joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b7b60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x6b7b8c
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jae 0x6b7b95
call fcn.006b67a0
mov eax, 0xa
call fcn.005c8990
call fcn.006b67a0
call fcn.006b7b2c
test al, al
jne 0x6b7b6a
pop ebx
ret

Function at 0x6b80bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x6d0908]
cmp dword [eax], 0
je 0x6b8167
mov eax, dword [0x6d0908]
mov eax, dword [eax]
call fcn.0051b7e8
test al, al
je 0x6b8167
mov eax, dword [0x6d0908]
mov eax, dword [eax]
cmp byte [eax + 0x215], 0
je 0x6b8111
cmp byte [ebx + 0x3e1], 0
jne 0x6b8111
mov eax, dword [0x6d0ec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_IsIconic
test eax, eax
je 0x6b8115
xor eax, eax
jmp 0x6b8117
mov al, 1
mov ebx, eax
mov eax, dword [0x6d0908]
mov eax, dword [eax]
call fcn.0051b414
push 0xfffffffffffffff0
push eax
call sub.user32.dll_GetWindowLongW
test eax, 0x10000000
setne al
cmp bl, al
je 0x6b8167
test bl, bl
je 0x6b8153
push 5
mov eax, dword [0x6d0908]
mov eax, dword [eax]
call fcn.0051b414
push eax
call sub.user32.dll_ShowWindow
jmp 0x6b8167
push 0
mov eax, dword [0x6d0908]
mov eax, dword [eax]
call fcn.0051b414
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x6b8218
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffd4
mov byte [0x6d9fa9], 0
push 0x6b83a4
call sub.kernel32.dll_GetModuleHandleW
mov ebx, eax
push 0x6b83c0
push ebx
call fcn.00414020
mov esi, eax
test esi, esi
je 0x6b82c0
lea eax, [esp + 2]
push eax
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x6b82c0
cmp word [esp], 0
je 0x6b82c0
mov byte [0x6d9fa9], 1
movzx eax, word [esp + 2]
sub ax, 0x14c
je 0x6b8284
sub ax, 0xb4
je 0x6b8290
sub ax, 0x8464
je 0x6b829c
sub ax, 0x2400
je 0x6b82a8
jmp 0x6b82b4
mov byte [0x6d073d], 1
jmp 0x6b835c
mov byte [0x6d073d], 3
jmp 0x6b835c
mov byte [0x6d073d], 2
jmp 0x6b835c
mov byte [0x6d073d], 4
jmp 0x6b835c
mov byte [0x6d073d], 0
jmp 0x6b835c
push 0x6b83e0
push ebx
call fcn.00414020
test eax, eax
je 0x6b8308
lea edx, [esp + 8]
push edx
call eax
push 0x6b8408
push ebx
call fcn.00414020
mov esi, eax
test esi, esi
je 0x6b8312
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call esi
test eax, eax
je 0x6b8312
cmp dword [esp + 4], 0
je 0x6b8312
mov byte [0x6d9fa9], 1
jmp 0x6b8312
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetSystemInfo
movzx eax, word [esp + 8]
sub ax, 1
jb 0x6b8331
sub ax, 5
je 0x6b833a
sub ax, 3
je 0x6b8343
sub ax, 3
je 0x6b834c
jmp 0x6b8355
mov byte [0x6d073d], 1
jmp 0x6b835c
mov byte [0x6d073d], 3
jmp 0x6b835c
mov byte [0x6d073d], 2
jmp 0x6b835c
mov byte [0x6d073d], 4
jmp 0x6b835c
mov byte [0x6d073d], 0
cmp byte [0x6d9fa9], 0
je 0x6b839d
call fcn.0060ecd4
test al, al
je 0x6b8396
push 0x6b8428
push ebx
call fcn.00414020
test eax, eax
je 0x6b8396
push 0x6b845c
push 0x6b847c
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414020
test eax, eax
jne 0x6b839d
mov byte [0x6d9fa9], 0
add esp, 0x2c
pop esi
pop ebx
ret

Function at 0x6b8498
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 1
lea eax, [ebp - 4]
push eax
mov ecx, 0x6b8508
mov edx, 0x80000002
xor eax, eax
call fcn.005c7a14
test eax, eax
jne 0x6b8501
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x6b855c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x6b84f8
cmp dword [ebp - 0xc], 4
jne 0x6b84f8
cmp dword [ebp - 8], 4
jne 0x6b84f8
movzx eax, word [ebp - 0x10]
mov word [0x6d9fc0], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
mov esp, ebp
pop ebp
ret
Function at 0x6b8704
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6b87b3
movzx eax, byte [esp + 4]
shl eax, 0x18
movzx edx, byte [esp + 8]
shl edx, 0x10
or eax, edx
movzx edx, word [esp + 0xc]
or eax, edx
mov dword [0x6d9fbc], eax
cmp byte [0x6d9fa8], 0
je 0x6b87b3
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x6b87a4
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.kernel32.dll_GetVersionExW
test eax, eax
je 0x6b87b3
movzx eax, byte [esp + 0x228]
shl eax, 8
movzx edx, byte [esp + 0x22a]
or ax, dx
mov word [0x6d9fc0], ax
movzx eax, byte [esp + 0x22e]
mov byte [0x6d9fc2], al
movzx eax, word [esp + 0x22c]
mov word [0x6d9fc4], ax
jmp 0x6b87b3
cmp eax, 4
jne 0x6b87b3
call fcn.006b8498
call fcn.006b8574
add esp, 0x230
ret

