joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a890
Capabilities:
Encode data using xor

Disassembly:
cmp byte [esi + 6], 0
jne 0x1005a8d7
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edx, eax
shr edx, 5
inc edx
xor ecx, eax
cmp eax, edx
jb 0x1005a8cd
push ebx
push edi
lea ebx, [ebx]
movzx edi, byte [esi + eax + 0xf]
mov ebx, ecx
shl ebx, 5
add edi, ebx
mov ebx, ecx
shr ebx, 2
add edi, ebx
sub eax, edx
xor ecx, edi
cmp eax, edx
jae 0x1005a8b0
pop edi
pop ebx
mov dword [esi + 8], ecx
mov byte [esi + 6], 1
mov eax, ecx
ret
mov eax, dword [esi + 8]
ret

Function at 0x1005aa90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [eax + 0x10]
push ebp
mov ebp, dword [ebx + 0x38]
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, edi
shr eax, 5
inc eax
xor ebp, edi
mov dword [esp + 0x10], ebx
mov ecx, edi
cmp edi, eax
jb 0x1005aadf
jmp 0x1005aac0
mov edx, dword [esp + 0x20]
movzx edx, byte [edx + ecx - 1]
mov esi, ebp
shl esi, 5
add edx, esi
mov esi, ebp
shr esi, 2
add edx, esi
sub ecx, eax
xor ebp, edx
cmp ecx, eax
jae 0x1005aac0
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x18]
dec eax
and eax, ebp
lea eax, [ecx + eax*4]
mov dword [esp + 0x14], eax
mov eax, dword [eax]
test eax, eax
je 0x1005ab67
movzx edx, byte [eax + 7]
cmp edi, edx
jne 0x1005ab60
mov esi, dword [esp + 0x20]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x1005ab28
jmp 0x1005ab10
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x1005ab5c
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x1005ab10
mov ebx, dword [esp + 0x10]
test ecx, ecx
je 0x1005abec
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x1005ab5c
cmp ecx, 1
jbe 0x1005abe8
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x1005ab5c
cmp ecx, 2
jbe 0x1005abe8
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x1005abe8
mov ebx, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x1005aaf5
mov eax, dword [ebx + 0x20]
cmp dword [ebx + 0x1c], eax
jl 0x1005ab96
cmp eax, 0x3fffffff
jg 0x1005ab96
mov ecx, dword [esp + 0x1c]
add eax, eax
push eax
push ecx
call fcn.1005a8e0
mov edx, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
dec edx
add esp, 8
and edx, ebp
lea ecx, [eax + edx*4]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x1c]
push 4
lea ebx, [edi + 0x11]
push edx
call fcn.1005d150
mov ebx, dword [esp + 0x2c]
mov esi, eax
xor al, al
mov byte [esi + 6], al
mov dword [esi + 8], ebp
mov byte [esi + ebx + 0x10], al
mov eax, dword [esp + 0x28]
push ebx
push eax
lea ecx, [esi + 0x10]
push ecx
call sub.MSVCR90.dll_memcpy
mov eax, dword [esp + 0x28]
mov byte [esi + 7], bl
mov edx, dword [eax]
mov dword [esi + 0xc], edx
mov dword [eax], esi
mov eax, dword [esp + 0x24]
add esp, 0x14
inc dword [eax + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x10]
mov cl, byte [eax + 5]
mov dl, byte [ebx + 0x3c]
xor cl, 3
xor dl, 3
test cl, dl
jne 0x1005abe0
pop edi
pop esi
pop ebp
mov byte [eax + 5], cl
pop ebx
add esp, 8
ret
Function at 0x1005d1d0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 4]
and byte [esi + 5], 0xfc
mov ebx, 4
sub eax, ebx
push edi
cmp eax, 0x22
ja case.0x1005d207.6
mov edi, dword [ebp + 8]
lea ebx, [ebx]
movzx eax, byte [eax + 0x1005d30c]
jmp dword [eax*4 + 0x1005d2e8]
mov eax, dword [esi + 8]
test eax, eax
je 0x1005d225
test byte [eax + 5], 3
je 0x1005d225
push eax
push edi
call fcn.1005d1d0
add esp, 8
mov ecx, dword [esi + 0xc]
or byte [esi + 5], bl
add ecx, 0x18
add dword [edi + 0x10], ecx
movzx ecx, byte [esi + 6]
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
mov dword [esp + 0x14], edx
test cl, 0x40
je case.0x1005d207.6
mov cl, byte [eax + 5]
test cl, 3
je case.0x1005d207.6
and cl, 0xfc
mov esi, eax
mov byte [eax + 5], cl
movzx eax, byte [eax + 4]
sub eax, ebx
cmp eax, 0x22
jbe 0x1005d200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 7]
or byte [esi + 5], bl
add eax, 0x11
add dword [edi + 0x10], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0xc]
or byte [esi + 5], bl
add ecx, 0x11
add dword [edi + 0x10], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x4c]
mov dword [esi + 8], edx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x4c]
mov dword [esi + 8], eax
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x4c]
mov dword [esi + 0x1c], ecx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x4c]
mov dword [esi + 0x28], edx
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
mov dword [edi + 0x4c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006c9d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push esi
mov ebx, eax
push str._5_3
push ebx
push str._s_s
mov esi, edi
call fcn.100513d0
add esp, 0xc
push eax
call dword [sym.imp.MSVCR90.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1006ca13
push ebx
call dword [sym.imp.MSVCR90.dll_getenv]
mov esi, eax
add esp, 4
test esi, esi
je 0x1006caa2
mov eax, dword [edi + 0x10]
add eax, 0x28
push eax
push edi
mov eax, str.LUA_NOENV
call fcn.100514b0
mov eax, dword [edi + 0xc]
mov ecx, dword [eax - 8]
add eax, 0xfffffff0
add esp, 8
test ecx, ecx
je 0x1006ca46
cmp ecx, 1
jne 0x1006ca3f
cmp dword [eax], 0
je 0x1006ca46
mov ecx, 1
jmp 0x1006ca48
xor ecx, ecx
mov dword [edi + 0xc], eax
test ecx, ecx
jne 0x1006caa2
push 0x100889d0
push 0x100889d4
mov edx, esi
mov ecx, edi
call fcn.10054420
mov ecx, dword [ebp + 0xc]
push ecx
push 0x100889d8
mov edx, eax
mov ecx, edi
call fcn.10054420
mov eax, dword [edi + 0xc]
lea esi, [eax - 0x20]
lea ebx, [eax - 0x10]
add esp, 0x10
mov ecx, esi
mov eax, esi
call fcn.100509e0
lea eax, [esi + 0x10]
mov ecx, ebx
call fcn.100509e0
mov ecx, ebx
mov eax, esi
call fcn.100509e0
add dword [edi + 0xc], 0xfffffff0
jmp 0x1006cadf
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x1006cab1
mov edx, dword [edi + 0xc]
mov dword [edx + 8], esi
jmp 0x1006cac9
push edi
call fcn.1005ac90
mov ecx, dword [edi + 0xc]
mov dword [ecx], eax
movzx eax, byte [eax + 4]
add esp, 4
or eax, 0x40
mov dword [ecx + 8], eax
mov ecx, dword [edi + 0x10]
add dword [edi + 0xc], 0x10
cmp dword [ecx + 0xc], 0
jle 0x1006cadf
push edi
call fcn.1005e6f0
add esp, 4
mov esi, edi
call fcn.1006c820
mov eax, dword [edi + 0xc]
sub eax, 0x30
push eax
mov eax, dword [ebp + 8]
push edi
call fcn.10051970
add esp, 8
add dword [edi + 0xc], 0xfffffff0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10076c10
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
lea eax, [esp + 0xc]
push eax
push ecx
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_vfprintf]
add esp, 0xc
push 0x10085644
call esi
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 8
push 0xffffffffffffffff
call dword [sym.imp.MSVCR90.dll_exit]
pop esi
int3
Function at 0x1007a3c0
Capabilities:
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x1007a3c7
xor eax, eax
ret
mov eax, dword [esp + 4]
jmp fcn.1007a3d0
Function at 0x1007b2de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x1007b2e8
repz ret
jmp fcn.1007b6cc
Function at 0xf5f280
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x481000]
push edi
jmp 0xf5f29a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xf5f2a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf5f290
mov eax, 1
add ebx, ebx
jne 0xf5f2b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xf5f2c4
jne 0xf5f2e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf5f2e3
dec eax
add ebx, ebx
jne 0xf5f2d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xf5f2a8
add ebx, ebx
jne 0xf5f2df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xf5f335
xor ecx, ecx
sub eax, 3
jb 0xf5f2fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xf5f36a
sar eax, 1
mov ebp, eax
jmp 0xf5f306
add ebx, ebx
jne 0xf5f306
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf5f2d4
inc ecx
add ebx, ebx
jne 0xf5f314
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xf5f2d4
add ebx, ebx
jne 0xf5f321
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xf5f316
jne 0xf5f332
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xf5f316
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xf5f354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xf5f346
jmp 0xf5f296
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xf5f354
add edi, ecx
jmp 0xf5f296
pop esi
mov edi, esi
mov ecx, 0x98e3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xf5f372
cmp byte [edi], 0x1e
jne 0xf5f372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xf5f377
lea edi, [esi + 0xb5c000]
mov eax, dword [edi]
or eax, eax
je 0xf5f3ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb61334]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb61474]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xf5f3a4
mov ecx, edi
jns 0xf5f3d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb61478]
or eax, eax
je 0xf5f3e9
mov dword [ebx], eax
add ebx, 4
jmp 0xf5f3c1
call dword [esi + 0xb61488]
mov ebp, dword [esi + 0xb6147c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xf5f423
sub esp, 0xffffff80
jmp 0x532594
Function at 0x1001679
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov esi, ecx
cmp dword [esi + 4], ebx
push edi
mov dword [ebp - 4], ebx
jne 0x1001723
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1001723
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push ebx
lea ecx, [ebp - 0xc]
push ecx
push ebx
push eax
push dword [esi + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1001723
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
mov dword [ebp - 4], eax
jne 0x1001723
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push ebx
mov dword [ebp - 4], ebx
call edi
cmp eax, ebx
mov dword [esi + 4], eax
je 0x10016f5
mov eax, dword [ebp - 8]
add eax, eax
push eax
push ebx
call edi
cmp eax, ebx
mov dword [esi + 0x10], eax
jne 0x10016fa
push 8
pop eax
jmp 0x100172e
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 8]
push ecx
push eax
lea eax, [ebp - 0xc]
push eax
push dword [esi + 4]
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1001723
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10017b5
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp dword [esi + 4], 0x40
jb 0x10017cc
push 0x6f
pop eax
jmp 0x100188d
push edi
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
xor edi, edi
cmp eax, edi
pop ecx
je 0x10017ea
push dword [ebp + 0x10]
mov ecx, eax
push dword [ebp + 0xc]
call fcn.010014a5
jmp 0x10017ec
xor eax, eax
cmp eax, edi
mov ecx, dword [esi + 4]
mov dword [esi + ecx*8 + 8], eax
jne 0x10017ff
push 8
pop eax
jmp 0x100188c
cmp dword [ebp + 0x14], edi
mov eax, dword [ebp + 8]
jne 0x1001819
cmp eax, 1
jne 0x1001819
mov eax, dword [esi + 4]
mov dword [esi + eax*8 + 0xc], 4
jmp 0x1001820
mov ecx, dword [esi + 4]
mov dword [esi + ecx*8 + 0xc], eax
mov eax, dword [esi + 4]
mov ecx, dword [esi + eax*8 + 8]
push ebx
push dword [ebp + 0x14]
call fcn.010014d3
mov ebx, eax
cmp ebx, edi
jne 0x1001889
mov eax, dword [esi + 4]
mov ecx, dword [esi + eax*8 + 8]
lea eax, [ebp - 4]
push eax
call fcn.01001679
mov ebx, eax
cmp ebx, edi
jne 0x1001889
cmp dword [esi + 4], edi
mov dword [ebp + 0x14], edi
jbe 0x1001886
lea edi, [esi + 8]
mov ecx, dword [edi]
lea eax, [ebp + 0x10]
push eax
call fcn.01001679
mov ebx, eax
test ebx, ebx
jne 0x1001878
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1001892
inc dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
add edi, 8
cmp eax, dword [esi + 4]
jb 0x1001857
inc dword [esi + 4]
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 0x10
mov eax, 0xa0
jmp 0x100188b
Function at 0x1002111
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
or edi, 0xffffffff
test eax, eax
je 0x1002183
jmp 0x1002156
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1002161
mov ecx, dword [esi + 0x10]
add ecx, 8
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x1002161
mov eax, dword [esi + 0x10]
inc dword [esi + 0x18]
movzx ecx, word [eax + 2]
push ecx
push eax
call fcn.010027f9
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0xc]
movzx eax, word [eax + 4]
cmp dword [esi + 0x18], eax
jb 0x1002126
jmp 0x1002183
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edi, dword [esi + 0x18]
lea eax, [edi + 1]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
movzx ecx, word [eax + 2]
push ecx
push eax
call fcn.010027f9
mov dword [esi + 0x10], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x1002f08
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x10050f4]
push 0x104
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x1002f9c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [ebp + eax*2 - 0x210]
xor ecx, ecx
cmp word [eax - 2], 0x5c
je 0x1002f56
mov word [eax], cx
push ecx
push ecx
lea eax, [ebp - 0x214]
push eax
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x214], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1002f9c
test byte [ebp - 0x214], 8
jne 0x1002f9c
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x1f58
push eax
call fcn.01002e28
pop ecx
pop ecx
xor eax, eax
jmp 0x1002f9f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.010039ad
leave
ret 4
Function at 0x100386a
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10050f4]
push esi
push edi
push 0x10013fc
push 0
mov dword [ebp - 4], eax
call dword [sym.imp.msvcrt.dll_setlocale]
pop ecx
pop ecx
push 0
call sub.KERNEL32.dll_SetThreadUILanguage
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 8]
call fcn.01002acf
mov edi, eax
test edi, edi
jne 0x1003928
push dword [esi + 4]
call fcn.01002f08
test eax, eax
jne 0x10038c4
push 1
jmp 0x100392e
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10038f0
jle 0x10038e9
cmp eax, 2
jg 0x10038e9
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
push esi
push dword [ebp - 8]
push eax
push dword [esi + 4]
call fcn.01002fb0
jmp 0x10038fb
call fcn.01002eea
jmp 0x10038c0
push dword [ebp - 8]
push dword [esi + 4]
call fcn.010036a2
mov edi, eax
test edi, edi
je 0x100392d
cmp edi, 0xa0
mov esi, 0x1f57
jne 0x1003910
mov edi, esi
mov eax, dword [sym.imp.msvcrt.dll__iob]
push 0
add eax, 0x40
push edi
push eax
call fcn.01002e28
add esp, 0xc
cmp edi, esi
jne 0x100392d
call fcn.01002eea
push edi
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x1003ac5
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x1001408
call fcn.01003cd8
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1003b00
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003b00
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1003b18
cmp eax, 0x20b
je 0x1003b05
mov dword [ebp - 0x1c], edi
jmp 0x1003b2c
cmp dword [ecx + 0x84], 0xe
jbe 0x1003b00
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1003b26
cmp dword [ecx + 0x74], 0xe
jbe 0x1003b00
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1005114], 0xffffffff
or dword [0x1005118], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1005110]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100510c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100511c], eax
call fcn.01003cd0
cmp dword [0x1005100], edi
jne 0x1003b87
push fcn.01003cd0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01003cb9
push 0x1005010
push 0x100500c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1005108]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1005104]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1005008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.0100386a
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1003bfe
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1003c33
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003d13
ret
Function at 0x40a4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x412250], 0
push esi
push edi
jne 0x40a436
call fcn.0040a3a2
test eax, eax
je 0x40a47b
mov eax, dword [0x412250]
cmp eax, 1
jne 0x40a457
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40a47b
jmp 0x40a4bd
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x40a4bd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40a47f
xor eax, eax
jmp 0x40a4bd
mov eax, dword [esi]
push dword [0x412250]
call edi
mov edi, eax
test edi, edi
je 0x40a4a1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x40a4bd
lea edi, [esi + 0xff0]
push esi
push dword [0x412250]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x40a4a7
mov eax, esi
pop edi
pop esi
ret
jmp 0x40a422

Function at 0x40a788
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412120]
jne 0x40a792
repz ret
jmp fcn.0040adba

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
nop
nop
nop
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42ffe0
insb byte es:[edi], dx
pop dword [eax]
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x53ae25c8
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xca91675
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404cb9
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x9606f579
xchg edx, eax
jg 0x404c32
mov dl, 0x2f
jne 0x404cbe
pop esp
out dx, al
inc eax
mov ah, 0xd6
and eax, 0xe332a437
aaa
movsb byte es:[edi], byte [esi]
xor ah, bl
mov ch, 0x5c
ljmp 0xf2f3
loopne 0x404c75
daa
jmp dword [ebp + 0x31]
jno 0x404c86
pop ecx
jb 0x404cd5
or eax, ebp
pop ebx
mov ebx, 0x3875de3c
and ah, byte [edx - 0x62]
loopne 0x404c63
mov ecx, ss
mov cl, 0xba
mov eax, dword [0x5ae97964]
jns 0x404ca4
pop edx
dec eax
inc ebx
ja 0x404c94
push ss
ja 0x404c70
pop esp
push ecx
arpl word [ebx - 0x22], si
loop 0x404cee
adc al, 0x98
in al, 0x4e

Function at 0x422fc9
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
mov dword [esi + 0x10], 1
je 0x422fde
call fcn.00422fa2
lea eax, [esi + 0x18]
push eax
push 0
push esi
push 0x10007ecf
push 0
push 0
call fcn.0042cb9c
add esp, 0x18
mov dword [esi + 0x14], eax
pop esi
ret

Function at 0x42300d
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x10027620
call fcn.0042ccd4
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [0x1002220c]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov edx, dword [ebp - 0x30]
cmp word [edx], ax
jne 0x423075
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x423075
mov ecx, dword [eax + 0xd8]
lea esi, [ecx + edx]
cmp dword [ebp + 0xc], esi
jb 0x423075
mov eax, dword [eax + 0xdc]
add eax, ecx
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x423075
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x42307e
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.0042cd19
ret