joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f9350
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
push eax
call ebx
mov ecx, dword [edi + 4]
push ecx
mov esi, eax
call ebx
mov edx, dword [ebp]
push edx
mov edi, eax
call ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 4]
push eax
call ebx
mov ecx, dword [ebp + 8]
push ecx
mov dword [esp + 0x24], eax
call ebx
mov edx, dword [ebp + 0xc]
push edx
mov dword [esp + 0x1c], eax
call ebx
mov dword [esp + 0x14], eax
mov edx, 0x10
xor ecx, ecx
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x20]
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x10]
sub ecx, 0x61c88647
xor eax, ebx
lea ebx, [ecx + edi]
xor eax, ebx
add esi, eax
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x14]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x18]
sub edx, 1
xor eax, ebx
lea ebx, [ecx + esi]
xor eax, ebx
add edi, eax
test edx, edx
ja 0x4f93a1
push esi
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
mov ebx, dword [esp + 0x24]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0xc
ret

Function at 0x4f9410
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_ntohl]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, eax
mov eax, dword [esi]
push edi
push eax
call ebx
mov ecx, dword [esi + 4]
push ecx
mov edi, eax
call ebx
mov edx, dword [ebp]
push edx
mov esi, eax
call ebx
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 4]
push eax
call ebx
mov ecx, dword [ebp + 8]
push ecx
mov dword [esp + 0x18], eax
call ebx
mov edx, dword [ebp + 0xc]
push edx
mov dword [esp + 0x14], eax
call ebx
mov dword [esp + 0x20], eax
mov edx, 0x10
mov ecx, 0xe3779b90
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x20]
mov ebx, edi
shl ebx, 4
add ebx, dword [esp + 0x10]
sub edx, 1
xor eax, ebx
lea ebx, [ecx + edi]
xor eax, ebx
sub esi, eax
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x14]
mov ebx, esi
shl ebx, 4
add ebx, dword [esp + 0x18]
xor eax, ebx
lea ebx, [ecx + esi]
xor eax, ebx
sub edi, eax
add ecx, 0x61c88647
test edx, edx
ja 0x4f9464
push edi
mov edi, dword [sym.imp.WS2_32.dll_htonl]
call edi
mov ebx, dword [esp + 0x24]
push esi
mov dword [ebx], eax
call edi
pop edi
pop esi
pop ebp
mov dword [ebx + 4], eax
pop ebx
add esp, 0xc
ret
Function at 0x4f9e00
Capabilities:
Access peb ldr_data
Get ntdll base address
Reference http user-agent string

Disassembly:
push 0xffffffffffffffff
push 0x505db6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov byte [esi + 0x40], al
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov cl, byte [esp + 0xb]
mov dword [esp + 0x18], edi
mov byte [esi + 0x50], cl
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov byte [esp + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esi + 0x18]
mov dword [esi + 0x6c], eax
push edx
push str.Mozilla_5.0__Windows__U__Windows_NT_6.1__en_US__AppleWebKit_534.10__KHTML__like_Gecko__Chrome_7.0.536.2_Safari_534.10
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov word [esi + 0x24], di
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
call fcn.004f9ec0
mov dword [esi + 0x14], eax
lea eax, [esi + 0x60]
push 0x80
push eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov byte [esi + 0x3c], 1
mov byte [esi + 0x3d], 1
call fcn.004fb2a0
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x4fa2af
Capabilities:
Parse url

Disassembly:
sub esp, 0x95c
push ebx
mov ebx, dword [esp + 0x968]
push ebp
push esi
mov esi, ecx
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x14]
mov ebp, ecx
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0x3c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x6c], eax
je 0x4fa2ff
push 0
push 0x5e1c50
push 0x7eb
call fcn.004f35c0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x95c
ret 8
lea ecx, [esp + 0x16c]
lea eax, [esp + 0x6c]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x10]
xor eax, eax
push ecx
push eax
lea edx, [esp + 0x54]
push ebp
push ebx
mov dword [esp + 0x34], pe_nt_image_headers32
mov dword [esp + 0x50], 0x800
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0x20
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x4fa2f0
mov ecx, esi
call fcn.004fabc0
mov edx, dword [esp + 0x20]
push edx
call fcn.004f9f50
push ebx
mov dword [esi + 4], eax
call fcn.004faf60
push eax
call fcn.004f9f50
push ebp
push ebx
mov dword [esi + 8], eax
call fcn.004f9fa0
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esi], eax
mov ax, word [esp + 0x3c]
push edx
mov word [esi + 0x24], ax
mov dword [esi + 0x28], ecx
call fcn.004f9f50
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x988]
push eax
call fcn.004f9f50
add esp, 0x1c
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.004fab80
mov ecx, esi
call fcn.004fa260
test eax, eax
je 0x4fa2f0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x95c
ret 8
Function at 0x406d99
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x423903
call fcn.00408cfd
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x406eb6
cmp byte [ebx + 0x3e], 0
je 0x406eb6
mov eax, dword [ebx]
mov edi, 0xffff
push edi
mov esi, dword [eax + 0xc]
mov ecx, esi
call fcn.00408c8c
mov ecx, ebx
call esi
movzx eax, ax
cmp di, ax
sete al
test al, al
je 0x406de5
xor al, al
jmp 0x406eb8
xor eax, eax
mov dword [ebp - 0x14], 0xf
push eax
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004070bc
and dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x406e15
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebx + 0x40]
mov ecx, dword [esi + 0x20]
push eax
call fcn.00408c8c
mov ecx, edi
call dword [esi + 0x20]
sub eax, 0
je 0x406e4a
sub eax, 1
je 0x406e4e
dec eax
sub eax, 1
je 0x406ea4
xor bl, bl
jmp 0x406ea6
mov byte [ebx + 0x3e], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x406e5e
lea edx, [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
sub esi, edx
je 0x406e86
cmp eax, 0x10
jae 0x406e6d
lea ecx, [ebp - 0x28]
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0041093b
add esp, 0x10
cmp esi, eax
jne 0x406e46
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp byte [ebx + 0x3e], 0
je 0x406ea4
test esi, esi
jne 0x406e09
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404602
jmp 0x406e03
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403346
mov al, bl
jmp 0x406eb8
mov al, 1
call fcn.00408ca7
ret
Function at 0x407472
Capabilities:
Write file on windows

Disassembly:
push 0x30
mov eax, 0x423979
call fcn.00408cfd
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x407497
xor eax, eax
jmp 0x407610
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4074c3
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x4074c3
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x407610
cmp dword [esi + 0x4c], 0
je 0x40760d
mov ecx, esi
call fcn.0040704c
xor eax, eax
cmp dword [esi + 0x38], eax
jne 0x4074f6
push dword [esi + 0x4c]
push edi
call fcn.004068ed
pop ecx
pop ecx
test al, al
je 0x40760d
movzx ebx, di
jmp 0x40760d
push eax
push 8
lea ecx, [ebp - 0x28]
mov word [ebp - 0x2c], di
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
call fcn.004070bc
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, ecx
cmp eax, 0x10
jae 0x40752e
lea edx, [ebp - 0x28]
mov ecx, edx
mov edi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
add eax, edx
mov esi, dword [edi]
push eax
push ecx
lea eax, [ebp - 0x3c]
mov ecx, dword [esi + 0x1c]
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call fcn.00408c8c
mov ecx, edi
call dword [esi + 0x1c]
test eax, eax
js 0x407601
cmp eax, 1
jg 0x4075dc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
cmp eax, 0x10
jae 0x407577
lea edx, [ebp - 0x28]
mov edi, dword [ebp - 0x38]
sub edi, edx
je 0x4075a4
cmp eax, 0x10
jae 0x407586
lea ecx, [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.0041093b
add esp, 0x10
cmp edi, eax
jne 0x4075d7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
jmp 0x4075a7
mov esi, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x3c], edx
jne 0x4075d1
test edi, edi
jne 0x407522
cmp dword [ebp - 0x18], 0x20
jae 0x4075fb
push edi
push 8
lea ecx, [ebp - 0x28]
call fcn.00404602
jmp 0x40751c
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x4075fb
cmp eax, 3
jne 0x407601
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.004068ed
pop ecx
pop ecx
test al, al
je 0x4075fb
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403346
mov ax, bx
call fcn.00408ca7
ret 4

Function at 0x417f60
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417c23

Function at 0x417f6b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417da4

Function at 0x41c03a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041bcfa
Function at 0x1326880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc4e000]
push edi
or ebp, 0xffffffff
jmp 0x13268a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x13268a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1326898
mov eax, 1
add ebx, ebx
jne 0x13268bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x13268b0
jne 0x13268cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x13268b0
xor ecx, ecx
sub eax, 3
jb 0x13268e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1326952
mov ebp, eax
add ebx, ebx
jne 0x13268eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x13268f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x132691c
inc ecx
add ebx, ebx
jne 0x1326908
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x13268fd
jne 0x1326919
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x13268fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x132693c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x132692d
jmp 0x132689e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x132693c
add edi, ecx
jmp 0x132689e
pop esi
mov edi, esi
mov ecx, 0x506897
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x1326977
cmp byte [edi], 0x36
jne 0x132695c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x132695a
lea edi, [esi + 0xeff000]
mov eax, dword [edi]
or eax, eax
je 0x13269c8
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf2b074]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf2b260]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x132697d
mov ecx, edi
jns 0x13269ac
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf2b268]
or eax, eax
je 0x13269c2
mov dword [ebx], eax
add ebx, 4
jmp 0x132699a
call dword [esi + 0xf2b264]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x13269f9
cmp al, 0xef
ja 0x13269ec
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x13269ce
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x13269db
mov ebp, dword [esi + 0xf2b26c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x297]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1326a2d
sub esp, 0xffffff80
jmp 0x811e4e
Function at 0x100047af
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x108
call fcn.100092f4
add esp, 4
mov dword [ebp - 4], eax
mov edi, eax
mov esi, 0x9ee29d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
push 0x108
call fcn.100092f4
add esp, 4
mov dword [ebp - 8], eax
mov edi, eax
mov esi, 0x9ee29d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 4]
call fcn.10001107
mov eax, 0
cmp eax, ecx
jl 0x1000482f
push 0
push 0x4011022
push 1
call fcn.100092fa
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov ebx, dword [ebp - 8]
call fcn.10001107
mov eax, 0
cmp eax, ecx
jl 0x10004862
push 0x29
push 0x4011022
push 1
call fcn.100092fa
add esp, 0xc
add ebx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0x10]
mov byte [ebx], 0
mov eax, dword [ebp - 4]
add eax, 8
mov ecx, 0x100
xor ebx, ebx
sub bl, cl
mov byte [ebx + eax], bl
loop 0x10004878
push eax
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov edi, dword [edx + 4]
add edx, 8
mov esi, dword [ebp - 8]
add esi, 8
mov ecx, 0x100
xor ebx, ebx
cmp ebx, edi
jb 0x100048a0
xor ebx, ebx
mov ah, byte [ebx + edx]
mov byte [esi], ah
inc esi
inc ebx
loop 0x1000489a
pop edi
xor ebx, ebx
sub esi, 0x100
xor eax, eax
mov ecx, 0x100
mov dl, byte [eax + esi]
add bl, dl
mov dl, byte [eax + edi]
add bl, dl
mov dl, byte [eax + edi]
mov dh, byte [ebx + edi]
mov byte [eax + edi], dh
mov byte [ebx + edi], dl
inc eax
loop 0x100048b9
mov esi, dword [ebp + 8]
mov esi, dword [esi]
mov ecx, dword [esi + 4]
mov dword [ebp - 0xc], ecx
add esi, 8
push 0x80000301
push 0
push dword [ebp - 0xc]
push 1
mov ebx, 0x1bc
call fcn.1000a020
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10004915
push ebx
call fcn.100092ee
add esp, 4
pop eax
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
add edx, 8
xor eax, eax
xor ebx, ebx
push ecx
movzx ecx, al
inc cl
push edx
mov dh, byte [ecx + edi]
add bl, dh
mov dl, byte [ebx + edi]
mov byte [ecx + edi], dl
mov byte [ebx + edi], dh
add dl, dh
movzx edx, dl
mov dl, byte [edx + edi]
mov cl, byte [eax + esi]
xor cl, dl
pop edx
mov byte [eax + edx], cl
inc eax
pop ecx
loop 0x1000492a
mov ebx, dword [ebp - 4]
push ebx
call fcn.100092ee
add esp, 4
mov ebx, dword [ebp - 8]
push ebx
call fcn.100092ee
add esp, 4
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000abb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000abce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x1000abc3
pop esi
ret
Function at 0x1000bd10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1000bd66
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1000bd4d
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x83ed50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2e5000]
push edi
or ebp, 0xffffffff
jmp 0x83ed72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x83ed79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83ed68
mov eax, 1
add ebx, ebx
jne 0x83ed8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x83ed9c
jne 0x83edbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83edbb
dec eax
add ebx, ebx
jne 0x83eda8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x83ed80
add ebx, ebx
jne 0x83edb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x83ee0d
xor ecx, ecx
sub eax, 3
jb 0x83edd3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x83ee42
sar eax, 1
mov ebp, eax
jmp 0x83edde
add ebx, ebx
jne 0x83edde
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83edac
inc ecx
add ebx, ebx
jne 0x83edec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x83edac
add ebx, ebx
jne 0x83edf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x83edee
jne 0x83ee0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x83edee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x83ee2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x83ee1e
jmp 0x83ed6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x83ee2c
add edi, ecx
jmp 0x83ed6e
pop esi
mov edi, esi
mov ecx, 0xfa56
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x83ee4a
cmp byte [edi], 0x3c
jne 0x83ee4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x83ee4f
lea edi, [esi + 0x426000]
mov eax, dword [edi]
or eax, eax
je 0x83eec7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x443a04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x443aec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x83ee7c
mov ecx, edi
jns 0x83eeab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x443af4]
or eax, eax
je 0x83eec1
mov dword [ebx], eax
add ebx, 4
jmp 0x83ee99
call dword [esi + 0x443af0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x83eef8
cmp al, 0xef
ja 0x83eeeb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x83eecd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x83eeda
mov ebp, dword [esi + 0x443af8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x83ef2c
sub esp, 0xffffff80
jmp 0x5cfcc0
Function at 0x4d33d0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x533f8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.005283ca
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4d3452
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0052614a
mov eax, dword [eax]
push 0x5b8210
push eax
call fcn.00518514
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00528655
test bl, bl
je 0x4d3452
push 0x5b8210
lea ecx, [esp + 0xc]
call fcn.005289e5
push 0x5bbd8c
lea ecx, [esp + 0xc]
call fcn.005289e5
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4d348e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00528655
jmp 0x4d3559
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x4d3512
lea edx, [esp + 0x7c]
push 0x5bbd88
push edx
call fcn.00518514
add esp, 8
test eax, eax
je 0x4d3512
lea eax, [esp + 0x7c]
push 0x5bbd84
push eax
call fcn.00518514
add esp, 8
test eax, eax
je 0x4d3512
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4d34a2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00528655
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4d3d50
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4d3db2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc