi]
call fcn.00417747
jmp 0x41532a
ror al, 6
test dx, 0x5aa6
jmp 0x4183a0
lea esp, [esp + 0x30]
jb 0x40ec06
pushfd
xor dh, dl
pushal
test dh, 1
not dh
call fcn.004161be
test al, ah
neg al
pushal
stc
stc
rol al, 7
cmp al, cl
neg al
test cl, 0xf5
clc
cmp al, 0xa1
shl edi, 8
jmp 0x40d400
cmp bp, bx
sub ecx, 1
call fcn.0040d6b8

Function at 0x4183cb
Capabilities:
Packed with generic packer

Disassembly:
test dh, 1
not dh
mov dh, 0
call fcn.004158da
repne scasb al, byte es:[edi]
mov dword [esp + 8], ecx
mov byte [esp], 0x58
call fcn.0041473c
sub edi, 4
test edi, esi
push dword [edi]
pop dword [esp]
cmp dl, 0x9b
cmp edi, ebx
call fcn.0040e60c
jge 0x40de40
mov cl, 0xc8
inc esp
dec esp
or eax, 0xa14988fd
inc eax
or esp, dword fs:[edi - 2]
scasb al, byte es:[edi]
and eax, 0x3a301e41
mov eax, 0xed520a92
retf 0xdd62
neg ch
mov bh, byte [edi - 0x267e094d]
push edx
sbb al, 0xee
arpl word [ebx + 0x673f885c], ax
adc byte [edi + ebp*8 + 0xb], dl
jmp 0x41e38a
jmp 0x4183bc
push 0x4d8b86a5
push dword [esp]
adc dl, dl
call fcn.00418479
pushal
lea esp, [esp + 0x28]
call fcn.0040eb2d
pushal
push dword [esp]
lea esp, [esp + 0x24]
jo 0x41415a
pushal
adc dl, dl
mov byte [esp + 0x1c], 0x73
lea esp, [esp + 0x20]
jb 0x40ec06
stc
test bx, 0xd9f4
pushfd
xor dh, dl
pushfd
jmp 0x40ddec

Function at 0x418412
Capabilities:
Packed with generic packer

Disassembly:
inc al
clc
clc
clc
ror al, 4
jmp 0x417b7a
not al
jmp 0x418404
dec al
clc
push dword [esp + 8]
xor al, 0xf7
call fcn.00417dab
lea esp, [esp + 0x40]
jb 0x411b58
lahf
shrd ax, bp, 2
aas
mov eax, dword [ebp - 0x20]
xchg dh, cl
xadd cl, dh
cmp bh, 0xff
xor cl, 0x4a
not eax
bt ax, bx
seto cl
rcr cl, cl
mov cl, byte [eax + edi]
mov al, ah
add cl, cl
bswap ax
not dh
push edx
bswap ax
setb dh
setb ah
not ah
pushal
lea eax, [ebx + edx*4 + 0x400]
push 0xa17ded71
call fcn.004153a7

Function at 0x418479
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0xc]
jb 0x40ec06
call fcn.00416639

Function at 0x418488
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x44], 0x90304265
pushfd
pushfd
mov dword [esp + 4], eax
pushfd
lea esp, [esp + 0x50]
jmp 0x41bc59
jmp loc.0041f025

Function at 0x41a0df
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 4], 0x9a1104a8
jmp 0x41b471
Function at 0x41a9ad
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pop dword [esp + 0x30]
test ch, ch
mov dword [esp + 0x2c], esi
bt dx, si
ror esi, 0x13
cmc
jmp loc.0041eac7

Function at 0x41aac2
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jne 0x41ba1d
jmp loc.0041f267
pushfd
pushal
pushfd
push dword [esp + 4]
mov dword [ebp + 4], ecx
pushfd
mov dword [ebp], edx
jmp 0x41a8bc
lea esp, [esp + 0x30]
jne 0x41ba1d
push ebx
mov ebx, eax
call fcn.0041c070
lea esp, [esp + 0x28]
jns 0x41a188
mov dword [ebp + 4], ecx
push 0xb1f31257
mov dword [ebp], edx
jmp 0x41a16b

Function at 0x41abb4
Capabilities:
Packed with generic packer

Disassembly:
cwde
jmp 0x41c111
sub ebp, 4
jmp loc.00420100

Function at 0x41acd1
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x41b2c7
mov word [esp], 0xbfb7
mov dword [esp + 0x30], 0x41baf7
jmp 0x41c5fc
jmp loc.0041fc64

Function at 0x41b1c2
Capabilities:
Packed with generic packer

Disassembly:
std
push esi
pushal
movsx di, cl
bswap si
jmp loc.0041e1eb
mov esp, eax
pushfd
not di
pushfd
pop dword [esp]
std
not edi
jmp 0x41ab24

Function at 0x41b25a
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + 0x40], esi
cmp ah, cl
mov dword [esp + 0x3c], ecx
inc esi
jmp loc.0041fda0

Function at 0x41b30d
Capabilities:
Packed with generic packer

Disassembly:
jmp loc.0041f6a0
jmp 0x41bd5a
pushal
jmp 0x41a98e
pushal
mov dword [esp + 0x3c], ebx
jmp 0x41a25a
mov dword [esp + 0x20], edi
jmp 0x41b72c

Function at 0x41b75c
Capabilities:
Packed with generic packer

Disassembly:
pushfd
push dword [esp + 0x10]
pop dword [ebp]
pushal
mov byte [esp + 4], cl
mov byte [esp + 4], bl
push ebx
lea esp, [esp + 0x38]
jmp loc.004200da

Function at 0x41bc05
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp + 0xc], 0xf7
push dword [esp + 4]
not al
cmp dh, 0x66
mov byte [esp], bl
jmp loc.0041e4c2

Function at 0x41be0b
Capabilities:
Packed with generic packer

Disassembly:
mov al, byte [esi]
sbb ch, 0x8d
stc
sar ch, 5
and ch, dh
xor al, bl
btc ecx, 9
bt edx, 0x17
sal cx, 4
add al, 0x90
btc cx, di
rol cl, cl
ror al, 1
shrd cx, dx, 4
movzx cx, cl
not al
cmc
xor bl, al
pushal
jmp loc.0041fe04

Function at 0x41bf2e
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x40], ebp
sal si, cl
dec esi
rol si, 8
and si, 0x8c06
mov dword [esp + 0x3c], edx
bsr si, bp
rcl si, cl
mov dword [esp + 0x38], edx
bsf si, cx
sbb si, 0x1a14
bsf si, ax
push dword [0x41aa0f]
pop dword [esp + 0x34]
and si, bp
or si, 0xdb2e
mov dword [esp + 0x30], 0
push dword [esp]
bsf esi, ecx
clc
mov esi, dword [esp + 0x64]
stc
jmp loc.00420056
jmp 0x41b157

Function at 0x41c467
Capabilities:
Packed with generic packer

Disassembly:
push esp
mov dword [esp + 0x40], eax
jmp loc.0041fd15

Function at 0x41e002
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419d68
push 0x4153e0
push eax
push ebx
push edi
xor ebx, ebx
push 2
pop ecx
mov ecx, dword [0x41cd2e]
mov ecx, dword [0x40f0be]
add esp, 0x18
leave
popal
popfd
xchg dword [esp + 0x40], esi
shr si, cl
jmp loc.0041b798
Function at 0x41e413
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
add al, ch
push ebx
push edx
dec ecx
dec ecx
add ch, al
add esp, 8
leave
popal
popfd
push 0x92b0defa
jmp loc.0041bbc4

Function at 0x41e53a
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
push eax
test eax, eax
add esp, 0x10
leave
popal
popfd
shr al, cl
mov byte [esp], 0x28
jmp fcn.0041a999

Function at 0x41e921
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
salc
add dh, dl
salc
pop edi
push ebx
dec edi
pop edi
dec edi
dec ecx
and al, 0
add al, 0
popal
popfd
add bl, byte [ecx + 0x193c8fbc]
jmp fcn.0040da55

Function at 0x41ef25
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x8001
push ebx
push 8
push ebx
push 0x160
push eax
push ebx
push 0x41f458
push 0x4091b8
push 0x4236a0
mov edi, 0x429000
push eax
push edi
push ebx
mov eax, edi
add esp, 0x3c
leave
popal
popfd
adc esp, dword [eax + 0xd4c40d9]
jmp fcn.0040da18

Function at 0x41f0b4
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4050a0
push 0x401cd0
push eax
push ebx
push edi
xor edx, edx
mov dl, ah
mov ecx, eax
and ecx, 0xff
shl ecx, 8
add ecx, edx
shr eax, 0x10
pop ecx
test eax, eax
add esp, 0x14
leave
popal
popfd
mov word [eax], dx
push dword [esp]
jmp loc.0041ac0e

Function at 0x41f1ed
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
nop
mov eax, 0
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
mov eax, 1
push eax
push eax
mov eax, 0
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
add esp, 0x30
leave
popal
popfd
pushal
mov dword [esp + 0x30], ebx
jmp fcn.0041beb7

Function at 0x41f22b
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
nop
mov eax, 0
mov eax, 0x30000
push eax
mov eax, 0x10000
push eax
mov eax, 1
push eax
push eax
mov eax, 0
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
add esp, 0x30
leave
popal
popfd
pushfd
mov dword [esp + 0x24], edi
jmp fcn.0041a9d0

Function at 0x41f83b
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
aam 3
aam 3
xor al, 0
pop edi
push ebx
dec edi
pop edi
dec edi
add al, 0
popal
popfd
jmp loc.0041be97

Function at 0x41f8df
Capabilities:
Encode data using xor

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x8001
push ebx
push 8
push ebx
push 0x160
push eax
push ebx
push 0x420cb0
push 0x40a810
push 0x425b00
mov edi, 0x42c000
push eax
push edi
push ebx
mov eax, edi
add esp, 0x3c
leave
popal
popfd
xor eax, 0xd4dfc
jmp loc.004166da
Function at 0x41fac6
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push edi
push 0x8001
push ebx
push 8
push ebx
push 0x160
push eax
push ebx
push 0x420cb0
push 0x40a810
push 0x425b00
mov edi, 0x42c000
push eax
push edi
push ebx
mov eax, edi
add esp, 0x3c
leave
popal
popfd
bts dx, 4
jmp fcn.0041bbf4

Function at 0x41fca7
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
dec eax
nop
nop
pop edi
push ebx
dec edi
pop edi
dec edi
add dl, ah
sbb eax, 0xa000200
popal
popfd
mov dword [esp + 4], 0xb57f8162
jmp loc.0041afa9

