joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56b080
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [ecx + 0xc], 0x45f479d7
mov dword [ecx], 0
mov esi, ecx
mov dword [ecx + 0x18], 0xf3cb3e57
mov dword [esi + 0x1c], 0x40092ee0
mov dword [esi + 8], 0x75bbf938
mov dword [esi + 0x10], 0xfd3371b0
mov dword [esi + 0x20], 0x8a4406c7
mov dword [esi + 0x24], 0x2cc8e4f
mov dword [esi + 0x28], 0xd12c3bc9
mov dword [esi + 0x30], 0xebcc478b
mov dword [esi + 0x34], 0x489225be
mov dword [esi + 0x38], 0xafda13f8
mov dword [esi + 0x10], 0x3f4cdc6c
mov dword [esi + 0x28], 0xea71e659
mov dword [esi + 8], 0x1d6efe4e
mov dword [esi + 0x30], 0x5a92a305
mov dword [esi + 0x34], 0x412b44f5
xor eax, eax
mov ecx, eax
inc eax
xor ecx, 0x3c2d1e0f
cmp eax, 0x1e
not ecx
mov dword [esi + eax*4 + 0x38], ecx
jl 0x56b0fc
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x38]
mov ecx, dword [esi + 0x28]
mov edx, eax
or edx, edi
and eax, edi
and edx, dword [esi + 0x10]
or edx, eax
mov eax, ecx
shl eax, 5
shr ecx, 0x1b
or eax, ecx
add edx, eax
mov eax, edi
shr eax, 2
add edx, dword [esi + 0x24]
shl edi, 0x1e
add edx, 0x5a837999
or eax, edi
add dword [esi + 0x20], edx
mov dword [esi + 0x38], eax
call fcn.0056ae70
mov edi, dword [esi + 0x28]
mov ecx, dword [esi + 8]
xor ecx, dword [esi + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x20]
xor ecx, edi
mov edx, eax
shl edx, 5
shr eax, 0x1b
or edx, eax
mov eax, edi
shr eax, 2
add ecx, edx
shl edi, 0x1e
add ecx, dword [esi + 0x24]
add ecx, 0x5a837999
or eax, edi
pop edi
add dword [esi + 0x10], ecx
mov dword [esi + 0x28], eax
mov eax, esi
pop esi
ret

Function at 0x56b7a0
Capabilities:
Resolve function by hash

Disassembly:
sub esp, 0x10
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x1c]
push edi
push 0xec0e4e8e
call fcn.0056b490
mov ecx, dword [esi + 0x14]
push edi
push 0xffd97fb
mov dword [ecx], eax
call fcn.0056b490
mov ecx, dword [esi + 0x14]
push edi
push 0x7c0017a5
mov dword [ecx + 4], eax
call fcn.0056b490
mov ecx, dword [esi + 0x14]
push edi
push 0x4dc9d5a0
mov dword [ecx + 8], eax
call fcn.0056b490
mov ecx, dword [esi + 0x14]
lea edx, [esp + 8]
mov dword [ecx + 0xc], eax
mov eax, dword [0x564b24]
mov edi, dword [0x564b28]
mov ecx, 0x564b24
push edx
mov dword [edx], eax
mov eax, dword [ecx + 8]
mov dword [edx + 4], edi
mov cl, byte [ecx + 0xc]
mov dword [edx + 8], eax
mov byte [edx + 0xc], cl
mov ecx, esi
call fcn.0056b6b0
mov ecx, dword [esi + 0x14]
lea eax, [esp + 8]
push eax
mov edx, dword [ecx]
mov dword [0x564af0], edx
call fcn.0056b4f0
mov dword [esi], eax
test eax, eax
je 0x56b86d
push eax
push 0xa84aeb81
call fcn.0056b490
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], eax
mov eax, dword [esi]
push eax
push 0xfcba95ab
call fcn.0056b490
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov edx, dword [esi]
push edx
push 0x35e273e6
call fcn.0056b490
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x56c226
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565300
push 0x56c4ec
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov dword [ebp - 0x2c], 0x3459fe
mov dword [ebp - 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xd8
call fcn.0056c6e0
add esp, 4
test eax, eax
je 0x56c271
mov ecx, eax
call fcn.0056c190
mov dword [ebp - 0x1c], eax
jmp 0x56c278
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xb8
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.0056c0f0
test eax, eax
je 0x56c2b2
cmp dword [ebp - 0x1c], 0
je 0x56c2a8
mov ecx, dword [ebp - 0x1c]
call fcn.0056c200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0056c6f0
add esp, 4
mov eax, 0x2a
jmp 0x56c3de
wait
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x20]
call fcn.0056b700
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xbc], 0
mov eax, dword fs:[0x20]
je 0x56c2e1
mov eax, dword fs:[0x30]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.0056b880
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xc4], 0
je 0x56c324
mov esi, eax
test esi, esi
je 0x56c312
mov ecx, esi
call fcn.0056c200
push esi
call fcn.0056c6f0
add esp, 4
mov eax, 0x926
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x56c3de
mov ecx, dword [ebp - 0x20]
call fcn.0056bb30
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 0
jne 0x56c36c
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0xd0], 0
je 0x56c366
mov esi, eax
test esi, esi
je 0x56c357
mov ecx, esi
call fcn.0056c200
push esi
call fcn.0056c6f0
add esp, 4
mov eax, 0xc3
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x56c3de
mov eax, dword ds:[0]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0056b2e0
mov ecx, dword [ebp - 0x20]
call fcn.0056bc90
xor dword [ebp - 0x24], eax
wait
jmp 0x56c3ad
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x56c3ce
mov ecx, dword [ebp - 0x1c]
call fcn.0056c200
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0056c6f0
add esp, 4
cmp dword [ebp - 0x28], 0
je 0x56c3db
mov dword [ebp - 0x24], 0x4e6
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x56cda0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov eax, ecx
push edi
sub eax, 0x80
je 0x56cdcf
sub eax, 0x40
je 0x56cdc8
sub eax, 0x40
je 0x56cdc1
pop edi
mov eax, 0xfffffffe
pop ebp
ret
mov edi, 8
jmp 0x56cdd4
mov edi, 6
jmp 0x56cdd4
mov edi, 4
mov eax, dword [esp + 0x10]
cmp eax, ecx
jge 0x56cdde
mov eax, ecx
sub eax, 0x80
je 0x56ce05
sub eax, 0x40
je 0x56cdfe
sub eax, 0x40
je 0x56cdf7
pop edi
mov eax, 0xfffffffd
pop ebp
ret
mov ebp, 0xe
jmp 0x56ce0a
mov ebp, 0xc
jmp 0x56ce0a
mov ebp, 0xa
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push esi
call fcn.0056cea0
add esp, 0xc
cmp ebp, 1
jle 0x56ce67
lea eax, [ebp - 1]
add ebx, 0x20
mov dword [esp + 0x1c], eax
push edi
push 0x564dd8
push esi
call fcn.0056cf80
push edi
push 0
push esi
call fcn.0056cef0
push edi
push esi
call fcn.0056cfc0
push edi
push ebx
push esi
call fcn.0056cea0
mov eax, dword [esp + 0x48]
add esp, 0x2c
add ebx, 0x20
dec eax
mov dword [esp + 0x1c], eax
jne 0x56ce2e
mov ebx, dword [esp + 0x20]
push edi
push 0x564dd8
push esi
call fcn.0056cf80
push edi
push 0
push esi
call fcn.0056cef0
shl ebp, 5
add ebp, ebx
push edi
push ebp
push esi
call fcn.0056cea0
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x56cea0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
and edi, 0xff
mov ebp, edx
mov dword [esp + 0x1c], 4
test edi, edi
jle 0x56ced3
mov ecx, dword [esp + 0x18]
mov eax, ebp
sub ecx, edx
mov esi, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec esi
jne 0x56ceca
mov eax, dword [esp + 0x1c]
add ebp, 8
dec eax
mov dword [esp + 0x1c], eax
jne 0x56cebc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x101a3ed
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1006da0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101a445
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1004d40
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101a438
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x101a447
xor eax, eax
pop esi
leave
ret 4

Function at 0x413ee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40c015
lea edi, [esi - 0xb015]
push edi
or ebp, 0xffffffff
jmp 0x413f02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413ef8
mov eax, 1
add ebx, ebx
jne 0x413f1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413f10
jne 0x413f2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413f10
xor ecx, ecx
sub eax, 3
jb 0x413f40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413fb2
mov ebp, eax
add ebx, ebx
jne 0x413f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413f7c
inc ecx
add ebx, ebx
jne 0x413f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413f5d
jne 0x413f79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413f5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413f9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413f8d
jmp 0x413efe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413f9c
add edi, ecx
jmp 0x413efe
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413fba
cmp byte [edi], 5
jne 0x413fba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x413fbf
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x41402e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15508]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413fec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1550c]
or eax, eax
je 0x414028
mov dword [ebx], eax
add ebx, 4
jmp 0x414009
call dword [esi + 0x1551c]
mov ebp, dword [esi + 0x15510]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414062
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x40100a
repz ret
jmp fcn.00401ac6

Function at 0x4069eb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004026f6
and dword [ebp - 0x14], 0
cmp dword [0x42c620], 0
mov dword [ebp - 0x18], eax
jne 0x406a9e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406b46
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406b46
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c620], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c624], eax
call edi
push eax
call esi
push 0x428858
push ebx
mov dword [0x42c628], eax
call edi
push eax
call esi
mov dword [0x42c630], eax
test eax, eax
je 0x406a9e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c62c], eax
mov eax, dword [0x42c62c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406af7
cmp dword [0x42c630], ecx
je 0x406af7
push eax
call esi
push dword [0x42c630]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406af7
test ebx, ebx
je 0x406af7
call edi
test eax, eax
je 0x406aee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406aee
test byte [ebp - 8], 1
jne 0x406af7
or dword [ebp + 0x10], 0x200000
jmp 0x406b2a
mov eax, dword [0x42c624]
cmp eax, dword [ebp - 0x18]
je 0x406b2a
push eax
call esi
test eax, eax
je 0x406b2a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x406b2a
mov eax, dword [0x42c628]
cmp eax, dword [ebp - 0x18]
je 0x406b2a
push eax
call esi
test eax, eax
je 0x406b2a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c620]
call esi
test eax, eax
je 0x406b46
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406b48
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x4264e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc28], eax
cmp ebx, 0x182
jne 0x426515
lea ecx, [ebp - 0xc20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x426533
cmp ebx, 0x19f
jne 0x426533
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x426594
push esi
jmp 0x426540
lea esi, [ebp - 0xc24]
mov dword [ebp - 0xc24], 0
call fcn.004264d0
mov dl, byte [ebp - 0xc24]
mov eax, dword [ebp - 0xc28]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x42658e
lea eax, [ebp - 0xc2c]
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
lea edx, [ebp - 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
inc edi
cmp edi, ebx
jl 0x426540
pop esi
pop edi
cmp ebx, 0x2d
jne 0x4265ae
mov dword [0x42e008], 0xa62e7790
mov dword [0x42e00c], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x4265c0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x42dffc]
push ebx
push esi
mov esi, dword [0x42dd1c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x4265e2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x42b1d0]
call fcn.004264a0
cmp dword [0x42dffc], 0x2f
jne 0x4265fd
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.004264e0
add esp, 4
cmp dword [0x42dffc], 0x568
pop esi
pop ebx
jne 0x426628
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
ret
Function at 0x425120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x425142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x425149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x425138
mov eax, 1
add ebx, ebx
jne 0x42515b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x425150
jne 0x42516c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x425150
xor ecx, ecx
sub eax, 3
jb 0x425180
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4251f2
mov ebp, eax
add ebx, ebx
jne 0x42518b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x425198
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4251bc
inc ecx
add ebx, ebx
jne 0x4251a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42519d
jne 0x4251b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42519d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4251dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4251cd
jmp 0x42513e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4251dc
add edi, ecx
jmp 0x42513e
pop esi
mov edi, esi
mov ecx, 0x7f1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4251fa
cmp byte [edi], 6
jne 0x4251fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4251ff
lea edi, [esi + 0x22000]
mov eax, dword [edi]
or eax, eax
je 0x425277
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x29acc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29be4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42522c
mov ecx, edi
jns 0x42525b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29be8]
or eax, eax
je 0x425271
mov dword [ebx], eax
add ebx, 4
jmp 0x425249
call dword [esi + 0x29bec]
popal
jmp 0x412044
Function at 0x42eba0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1f000]
push edi
jmp 0x42ebba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42ebc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42ebb0
mov eax, 1
add ebx, ebx
jne 0x42ebd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42ebc8
jne 0x42ebe4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ebc8
xor ecx, ecx
sub eax, 3
jb 0x42ebf8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ec6a
mov ebp, eax
add ebx, ebx
jne 0x42ec03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42ec10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ec34
inc ecx
add ebx, ebx
jne 0x42ec20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42ec15
jne 0x42ec31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ec15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ec54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ec45
jmp 0x42ebb6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ec54
add edi, ecx
jmp 0x42ebb6
pop esi
mov edi, esi
mov ecx, 0xd97
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ec72
cmp byte [edi], 9
jne 0x42ec72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ec77
lea edi, [esi + 0x2c000]
mov eax, dword [edi]
or eax, eax
je 0x42ecef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x33204]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33268]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42eca4
mov ecx, edi
jns 0x42ecd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3326c]
or eax, eax
je 0x42ece9
mov dword [ebx], eax
add ebx, 4
jmp 0x42ecc1
call dword [esi + 0x3327c]
mov ebp, dword [esi + 0x33270]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42ed23
sub esp, 0xffffff80
jmp 0x4148d4
Function at 0xe5a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xe5a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xe83074
push ecx
mov edi, eax
call fcn.00e6e198
mov esi, eax
add esp, 8
test esi, esi
jne 0xe5a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00e6e02e
push esi
call fcn.00e6dfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xe5d850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xe5d8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xe88720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe5d8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00e6e1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xe5d8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xe88720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xe5d92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00e6f082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xe5d957
mov word [eax], si
add eax, 2
push eax
call fcn.00e6f030
add esp, 4
jmp 0xe5d959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xe5d8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xe5d8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xe5dff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xe5e080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0xe5e0c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0xe83458
push ecx
call fcn.00e6e1e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.00e6e1e1
add esp, 0x10
jmp 0xe5e0d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.00e6e20b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00e6ddff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00e5e050
mov eax, dword [0xe88728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0xe5e13b
push esi
call fcn.00e5dfb0
add esp, 4
mov dword [0xe88728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0xe5e14c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00e5dff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0xe61440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0xe614b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0xe6148e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0xe61471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0xe6147e
add edx, ecx
cmp ebx, edx
jb 0xe6148a
inc edi
add eax, 0x28
cmp edi, esi
jb 0xe61467
xor ecx, ecx
jmp 0xe614a2
test eax, eax
jne 0xe61492
xor ecx, ecx
jmp 0xe614a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.00e613c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret