joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007b74
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
jne 0x10007c83
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x10007c83
mov edi, 0x2000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push edi
push dword [esi + 0x50]
push dword [esi + 0x34]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jne 0x10007bcc
push 4
push edi
push dword [esi + 0x50]
push eax
call ebx
test eax, eax
mov dword [ebp - 4], eax
je 0x10007c83
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov eax, dword [ebp - 4]
xor ecx, ecx
push 4
push 0x1000
mov dword [edi + 4], eax
mov dword [edi + 0xc], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x10], ecx
push dword [esi + 0x50]
push eax
call ebx
push 4
push 0x1000
push dword [esi + 0x54]
push dword [ebp - 4]
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x3c]
add ecx, dword [esi + 0x54]
push ecx
push ebx
push eax
call fcn.100093a0
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 4]
push edi
push esi
mov dword [edi], eax
push ebx
mov dword [eax + 0x34], ecx
call fcn.10007c91
mov ebx, dword [ebp - 4]
add esp, 0x18
mov eax, ebx
sub eax, dword [esi + 0x34]
je 0x10007c4e
push eax
push edi
call fcn.10007dfb
pop ecx
pop ecx
push edi
call fcn.10007e75
test eax, eax
pop ecx
je 0x10007c7c
push edi
call fcn.10007d3e
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x10007c8a
add eax, ebx
test eax, eax
je 0x10007c7c
push 0
push 1
pop esi
push esi
push ebx
call eax
test eax, eax
jne 0x10007c87
push edi
call fcn.1000802f
pop ecx
xor eax, eax
jmp 0x10007c8c
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10007c91
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push esi
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], ecx
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x10007d3b
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esi, 0x10
mov ebx, 0x1000
cmp dword [esi], 0
jne 0x10007cfc
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 0xc], eax
jle 0x10007d25
push 4
push ebx
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 8]
push eax
call edi
push dword [ebp - 0xc]
mov dword [esi - 8], eax
push 0
push eax
call fcn.10009c20
add esp, 0xc
jmp 0x10007d25
mov eax, dword [esi - 4]
push 4
add eax, dword [ebp - 8]
push ebx
push dword [esi]
push eax
call edi
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
call fcn.100093a0
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi - 8], eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, 0x28
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x10007cca
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10008acb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push dword [ebp + 0x18]
push eax
push 0x10008a93
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000b30d
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
leave
ret

Function at 0x10008b25
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x10008b44
mov dl, byte [ecx + eax]
sub dl, 0x31
xor dl, 0xfc
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x10008b31
ret

Function at 0x10008b45
Capabilities:
Enumerate processes

Disassembly:
push ebx
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, 0x128
mov ebx, eax
push edi
call fcn.10009cf4
pop ecx
mov esi, eax
push esi
push ebx
mov dword [esi], edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10008b9e
push dword [esp + 0x10]
lea edi, [esi + 0x24]
push edi
call fcn.1000e600
pop ecx
pop ecx
jmp 0x10008b95
push esi
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x10008b9e
push dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10008b7f
mov eax, dword [esi + 8]
jmp 0x10008ba0
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x10008ba4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e510
push 0x1000ad50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
push str.user32.dll
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call edi
mov ebx, eax
mov dword [ebp - 0x2c], ebx
push str.GetThreadDesktop
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x3c], eax
push str.GetUserObjectInformationA
push ebx
call esi
mov dword [ebp - 0x20], eax
push str.SetThreadDesktop
push ebx
call esi
mov dword [ebp - 0x140], eax
push str.CloseDesktop
push ebx
call esi
mov dword [ebp - 0x38], eax
push str.kernel32.dll
call edi
mov dword [ebp - 0x30], eax
push str.GetCurrentThreadId
push eax
call esi
call eax
push eax
call dword [ebp - 0x3c]
mov esi, eax
mov dword [ebp - 0x28], 1
xor edi, edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x34]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x13c]
push eax
push 2
push dword [ebp + 8]
call dword [ebp - 0x20]
test eax, eax
je 0x10008c60
push dword [ebp + 8]
call dword [ebp - 0x140]
test eax, eax
jne 0x10008c65
mov dword [ebp - 0x28], edi
jmp 0x10008c69
push esi
call dword [ebp - 0x38]
or dword [ebp - 4], 0xffffffff
call fcn.10008c87
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10008ca2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e520
push 0x1000ad50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
push edi
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x44], 0x4f
mov byte [ebp - 0x43], 0x70
mov byte [ebp - 0x42], 0x65
mov byte [ebp - 0x41], 0x6e
mov byte [ebp - 0x40], 0x49
mov byte [ebp - 0x3f], 0x6e
mov byte [ebp - 0x3e], 0x70
mov byte [ebp - 0x3d], 0x75
mov byte [ebp - 0x3c], 0x74
mov byte [ebp - 0x3b], 0x44
mov byte [ebp - 0x3a], 0x65
mov byte [ebp - 0x39], 0x73
mov byte [ebp - 0x38], 0x6b
mov byte [ebp - 0x37], 0x74
mov byte [ebp - 0x36], 0x6f
mov byte [ebp - 0x35], 0x70
xor ebx, ebx
mov byte [ebp - 0x34], bl
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x1c], eax
push str.OpenDesktopA
push dword [ebp - 0x24]
call esi
mov edi, eax
push str.CloseDesktop
push dword [ebp - 0x24]
call esi
mov esi, eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
push 0x1ff
push ebx
push ebx
je 0x10008d5f
push dword [ebp + 8]
call edi
jmp 0x10008d62
call dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x10008d79
push eax
call fcn.10008ba4
pop ecx
test eax, eax
jne 0x10008d7c
push dword [ebp - 0x2c]
call esi
mov dword [ebp - 0x20], ebx
or dword [ebp - 4], 0xffffffff
call fcn.10008d99
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10008da8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ADVAPI32.dll
mov byte [ebp - 1], 1
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
push str.OpenProcessToken
push ebx
call esi
push str.AdjustTokenPrivileges
push ebx
mov dword [ebp - 0x10], eax
call esi
push str.LookupPrivilegeValueA
push ebx
mov dword [ebp - 0x18], eax
call esi
push str.kernel32.dll
mov dword [ebp - 0x14], eax
call edi
push str.GetCurrentProcess
push eax
mov dword [ebp - 0xc], eax
call esi
lea ecx, [ebp - 8]
push ecx
push 0x28
call eax
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x10008e7c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], 1
neg eax
sbb eax, eax
and eax, 2
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
push 0
call dword [ebp - 0x14]
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push eax
push 0x10
push ecx
push eax
push dword [ebp - 8]
call dword [ebp - 0x18]
push 0x100285c8
call edi
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x10008e57
and byte [ebp - 1], 0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x10008e6d
push ebx
call esi
cmp dword [ebp - 0xc], 0
je 0x10008e78
push dword [ebp - 0xc]
call esi
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100091d4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e540
push 0x1000ad50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x38], edi
push str.RegCreateKeyExA
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x2c], eax
push str.RegSetValueExA
push edi
call esi
mov dword [ebp - 0x34], eax
push str.RegDeleteKeyA
push edi
call esi
mov dword [ebp - 0x1c], eax
push str.RegDeleteValueA
push edi
call esi
mov dword [ebp - 0x40], eax
push str.RegOpenKeyExA
push edi
call esi
mov dword [ebp - 0x28], eax
push str.RegCloseKey
push edi
call esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x20]
sub eax, ebx
je 0x100092ba
dec eax
je 0x100092d8
dec eax
je 0x10009294
dec eax
jne 0x10009335
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
test eax, eax
jne 0x10009335
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
call dword [ebp - 0x40]
jmp 0x1000932a
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
test eax, eax
jne 0x10009335
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
call dword [ebp - 0x1c]
jmp 0x1000932a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x2c]
test eax, eax
jne 0x10009335
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [ebp - 0x28]
test eax, eax
jne 0x10009335
mov esi, dword [ebp + 0x14]
cmp esi, ebx
jbe 0x10009335
cmp esi, 2
jbe 0x10009311
cmp esi, 4
je 0x10009307
cmp esi, 7
je 0x10009311
jmp 0x10009335
push 4
lea eax, [ebp + 0x1c]
push eax
push 4
jmp 0x10009320
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0x18]
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
call dword [ebp - 0x34]
test eax, eax
jne 0x10009335
mov dword [ebp - 0x20], 1
or dword [ebp - 4], 0xffffffff
call fcn.10009360
cmp edi, ebx
je 0x10009349
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000936d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000938a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1000938a
xor eax, eax
ret
push 1
pop eax
ret
Function at 0x10009f70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10009f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1000dd52
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x10009fb3
test byte [esp + 8], 2
je 0x10009fb3
call fcn.1000ddc5
mov dword [eax], 0xd
call fcn.1000ddce
mov dword [eax], 5
jmp 0x10009f8c
xor eax, eax
ret
Function at 0x100b24cc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10093f96
xor ecx, ecx
cmp dword [esp + 8], ecx
jbe 0x10093fb2
mov edx, dword [esp + 4]
movzx edx, byte [ecx + edx]
rol eax, 7
xor eax, edx
inc ecx
cmp ecx, dword [esp + 8]
jb 0x10093f9e
jmp 0x10093fbd
ret
pushal
lea esp, [esp + 0x20]
jmp 0x100b24d7
pushal
lea esp, [esp + 0x20]
jmp 0x10093f8b

