joyce8/EMBER2024-capa huggingface dataset:
Function at 0x572a86
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ded08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0056d300
xor edx, edx
mov eax, 0x3f800000
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi], vtable.tView.0
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0x20], 0xff000000
mov dword [esi + 0x28], edx
mov dword [esi + 0x1c], 0xff101010
lea edi, [esi + 0x3c]
mov ecx, 0x20
rep stosd dword es:[edi], eax
lea ecx, [esi + 0xc0]
mov dword [esp + 0x14], edx
mov dword [esi + 0x2c], 3
mov byte [esi + 0xbc], dl
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x38], edx
mov dword [esi + 0x34], edx
call fcn.0055fd80
lea ecx, [esi + 0x100]
call fcn.0055fd80
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x57e176
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5df638
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0056f760
xor edi, edi
mov dword [esi + 0x10], vtable.tPosable.0
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esi + 0x20]
mov dword [esp + 0x18], edi
mov dword [esi], vtable.tPolySkin.1.0
mov dword [esi + 0x10], vtable.tPolySkin.0
mov dword [esi + 0x1c], edi
call fcn.0057e0e0
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov eax, 0x3f800000
mov dword [esi + 0x3c], eax
mov ecx, 0x501502f9
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov ecx, 0xd01502f9
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x592ab6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5e0188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00576f60
mov eax, dword [esp + 0x1c]
xor edi, edi
mov dword [esi + 0x1c], vtable.IRadFileCompletionCallback.0
push eax
mov ecx, esi
mov dword [esp + 0x18], edi
mov dword [esi], vtable.tFileFTT.1.0
mov dword [esi + 0x1c], vtable.tFileFTT.0
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
call fcn.00577010
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x40], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x5b7020
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e0d3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0056d300
mov ecx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov dword [esi], vtable.choreo::LocomotionSlot.0
mov eax, dword [edi + 0x10]
push ecx
lea ebp, [esi + 8]
push eax
mov ecx, ebp
mov dword [esp + 0x38], 0
call fcn.005c0d30
push 0x14
mov byte [esp + 0x34], 1
call fcn.0056d2e0
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
mov byte [esp + 0x30], 2
je 0x5b7092
push esi
push edi
mov ecx, eax
call fcn.005bf820
jmp 0x5b7094
xor eax, eax
mov dword [esi + 0x18], eax
mov edx, dword [eax]
mov ecx, eax
mov byte [esp + 0x30], 1
call dword [edx]
push 1
mov ecx, edi
call fcn.005c1090
mov edi, eax
test edi, edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
jl 0x5b7125
push edi
mov ecx, ebp
call fcn.005c0b70
test al, al
je 0x5b7125
lea eax, [esp + 0x1c]
push eax
push 0
push edi
mov ecx, ebp
call fcn.005c0ba0
mov edx, dword [ebp]
fld dword [edx + 0x10]
lea ecx, [esp + 0x10]
push ecx
fsub dword [0x617dbc]
push ecx
mov ecx, ebp
fstp dword [esp]
push edi
call fcn.005c0ba0
fld dword [esp + 0x10]
fsub dword [esp + 0x1c]
fstp dword [esp + 0x10]
fld dword [esp + 0x14]
fsub dword [esp + 0x20]
fstp dword [esp + 0x14]
fld dword [esp + 0x18]
fsub dword [esp + 0x24]
fstp dword [esp + 0x18]
mov ecx, esi
call fcn.005bdd90
fcom dword [0x617db0]
fnstsw ax
test ah, 0x41
mov eax, esi
jne 0x5b7160
fld dword [esp + 0x18]
fmul dword [esp + 0x18]
fld dword [esp + 0x14]
fmul dword [esp + 0x14]
faddp st(1)
fld dword [esp + 0x10]
fmul dword [esp + 0x10]
faddp st(1)
fsqrt
fdiv st(1)
fstp dword [esi + 0x1c]
jmp 0x5b7167
mov dword [esi + 0x1c], 0
mov ecx, dword [esp + 0x28]
fstp st(0)
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x5bc540
Capabilities:
Terminate process

Disassembly:
int3
push eax
push str._s_nClick_RETRY_to_debug
push 0x400
push 0x6c6f58
call fcn.005b57d0
add esp, 0x10
push 0x32
push str.Script_Error
push 0x6c6f58
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
cmp eax, 3
jne 0x5bc578
push 0xffffffffffffffff
call fcn.005c892e
cmp eax, 4
jne 0x5bc582
jmp 0x5bc530
ret
Function at 0x5c0f86
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5e1118
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.0056f760
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x5fdf04]
mov dword [esi + 0x28], ecx
mov ecx, dword [0x5fdf0c]
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [0x5fdf08]
mov dword [esi], vtable.choreo::Rig.0
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], eax
mov dword [esi + 0x10], ecx
mov edx, dword [ecx]
call dword [edx]
or eax, 0xffffffff
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x28]
shl ecx, 2
push ecx
call fcn.00445250
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], eax
add esp, 4
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x5c885b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
call fcn.005cb6af
xor esi, esi
inc esi
cmp dword [0x6c7500], esi
pop ecx
jne 0x5c8883
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x6c74fc], esi
mov byte [0x6c74f8], al
jne 0x5c88e9
mov ecx, dword [0x6d1170]
test ecx, ecx
je 0x5c88ca
mov eax, dword [0x6d116c]
sub eax, 4
cmp eax, ecx
jmp 0x5c88c3
mov eax, dword [eax]
test eax, eax
je 0x5c88b5
call eax
mov eax, dword [0x6d116c]
sub eax, 4
cmp eax, dword [0x6d1170]
mov dword [0x6d116c], eax
jae 0x5c88ad
mov eax, 0x642334
mov esi, 0x64233c
cmp eax, esi
mov edi, eax
jae 0x5c88e9
mov eax, dword [edi]
test eax, eax
je 0x5c88e2
call eax
add edi, 4
cmp edi, esi
jb 0x5c88da
mov eax, 0x642340
mov esi, 0x642348
cmp eax, esi
mov edi, eax
jae 0x5c8908
mov eax, dword [edi]
test eax, eax
je 0x5c8901
call eax
add edi, 4
cmp edi, esi
jb 0x5c88f9
cmp dword [ebp + 0x10], 0
pop edi
pop esi
je 0x5c8919
push 8
call fcn.005cb61b
jmp 0x5c892b
push dword [ebp + 8]
mov dword [0x6c7500], 1
call fcn.005c87b4
pop ecx
pop ebp
ret
Function at 0x5c8d17
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x5fed60
call fcn.004337c8
mov edi, 0x94
mov eax, edi
call fcn.005c9390
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.kernel32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x6c74c0], ecx
mov eax, dword [esi + 4]
mov dword [0x6c74cc], eax
mov edx, dword [esi + 8]
mov dword [0x6c74d0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6c74c4], esi
cmp ecx, 2
je 0x5c8d77
or esi, 0x8000
mov dword [0x6c74c4], esi
shl eax, 8
add eax, edx
mov dword [0x6c74c8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.kernel32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x5c8db2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5c8db2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x5c8dca
cmp eax, 0x20b
je 0x5c8db7
mov dword [ebp - 0x1c], esi
jmp 0x5c8dde
cmp dword [ecx + 0x84], 0xe
jbe 0x5c8db2
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x5c8dd8
cmp dword [ecx + 0x74], 0xe
jbe 0x5c8db2
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.005cda2e
pop ecx
test eax, eax
jne 0x5c8df2
push 0x1c
call fcn.005c8cf3
pop ecx
call fcn.005cc37e
test eax, eax
jne 0x5c8e03
push 0x10
call fcn.005c8cf3
pop ecx
call fcn.005cd98c
mov dword [ebp - 4], esi
call fcn.005d40bd
test eax, eax
jge 0x5c8e1c
push 0x1b
call fcn.005c8cce
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x6d1164], eax
call fcn.005d3f9b
mov dword [0x6c7504], eax
call fcn.005d3ef9
test eax, eax
jge 0x5c8e42
push 8
call fcn.005c8cce
pop ecx
call fcn.005d3cc6
test eax, eax
jge 0x5c8e53
push 9
call fcn.005c8cce
pop ecx
call fcn.005c87f6
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x5c8e66
push eax
call fcn.005c8cce
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
call fcn.005d3c5d
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x5c8e87
movzx eax, word [ebp - 0x34]
jmp 0x5c8e8a
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00442410
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x5c8ea8
push edi
call fcn.005c892e
call fcn.005c8950
jmp 0x5c8eda
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.005cb77f
ret
Function at 0x100305f6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x64b
push 1
push 0x2695
push 0x7432
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4e39
push 0x5059
call fcn.100302f7
add esp, 0x20
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003063f
xor eax, eax
jmp 0x1003079b
push 0x40e3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1003041c
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1003066c
xor eax, eax
jmp 0x1003079b
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.1002fd8e
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1003068a
xor eax, eax
jmp 0x1003079b
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.10030487
add esp, 0x18
push dword [ebp - 8]
push 0x36bc
push 0x15b6
push 1
push 0x7b37
push dword [ebp + 8]
push dword [ebp - 4]
push 0x150
call fcn.10026083
add esp, 0x20
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.10030524
add esp, 0x10
cmp dword [ebp - 0x14], 0
je 0x10030707
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0x139d
push 0x34f7
call fcn.10030580
add esp, 0x14
push dword [ebp - 4]
call fcn.1002fc74
pop ecx
test eax, eax
jne 0x1003071b
xor eax, eax
jmp 0x1003079b
push 0xf26
push dword [ebp - 4]
push 0x3ed4
push 0x405e
push 0x581e
push 0x5bc0
push 1
call fcn.10029d9c
add esp, 0x1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10030783
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10030760
xor eax, eax
jmp 0x1003079b
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10030779
xor eax, eax
jmp 0x1003079b
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10030794
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10030798
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100546a0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10086340]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x20], ax
xor ecx, ecx
mov word [ebp - 0x1e], cx
cmp dword [ebp + 8], 0xffffffff
jne 0x100546c4
jmp 0x10054733
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x100546d8
jmp 0x10054733
movsx ecx, word [ebp - 0x1c]
movsx edx, word [ebp - 0x1a]
imul ecx, edx
mov dword [ebp - 0x24], ecx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
test eax, eax
jne 0x10054704
jmp 0x10054733
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
movzx ecx, word [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x10054725
jmp 0x10054733
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call main
mov esp, ebp
pop ebp
ret

Function at 0x100565e0
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 5]
and ecx, 0xf
movzx edx, byte [0x10671d40]
or ecx, edx
mov byte [ebp - 1], cl
movzx ax, byte [ebp - 1]
movzx ecx, ax
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 4]
push ecx
push 0x13c619c8
call fcn.10054b60
add esp, 8
mov esp, ebp
pop ebp
ret 4
Function at 0x1007bcd0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10086340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006e34d
mov dword [ebp - 0x14], eax
cmp dword [0x13c62b1c], esi
jne 0x1007bdc3
push 0x800
push esi
push 0x1000774c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007bd50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007bea3
push esi
push esi
push 0x1000774c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007bea3
push 0x10007764
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007bea3
push eax
call ebx
push 0x10007770
push edi
mov dword [0x13c62b1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007780
push edi
mov dword [0x13c62b20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007794
push edi
mov dword [0x13c62b24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x13c62b2c], eax
test eax, eax
je 0x1007bdc0
push 0x100077b0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x13c62b28], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007bde8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007bddb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007bdfd
push 4
pop eax
jmp 0x1007bea5
cmp dword [ebp - 0x14], esi
je 0x1007bdfd
push dword [0x13c62b1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007bde2
mov eax, dword [0x13c62b28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007be5b
cmp dword [0x13c62b2c], edi
je 0x1007be5b
push eax
call ebx
push dword [0x13c62b2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007be5b
test eax, eax
je 0x1007be5b
call ecx
test eax, eax
je 0x1007be50
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007be50
test byte [ebp - 8], 1
jne 0x1007be5b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007be8b
mov eax, dword [0x13c62b20]
cmp eax, edi
je 0x1007be88
push eax
call ebx
test eax, eax
je 0x1007be88
call eax
mov esi, eax
test esi, esi
je 0x1007be88
mov eax, dword [0x13c62b24]
cmp eax, edi
je 0x1007be88
push eax
call ebx
test eax, eax
je 0x1007be88
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x13c62b1c]
call ebx
test eax, eax
je 0x1007bea3
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007bea5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x10124420
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x101245e4
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf7000]
push edi
or ebp, 0xffffffff
jmp 0x1012444a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10124451
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10124440
mov eax, 1
add ebx, ebx
jne 0x10124463
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10124458
jne 0x10124474
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10124458
xor ecx, ecx
sub eax, 3
jb 0x10124488
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x101244fa
mov ebp, eax
add ebx, ebx
jne 0x10124493
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x101244a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x101244c4
inc ecx
add ebx, ebx
jne 0x101244b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x101244a5
jne 0x101244c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x101244a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x101244e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x101244d5
jmp 0x10124446
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x101244e4
add edi, ecx
jmp 0x10124446
pop esi
mov edi, esi
mov ecx, 0x169c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10124502
cmp byte [edi], 0x11
jne 0x10124502
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10124507
lea edi, [esi + 0x121000]
mov eax, dword [edi]
or eax, eax
je 0x10124576
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x125390]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x125408]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10124534
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12540c]
or eax, eax
je 0x10124570
mov dword [ebx], eax
add ebx, 4
jmp 0x10124551
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x101245a7
cmp al, 0xef
ja 0x1012459a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1012457c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10124589
mov ebp, dword [esi + 0x125410]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x101245db
sub esp, 0xffffff80
jmp 0x100170ce
Function at 0x10005a70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10090f98
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100b84c0]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov eax, dword [0x100b84c0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x10], 0
jne 0x10005abc
mov eax, 0xfffffff5
jmp 0x10005be4
push 4
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
push 0x100a3708
lea ecx, [esp + 0x50]
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], 0
mov word [esp + 0x50], ax
call fcn.100157b0
mov dword [esp + 0x70], 0
cmp byte [ebp + 0x10], 0
je 0x10005b1a
call fcn.1002dcd0
test eax, eax
je 0x10005b1a
push 5
push str.runas
lea ecx, [esp + 0x50]
call fcn.100157b0
push 0x38
lea eax, [esp + 0x14]
push 0
push eax
call fcn.10073e30
add esp, 0xc
cmp dword [esp + 0x5c], 8
lea eax, [esp + 0x48]
cmovae eax, dword [esp + 0x48]
cmp dword [esi + 0x14], 8
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x10], 0x40
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
jb 0x10005b5d
mov esi, dword [esi]
cmp dword [edi + 0x14], 8
mov dword [esp + 0x1c], esi
jb 0x10005b69
mov edi, dword [edi]
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x493e0
push dword [esp + 0x48]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 0xb
mov eax, 0xfffffff4
test esi, esi
cmove edi, eax
mov dword [esp + 0x70], 0xffffffff
cmp dword [esp + 0x5c], 8
jb 0x10005bcb
push dword [esp + 0x48]
call fcn.1006e29c
add esp, 4
xor eax, eax
mov word [esp + 0x48], ax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], 0
mov eax, edi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1006e28d
mov esp, ebp
pop ebp
ret 0xc