Function at 0x41fcea
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
pop edi
xor ebx, ebx
push 0x8001
and eax, 0xbfffffff
cmp ax, 6
add esp, 0xc
leave
popal
popfd
pushfd
pop dword [esp + 0x10]
jmp loc.0041b0cf
Function at 0x100013d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0xc]
add ebx, 0x24
mov ebx, dword [ebx + 4]
movzx eax, byte [ebx]
or eax, 0x5c3a00
mov dword [ebp - 8], eax
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
lea eax, [ebp - 8]
push eax
call fcn.100033f8
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x100015ce
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
push 0x1bc558ea
push eax
call fcn.10002ac0
mov dword [0x68b3588], eax
call fcn.100033e6
mov dword [0x68b3584], eax
call fcn.100013d0
mov dword [0x68b356c], eax
mov dword [0x68b3578], 0x68b1fbd
mov dword [0x68b357c], 0x68b1374
mov dword [ebp - 0xa4], 0x94
lea eax, [ebp - 0xa4]
push eax
call fcn.100033f2
mov eax, dword [ebp - 0xa0]
rol eax, 8
add eax, dword [ebp - 0x9c]
mov dword [0x68b3570], eax
push 0x68b3590
push 0xffffffffffffffff
call fcn.1000340a
mov dword [0x68b3640], 0xffffffff
mov dword [ebp - 0x10], 0xfe363c80
mov dword [ebp - 0xc], 0xffffffff
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.100033a4
push 4
push 0x1000
push 0x8000
push 0
call fcn.1000341c
mov dword [ebp - 4], eax
test eax, eax
je 0x100017d8
push 0x8000
push dword [ebp - 4]
push 0x68b1176
call fcn.100033da
test eax, eax
je 0x100017d8
push 0
push 0x68b117e
call fcn.10003410
push 0x8000
push dword [ebp - 4]
push dword [ebp - 4]
call fcn.100033ec
call fcn.10002377
push dword [0x68b356c]
push 0x68b1186
lea eax, [ebp - 0x10]
push eax
call fcn.10003506
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0
push 0
call fcn.100033bc
mov dword [0x68b3564], eax
call fcn.100033e0
cmp eax, 0xb7
je 0x100017c1
push dword [ebp - 4]
call fcn.100024a7
push dword [ebp - 4]
call fcn.100033c8
push 0x8000
push 0
push dword [ebp - 4]
call fcn.10003422
lea eax, [ebp - 0x236]
push eax
push 0x202
call fcn.100034b8
call fcn.10001d0c
bswap eax
mov dword [0x68b3574], eax
push 0
push 0
push 1
push 0
call fcn.100033b6
mov dword [ebp - 0xa8], eax
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0xa8]
push 0x68b29c0
push ecx
push ecx
call fcn.100033c2
push eax
call fcn.100033b0
xor eax, eax
push eax
push eax
push dword [ebp - 0xa8]
push 0x68b1410
push eax
push eax
call fcn.100033c2
push eax
push 0x2710
push eax
call fcn.10003428
call fcn.100033b0
xor edx, edx
mov eax, 0x23c34600
mul dword [0x68b1140]
not eax
not edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.100033a4
jmp 0x10001776
push dword [ebp - 4]
call fcn.100033c8
push 0x8000
push 0
push dword [ebp - 4]
call fcn.10003422
push 0
call fcn.100033ce
Function at 0x10001c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edx
push esi
xor eax, eax
xor edx, edx
dec edx
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
xor al, dl
shr edx, 8
xor edx, dword [eax*4 + 0x68b1800]
loop 0x10001c11
mov eax, edx
not eax
pop esi
pop edx
pop ecx
leave
ret 8
Function at 0x4011c6
Capabilities:
Access peb ldr_data
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call fcn.0040114f
call section..text
movzx eax, al
cmp eax, 1
jne 0x4011e9
push 5
pop eax
jmp 0x4013b8
and dword [ebp - 0x40], 0
and dword [ebp - 0xc], 0
and dword [ebp - 0x30], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x44], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x1c], 0
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0x330
pushal
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ebx, eax
add ebx, 0xc
mov eax, dword [eax + 0xc]
mov edi, dword [eax + 0x30]
mov ecx, 0x18
xor esi, esi
xor ebx, ebx
add bl, byte [edi + ecx - 1]
add esi, ebx
loop 0x401234
cmp esi, dword [ebp - 0x2c]
je 0x401249
mov eax, dword [eax]
cmp eax, ebx
jne 0x40122a
mov eax, dword [eax + 0x18]
mov dword [ebp - 8], eax
nop
popal
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x422348
push dword [0x422328]
push 0x42232c
push dword [0x422348]
push 0x42234c
call fcn.0040102b
add esp, 0x14
push 0x42234c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x30], eax
push 0x422368
push dword [0x422328]
push 0x42232c
push dword [0x422368]
push 0x42236c
call fcn.0040102b
add esp, 0x14
push 0x42236c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x422388
push dword [0x422328]
push 0x42232c
push dword [0x422388]
push 0x42238c
call fcn.0040102b
add esp, 0x14
push 0x42238c
push dword [ebp - 8]
call dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [0x404040]
mov dword [ebp - 0x10], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0
call dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x404048
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10]
push eax
push dword [section..data]
push 0x404004
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 4], eax
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
push 0x20
push dword [0x404040]
push dword [ebp - 4]
call dword [ebp - 0x24]
push 0x404724
push dword [0x404044]
push 0x4046e8
push dword [0x404724]
push 0x404728
call fcn.0040102b
add esp, 0x14
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [0x4223dc], eax
and dword [ebp - 0x28], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
push dword [ebp - 0x28]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call dword [0x4223dc]
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f730
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40f752
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f748
mov eax, 1
add ebx, ebx
jne 0x40f76b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f760
jne 0x40f77c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f760
xor ecx, ecx
sub eax, 3
jb 0x40f790
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f802
mov ebp, eax
add ebx, ebx
jne 0x40f79b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f7a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f7cc
inc ecx
add ebx, ebx
jne 0x40f7b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f7ad
jne 0x40f7c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f7ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f7ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f7dd
jmp 0x40f74e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f7ec
add edi, ecx
jmp 0x40f74e
pop esi
mov edi, esi
mov ecx, 0x198
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f80a
cmp byte [edi], 7
jne 0x40f80a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f80f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f87e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf47c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf530]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f83c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf534]
or eax, eax
je 0x40f878
mov dword [ebx], eax
add ebx, 4
jmp 0x40f859
call dword [esi + 0xf538]
popal
jmp 0x403216