joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00404502
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00404502
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00404502
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00404502
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00404502
mov dword [0x41203c], eax
call fcn.00404502
test eax, eax
jge 0x402550
push 8
call fcn.00404502
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00404502
pop ecx
push 1
call fcn.00404502
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00404502
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00404502
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00404502
jmp 0x402495

Function at 0x404502
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x404511
pop dword [ebp - 0x40]
mov eax, 0x5de553bf
add eax, 0xa25af152
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3822a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x43bd
mov edx, eax
mov esi, 0x51a1c5bc
sub esi, 0x516089f8
add esi, dword [ebp - 0x40]
mov ebx, 0xda714c07
add ebx, 0x7e97760
add dword [ebp - 0x18], 0xc49444dd
mov edi, dword [esi]
xor dword [ebp - 0x34], edi
xor edi, ebx
add dword [ebp - 8], edx
mov dword [edx], edi
add dword [ebp - 0x14], ebx
add edx, 0x11d75c6b
add edx, 0xee28a399
add esi, 0xdc965231
add esi, 0x2369add3
loop 0x404565
add eax, 0x9675c765
sub eax, 0x9674c59e
xor ebx, ebx
add ebx, eax
add eax, 0xa17b0403
add eax, 0x5e84fc02
mov ecx, 0x8a51b49a
add ecx, 0x75ee4b66
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0xdef14e
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0xdef154
pop ebp
sub ebp, 0x10
sub ebp, 0x9ef144
jmp 0xdef16a
mov eax, 0x9ef144
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cd
mov edx, 0x5aaa8bfd
add eax, 0xfdba0000
mov ebp, dword [edx + 0x4010305a]
xor byte [eax], dl
inc eax
dec ecx
jne 0xdef181
jmp 0xdef194
jbe 0xdef1c6
jbe 0xdef20c
sar ebp, 0xfd
std
jl 0xdef1da
add eax, 0xfefdfdfd
xor byte [ebp - 5], al
std
std
std
inc edi
aad 0xfd
std
std
or bl, byte [edi]
invalid
std
std
std
invalid
std
xchg ebp, eax
test dword [edx + 0x7f], esp
std
cld
rcr ecx, 1
xchg ebp, eax
jne 0xdef207
sub eax, 0xfdf81562
std
std
adc al, 0xd3
std
sar ebp, cl
std
std
jo 0xdef179
cdq
fld dword [ecx]
je 0xdef1b5
fnstenv [esi + 0x11]
jbe 0xdef261
js 0xdef1df
cmc
std
std
std
jbe 0xdef257
int1
std
std
std
jbe 0xdef265
in eax, dx
std
std
std
cmp al, 0x14
dec esp
invalid
add ah, byte [eax + 0x76fdf13f]
jno 0xdef1e8
jbe 0xdef27f
fyl2xp1
stc
std
std
std
xchg ebp, eax
xor dword [ecx + 0x628595fd], ebp
jg 0xdef21a
lodsb al, byte [esi]
loope 0xdef215
xchg ebp, eax
test dword [edx + 0x7f], esp
std
bound edi, qword [edi - 3]
cld
rcr ecx, 1
lodsb al, byte [esi]
adc eax, 0xfdfdfdf8
adc al, 0xac
invalid
out 8, al
xchg edx, eax
into
xor al, 0x7c
movups xmm2, xmm5
adc edx, ebp
push cs
xchg dword [edi + ecx + 0x11], edi
ljmp 0x157e
push cs
xchg esi, ecx
das
jle 0xdef272
adc eax, 0x79f2b5f8
clc
mov ch, 0xf2
jns 0xdef215
mov bl, 0xfd
std
std
std
bnd jne 0xdef21d
std
std
std
wait
jbe 0xdef24f
les edi, [ebp + 6]
adc eax, 0xfde779f2
bnd jns 0xdef25c
std
std
std
jge 0xdef280
adc al, 0xf2
jns 0xdef26a
std
std
std
wait
jl 0xdef28a
add bl, al
bnd jns 0xdef271
std
std
std
mov esp, 0x2023114
add dl, ah
mov cl, 0xc4
cld
jle 0xdef2d4
clc
jle 0xdef2b0
stc
adc al, 0x40
add al, byte [edx]
add dl, ah
test eax, 0x3c7effc4
sti
jle 0xdef2c1
stc
jle 0xdef2c2
clc
adc al, 0x56
add al, byte [edx]
add dh, byte [esi - 0x2f]
fnstenv [eax - 0x67]
fyl2xp1
aas
int1
std
test al, 0x76
adc dword [ebx - 0x77895756], ebp
int1
stosb byte es:[edi], al
test al, 0x76
mov cl, dh
jbe 0xdef248
cmc
add dword [edi + 0x7d], ecx
ja 0xdef2c9
jl 0xdef30b
cmp edi, esp
cld
std
std
std
jne 0xdef2d0
jl 0xdef312
cld
std
std
std
inc esi
invalid
mov ebx, 0x7ef22fef
xchg edi, eax
std
std
std
into
cmp eax, 0x78f22fff
clc
bnd js 0xdef306
std
std
std
ja 0xdef2fe
jmp 0xdef2cf
mov ebx, 0x7ef22fef
xlatb
cld
std
std
jmp [edi]
Function at 0x40351e
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0x631120], 0x594
mov dword [ebp - 0xc], eax
jne 0x40356a
push 0x402e68
push 0x402e88
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push 0x402e94
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
mov eax, dword [0x4bd4b8]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4bd4bc]
mov dword [ebp - 0x2c], eax
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
call fcn.00403517
mov eax, dword [0x4bd4c0]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x4bd4c4]
add ebx, 0x23f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x631120], 0xc
mov dword [ebp - 4], ecx
jne 0x403611
push esi
lea eax, [ebp - 0xc48]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosw word es:[edi], ax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x18]
lea eax, [ebp - 0x448]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
lea eax, [ebp - 0x34]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add dword [ebp - 4], ecx
mov ecx, dword [0x631120]
cmp ecx, 0xfa9
jne 0x40362f
mov dword [0x6306bc], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x40363d
mov dword [0x630070], esi
lea ecx, [ebx + eax]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
shr eax, cl
mov dword [0x6306b8], 0xf4ea3dee
add eax, dword [ebp - 0x20]
mov ecx, eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x631120], 0x213
mov dword [ebp - 0x14], ecx
jne 0x40367a
push 0x402ea8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ebx + eax]
shr eax, cl
add eax, dword [ebp - 0x2c]
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
add ebx, 0x61c88647
dec dword [ebp - 0x1c]
jne 0x4035a6
cmp dword [0x631120], 0xa6d
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
pop ebx
jne 0x4036d9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret 4
Function at 0x4036e5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x631120]
mov ecx, dword [0x630074]
sub esp, 0x98c
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4037a7
mov ebx, ecx
mov dword [ebp - 8], eax
cmp dword [0x631120], 0x959
jne 0x403795
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
xor eax, eax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push esi
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x188]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x402edc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
lea eax, [ebp - 0x988]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push ebx
call fcn.0040351e
add ebx, 8
dec dword [ebp - 8]
jne 0x40370e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ae9
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
push ebx
push esi
xor esi, esi
cmp dword [0x631120], 0x400
push edi
jne 0x403b42
push esi
push esi
call fcn.00403dd6
push esi
push esi
call fcn.00403dd6
push esi
call fcn.00403fa0
add esp, 0x14
push esi
push esi
push esi
call fcn.00404a5e
pop ecx
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.004034f2
fstp st(0)
push esi
call fcn.00404ae3
pop ecx
push esi
call fcn.00404875
pop ecx
mov eax, dword [0x4bdb44]
mov dword [0x631120], eax
mov eax, dword [0x4bdb1c]
mov dword [0x631124], eax
call fcn.004037c6
mov dword [esp + 0x10], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push esi
lea eax, [esp + 0x3c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [esp + 0x10], ebx
jle 0x403ba9
cmp dword [esp + 0x18], 0x785074d5
jne 0x403bb7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c1b
jl 0x403b64
xor edi, edi
push esi
lea eax, [esp + 0x34]
push eax
push esi
push 0x403360
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x4033ac
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x403be6
cmp dword [esp + 0x18], 0x785074d5
jne 0x403bef
inc edi
cmp edi, 0x11915
jl 0x403bb9
mov eax, dword [0x630074]
mov dword [0x6306b4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ab55
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bc6c4]
jne 0x40ab5f
repz ret
jmp fcn.0040ef18
Function at 0x40ecf0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407248
and dword [ebp - 4], 0
cmp dword [0x4be478], 0
mov ebx, eax
jne 0x40eda1
push 0x402cd4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ee52
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402cc8
push edi
call esi
test eax, eax
je 0x40ee52
push eax
call fcn.004071d6
mov dword [esp], 0x402cb8
push edi
mov dword [0x4be478], eax
call esi
push eax
call fcn.004071d6
mov dword [esp], 0x402ca4
push edi
mov dword [0x4be47c], eax
call esi
push eax
call fcn.004071d6
mov dword [esp], 0x402c88
push edi
mov dword [0x4be480], eax
call esi
push eax
call fcn.004071d6
pop ecx
mov dword [0x4be488], eax
test eax, eax
je 0x40eda1
push 0x402c70
push edi
call esi
push eax
call fcn.004071d6
pop ecx
mov dword [0x4be484], eax
mov eax, dword [0x4be484]
cmp eax, ebx
je 0x40edf9
cmp dword [0x4be488], ebx
je 0x40edf9
push eax
call fcn.00407251
push dword [0x4be488]
mov esi, eax
call fcn.00407251
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40edf9
test edi, edi
je 0x40edf9
call esi
test eax, eax
je 0x40edf0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40edf0
test byte [ebp - 0xc], 1
jne 0x40edf9
or dword [ebp + 0x10], 0x200000
jmp 0x40ee32
mov eax, dword [0x4be47c]
cmp eax, ebx
je 0x40ee32
push eax
call fcn.00407251
pop ecx
test eax, eax
je 0x40ee32
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ee32
mov eax, dword [0x4be480]
cmp eax, ebx
je 0x40ee32
push eax
call fcn.00407251
pop ecx
test eax, eax
je 0x40ee32
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4be478]
call fcn.00407251
pop ecx
test eax, eax
je 0x40ee52
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ee54
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403cd0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x403d0b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x403cf2
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x403d03
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x403d0d
inc edi
add eax, 0x28
cmp edi, esi
jb 0x403ce8
xor eax, eax
pop edi
pop esi
ret

Function at 0x405983
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax], al
add byte [eax - 0x7ab5b], al
inc dword [eax]

Function at 0x405d07
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
call fcn.00403ca0
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00403c55
add esp, 0xc
mov dword [ebp - 0x37c], eax
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x41a6c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
jmp 0x41a6da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41a6e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41a6d0
mov eax, 1
add ebx, ebx
jne 0x41a6f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41a6e8
jne 0x41a704
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41a6e8
xor ecx, ecx
sub eax, 3
jb 0x41a718
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41a78a
mov ebp, eax
add ebx, ebx
jne 0x41a723
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41a730
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41a754
inc ecx
add ebx, ebx
jne 0x41a740
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41a735
jne 0x41a751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41a735
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41a774
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41a765
jmp 0x41a6d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41a774
add edi, ecx
jmp 0x41a6d6
pop esi
mov edi, esi
mov ecx, 0x3aa
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41a792
cmp byte [edi], 1
jne 0x41a792
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41a797
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41a80f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a08c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41a7c4
mov ecx, edi
jns 0x41a7f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a094]
or eax, eax
je 0x41a809
mov dword [ebx], eax
add ebx, 4
jmp 0x41a7e1
call dword [esi + 0x1a090]
mov ebp, dword [esi + 0x1a098]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41a843
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40268e
Capabilities:
Inspect section memory permissions

Disassembly:
push esi
push edi
push ebp
mov ebp, esp
push ebx
push ecx
cmp byte [eax], 0
je 0x4026c0
cmp byte [eax + 1], 0
je 0x4026b2
jmp 0x4026c0
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
jmp 0x402794
push 0xfffffffffffffff5
jmp 0x4026a4
mov bl, byte [eax]
cmp bl, 0x3c
jb 0x4026c0
jbe 0x4026a2
cmp bl, 0x3e
je 0x4026ae
mov ecx, dword [ebp - 4]
and ecx, 7
xor esi, esi
cmp ecx, 1
jb 0x4026ef
jbe 0x4026e8
cmp ecx, 2
jbe 0x4026e1
cmp ecx, 4
jne 0x402706
or esi, 0x80000000
jmp 0x402706
mov esi, 0xc0000000
jmp 0x402706
mov esi, 0x40000000
jmp 0x402706
test ecx, ecx
jmp 0x4026d7
or bl, 3
jmp 0x402727
mov ebx, 1
jmp 0x402727
mov ebx, 2
jmp 0x402727
mov ecx, dword [ebp - 4]
and ecx, 0x70
xor ebx, ebx
cmp ecx, 0x20
jb 0x402723
jbe 0x4026f8
cmp ecx, 0x30
jb 0x402727
jbe 0x4026ff
cmp ecx, 0x40
je 0x4026f3
jmp 0x402727
test ecx, ecx
jbe 0x4026f3
mov edi, dword [ebp - 8]
test byte [ebp - 3], 0x40
je 0x402736
or edi, 0x80000000
test byte [ebp - 3], 1
je 0x402742
or edi, 0x20000000
xor ecx, ecx
cmp edx, 0x10
jb 0x40277a
jbe 0x402765
cmp edx, 0x11
jbe 0x40276c
cmp edx, 0x12
je 0x402773
jmp 0x402786
mov ecx, 3
jmp 0x402786
mov ecx, 5
jmp 0x402786
mov ecx, 1
jmp 0x402786
mov ecx, 4
jmp 0x402786
mov ecx, 2
jmp 0x402786
cmp edx, 1
jb 0x402786
jbe 0x402757
cmp edx, 2
je 0x40275e
push 0
push edi
push ecx
push 0
push ebx
push esi
push eax
call sub.KERNEL32.DLL_CreateFileA
mov edx, eax
mov eax, edx
leave
pop edi
pop esi
ret

Function at 0x402976
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
mov ebp, esp
push eax
push edx
push ebx
mov esi, ebx
cmp ebx, 0xc350
jbe 0x402999
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_GetConsoleMode
test eax, eax
jne 0x4029bb
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
je 0x4029b4
mov ebx, dword [ebp - 0xc]
jmp 0x4029fe
mov ebx, 0xffffffff
jmp 0x4029fe
xor edi, edi
mov ebx, 0x7d00
cmp esi, ebx
jae 0x4029c8
mov ebx, esi
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x4029e9
test edi, edi
jne 0x4029fc
mov edi, 0xffffffff
jmp 0x4029fc
add edi, dword [ebp - 0xc]
cmp ebx, dword [ebp - 0xc]
jne 0x4029fc
cmp esi, ebx
jbe 0x4029fc
add dword [ebp - 8], ebx
sub esi, ebx
jmp 0x4029bd
mov ebx, edi
mov eax, ebx
leave
pop edi
pop esi
pop ecx
ret

Function at 0x4031d8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
mov eax, 0x3020100
mov dword [edx], eax
add eax, 0x4040404
add edx, 4
test al, al
jne 0x4031e1
ret 4
Function at 0x401ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406c], eax
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.mifedount
push str.Deltapo
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b33
xor eax, eax
jmp 0x401b4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0xfe1100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0xfe5042], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0xfe5228
push 0xfe5290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xfe114b
xor eax, eax
jmp 0xfe1166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x404a42
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x404a51
pop dword [ebp - 0x24]
mov eax, 0xb7571b97
sub eax, 0xb716d146
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x46e5427c
sub dword [ebp - 0x34], 0xf892fd31
mov dword [ebp - 0x30], 0x18de9e92
sub dword [ebp - 0x30], 0xe6ab524d
mov dword [ebp - 0x2c], 0xb18f183d
add dword [ebp - 0x2c], 0x9abd2bf1
mov dword [ebp - 0x28], 0xedd7cad7
add dword [ebp - 0x28], 0x12283529
lea eax, [ebp - 0x34]
push eax
mov eax, 0x5737f15
add eax, 0xfacd5137
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xbd4c202
sub dword [ebp - 0x34], 0x976258ac
mov dword [ebp - 0x30], 0xd79d1b68
add dword [ebp - 0x30], 0x69cf460d
mov dword [ebp - 0x2c], 0x14cce44a
sub dword [ebp - 0x2c], 0xb15d77de
mov dword [ebp - 0x28], 0x855c4324
add dword [ebp - 0x28], 0x7aa3bcdc
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3c18e
push 0
call eax
mov ecx, 0x5282
mov ebx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x24]
mov edi, 0xc6a74b
sub dword [ebp - 0xc], 0xb02a1989
mov edx, dword [esi]
xor dword [ebp - 0x20], 0x55cca625
sub edx, edi
add dword [ebp - 0x1c], edx
mov dword [ebx], edx
add dword [ebp - 0x14], eax
add ebx, 0x9d881e80
add ebx, 0x6277e184
add esi, 0xaa0a1b85
add esi, 0x55f5e47f
loop 0x404b5c
add eax, 0x13cdb
xor ebx, ebx
add ebx, eax
add eax, 0x1d7944b8
sub eax, 0x1d7944b3
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret