joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10026f0a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10026f63
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10026f0a
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10026f19
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042cbbc
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10026f6a
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000dde0
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10027009
add edi, 4
add eax, 2
dec ecx
jne 0x10026f4f
call 0x10026fb6
loope 0x10026fac
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10027006
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10027017
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10026fca
cmp eax, ecx
ja 0x10026fca
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10027054
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002704a
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000e2bf
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10026f19
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10026f63
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10026f0a
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10026f19
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1042cbbc
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10026f6a
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1000dde0
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10027009
add edi, 4
add eax, 2
dec ecx
jne 0x10026f4f
call 0x10026fb6
loope 0x10026fac
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10027006
mov dh, pe_nt_image_headers32
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10027017
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10026fca
cmp eax, ecx
ja 0x10026fca
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10027054
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x1002704a
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1000e2bf
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0xda1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xda11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xda107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda106a
add dl, dl
jne 0xda1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda10dc
xor eax, eax
add dl, dl
jne 0xda1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xda117d
add dl, dl
jne 0xda10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xda10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xda1075
mov eax, 1
add dl, dl
jne 0xda10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xda10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda10e1
sub eax, ebx
mov ebx, 1
jne 0xda1128
mov ecx, 1
add dl, dl
jne 0xda110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xda113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xda114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xda1136
cmp eax, 0x7d00
jae 0xda116d
cmp eax, 0x500
jb 0xda1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda1075
cmp eax, 0x7f
ja 0xda1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xda1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xda119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xda1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1013d250
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x102c935c], 0x729
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1013d2f5
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x1013d385
jmp 0x1013d37e
mov dword [0x102c935c], 0xa71
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1013d361
jmp 0x1013d37e
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x1013d2f5
jmp 0x1013d30b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1013d329
jmp 0x1013d37e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x1013d2c8
mov eax, dword [ebp - 0x20]
mov dword [0x102c935c], 0xafc
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x1013d2e1
jmp 0x1013d37e
mov dword [0x102c9360], 0x19b4
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1013d37e
mov dword [0x102c935c], 0x34f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1013d2a6
jmp 0x1013d37e
mov dword [0x102c935c], 0xfffffba1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1013d286
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1013d385
mov eax, dword [ebp - 0x18]
add esp, 0x20
pop ebp
ret
Function at 0x1013d4e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102c9368], 0
mov byte [0x102c936c], 0
mov dword [0x102c9360], 0xc9e
mov dword [0x102c9364], 0
mov edi, dword [0x102c935c]
add edi, 0x2125
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], esi
jmp 0x1013d548
mov dword [0x102c935c], 0x1f39
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, 0x2b6d
mov dword [0x102c9360], ecx
mov ecx, eax
mov bl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov dword [0x102c935c], 0xa48
mov eax, dword [0x102c9364]
add eax, 1
mov dword [0x102c9364], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
jl 0x1013d548
mov eax, 0x1a7b
xor ecx, ecx
mov dword [0x102c9360], 0x1a7b
mov dword [0x102c9364], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x102c9370], 0
mov esi, ecx
add esi, 0x23cb
add ecx, 0x24de
mov dword [ebp - 0x2c], eax
xor edi, edi
mov dword [ebp - 0x30], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov dword [0x102c935c], esi
mov esi, dword [0x102c9368]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
movzx edi, byte [ebx + edi]
add edi, esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x102c9370], edi
mov dword [0x102c935c], ecx
mov eax, edi
cdq
mov ecx, dword [ebp - 0x30]
idiv ecx
mov dword [0x102c9368], edx
mov edi, dword [ebp - 0x2c]
mov cl, byte [ebx + edi]
mov byte [0x102c936c], cl
mov dword [0x102c935c], 0x11cb
mov cl, byte [ebx + edx]
mov byte [ebx + edi], cl
mov edx, dword [0x102c935c]
add edx, 0xffffd9ae
mov dword [0x102c935c], edx
mov cl, byte [0x102c936c]
mov edx, dword [0x102c9368]
mov byte [ebx + edx], cl
mov edx, dword [0x102c9364]
add edx, 1
mov dword [0x102c9364], edx
cmp edx, 0x100
mov dword [ebp - 0x34], edx
jge 0x1013d536
mov eax, dword [0x102c9360]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1013d5aa
Function at 0x1013ee40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x102c9364], 0
mov dword [0x102c9368], 0
mov dword [0x102c9374], 0
mov dword [0x102c935c], 0x90d
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1013efb4
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1013eea5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add eax, 1
mov edi, edx
add edi, 1
mov ebx, dword [0x102c9360]
add ebx, 0xffffe796
mov dword [0x102c9360], ebx
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x102c9364], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x102c9368], edx
mov dword [0x102c9360], 0x17dc
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x102c936c], cl
mov dword [0x102c935c], 0x804
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x102c936c]
mov edx, dword [0x102c9368]
mov byte [ebx + edx], cl
mov edx, dword [0x102c9364]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x102c9368]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x102c9360], 0x1c7e
and ecx, 0xff
mov dword [0x102c9374], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x2c]
mov ch, byte [edx + esi]
mov byte [0x102c9379], ch
mov byte [0x102c937a], cl
xor ch, cl
mov byte [0x102c9378], ch
mov dword [0x102c935c], 0x1630
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x34], edi
je 0x1013efb2
mov eax, dword [0x102c9364]
mov ecx, dword [0x102c9368]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jmp 0x1013eea5
jmp 0x1013efb4
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013efc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x102c9360], 0x940
mov edx, dword [0x102c935c]
add edx, 0x11c0
mov dword [0x102c935c], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1013e6b0
lea ecx, [0x1013d390]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x50], edx
mov edx, dword [0x102c9360]
add edx, 0xffffed02
mov dword [0x102c935c], edx
mov dword [esp + 0x4c], 0x11ee00
mov edx, dword [0x102c9348]
mov dword [esp + 0x80], edx
mov edx, dword [0x102c934c]
mov dword [esp + 0x64], edx
mov edx, dword [0x102c9350]
mov dword [esp + 0x58], edx
mov edx, dword [0x102c9354]
mov dword [esp + 0x44], edx
mov edx, dword [0x102c9358]
mov dword [esp + 0x6c], edx
mov dword [0x102c9360], 0x1a7b
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1013f0c3
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1013f0c3
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], ecx
mov dword [0x102c935c], 0xfffff2fc
mov dword [0x102c9360], 0x1d5c
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x3c], eax
call fcn.1013d250
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
je 0x1013f0ec
jmp 0x1013f12d
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x1013f073
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
je 0x1013f087
jmp 0x1013f073
lea eax, [esp + 0x28]
mov dword [0x102c935c], 0x1a2f
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1013de40
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x102c9360], 0x1b4a
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x51b7a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xac000]
push edi
jmp 0x51b7ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51b7c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b7b0
mov eax, 1
add ebx, ebx
jne 0x51b7d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51b7e4
jne 0x51b803
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b803
dec eax
add ebx, ebx
jne 0x51b7f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51b7c8
add ebx, ebx
jne 0x51b7ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51b855
xor ecx, ecx
sub eax, 3
jb 0x51b81b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51b88a
sar eax, 1
mov ebp, eax
jmp 0x51b826
add ebx, ebx
jne 0x51b826
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b7f4
inc ecx
add ebx, ebx
jne 0x51b834
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51b7f4
add ebx, ebx
jne 0x51b841
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51b836
jne 0x51b852
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51b836
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51b874
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51b866
jmp 0x51b7b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51b874
add edi, ecx
jmp 0x51b7b6
pop esi
mov edi, esi
mov ecx, 0x6cc4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51b892
cmp byte [edi], 0x26
jne 0x51b892
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51b897
lea edi, [esi + 0x117000]
mov eax, dword [edi]
or eax, eax
je 0x51b90f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12053c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x120690]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51b8c4
mov ecx, edi
jns 0x51b8f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x120694]
or eax, eax
je 0x51b909
mov dword [ebx], eax
add ebx, 4
jmp 0x51b8e1
call dword [esi + 0x1206a4]
mov ebp, dword [esi + 0x120698]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51b943
sub esp, 0xffffff80
jmp 0x48f6ed
Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x4083c4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408824
mov byte [esp], al
cmp byte [esp], 0
jne 0x40854e
test edi, edi
je 0x40854e
mov byte [esp + 1], 0
test ebp, ebp
jle 0x40848e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408469
cmp edi, 0xffffffff
je 0x408429
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408429
mov byte [esp], 0
jmp 0x40854e
mov ebx, dword [esi]
cmp ebx, 1
jg 0x408469
test ebx, ebx
jne 0x40845b
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40845b
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x40854e
lea eax, [esp + 0xc]
call fcn.004080a4
dec ebp
test ebp, ebp
jg 0x40840e
cmp edi, 0xffffffff
je 0x40848e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40848c
mov byte [esp], 0
jmp 0x40854e
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4083d2
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x40848e
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004085bc
mov edx, eax
mov ebx, dword [0x5ec8fc]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4084f2
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4084f0
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4084f2
xor edi, edi
cmp byte [esp], 0
je 0x408518
mov ebx, dword [esi]
test bl, 1
jne 0x40852e
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4084f8
mov byte [esp + 1], 1
jmp 0x40852e
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408518
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x4084a5
cmp byte [esp], 0
je 0x40854e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x409390
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x5ec05c], 0
je 0x4093f7
cmp word [0x5ec348], 0xd7b2
jne 0x4093b9
cmp dword [0x5ec350], 0
jbe 0x4093b9
mov eax, 0x5ec344
call dword [0x5ec360]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409424
call fcn.00409f44
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x5e6032], 0
jne 0x409413
push 0
push 0x5e69c2
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret