joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4390fb
Capabilities:
Create process on windows
Enumerate processes
Impersonate user

Disassembly:
mov eax, 0x46b4fe
call fcn.00468300
sub esp, 0x580
push ebx
xor ebx, ebx
mov dword [ebp - 0x1a], 0xcac2df45
push edi
mov cl, 0x45
mov dword [ebp - 0x16], 0xdfc8d5d6
mov dword [ebp - 0x12], 0xc2df94c8
mov edx, ebx
mov word [ebp - 0xe], 0xdf
not cl
xor byte [ebp + edx - 0x19], cl
inc edx
cmp edx, 0xc
jae 0x43913f
mov cl, byte [ebp - 0x1a]
jmp 0x43912e
lea eax, [ebp - 0x19]
mov dword [ebp - 0x3c], ebx
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 0xd], bl
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xf
mov byte [ebp - 0x3c], bl
call fcn.00413e6c
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x384], 0x22c
lea eax, [ebp - 0x384]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4392a3
push esi
lea edx, [ebp - 0x3c]
lea ecx, [ebp - 0x54]
call fcn.00438eb9
lea edx, [ebp - 0x360]
mov ecx, eax
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x4391a3
mov eax, dword [ecx + 0x10]
sub edx, esi
sar edx, 1
cmp dword [ecx + 0x14], 8
jb 0x4391bd
mov ecx, dword [ecx]
cmp eax, edx
jne 0x4391d4
push eax
lea edx, [ebp - 0x360]
call fcn.00413f98
pop ecx
test eax, eax
jne 0x4391d4
mov bl, 1
lea ecx, [ebp - 0x54]
call fcn.00413c2d
test bl, bl
je 0x43928a
push dword [ebp - 0x37c]
xor ebx, ebx
push ebx
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x20]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x439281
lea eax, [ebp - 0x24]
push eax
push 1
push 2
push ebx
push 0xf01ff
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x439281
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [ebp - 0x158]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x158]
push eax
call fcn.0044c110
inc eax
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.00451905
add esp, 0x10
lea eax, [ebp - 0x58c]
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
push 1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CreateProcessWithTokenW]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43928c
xor ebx, ebx
lea eax, [ebp - 0x384]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x43918d
pop esi
lea ecx, [ebp - 0x3c]
call fcn.00413e0b
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4392bb
Capabilities:
Create process on windows
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push ebx
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0x90]
push ebx
push eax
call fcn.00442300
xor eax, eax
lea edi, [ebp - 0x4c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 0x104
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x194]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movaps xmm0, xmmword [0x47e9b0]
mov ecx, ebx
movups xmmword [ebp - 0x3a], xmm0
mov dword [ebp - 0xa], 0xeeb0bff9
movaps xmm0, xmmword [0x47e840]
movups xmmword [ebp - 0x2a], xmm0
mov dword [ebp - 6], 0xecbabdbf
movaps xmm0, xmmword [0x47e6f0]
movups xmmword [ebp - 0x1a], xmm0
mov word [ebp - 2], 0xbd
mov al, byte [ebp - 0x3a]
not al
xor byte [ebp + ecx - 0x39], al
inc ecx
cmp ecx, 0x38
jb 0x43932d
lea eax, [ebp - 0x194]
mov byte [ebp - 1], bl
push eax
lea eax, [ebp - 0x39]
push eax
lea eax, [ebp - 0x39c]
push 0x208
push eax
call fcn.00435a24
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea eax, [ebp - 0x39c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
leave
ret

Function at 0x43b5cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
lea eax, [ecx - 1]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
mov esi, edi
sar eax, 1
mov dword [ebp - 8], eax
cmp edi, eax
jge 0x43b627
add esi, esi
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea edx, [ecx - 0x18]
call fcn.004286a9
movzx eax, al
xor eax, 1
imul ecx, edi, 0x18
inc eax
add esi, eax
imul eax, esi, 0x18
add ecx, ebx
add eax, ebx
push eax
call fcn.004133cf
mov eax, dword [ebp - 8]
mov edi, esi
cmp esi, eax
jl 0x43b5f0
mov ecx, dword [ebp + 8]
cmp esi, eax
jne 0x43b646
test cl, 1
jne 0x43b646
imul eax, ecx, 0x18
imul ecx, edi, 0x18
add eax, 0xffffffe8
add eax, ebx
add ecx, ebx
push eax
call fcn.004133cf
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], edi
jge 0x43b67a
mov edx, dword [ebp + 0xc]
lea esi, [edi - 1]
sar esi, 1
imul eax, esi, 0x18
add eax, ebx
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.004286a9
test al, al
je 0x43b67a
push dword [ebp + 8]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.004133cf
mov edi, esi
cmp dword [ebp - 4], esi
jl 0x43b64b
push dword [ebp + 0xc]
imul ecx, edi, 0x18
add ecx, ebx
call fcn.004133cf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43cb21
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x43cb3d
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x43cb61
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.00442300
movzx eax, word [ebx*8 + 0x47bf5a]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x47bf58]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x47bf5c]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x47bf5e]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x43cbc4
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x43cbcf
cmp ebx, 8
jl 0x43cbcf
mov eax, dword [ebp + 8]
or word [eax], cx
mov eax, dword [esi + 0xc]
lea ebx, [esi + 0x1af70]
push 0x10000
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call eax
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x43cc38
cmp eax, 0xffffffff
je 0x43cc38
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x43cc13
mov ecx, esi
call fcn.0043ce07
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x43cc1b
jmp 0x43cc48
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x43cf50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov ecx, ebx
push edi
mov dword [ebp - 4], ecx
mov edi, ebx
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
jmp 0x43d162
cmp eax, 3
jb 0x43cfcf
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x43d00c
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x43d00c
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x43cff6
mov dword [esi + 0x6afa0], eax
mov edx, ecx
mov ecx, esi
call fcn.0043cc4d
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x43d0ec
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.0043c56d
pop ecx
mov ecx, dword [esi + 0x6af90]
sub ecx, edi
mov dword [ebp - 8], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x43d0b6
cmp ecx, 3
jb 0x43d0b6
dec edi
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x43d04e
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
jmp 0x43d0e7
mov edx, dword [esi + 0x6af84]
add edx, edi
mov edi, ebx
mov dword [esi + 0x6af84], edx
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 8]
jmp 0x43d111
movzx eax, byte [ecx + esi + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.0043c56d
dec dword [esi + 0x6af90]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
pop ecx
test eax, eax
je 0x43d145
mov eax, dword [esi + 0x6af74]
sub edx, eax
test eax, eax
js 0x43d12a
add eax, 0x1af70
add eax, esi
jmp 0x43d12c
mov eax, ebx
push ebx
push edx
mov edx, eax
mov ecx, esi
call fcn.0043c378
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x43d15f
mov ecx, esi
call fcn.0043ce07
mov eax, dword [esi + 0x6af90]
mov ecx, dword [ebp - 4]
test eax, eax
jne 0x43cf78
mov eax, dword [esi + 0x6af74]
mov ecx, dword [esi + 0x6af84]
sub ecx, eax
test eax, eax
js 0x43d184
lea ebx, [esi + 0x1af70]
add ebx, eax
push 1
push ecx
mov edx, ebx
mov ecx, esi
call fcn.0043c378
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43dd80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x43dd8b
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x43de47
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
sub edi, 1
jne 0x43dda0
pop edi
test esi, esi
je 0x43de63
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
inc edx
sub esi, 1
jne 0x43de4b
not ecx
mov eax, ecx
pop esi
pop ebp
ret

Function at 0x43de6a
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
mov esi, ecx
movsx eax, dl
mov ecx, dword [esi]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x47ba18]
movzx eax, cl
add eax, dword [esi + 4]
imul eax, eax, 0x8088405
mov dword [esi], ecx
mov ecx, dword [esi + 8]
inc eax
mov dword [esi + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x47ba18]
mov dword [esi + 8], ecx
pop esi
ret
Function at 0x43dfe1
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
mov dword [ebp - 0x14], edx
push eax
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x43e009
mov eax, 0x200
jmp 0x43e1c5
mov ebx, dword [ebp - 0x48]
mov edi, 0x41000000
mov esi, ebx
mov eax, ebx
and esi, 1
mov ecx, esi
or ecx, 2
and al, 2
mov eax, ebx
cmove ecx, esi
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov ecx, ebx
and ecx, 0x10
mov eax, edx
or eax, 0x10
mov dword [ebp - 8], ecx
test ecx, ecx
cmove eax, edx
mov edx, 0x81000000
mov ecx, eax
or ecx, 0x20
and bl, 0x20
cmove ecx, eax
mov eax, dword [ebp - 8]
test eax, eax
cmove edi, edx
or edi, ecx
test esi, esi
jne 0x43e06f
test eax, eax
mov edi, 0x41800000
mov edx, 0x81800000
cmove edi, edx
or edi, ecx
mov ebx, dword [ebp - 4]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x28
jbe 0x43e11e
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [ebp - 4], ax
jne 0x43e11e
mov ecx, dword [ebp - 8]
lea eax, [ecx + 0x34]
cmp esi, eax
jbe 0x43e11e
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x10]
cmp eax, 0x5a4d
je 0x43e118
cmp eax, 0x454e
je 0x43e118
cmp eax, 0x454c
je 0x43e118
cmp eax, 0x4550
jne 0x43e11e
or edi, 0x400000
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x43e127
mov dword [eax], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x43e130
mov dword [eax], esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x43e19a
mov ecx, dword [ebp - 0x3c]
mov ebx, 0x19db1de
mov eax, dword [ebp - 0x38]
sub ecx, 0xd53e8000
push 0
mov edi, 0x989680
sbb eax, ebx
push edi
push eax
push ecx
call fcn.00467e20
mov ecx, dword [ebp - 0x34]
mov dword [esi], eax
sub ecx, 0xd53e8000
mov eax, dword [ebp - 0x30]
push 0
push edi
sbb eax, ebx
mov dword [esi + 4], edx
push eax
push ecx
call fcn.00467e20
mov ecx, dword [ebp - 0x44]
mov dword [esi + 8], eax
sub ecx, 0xd53e8000
mov eax, dword [ebp - 0x40]
push 0
push edi
sbb eax, ebx
mov dword [esi + 0xc], edx
push eax
push ecx
call fcn.00467e20
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x43e1c3
push dword [ebp - 0x30]
lea edx, [ebp - 8]
push dword [ebp - 0x34]
lea ecx, [ebp - 4]
call fcn.0043df84
movzx eax, word [ebp - 8]
pop ecx
pop ecx
movzx ecx, word [ebp - 4]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43e2d3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x43e348
mov ecx, dword [esi + 0x3c]
mov eax, ecx
test ecx, ecx
je 0x43e302
cmp dword [esi + 0x40], edi
jae 0x43e302
push ecx
call fcn.0044087f
and dword [esi + 0x3c], 0
pop ecx
jmp 0x43e306
test eax, eax
jne 0x43e316
lea eax, [edi + edi]
push eax
call fcn.00440b3f
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push eax
call fcn.00441af0
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x43e345
lea ecx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
mov dl, byte [ebx + eax]
call fcn.0043dead
mov cl, al
mov eax, dword [esi + 0x3c]
mov byte [ebx + eax], cl
inc ebx
lea ecx, [esi + 0x30]
cmp ebx, edi
jb 0x43e32a
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x43e377
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x43e363
mov dword [esi + 0x14], 0x30000
jmp 0x43e399
push edi
add ecx, edx
push ebx
push ecx
call fcn.00441af0
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x43e39b
mov eax, dword [esi + 4]
test eax, eax
je 0x43e392
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x43e39b
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x43e721
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x43e777
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp eax, esi
jae 0x43e7b2
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call fcn.00441af0
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
call fcn.0043dd80
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x43e7b4
cmp dword [edi + 0x7c], 0
je 0x43e7ab
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43e7b2
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.0043dd80
pop ecx
jmp 0x43e770
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0x45844d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004582c3

Function at 0x45bb7a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045b6cd

Function at 0x45cf32
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045ceb4
Function at 0x685ddae0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x68fbd040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.685ddb40

Function at 0x685ddb40
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x68fbe378]
test esi, esi
jle 0x685ddc2d
mov edi, dword [0x68fbe37c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x685ddb74
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x685ddc26
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x685ddb60
mov dword [esp], eax
mov esi, eax
call fcn.685de2e0
test eax, eax
mov edi, eax
je 0x685ddc6a
mov esi, dword [0x68fbe37c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.685de3f0
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x68fbe37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x685ddc4a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x685ddc1f
sub eax, 0x40
and eax, 0xffffffbf
je 0x685ddc1f
mov eax, dword [esp + 0x20]
add ebx, dword [0x68fbe37c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x685ddc34
add dword [0x68fbe378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x685ddb7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.685ddae0
mov eax, dword [0x68fbe37c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.685ddae0
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.685ddae0
lea esi, [esi]
Function at 0x685ddf50
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x68fbe388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x68fbe380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x685ddfa5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x685ddf9e
test esi, esi
je 0x685ddf9e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x685ddf80
mov dword [esp], 0x68fbe388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4bbe70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x79000]
push edi
jmp 0x4bbe8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4bbe91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbe80
mov eax, 1
add ebx, ebx
jne 0x4bbea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4bbeb4
jne 0x4bbed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbed3
dec eax
add ebx, ebx
jne 0x4bbec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4bbe98
add ebx, ebx
jne 0x4bbecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4bbf25
xor ecx, ecx
sub eax, 3
jb 0x4bbeeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4bbf5a
sar eax, 1
mov ebp, eax
jmp 0x4bbef6
add ebx, ebx
jne 0x4bbef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbec4
inc ecx
add ebx, ebx
jne 0x4bbf04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bbec4
add ebx, ebx
jne 0x4bbf11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4bbf06
jne 0x4bbf22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4bbf06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4bbf44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4bbf36
jmp 0x4bbe86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4bbf44
add edi, ecx
jmp 0x4bbe86
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4bbf62
cmp byte [edi], 0x13
jne 0x4bbf62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4bbf67
lea edi, [esi + 0xb7000]
mov eax, dword [edi]
or eax, eax
je 0x4bbfdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc6a78]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc6bcc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4bbf94
mov ecx, edi
jns 0x4bbfc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc6bd0]
or eax, eax
je 0x4bbfd9
mov dword [ebx], eax
add ebx, 4
jmp 0x4bbfb1
call dword [esi + 0xc6be0]
mov ebp, dword [esi + 0xc6bd4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4bc013
sub esp, 0xffffff80
jmp 0x4165c1