joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a4360
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [0x101c82e4], 0x1973
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x101c82e8]
sub eax, 0x1648
mov dword [0x101c82e4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x101a4414
jmp 0x101a452f
mov dword [0x101c82e8], 0x9c7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x101a4484
jmp 0x101a4537
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x101a4414
mov dword [0x101c82e4], 0x401
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
sete dl
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x15]
test al, 1
jne 0x101a44fc
jmp 0x101a452f
cmp dword [ebp - 0x10], 0x104
setl al
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0x16]
test al, 1
jne 0x101a442a
jmp 0x101a4459
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
sete dl
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0x17]
test al, 1
jne 0x101a4448
jmp 0x101a444a
jmp 0x101a4459
mov dword [0x101c82e8], 0xe9d
jmp 0x101a43d1
mov dword [0x101c82e8], 0x2480
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x6c
je 0x101a43ac
jmp 0x101a4539
mov dword [0x101c82e4], 0x1f2f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x1e], dx
mov ax, word [ebp - 0x1e]
movzx ecx, ax
cmp ecx, 0x61
jne 0x101a4535
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
movzx edx, word [eax + ecx*2 - 0x14]
cmp edx, 0x64
jne 0x101a4533
mov dword [0x101c82e4], 0x24a3
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
shl ecx, 1
add eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax - 0x12]
cmp ecx, 0x64
je 0x101a43e4
jmp 0x101a4531
mov dword [0x101c82e8], 0x1d1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x101a43a7
mov dword [0x101c82e4], 0x1a60
mov dword [ebp - 4], 1
jmp 0x101a4540
jmp 0x101a4531
jmp 0x101a4533
jmp 0x101a4535
jmp 0x101a4537
jmp 0x101a4539
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add esp, 0x2c
pop ebp
ret
Function at 0x101a52f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [0x101c82e4], 0x513
mov dword [0x101c82ec], 0
mov dword [0x101c82f0], 0
mov dword [0x101c82fc], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov eax, dword [0x101c82e4]
add eax, 0x1004
mov dword [0x101c82e8], eax
mov dword [ebp - 0x24], 0
jmp 0x101a5370
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
jae 0x101a54d0
mov dword [0x101c82e4], 0x525
mov dword [0x101c82e8], 0x2451
mov dword [0x101c82e8], 0xda4
mov eax, dword [0x101c82ec]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, 0x100
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, ecx
cdq
mov esi, dword [ebp - 0x30]
idiv esi
mov dword [0x101c82ec], edx
mov edx, dword [0x101c82f0]
mov edi, dword [0x101c82ec]
mov ebx, dword [ebp - 0x1c]
movzx edi, byte [ebx + edi]
add edx, edi
mov eax, edx
cdq
idiv esi
mov dword [0x101c82f0], edx
mov edx, dword [0x101c82e4]
add edx, 0x1e48
mov dword [0x101c82e4], edx
mov edx, dword [0x101c82ec]
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [0x101c82f4], cl
mov dword [0x101c82e4], 0x1607
mov edx, dword [0x101c82f0]
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov edx, dword [0x101c82ec]
mov edi, dword [ebp - 0x1c]
mov byte [edi + edx], cl
mov edx, dword [0x101c82e8]
add edx, 0x7cc
mov dword [0x101c82e4], edx
mov cl, byte [0x101c82f4]
mov edx, dword [0x101c82f0]
mov edi, dword [ebp - 0x1c]
mov byte [edi + edx], cl
mov edx, dword [0x101c82ec]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
mov edi, dword [0x101c82f0]
mov ebx, dword [ebp - 0x1c]
movzx edi, byte [ebx + edi]
add edx, edi
mov dword [ebp - 0x20], edx
mov dword [0x101c82e4], 0xf7b
mov edx, dword [0x101c82e4]
sub edx, 0x35d
mov dword [0x101c82e8], edx
mov edx, dword [ebp - 0x20]
mov eax, edx
cdq
idiv esi
mov dword [0x101c82fc], edx
mov dword [0x101c82e4], 0x1d88
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
mov edi, dword [0x101c82fc]
mov ebx, dword [ebp - 0x1c]
movzx edi, byte [ebx + edi]
xor edx, edi
mov cl, dl
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
mov byte [edi + edx], cl
mov dword [0x101c82e4], 0x627
jmp 0x101a535f
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101a57f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.101a57f0]
mov ecx, dword [0x101c82e4]
sub ecx, 0x2540
mov dword [0x101c82e4], ecx
mov dword [ebp - 8], eax
mov dword [0x101c82e4], 0x8d2
jmp 0x101a5837
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x101a5874
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
jmp 0x101a5863
mov eax, dword [ebp - 8]
movzx eax, word [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0x5a4d
jne 0x101a5825
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x4550
je 0x101a581d
jmp 0x101a5825
mov al, 1
test al, 1
jne 0x101a5837
jmp 0x101a586b
mov dword [ebp - 4], 0
jmp 0x101a5874
mov eax, dword [ebp - 4]
add esp, 0x10
pop ebp
ret
Function at 0x10001040
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov ecx, dword [esp + 0x10]
push edi
mov edi, ecx
mov ebp, 0x10
jmp 0x10001060
xor eax, dword [edi]
mov ebx, eax
call fcn.10001000
xor eax, esi
add edi, 4
sub ebp, 1
mov esi, ebx
jne 0x10001060
mov edx, dword [ecx + 0x40]
xor edx, eax
mov eax, dword [ecx + 0x44]
mov ecx, dword [esp + 0x18]
pop edi
xor eax, esi
pop esi
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
pop ebp
mov dword [eax], edx
pop ebx
ret

Function at 0x10001090
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov eax, 0x1000c1d0
lea ecx, [esi + 0x48]
mov edx, 0x100
mov edi, dword [eax]
mov dword [ecx], edi
add eax, 4
add ecx, 4
sub edx, 1
jne 0x100010a8
cmp eax, 0x1000d1d0
jl 0x100010a3
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ebp, 0x1000c188
xor eax, eax
sub ebp, esi
mov dword [esp + 0x14], 0x12
movzx ecx, byte [eax + ebx]
add eax, 1
cmp eax, edi
jl 0x100010e4
xor eax, eax
movzx edx, byte [eax + ebx]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, edi
jl 0x100010f6
xor eax, eax
movzx ecx, byte [eax + ebx]
shl edx, 8
add eax, 1
or ecx, edx
cmp eax, edi
jl 0x10001108
xor eax, eax
movzx edx, byte [eax + ebx]
shl ecx, 8
add eax, 1
or edx, ecx
cmp eax, edi
jl 0x1000111a
xor eax, eax
mov ecx, dword [esi + ebp]
xor ecx, edx
mov dword [esi], ecx
add esi, 4
sub dword [esp + 0x14], 1
jne 0x100010d7
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.10001040
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov dword [edi + esi*4], ecx
mov dword [edi + esi*4 + 4], edx
add esi, 2
add esp, 0xc
cmp esi, 0x12
jl 0x10001135
mov ebp, edi
lea esi, [ebp + 0x4c]
mov ebx, 4
lea ecx, [ecx]
mov edi, 0x80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebp
call fcn.10001040
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 0xc
add esi, 8
sub edi, 1
jne 0x10001175
sub ebx, 1
jne 0x10001170
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x100011d0
Capabilities:
Create pipe

Disassembly:
sub esp, 0x108
mov eax, dword [0x10010004]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push 0x104
lea eax, [esp + 8]
push 0
push eax
call fcn.10001f00
push esi
push 0x1000d1d0
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.10001e42
add esp, 0x1c
push 0
push 0x2710
push 0x1f4
push 0x1f4
push 0xff
push 6
push 3
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [0x10010f8c], eax
pop esi
mov eax, ecx
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.10001eef
add esp, 0x108
ret
Function at 0x100012c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14c
mov eax, dword [0x10010004]
xor eax, esp
mov dword [esp + 0x148], eax
push ebp
push 0x1f4
call fcn.10002123
add esp, 4
cmp dword [esp + 0x154], 0
mov ebp, eax
mov byte [esp + 4], 3
mov byte [esp + 5], 0
mov byte [esp + 6], 0
je 0x100013ba
push ebx
push esi
push edi
push 0x1f5
call fcn.10002123
push 0x1f5
mov ebx, eax
push 0
push ebx
call fcn.10001f00
mov ecx, dword [esp + 0x170]
lea eax, [esp + 0x174]
push eax
push ecx
push 0x1f4
push ebx
call fcn.100020b9
push ebx
lea edx, [esp + 0x7c]
push 0xff
push edx
call fcn.10001e42
push 0x1f4
push 0
push ebp
call fcn.10001f00
mov ax, word [esp + 0x48]
mov word [ebp], ax
xor al, al
mov byte [ebp + 2], al
mov eax, dword [0x10010f8c]
add esp, 0x38
test eax, eax
lea edi, [ebp + 3]
mov ecx, 0x50
lea esi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
je 0x100013a8
cmp eax, 0xffffffff
je 0x100013a8
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x143
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x10010f8c]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call fcn.10001260
push ebx
call fcn.10001f7a
push ebp
call fcn.10001f7a
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x14c]
pop ebp
xor ecx, esp
call fcn.10001eef
add esp, 0x14c
ret
Function at 0x100013d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x194
mov eax, dword [0x10010004]
xor eax, esp
mov dword [esp + 0x190], eax
push ebp
push esi
push edi
push 0x1f4
call fcn.10002123
push 0x40
mov ebp, eax
lea eax, [esp + 0x164]
push 0
push eax
mov byte [esp + 0x24], 2
mov byte [esp + 0x25], 0
call fcn.10001f00
mov esi, dword [esp + 0x1b4]
mov ecx, 8
lea edi, [esp + 0x16c]
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
xor esi, esi
jmp 0x10001430
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + esi + 0x164]
push eax
call fcn.100011b0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
push 0x10011a20
call fcn.10001040
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + esi + 0x34], eax
mov dword [esp + esi + 0x38], ecx
add esi, 8
add esp, 0x18
cmp esi, 0x20
jl 0x10001430
mov edi, dword [esp + 0x1a8]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10001482
sub eax, edx
push ebx
lea ebx, [eax + 1]
shr ebx, 3
mov esi, 0
js 0x100014e6
lea edx, [esp + 0x60]
sub edi, edx
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
lea edx, [edi + esi*8]
push ecx
lea eax, [esp + edx + 0x68]
push eax
call fcn.100011b0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x10011a20
call fcn.10001040
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov dword [esp + esi*8 + 0x78], eax
mov dword [esp + esi*8 + 0x7c], ecx
add esi, 1
add esp, 0x18
cmp esi, ebx
jle 0x100014a1
push 0x1f4
push 0
push ebp
add bl, 1
call fcn.10001f00
mov dx, word [esp + 0x24]
mov eax, dword [0x10010f8c]
add esp, 0xc
test eax, eax
mov word [ebp], dx
lea edi, [ebp + 3]
mov ecx, 0x50
lea esi, [esp + 0x20]
mov byte [ebp + 2], bl
rep movsd dword es:[edi], dword [esi]
pop ebx
je 0x10001548
cmp eax, 0xffffffff
je 0x10001548
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0x143
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x10010f8c]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call fcn.10001260
push ebp
call fcn.10001f7a
mov ecx, dword [esp + 0x1a0]
add esp, 4
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.10001eef
add esp, 0x194
ret

Function at 0x10001570
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [0x10010f8c]
xor ecx, ecx
cmp eax, ecx
mov byte [esp], cl
mov byte [esp + 1], cl
mov byte [esp + 2], cl
je 0x100015bb
cmp eax, 0xffffffff
je 0x100015bb
push ecx
lea ecx, [esp + 8]
push ecx
push 3
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x10010f8c]
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [0x10010f8c]
push ecx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
add esp, 8
ret
Function at 0x10001da0
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 4]
push eax
push 0x20
mov dword [esp + 0xc], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10001e03
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10001e03
mov eax, dword [esp + 4]
push esi
push esi
push esi
lea edx, [esp + 0x14]
push edx
push esi
push eax
mov dword [esp + 0x2c], 2
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10001e19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.PT_failed:__d_n
call fcn.100012c0
add esp, 8
mov eax, dword [esp + 4]
test eax, eax
je 0x10001e28
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 0x14
ret

Function at 0x10001eef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10010004]
jne 0x10001ef9
repz ret
jmp fcn.10003584
Function at 0x10004a42
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x100102b8]
je 0x10004a5d
inc edi
cmp edi, 0x17
jb 0x10004a4e
cmp edi, 0x17
jae 0x10004bdd
push ebp
push 3
call fcn.100085df
cmp eax, 1
pop ecx
je 0x10004ba9
push 3
call fcn.100085df
test eax, eax
pop ecx
jne 0x10004a91
cmp dword [0x10010fa4], 1
je 0x10004ba9
cmp ebx, 0xfc
je 0x10004bdc
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10011478
push ebp
call fcn.1000857a
add esp, 0xc
test eax, eax
je 0x10004ac7
push esi
push esi
push esi
push esi
push esi
call fcn.100033e5
add esp, 0x14
push 0x104
mov esi, 0x10011491
push esi
push 0
mov byte [0x10011595], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10004b0b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.1000857a
add esp, 0xc
test eax, eax
je 0x10004b0b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.100033e5
add esp, 0x14
push esi
call fcn.10007470
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10004b50
push esi
call fcn.10007470
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1001178c
push 0x1000da54
sub ecx, eax
push ecx
push eax
call fcn.100084c7
add esp, 0x14
test eax, eax
je 0x10004b50
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.100033e5
add esp, 0x14
jmp 0x10004b52
xor esi, esi
push 0x1000da50
push ebx
push ebp
call fcn.10008456
add esp, 0xc
test eax, eax
je 0x10004b72
push esi
push esi
push esi
push esi
push esi
call fcn.100033e5
add esp, 0x14
push dword [edi*8 + 0x100102bc]
push ebx
push ebp
call fcn.10008456
add esp, 0xc
test eax, eax
je 0x10004b94
push esi
push esi
push esi
push esi
push esi
call fcn.100033e5
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10008299
add esp, 0xc
jmp 0x10004bdc
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10004bdc
cmp ebp, 0xffffffff
je 0x10004bdc
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x100102bc]
push dword [esi]
call fcn.10007470
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10008299
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000505a
xor ebx, ebx
cmp dword [0x10011928], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1000836f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1000844f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1000844f
push eax
call fcn.10004fec
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10011928], eax
call esi
push eax
call fcn.10004fec
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1001192c], eax
call esi
push eax
call fcn.10004fec
mov dword [0x10011930], eax
lea eax, [ebp - 0xc]
push eax
call fcn.100047ef
test eax, eax
pop ecx
pop ecx
je 0x1000833d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100033e5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1000836f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10004fec
cmp eax, ebx
pop ecx
mov dword [0x10011938], eax
je 0x1000836f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10004fec
pop ecx
mov dword [0x10011934], eax
mov eax, dword [0x10011934]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x100083f4
cmp dword [0x10011938], ecx
je 0x100083f4
push eax
call fcn.10005063
push dword [0x10011938]
mov esi, eax
call fcn.10005063
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x100083f4
cmp edi, ebx
je 0x100083f4
call esi
cmp eax, ebx
je 0x100083c1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100083c1
test byte [ebp - 0x18], 1
jne 0x100083f4
lea eax, [ebp - 0x10]
push eax
call fcn.10004826
test eax, eax
pop ecx
je 0x100083dc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100033e5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100083eb
or dword [ebp + 0x10], 0x200000
jmp 0x1000842f
or dword [ebp + 0x10], 0x40000
jmp 0x1000842f
mov eax, dword [0x1001192c]
cmp eax, dword [ebp - 8]
je 0x1000842f
push eax
call fcn.10005063
cmp eax, ebx
pop ecx
je 0x1000842f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1000842f
mov eax, dword [0x10011930]
cmp eax, dword [ebp - 8]
je 0x1000842f
push eax
call fcn.10005063
cmp eax, ebx
pop ecx
je 0x1000842f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10011928]
call fcn.10005063
cmp eax, ebx
pop ecx
je 0x1000844f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10008451
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x43b650
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
add esi, 0xbb77b5e6
call fcn.0043b684
add esi, 1
xor dword [eax], ebx
push 0x5290bfce
pop edx
inc eax
or esi, esi
sub esi, esi
sub edx, 0x581c39ec
cmp eax, edi
jne fcn.0043b650
and edx, esi
or esi, esi
ret

Function at 0x43f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x43f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x43f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x43f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret