joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
fld dword [esi + 0x14]
call fcn.10013480
fld dword [esi + 0x18]
push 1
push 0xa
add eax, 0x78
push 0xa
push eax
call fcn.10013480
push eax
mov eax, 0x454a00
call eax
add esp, 0x14
test eax, eax
je 0x1000b14d
cmp byte [0x7d17004], 0
je 0x1000b14d
push 0
mov byte [0x7d17004], 0
push 0
mov dword [0x77d86d8], 0
push 0x19
mov ecx, 0x41d1a0
mov dword [0x6b7d60], 6
call ecx
add esp, 0xc
xor dword [esi + 0x3c], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
push 1
push 0x6024e0
je 0x1000b0de
call esi
lea eax, [ebp - 4]
push eax
mov byte [0x6024e0], 0xc3
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x6024e0
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 1
push 0x526280
call esi
lea eax, [ebp - 4]
push eax
mov byte [0x526280], 0xc3
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x526280
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 1
push 0x50f41e
call esi
mov byte [0x50f41e], 0
jmp 0x1000b135
call esi
lea eax, [ebp - 4]
push eax
mov byte [0x6024e0], 0x55
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x6024e0
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 1
push 0x526280
call esi
lea eax, [ebp - 4]
push eax
mov byte [0x526280], 0x55
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x526280
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 1
push 0x50f41e
call esi
mov byte [0x50f41e], 1
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 1
push 0x50f41e
call esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000bc00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10016018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000bc47
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012abd
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [ebp - 0x18]
push eax
push 6
lea ecx, [ebp - 0x20]
push ecx
push edi
call ebx
mov edx, 0x1112
cmp word [ebp - 0x20], dx
jne 0x1000bd5c
cmp dword [ebp - 0x1e], 0x36
jne 0x1000bd5c
cmp byte [ebp + 0xc], 0
push esi
mov esi, 0x1009fae4
je 0x1000bc87
mov esi, 0x1009fb14
push 0
lea eax, [ebp - 0x18]
push eax
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
call ebx
mov edx, dword [0x1009fb44]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi], edx
mov eax, dword [0x1009fb48]
xor eax, dword [ebp - 0x10]
mov dword [esi + 4], eax
mov ecx, dword [0x1009fb4c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 8], ecx
mov edx, dword [0x1009fb50]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0xc], edx
call ebx
mov edx, dword [0x1009fb44]
xor edx, dword [ebp - 0x14]
push 0
mov dword [esi + 0x10], edx
mov eax, dword [0x1009fb48]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x14], eax
mov ecx, dword [0x1009fb4c]
xor ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
mov dword [esi + 0x18], ecx
mov edx, dword [0x1009fb50]
xor edx, dword [ebp - 8]
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push edi
mov dword [esi + 0x1c], edx
call ebx
mov edx, dword [0x1009fb44]
xor edx, dword [ebp - 0x14]
push edi
mov dword [esi + 0x20], edx
mov eax, dword [0x1009fb48]
xor eax, dword [ebp - 0x10]
mov dword [esi + 0x24], eax
mov ecx, dword [0x1009fb4c]
xor ecx, dword [ebp - 0xc]
mov dword [esi + 0x28], ecx
mov edx, dword [0x1009fb50]
xor edx, dword [ebp - 8]
mov dword [esi + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012abd
mov esp, ebp
pop ebp
ret 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.10012abd
mov esp, ebp
pop ebp
ret 8
Function at 0x1000d190
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x10016018]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
push edi
lea esi, [esp + 0x10]
call fcn.10001c60
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x8c140]
mov eax, str.ServerInfo.sse
call fcn.10001da0
test al, al
jne 0x1000d1f1
push str._Error__ReadMainFile_1:_Failed_to_calculate_CRC_for_the_main_file.
call fcn.10011d90
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10012abd
mov esp, ebp
pop ebp
ret
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push str.ServerInfo.sse
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1000d235
push str._Error__ReadMainFile_2:_Failed_to_open_the_main_file.
call fcn.10011d90
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10012abd
mov esp, ebp
pop ebp
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x8c13c
je 0x1000d26f
push str._Error__ReadMainFile_3:_Unexpected_size_for_the_main_file.
call fcn.10011d90
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.10012abd
mov esp, ebp
pop ebp
ret
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x8c13c
lea esi, [ebx + 4]
push esi
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1000d299
push str._Error__ReadMainFile_4:_Failed_to_read_the_main_file_data.
jmp 0x1000d24a
mov dword [esp + 0x410], 0x1a927d46
mov dword [esp + 0x414], 0x295de8b4
mov dword [esp + 0x418], 0x6c2e8f70
mov dword [esp + 0x41c], 0x3a8ef79b
mov dword [esp + 0x420], 0x81a12f59
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov eax, ecx
sub eax, edx
mov edx, ecx
shr edx, 8
and dl, cl
or dl, byte [esp + eax + 0x410]
mov al, byte [esi + ecx]
not al
xor dl, al
mov byte [esi + ecx], dl
inc ecx
cmp ecx, 0x8c13c
jb 0x1000d2d2
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.10012abd
mov esp, ebp
pop ebp
ret

Function at 0x1000eb20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x101d97d4], 2
jne 0x1000eb9b
mov edx, dword [0x10131320]
mov eax, dword [0x1013131c]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov ax, word [0x10131324]
lea edx, [ebp - 0x10]
push esi
mov ecx, 0xe
push edx
mov dword [ebp - 0x10], 0x3f30ec1
mov word [ebp - 4], ax
call fcn.1000e1c0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 4
mov dword [0x101d97d0], 1
mov dword [0x101d97d4], 3
call esi
mov dword [0x101d97d8], eax
call esi
mov dword [0x101d97dc], eax
mov eax, 0x7530
mov dword [0x101d97e0], eax
mov dword [0x101d97e4], eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000f080
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x61fc58
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x61fc58], 0xeb
mov edx, dword [ebp - 4]
push edx
push 1
push 0x61fc58
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x61fcfd
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x61fcfd], 0x50
mov edx, dword [ebp - 4]
push edx
push 1
push 0x61fcfd
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x26
push 0x61fcd2
call esi
mov eax, 0x90909090
mov ecx, 0x61fcd2
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x20], eax
mov word [ecx + 0x24], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 0x26
push 0x61fcd2
call esi
push 0x1000f160
push 0x61fd79
mov bl, 0xe8
call fcn.10011cc0
push 0x1000f190
push 0x5dce0a
call fcn.10011cc0
push 0x1000f1c0
push 0x45c895
call fcn.10011cc0
add esp, 0x18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x575052c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x10011b20
mov ecx, dword [0x575052c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.10011b40
mov esp, ebp
pop ebp
ret
mov edx, dword [0x575052c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.10011b40
mov esp, ebp
pop ebp
ret

Function at 0x10011c90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 4
push esi
call edi
fld dword [ebp + 0xc]
mov edx, dword [ebp + 8]
fstp dword [esi]
lea ecx, [ebp + 8]
push ecx
push edx
push 4
push esi
call edi
pop edi
pop esi
pop ebp
ret

Function at 0x10011cc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push esi
call edi
cmp bl, 0xff
je 0x10011ce1
mov byte [esi], bl
mov ecx, dword [ebp + 0xc]
sub ecx, esi
sub ecx, 5
lea edx, [ebp - 4]
push edx
mov dword [esi + 1], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push esi
call edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10011d00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
push esi
push edi
call ebx
mov ecx, dword [ebp + 0xc]
push esi
push ecx
push edi
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push eax
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011e00
Capabilities:
Get common file path
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10016018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x10011e39
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012abd
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10c]
push ecx
push 0
push 0
lea edx, [ebp - 0x108]
push edx
mov byte [ebp - 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x10011e29
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx edx, word [ebp - 0x10e]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x10c]
and ecx, 0xf5fb
shl edx, 0x10
or ecx, edx
xor ecx, 0x15ca2020
push ecx
movzx ecx, word [ebp - 0x130]
shl ecx, 0xe
mov edx, eax
shr edx, 2
or ecx, edx
push ecx
mov ecx, dword [ebp - 0x11c]
shl ecx, 0x10
or ecx, eax
imul eax, eax
imul ecx, ecx, 0x14ce1989
push ecx
sub eax, 0x13b06451
push eax
push 0x12ba1074
push str._08X__08X__08X__08X__08X
push 0x101d9a9c
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x1c
mov eax, 0x101d9a9c
call fcn.10012abd
mov esp, ebp
pop ebp
ret

Function at 0x10011ef0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SOFTWAREWebzenMuConfig
push getpeername
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10011f52
mov eax, 4
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.WindowMode
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10011f52
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10012abd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10016018]
jne 0x10012ac7
repz ret
jmp fcn.10012f79
Function at 0x15f1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.015f11a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x15f107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15f106a
add dl, dl
jne 0x15f1089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15f10dc
xor eax, eax
add dl, dl
jne 0x15f1096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x15f117d
add dl, dl
jne 0x15f10a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15f10b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15f10bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15f10c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x15f10d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x15f1075
mov eax, 1
add dl, dl
jne 0x15f10ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x15f10f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15f10e1
sub eax, ebx
mov ebx, 1
jne 0x15f1128
mov ecx, 1
add dl, dl
jne 0x15f110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15f1119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15f1105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15f1075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x15f113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x15f114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x15f1136
cmp eax, 0x7d00
jae 0x15f116d
cmp eax, 0x500
