joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006a9b9
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push 4
mov eax, 0x1012f0c6
call fcn.1008de34
and dword [ebp - 0x10], 0
mov esi, dword [ebp + 8]
mov eax, dword [0x10183004]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
xor edi, edi
and dword [ebp - 4], 0
inc edi
movzx edx, cx
mov dword [ebp - 0x10], edi
cmp edx, 0x25
ja 0x1006aa5f
je 0x1006aa55
mov eax, edx
sub eax, 0xd
je 0x1006aa4b
sub eax, 0xe
je 0x1006aa41
sub eax, 5
je 0x1006aa37
sub eax, edi
je 0x1006aa2d
sub eax, edi
je 0x1006aa23
sub eax, edi
je 0x1006aa19
sub eax, edi
jne 0x1006aa98
push str.Home
jmp 0x1006ab9c
push 0x101400b8
jmp 0x1006ab9c
push str.PageDown
jmp 0x1006ab9c
push str.PageUp
jmp 0x1006ab9c
push str.Space
jmp 0x1006ab9c
push 0x1014006c
jmp 0x1006ab9c
push 0x10140074
jmp 0x1006ab9c
push str.Left
jmp 0x1006ab9c
mov eax, edx
sub eax, 0x26
je 0x1006ab97
sub eax, 1
je 0x1006ab90
sub eax, 1
je 0x1006ab89
dec eax
sub eax, 1
je 0x1006ab82
sub eax, 3
je 0x1006ab7b
sub eax, 1
je 0x1006ab74
cmp cx, 0x30
jb 0x1006aaa4
cmp cx, 0x39
jbe 0x1006aaad
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x1006aac4
movzx eax, cx
mov ecx, esi
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.10002970
jmp 0x1006aba3
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x1006aad8
lea eax, [edx - 0x60]
push eax
push str.Num__d
jmp 0x1006ab1a
cmp cx, 0x6a
jne 0x1006aae8
push 0x1014012c
jmp 0x1006ab9c
cmp cx, 0x6b
jne 0x1006aaf8
push str.Num_
jmp 0x1006ab9c
cmp cx, 0x6e
jne 0x1006ab08
push str.Num_Del
jmp 0x1006ab9c
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x1006ab31
lea eax, [edx - 0x6f]
push eax
push 0x10140154
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.10006fb0
add esp, 0x10
lea ecx, [ebp + 0xc]
call fcn.10002740
jmp 0x1006aba3
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp al, 0x3d
jg 0x1006ab52
je 0x1006ab5e
cmp al, 0x27
je 0x1006ab5e
cmp al, 0x2b
jle 0x1006aba3
cmp al, 0x2f
jle 0x1006ab5e
cmp al, 0x3b
je 0x1006ab5e
jmp 0x1006aba3
cmp al, 0x5b
jl 0x1006aba3
cmp al, 0x5d
jle 0x1006ab5e
cmp al, 0x60
jne 0x1006aba3
cbw
mov ecx, esi
movzx eax, ax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
push edi
call fcn.100076c0
jmp 0x1006aba3
push str.Delete
jmp 0x1006ab9c
push str.Insert
jmp 0x1006ab9c
push str.Print
jmp 0x1006ab9c
push str.Down
jmp 0x1006ab9c
push str.Right
jmp 0x1006ab9c
push 0x10140080
mov ecx, esi
call fcn.10002a20
mov eax, esi
call fcn.1008ddfd
ret
Function at 0x10071d6a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002462e
mov esi, eax
test esi, esi
je 0x10071d96
mov edx, dword [esi]
mov ecx, esi
push str.menuItem
call dword [edx + 4]
test eax, eax
je 0x10071d96
mov eax, esi
jmp 0x10071e98
mov ecx, dword [0x1018b4e0]
test ecx, ecx
je 0x10071da9
call fcn.10014e48
mov esi, eax
jmp 0x10071dab
xor esi, esi
push ebx
push edi
push 0x2800
call fcn.100bdb32
mov edi, eax
mov dword [esp], 0x5000
call fcn.100bdb32
push dword [ebp + 0xc]
mov ebx, eax
push dword [ebp + 8]
push str.menuItem
push str.FindChildByID2_Failed__no_window_of_class___s__with_id_of___d__was_found_within___d__levels
push 0xffffffffffffffff
push 0x2800
push ebx
call fcn.1002eff8
add esp, 0x20
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push ebx
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 0x2800
jae 0x10071e10
xor ecx, ecx
push ecx
push ecx
push eax
push edi
push 0xffffffffffffffff
push ebx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
call fcn.100bdb3d
pop ecx
test esi, esi
je 0x10071e4f
mov eax, dword [esi]
mov ecx, esi
push 3
push 0
call dword [eax + 0x2c]
test al, al
je 0x10071e4f
push dword [ebp + 4]
mov eax, dword [esi]
mov ecx, esi
push str.SOUI::SWindow::FindChildByID2
push 0x1e9
push str.d:workspace_soui_souiincludecore_swnd.h
push edi
push str.soui
push 3
push 0
call dword [eax + 0x34]
jmp 0x10071e8d
mov ebx, 0x2800
push ebx
call fcn.100bdb32
mov dword [esp], 0x1e9
mov esi, eax
push str.d:workspace_soui_souiincludecore_swnd.h
push str.SOUI::SWindow::FindChildByID2
push edi
push str._s__s__s:_d_n
push 0xffffffffffffffff
push ebx
push esi
call fcn.1002efd9
add esp, 0x20
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push esi
call fcn.100bdb3d
pop ecx
push edi
call fcn.100bdb3d
pop ecx
pop edi
xor eax, eax
pop ebx
pop esi
pop ebp
ret 8
Function at 0x10082dab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x10082dd9
cmp eax, edi
jge 0x10082dcd
push esi
call fcn.1007f2e7
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x10082dfc
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x10082de2
mov dword [esi + 8], edx
jmp 0x10082e11
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x10082e07
xor dl, dl
jmp 0x10082e0c
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x10082dfc
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x10082e4a
mov dword [0x1018b970], str.zlib_corrupt
xor eax, eax
jmp 0x10082e8c
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x10082e5f
mov dword [0x1018b970], str.read_past_buffer
jmp 0x10082e46
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x10082e76
push edi
push esi
call fcn.10086f8d
pop ecx
pop ecx
test eax, eax
je 0x10082e46
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.100b10c0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x10091469
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10091808
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x10091825
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x10091829
jmp 0x10091831
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.10092291
push 0x1017d194
lea eax, [ebp - 0x10]
push eax
call fcn.100b55cf
int3

Function at 0x1009e1a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x101310c6
call fcn.1008de34
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], SysReAllocString
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
call fcn.100900dc
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
test dword [0x10183814], 0x80000000
je 0x1009e218
push dword [0x1018bee4]
call fcn.10091857
pop ecx
test eax, eax
jne 0x1009e21d
call fcn.10098b25
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x1009e238
cmp eax, 2
je 0x1009e238
lock inc dword [eax + 4]
mov ecx, edi
call fcn.1009f67f
lea ecx, [edi + 0x3c]
call fcn.10090b98
cmp byte [ebp + 0xc], 0
je 0x1009e279
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x1009e273
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
jne 0x1009e262
jmp 0x1009e281
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.10098e48
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x1009e299
mov ecx, esi
call fcn.1009c6ca
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.1008ddfd
ret 8

Function at 0x100a99eb
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1018bf50], eax
cmp eax, 0xffffffff
jne 0x100a9a0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x100a9a11
jmp 0x100a9a19
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.10092291
push 0x1017d194
lea eax, [ebp - 0x10]
push eax
call fcn.100b55cf
int3
Function at 0x100b5c06
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10148ed4
push 0x10148ecc
push str.FlsAlloc
push 0
call fcn.100b5aad
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100b5c38
push dword [ebp + 8]
mov ecx, esi
call fcn.1008e82d
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x100b5c7a
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10148ee4
push 0x10148edc
push str.FlsGetValue
push 2
call fcn.100b5aad
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x100b5cab
mov ecx, esi
call fcn.1008e82d
call esi
jmp 0x100b5cb1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x100b5cb4
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x10148eec
push 0x10148ee4
push str.FlsSetValue
push 3
call fcn.100b5aad
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x100b5ce8
mov ecx, esi
call fcn.1008e82d
call esi
jmp 0x100b5cee
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x100ee2c3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100edec8

Function at 0x100ee2ce
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ee049

Function at 0x100f709d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f6877

Function at 0x100f70a8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100f6ab2

Function at 0x10101020
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10100da7

Function at 0x10103a1c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
test esi, esi
je 0x10103a35
mov edx, dword [esi]
and edx, 7
inc edx
jmp 0x10103a37
xor edx, edx
lea eax, [edx - 1]
cmp eax, 4
ja 0x10103b67
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
cmp edx, 1
jbe 0x10103af8
push edi
lea ecx, [ebp + 0xc]
call fcn.10105f35
push eax
push ebx
call fcn.10103c10
add esp, 0xc
lea ecx, [ebp + 0xc]
push edi
call fcn.10109061
push eax
push ebx
call fcn.10103c10
add esp, 0xc
lea eax, [ebp - 0x14]
lea ecx, [ebp + 0xc]
push eax
call fcn.10104274
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
and dword [ebp - 8], 0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
call fcn.10102f50
test al, al
je 0x10103ae9
and dword [ebp - 8], 0
mov esi, dword [ebp - 0x14]
push edi
lea ecx, [ebp - 0x14]
call fcn.10105f22
push eax
push ebx
call fcn.10103c10
add esp, 0xc
lea ecx, [ebp - 0x14]
push edi
call fcn.1010904e
push eax
push ebx
call fcn.10103c10
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
mov esi, dword [esi + 0x14]
add esp, 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], esi
push eax
call fcn.10102f50
test al, al
jne 0x10103aa7
push edi
push 0
push ebx
call fcn.10103c10
mov esi, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x10103b01
mov esi, dword [esi + 0x10]
jmp 0x10103b03
xor esi, esi
mov dword [ebp - 4], esi
test esi, esi
je 0x10103b50
mov eax, esi
test eax, eax
je 0x10103b18
mov al, byte [esi]
and al, 7
inc al
jmp 0x10103b1a
xor al, al
push edi
push 1
mov byte [ebp + 0x13], al
lea eax, [ebp + 0x13]
push 1
push eax
call fcn.100e2513
mov ecx, dword [ebp - 0xc]
add esp, 0x10
push edi
push esi
push ebx
call fcn.10103a1c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
call fcn.10105fda
mov esi, dword [eax]
mov eax, esi
mov dword [ebp - 4], esi
test esi, esi
jne 0x10103b0c
push edi
push 1
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push 1
push eax
call fcn.100e2513
add esp, 0x10
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10103b6e
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x1013205d
call fcn.1008de68
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x50]
push 0xa
sub esp, 0xc
mov dword [esp + 8], 0x40100000
mov dword [esp + 4], 0x3e800000
mov dword [esp], 0x3f400000
push 0x11
call fcn.10102b8d
and dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push eax
push dword [edi]
mov ecx, edi
call fcn.1010374b
lea eax, [ebp - 0x50]
push eax
call fcn.101038ac
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
push esi
inc ebx
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x6c6d7873
push ebx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
call fcn.100e2513
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.10103c7f
add esp, 0x1c
lea eax, [ebp - 0x50]
mov ecx, edi
push esi
push dword [edi]
push eax
call fcn.10103a1c
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.101035e1
call fcn.1008de12
ret 4

Function at 0x10103c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0xff
jge 0x10103c27
xor esi, esi
inc esi
jmp 0x10103c37
cmp dword [edi + 4], 0xffff
push 4
pop esi
push 2
pop eax
cmovl esi, eax
push dword [ebp + 0xc]
and dword [ebp + 8], 0
lea ecx, [ebp - 4]
call fcn.100026c0
mov eax, dword [ebp - 4]
cmp dword [eax - 8], 0
je 0x10103c5f
push dword [ebp + 0xc]
mov ecx, edi
call fcn.10103411
mov eax, dword [eax + 4]
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push esi
push 1
push eax
call fcn.100e2513
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.10002740
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10103c7f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
call fcn.10103372
mov edi, eax
test edi, edi
je 0x10103cbc
push esi
mov ecx, dword [ebp + 0xc]
mov esi, edi
push edi
call fcn.10103246
push dword [esi]
mov edi, eax
call fcn.100cf83f
push dword [ebp + 8]
inc eax
push eax
push 2
push dword [esi]
call fcn.100e2513
add esp, 0x14
test edi, edi
jne 0x10103c92
pop esi
pop edi
pop ebp
ret
Function at 0x10105e03
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jne 0x10105e26
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x10105ec3
push esi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push ebx
call fcn.10105310
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10105e49
push ebx
call fcn.100ddaa2
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x10105e9f
mov esi, dword [ebp + 0x10]
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [0x10184210]
mov dword [ebp - 4], eax
pop ecx
push ebx
test eax, eax
jne 0x10105e74
call fcn.100ddaa2
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x10105e9f
push esi
push 1
push eax
call fcn.100ddd86
push ebx
mov esi, eax
call fcn.100ddaa2
add esp, 0x14
cmp esi, dword [ebp + 0x10]
je 0x10105ea8
push dword [ebp - 4]
call dword [0x10184214]
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
jmp 0x10105ec2
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.10105d6d
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1010a74e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.1011a312
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x1010a77b
xor eax, eax
jmp 0x1010a877
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x100b57dd
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.1010c1dd
push esi
push eax
call fcn.100b57f0
add esp, 0x14
test eax, eax
je 0x1010a7b6
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.1011a4d1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.1010c1bf
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.1010e119
add esp, 0x28
test eax, eax
jne 0x1010a7ed
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x1010a82e
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.1011a4a2
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x1010a829
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x1010a85e
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.1011a3e3
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.1011a39b
add esp, 0x14
jmp 0x1010a774
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.1011a261
push dword [ebp - 4]
call fcn.1010ab71
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1010ddb9
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x1010ddef
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x1010dde2
push eax
call fcn.1011a387
push 2
call fcn.1011a2fe
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.100b1640
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x1010fb2d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.1011a312
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x1010fb5a
xor eax, eax
jmp 0x1010fcfe
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x100b57dd
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.1010c1dd
push esi
push eax
call fcn.100b57f0
add esp, 0x14
test eax, eax
je 0x1010fba7
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.1011a4d1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.1010c1bf
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.1010e119
add esp, 0x28
test eax, eax
jne 0x1010fbde
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x1010fc1a
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.1011a4a2
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x1010fc1a
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x1010e328
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.1010e377
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x1010fc9a
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.101231d6
add esp, 0xc
cmp eax, 0xfffffffa
je 0x1010fc83
cmp eax, 0xfffffffc
je 0x1010fc7c
cmp eax, 0xfffffffe
je 0x1010fc75
test eax, eax
je 0x1010fc95
push str.Unknown_zlib_error
jmp 0x1010fc88
push str.zlib_stream_error
jmp 0x1010fc88
push str.zlib_memory_error
jmp 0x1010fc88
push str.zlib_version_error
push dword [ebp - 4]
call fcn.1010c1f9
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x1010fcca
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.1011a3e3
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.1011a39b
add esp, 0x14
jmp 0x1010fb53
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.10115e5e
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1012365d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1012366a
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.10123763

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130