joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c45a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x18
call fcn.00410fd9
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
add ebx, 0x14
push ebx
push 0x208
call fcn.00410fd9
add esp, 4
pop ebx
mov dword [ebx], eax
mov edi, eax
mov esi, 0x42a31d
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
xor eax, eax
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x94
mov dword [ebp - 8], esp
mov eax, dword [ebp - 4]
push eax
push 0x214
call fcn.00410fd9
add esp, 4
mov edi, eax
pop ebx
push eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
push ebx
mov ebx, dword [ebx]
add ebx, 8
mov ecx, 0x80
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
pop ebx
add ebx, 4
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40c539
push 6
call fcn.00410fcd
add esp, 4
push eax
mov ebx, dword [ebp - 0xc]
push ebx
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
add edi, 4
call fcn.00410fdf
add esp, 4
pop eax
mov ebx, dword [ebp - 4]
add ebx, 4
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
cmp dword [ebx], 6
jl 0x40c5a0
mov eax, 1
jmp 0x40c5aa
mov eax, 0
jmp 0x40c5aa
push eax
mov ebx, dword [ebp - 4]
push ebx
add ebx, 0x14
push ebx
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40c5d0
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40c5cc
imul eax, dword [ebx]
jmp 0x40c5c1
mov ecx, eax
test ecx, ecx
je 0x40c5ef
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x40c5e8
push ebx
push eax
call fcn.00410fdf
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x40c5d6
call fcn.00410fdf
add esp, 4
pop ebx
call fcn.00410fdf
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x411d50
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.004115b0
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x411da7
push ebx
push edi
call fcn.00411640
push esi
mov ebx, esi
call fcn.004115b0
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x411d7e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x4154c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
sub esp, 0x10
push esi
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov ecx, dword [esp + 0x1c]
mov esi, eax
xor eax, eax
push ecx
mov dword [esp + 8], eax
mov word [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call sub.WS2_32.dll_inet_addr
mov edx, dword [esp + 0x20]
mov dword [esp + 8], eax
push edx
call sub.WS2_32.dll_htons
mov word [esp + 6], ax
lea eax, [esp + 4]
push 0x10
push eax
push esi
call sub.WS2_32.dll_connect
test eax, eax
jne 0x41551f
mov eax, esi
pop esi
add esp, 0x10
ret
push esi
call sub.WS2_32.dll_closesocket
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x415680
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
lea eax, [esp + 0x1c]
push ebx
push esi
push edi
push eax
push 1
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x4157a3
mov ebx, dword [esp + 0x1c0]
test ebx, ebx
jl 0x4157a3
cmp ebx, 0xffff
jg 0x4157a3
mov edi, dword [esp + 0x1c4]
push edi
call fcn.00416810
add esp, 4
cmp eax, 1
jne 0x4156f0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x415706
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.00416a00
add esp, 8
test eax, eax
je 0x4157a3
mov esi, dword [esp + 0x1bc]
xor edx, edx
lea ecx, [esp + 0x14]
push ebx
lea eax, [esi + 0x34]
push ecx
push esi
mov dword [eax], edx
mov byte [eax + 4], dl
call fcn.004154c0
add esp, 0xc
mov dword [esi + 0xc], eax
test eax, eax
je 0x4157a3
push eax
call fcn.00415a00
push esi
lea edx, [esp + 0x18]
push 0x415530
push edx
mov dword [esi + 0x10], 0
call fcn.00416a50
mov eax, dword [esp + 0x20]
add esp, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
test eax, eax
jne 0x41578c
push esi
lea ecx, [esp + 0x10]
push 0x4155a0
push ecx
call fcn.00416a50
mov edx, dword [esp + 0x18]
push esi
lea eax, [esp + 0x1c]
push 0x415610
push eax
mov dword [esi + 0x18], edx
call fcn.00416a50
mov ecx, dword [esp + 0x24]
add esp, 0x18
mov dword [esi + 0x1c], ecx
call fcn.004153f0
mov dword [esi + 8], eax
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x1ac
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x1ac
ret

Function at 0x415a00
Capabilities:
Set socket configuration

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
xor edx, edx
test eax, eax
setge dl
mov eax, edx
pop ecx
ret
Function at 0x416a00
Capabilities:
Resolve dns

Disassembly:
mov eax, dword [esp + 4]
push eax
call sub.WS2_32.dll_gethostbyname
test eax, eax
jne 0x416a0f
ret
mov ecx, dword [eax + 0xc]
push esi
push edi
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret

Function at 0x416a50
Capabilities:
Create thread

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0
push ecx
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 4]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], eax
mov eax, edx
ret

Function at 0x416a80
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x416a99
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x1002581
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 4], 0x5c3a78
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002595
sub eax, ecx
cmp eax, 2
jb 0x10025c7
movsx eax, byte [esi]
push eax
call dword [sym.imp.msvcrt.dll_isalpha]
test eax, eax
pop ecx
je 0x10025c7
cmp byte [esi + 1], 0x3a
jne 0x10025c7
movsx eax, byte [esi]
push eax
call dword [sym.imp.msvcrt.dll_toupper]
pop ecx
sub al, 0x40
jmp 0x10025cd
call dword [sym.imp.msvcrt.dll__getdrive]
mov ecx, dword [ebp + 0xc]
add al, 0x40
mov byte [ecx], al
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
dec eax
dec eax
neg eax
sbb eax, eax
inc eax
pop esi
leave
ret 8
Function at 0x1002a15
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
xor esi, esi
push esi
push esi
push 3
push esi
push esi
mov ebx, 0x40000000
push ebx
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x1002a5b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push esi
push 3
push esi
push esi
push ebx
push dword [ebp + 8]
call edi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x1002ad7
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
xor eax, eax
mov ax, word [edi + 2]
push eax
xor eax, eax
mov ax, word [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
or ebx, eax
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [ebp - 4]
or ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ax, word [edi + 4]
push eax
call fcn.010025ed
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
or eax, ebx
jne 0x1002ad7
push dword [ebp + 8]
push 0x1001190
push 0x1001328
push dword [ebp + 0x10]
call fcn.010022c0
add esp, 0x10
xor eax, eax
jmp 0x1002ada
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002ae1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.msvcrt.dll__open]
push edi
mov edi, dword [ebp + 0xc]
push 0x8000
push edi
call esi
cmp eax, 0xffffffff
pop ecx
pop ecx
mov dword [ebp - 8], eax
jne 0x1002b27
push edi
push 0x1001190
push 0x10013b4
push dword [ebp + 0x20]
call fcn.010022c0
add esp, 0x10
jmp 0x1002c50
push ebx
mov ebx, dword [ebp + 0x20]
push ebx
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.010029ab
test eax, eax
je 0x1002c35
cmp dword [ebp + 0x18], 0
je 0x1002b57
push ebx
push dword [ebp + 0x1c]
lea eax, [ebp - 0x14]
push eax
call dword [ebp + 0x18]
test eax, eax
je 0x1002c35
cmp dword [ebp + 0x10], 0
jne 0x1002b69
mov dword [ebp - 0xc], 1
jmp 0x1002c35
push dword [ebp + 0x14]
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jne 0x1002b96
push dword [ebp + 8]
push edi
push 0x10011c8
push 0x1001388
push ebx
call fcn.010022c0
add esp, 0x14
jmp 0x1002c35
push 0x180
push 0x8301
push dword [ebp + 8]
call esi
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
jne 0x1002bc2
push dword [ebp + 8]
push 0x1001190
push 0x10013b4
push ebx
jmp 0x1002c78
mov ebx, dword [sym.imp.msvcrt.dll__eof]
jmp 0x1002bf9
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__read]
mov esi, eax
add esp, 0xc
cmp esi, 0xffffffff
je 0x1002c59
test esi, esi
je 0x1002bf9
push esi
push dword [ebp - 4]
push edi
call dword [sym.imp.msvcrt.dll__write]
add esp, 0xc
cmp eax, esi
jne 0x1002c68
push dword [ebp - 8]
call ebx
test eax, eax
pop ecx
je 0x1002bca
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push dword [ebp + 0x20]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
or edi, 0xffffffff
call fcn.01002a15
test eax, eax
je 0x1002c35
mov dword [ebp - 0xc], 1
cmp edi, 0xffffffff
je 0x1002c35
push edi
call dword [sym.imp.msvcrt.dll__close]
pop ecx
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__close]
cmp dword [ebp - 4], 0
pop ecx
pop ebx
je 0x1002c50
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret 0x1c
push dword [ebp + 0xc]
push 0x1001190
push 0x1001370
jmp 0x1002c75
push dword [ebp + 0xc]
push 0x1001190
push 0x1001358
push dword [ebp + 0x20]
call fcn.010022c0
add esp, 0x10
jmp 0x1002c28

Function at 0x1003ee8
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push dword [esp + 0x14]
push dword [esp + 0x14]
push esi
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
cmp esi, dword [0x100b020]
mov edi, eax
jne 0x1003f18
mov eax, dword [0x100b16c]
add eax, edi
mov dword [0x100b16c], eax
jmp 0x1003f2c
cmp esi, dword [0x100b024]
jne 0x1003f3e
mov eax, dword [0x100b164]
add eax, edi
mov dword [0x100b164], eax
cmp eax, dword [0x100b170]
jbe 0x1003f3e
mov dword [0x100b170], eax
call fcn.01003a58
mov eax, edi
pop edi
pop esi
ret
Function at 0x1005293
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100b02c]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x21c]
push eax
call fcn.010022e9
xor ebx, ebx
push 0x1074
mov dword [ebp - 0x18], ebx
mov byte [0x100c300], bl
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x10052f8
lea eax, [ebp - 0x21c]
push 0x1001f78
push eax
call fcn.010022c0
pop ecx
pop ecx
lea eax, [ebp - 0x21c]
push eax
push ebx
call fcn.01003683
push 1
call dword [sym.imp.msvcrt.dll_exit]
mov edi, dword [sym.imp.msvcrt.dll_printf]
mov dword [0x100c400], esi
push 0x1001f00
mov dword [esi + 0xc], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x858], ebx
mov dword [esi + 0x850], ebx
mov dword [esi + 0x854], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0xe64], bl
mov dword [esi + 0x1064], ebx
mov dword [esi + 0x106c], ebx
call edi
pop ecx
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.01004b05
test eax, eax
jne 0x1005371
lea eax, [ebp - 0x21c]
push eax
push esi
call fcn.01003683
jmp 0x10053d0
mov eax, dword [esi]
cmp eax, 1
jne 0x100538d
push 0x1001448
call edi
mov dword [esp], 0x1001b30
call edi
jmp 0x1005440
cmp eax, 5
lea eax, [ebp - 0x21c]
push eax
push esi
jne 0x10053a9
call fcn.01003b18
test eax, eax
jne 0x1005441
jmp 0x1005362
call fcn.01004dd5
test eax, eax
jne 0x10053d5
lea eax, [ebp - 0x21c]
push eax
push esi
call fcn.01003683
mov eax, dword [0x100c2e4]
cmp eax, 0xffffffff
je 0x10053d0
push eax
call fcn.010038c6
pop ecx
xor eax, eax
inc eax
jmp 0x1005443
mov eax, dword [esi + 0x3c]
cmp eax, ebx
jne 0x10053ff
push 0x1001b1c
lea ebx, [esi + 0x150]
push 0x200
push ebx
call fcn.0100338e
push ebx
push 0x10014d8
call edi
add esp, 0x14
jmp 0x1005439
cmp dword [esi], 3
jne 0x1005439
cmp eax, 1
mov ecx, 0x1001b04
je 0x1005413
mov ecx, 0x1001aec
push dword [esi + 0x40]
lea ebx, [esi + 0x150]
push eax
push 0x1001adc
push ecx
push 0x200
push ebx
call fcn.0100338e
push ebx
push 0x10014d8
call edi
add esp, 0x20
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005588
leave
ret
Function at 0x1005588
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100b02c]
jne 0x1005591
ret
jmp 0x1005596
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100b02c]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x100c404]
test eax, eax
je 0x10055ba
call eax
cmp dword [0x100c408], 0
je 0x1005601
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x100c408]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005588
add ebp, 0x2a8
leave
ret
Function at 0x1005626
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001fc0
call fcn.01005834
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x1000000], 0x5a4d
jne 0x1005679
mov eax, dword [0x100003c]
lea eax, [eax + 0x1000000]
cmp dword [eax], 0x4550
jne 0x1005679
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x1005691
cmp ecx, 0x20b
je 0x100567e
mov dword [ebp - 0x1c], ebx
jmp 0x10056a5
cmp dword [eax + 0x84], 0xe
jbe 0x1005679
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x100569f
cmp dword [eax + 0x74], 0xe
jbe 0x1005679
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x100c40c], edi
mov dword [0x100c410], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100b190]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100b18c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100c414], eax
call fcn.0100582e
cmp dword [0x100b030], ebx
jne 0x1005702
push fcn.0100582e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100581c
push 0x100b010
push 0x100b00c
call sub.msvcrt.dll__initterm
mov eax, dword [0x100b188]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100b184]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x100b008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x100578d
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x100576d
cmp cl, 0x22
jne 0x100575e
cmp byte [eax], 0x22
jne 0x1005776
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x1005781
cmp cl, 0x20
jbe 0x1005772
test byte [ebp - 0x54], 1
je 0x1005798
movzx ecx, word [ebp - 0x50]
jmp 0x100579b
cmp byte [eax], 0x20
jbe 0x1005776
inc eax
mov dword [ebp - 0x20], eax
jmp 0x100578d
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.01005450
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x10057b9
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x10057f5
mov eax, esi
jmp 0x1005809
call fcn.0100586f
ret
Function at 0x1006b72
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1006bad
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1006b8a
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1006bc9
dec esi
je 0x1006bc2
dec esi
jne 0x1006bce
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x4b1310
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6f000]
push edi
jmp 0x4b132a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b1331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1320
mov eax, 1
add ebx, ebx
jne 0x4b1343
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b1354
jne 0x4b1373
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1373
dec eax
add ebx, ebx
jne 0x4b1360
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b1338
add ebx, ebx
jne 0x4b136f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b13c5
xor ecx, ecx
sub eax, 3
jb 0x4b138b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b13fa
sar eax, 1
mov ebp, eax
jmp 0x4b1396
add ebx, ebx
jne 0x4b1396
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1364
inc ecx
add ebx, ebx
jne 0x4b13a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b1364
add ebx, ebx
jne 0x4b13b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b13a6
jne 0x4b13c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b13a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b13e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b13d6
jmp 0x4b1326
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b13e4
add edi, ecx
jmp 0x4b1326
pop esi
mov edi, esi
mov ecx, 0x3726
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b1402
cmp byte [edi], 0x22
jne 0x4b1402
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b1407
lea edi, [esi + 0xad000]
mov eax, dword [edi]
or eax, eax
je 0x4b147f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb28e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb2a3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b1434
mov ecx, edi
jns 0x4b1463
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb2a40]
or eax, eax
je 0x4b1479
mov dword [ebx], eax
add ebx, 4
jmp 0x4b1451
call dword [esi + 0xb2a50]
mov ebp, dword [esi + 0xb2a44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b14b3
sub esp, 0xffffff80
jmp 0x416781
Function at 0x1001529
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x10015a0
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001588
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x1001590
push dword [ebp - 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
call dword [entry0]
test eax, eax
je 0x10017cd
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
leave
ret
cmp dword [ebp - 8], 0xd2af9
sete bl
jmp 0x100157f

Function at 0x1001630
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 1], 1
je 0x1001667
push 0x10017c0
push dword [ebp + 8]
call fcn.010015ca
test eax, eax
pop ecx
pop ecx
jne 0x10017dc
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 8]
push eax
mov edi, 0x20019
push edi
push ebx
push 0x1001730
push 0x80000001
call esi
test eax, eax
jne 0x10016d1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x100178c
push dword [ebp - 8]
mov dword [ebp - 0xc], 4
call dword [entry0]
test eax, eax
jne 0x10016c0
cmp dword [ebp - 0x10], 4
jne 0x10016c0
cmp dword [ebp - 0x14], 1
je 0x10017e3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 1], bl
mov dword [ebp - 8], ebx
je 0x1001723
lea eax, [ebp - 8]
push eax
push edi
push ebx
push 0x100175c
push 0x80000002
call esi
test eax, eax
jne 0x1001723
push 4
pop esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x10017a8
push dword [ebp - 8]
mov dword [ebp - 0xc], esi
call dword [entry0]
test eax, eax
jne 0x100171a
cmp dword [ebp - 0x10], esi
jne 0x100171a
cmp dword [ebp - 0x14], 1
jne 0x100171a
mov byte [ebp - 1], bl
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 4
xor al, al
jmp 0x1001728
mov byte [ebp - 1], bl
jmp 0x10016c0