joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd860b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d86200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd860d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd860c2
add dl, dl
jne 0xd860e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd86134
xor eax, eax
add dl, dl
jne 0xd860ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd861d5
add dl, dl
jne 0xd860fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd86108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd86113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8611e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd8612a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd860cd
mov eax, 1
add dl, dl
jne 0xd86142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8614d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd86139
sub eax, ebx
mov ebx, 1
jne 0xd86180
mov ecx, 1
add dl, dl
jne 0xd86166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd86171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8615d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd860cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd86197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd861a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8618e
cmp eax, 0x7d00
jae 0xd861c5
cmp eax, 0x500
jb 0xd861c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd860cd
cmp eax, 0x7f
ja 0xd861c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd860cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd861f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd860cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x430391
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48d0b8]
jne 0x43039b
repz ret
jmp fcn.00433a5f

Function at 0x4391bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48d0b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00433107
and dword [ebp - 0x14], 0
cmp dword [0x48ee0c], 0
mov dword [ebp - 0x18], eax
jne 0x43926e
push 0x402b78
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x439316
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402b6c
push ebx
call edi
test eax, eax
je 0x439316
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402b5c
push ebx
mov dword [0x48ee0c], eax
call edi
push eax
call esi
push 0x402b48
push ebx
mov dword [0x48ee10], eax
call edi
push eax
call esi
push 0x402b2c
push ebx
mov dword [0x48ee14], eax
call edi
push eax
call esi
mov dword [0x48ee1c], eax
test eax, eax
je 0x43926e
push 0x402b14
push ebx
call edi
push eax
call esi
mov dword [0x48ee18], eax
mov eax, dword [0x48ee18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4392c7
cmp dword [0x48ee1c], ecx
je 0x4392c7
push eax
call esi
push dword [0x48ee1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4392c7
test ebx, ebx
je 0x4392c7
call edi
test eax, eax
je 0x4392be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4392be
test byte [ebp - 8], 1
jne 0x4392c7
or dword [ebp + 0x10], 0x200000
jmp 0x4392fa
mov eax, dword [0x48ee10]
cmp eax, dword [ebp - 0x18]
je 0x4392fa
push eax
call esi
test eax, eax
je 0x4392fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4392fa
mov eax, dword [0x48ee14]
cmp eax, dword [ebp - 0x18]
je 0x4392fa
push eax
call esi
test eax, eax
je 0x4392fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x48ee0c]
call esi
test eax, eax
je 0x439316
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x439318
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00430391
leave
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100843de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
jmp 0x1007ff73
lea esp, [esp + 4]
je 0x1007e793
btc edx, eax
dec si
and si, ax
cmp dx, ax
mov esi, dword [eax + 0x3c]
rcl dx, 5
ror dl, 1
bsf dx, ax
clc
add esi, eax
movsx dx, dl
mov dh, ah
sub dl, 0x85
shld edx, eax, 0xd
mov edx, dword [esi + 0x78]
bt si, 6
test edx, edx
pushfd
lea esp, [esp + 4]
je 0x1007e793
shld cx, si, cl
add cl, 0x90
pushal
cmp bh, bl
add edx, eax
push edi
mov ecx, dword [esi + 0x7c]
cmp ebp, 0x57651bb9
add ecx, edx
jmp 0x10083000
stc
sbb ax, 0xcaf5
movzx ax, bl
btc ax, 2
shl eax, cl
push ebp
lahf
test dl, 0x9c
bsr ax, bx
mov ebp, esp
pushfd
pushal
shrd ax, bx, 7
sub esp, 0xffffffec
bsf eax, esi
sub ax, cx
shr al, 7
aas
push esi
xor ah, 0xab
pushfd
mov dword [esp], edi
shrd ax, sp, cl
aaa
pushfd
lea eax, [ecx*8 + 0x5b1f7bb0]
mov dword [esp], ebx
lea eax, [edi*2 + 0x1525c183]
push edx
adc ah, 0x6c
mov eax, dword [ebp + 8]
stc
test eax, eax
pushal
lea esp, [esp + 0x20]
ja 0x1006f82d
je 0x1007e793
xchg si, dx
mov esi, dword [eax + 0x3c]
or edx, ebx
neg dh
bsr dx, ax
shl dx, 1
add esi, eax
call fcn.1006fcd7
Function at 0x40c470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c488
mov eax, 1
add ebx, ebx
jne 0x40c4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c4a0
jne 0x40c4bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4a0
xor ecx, ecx
sub eax, 3
jb 0x40c4d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c542
mov ebp, eax
add ebx, ebx
jne 0x40c4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c50c
inc ecx
add ebx, ebx
jne 0x40c4f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c4ed
jne 0x40c509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c51d
jmp 0x40c48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c52c
add edi, ecx
jmp 0x40c48e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c54a
cmp byte [edi], 1
jne 0x40c54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40c54f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c5c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd70c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c57c
mov ecx, edi
jns 0x40c5ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd74c]
or eax, eax
je 0x40c5c1
mov dword [ebx], eax
add ebx, 4
jmp 0x40c599
call dword [esi + 0xd750]
popal
jmp 0x401128

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x206e6217
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0xbef50b5
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x240b3415
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x40ab0a07
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40bf79
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4504c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
pop ecx
mov esi, 0x440608
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 0x88]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 8]
movzx eax, byte [ecx + esi]
inc ecx
mov dword [ebp - 0x8c], eax
cmp ecx, 8
jae 0x40bfc2
movzx edi, byte [ecx + esi]
inc ecx
jmp 0x40bfc4
xor edi, edi
cmp ecx, 8
jae 0x40bfdc
movzx eax, byte [ecx + esi]
inc ecx
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x8c]
jmp 0x40bfe3
and dword [ebp - 0x90], 0
shr eax, 2
mov ax, word [ebp + eax*2 - 0x88]
mov word [ebx + edx*2], ax
mov eax, dword [ebp - 0x8c]
and eax, 3
shl eax, 4
mov dword [ebp - 0x8c], eax
mov eax, edi
shr eax, 4
and edi, 0xf
or dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
shl edi, 2
mov ax, word [ebp + eax*2 - 0x88]
mov word [ebx + edx*2 + 2], ax
mov eax, dword [ebp - 0x90]
shr eax, 6
or edi, eax
mov ax, word [ebp + edi*2 - 0x88]
mov word [ebx + edx*2 + 4], ax
mov eax, dword [ebp - 0x90]
and eax, 0x3f
mov ax, word [ebp + eax*2 - 0x88]
mov word [ebx + edx*2 + 6], ax
add edx, 4
cmp ecx, 8
jb 0x40bfab
mov ecx, dword [ebp - 4]
push 0x3d
pop eax
mov word [ebx + edx*2 - 2], ax
xor ecx, ebp
xor eax, eax
pop edi
mov word [ebx + edx*2], ax
mov al, 1
pop esi
pop ebx
call fcn.0041dd94
leave
ret

Function at 0x42ec4d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042e8fe

Function at 0x42ec58
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ea88
Function at 0x10001fc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10002018
cmp byte [esi + ebx - 1], 0xa
je 0x10001fec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10008084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10002640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x10002818
mov edi, dword [0x10008084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x10002727
test byte [0x10003038], 8
jne 0x100027c0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x10003048], 8
jne 0x10002780
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x100026c9
cmp esi, 3
jbe 0x10002738
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x100026da
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x10006528]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x100026c9
mov dword [esp], 0x10003048
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x100026a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x100026a0
mov dword [esp], 0x10003038
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x1000268b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x10002693
mov eax, 0xffffffff
jmp 0x10002727
Function at 0x100028e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100080a0]
test eax, eax
je 0x10002998
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10002920
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1000290c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x100029cd
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100080a0], eax
sub esp, 8
test eax, eax
jne 0x100028fd
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1000290e
Function at 0x100029e0
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x10002b70
mov eax, dword [esi]
test eax, eax
je 0x10002b58
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [ebp - 0x14], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x10002b7c
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10002b48
call dword [edx + 0x28]
mov dword [esi + 8], eax
sub esp, 8
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
lea esp, [ebp - 0xc]
not eax
pop ebx
pop esi
shr eax, 0x1f
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
mov dword [esi + 8], eax
sub esp, 8
jmp 0x10002b0c
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10002a46
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10002b72
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x45595883
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0xf42376
nop
nop
nop
nop
test eax, eax
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x43cdd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
jmp 0x43cdea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x43cdf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x43cde0
mov eax, 1
add ebx, ebx
jne 0x43ce03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x43cdf8
jne 0x43ce14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43cdf8
xor ecx, ecx
sub eax, 3
jb 0x43ce28
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43ce9a
mov ebp, eax
add ebx, ebx
jne 0x43ce33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x43ce40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x43ce64
inc ecx
add ebx, ebx
jne 0x43ce50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x43ce45
jne 0x43ce61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x43ce45
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43ce84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43ce75
jmp 0x43cde6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43ce84
add edi, ecx
jmp 0x43cde6
pop esi
mov edi, esi
mov ecx, 0xdae
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43cea2
cmp byte [edi], 9
jne 0x43cea2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x43cea7
lea edi, [esi + 0x3a000]
mov eax, dword [edi]
or eax, eax
je 0x43cf1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4fd30]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4fd94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43ced4
mov ecx, edi
jns 0x43cf03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4fd9c]
or eax, eax
je 0x43cf19
mov dword [ebx], eax
add ebx, 4
jmp 0x43cef1
call dword [esi + 0x4fd98]
mov ebp, dword [esi + 0x4fda0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x43cf53
sub esp, 0xffffff80
jmp 0x414b04