joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401020
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
cmp word [esi], 0x22
jne 0x4010b0
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x401053
cmp ax, 0x22
je 0x401059
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401041
cmp word [esi], 0x22
jne 0x40105c
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x401076
cmp ax, 0x20
ja 0x401076
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x401064
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x18], 1
movzx eax, word [ebp - 0x14]
jne 0x401096
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp word [esi], 0x20
jbe 0x40105c
add esi, 2
jmp 0x4010b0
Function at 0x4063f3
Capabilities:
Terminate process

Disassembly:
call fcn.004068b9
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x435980
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004366c0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004366c0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4359e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x43a070]
test esi, esi
jle 0x435b00
mov eax, dword [0x43a074]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x435a14
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x435a97
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x435a00
mov dword [esp], ebx
call fcn.004363d0
mov edi, eax
test eax, eax
je 0x435b27
mov eax, dword [0x43a074]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00436510
mov edx, dword [0x43a074]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x435b07
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x435a90
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x435aa0
add dword [0x43a070], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x43a074]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x435a90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00435980
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x435a1e
mov eax, dword [0x43a074]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00435980
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00435980
lea esi, [esi]
nop
Function at 0x436040
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x43a08c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x43a084]
sub esp, 4
test ebx, ebx
je 0x436095
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x43608e
test esi, esi
je 0x43608e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x436070
mov dword [esp], 0x43a08c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4363d0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x4363f5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x436400
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x4363f5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x436448
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x43643e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x43644a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x436430
xor eax, eax
pop ebx
pop esi
ret
Function at 0x408729
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
and dword [esp], 0
push ebx
mov ebx, dword [esp + 0x10c]
cmp dword [ebx + 0x240], 0
je 0x4087e2
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, 0x80
cmp byte [esp + 0x19], al
jne 0x40876e
test word [ebx + 0x23c], 0x800
jne 0x40876e
mov dword [esp + 4], 8
cmp byte [esp + 0x1a], al
jne 0x408784
test word [ebx + 0x23c], 0x100
jne 0x408784
or dword [esp + 4], 1
mov ecx, dword [ebx + 0x24c]
cmp byte [esp + ecx + 8], al
je 0x408796
cmp byte [esp + 0x18], al
jne 0x4087a6
test word [ebx + 0x23c], 0x200
jne 0x4087a6
or dword [esp + 4], 2
cmp byte [esp + 0xa9], al
jne 0x4087bf
test word [ebx + 0x23c], 0x400
jne 0x4087bf
or dword [esp + 4], 4
cmp byte [esp + 0x63], al
jne 0x4088c4
test word [ebx + 0x23c], 0x1000
jne 0x4088c4
or dword [esp + 4], 0x10
jmp 0x4088c4
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
jne 0x408808
push 0x11
call ebp
test si, ax
je 0x40881b
test word [ebx + 0x23c], 0x800
jne 0x40881b
mov dword [esp + 0x10], 8
push 0x12
call edi
test si, ax
jne 0x40882d
push 0x12
call ebp
test si, ax
je 0x40883d
test word [ebx + 0x23c], 0x100
jne 0x40883d
or dword [esp + 0x10], 1
add ebx, 0x24c
push dword [ebx]
call edi
test si, ax
jne 0x408855
push dword [ebx]
call ebp
test si, ax
je 0x40886c
mov eax, dword [esp + 0x118]
test word [eax + 0x23c], 0x200
jne 0x40886c
or dword [esp + 0x10], 2
mov ebx, 0xa1
push ebx
call edi
test si, ax
jne 0x408881
push ebx
call ebp
test si, ax
je 0x408898
mov eax, dword [esp + 0x118]
test word [eax + 0x23c], 0x400
jne 0x408898
or dword [esp + 0x10], 4
push 0x5b
call edi
test si, ax
jne 0x4088aa
push 0x5b
call ebp
test si, ax
je 0x4088c1
mov eax, dword [esp + 0x118]
test word [eax + 0x23c], 0x1000
jne 0x4088c1
or dword [esp + 0x10], 0x10
pop edi
pop esi
pop ebp
mov eax, dword [esp + 4]
pop ebx
add esp, 0x104
ret 4
Function at 0x40d0aa
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
push esi
mov esi, eax
lea eax, [ebp - 0x29c]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x40d16a
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call sub.WSOCK32.dll_gethostname
lea eax, [ebp - 0x10c]
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40d16a
mov eax, dword [eax + 0xc]
xor edx, edx
cmp dword [eax], edx
je 0x40d104
mov ecx, eax
add ecx, 4
inc edx
cmp dword [ecx], 0
jne 0x40d0fb
cmp esi, edx
jle 0x40d119
push str.0.0.0.0
push dword [ebp + 8]
call fcn.0044e973
pop ecx
pop ecx
jmp 0x40d163
push 4
push dword [eax + esi*4 - 4]
lea eax, [ebp - 8]
push eax
call fcn.00450dd0
add esp, 0xc
push dword [ebp - 8]
call sub.WSOCK32.dll_inet_ntoa
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00450c40
lea eax, [ebp - 0x10c]
push eax
or eax, 0xffffffff
call fcn.0040ded4
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0044e973
push esi
call fcn.0044e722
add esp, 0x18
call sub.WSOCK32.dll_WSACleanup
jmp 0x40d179
push 0x46bf68
push dword [ebp + 8]
call fcn.0044e973
pop ecx
pop ecx
pop esi
leave
ret

Function at 0x40d288
Capabilities:
Enumerate gui resources
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [0x48b7b4], 0
push ebx
push esi
mov ebx, eax
je 0x40d2f3
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40d2b6
xor eax, eax
jmp 0x40d335
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40d2f5
jmp 0x40d2b2
xor esi, esi
cmp byte [0x48b7b5], 0
je 0x40d312
test bl, 4
je 0x40d312
push esi
push 0x40d339
xor ebx, 4
call dword [sym.imp.USER32.dll_EnumWindows]
cmp ebx, 0x20
je 0x40d326
cmp ebx, 0x40
je 0x40d326
push esi
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x40d335
xor eax, eax
cmp ebx, 0x20
sete al
push esi
push eax
call sub.KERNEL32.DLL_SetSystemPowerState
pop esi
pop ebx
leave
ret

Function at 0x40d375
Capabilities:
Log keystrokes

Disassembly:
cmp byte [esp + 8], 1
jne 0x40d38e
push dword [esp + 4]
call fcn.0040d350
test al, al
pop ecx
jne 0x40d3aa
push 1
jmp 0x40d390
push 0
push 0
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
ret
Function at 0x401318
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0x5818
call fcn.004019ec
call fcn.004017e0
lea ebx, [ebp - 0x580c]
mov esi, 0x403040
mov ecx, 0x15fd
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call sub.KERNEL32.dll_FreeConsole
mov esi, dword [ebp - 0x618]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x57f4
mov dword [esp], 0
call sub.KERNEL32.dll_VirtualAlloc
sub esp, 0x10
mov edi, eax
xor ecx, ecx
nop
mov edx, edi
mov al, byte [ebx + ecx]
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0x57f4
jne 0x401384
lea ecx, [edi + 0x51f4]
nop
xor dword [edx], esi
add esi, 0x499602d2
add edx, 4
cmp edx, ecx
jne 0x40139c
call edi
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
leave
lea esp, [ecx - 4]
ret

Function at 0x4014d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
test ecx, ecx
mov dword [ebp - 0xc], ebx
mov ebx, eax
mov dword [ebp - 8], esi
mov esi, edx
mov dword [ebp - 4], edi
mov edi, ecx
jne 0x4014f6
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x40158a
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x401545
cmp eax, 0x40
je 0x401545
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x4014e9
cmp eax, 0x40
je 0x4014e9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x4014e9
mov dword [esp + 8], 0x34
mov dword [esp + 4], str..._.._runtime_pseudo_reloc.c
mov dword [esp], str.VirtualQuery__addr__b__sizeof_b__
call sub.msvcrt.dll__assert
lea esi, [esi]
lea edi, [edi]
Function at 0x409681
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a344]
jne 0x40968b
repz ret
jmp fcn.0040e06c

Function at 0x41229c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a344]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b70f
and dword [ebp - 0x14], 0
cmp dword [0x46b48c], 0
mov dword [ebp - 0x18], eax
jne 0x41234f
push 0x403764
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4123f7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403758
push ebx
call edi
test eax, eax
je 0x4123f7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403748
push ebx
mov dword [0x46b48c], eax
call edi
push eax
call esi
push 0x403734
push ebx
mov dword [0x46b490], eax
call edi
push eax
call esi
push 0x403718
push ebx
mov dword [0x46b494], eax
call edi
push eax
call esi
mov dword [0x46b49c], eax
test eax, eax
je 0x41234f
push 0x403700
push ebx
call edi
push eax
call esi
mov dword [0x46b498], eax
mov eax, dword [0x46b498]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4123a8
cmp dword [0x46b49c], ecx
je 0x4123a8
push eax
call esi
push dword [0x46b49c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4123a8
test ebx, ebx
je 0x4123a8
call edi
test eax, eax
je 0x41239f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41239f
test byte [ebp - 8], 1
jne 0x4123a8
or dword [ebp + 0x10], 0x200000
jmp 0x4123db
mov eax, dword [0x46b490]
cmp eax, dword [ebp - 0x18]
je 0x4123db
push eax
call esi
test eax, eax
je 0x4123db
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4123db
mov eax, dword [0x46b494]
cmp eax, dword [ebp - 0x18]
je 0x4123db
push eax
call esi
test eax, eax
je 0x4123db
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46b48c]
call esi
test eax, eax
je 0x4123f7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4123f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409681
leave
ret
Function at 0x414210
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1400
call fcn.00413870
cmp dword [0x80b5e4], 0x37
jne 0x4142a1
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push 0x403f58
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x403fb4
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
lea edx, [esp + 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x80c1c8]
mov edx, dword [0x808644]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1400
ret
Function at 0x45aa00
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x460f9f
call fcn.0045c888
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x45ab12
cmp byte [esi + 0x42], bl
je 0x45ab12
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp ax, di
jne 0x45aa3c
xor al, al
jmp 0x45ab14
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00413bf0
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040fc50
mov ecx, eax
call fcn.004140a0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040fc50
mov ecx, eax
call fcn.004140a0
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x45aaac
dec eax
je 0x45aab0
dec eax
dec eax
je 0x45ab0e
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00407df0
mov al, bl
jmp 0x45ab14
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040fc50
mov ecx, eax
call fcn.004140a0
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x45aaf0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040fc50
mov ecx, eax
call fcn.004140a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0043f127
add esp, 0x10
cmp edi, eax
jne 0x45aa9a
cmp byte [esi + 0x42], 0
je 0x45ab0e
test edi, edi
jne 0x45aa4a
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00407b50
jmp 0x45aa4a
mov bl, 1
jmp 0x45aa9c
mov al, 1
call fcn.0045c8d2
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x103958e9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
seta ah
mov eax, 0x9365566
pushfd
bswap ax
push ecx
mov ax, 0x3526
lahf
push ebp
mov eax, ebp
cbw
push edx
bswap edx
cwd
push ebx
movzx bx, bl
mov bh, 0x51
rdtsc
push esi
push edi
cdq
rdtsc
mov eax, 0
xchg edx, esi
not bp
push eax
bswap dx
movzx ebx, si
inc di
mov esi, dword [esp + 0x28]
movsx ebx, di
not cl
inc esi
cmc
xor esi, 0x22085bcc
bts edx, ecx
add di, bp
lea esi, [esi - 0x53cc2df2]
not ecx
bts ebp, ebx
btr ebp, esp
not esi
setne bh
ror dh, cl
bt ebx, 0xb8
sub esi, 0x5dda2d2c
movsx dx, dl
bt edx, ebx
xadd bp, di
add esi, eax
sbb edx, ebx
mov edi, esp
and dx, bp
lea esp, [esp - 0xc0]
mov ebx, esi
mov ecx, 0
sub ebx, ecx
lea ebp, [0x10395983]
mov edx, dword [esi]
cmp esi, 0x68336f5b
lea esi, [esi + 4]
xor edx, ebx
jmp 0x1090a6de
push ebp
ret
dec edx
stc
ror edx, 1
xor edx, 0x3dd01368
sub edx, 0x7183712b
cmc
rol edx, 2
test dx, ax
test edx, 0x56d935d3
xor ebx, edx
stc
clc
cmc
add ebp, edx
jmp 0x10806c76
Function at 0x1976a10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x723000]
push edi
or ebp, 0xffffffff
jmp 0x1976a32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1976a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1976a28
mov eax, 1
add ebx, ebx
jne 0x1976a4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1976a5c
jne 0x1976a7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1976a7b
dec eax
add ebx, ebx
jne 0x1976a68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1976a40
add ebx, ebx
jne 0x1976a77
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1976acd
xor ecx, ecx
sub eax, 3
jb 0x1976a93
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1976b02
sar eax, 1
mov ebp, eax
jmp 0x1976a9e
add ebx, ebx
jne 0x1976a9e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1976a6c
inc ecx
add ebx, ebx
jne 0x1976aac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1976a6c
add ebx, ebx
jne 0x1976ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1976aae
jne 0x1976aca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1976aae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1976aec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1976ade
jmp 0x1976a2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1976aec
add edi, ecx
jmp 0x1976a2e
pop esi
mov edi, esi
mov ecx, 0x4c65a7
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1976b27
cmp byte [edi], 0x87
jne 0x1976b0c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x1976b0a
lea edi, [esi + 0xa72000]
mov eax, dword [edi]
or eax, eax
je 0x1976b6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaf22b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xaf23dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1976b2d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xaf23e0]
or eax, eax
je 0x1976b69
mov dword [ebx], eax
add ebx, 4
jmp 0x1976b4a
call dword [esi + 0xaf23f0]
mov ebp, dword [esi + 0xaf23e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1976ba3
sub esp, 0xffffff80
jmp 0x142c580
Function at 0x100015c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009f83d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x100bd080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x100b4400]
xor ecx, ecx
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x73694563
mov dword [ebp - 0x2c], 0x74637268
mov byte [ebp - 0x28], 0
mov al, byte [ebp - 0x40]
xor byte [ebp + ecx - 0x3f], al
inc ecx
cmp ecx, 0x17
jb 0x10001618
mov byte [ebp - 0x28], 0
mov dl, 0x2e
mov dword [ebp - 0x20], 0x5c4b452e
xor ecx, ecx
mov dword [ebp - 0x1c], 0x1d424b40
mov dword [ebp - 0x18], 0x424a001c
mov word [ebp - 0x14], 0x42
lea eax, [ebp - 0x1f]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, 0xc
jae 0x10001659
mov dl, byte [ebp - 0x20]
jmp 0x10001648
lea eax, [ebp - 0x1f]
mov byte [ebp - 0x13], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x3f]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
call fcn.100196a0
cmp al, 0xe9
jne 0x10001715
movaps xmm0, xmmword [0x100b4090]
xor ecx, ecx
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x4d
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x10001694
xorps xmm0, xmm0
mov byte [ebp - 0x13], 0
lea ecx, [ebp - 0x23]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x2c], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100016c0
sub ecx, edx
lea eax, [ebp - 0x23]
push ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.10002570
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.1001e700
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x10001715
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000170b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10001727
push ecx
push edx
call fcn.1007fa16
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.10084b1f
int3