jb 0x15f1168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15f1075
cmp eax, 0x7f
ja 0x15f1170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x15f1075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x15f119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x15f1075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401388
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4022a8
call fcn.00401660
xor ebx, ebx
cmp dword [0x40339c], ebx
jne 0x401166
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x403390
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x4011a0
cmp eax, esi
jne 0x401193
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x4011a3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40117a
xor esi, esi
inc esi
mov eax, dword [0x40338c]
cmp eax, esi
jne 0x4011b6
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x4011f1
mov eax, dword [0x40338c]
test eax, eax
jne 0x4011eb
mov dword [0x40338c], esi
push 0x4020e8
push 0x4020dc
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4011f1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4012c8
mov dword [0x403054], esi
mov eax, dword [0x40338c]
cmp eax, esi
jne 0x401215
push 0x4020d8
push 0x4020d0
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x40338c], 2
cmp dword [ebp - 0x1c], ebx
jne 0x401222
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x4033a0], ebx
je 0x401243
push 0x4033a0
call fcn.00401590
pop ecx
test eax, eax
je 0x401243
push ebx
push 2
push ebx
call dword [0x4033a0]
mov eax, dword [0x40303c]
mov ecx, dword [sym.imp.MSVCR100.dll___initenv]
mov dword [ecx], eax
push dword [0x40303c]
push dword [0x403040]
push dword [0x403038]
call section..text
add esp, 0xc
mov dword [0x403050], eax
cmp dword [0x403044], ebx
jne 0x4012ae
push eax
call dword [sym.imp.MSVCR100.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR100.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x403054], ebx
jne 0x4012bc
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x403050]
call fcn.004016a5
ret
call 0x567000
jmp 0x401145
Function at 0xf5840c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf58416
pushal
call 0xf5841c
pop ebp
sub ebp, 0x10
sub ebp, 0xb5840c
jmp 0xf58432
mov eax, 0xb5840c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b9
mov edx, 0xd1d8c1b8
xor byte [eax], dl
inc eax
dec ecx
jne 0xf58449
jmp 0xf5845c
xor esi, dword [ebp + 0x33]
xor dword [eax + edi*4 + 0x7939b8b8], eax
inc eax
mov eax, 0x75bbb8b8
add byte [ecx + 0x2b8b8b8], dh
nop
mov eax, 0x5a4fb8b8
mov ebx, 0xb4393370
mov eax, 0x7dbbb8b8
call 0xcbca556f
cdq
mov eax, 0x2ca926d0
mov eax, 0xd09c94b9
cmc
pop ds
mov cl, 0x4e
push eax
mov ebp, 0x51b8b8b8
mov byte [eax - 0x23ca4748], bh
pushfd
inc esp
xor dword [esp + ebx*4 - 0x47632bcb], edx
xor edi, dword [0xb8b8b8b0]
xor ebp, dword [0xb8b8b8b4]
xor esi, dword [0xb8b8b8a8]
jns 0xf58510
mov edx, 0x7a3bba89
mov esp, 0x4c3db7f1
inc edi
inc edi
inc edi
in eax, 0x7a
mov ah, 0xb8
xor esi, dword [esp + ebx*4]
mov esp, 0xd0b8b8b8
aam 0xca
cdq
mov eax, 0x2ca926d0
mov eax, 0x359c94b9
fcomp qword [esp + eax*2 + 0x509cb431]
mov ebp, 0x51b8b8b8
cmp dword [edx - 0x23ca4748], 0xffffff9c
inc esp
xor dword [esp + ebx*4 - 0x47632bcb], edx
inc edi
int 0xb4
inc edi
int 0xb0
push eax
fidivr word [eax + 0x533b8b8]
mov al, 0xb8
mov eax, 0x8b718bb8
push 0x3b
push eax
mov ebp, 0xf63cb7f0
mov eax, 0x30b7b8b8
invalid
mov eax, 0x6a8b718b
cmp edx, dword [eax - 0x43]
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x58bb556c
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x32472600
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0xcc8340
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x86a000]
push edi
jmp 0xcc835a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xcc8361
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcc8350
mov eax, 1
add ebx, ebx
jne 0xcc8373
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xcc8384
jne 0xcc83a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcc83a3
dec eax
add ebx, ebx
jne 0xcc8390
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xcc8368
add ebx, ebx
jne 0xcc839f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xcc83f5
xor ecx, ecx
sub eax, 3
jb 0xcc83bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xcc842a
sar eax, 1
mov ebp, eax
jmp 0xcc83c6
add ebx, ebx
jne 0xcc83c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcc8394
inc ecx
add ebx, ebx
jne 0xcc83d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcc8394
add ebx, ebx
jne 0xcc83e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xcc83d6
jne 0xcc83f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xcc83d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xcc8414
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xcc8406
jmp 0xcc8356
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xcc8414
add edi, ecx
jmp 0xcc8356
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xcc8432
cmp byte [edi], 0x11
jne 0xcc8432
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xcc8437
lea edi, [esi + 0x8c1000]
mov eax, dword [edi]
or eax, eax
je 0xcc84af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10ab5f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10ab770]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xcc8464
mov ecx, edi
jns 0xcc8493
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x10ab774]
or eax, eax
je 0xcc84a9
mov dword [ebx], eax
add ebx, 4
jmp 0xcc8481
call dword [esi + 0x10ab784]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xcc84e0
cmp al, 0xef
ja 0xcc84d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xcc84b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xcc84c2
mov ebp, dword [esi + 0x10ab778]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xcc8514
sub esp, 0xffffff80
jmp 0x420577
Function at 0x427720
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x427690
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x42774a
pop edi
xor al, al
pop ebx
ret
mov edx, dword [edi]
push esi
add edx, 4
mov eax, 1
lock xadd dword [edx], eax
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x427771
cmp eax, 0xffffffff
je 0x427771
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret