joyce8/EMBER2024-capa huggingface dataset:
Function at 0x298012b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x298012c6
pop dword [ebp - 0x40]
mov eax, 0x1f0700a9
sub eax, 0xf586ede3
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x4da53526
sub dword [ebp - 0x50], 0xff52efdb
mov dword [ebp - 0x4c], 0x478e8fae
sub dword [ebp - 0x4c], 0x155b4369
mov dword [ebp - 0x48], 0xcf4d4eeb
add dword [ebp - 0x48], 0x7cfef543
mov dword [ebp - 0x44], 0x371731fa
sub dword [ebp - 0x44], 0x371731fa
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x1994ee3a
add dword [ebp - 0x50], 0x5add7b1c
mov dword [ebp - 0x4c], 0xf134835e
sub dword [ebp - 0x4c], 0xafc821e9
mov dword [ebp - 0x48], 0x7e5924f8
sub dword [ebp - 0x48], 0x1ae9b88c
mov dword [ebp - 0x44], 0x79ff8af7
sub dword [ebp - 0x44], 0x79ff8af7
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe46d6aef
sub eax, 0xbae7fa37
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x4c06b
push 0
call eax
mov ecx, 0x5aef02fe
sub ecx, 0x5aeeaad3
xor edx, edx
add edx, eax
mov esi, 0xcf99fff9
add esi, 0x59ef6407
add esi, dword [ebp - 0x40]
mov ebx, 0x3baa90dc
add dword [ebp - 0x34], edx
mov edi, dword [esi]
mov dword [ebp - 0x30], 0x4c328e08
sub edi, ebx
mov dword [edx], edi
xor dword [ebp - 0x30], 0x5378f650
add edx, 0x968b1482
sub edx, 0x968b147e
add esi, 0x487dad67
add esi, 0xb782529d
loop 0x298013df
add eax, 0xfaaa049
sub eax, 0xfa94cca
mov ebx, eax
add eax, 0xd716c8f4
sub eax, 0xd716c8ef
mov ecx, 0x6078114b
sub ecx, 0x36f8114b
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x402a90
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
mov eax, dword [0x405018]
imul eax, dword [0x405018]
sub eax, 3
mov dword [0x405014], eax
and dword [ebp - 0x14], 0
jmp 0x402aeb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
add eax, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14], eax
jge 0x402c7c
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x402bfc
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
cmp dword [ebp - 4], 0
jle 0x402be3
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
push 0x1000
push dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
push dword [ebp - 4]
push 0
push dword [ebp - 0xc]
call fcn.0040197e
add esp, 0xc
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
jmp 0x402adb
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
push 4
push 0x1000
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
mov eax, dword [0x405018]
xor edx, edx
push 0xc
pop ecx
div ecx
mov dword [0x405018], eax
mov eax, dword [ebp - 8]
push dword [eax + 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xc]
call fcn.00401940
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
jmp 0x402adb
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
push 0x40ba60
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
leave
ret
Function at 0x402ef3
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 0xa0
mov dword [ebp - 0xc], eax
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 4], 0
jbe 0x4030d5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, dword [eax]
mov dword [ebp - 0x10], ecx
push 0x40ba60
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x405018]
imul eax, dword [0x405018]
sub eax, 3
mov dword [0x405014], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jbe 0x4030d5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add ecx, dword [eax]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x10]
add eax, 8
mov dword [ebp - 0x18], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
mov eax, dword [0x405018]
imul eax, dword [0x405018]
sub eax, 3
mov dword [0x405014], eax
and dword [ebp - 8], 0
jmp 0x402fb5
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 8], eax
jae 0x403093
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
sar eax, 0xc
mov dword [ebp - 0x20], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x405014]
imul eax, eax, 0x63
mov dword [0x405014], eax
mov eax, dword [ebp - 0x18]
movzx eax, word [eax]
and eax, 0xfff
mov dword [ebp - 0x24], eax
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40302d
cmp dword [ebp - 0x28], 3
je 0x40302f
jmp 0x403081
jmp 0x40308e
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [0x405014]
mov ecx, dword [0x405018]
lea eax, [ecx + eax - 9]
mov dword [0x405014], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
jmp 0x40308e
mov eax, dword [0x405018]
shl eax, 3
mov dword [0x405018], eax
jmp 0x402fa6
push 0x40ba60
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 4]
mov dword [ebp - 0x10], ecx
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
jmp 0x402f60
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
leave
ret
Function at 0x4037ef
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x403818
cmp al, 0x22
je 0x403810
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403804
cmp byte [esi], 0x22
jne 0x403822
inc esi
jmp 0x403822
cmp al, 0x20
jle 0x403822
inc esi
cmp byte [esi], 0x20
jg 0x40381c
mov al, byte [esi]
test al, al
je 0x40382c
cmp al, 0x20
jle 0x403815
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040389a
push 0x405004
push section..data
call fcn.00403880
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40385c
movzx eax, word [ebp - 0x14]
jmp 0x40385f
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004038b2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10001a8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1002b3f0
test dword [eax - 0x4f000007], esp
mov byte [ebp - 0x65f], 0x9d
mov byte [ebp - 0x65e], 0x99
mov byte [ebp - 0x65d], 0x88
mov byte [ebp - 0x65c], 0xb9
mov byte [ebp - 0x65b], 0x94
mov byte [ebp - 0x65a], 0x94
mov byte [ebp - 0x659], 0x97
mov byte [ebp - 0x658], 0x9b
mov byte [ebp - 0x657], 0xf8
lea eax, [ebp - 0x664]
push eax
call fcn.1002a8d6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002a88b
add esp, 0xc
mov dword [ebp - 0x67c], eax
and byte [ebp - 0x524], 0
and byte [ebp - 0x523], 0
mov byte [ebp - 0x522], 0x15
and byte [ebp - 0x521], 0
mov byte [ebp - 0x520], 0xa2
mov byte [ebp - 0x51f], 0x8f
mov byte [ebp - 0x51e], 0x8b
mov byte [ebp - 0x51d], 0x9a
mov byte [ebp - 0x51c], 0xac
mov byte [ebp - 0x51b], 0x98
mov byte [ebp - 0x51a], 0x8f
mov byte [ebp - 0x519], 0x8f
mov byte [ebp - 0x518], 0xea
lea eax, [ebp - 0x524]
push eax
call fcn.1002a8d6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002a88b
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.1002a8c6
jle 0x1002b543
inc ecx
pop eax
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.1002a8d6
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.1002a88b
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.1002a8c6
invalid
invalid

Function at 0x100025a9
Capabilities:
Create pipe

Disassembly:
jmp 0x1003f480
mov ecx, dword [esp + 4]
cmp dword [ecx + 0x14], 8
jb 0x1003f48c
mov ecx, dword [ecx]
mov eax, dword [esp + 8]
push 0
push dword [esp + 0x10]
or eax, 0x40000000
push 0x1000
push 0x1000
push 1
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
ret 0xc

Function at 0x100026bc
Capabilities:
Connect pipe

Disassembly:
jmp 0x1003f870
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x20]
cmp edi, 0xffffffff
je 0x1003f8f8
push 4
call fcn.100015c8
test al, al
je 0x1003f8f8
lea eax, [esi + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1003f8f1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x217
je 0x1003f8f8
call edi
mov dword [esp + 8], eax
mov ecx, esi
cmp eax, 0x3e5
je 0x1003f8c3
push eax
call fcn.10003afd
pop edi
xor al, al
pop esi
pop ecx
ret 4
lea eax, [esp + 8]
push eax
push dword [esp + 0x14]
call fcn.10003dc3
test al, al
jne 0x1003f8f1
push dword [esp + 8]
mov ecx, esi
call fcn.10003afd
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CancelIo]
pop edi
xor al, al
pop esi
pop ecx
ret 4
mov dword [esi + 4], 4
cmp dword [esi + 4], 4
pop edi
sete al
pop esi
pop ecx
ret 4
Function at 0x100035cb
Capabilities:
Inspect section memory permissions

Disassembly:
jmp 0x1002af00
cmp dword [eax + 4], ebx
jne 0x1002ae6b
cmp dword [eax + 0xc], ebx
je 0x1002af0e
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1002a8c6
sub dword [edx + 0x5d398e7b], eax
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x1002ae5d
call fcn.1002a8c6
dec edx
rcl dh, 0xc0
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x1002af7a
add eax, esi
cmp dword [eax], ebx
je 0x1002af7a
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1002af75
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1002af5f
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1002af67
cmp edx, ebx
jne 0x1002b0b5
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1002af36
add eax, dword [eax + 4]
jmp 0x1002af23
mov dword [ebp + 0xc], ebx
jmp 0x1002af85
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1002af9d
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1002afbb
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1002b019
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1002b000
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1002b009
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1002b013
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1002aff5
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1002af7f
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1002b066
dec eax
je 0x1002b05d
sub eax, 3
je 0x1002b054
mov dword [ebp - 4], 0x40
jmp 0x1002b083
mov dword [ebp - 4], 4
jmp 0x1002b069
mov dword [ebp - 4], 0x20
jmp 0x1002b069
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1002b0b5
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1002b035
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1002a8c6
jl 0x1002b0d5
cmp ebp, dword [edi + edi*8 + 0x75]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x1002b0c1
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
invalid
Function at 0x1003df60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049040
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100554d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov dword [ebp - 4], 0
call dword [eax + 0xc]
lea esi, [edi + 0x30]
push esi
mov dword [ebp - 0x10], esi
call sub.MSVCP140.dll__Mtx_lock
add esp, 4
test eax, eax
je 0x1003dfaf
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
add esp, 4
lea eax, [ebp + 8]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 8]
call fcn.10004caf
cmp dword [edi + 0x2c], 0
jne 0x1003dfcb
mov byte [ebp - 4], 2
jmp 0x1003dfd6
mov ecx, edi
call fcn.100030ad
mov byte [ebp - 4], 3
push esi
call sub.MSVCP140.dll__Mtx_unlock
add esp, 4
test eax, eax
je 0x1003dfec
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
add esp, 4
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x1003e004
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x28

Function at 0x1003f871
Capabilities:
Connect pipe

Disassembly:
jmp 0x1003f870
push ecx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x20]
cmp edi, 0xffffffff
je 0x1003f8f8
push 4
call fcn.100015c8
test al, al
je 0x1003f8f8
lea eax, [esi + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1003f8f1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x217
je 0x1003f8f8
call edi
mov dword [esp + 8], eax
mov ecx, esi
cmp eax, 0x3e5
je 0x1003f8c3
push eax
call fcn.10003afd
pop edi
xor al, al
pop esi
pop ecx
ret 4
lea eax, [esp + 8]
push eax
push dword [esp + 0x14]
call fcn.10003dc3
test al, al
jne 0x1003f8f1
push dword [esp + 8]
mov ecx, esi
call fcn.10003afd
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CancelIo]
pop edi
xor al, al
pop esi
pop ecx
ret 4
mov dword [esi + 4], 4
cmp dword [esi + 4], 4
pop edi
sete al
pop esi
pop ecx
ret 4
Function at 0x40b8c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x40b8da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40b8e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40b8d0
mov eax, 1
add ebx, ebx
jne 0x40b8f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40b8e8
jne 0x40b904
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b8e8
xor ecx, ecx
sub eax, 3
jb 0x40b918
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40b98a
mov ebp, eax
add ebx, ebx
jne 0x40b923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40b930
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40b954
inc ecx
add ebx, ebx
jne 0x40b940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40b935
jne 0x40b951
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b935
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40b974
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40b965
jmp 0x40b8d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40b974
add edi, ecx
jmp 0x40b8d6
pop esi
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40b9d3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe948]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe9a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40b991
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe9a8]
or eax, eax
je 0x40b9cd
mov dword [ebx], eax
add ebx, 4
jmp 0x40b9ae
call dword [esi + 0xe9a4]
mov ebp, dword [esi + 0xe9ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40ba07
sub esp, 0xffffff80
jmp 0x4022b0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xec6830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x86c000]
push edi
or ebp, 0xffffffff
jmp 0xec6852
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xec6859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec6848
mov eax, 1
add ebx, ebx
jne 0xec686b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xec687c
jne 0xec689b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec689b
dec eax
add ebx, ebx
jne 0xec6888
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xec6860
add ebx, ebx
jne 0xec6897
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xec68ed
xor ecx, ecx
sub eax, 3
jb 0xec68b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xec6922
sar eax, 1
mov ebp, eax
jmp 0xec68be
add ebx, ebx
jne 0xec68be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec688c
inc ecx
add ebx, ebx
jne 0xec68cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xec688c
add ebx, ebx
jne 0xec68d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xec68ce
jne 0xec68ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xec68ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xec690c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xec68fe
jmp 0xec684e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xec690c
add edi, ecx
jmp 0xec684e
pop esi
mov edi, esi
mov ecx, 0x30a83
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xec692a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xec692f
lea edi, [esi + 0xac2000]
mov eax, dword [edi]
or eax, eax
je 0xec6997
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xaccf98]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xacd100]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xec6955
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xacd104]
or eax, eax
je 0xec6991
mov dword [ebx], eax
add ebx, 4
jmp 0xec6972
call dword [esi + 0xacd114]
mov ebp, dword [esi + 0xacd108]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xec69cb
sub esp, 0xffffff80
jmp 0xa18064