joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e5a43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xe
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005da12d
add esp, 0xc
xor ecx, 0
test dword [esp + 8], ecx
js 0x5e5a65
push edx
add edx, 0x97d
ror edx, 0xf
pop edx
jg 0x5e5a80
pushf
jne 0x5e5a76
or ecx, 0
popf
ja 0x5e5a7d
jle 0x5e5a80
add eax, 0x48ec45c6
mov byte [ebp - 0x14], 0x48
mov byte [ebp - 8], 0x42
mov byte [ebp - 0xa], 0x6e
mov byte [ebp - 0x12], 0x75
mov byte [ebp - 7], 0
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0x11], 0x44
mov byte [ebp - 0xc], 0x4f
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xb], 0x62
mov byte [ebp - 0x13], 0x66
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 9], 0x66
xchg edi, ebx
xchg edi, ebx
lea edi, [edi + 0x3b77]
lea edi, [edi - 0x3b77]
je 0x5e5ad5
ja 0x5e5acc
jae 0x5e5ace
mov esi, esi
jge 0x5e5ad2
jne 0x5e5ad5
call 0x814aa863
jmp 0xecabe2df
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 9]
sub dl, 1
mov byte [ebp - 9], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
call fcn.005e8272
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e5b58
xor eax, eax
jmp 0x5e5bd0
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.005cc224
mov dword [ebp - 0x18], eax
push 0xe
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x5e5bce
add ecx, 0x4dfb
sub ecx, 0x4dfb
jle 0x5e5b8c
xor esp, 0
js 0x5e5b91
je 0x5e5ba1
pushf
shr esp, 0
popf
xchg edi, edx
xchg edi, edx
jne 0x5e5ba1
add eax, 0x52e8558b
mov edx, dword [ebp - 0x18]
push edx
call fcn.005c0cb3
add esp, 4
or esp, 0
jns 0x5e5bbd
je 0x5e5bb4
ja 0x5e5bb6
jge 0x5e5bb8
jns 0x5e5bba
js 0x5e5bbd
sub eax, 0x5010458b
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
jmp 0x5e5bd0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5e6ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0xf
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.005da12d
add esp, 0xc
rol esi, 9
ror esi, 9
mov ebx, ebx
cmp ebx, dword [esp + 8]
jg 0x5e702f
pushf
mov eax, eax
xchg esp, esp
test esp, 0x76e5
shl edx, 0
popf
je 0x5e702a
jno 0x5e702c
jle 0x5e702f
mov esi, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0xd], 0x79
mov byte [ebp - 0xb], 0x42
mov byte [ebp - 0xf], 0x55
mov byte [ebp - 0x15], 0x58
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0xa], 0
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x14], 0x6a
mov byte [ebp - 0x10], 0x78
mov byte [ebp - 0x17], 0x66
mov byte [ebp - 0xe], 0x66
mov byte [ebp - 0xc], 0x75
mov byte [ebp - 0x16], 0x75
lea edx, [edx + 0x21dc]
lea edx, [edx - 0x21dc]
jbe 0x5e7079
jnp 0x5e7081
lea edx, [edx]
jp 0x5e7081
mov edx, 0xe84d8a8f
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 0x11]
sub al, 1
mov byte [ebp - 0x11], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x16]
sub cl, 1
mov byte [ebp - 0x16], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
call fcn.005e8272
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5e710d
xor eax, eax
jmp 0x5e718a
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cc224
mov dword [ebp - 8], eax
push 0xf
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x5e7188
xor esi, 0
jae 0x5e713f
jg 0x5e713a
jle 0x5e713c
jb 0x5e713f
add eax, 0x50f8458b
mov eax, dword [ebp - 8]
push eax
call fcn.005c0cb3
add esp, 4
add esi, 0
push edi
pop edi
nop
jnp 0x5e7177
pushf
test dword [esp + 0xc], eax
test dword [esp], ecx
shr edi, 0
test dword [esp], eax
popf
lea ebx, [ebx + 0x61bf]
lea ebx, [ebx - 0x61bf]
jno 0x5e7172
jg 0x5e7174
jp 0x5e7177
or dword [ebx - 0x74aeefb3], 0x8b520c55
inc ebp
or byte [eax - 1], dl
push ebp
clc
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 8]
jmp 0x5e718a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5e808b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005da12d
add esp, 0xc
mov ebx, ebx
add edx, dword [esp]
sub edx, dword [esp]
jge 0x5e80c4
pushf
js 0x5e80b2
lea edx, [edx + 0x4373]
sub edx, 0x4373
popf
nop
jl 0x5e80c4
mov edi, 0x53e445c6
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
shr esp, 0
jo 0x5e8111
xor esi, dword [esp + 0xc]
xor esi, dword [esp + 0xc]
jb 0x5e812d
pushf
lea edx, [edx]
nop
rol eax, 0x14
rol eax, 0xc
popf
jl 0x5e812a
jae 0x5e812d
lcall 0x1e9, 0x80e44d8a
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.005d5752
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5e81de
xor eax, eax
jmp 0x5e8269
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.005cc224
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5e8267
cmp edi, eax
nop
or eax, eax
je 0x5e8221
pushf
or esp, 0
cmc
or ebx, 0
not ebx
not ebx
popf
jae 0x5e821c
mov esp, esp
jne 0x5e8221
mov ebp, 0x51fc4d8b
mov ecx, dword [ebp - 4]
push ecx
call fcn.005c0cb3
add esp, 4
jne 0x5e822f
xchg ebx, ebx
push esi
add esi, 0x650f
ror esi, 0xb
pop esi
je 0x5e824e
pushf
push edx
pop edx
std
cld
jg 0x5e8246
popf
lea esp, [esp]
jne 0x5e824e
mov ebp, 0x5218558b
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x5e8269
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5ea59e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.005da12d
add esp, 0xc
jo 0x5ea5b9
xchg edi, edi
jns 0x5ea5e0
pushf
xor esi, 0x22a9
xor esi, 0x22a9
xchg edx, edx
rol ecx, 6
rol ecx, 0x1a
test ebx, 0x6d6d
popf
jg 0x5ea5dd
js 0x5ea5e0
mov esi, 0x46f045c6
mov byte [ebp - 0x10], 0x46
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 6], 0x74
mov byte [ebp - 0xf], 0x79
mov byte [ebp - 0xa], 0x70
mov byte [ebp - 5], 0
mov byte [ebp - 0xe], 0x6a
mov byte [ebp - 9], 0x64
mov byte [ebp - 0xd], 0x75
mov byte [ebp - 8], 0x66
mov byte [ebp - 0xc], 0x51
mov byte [ebp - 7], 0x74
jne 0x5ea612
xor edi, dword [esp]
xor edi, dword [esp]
push esi
pop esi
jp 0x5ea622
jbe 0x5ea61e
jnp 0x5ea622
lcall 0xe980, 0xf04d8a49
add dword [eax + 0x558af04d], ecx
cmc
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
mov al, byte [ebp - 6]
sub al, 1
mov byte [ebp - 6], al
mov cl, byte [ebp - 0xf]
sub cl, 1
mov byte [ebp - 0xf], cl
mov dl, byte [ebp - 0xa]
sub dl, 1
mov byte [ebp - 0xa], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 9]
sub cl, 1
mov byte [ebp - 9], cl
mov dl, byte [ebp - 0xd]
sub dl, 1
mov byte [ebp - 0xd], dl
mov al, byte [ebp - 8]
sub al, 1
mov byte [ebp - 8], al
mov cl, byte [ebp - 0xc]
sub cl, 1
mov byte [ebp - 0xc], cl
mov dl, byte [ebp - 7]
sub dl, 1
mov byte [ebp - 7], dl
cmp ecx, ebx
xor ecx, eax
xor ecx, eax
xor ebx, dword [esp + 0x10]
xor ebx, dword [esp + 0x10]
shr esp, 0
jb 0x5ea6a8
jae 0x5ea697
lea ebx, [ebx + 0x2d96]
lea ebx, [ebx - 0x2d96]
mov eax, eax
jae 0x5ea6a8
mov ebp, 0xfeb0a5e8
dec dword [ecx + 0x7d83fc45]
cld
add byte [ebp + 4], dh
call fcn.005d5752
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5ea6ba
xor eax, eax
jmp 0x5ea6fc
jbe 0x5ea6bc
ror esi, 0x13
ror esi, 0xd
shl ebx, 0
shr edi, 0
jg 0x5ea6d9
lea ecx, [ecx + 0xdbb]
lea ecx, [ecx - 0xdbb]
jle 0x5ea6d9
call 0x514eec6a
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005cc224
mov dword [ebp - 0x14], eax
push 0xc
push 0
lea edx, [ebp - 0x10]
push edx
call fcn.005da12d
add esp, 0xc
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5eaf44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push 0x22
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.005da12d
add esp, 0xc
push 0x21
push 0x5bbbb8
lea ecx, [ebp - 0x138]
push ecx
call fcn.005d06a2
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
push 1
push 0
lea eax, [ebp - 0x138]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x5eb04c
push 0x22
push 0
lea ecx, [ebp - 0x138]
push ecx
call fcn.005da12d
add esp, 0xc
push 0xb
push 0x5bbbdc
lea edx, [ebp - 0x138]
push edx
call fcn.005d06a2
add esp, 0xc
mov dword [ebp - 0x13c], 0x105
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jne 0x5eb03f
push 0x105
lea edx, [ebp - 0x108]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.005d06a2
add esp, 0xc
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x5eb04e
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x5eb25f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xc
push 0
lea eax, [ebp - 0x14]
push eax
call fcn.005da12d
add esp, 0xc
sub esp, 0
std
cld
je 0x5eb290
pushf
rol edx, 0x19
rol edx, 7
popf
jbe 0x5eb28b
jb 0x5eb28d
jne 0x5eb290
mov esi, 0x47ec45c6
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x66
mov byte [ebp - 0x11], 0x66
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x6a
mov byte [ebp - 0xe], 0x63
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x7a
mov byte [ebp - 9], 0
dec eax
inc eax
jne 0x5eb2c4
je 0x5eb2c6
jge 0x5eb2dc
pushf
sub ecx, 0
jl 0x5eb2cf
popf
xchg esi, edx
xchg esi, edx
jl 0x5eb2d7
jnp 0x5eb2d9
jl 0x5eb2dc
call 0x814b006a
jmp 0xecac3ae6
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
mov al, byte [ebp - 0xa]
sub al, 1
mov byte [ebp - 0xa], al
mov cl, byte [ebp - 0x13]
sub cl, 1
mov byte [ebp - 0x13], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0x12]
sub al, 1
mov byte [ebp - 0x12], al
mov cl, byte [ebp - 0xd]
sub cl, 1
mov byte [ebp - 0xd], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x10]
sub cl, 1
mov byte [ebp - 0x10], cl
mov dl, byte [ebp - 0xb]
sub dl, 1
mov byte [ebp - 0xb], dl
jo 0x5eb33e
or ecx, 0
lea esi, [esi]
jnp 0x5eb35c
xchg ecx, esi
xchg ecx, esi
lea eax, [eax + 0x5f27]
lea eax, [eax - 0x5f27]
jnp 0x5eb357
jb 0x5eb359
jp 0x5eb35c
lcall 0x89ff, 0xfea3f1e8
inc ebp
clc
call fcn.005d5752
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x5eb371
xor eax, eax
jmp 0x5eb431
push esi
add esi, 0x574f
ror esi, 5
pop esi
cmp edi, esi
call 0x5eb383
add esp, 4
jne 0x5eb3ad
pushf
mov esp, esp
dec esi
inc esi
popf
lea ecx, [ecx + 0x70d4]
lea ecx, [ecx - 0x70d4]
lea esi, [esi + 0x69c5]
lea esi, [esi - 0x69c5]
lea ecx, [ecx]
je 0x5eb3ad
xor eax, 0x50ec458d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005cc224
mov dword [ebp - 4], eax
push 0xc
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.005da12d
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x5eb413
je 0x5eb3d5
test esp, 0x6cb3
jp 0x5eb3e7
lea esp, [esp]
mov edi, edi
jnp 0x5eb3e7
sub eax, 0x458b5166
cld
mov eax, dword [ebp - 4]
push eax
call fcn.005c0cb3
add esp, 4
jae 0x5eb3f5
jg 0x5eb40a
jmp 0x5eb3f9
lea ebx, [ebx + 0x68a6]
lea ebx, [ebx - 0x68a6]
xchg edi, edi
jle 0x5eb40a
mov esp, 0x51084d8b
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 4]
jmp 0x5eb431
jno 0x5eb415
push ebx
pop ebx
lea esp, [esp]
je 0x5eb42f
xchg esi, esi
jne 0x5eb420
lea edx, [edx + 0x758b]
lea edx, [edx - 0x758b]
jne 0x5eb42f
mov edx, 0x5e5fc033
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
nop
mov ecx, 0x4b9e44ce
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x30623f65
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x4313d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2c000]
push edi
or ebp, 0xffffffff
jmp 0x4313f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4313f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4313e8
mov eax, 1
add ebx, ebx
jne 0x43140b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x431400
jne 0x43141c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x431400
xor ecx, ecx
sub eax, 3
jb 0x431430
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4314a2
mov ebp, eax
add ebx, ebx
jne 0x43143b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x431448
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43146c
inc ecx
add ebx, ebx
jne 0x431458
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43144d
jne 0x431469
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43144d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43148c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43147d
jmp 0x4313ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43148c
add edi, ecx
jmp 0x4313ee
pop esi
mov edi, esi
mov ecx, 0x23e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4314aa
cmp byte [edi], 1
jne 0x4314aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4314af
lea edi, [esi + 0x2f000]
mov eax, dword [edi]
or eax, eax
je 0x431527
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x319f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x31aac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4314dc
mov ecx, edi
jns 0x43150b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x31ab0]
or eax, eax
je 0x431521
mov dword [ebx], eax
add ebx, 4
jmp 0x4314f9
call dword [esi + 0x31ab4]
popal
jmp 0x4030be
Function at 0x41a2e0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x41e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc28], eax
cmp ebx, 0x182
jne 0x41a315
lea ecx, [ebp - 0xc20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
jmp 0x41a333
cmp ebx, 0x19f
jne 0x41a333
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x41a394
push esi
jmp 0x41a340
lea esi, [ebp - 0xc24]
mov dword [ebp - 0xc24], 0
call fcn.0041a2d0
mov dl, byte [ebp - 0xc24]
mov eax, dword [ebp - 0xc28]
xor byte [eax + edi], dl
cmp ebx, 0xf
jne 0x41a38e
lea eax, [ebp - 0xc2c]
push eax
lea ecx, [ebp - 0x804]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
lea edx, [ebp - 0xc04]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
inc edi
cmp edi, ebx
jl 0x41a340
pop esi
pop edi
cmp ebx, 0x2d
jne 0x41a3ae
mov dword [0x422008], 0xa62e7790
mov dword [0x42200c], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x41a3c0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x421ffc]
push ebx
push esi
mov esi, dword [0x421d1c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x41a3e2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x41f1d0]
call fcn.0041a2a0
cmp dword [0x421ffc], 0x2f
jne 0x41a3fd
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.0041a2e0
add esp, 4
cmp dword [0x421ffc], 0x568
pop esi
pop ebx
jne 0x41a428
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
ret