Function at 0x10142704
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x10142b69
lea esp, [esp + 2]
jmp 0x101426ee
call fcn.100ac651
add byte [edi], cl
stosd dword es:[edi], eax
ror byte [ebp - 0x1379cffc], 0xc7
inc ebp
in al, 0xff
add byte [eax], al
add cl, ch
mov esp, 0xebfffffb
adc dh, ch
adc eax, eax
in eax, 0xa
mov bh, 0x75
push 0x17
sahf
cmp bh, byte [esi + esi*8 + 0x7947326]
scasb al, byte es:[edi]
mov ecx, 0x240c8b66
mov dh, byte [esp]
stc
jae 0x10142b83
jmp 0x10142bc3
mov dx, sp
jmp 0x10142bc6
jmp 0x10142c01
mov eax, dword [edi + 4]
add edx, eax
jle 0x10142beb
mov dx, word [esp]
setp dh
bt edx, ebx
jmp 0x10142c11
mov dx, sp
mov ecx, dword [edi]
dec dx
jp 0x10142ba8
neg edx
rdtsc
mov dx, word [esp]
jmp 0x10142baa
mov dx, word [esp]
jmp 0x10142c0b
neg edx
rdtsc
mov dx, word [esp]
jmp 0x10142baa
setp dh
bt edx, ebx
add edi, 8
jmp 0x10142c4e
lea edx, [edx - 0xa2]
mov edx, dword [esp]
jmp 0x10142d21
stc
jo 0x10142c38
lea edx, [edx - 0xa2]
mov edx, dword [esp]
setbe dh
jmp 0x10142d24
setnp dl
mov edx, dword [esp]
jmp 0x1009f401
setbe dh
mov dword ss:[ecx], eax
mov dx, word [esp]
lea edx, [ebx + edi]
jmp 0x10142cea

Function at 0x101a64e3
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg bx
pop cx
bswap edi
not ebx
setnp al
jmp 0x101a6468

Function at 0x101a6b6e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 5], ch
jmp 0x101a6bda
mov cl, dh
bswap ebx
bt ebx, ebx
xchg byte [esp + 0x13], bl
mov ah, 0xb4
lea ebx, [edx*4]
jmp 0x101a6b9a
lea ebx, [esi - 0x48add97f]
bswap esi
mov cx, word [esp + 0xb]
pushfd
lea ecx, [ebx + edi]
push word [esp + 0x17]
jmp 0x101a6bb0

Function at 0x101a84b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [esp + 0x19]
mov cx, bp
mov di, 0x2e94
cld
jmp 0x101a84e5
pop word [esp + 0x25]
add esp, 0xc
pop si
jmp 0x101a849e
lea esp, [esp + 0x1b]
lea eax, [0xf6dcd979]
mov byte [esp], dl
lea esp, [esp]
rdtsc
push word [esp + 2]
jmp 0x101a8516
lea edx, [eax*4]
mov byte [esp + 0xd], bl
mov ebx, dword [esp + 0x1c]
mov dword [esp + 6], ebp
mov dword [esp + 0xe], ebp
mov ebx, ecx
jmp 0x101a84c0
cmc
lea esi, [eax + ecx]
mov cl, 0xc8
sub esp, 0x11
xchg byte [esp + 0xc], ah
pop edx
jmp 0x101a852b
mov bx, 0x2d1a
lea esi, [edx + esi]
not al
pop word [esp]
cmp bl, 0xfc
mov eax, dword [esp]
jmp 0x101a8500
mov cl, 0xb6
push dword [esp + 7]
push edi
cpuid
lea ebx, [ecx*4]
jmp 0x101a864d
mov ecx, 0x42a906b6
pop dword [esp + 0xe]
pop di
mov ah, al
xchg bh, cl
push dword [esp + 0xa]
jmp 0x101a854e
push dword [esp + 0x11]
mov edx, eax
pop dword [esp + 0x10]
mov bl, 0xcb
mov byte [esp + 0x15], dl
xchg al, dh
jmp 0x101a8564
mov si, 0x6954
mov dl, bl
xchg ebp, ecx
mov dword [esp + 6], ebx
dec bp
mov dword [esp + 5], esp
jmp 0x101a85d5
Function at 0x101a8847
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov cx, bp
neg dl
mov dl, bh
shr ebp, cl
dec ebx
jmp 0x101a8861
jmp 0x101a8831
pop si
bt ebp, edx
push si
push esi
mov esi, esp
popal
jmp 0x101a8872
pop cx
mov ch, 0x49
sub esp, 0x1d
bts bp, si
ror esi, cl
xchg ecx, esi
jmp 0x101a8849
mov dword [esp + 7], ecx
setbe cl
sub esp, 0x12
lea ecx, [ecx + ebp]
lea edx, [eax + ebp]
mov di, word [esp + 0x1b]
jmp 0x101a88d8
mov byte [esp + 9], al
rdtsc
mov bl, 0xa2
dec ah
bt si, ax
btc si, cx
jmp 0x101a88a1
xchg byte [esp + 0x1b], cl
bts eax, eax
cpuid
inc ah
mov esi, dword [esp + 0xb]
rdtsc
jmp 0x101a88b7

Function at 0x101a8a2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
add bh, 0x30
xchg byte [esp + 2], bl
sub esp, 0x18
jmp 0x101a8a17

Function at 0x101b0ab6
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
push dword [esp + 1]
push dword [esp + 4]
call 0x101b0a4f
Function at 0x1eac510
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18ed000]
push edi
or ebp, 0xffffffff
jmp 0x1eac532
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1eac539
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1eac528
mov eax, 1
add ebx, ebx
jne 0x1eac54b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1eac55c
jne 0x1eac57b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1eac57b
dec eax
add ebx, ebx
jne 0x1eac568
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1eac540
add ebx, ebx
jne 0x1eac577
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1eac5cd
xor ecx, ecx
sub eax, 3
jb 0x1eac593
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1eac602
sar eax, 1
mov ebp, eax
jmp 0x1eac59e
add ebx, ebx
jne 0x1eac59e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1eac56c
inc ecx
add ebx, ebx
jne 0x1eac5ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1eac56c
add ebx, ebx
jne 0x1eac5b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1eac5ae
jne 0x1eac5ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1eac5ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1eac5ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1eac5de
jmp 0x1eac52e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1eac5ec
add edi, ecx
jmp 0x1eac52e
pop esi
mov edi, esi
mov ecx, 0x20752
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1eac60a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1eac60f
lea edi, [esi + 0x1aa8000]
mov eax, dword [edi]
or eax, eax
je 0x1eac677
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e6df50]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e6e094]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1eac635
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2e6e09c]
or eax, eax
je 0x1eac671
mov dword [ebx], eax
add ebx, 4
jmp 0x1eac652
call dword [esi + 0x2e6e098]
mov ebp, dword [esi + 0x2e6e0a0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1eac6ab
sub esp, 0xffffff80
jmp 0x9b1c38
Function at 0x40d81a
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
lea eax, [ebp + 0x10]
push edi
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.00418fe5
lea eax, [ebp - 0x104]
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 0x1a8], esi
je 0x40d881
add eax, 0x84
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, esi
je 0x40d88e
lea eax, [ebp - 4]
push esi
push eax
push esi
push 1
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x40d88e
lea eax, [ebp - 0x104]
push eax
call fcn.00418f6d
pop ecx
pop edi
pop esi
leave
ret
Function at 0x40ef01
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, 0x4232f4
call fcn.00417f9c
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x18], ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
cmp eax, ebx
jl 0x40f026
mov ecx, dword [ebp - 0x18]
call fcn.0040f241
push ebx
push ebx
push 1
push 0x321
push dword [ebp - 0x18]
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
mov dword [ebp - 0x14], ebx
mov esi, 0x20006
lea ecx, [ebp - 0x14]
push esi
push 0x42bcc0
push SysReAllocString
mov dword [ebp - 4], ebx
call fcn.0040f3fb
mov edi, eax
cmp edi, ebx
je 0x40ef7a
cmp dword [ebp - 0x14], ebx
je 0x40f024
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f024
mov dword [ebp - 0x10], ebx
push esi
push 0x42bc98
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040f3fb
mov edi, eax
cmp edi, ebx
jne 0x40f007
push 0x42bc88
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], ebx
je 0x40eff2
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, 0x42bd0c
push edi
call esi
inc eax
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push 0x42bc88
push dword [ebp - 0x10]
call edi
mov ebx, 0x42bd00
push ebx
call esi
inc eax
push eax
push ebx
push 1
push 0
push 0x42bcec
push dword [ebp - 0x10]
call edi
mov ecx, dword [ebp - 0x18]
call fcn.0040f117
xor ebx, ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ATL.DLL_AtlModuleRegisterServer]
mov edi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x10], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40f01a
push dword [ebp - 0x10]
call esi
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x14], ebx
je 0x40f024
push dword [ebp - 0x14]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40f117
Capabilities:
Create service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov esi, ecx
call fcn.0040d7d7
test eax, eax
jne 0x40f239
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
cmp edi, ebx
jne 0x40f194
mov eax, dword [0x42f3c8]
lea ecx, [ebp - 0x100]
test ecx, ecx
mov byte [ebp - 0x100], bl
je 0x40f181
cmp eax, ebx
jne 0x40f169
mov eax, dword [0x42f194]
cmp eax, ebx
je 0x40f181
lea ecx, [ebp - 0x100]
push 0xff
push ecx
push 0xed
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
add esi, 0x84
push ebx
push esi
lea eax, [ebp - 0x100]
jmp 0x40f221
lea eax, [ebp - 0x204]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 0x42bd20
push ebx
lea eax, [ebp - 0x204]
push ebx
push eax
push 1
push 3
add esi, 0x84
push 0x110
push 0xf01ff
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, ebx
jne 0x40f22d
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [0x42f3c8]
lea ecx, [ebp - 0x100]
test ecx, ecx
mov byte [ebp - 0x100], bl
je 0x40f219
cmp eax, ebx
jne 0x40f201
mov eax, dword [0x42f194]
cmp eax, ebx
je 0x40f219
lea ecx, [ebp - 0x100]
push 0xff
push ecx
push 0xee
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
push esi
lea eax, [ebp - 0x100]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x40f23c
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push edi
call esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret