joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089dd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c248]
jne 0x4089e7
repz ret
jmp fcn.004100bc

Function at 0x413bd1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ec96
and dword [ebp - 4], 0
cmp dword [0x43fc58], 0
mov ebx, eax
jne 0x413c82
push 0x402da0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413d33
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402d94
push edi
call esi
test eax, eax
je 0x413d33
push eax
call fcn.0040ec24
mov dword [esp], 0x402d84
push edi
mov dword [0x43fc58], eax
call esi
push eax
call fcn.0040ec24
mov dword [esp], 0x402d70
push edi
mov dword [0x43fc5c], eax
call esi
push eax
call fcn.0040ec24
mov dword [esp], 0x402d54
push edi
mov dword [0x43fc60], eax
call esi
push eax
call fcn.0040ec24
pop ecx
mov dword [0x43fc68], eax
test eax, eax
je 0x413c82
push 0x402d3c
push edi
call esi
push eax
call fcn.0040ec24
pop ecx
mov dword [0x43fc64], eax
mov eax, dword [0x43fc64]
cmp eax, ebx
je 0x413cda
cmp dword [0x43fc68], ebx
je 0x413cda
push eax
call fcn.0040ec9f
push dword [0x43fc68]
mov esi, eax
call fcn.0040ec9f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413cda
test edi, edi
je 0x413cda
call esi
test eax, eax
je 0x413cd1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413cd1
test byte [ebp - 0xc], 1
jne 0x413cda
or dword [ebp + 0x10], 0x200000
jmp 0x413d13
mov eax, dword [0x43fc5c]
cmp eax, ebx
je 0x413d13
push eax
call fcn.0040ec9f
pop ecx
test eax, eax
je 0x413d13
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413d13
mov eax, dword [0x43fc60]
cmp eax, ebx
je 0x413d13
push eax
call fcn.0040ec9f
pop ecx
test eax, eax
je 0x413d13
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43fc58]
call fcn.0040ec9f
pop ecx
test eax, eax
je 0x413d33
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413d35
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edx
dec ebx
mov esi, 0x7d6217d2
sub esp, 4
mov dword [esp], ebx
mov ebx, dword [esp]
add esp, 4
call fcn.0043b68a
or esi, esi
xor dword [ecx], edx
add esi, 0xad26cf41
or esi, ebx
add ecx, 1
inc esi
sub esi, 0x6f411e85
cmp ecx, eax
jne fcn.0043b647
and ebx, ebx
ret
Function at 0x416840
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a7cc6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4d1088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0047a4e7
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0045efda
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4175be
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4175f9
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4175e0
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4175f1
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4175fb
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4175d6
xor eax, eax
pop edi
pop esi
ret

Function at 0x419720
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
invalid
add ebp, 0x24
push esp
call fcn.0041757e
popfd
loopne 0x4196e4
cmpsb byte [esi], byte es:[edi]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x419742
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0041757e
sub dword [esi - 0x1c], edi
inc eax
mov edi, eax
clc
Function at 0x419750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
pop es
js 0x41975c
xlatb
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
sbb byte [ebx - 0x20fcdfa6], cl
call fcn.0041757e
or byte [ecx - 0x74b62de0], 0x34
mov eax, dword [ebx]
idiv dword [eax + 0x50746547]
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x41976b
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x41976b
call fcn.0041757e
arpl di, dx
fimul dword [eax + 0x3245a8b]
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0041757e
pop ds
jg 0x419756
invalid
mov bh, 0xff
jne 0x4197b5
push dword [ebp + 4]
push dword [ebp]
call fcn.00417d7e
or byte [ebx + 0xff0ffc9], al
ror dword [eax], 0x83
stc
add dword [ebp + 7], esi
in eax, 0xff
dec dword [eax]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
cmp ecx, 1
jne 0x4197cc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
push ebx
mov dword [ebp - 4], 0xffffffff
call fcn.0047a528
mov eax, dword [ebp - 0x10]
add esp, 4
cmp byte [edi + 0xd], 0
mov ebx, edi
je 0x419786
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41a5a0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4d1088]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 0xffffffff
jne 0x41a5e0
call fcn.00477000
mov dword [edi + 4], eax
or eax, esi
mov dword [edi], 0x2719
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047a4d6
mov esp, ebp
pop ebp
ret
push 0
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x110], 1
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov ebx, eax
call fcn.00477000
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi], eax
mov dword [edi + 4], esi
test ebx, ebx
js 0x41a64a
call fcn.00477000
mov dword [edi], 0
mov dword [edi + 4], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047a4d6
mov esp, ebp
pop ebp
ret
Function at 0x478360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae862
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4d1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x4783a1
mov eax, dword [edi]
jmp 0x4783a3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x4783c2
push esi
push edi
push ebx
call fcn.00478150
add esp, 0xc
jmp 0x4784be
test eax, 0x400
je 0x47847d
cmp dword [edi + 0x14], 8
jb 0x4783d7
mov eax, dword [edi]
jmp 0x4783d9
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.004774d0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00432c80
cmp esi, 0xffffffff
jne 0x478432
push dword [ebp - 0x34]
push edi
push ebx
call fcn.00478150
add esp, 0xc
jmp 0x4784be
push edi
call fcn.00477cc0
add esp, 4
test al, al
jne 0x478465
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00477da0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4784be
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x47848f
mov dword [esi], 0
call fcn.00477000
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x4784a6
mov dword [ebp - 0x30], 2
call fcn.00477da0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047a4d6
mov esp, ebp
pop ebp
ret

Function at 0x49c060
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049bedf

Function at 0x49f95f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049f2cd

Function at 0x49f96a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049f508
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x417680
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
jmp 0x41769a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4176a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417690
mov eax, 1
add ebx, ebx
jne 0x4176b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4176a8
jne 0x4176c4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4176a8
xor ecx, ecx
sub eax, 3
jb 0x4176d8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41774a
mov ebp, eax
add ebx, ebx
jne 0x4176e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4176f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417714
inc ecx
add ebx, ebx
jne 0x417700
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4176f5
jne 0x417711
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4176f5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417734
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417725
jmp 0x417696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417734
add edi, ecx
jmp 0x417696
pop esi
mov edi, esi
mov ecx, 0xe7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417752
cmp byte [edi], 8
jne 0x417752
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417757
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x4177cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417784
mov ecx, edi
jns 0x4177b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x4177c9
mov dword [ebx], eax
add ebx, 4
jmp 0x4177a1
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417803
sub esp, 0xffffff80
jmp 0x40bbd9
Function at 0x40184d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40188c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40188c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40188c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40188c
cmp dword [ecx + 0x74], 0xe
jbe 0x40188c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x959130
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00959280
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x959156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x959142
add dl, dl
jne 0x959161
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9591b4
xor eax, eax
add dl, dl
jne 0x95916e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x959255
add dl, dl
jne 0x95917d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x959188
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x959193
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x95919e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9591aa
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x95914d
mov eax, 1
add dl, dl
jne 0x9591c2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9591cd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9591b9
sub eax, ebx
mov ebx, 1
jne 0x959200
mov ecx, 1
add dl, dl
jne 0x9591e6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9591f1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9591dd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95914d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x959217
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x959222
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x95920e
cmp eax, 0x7d00
jae 0x959245
cmp eax, 0x500
jb 0x959240
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95914d
cmp eax, 0x7f
ja 0x959248
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x95914d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x959276
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x95914d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403400
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x200c
call fcn.0040d370
mov eax, dword [0x4561e4]
mov ecx, dword [0x456158]
shr eax, 3
test eax, eax
jbe 0x403532
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403450
cmp dword [0x4561e4], 0x959
jne 0x403514
push 0
lea eax, [esp + 0x420]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0xc20]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x1420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1820]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402cbc
push 0x402cd8
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00403240
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403450
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
Function at 0x407893
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x445ab0]
jne 0x40789d
repz ret
jmp fcn.0040abcb

Function at 0x40a75d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405bf8
and dword [ebp - 4], 0
cmp dword [0x446fa8], 0
mov ebx, eax
jne 0x40a80e
push 0x4023bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a8bf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4023b0
push edi
call esi
test eax, eax
je 0x40a8bf
push eax
call fcn.00405b86
mov dword [esp], 0x4023a0
push edi
mov dword [0x446fa8], eax
call esi
push eax
call fcn.00405b86
mov dword [esp], 0x40238c
push edi
mov dword [0x446fac], eax
call esi
push eax
call fcn.00405b86
mov dword [esp], 0x402370
push edi
mov dword [0x446fb0], eax
call esi
push eax
call fcn.00405b86
pop ecx
mov dword [0x446fb8], eax
test eax, eax
je 0x40a80e
push 0x402358
push edi
call esi
push eax
call fcn.00405b86
pop ecx
mov dword [0x446fb4], eax
mov eax, dword [0x446fb4]
cmp eax, ebx
je 0x40a866
cmp dword [0x446fb8], ebx
je 0x40a866
push eax
call fcn.00405c01
push dword [0x446fb8]
mov esi, eax
call fcn.00405c01
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a866
test edi, edi
je 0x40a866
call esi
test eax, eax
je 0x40a85d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a85d
test byte [ebp - 0xc], 1
jne 0x40a866
or dword [ebp + 0x10], 0x200000
jmp 0x40a89f
mov eax, dword [0x446fac]
cmp eax, ebx
je 0x40a89f
push eax
call fcn.00405c01
pop ecx
test eax, eax
je 0x40a89f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a89f
mov eax, dword [0x446fb0]
cmp eax, ebx
je 0x40a89f
push eax
call fcn.00405c01
pop ecx
test eax, eax
je 0x40a89f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x446fa8]
call fcn.00405c01
pop ecx
test eax, eax
je 0x40a8bf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a8c1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x55da90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x107000]
push edi
or ebp, 0xffffffff
jmp 0x55dab2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55dab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55daa8
mov eax, 1
add ebx, ebx
jne 0x55dacb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55dadc
jne 0x55dafb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55dafb
dec eax
add ebx, ebx
jne 0x55dae8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55dac0
add ebx, ebx
jne 0x55daf7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55db4d
xor ecx, ecx
sub eax, 3
jb 0x55db13
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55db82
sar eax, 1
mov ebp, eax
jmp 0x55db1e
add ebx, ebx
jne 0x55db1e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55daec
inc ecx
add ebx, ebx
jne 0x55db2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55daec
add ebx, ebx
jne 0x55db39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55db2e
jne 0x55db4a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55db2e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55db6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55db5e
jmp 0x55daae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55db6c
add edi, ecx
jmp 0x55daae
pop esi
mov edi, esi
mov ecx, 0x3a7e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55db8a
cmp byte [edi], 0x1e
jne 0x55db8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55db8f
lea edi, [esi + 0x15a000]
mov eax, dword [edi]
or eax, eax
je 0x55dc07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b6200]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b632c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55dbbc
mov ecx, edi
jns 0x55dbeb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b6330]
or eax, eax
je 0x55dc01
mov dword [ebx], eax
add ebx, 4
jmp 0x55dbd9
call dword [esi + 0x1b6338]
mov ebp, dword [esi + 0x1b6334]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55dc3b
sub esp, 0xffffff80
jmp 0x47bcb4
Function at 0x10061594
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x100615b5
jl 0x100615ac
test edi, edi
jne 0x100615b5
xor eax, eax
xor edx, edx
jmp 0x10061676
cmp dword [ebx + 0x38], 0
je 0x100615ca
push eax
push edi
push dword [ebp + 8]
call fcn.10022ee0
jmp 0x10061676
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10061611
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10061611
cmp eax, edi
jb 0x100615eb
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.10064c00
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10061617
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x1006166b
mov ecx, ebx
call fcn.10060eff
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x10061656
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.10072053
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x1006166b
jmp 0x10061629
test edx, edx
je 0x1006166b
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.10072053
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x1007438d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [0x10090084]
test eax, eax
je 0x100743cc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100743cc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100743cc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100743cc
cmp dword [ecx + 0x74], 0xe
jbe 0x100743cc
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10086dd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10086dfd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10086dfd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret