joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403dcd
Capabilities:
Create thread
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, 0x407ff0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebp - 0x220]
push 0x208
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
lea eax, [ebp - 0x220]
push esi
push eax
call fcn.00402ad6
mov edi, 0x407ccf
push 0x408204
push edi
call sub.MSVCRT.dll_strcmp
add esp, 0x14
test eax, eax
jne 0x403e2c
push 0x407bd0
push edi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [0x407de0]
call fcn.004026af
pop ecx
mov dword [0x407bc8], eax
mov dword [ebp - 0xc], 1
xor esi, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
jmp 0x403e53
mov edi, 0x407ccf
mov eax, dword [0x407ddc]
cmp esi, ebx
mov dword [ebp - 4], eax
jne 0x403eff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00403d81
push 0x514
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0xc
cmp eax, ebx
je 0x403e8c
mov ecx, eax
call fcn.00403d38
mov esi, eax
jmp 0x403e8e
xor esi, esi
or dword [esi + 0x108], 0xffffffff
mov dword [esi], ebx
mov eax, dword [ebp - 8]
sub eax, ebx
je 0x403ee4
dec eax
je 0x403ecd
dec eax
je 0x403eb6
dec eax
je 0x403eb3
dec eax
je 0x403eb0
dec eax
jne 0x403eff
push edi
jmp 0x403ebb
push edi
jmp 0x403ed2
push edi
jmp 0x403ee9
push 0x407bd0
lea eax, [esi + 4]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [0x407dd8]
pop ecx
pop ecx
jmp 0x403ef9
push 0x407bd0
lea eax, [esi + 4]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [0x407dd4]
pop ecx
pop ecx
jmp 0x403ef9
push 0x407bd0
lea eax, [esi + 4]
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [0x407dd0]
pop ecx
pop ecx
mov dword [esi + 0x104], eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push 0x4037cb
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x10c]
cmp eax, ebx
je 0x403fa6
sub eax, 0x3ec
je 0x403fc6
dec eax
je 0x403f92
dec eax
je 0x403f5f
dec eax
jne 0x403fa6
push esi
call fcn.00405a0a
xor esi, esi
mov dword [ebp - 0xc], ebx
mov dword [esp], 0x407ff0
call fcn.00403256
pop ecx
mov dword [ebp - 4], ebx
jmp 0x403fa8
cmp dword [esi + 0x510], 0x104
mov dword [ebp - 4], 5
jne 0x403fa8
lea edi, [esi + 0x110]
lea eax, [esi + 4]
push edi
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [edi + 0x100]
pop ecx
pop ecx
mov dword [esi + 0x104], eax
jmp 0x403fa8
push esi
mov dword [ebp - 4], 5
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
call fcn.00405a0a
pop ecx
xor esi, esi
mov eax, dword [ebp - 4]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0xc], ebx
jne 0x403e4e
pop edi
pop esi
pop ebx
leave
ret
cmp dword [esi + 0x510], 4
jne 0x403fa8
lea eax, [esi + 0x110]
push 4
push eax
lea eax, [ebp - 0x14]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp eax, ebx
jne 0x403ff4
mov dword [ebp - 4], 5
jmp 0x403fa8
imul eax, eax, 0x3c
mov dword [ebp - 4], eax
jmp 0x403fa8
Function at 0x403ffc
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x408200]
push eax
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push str._s_x_d
push eax
call sub.MSVCRT.dll_swprintf
add esp, 0x14
lea eax, [ebp - 0x410]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
leave
ret

Function at 0x40404a
Capabilities:
Check if file exists
Delete directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
cmp dword [0x408200], 0
je 0x4040b3
lea eax, [ebp - 0x410]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [0x408200]
push eax
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x208]
push str._s_x_d
push eax
call sub.MSVCRT.dll_swprintf
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4040b3
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x404551
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x408200], eax
call fcn.00403ffc
mov eax, dword [0x408200]
and eax, 0x3ff
push eax
call fcn.004032a6
mov dword [esp], 0x407bd0
call fcn.004032c0
test eax, eax
pop ecx
je 0x40458f
call fcn.0040404a
test eax, eax
jne 0x404596
xor eax, eax
jmp 0x404623
push ebx
xor ebx, ebx
cmp dword [0x407de4], ebx
push esi
je 0x4045c1
mov esi, 0x407de8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4045c1
push 5
push ebx
push ebx
push esi
push ebx
push ebx
call fcn.00402e69
add esp, 0x18
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 2]
push eax
mov byte [ebp - 2], 0x72
lea eax, [esi + 1]
mov byte [ebp - 1], bl
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x404604
cmp byte [esi], 0x2f
jne 0x4045ee
push 0x407ff0
call fcn.00403256
pop ecx
cmp byte [esi], 0x5c
jne 0x4045f8
call fcn.00403dcd
cmp byte [esi], 0x2d
jne 0x40461f
call fcn.004040b7
jmp 0x40461f
push dword [0x4081f8]
push 0x407ff0
call fcn.00402fcb
pop ecx
test eax, eax
pop ecx
jne 0x40461f
call fcn.00403dcd
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x404e6a
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Create process suspended
Create two anonymous pipes
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
push esi
mov esi, ecx
push edi
lea edx, [ebp - 0x28]
lea eax, [esi + 8]
push 0x6400
lea ecx, [esi + 4]
push edx
xor edi, edi
push eax
push ecx
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ecx
call ebx
lea edx, [ebp - 0x28]
lea ecx, [esi + 0x18]
push 0x6400
lea eax, [esi + 0x10]
push edx
push ecx
push eax
call ebx
push 0x44
lea eax, [ebp - 0x7c]
pop ebx
push ebx
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp - 4]
push 0x208
push edi
mov dword [ebp - 0x7c], ebx
mov eax, dword [eax]
mov dword [ebp - 0x50], 0x101
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x284]
mov word [ebp - 0x4c], di
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x284]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], 0x5c
push eax
lea eax, [ebp - 0x284]
push eax
mov word [ebp - 0x16], 0x63
mov word [ebp - 0x14], 0x6d
mov word [ebp - 0x12], 0x64
mov word [ebp - 0x10], 0x2e
mov word [ebp - 0xe], 0x65
mov word [ebp - 0xc], 0x78
mov word [ebp - 0xa], 0x65
mov word [ebp - 8], di
call sub.MSVCRT.dll_wcscat
pop ecx
lea eax, [ebp - 0x38]
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push edi
lea eax, [ebp - 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404fef
mov eax, dword [ebp - 0x30]
push dword [ebp - 0x38]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c], eax
call ebx
push dword [ebp - 0x34]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push edi
lea eax, [esi + 0x14]
push edi
push eax
call ebx
push eax
push dword [esi + 0x10]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x404fef
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], edi
push 2
push edi
add esi, 0xc
push edi
push esi
call ebx
mov esi, dword [ebp - 0x1c]
push eax
push dword [esi]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x404fef
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov dword [esi], edi
push dword [eax]
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404ff4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
cmp dword [eax + 4], ebx
mov edi, ecx
je 0x405064
lea ecx, [ebp - 0xc]
push esi
add eax, 8
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0xc], ebx
call fcn.00405253
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call sub.MSVCRT.dll_strlen
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
push dword [ebp - 4]
push dword [edi + 0xc]
call esi
test eax, eax
je 0x40505a
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp + 0xa]
push 2
push eax
push dword [edi + 0xc]
mov byte [ebp + 0xa], 0xd
mov byte [ebp + 0xb], 0xa
call esi
push dword [ebp - 4]
call fcn.00405a0a
pop ecx
pop esi
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
call fcn.00405077
pop edi
pop ebx
leave
ret 0xc

Function at 0x405077
Capabilities:
Check for time delay via gettickcount
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13818
call fcn.00405ab0
push ebx
push esi
push edi
xor ebx, ebx
push 0xd000
lea eax, [ebp - 0x13810]
push ebx
mov dword [ebp - 8], ecx
push eax
mov dword [ebp - 0x13818], 1
mov dword [ebp - 0x13814], ebx
call sub.MSVCRT.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
add esp, 0xc
mov byte [ebp - 2], bl
mov byte [ebp - 1], bl
call edi
mov esi, 0x6800
mov dword [ebp - 0x10], eax
push esi
lea eax, [ebp - 0x6810]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push ebx
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x6810]
push esi
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x14]
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp dword [ebp - 0xc], 0x6400
ja 0x405111
call edi
sub eax, dword [ebp - 0x10]
cmp eax, 0xc8
ja 0x405117
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4050d8
mov byte [ebp - 1], 1
jmp 0x40511b
mov byte [ebp - 2], 1
cmp dword [ebp - 0xc], ebx
jbe 0x4051d1
push esi
lea eax, [ebp - 0x6810]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
push ebx
push eax
push esi
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x6810]
push eax
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4051d1
cmp dword [ebp - 0xc], ebx
jbe 0x4051d1
lea eax, [ebp - 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x6810]
push eax
mov dword [ebp - 8], ebx
call fcn.004051ff
mov edi, eax
lea eax, [ebp - 0x13810]
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [ebp - 8]
cmp byte [ebp - 1], bl
pop ecx
mov dword [ebp - 0x13814], eax
pop ecx
je 0x405193
mov dword [ebp - 0x13818], ebx
jmp 0x4051a2
cmp byte [ebp - 2], bl
je 0x4051a2
mov dword [ebp - 0x13818], 1
mov esi, dword [ebp + 0xc]
mov eax, 0xd008
push eax
mov dword [esi], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push dword [esi]
lea ecx, [ebp - 0x13818]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
push edi
call fcn.00405a0a
add esp, 0x14
jmp 0x4051d6
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4051dd
Capabilities:
Terminate process

Disassembly:
push esi
push dword [ecx + 0x1c]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x405306
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0
call sub.MSVCRT.dll_time
pop ecx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp - 4]
mov edi, eax
call sub.MSVCRT.dll_srand
call sub.MSVCRT.dll_rand
mov esi, 0xffff
cdq
mov ecx, esi
idiv ecx
mov ebx, edx
lea eax, [ebx + edi]
push eax
call sub.MSVCRT.dll_srand
call sub.MSVCRT.dll_rand
cdq
idiv esi
and byte [ebp - 0xc], 0
lea eax, [ebp - 0x1c]
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x30
mov byte [ebp - 0x1a], 0x34
mov byte [ebp - 0x19], 0x58
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x30
mov byte [ebp - 0x16], 0x38
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x30
mov byte [ebp - 0x12], 0x38
mov byte [ebp - 0x11], 0x58
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x30
mov byte [ebp - 0xe], 0x34
mov byte [ebp - 0xd], 0x58
push edx
push edi
push dword [ebp - 4]
mov dword [ebp - 8], edx
push ebx
push eax
lea eax, [ebp - 0x38]
push eax
call sub.MSVCRT.dll_sprintf
lea eax, [ebp - 0x38]
add esp, 0x20
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, ecx
push 4
cdq
pop esi
idiv esi
cmp edx, 3
jne 0x4053f0
movsx eax, byte [ecx + 0x408205]
movsx edx, byte [ecx + 0x408206]
add eax, edx
push 0x10
movsx edx, byte [ecx + 0x408207]
add eax, edx
pop esi
cdq
idiv esi
cmp edx, 9
lea eax, [edx + 0x37]
jg 0x4053e8
lea eax, [edx + 0x30]
mov byte [ecx + 0x408208], al
jmp 0x4053fe
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
mov al, byte [eax]
mov byte [ecx + 0x408208], al
inc ecx
cmp ecx, 0x20
jl 0x4053b1
mov eax, edi
and eax, 3
dec eax
je 0x4054a9
dec eax
je 0x40545c
dec eax
mov byte [0x408228], 0x2e
je 0x40543e
mov byte [0x408229], 0x68
mov byte [0x40822a], 0x74
mov byte [0x40822b], 0x6d
mov byte [0x40822c], 0x6c
jmp 0x4054cc
mov byte [0x408229], 0x73
mov byte [0x40822a], 0x68
mov byte [0x40822b], 0x74
mov byte [0x40822c], 0x6d
jmp 0x4054cc
push 0xa
mov eax, ebx
xor edx, edx
pop ecx
div ecx
mov eax, dword [ebp - 8]
push 0x1a
mov byte [0x408228], 0x2e
add dl, 0x30
mov byte [0x408229], dl
xor edx, edx
div ecx
mov eax, edi
add dl, 0x30
mov byte [0x40822a], dl
xor edx, edx
div ecx
mov eax, dword [ebp - 8]
pop ecx
add dl, 0x30
mov byte [0x40822b], dl
xor edx, edx
div ecx
add dl, 0x41
mov byte [0x40822c], dl
jmp 0x4054cc
mov byte [0x408228], 0x2e
mov byte [0x408229], 0x61
mov byte [0x40822a], 0x73
mov byte [0x40822b], 0x70
mov byte [0x40822c], 0x78
and byte [0x40822d], 0
pop edi
pop esi
mov eax, 0x408208
pop ebx
leave
ret
Function at 0x40558c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, 0x405d28
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push ebx
push 0x4680000
push ebx
mov esi, ecx
push ebx
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], ebx
mov byte [ebp - 0x20], 0x50
mov byte [ebp - 0x1f], 0x4f
mov byte [ebp - 0x1e], 0x53
mov byte [ebp - 0x1d], 0x54
mov byte [ebp - 0x1c], bl
call fcn.00405306
push eax
lea eax, [ebp - 0x20]
push eax
push dword [esi + 8]
call dword [esi + 0x120]
lea ecx, [ebp - 0x14]
push 4
push ecx
push 2
push eax
mov dword [esi + 0xc], eax
mov dword [ebp - 0x14], 0x1d4c0
call dword [esi + 0x138]
cmp eax, ebx
je 0x40561f
lea eax, [ebp - 0x14]
push 4
push eax
push 5
push dword [esi + 0xc]
call dword [esi + 0x138]
cmp eax, ebx
je 0x40561f
lea eax, [ebp - 0x14]
push 4
push eax
push 6
push dword [esi + 0xc]
call dword [esi + 0x138]
cmp eax, ebx
jne 0x405637
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x4056af
push dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x38]
mov byte [ebp - 0x38], 0x43
push dword [ebp + 8]
mov byte [ebp - 0x37], 0x61
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x68
push 0xffffffffffffffff
push eax
push dword [esi + 0xc]
mov byte [ebp - 0x34], 0x65
mov byte [ebp - 0x33], 0x2d
mov byte [ebp - 0x32], 0x43
mov byte [ebp - 0x31], 0x6f
mov byte [ebp - 0x30], 0x6e
mov byte [ebp - 0x2f], 0x74
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x6c
mov byte [ebp - 0x2b], 0x3a
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x2d
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x63
mov byte [ebp - 0x23], 0x68
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], bl
call dword [esi + 0x124]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x405942
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov eax, dword [esi]
push eax
mov dword [ebp + 0x14], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
lea eax, [ebp + 0x14]
mov dword [esp], 0x408230
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004047c8
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x14]
add esp, 0x14
xor edi, edi
test eax, eax
mov dword [esi], eax
jbe 0x405995
mov eax, dword [ebp + 0x10]
mov ecx, ebx
sub ecx, eax
mov dl, byte [ecx + eax]
xor dl, 0x42
inc edi
mov byte [eax], dl
inc eax
cmp edi, dword [esi]
jb 0x405987
push ebx
call fcn.00405a0a
mov eax, dword [ebp + 0xc]
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4059a6
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
test edi, edi
pop ecx
mov esi, eax
jbe 0x4059d1
mov eax, dword [esp + 0xc]
push ebx
mov ecx, esi
sub eax, esi
mov edx, edi
mov bl, byte [eax + ecx]
xor bl, 0x42
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4059c4
pop ebx
push 0x408230
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push edi
push esi
call fcn.00404b97
push esi
mov edi, eax
call fcn.00405a0a
add esp, 0x18
mov eax, edi
pop edi
pop esi
ret 0x10
Function at 0x4cb9d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cba16
call fcn.004d174d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4cba16
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4cba0d
xor eax, eax
jmp 0x4cba1e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cba24
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d1c7d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d1cab
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4d1cc9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d1be3
jmp 0x4d1cc9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d1cc9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d1be3
test edi, edi
mov eax, edi
jne 0x4d1cb3
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x1004aed6
Capabilities:
Encode data using xor

Disassembly:
pushal
push 0x1c503130
test sp, bp
cmp byte [edi - 1], 0
lea esp, [esp + 0x24]
jl 0x10073fc8
jne 0x10076b62
shld di, ax, 7
cmp dx, bp
sar di, cl
mov edi, dword [edx + 0x24]
cmc
add edi, eax
push ebp
movzx ecx, word [edi + ecx*2]
jmp fcn.1004e588
lea esp, [esp + 0x40]
ja 0x1004c6a4
pushal
lea esp, [esp + 0x20]
jle 0x10065225
pushfd
mov dword [esp], 0xf96da2d5
lea esp, [esp + 4]
jb 0x10046f11
ja 0x1004acb0
bt ax, dx
pushal
mov byte [esp], cl
cmp byte [edi - 1], 0
call fcn.10073e0d
push 0xffffffffffffffc0
outsb dx, byte [esi]
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
inc edi
stosd dword es:[edi], eax
mov dword [0xb3abdfab], eax
stosd dword es:[edi], eax
mov ebx, 0x8fabefab
stosd dword es:[edi], eax
dec edi
stosd dword es:[edi], eax
imul dword [ebx + 0x64c3abc7]
jne 0x1004af5d
outsd dx, dword [esi]
mov bl, byte [edx + 0x5b]
dec edi
inc ebx
or edx, dword [bp + si]
dec esi
retf
push ebx
je 0x1004af91
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
inc ebx
outsd dx, dword [esi]
jne 0x1004afc0
je fcn.1004af54
push esi
js 0x1004afc0
Function at 0x1009d550
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1009d73c
pushal
mov esi, section.UPX1
lea edi, [esi - 0x65000]
mov dword [edi + 0x8daf8], 0x7e01f67f
push edi
or ebp, 0xffffffff
jmp 0x1009d582
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1009d589
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1009d578
mov eax, 1
add ebx, ebx
jne 0x1009d59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1009d5ac
jne 0x1009d5cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1009d5cb
dec eax
add ebx, ebx
jne 0x1009d5b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1009d590
add ebx, ebx
jne 0x1009d5c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1009d61d
xor ecx, ecx
sub eax, 3
jb 0x1009d5e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1009d652
sar eax, 1
mov ebp, eax
jmp 0x1009d5ee
add ebx, ebx
jne 0x1009d5ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1009d5bc
inc ecx
add ebx, ebx
jne 0x1009d5fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1009d5bc
add ebx, ebx
jne 0x1009d609
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1009d5fe
jne 0x1009d61a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1009d5fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1009d63c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1009d62e
jmp 0x1009d57e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1009d63c
add edi, ecx
jmp 0x1009d57e
pop esi
mov edi, esi
mov ecx, 0x261f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1009d65a
cmp byte [edi], 0x11
jne 0x1009d65a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1009d65f
lea edi, [esi + 0x98000]
mov eax, dword [edi]
or eax, eax
je 0x1009d6ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9d0f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9d168]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1009d68c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9d16c]
or eax, eax
je 0x1009d6c8
mov dword [ebx], eax
add ebx, 4
jmp 0x1009d6a9
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1009d6ff
cmp al, 0xef
ja 0x1009d6f2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1009d6d4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1009d6e1
mov ebp, dword [esi + 0x9d170]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1009d733
sub esp, 0xffffff80
jmp 0x100587a8