joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ad50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x411015
lea edi, [esi - 0x10015]
push edi
or ebp, 0xffffffff
jmp 0x41ad72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ad79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ad68
mov eax, 1
add ebx, ebx
jne 0x41ad8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ad80
jne 0x41ad9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ad80
xor ecx, ecx
sub eax, 3
jb 0x41adb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ae22
mov ebp, eax
add ebx, ebx
jne 0x41adbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41adc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41adec
inc ecx
add ebx, ebx
jne 0x41add8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41adcd
jne 0x41ade9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41adcd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ae0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41adfd
jmp 0x41ad6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ae0c
add edi, ecx
jmp 0x41ad6e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ae2a
cmp byte [edi], 5
jne 0x41ae2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ae2f
lea edi, [esi + 0x18000]
mov eax, dword [edi]
or eax, eax
je 0x41aea7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1a000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1a094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ae5c
mov ecx, edi
jns 0x41ae8b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1a09c]
or eax, eax
je 0x41aea1
mov dword [ebx], eax
add ebx, 4
jmp 0x41ae79
call dword [esi + 0x1a098]
mov ebp, dword [esi + 0x1a0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41aedb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x1c81fa8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1c81fb2
pushal
call 0x1c81fb8
pop ebp
sub ebp, 0x10
sub ebp, 0x1881fa8
jmp 0x1c81fce
mov eax, 0x1881fa8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cc
mov edx, 0x631500d6
xor byte [eax], dl
inc eax
dec ecx
jne 0x1c81fe5
jmp 0x1c81ff8
pop ebp
sbb ebx, dword [ebp + 0x5f]
ljmp 0x2e17
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x33a03cd0
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x2aac6e31
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x4195ec
Capabilities:
Terminate process

Disassembly:
call fcn.004195f9
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x42cd80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20000]
lea eax, [edi + 0x23efc]
push dword [eax]
mov dword [eax], 0x250a84d0
push eax
push edi
or ebp, 0xffffffff
jmp 0x42cdb2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42cdb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42cda8
mov eax, 1
add ebx, ebx
jne 0x42cdcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42cdc0
jne 0x42cddc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42cdc0
xor ecx, ecx
sub eax, 3
jb 0x42cdf0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42ce62
mov ebp, eax
add ebx, ebx
jne 0x42cdfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42ce08
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42ce2c
inc ecx
add ebx, ebx
jne 0x42ce18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42ce0d
jne 0x42ce29
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ce0d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42ce4c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42ce3d
jmp 0x42cdae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42ce4c
add edi, ecx
jmp 0x42cdae
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xa40
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42ce6e
cmp byte [edi], 6
jne 0x42ce6e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42ce73
lea edi, [esi + 0x29000]
mov eax, dword [edi]
or eax, eax
je 0x42ceeb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2d6c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2d828]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42cea0
mov ecx, edi
jns 0x42cecf
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2d830]
or eax, eax
je 0x42cee5
mov dword [ebx], eax
add ebx, 4
jmp 0x42cebd
call dword [esi + 0x2d82c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x42cf1c
cmp al, 0xef
ja 0x42cf0f
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x42cef1
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x42cefe
mov ebp, dword [esi + 0x2d834]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42cf50
sub esp, 0xffffff80
jmp 0x415798
Function at 0x100023dc
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x10002429
mov al, cl
cmp al, 0x61
jb 0x10002404
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x10002429
mov al, cl
cmp al, 0x61
jb 0x1000241c
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x100023f5
cmp edx, dword [esp + 0x18]
je 0x10002439
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x100023ee
xor eax, eax
jmp 0x1000243c
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x10002444
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x1000252b
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x10002531
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10002490
cmp al, 0x61
jb 0x10002488
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1000247b
cmp edx, dword [esp + 0x14]
je 0x100024a0
dec ecx
jne 0x10002470
xor eax, eax
jmp 0x1000252b
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x1000252b
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x1000252b
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x100024dc
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x100024eb
jmp 0x100024d3
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.100023dc
test eax, eax
je 0x1000252b
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10002526
cmp al, 0x61
jb 0x1000251e
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10002511
call fcn.10002444
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x10002549
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x10002549
sub edx, ecx
mov ecx, edx
jmp 0x100024a0
xor eax, eax
jmp 0x1000252b

Function at 0x10003cde
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1005bd72]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10003d19
add dword [esp], 5
retf

Function at 0x10003deb
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [0x1005bd72]
mov dword [ebp - 8], eax
mov word [ebp - 4], fs
mov eax, 0x2b
mov fs, ax
and esp, 0xfffffff0
push 0x33
call 0x10003e26
add dword [esp], 5
retf
Function at 0x10005368
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100053b5
push 0x19
push 0x401ba6e
push 6
call fcn.100067de
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x100053e9
push 0x71
push 0x401ba6e
push 6
call fcn.100067de
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
mov eax, 0
sete al
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x10005427
push 0x9f
push 0x401ba6e
push 6
call fcn.100067de
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x1000542f
mov esp, ebp
pop ebp
ret 4
Function at 0x10005a9f
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x10005aec
mov al, cl
cmp al, 0x61
jb 0x10005ac7
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x10005aec
mov al, cl
cmp al, 0x61
jb 0x10005adf
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10005ab8
cmp edx, dword [esp + 0x18]
je 0x10005afc
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x10005ab1
xor eax, eax
jmp 0x10005aff
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x10005b07
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x10005bee
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x10005bf4
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005b53
cmp al, 0x61
jb 0x10005b4b
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005b3e
cmp edx, dword [esp + 0x14]
je 0x10005b63
dec ecx
jne 0x10005b33
xor eax, eax
jmp 0x10005bee
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x10005bee
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x10005bee
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x10005b9f
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x10005bae
jmp 0x10005b96
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.10005a9f
test eax, eax
je 0x10005bee
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10005be9
cmp al, 0x61
jb 0x10005be1
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10005bd4
call fcn.10005b07
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x10005c0c
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x10005c0c
sub edx, ecx
mov ecx, edx
jmp 0x10005b63
xor eax, eax
jmp 0x10005bee
Function at 0x10006df0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.100094c0
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call dword [0x1005c318]
add esp, 8
test ebx, ebx
je 0x10006f34
test eax, eax
je 0x10006f34
inc eax
push eax
call fcn.1000ab67
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1000ab40
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10006e62
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10006f21
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.1000ab67
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x10006eea
cmp eax, 0xea
jne 0x10006f0d
push esi
call fcn.1000ab28
mov ecx, dword [esp + 0x18]
push ecx
call fcn.1000ab67
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x10006eb5
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x10006ef8
cmp eax, 2
jne 0x10006f0d
push esi
call dword [0x1005c318]
push eax
push esi
call fcn.10008ee0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.1000ab28
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.1000ab28
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x10006f5d
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x10006f69
mov esi, dword [esp + 0x40]
test esi, esi
je 0x10006f69
push esi
call dword [0x1005c318]
push eax
push esi
call fcn.10008ee0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10006f90
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10007022
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10007014
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1000700c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x10006fd5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x10008740
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x1000874d
xor eax, eax
pop esi
ret
push esi
call dword [0x1005c318]
add esp, 4
test eax, eax
jne 0x1000875d
pop esi
ret
cmp eax, 1
jne 0x1000876b
cmp byte [esi], 0x5c
jne 0x1000876b
xor eax, eax
pop esi
ret
push esi
call fcn.100084f0
add esp, 4
test eax, eax
je 0x1000877f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x10009080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x100090a1
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x100090fb
inc edi
cmp edi, esi
jl 0x10009095
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x10009130
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x100090ea
cmp byte [eax], bl
je 0x10009105
cmp byte [eax + 1], bl
je 0x1000910e
cmp byte [eax + 2], bl
je 0x10009118
cmp byte [eax + 3], bl
je 0x10009124
add eax, 4
cmp eax, edi
jb 0x100090c1
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x490440
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6e000]
push edi
or ebp, 0xffffffff
jmp 0x490462
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x490469
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x490458
mov eax, 1
add ebx, ebx
jne 0x49047b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x49048c
jne 0x4904ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4904ab
dec eax
add ebx, ebx
jne 0x490498
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x490470
add ebx, ebx
jne 0x4904a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4904fd
xor ecx, ecx
sub eax, 3
jb 0x4904c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x490532
sar eax, 1
mov ebp, eax
jmp 0x4904ce
add ebx, ebx
jne 0x4904ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49049c
inc ecx
add ebx, ebx
jne 0x4904dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x49049c
add ebx, ebx
jne 0x4904e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4904de
jne 0x4904fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4904de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x49051c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x49050e
jmp 0x49045e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x49051c
add edi, ecx
jmp 0x49045e
pop esi
mov edi, esi
mov ecx, 0x1481
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x49053a
cmp byte [edi], 0x11
jne 0x49053a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x49053f
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x4905ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd6530]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd6574]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49056c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd657c]
or eax, eax
je 0x4905a8
mov dword [ebx], eax
add ebx, 4
jmp 0x490589
call dword [esi + 0xd6578]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4905df
cmp al, 0xef
ja 0x4905d2
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4905b4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4905c1
mov ebp, dword [esi + 0xd6580]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x490613
sub esp, 0xffffff80
jmp 0x4111b0
Function at 0x1124058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.011241a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x112407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x112406a
add dl, dl
jne 0x1124089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11240dc
xor eax, eax
add dl, dl
jne 0x1124096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x112417d
add dl, dl
jne 0x11240a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11240b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11240bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11240c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11240d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1124075
mov eax, 1
add dl, dl
jne 0x11240ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11240f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11240e1
sub eax, ebx
mov ebx, 1
jne 0x1124128
mov ecx, 1
add dl, dl
jne 0x112410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1124119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1124105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1124075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x112413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x112414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1124136
cmp eax, 0x7d00
jae 0x112416d
cmp eax, 0x500
jb 0x1124168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1124075
cmp eax, 0x7f
ja 0x1124170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1124075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x112419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1124075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10