joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]
Function at 0x45c550
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x432015
lea edi, [esi - 0x31015]
push edi
or ebp, 0xffffffff
jmp 0x45c572
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45c579
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45c568
mov eax, 1
add ebx, ebx
jne 0x45c58b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45c580
jne 0x45c59c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c580
xor ecx, ecx
sub eax, 3
jb 0x45c5b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45c622
mov ebp, eax
add ebx, ebx
jne 0x45c5bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x45c5c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x45c5ec
inc ecx
add ebx, ebx
jne 0x45c5d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45c5cd
jne 0x45c5e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45c5cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45c60c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45c5fd
jmp 0x45c56e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45c60c
add edi, ecx
jmp 0x45c56e
pop esi
mov edi, esi
mov ecx, 0x72f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45c62a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45c62f
lea edi, [esi + 0x5a000]
mov eax, dword [edi]
or eax, eax
je 0x45c697
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5c25c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5c2c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45c655
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5c2d0]
or eax, eax
je 0x45c691
mov dword [ebx], eax
add ebx, 4
jmp 0x45c672
call dword [esi + 0x5c2cc]
mov ebp, dword [esi + 0x5c2d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45c6cb
sub esp, 0xffffff80
jmp 0x42c0b0
Function at 0x462a10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x43000]
push edi
jmp 0x462a2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x462a31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x462a20
mov eax, 1
add ebx, ebx
jne 0x462a43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x462a38
jne 0x462a54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x462a38
xor ecx, ecx
sub eax, 3
jb 0x462a68
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x462ada
mov ebp, eax
add ebx, ebx
jne 0x462a73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x462a80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x462aa4
inc ecx
add ebx, ebx
jne 0x462a90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x462a85
jne 0x462aa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x462a85
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x462ac4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x462ab5
jmp 0x462a26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x462ac4
add edi, ecx
jmp 0x462a26
pop esi
mov edi, esi
mov ecx, 0x1024
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x462ae2
cmp byte [edi], 0x11
jne 0x462ae2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x462ae7
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x462b56
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x63e34]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x63e5c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x462b14
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x63e64]
or eax, eax
je 0x462b50
mov dword [ebx], eax
add ebx, 4
jmp 0x462b31
call dword [esi + 0x63e60]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x462b87
cmp al, 0xef
ja 0x462b7a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x462b5c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x462b69
mov ebp, dword [esi + 0x63e68]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x462bbb
sub esp, 0xffffff80
jmp 0x41cab5
Function at 0x460dc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3e000]
lea eax, [edi + 0x4fcac]
push dword [eax]
mov dword [eax], 0x56076cf7
push eax
push edi
jmp 0x460dea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x460df1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x460de0
mov eax, 1
add ebx, ebx
jne 0x460e03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x460e14
jne 0x460e33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x460e33
dec eax
add ebx, ebx
jne 0x460e20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x460df8
add ebx, ebx
jne 0x460e2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x460e85
xor ecx, ecx
sub eax, 3
jb 0x460e4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x460eba
sar eax, 1
mov ebp, eax
jmp 0x460e56
add ebx, ebx
jne 0x460e56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x460e24
inc ecx
add ebx, ebx
jne 0x460e64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x460e24
add ebx, ebx
jne 0x460e71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x460e66
jne 0x460e82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x460e66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x460ea4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x460e96
jmp 0x460de6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x460ea4
add edi, ecx
jmp 0x460de6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x17a1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x460ec6
cmp byte [edi], 0xe
jne 0x460ec6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x460ecb
lea edi, [esi + 0x5c000]
mov eax, dword [edi]
or eax, eax
je 0x460f43
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x622d0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6241c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x460ef8
mov ecx, edi
jns 0x460f27
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62424]
or eax, eax
je 0x460f3d
mov dword [ebx], eax
add ebx, 4
jmp 0x460f15
call dword [esi + 0x62420]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x460f74
cmp al, 0xef
ja 0x460f67
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x460f49
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x460f56
mov ebp, dword [esi + 0x62428]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x460fa8
sub esp, 0xffffff80
jmp 0x40474b
Function at 0x10009220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x1000922f
pop dword [ebp - 0x38]
mov eax, 0x5cadf9d5
add eax, 0xb352985a
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x21fb09b7
sub dword [ebp - 0x48], 0xd3a8c46c
mov dword [ebp - 0x44], 0x6c28907b
add dword [ebp - 0x44], 0xc60abbca
mov dword [ebp - 0x40], 0x788e41f4
add dword [ebp - 0x40], 0xd3be023a
mov dword [ebp - 0x3c], 0xc974d6cd
add dword [ebp - 0x3c], 0x368b2933
lea eax, [ebp - 0x48]
push eax
mov eax, 0x3aa0b5b6
add eax, 0xd55feb02
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x252e341d
add dword [ebp - 0x48], 0x4f443539
mov dword [ebp - 0x44], 0x5c1d022e
sub dword [ebp - 0x44], 0x1ab0a0b9
mov dword [ebp - 0x40], 0x7a2fc52d
sub dword [ebp - 0x40], 0x16c058c1
mov dword [ebp - 0x3c], 0x17cd077e
sub dword [ebp - 0x3c], 0x17cd077e
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x889dc0d4
add eax, 0x8762df9c
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x36a64
push 0
call eax
mov ecx, 0xbf4d81f7
add ecx, 0x40b2c096
mov ebx, eax
mov esi, 0x4e3051ac
sub esi, 0x3e2f1fac
add esi, dword [ebp - 0x38]
mov edi, 0xe3b580e3
xor dword [ebp - 0x34], eax
mov edx, dword [esi]
sub dword [ebp - 0x24], 0xb5311dbe
xor edx, edi
xor dword [ebp - 8], esi
mov dword [ebx], edx
mov dword [ebp - 0x28], 0x7fdcf197
add ebx, 4
add esi, 0xf8102b8d
sub esi, 0xf8102b89
loop 0x1000934b
add eax, 0xa6b66492
add eax, 0x594a9875
xor ebx, ebx
add ebx, eax
add eax, 0xb32c4e4
add eax, 0xf4cd3b21
mov ecx, 0x24184c8a
add ecx, 0xebe7b376
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x4015b0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
jmp 0x4015c8
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x401622
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x4015e9
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x401613
mov eax, dword [ebp - 4]
and eax, 1
test eax, eax
je 0x401609
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 4], ecx
jmp 0x401611
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
jmp 0x4015e0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x42ecc8], ecx
jmp 0x4015bf
mov esp, ebp
pop ebp
ret
Function at 0x401dd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jb 0x401e0b
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402a80
add esp, 4
and eax, 0xff
test eax, eax
jne 0x401e19
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00402e80
add esp, 4
push 0x42ea28
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00402990
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401e59
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x5c
mov eax, dword [ebp - 4]
push eax
call fcn.00402ae0
add esp, 8
mov byte [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x402750
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404780
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3d8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3e4]
push ecx
call fcn.00401000
add esp, 8
lea edx, [ebp - 0x3e4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 1]
cmp ecx, 0x3a
jne 0x4027db
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx]
test edx, edx
je 0x4027db
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
cmp ecx, 0x5c
jne 0x4027db
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40284d
mov edx, dword [ebp - 0x14]
movsx eax, byte [edx]
cmp eax, 0x5c
jne 0x402842
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0
lea edx, [ebp - 0x3e4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x40282d
push 0
lea eax, [ebp - 0x3e4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40282b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40282b
xor al, al
jmp 0x40286d
jmp 0x40283c
mov ecx, dword [ebp - 0x18]
and ecx, 0x10
cmp ecx, 0x10
je 0x40283c
xor al, al
jmp 0x40286d
mov edx, dword [ebp - 0x14]
mov byte [edx], 0x5c
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
jmp 0x4027db
jmp 0x402864
mov dword [ebp - 4], 0xffffffff
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402a50
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 1
test eax, eax
je 0x402a73
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ebp
ret

Function at 0x402a80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
pop ebp
ret
Function at 0x402cd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.00401000
add esp, 8
lea edx, [ebp - 0x104]
push edx
call fcn.00402be0
add esp, 4
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x42e930
call fcn.00401830
add esp, 4
add eax, 1
push eax
push 0x42e930
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401830
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.00402b30
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.00401830
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00401830
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
call fcn.00402b30
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call fcn.00401830
add esp, 4
add eax, 1
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401830
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
call fcn.00402b30
add esp, 0xc
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x403150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov ecx, 5
mov esi, 0x42e9dc
lea edi, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x14], 0x52
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [0x42f0c8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42f0e0], eax
push 0x42e9cc
call fcn.00402ec0
add esp, 4
push eax
mov edx, dword [0x42f0c8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x42f0d4], eax
mov dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x4e72454b
mov dword [ebp - 0x1c], 0x32336c65
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403ab0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x634
push edi
mov byte [ebp - 0x240], 0
mov ecx, 0x8e
xor eax, eax
lea edi, [ebp - 0x23f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x403aef
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401830
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 1]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
je 0x403c4d
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 1]
test ecx, ecx
je 0x403c4d
mov edx, dword [ebp - 4]
push edx
call fcn.00402e80
add esp, 4
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.00401830
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00401020
add esp, 0xc
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0x5cf345ca
je 0x403b5d
cmp dword [ebp - 0x634], 0x642d3b30
je 0x403b5d
cmp dword [ebp - 0x634], 0x8a705f51
jne 0x403b62
jmp 0x403ad9
mov edx, dword [0x42e95c]
push edx
lea eax, [ebp - 0x240]
push eax
call fcn.00401000
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x240]
push edx
call fcn.004029e0
add esp, 8
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x62c]
push edx
push 0x42eb6c
lea eax, [ebp - 0x240]
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x403bc0
jmp 0x403ad9
lea ecx, [ebp - 0x240]
push ecx
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0x42f6ec
push 0x120
push 0x42eb64
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004010b0
add esp, 0x1c
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x403c48
mov eax, dword [ebp - 0x630]
push eax
call fcn.00403450
add esp, 4
and eax, 0xff
test eax, eax
je 0x403c24
mov al, 1
jmp 0x403c4f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x630]
push ecx
call dword [0x42ec9c]
mov edx, dword [ebp + 0x14]
push edx
call fcn.00402a50
add esp, 4
jmp 0x403ad9
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x6c6f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x260000]
push edi
jmp 0x6c6f2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6c6f31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c6f20
mov eax, 1
add ebx, ebx
jne 0x6c6f43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6c6f54
jne 0x6c6f73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c6f73
dec eax
add ebx, ebx
jne 0x6c6f60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6c6f38
add ebx, ebx
jne 0x6c6f6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6c6fc5
xor ecx, ecx
sub eax, 3
jb 0x6c6f8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6c6ffa
sar eax, 1
mov ebp, eax
jmp 0x6c6f96
add ebx, ebx
jne 0x6c6f96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c6f64
inc ecx
add ebx, ebx
jne 0x6c6fa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6c6f64
add ebx, ebx
jne 0x6c6fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6c6fa6
jne 0x6c6fc2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6c6fa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6c6fe4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6c6fd6
jmp 0x6c6f26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6c6fe4
add edi, ecx
jmp 0x6c6f26
pop esi
mov edi, esi
mov ecx, 0x5cd2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6c7002
cmp byte [edi], 0x1b
jne 0x6c7002
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6c7007
mov ebp, dword [esi + 0x2d26fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6c7062
sub esp, 0xffffff80
jmp 0x467391
Function at 0xe43194
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe4319e
pushal
call 0xe431a4
pop ebp
sub ebp, 0x10
sub ebp, 0xa43194
jmp 0xe431ba
mov eax, 0xa43194
add eax, ebp
add eax, 0x4c
mov ecx, 0x5aa
mov edx, 0x77d1d6c
xor byte [eax], dl
inc eax
dec ecx
jne 0xe431d1
jmp 0xe431e4
out 0xa1, eax
out 0xe5, eax
push eax
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
in eax, dx
lodsd eax, dword [esi]
xchg esp, eax
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
mov eax, dword [0x6c6c6bd4]
insb byte es:[edi], dx
salc
inc esp
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
wait
mov gs, word [edi - 0x5c]
out 0xed, eax
pushal
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
test eax, 0x904808e1
in eax, 0x68
dec eax
loope 0xe4321b
dec eax
nop
in eax, 0x68
dec eax
add al, 0xb4
dec ebp
dec ebp
insb byte es:[edi], dx
add al, 0xd5
invalid