Function at 0x6b9754
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6b97fc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6b9818
push ebx
push 0x6b9828
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040b550
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407760
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x6b97da
mov eax, dword [0x6d0ed8]
mov eax, dword [eax + 0x20c]
call fcn.006b96a8
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b9803
lea eax, [ebp - 4]
call fcn.0040a1c8
ret
Function at 0x6ba1c8
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ba3b6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.005c75e4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0061011c
test al, al
jne 0x6ba235
xor eax, eax
push ebp
push 0x6ba22b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
xor eax, eax
call fcn.00610618
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ba235
push 0
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
mov eax, dword [0x6da09c]
call fcn.0040b278
push eax
call sub.kernel32.dll_CopyFileW
test eax, eax
jne 0x6ba264
mov eax, dword [0x6d0ed8]
mov eax, dword [eax + 0x208]
call fcn.006b96a8
push 0x80
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_SetFileAttributesW
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x6d5634]
push eax
push 0
mov ecx, 0x6ba3c4
mov edx, 0x6ba3c8
xor eax, eax
call fcn.00414da0
mov dword [ebp - 8], eax
push 0x6b986c
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongW
mov dword [0x6da0c8], eax
xor eax, eax
push ebp
push 0x6ba37f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x6d0ec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.005c6fb0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x24]
mov ecx, 1
mov eax, 0x6ba3e4
call fcn.004244f8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
call fcn.005c6e90
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.0040b470
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.006b9754
mov dword [ebp - 0xc], eax
call fcn.006b9830
test al, al
jne 0x6ba35f
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x6ba33d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ba386
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x6bb754
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x6bba0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6d0ec4]
mov eax, dword [eax]
mov edx, 0x6bba24
call fcn.005b8250
push 5
mov eax, dword [0x6d0ec4]
mov eax, dword [eax]
mov eax, dword [eax + 0x188]
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
push ebp
push 0x6bb9d1
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.006b25dc
lea eax, [ebp - 0x10]
call fcn.005c745c
mov eax, dword [ebp - 0x10]
call fcn.00424020
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.005c6fb0
mov edx, dword [ebp - 0x14]
mov eax, 0x6da09c
call fcn.0040a5a8
call fcn.006b9a3c
lea ecx, [ebp - 0x18]
mov edx, 0x6bba44
mov eax, dword [0x6da09c]
call fcn.005c4f90
mov edx, dword [ebp - 0x18]
mov eax, 0x6da0a0
call fcn.0040a5a8
lea ecx, [ebp - 0x1c]
mov edx, 0x6bba5c
mov eax, dword [0x6da09c]
call fcn.005c4f90
mov edx, dword [ebp - 0x1c]
mov eax, 0x6da0a4
call fcn.0040a5a8
push 2
push 0
push 1
mov ecx, dword [0x6da09c]
mov dl, 1
mov eax, dword [0x5ce3c4]
call fcn.005ced20
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6bb8ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 4]
mov edx, dword [ebp - 0x24]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.005cece0
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.005cecb8
cmp dword [ebp - 0xc], 0x67734d49
je 0x6bb887
mov cl, 1
xor edx, edx
mov eax, dword [0x6da0a4]
call fcn.005d0424
jmp 0x6bb896
mov cl, 1
mov edx, dword [ebp - 8]
mov eax, dword [0x6da09c]
call fcn.005d0424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bb8b3
mov eax, dword [ebp - 4]
call fcn.00408444
ret
Function at 0x6bbba0
Capabilities:
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6bbcdd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x25c]
mov ecx, 0x6bbcf8
mov edx, ebx
call fcn.0040b4c8
mov eax, dword [ebp - 0x25c]
call fcn.0040b278
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x6bbcb7
xor eax, eax
push ebp
push 0x6bbcb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x6bbd14
lea eax, [ebp - 0x22c]
