joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100476c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x1014ac8]
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp ecx, edi
je 0x100483a
cmp dword [ebp + 0x10], edi
je 0x1004843
mov eax, dword [0x1014acc]
cmp eax, edi
push esi
jne 0x10047f9
mov eax, dword [ebp + 0x18]
push 0x100c440
push 0x1014acc
push 0x640
push 0x1014480
push ecx
mov dword [0x100c450], eax
mov dword [0x100c448], edi
mov dword [0x100c44c], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call esi
cmp eax, 0x3e5
jne 0x10047da
xor edi, edi
jmp 0x1004839
test edi, edi
jne 0x10047e8
call esi
and dword [0x1014acc], edi
jmp 0x1004832
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x1014acc]
test eax, eax
je 0x1004832
mov ebx, dword [ebp + 0xc]
cmp eax, ebx
jae 0x1004802
mov ebx, eax
mov esi, dword [0x1014ad0]
mov edi, dword [ebp + 8]
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea esi, [esi + 0x1014480]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add dword [0x1014ad0], ebx
sub dword [0x1014acc], ebx
push 1
pop edi
jne 0x1004839
and dword [0x1014ad0], 0
pop esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1004843
mov dword [eax], ebx
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x10049de
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x900
mov eax, dword [0x100b928]
cmp eax, 0xffffffff
jne 0x1004a1b
push 0
push 2
push 2
call dword [sym.imp.WSOCK32.dll_socket]
cmp eax, 0xffffffff
mov dword [0x100b928], eax
jne 0x1004a1b
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov eax, dword [0x100b928]
cmp eax, 0xffffffff
je 0x1004aad
and dword [ebp - 4], 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push 0x2003
push 0xffff
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.WSOCK32.dll_getsockopt]
mov eax, dword [ebp - 4]
mov ecx, 0x8000
cmp eax, ecx
jb 0x1004a4d
mov eax, ecx
shr eax, 2
shl eax, 2
mov dword [ebp - 4], eax
mov dword [0x100b92c], eax
lea eax, [ebp - 0xc]
push eax
push 0x8f4
lea eax, [ebp - 0x900]
push eax
push 6
push 0xffffffffffffffff
push 0
call sub.WINSTA.dll_WinStationQueryInformationW
test al, al
je 0x1004aa7
cmp dword [ebp - 0x458], 2
movzx eax, byte [ebp - 0x45c]
mov dword [0x100b930], eax
jne 0x1004aad
lea eax, [ebp - 0x454]
push eax
call fcn.01004456
cmp eax, 0xffffffff
je 0x1004aad
mov dword [0x1014b40], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x1004c0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 0xc], 0xffffffff
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1004ad0
push 0x80000002
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004d5f
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1004b68
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1004c72
mov eax, dword [ebp - 0xc]
mov dword [0x100b920], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1004b84
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1004c95
mov eax, dword [ebp - 0xc]
mov dword [0x1014b1c], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1004ba0
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1004cb8
mov eax, dword [ebp - 0xc]
mov dword [0x1014b20], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1004bbc
push dword [ebp - 8]
call esi
test eax, eax
jne 0x1004cdb
mov eax, dword [ebp - 0xc]
mov dword [0x1014b24], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1004bdc
push dword [ebp - 8]
mov dword [ebp - 0x10], 3
mov dword [ebp - 4], edi
call esi
cmp eax, 0xea
jne 0x1004d5d
mov eax, dword [0x1014b28]
cmp eax, edi
mov ebx, dword [sym.imp.msvcrt.dll_free]
je 0x1004d16
push eax
call ebx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, edi
pop ecx
mov dword [0x1014b28], eax
je 0x1004d5d
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0x1004bf4
push dword [ebp - 8]
call esi
test eax, eax
je 0x1004d52
push dword [0x1014b28]
call ebx
pop ecx
mov dword [0x1014b28], edi
jmp 0x1004d5d
mov eax, dword [ebp - 4]
shr eax, 3
mov dword [0x1014b2c], eax
pop esi
pop ebx
cmp dword [ebp - 8], edi
pop edi
je 0x1004d6e
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1005574
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x24
push 0x1001660
call fcn.0100721c
and dword [ebp - 0x1c], 0
cmp dword [0x100b930], 2
jb 0x10055af
push dword [ebp + 0x10]
mov eax, dword [0x1014b44]
shl eax, 8
movzx ecx, byte [ebp + 8]
add eax, ecx
push eax
push dword [ebp + 0xc]
call fcn.01004484
test eax, eax
je 0x10056a3
and dword [ebp - 4], 0
mov eax, dword [0x100b92c]
add eax, 3
and eax, 0xfffffffc
call fcn.01007270
mov dword [ebp - 0x18], esp
mov ebx, esp
mov dword [ebp - 0x20], ebx
jmp 0x10055d6
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x10056a3
cmp dword [0x100b930], 2
sbb al, al
and al, 0xf9
add al, 9
mov byte [ebx], al
mov ax, word [0x1014afc]
mov word [ebx + 6], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov word [ebx + 4], ax
mov eax, dword [0x1014b44]
shl eax, 8
movzx ecx, byte [ebp + 8]
add eax, ecx
mov dword [ebx + 8], eax
mov word [ebp - 0x30], 2
mov ax, word [0x1014b3c]
mov word [ebp - 0x2e], ax
mov eax, dword [0x1014b40]
mov dword [ebp - 0x2c], eax
jmp 0x1005696
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 0xc]
mov eax, dword [0x100b92c]
cmp edx, eax
jae 0x1005646
mov eax, ecx
mov dword [ebp - 0x34], eax
jmp 0x100564c
add eax, 0xfffffff4
mov dword [ebp - 0x34], eax
lea ecx, [eax + 8]
mov word [ebx + 2], cx
mov ecx, eax
mov esi, dword [ebp + 0xc]
lea edi, [ebx + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [eax + 0xc]
push 0x10
lea eax, [ebp - 0x30]
push eax
push 0
push esi
push ebx
push dword [0x100b928]
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
je 0x10056b1
mov dword [0x1014b38], esi
mov eax, dword [ebp - 0x34]
sub dword [ebp + 0x10], eax
add dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 0
jne 0x1005630
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x40]
call fcn.01007255
ret 0xc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x10056a3

Function at 0x10056ba
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
add esp, 0x190
ret

Function at 0x1005a44
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 8], 6
mov word [ebp - 6], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x100b928]
and word [ebp - 2], 0
cmp edx, 0xffffffff
mov word [ebp - 4], ax
je 0x1005ab0
mov ecx, dword [0x1014b3c]
test ecx, ecx
je 0x1005ab0
mov eax, dword [0x1014b40]
test eax, eax
je 0x1005ab0
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 8
lea eax, [ebp - 8]
push eax
push edx
mov word [ebp - 0x18], 2
mov word [ebp - 0x16], cx
call dword [sym.imp.WSOCK32.dll_sendto]
cmp eax, 0xffffffff
jne 0x1005ac5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
leave
ret
push 8
lea eax, [ebp - 8]
push eax
call fcn.01004648
test eax, eax
jne 0x1005ac5
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
Function at 0x1005ac8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp word [esi + 2], 0
je 0x1005ade
cmp dword [esi + 8], 0
je 0x1005bc6
call fcn.01004990
test eax, eax
je 0x1005bc6
movzx eax, byte [esi]
sub eax, 5
je 0x1005b49
dec eax
jne 0x1005bc1
cmp word [esi + 2], 4
jb 0x1005bc1
mov esi, dword [esi + 8]
sub esi, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
movzx eax, word [esi + 4]
and ecx, 0xffff
sub ecx, eax
mov eax, dword [0x1014b30]
test eax, eax
jne 0x1005b33
mov dword [0x1014b30], ecx
jmp 0x1005bc1
imul eax, eax, 7
lea ecx, [ecx + ecx*2]
add eax, ecx
push 0xa
xor edx, edx
pop ecx
div ecx
mov dword [0x1014b30], eax
jmp 0x1005bc1
mov esi, dword [esi + 8]
movzx eax, word [esi]
sub esi, 4
push edi
push eax
call fcn.0100458c
mov edi, dword [0x100c478]
mov al, byte [esi + 6]
mov cl, byte [edi + 0x15]
sub cl, al
cmp cl, 8
ja 0x1005bc0
push ebx
mov bl, byte [edi + 0x16]
mov cl, al
sub cl, bl
cmp cl, 8
jae 0x1005bb3
inc al
cmp bl, al
je 0x1005bab
push ebp
movzx eax, bl
cdq
push 8
pop ebp
idiv ebp
xor eax, eax
mov ecx, 0x2000
shl edx, 0xf
lea edi, [edx + edi + 0x1c]
rep stosd dword es:[edi], eax
mov al, byte [esi + 6]
mov edi, dword [0x100c478]
inc bl
inc al
cmp bl, al
jne 0x1005b80
pop ebp
mov al, byte [esi + 6]
inc al
mov byte [edi + 0x16], al
push dword [0x1014ad8]
call dword [sym.imp.KERNEL32.dll_PulseEvent]
pop ebx
pop edi
call fcn.010049c4
pop esi
ret 4

Function at 0x1005ea2
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x100b928], 0xffffffff
je 0x1005f53
push ebx
push esi
push edi
mov esi, 0x100c3a8
mov ebx, 0x100c3c0
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor edi, edi
push edi
push esi
push edi
push edi
mov dword [0x100c3b8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x1014ac0
push dword [0x100b928]
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [0x1014ac0], 0x80
mov dword [0x1014ac4], ebx
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x1005f3d
mov ecx, dword [ebp + 0xc]
cmp ecx, edi
je 0x1005f1f
mov eax, dword [ebp + 0x10]
cmp eax, edi
jne 0x1005f49
cmp dword [ebp - 4], 4
jb 0x1005ec2
mov eax, dword [0x100c3c0]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x18], 0x100c3c4
call fcn.01005ac8
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1005ec2
jmp 0x1005f50
mov dword [ecx], ebx
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10060b4
Capabilities:
Send data
Send data on socket

Disassembly:
push 0x38
push 0x1001670
call fcn.0100721c
xor edx, edx
mov dword [ebp - 0x1c], edx
cmp dword [ebp + 8], edx
je 0x1006222
cmp dword [0x100b928], 0xffffffff
je 0x1006222
cmp dword [0x1014b3c], edx
je 0x1006222
mov eax, dword [0x100b92c]
cmp eax, 8
jb 0x1006222
cmp dword [0x1014b40], edx
je 0x1006222
mov ecx, 0x400
cmp eax, ecx
mov dword [ebp - 0x20], eax
jb 0x1006110
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x20]
add eax, 3
and eax, 0xfffffffc
call fcn.01007270
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x24], esi
jmp 0x1006134
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x1006222
mov ebx, dword [ebp - 0x20]
push ebx
push esi
call fcn.01004ab0
mov word [ebp - 0x34], 2
mov ax, word [0x1014b3c]
mov word [ebp - 0x32], ax
mov eax, dword [0x1014b40]
mov dword [ebp - 0x30], eax
mov byte [esi], 6
lea eax, [ebx - 4]
mov word [esi + 2], ax
mov word [esi + 6], 0x400
mov dword [ebp - 0x38], 0xa
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov word [esi + 4], ax
push 0x10
lea eax, [ebp - 0x34]
push eax
push 0
push ebx
mov ebx, dword [sym.imp.WSOCK32.dll_sendto]
jmp 0x1006260
and dword [ebp - 0x3c], 0
and dword [ebp - 0x40], 0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 8]
call fcn.01005ea2
cmp dword [ebp - 0x3c], 0
jne 0x10061f1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1014ae4]
mov dword [ebp - 0x44], eax
push 0x3e8
push 0
lea eax, [ebp - 0x48]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp eax, 1
je 0x1006222
cmp eax, 0x102
je 0x100624a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.01005f58
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1006199
cmp dword [ebp - 0x40], 8
jne 0x1006199
cmp byte [eax], 6
jne 0x1006199
cmp word [eax + 2], 4
ja 0x1006199
cmp dword [ebp - 0x38], 0
je 0x1006222
call edi
movzx eax, ax
mov ecx, dword [ebp - 0x3c]
movzx ecx, word [ecx + 4]
sub eax, ecx
inc eax
mov dword [ebp - 0x1c], eax
xor eax, eax
cmp dword [ebp - 0x1c], eax
je 0x100623f
mov eax, dword [ebp - 0x3c]
movzx eax, word [eax + 6]
add eax, 8
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0x1c]
inc eax
lea esp, [ebp - 0x54]
call fcn.01007255
ret 4
dec dword [ebp - 0x38]
je 0x100620a
call edi
mov word [esi + 4], ax
push 0x10
lea eax, [ebp - 0x34]
push eax
push 0
push dword [ebp - 0x20]
push esi
push dword [0x100b928]
call ebx
cmp eax, 0xffffffff
jne 0x1006199
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
jmp 0x1006222

Function at 0x100700c
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
lea eax, [esp + 4]
push eax
push esi
push esi
push 0x1006940
push esi
push esi
mov dword [0x100b91c], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x1014b48], eax
jne 0x100703f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1007042
xor esi, esi
inc esi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x1007700
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0x100783b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0x1007810
test eax, eax
jne 0x1007810
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0x1007750
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0x100783b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x1007810
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x1007ac0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
mov esi, dword [esp + 0x60]
mov edx, dword [esi + 0x30]
mov eax, edx
and eax, 0x3f
mov ebx, 0x40
sub ebx, eax
cmp ebx, 8
push edi
ja 0x1007ae2
add ebx, 0x40
lea ecx, [ebx - 6]
mov ebp, ecx
shr ecx, 2
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esi + 0x2c]
mov eax, edx
shl ecx, 3
shr eax, 0x1d
or ecx, eax
mov dword [esp + 0x10], ecx
lea ecx, [edx*8]
push 2
lea edx, [esp + 0x14]
push edx
lea eax, [esp + ebx + 0x18]
push eax
mov byte [esp + 0x24], 0x80
mov dword [esp + 0x20], ecx
call fcn.01009230
push ebx
lea ecx, [esp + 0x1c]
push ecx
push esi
call fcn.010079a0
mov edx, dword [esp + 0x68]
push 5
lea edi, [esi + 0x18]
push edi
push edx
call fcn.01009230
xor eax, eax
mov dword [edi], 0x67452301
pop edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x1c], 0xefcdab89
mov dword [esi + 0x20], 0x98badcfe
mov dword [esi + 0x24], 0x10325476
mov dword [esi + 0x28], 0xc3d2e1f0
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 8
Function at 0x1022185
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [esi]
pop esi
add esi, dword [edi + eax*4]
lea edx, [ebp - 0x55b4bcef]
test ecx, esi
xchg edx, eax
inc edx
xchg al, dl
ret 4
wait
jne 0x101d60d
lea esi, [ebx]
lea edi, [ebx]
jmp 0x101d639
cmp byte [edi], 1
mov esp, esp
pop eax
ja 0x1022144
xor eax, 0x4f0752f7
wait
sbb eax, dword [esp + 4]
jmp 0x101d5e1
pop ecx
lodsd eax, dword [esi]
inc ecx
jmp 0x1022272
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
xor dl, 0x22
lea esi, [esi + ecx*2]
push ebx
jmp 0x101d5c4
pop eax
imul eax, eax, 0xf
push eax
jmp 0x102222e
mov edx, ebx
mov esi, ebx
mov eax, ebx
jmp 0x1022190
xor cl, dl
add eax, dword [ebx + 0x3c]
mov ch, 0x6c
add edx, dword [eax + 0x78]
mov cl, 0x59
push 0xffffffffffffffff
not edi
add esi, dword [edx + 0x20]
jmp 0x101d60c
ret
movzx eax, byte [edi]
sub dword [esp], eax
lea edi, [edi + 1]
jmp 0x101d5f1
cmp ecx, dword [edx + 0x18]
lea edi, [eax + ebx]
nop
je 0x102222d
push 0
jmp 0x1022143
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2bf52bf9
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2a20349
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x3ce5ebb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x3ce5ebd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x3ce5ebd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x3ce5ebc8
mov eax, 1
add ebx, ebx
jne 0x3ce5ebeb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x3ce5ebe0
jne 0x3ce5ebfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x3ce5ebe0
xor ecx, ecx
sub eax, 3
jb 0x3ce5ec10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x3ce5ec82
mov ebp, eax
add ebx, ebx
jne 0x3ce5ec1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x3ce5ec28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x3ce5ec4c
inc ecx
add ebx, ebx
jne 0x3ce5ec38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x3ce5ec2d
jne 0x3ce5ec49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x3ce5ec2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x3ce5ec6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x3ce5ec5d
jmp 0x3ce5ebce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x3ce5ec6c
add edi, ecx
jmp 0x3ce5ebce
pop esi
mov edi, esi
mov ecx, 0x214
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x3ce5ec8a
cmp byte [edi], 4
jne 0x3ce5ec8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x3ce5ec8f
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x3ce5ecfe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xed04]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xed54]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x3ce5ecbc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xed58]
or eax, eax
je 0x3ce5ecf8
mov dword [ebx], eax
add ebx, 4
jmp 0x3ce5ecd9
call dword [esi + 0xed60]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x3ce5ed2f
cmp al, 0xef
ja 0x3ce5ed22
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x3ce5ed04
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x3ce5ed11
mov ebp, dword [esi + 0xed5c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x3ce5ed63
sub esp, 0xffffff80
jmp 0x3ce51a50
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4050f0
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, 0x1854
call fcn.004167d0
mov eax, dword [0x70c7ec]
mov ecx, dword [0x7096f4]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x405265
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov ebp, dword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x70c7ec], 0x959
jne 0x40524b
push 0
push 0
call edi
lea eax, [esp + 0x40]
push eax
call ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xc64]
push edx
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x464]
push ecx
push 0
push 0x403734
push 0x403770
push 0x4037b0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
lea edx, [esp + 0x24]
push edx
push 0
call esi
push 0
push 0
push 0
lea eax, [esp + 0x106c]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0
lea ecx, [esp + 0x64]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0x4037d0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0x403830
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
push 0
push 0x403834
push 0x403840
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0x403868
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00404f10
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x405134
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1854
ret