joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58a670
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x5f4964]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x58a7ed
cmp ebp, 0x20
jb 0x58a7ed
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.0056b960
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x5c83a4
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x58a7ed
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x58a700
sub eax, edx
cmp eax, 0x40
jne 0x58a7ed
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x58a73e
mov cl, byte [esi + eax]
test cl, cl
je 0x58a73e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x58a726
jmp 0x58a742
test edx, edx
jne 0x58a743
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x58a77b
mov cl, byte [edx + eax]
test cl, cl
je 0x58a77b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x58a760
jmp 0x58a77f
test esi, esi
jne 0x58a780
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.0056b960
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.00589870
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x58a7ed
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.00589710
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.0056ab51
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0056ab51
add esp, 0x50c
ret

Function at 0x58a810
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x5f4964]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0056b960
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.00589870
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x58a87b
mov cl, byte [esi + eax]
test cl, cl
je 0x58a87b
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x58a860
jmp 0x58a87f
test edx, edx
jne 0x58a880
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.00589780
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x58a8a6
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x5c83a4
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.0056ab51
add esp, 0x188
ret
Function at 0x4ec670
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8f000]
mov dword [edi + 0xcf740], 0xb204d659
push edi
jmp 0x4ec69a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4ec6a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec690
mov eax, 1
add ebx, ebx
jne 0x4ec6b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4ec6c4
jne 0x4ec6e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6e3
dec eax
add ebx, ebx
jne 0x4ec6d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4ec6a8
add ebx, ebx
jne 0x4ec6df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4ec735
xor ecx, ecx
sub eax, 3
jb 0x4ec6fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4ec76a
sar eax, 1
mov ebp, eax
jmp 0x4ec706
add ebx, ebx
jne 0x4ec706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6d4
inc ecx
add ebx, ebx
jne 0x4ec714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4ec6d4
add ebx, ebx
jne 0x4ec721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4ec716
jne 0x4ec732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4ec716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4ec754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4ec746
jmp 0x4ec696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4ec754
add edi, ecx
jmp 0x4ec696
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ec772
cmp byte [edi], 0x11
jne 0x4ec772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ec777
lea edi, [esi + 0xe5000]
mov eax, dword [edi]
or eax, eax
je 0x4ec7ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf3044]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf31c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4ec7a4
mov ecx, edi
jns 0x4ec7d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf31c4]
or eax, eax
je 0x4ec7e9
mov dword [ebx], eax
add ebx, 4
jmp 0x4ec7c1
call dword [esi + 0xf31d4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4ec820
cmp al, 0xef
ja 0x4ec813
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4ec7f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4ec802
mov ebp, dword [esi + 0xf31c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ec854
sub esp, 0xffffff80
jmp 0x420577
Function at 0x4032b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [0x4069d0]
push ebx
push ebp
push esi
push edi
push 1
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
mov eax, dword [section..data]
mov ecx, 0x5e62
cdq
idiv ecx
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov dword [0x406004], 0x73ae
xor ecx, ecx
mov dword [section..data], edx
mov byte [ecx + edi], cl
mov edx, dword [0x406004]
mov eax, 0x38e38e39
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
inc ecx
cmp ecx, 0x100
mov dword [0x406004], edx
jl 0x4032e7
mov byte [edi + 0x100], bl
mov ecx, dword [section..data]
mov eax, 0x3159721f
mov ebp, dword [esp + 0x1c]
imul ecx
sar edx, 5
mov ecx, edx
mov eax, 0x4d4873ed
shr ecx, 0x1f
add edx, ecx
mov dword [section..data], edx
mov byte [edi + 0x101], bl
mov ecx, dword [0x40600c]
imul ecx
sar edx, 5
mov eax, edx
mov ecx, 0x1599
shr eax, 0x1f
add edx, eax
mov eax, dword [0x406004]
mov dword [0x40600c], edx
cdq
idiv ecx
xor esi, esi
mov dword [0x406010], edx
mov eax, esi
mov ecx, dword [esp + 0x18]
cdq
idiv ebp
xor eax, eax
push 1
mov al, byte [edx + ecx]
xor edx, edx
mov dl, byte [esi + edi]
mov ecx, dword [section..data]
add edx, ebx
lea ebx, [edx + eax]
mov eax, 0xf2b9d649
imul ecx
add edx, ecx
mov ecx, dword [0x4069d0]
sar edx, 7
mov eax, edx
push ecx
shr eax, 0x1f
add edx, eax
and ebx, 0xff
mov dword [section..data], edx
call dword [sym.imp.USER32.dll_FlashWindow]
mov dl, byte [ebx + edi]
xor eax, eax
mov al, byte [esi + edi]
mov byte [esi + edi], dl
inc esi
mov byte [ebx + edi], al
cmp esi, 0x100
mov dword [0x40601c], 0x6a44
jl 0x40336f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4033f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x406028]
mov ecx, 0x3ca1
cdq
idiv ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, dword [sym.imp.USER32.dll_FlashWindow]
xor eax, eax
mov dword [0x40600c], 0x2d71
push edi
xor ebx, ebx
push 1
mov dword [0x406020], edx
mov al, byte [esi + 0x101]
mov edx, dword [0x406008]
mov bl, byte [esi + 0x100]
mov dword [esp + 0x1c], eax
mov eax, dword [0x4069d0]
add edx, 0xffffd578
push eax
mov dword [0x406024], edx
call ebp
mov eax, dword [esp + 0x20]
xor edi, edi
test eax, eax
jle 0x403530
mov ecx, dword [0x4069d8]
push 1
push ecx
call ebp
mov edx, dword [0x4069d4]
inc ebx
push 1
push edx
and ebx, 0xff
call ebp
mov ecx, dword [esp + 0x18]
xor eax, eax
mov al, byte [ebx + esi]
push 0
add ecx, eax
push 0x4166
mov dword [esp + 0x20], ecx
mov ecx, dword [0x4069d4]
push 0xe0
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x18]
mov edx, dword [0x4069d0]
push 0
push 0x697c
and ecx, 0xff
push 0xd6
push edx
mov dword [esp + 0x28], ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [esp + 0x18]
xor eax, eax
mov al, byte [ebx + esi]
push 1
mov dl, byte [ecx + esi]
mov dword [esp + 0x14], eax
mov byte [ebx + esi], dl
mov byte [ecx + esi], al
mov eax, dword [0x4069d8]
push eax
call ebp
mov cl, byte [ebx + esi]
mov eax, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x1c]
and ecx, 0xff
mov dl, byte [ecx + esi]
mov cl, byte [edi + eax]
xor cl, dl
mov byte [edi + eax], cl
mov ecx, dword [0x406038]
mov eax, 0xa4315895
imul ecx
add edx, ecx
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x20]
inc edi
mov dword [0x406010], edx
cmp edi, eax
jl 0x40345a
mov cl, byte [esp + 0x18]
pop edi
mov byte [esi + 0x101], cl
mov eax, dword [0x406018]
mov edx, eax
shl edx, 6
add edx, eax
lea ecx, [eax + edx*2]
shl ecx, 4
add ecx, eax
lea eax, [eax + ecx*4]
lea edx, [eax + eax*2]
mov eax, 0x8c08c08d
mov dword [0x406040], edx
mov byte [esi + 0x100], bl
mov ecx, dword [0x406048]
pop esi
imul ecx
add edx, ecx
pop ebp
sar edx, 7
mov eax, edx
pop ebx
shr eax, 0x1f
add edx, eax
mov dword [0x406048], edx
pop ecx
ret
Function at 0x1011d165
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
lodsb al, byte [esi]
xor al, dl
stosb byte es:[edi], al
ror edx, 8
loop 0x1011d175
popal
pop ebp
ret 0x10

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2e7f6a1d
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x470439a5
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x418c3c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x418c4b
pop dword [ebp - 0x18]
mov eax, 0x838248
add eax, 0xffbe0a03
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3bb79
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x6419f906
add ecx, 0x9be646c8
xor edi, edi
add edi, eax
mov ebx, 0xa11ff346
add ebx, 0x5f2360ba
add ebx, dword [ebp - 0x18]
mov esi, 0xe6782721
add esi, 0xe6dd30ce
add dword [ebp - 0x14], esi
mov edx, dword [ebx]
sub dword [ebp - 4], 0x6e687e13
xor edx, esi
xor dword [ebp - 4], ecx
mov dword [edi], edx
add dword [ebp - 0xc], 0x2fb5e155
add edi, 0xd2502e7b
sub edi, 0xd2502e77
add ebx, 0x9d389a57
sub ebx, 0x9d389a53
loop 0x418ca7
add eax, 0xf20b
mov ebx, eax
add eax, 5
mov ecx, 0x5d356065
sub ecx, 0x5cf56065
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x475000
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x52000]
push edi
or ebp, 0xffffffff
jmp 0x475022
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x475029
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x475018
mov eax, 1
add ebx, ebx
jne 0x47503b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47504c
jne 0x47506b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47506b
dec eax
add ebx, ebx
jne 0x475058
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x475030
add ebx, ebx
jne 0x475067
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4750bd
xor ecx, ecx
sub eax, 3
jb 0x475083
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4750f2
sar eax, 1
mov ebp, eax
jmp 0x47508e
add ebx, ebx
jne 0x47508e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47505c
inc ecx
add ebx, ebx
jne 0x47509c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47505c
add ebx, ebx
jne 0x4750a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47509e
jne 0x4750ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47509e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4750dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4750ce
jmp 0x47501e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4750dc
add edi, ecx
jmp 0x47501e
pop esi
mov edi, esi
mov ecx, 0x1116
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4750fa
cmp byte [edi], 0x11
jne 0x4750fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4750ff
lea edi, [esi + 0x72000]
mov eax, dword [edi]
or eax, eax
je 0x47516e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7f308]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7f34c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47512c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7f354]
or eax, eax
je 0x475168
mov dword [ebx], eax
add ebx, 4
jmp 0x475149
call dword [esi + 0x7f350]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x47519f
cmp al, 0xef
ja 0x475192
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x475174
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x475181
mov ebp, dword [esi + 0x7f358]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4751d3
sub esp, 0xffffff80
jmp 0x41ea80
Function at 0x41aecd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x41aedc
pop dword [ebp - 8]
mov eax, 0x41aedc
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x36a94
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0x3d6a
xor esi, esi
add esi, eax
mov edi, 0x6f54b405
sub edi, 0x6f10fc05
add edi, dword [ebp - 8]
mov edx, 0xf6396081
add edx, 0xa62d93e4
xor dword [ebp - 4], 0xdac2a1c0
mov ebx, dword [edi]
mov dword [ebp - 4], 0x80f9775b
sub ebx, edx
add dword [ebp - 4], eax
mov dword [esi], ebx
xor dword [ebp - 4], 0x2941c616
add esi, 0x691d2cb0
add esi, 0x96e2d354
add edi, 0x273893d9
add edi, 0xd8c76c2b
loop 0x41af2d
add eax, 0x71dddf8e
sub eax, 0x71dcf713
xor ebx, ebx
add ebx, eax
add eax, 0x89f34f49
add eax, 0x760cb0bc
mov ecx, 0x400000
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x421730
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x2d4
push esi
call dword [sym.imp.kernel32.dll_GetVersion]
cmp ax, 6
je 0x42176d
push str.SetDefaultDllDirectories
push 0x42c874
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x42176d
push 0xc00
call eax
test eax, eax
jne 0x421806
lea eax, [esp + 8]
push 0x106
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421806
cmp eax, 0x104
ja 0x421806
cmp word [esp + eax*2 + 6], 0x5c
je 0x42179c
mov word [esp + eax*2 + 8], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x421806
push ebp
lea ecx, [esp + eax*2 + 0xc]
push edi
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov dword [esp + 0xc], ecx
mov ebp, 0x6c
mov cl, byte [esi]
mov eax, dword [esp + 0xc]
inc esi
test cl, cl
je 0x4217db
xor dx, dx
add eax, 2
mov dl, cl
inc esi
mov word [eax - 2], dx
mov cl, byte [esi - 1]
test cl, cl
jne 0x4217c7
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], bp
mov word [eax + 6], bp
mov word [eax + 8], 0
push 8
lea eax, [esp + 0x14]
push 0
push eax
call edi
cmp byte [esi], 0
jne 0x4217bc
pop edi
pop ebp
pop esi
add esp, 0x2d4
ret
Function at 0x427230
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x427258
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x427267
mov eax, 1
ret 4

Function at 0x427ee0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [0x433158]
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x4284f0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
and eax, 0x3f
mov byte [eax + esi + 0x40], 0x80
inc eax
push edi
mov edi, edx
cmp eax, 0x38
jbe 0x428533
cmp eax, 0x40
je 0x428525
mov edx, 0x40
sub edx, eax
push edx
lea ecx, [eax + esi + 0x40]
push 0
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
xor eax, eax
mov ecx, 0x38
sub ecx, eax
push ecx
lea edx, [eax + esi + 0x40]
push 0
push edx
call sub.msvcrt.dll_memset
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap ecx
bswap eax
add esp, 0xc
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], eax
mov eax, dword [esi]
push 1
lea edx, [esi + 0x40]
lea ecx, [esi + 0x20]
call eax
lea ecx, [esi + 0x20]
mov edx, 4
mov eax, dword [ecx + 4]
mov ebp, dword [ecx]
bswap ebp
bswap eax
mov dword [edi], ebp
mov dword [edi + 4], eax
add edi, 8
add ecx, 8
dec edx
jne 0x428578
xor eax, eax
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x20], 0x6a09e667
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xf19d70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb10000]
push edi
or ebp, 0xffffffff
jmp 0xf19d92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xf19d99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf19d88
mov eax, 1
add ebx, ebx
jne 0xf19dab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xf19da0
jne 0xf19dbc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xf19da0
xor ecx, ecx
sub eax, 3
jb 0xf19dd0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xf19e42
mov ebp, eax
add ebx, ebx
jne 0xf19ddb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xf19de8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xf19e0c
inc ecx
add ebx, ebx
jne 0xf19df8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xf19ded
jne 0xf19e09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xf19ded
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xf19e2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xf19e1d
jmp 0xf19d8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xf19e2c
add edi, ecx
jmp 0xf19d8e
pop esi
mov edi, esi
mov ecx, 0x7ba
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xf19e4a
cmp byte [edi], 7
jne 0xf19e4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xf19e4f
lea edi, [esi + 0xb17000]
mov eax, dword [edi]
or eax, eax
je 0xf19ebe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb1db9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb1dbec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xf19e7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb1dbf4]
or eax, eax
je 0xf19eb8
mov dword [ebx], eax
add ebx, 4
jmp 0xf19e99
call dword [esi + 0xb1dbf0]
mov ebp, dword [esi + 0xb1dbf8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xf19ef2
sub esp, 0xffffff80
jmp 0x409116