mov ecx, 5
call fcn.004241a0
test eax, eax
jne 0x6bbc81
test byte [ebp - 0x258], 0x10
jne 0x6bbc81
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x22c]
mov ecx, 0x104
call fcn.0040b318
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b4c8
mov esi, dword [ebp - 0x258]
test esi, 1
je 0x6bbc79
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 4]
call fcn.0040b278
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, dword [ebp - 4]
call fcn.00423a20
lea eax, [ebp - 0x258]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x6bbc11
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bbcb7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bbce4
lea eax, [ebp - 0x260]
mov edx, 2
call fcn.0040a228
lea eax, [ebp - 4]
call fcn.0040a1c8
ret
Function at 0x6bbd20
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x6bbe1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
call fcn.0040a1c8
lea edx, [ebp - 4]
mov eax, dword [ebp - 0xc]
call fcn.005c5428
xor edi, edi
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
lea edx, [ebp - 0x1c]
xor ecx, ecx
mov eax, 0x6bbe38
call fcn.004244f8
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040b4c8
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
mov esi, eax
cmp esi, 0xffffffff
je 0x6bbdbe
test esi, 0x10
jne 0x6bbdee
test esi, 1
je 0x6bbdbe
and esi, 0xfffffffe
push esi
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
call sub.kernel32.dll_SetFileAttributesW
push 1
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
mov eax, dword [ebp - 0xc]
call fcn.0040b278
push eax
call sub.kernel32.dll_MoveFileExW
test eax, eax
je 0x6bbde8
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040a5a8
jmp 0x6bbdfb
inc edi
cmp edi, 0xa
je 0x6bbdfb
inc ebx
cmp ebx, 0x3e8
jne 0x6bbd5f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bbe25
lea eax, [ebp - 0x14]
call fcn.0040a1c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040a228
ret
Function at 0x1001b122
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001b147
push 0
push 0
push 0x18d
push 0x192b
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x1001b17a
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001b17a
push 0
push 0
push 0
push 0
push 0x25f7
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x100243c9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100243f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100243f3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
jmp 0x10024428
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10024428
push 0
push 0
push 0
push 0
push 0x25f7
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x10029bfd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.10029acc
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10029c2d
xor eax, eax
jmp 0x10029d66
lea eax, [ebp - 8]
push eax
push 0x1ca5
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.10029b14
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10029c5a
xor eax, eax
jmp 0x10029d66
lea eax, [ebp - 8]
push eax
push 0x7938
lea eax, [ebp - 0xc]
push eax
push 0x684a
push 0x5cf1
push 1
call fcn.10029b75
add esp, 0x18
cmp dword [ebp - 0xc], 0
jne 0x10029c88
xor eax, eax
jmp 0x10029d66
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
push 0x24e3
push dword [ebp - 8]
call fcn.10029959
add esp, 0x1c
push dword [ebp + 8]
push dword [ebp - 4]
push 0
push dword [ebp - 8]
call fcn.1002307c
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x10029cdf
push dword [ebp - 0x14]
push 0x17ae
push 1
push dword [ebp - 4]
call fcn.10025aaf
add esp, 0x10
push dword [ebp - 4]
call fcn.10028cfc
pop ecx
test eax, eax
jne 0x10029cf0
xor eax, eax
jmp 0x10029d66
push 0x3c89
push 0
push 0x34aa
push 0x1228
push dword [ebp - 4]
call fcn.1002716f
add esp, 0x14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10029d4e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10029d2b
xor eax, eax
jmp 0x10029d66
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10029d44
xor eax, eax
jmp 0x10029d66
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10029d5f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10029d63
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10056220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.100562b0
movzx eax, al
test eax, eax
je 0x10056251
push 0x10001844
push 0x10665df8
call fcn.1004ad90
add esp, 8
push 0
call fcn.1005e801
mov ecx, dword [ebp - 4]
call fcn.10056580
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 4]
call fcn.100563b0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10071bc0
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1007a338]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006199c
mov dword [ebp - 0x14], eax
cmp dword [0x10666de0], esi
jne 0x10071cb3
push 0x800
push esi
push 0x10007ce0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10071c40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10071d93
push esi
push esi
push 0x10007ce0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10071d93
push 0x10007cf8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10071d93
push eax
call ebx
push 0x10007d04
push edi
mov dword [0x10666de0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d14
push edi
mov dword [0x10666de4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007d28
push edi
mov dword [0x10666de8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10666df0], eax
test eax, eax
je 0x10071cb0
push 0x10007d44
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10666dec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10071cd8
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10071ccb
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10071ced
push 4
pop eax
jmp 0x10071d95
cmp dword [ebp - 0x14], esi
je 0x10071ced
push dword [0x10666de0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10071cd2
mov eax, dword [0x10666dec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10071d4b
cmp dword [0x10666df0], edi
je 0x10071d4b
push eax
call ebx
push dword [0x10666df0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10071d4b
test eax, eax
je 0x10071d4b
call ecx
test eax, eax
je 0x10071d40
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10071d40
test byte [ebp - 8], 1
jne 0x10071d4b
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10071d7b
mov eax, dword [0x10666de4]
cmp eax, edi
je 0x10071d78
push eax
call ebx
test eax, eax
je 0x10071d78
call eax
mov esi, eax
test esi, esi
je 0x10071d78
mov eax, dword [0x10666de8]
cmp eax, edi
je 0x10071d78
push eax
call ebx
test eax, eax
je 0x10071d78
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10666de0]
call ebx
test eax, eax
je 0x10071d93
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10071d95
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1005d6f4
mov esp, ebp
pop ebp
ret
Function at 0x421bd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x421bf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421be8
mov eax, 1
add ebx, ebx
jne 0x421c0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421c1c
jne 0x421c2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421c2c
dec eax
add ebx, ebx
jne 0x421c28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x421c00
xor ecx, ecx
sub eax, 3
jb 0x421c44
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421cb6
sar eax, 1
mov ebp, eax
jmp 0x421c4f
add ebx, ebx
jne 0x421c4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421c5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421c80
inc ecx
add ebx, ebx
jne 0x421c6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421c61
jne 0x421c7d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421c61
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421ca0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421c91
jmp 0x421bee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421ca0
add edi, ecx
jmp 0x421bee
pop esi
mov edi, esi
mov ecx, 0x843
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x421cbe
cmp byte [edi], 0xd
jne 0x421cbe
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x421cc3
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x421d3b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x228e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2299c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x421cf0
mov ecx, edi
jns 0x421d1f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x229a0]
or eax, eax
je 0x421d35
mov dword [ebx], eax
add ebx, 4
jmp 0x421d0d
call dword [esi + 0x229a4]
popal
jmp section.UPX0

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219