joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d1ad
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001d1c5
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001d210
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001d1f3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001d210
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100185ec
mov dword [eax], 1
jmp 0x1001d1e8
mov esp, ebp
pop ebp
ret

Function at 0x1001f4bd
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001f51e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001f4ed
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xd
jg 0x1001f51c
mov dword [ebp - 0x10], 4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f512
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
cmp dword [ebp - 0x10], 0
je 0x1001f51a
jmp 0x1001f51c
jmp 0x1001f4e2
jmp 0x1001f53c
push 0x166e
push 0x89e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esp, ebp
pop ebp
ret

Function at 0x1001f726
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f781
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001f762
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001f77f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100185ec
mov dword [eax], 0x9a164e6
jmp 0x1001f757
jmp 0x1001f79a
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10025d8a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10025dd0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.10025fc7
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10025df5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10025df5
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10029ab7
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10029add
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10029aef
push 0x1bd4
push 0x2c0
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
pop ebp
ret
Function at 0x1002ac3d
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002ac7c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002ac7a
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1002acd2
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push 0x5c05
mov eax, dword [ebp - 0x1c]
push dword [eax]
push dword [ebp - 0x20]
push 0
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
push 0x21a6
call fcn.1002a106
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x1002d4b9
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002d514
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002d4f5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002d512
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100185ec
mov dword [eax], 0xe677b568
jmp 0x1002d4ea
jmp 0x1002d51e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x1002f5ae
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f5d2
xor eax, eax
jmp 0x1002f727
push 0x2f78
push 0x38b4
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002f433
add esp, 0x18
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f604
xor eax, eax
jmp 0x1002f727
push 1
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
call fcn.1002eef5
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002f622
xor eax, eax
jmp 0x1002f727
push 0
push 0x4427
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push 0xd16
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push 0x632f
call fcn.1002f72b
add esp, 0x24
push dword [ebp + 8]
push 0x27e0
push 0x5376
push dword [ebp - 4]
push dword [ebp - 8]
push 0x490d
push 0xaa7
push 0x2555
push 0
call fcn.1002812f
add esp, 0x24
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002f69c
push 0x1b45
push dword [ebp - 0x14]
push dword [ebp - 4]
push 1
call fcn.1002ae66
add esp, 0x10
push dword [ebp - 4]
call fcn.1002ede1
pop ecx
test eax, eax
jne 0x1002f6ad
xor eax, eax
jmp 0x1002f727
push dword [ebp - 4]
push 0x469b
push 0x485
push 0
call fcn.1002ae66
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f70f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002f6e3
xor eax, eax
jmp 0x1002f727
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002f6fc
xor eax, eax
jmp 0x1002f727
lea eax, [ebp - 4]
push eax
push 1
push 0x6996
call fcn.1002f4c8
add esp, 0xc
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002f720
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002f724
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100417e6
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10041807
push 0x1893
push 0xdcd
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x10041836
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10041836
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x100441db
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004423c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1004420b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x1004423a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10044238
push 0x550
push 0xb02
push 0
push 0x18f9
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10044200
jmp 0x1004424e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and dword [eax], 0
mov esp, ebp
pop ebp
ret

Function at 0x10044252
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100442aa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004428e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100442a8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100185ec
and dword [eax], 0
jmp 0x10044283
jmp 0x100442b4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x10080a56
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008a330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10070c2c
mov dword [ebp - 0x14], eax
cmp dword [0x12677520], esi
jne 0x10080b49
push 0x800
push esi
push 0x1000a510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10080ad6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10080c29
push esi
push esi
push 0x1000a510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10080c29
push 0x1000a528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10080c29
push eax
call ebx
push 0x1000a534
push edi
mov dword [0x12677520], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a544
push edi
mov dword [0x12677524], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000a558
push edi
mov dword [0x12677528], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x12677530], eax
test eax, eax
je 0x10080b46
push 0x1000a574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1267752c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10080b6e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10080b61
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10080b83
push 4
pop eax
jmp 0x10080c2b
cmp dword [ebp - 0x14], esi
je 0x10080b83
push dword [0x12677520]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10080b68
mov eax, dword [0x1267752c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10080be1
cmp dword [0x12677530], edi
je 0x10080be1
push eax
call ebx
push dword [0x12677530]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10080be1
test eax, eax
je 0x10080be1
call ecx
test eax, eax
je 0x10080bd6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10080bd6
test byte [ebp - 8], 1
jne 0x10080be1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10080c11
mov eax, dword [0x12677524]
cmp eax, edi
je 0x10080c0e
push eax
call ebx
test eax, eax
je 0x10080c0e
call eax
mov esi, eax
test esi, esi
je 0x10080c0e
mov eax, dword [0x12677528]
cmp eax, edi
je 0x10080c0e
push eax
call ebx
test eax, eax
je 0x10080c0e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x12677520]
call ebx
test eax, eax
je 0x10080c29
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10080c2b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x795803e2
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x32e85524
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x22f2680
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1e92000]
push edi
jmp 0x22f269a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x22f26a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22f2690
mov eax, 1
add ebx, ebx
jne 0x22f26b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x22f26c4
jne 0x22f26e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22f26e3
dec eax
add ebx, ebx
jne 0x22f26d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x22f26a8
add ebx, ebx
jne 0x22f26df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x22f2735
xor ecx, ecx
sub eax, 3
jb 0x22f26fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x22f276a
sar eax, 1
mov ebp, eax
jmp 0x22f2706
add ebx, ebx
jne 0x22f2706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22f26d4
inc ecx
add ebx, ebx
jne 0x22f2714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22f26d4
add ebx, ebx
jne 0x22f2721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x22f2716
jne 0x22f2732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x22f2716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x22f2754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x22f2746
jmp 0x22f2696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x22f2754
add edi, ecx
jmp 0x22f2696
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x22f2772
cmp byte [edi], 0x11
jne 0x22f2772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x22f2777
lea edi, [esi + 0x1eeb000]
mov eax, dword [edi]
or eax, eax
je 0x22f27ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3cff650]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3cff7cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x22f27a4
mov ecx, edi
jns 0x22f27d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3cff7d0]
or eax, eax
je 0x22f27e9
mov dword [ebx], eax
add ebx, 4
jmp 0x22f27c1
call dword [esi + 0x3cff7e0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x22f2820
cmp al, 0xef
ja 0x22f2813
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x22f27f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x22f2802
mov ebp, dword [esi + 0x3cff7d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x22f2854
sub esp, 0xffffff80
jmp 0x420577
Function at 0x10001060
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001070
sub eax, edx
mov edi, eax
xor eax, eax
lea ecx, [ecx]
mov byte [eax + 0x10010aa8], al
inc eax
cmp eax, 0x100
jl 0x10001080
xor ecx, ecx
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 8]
movzx ebx, byte [ecx + 0x10010aa8]
movzx edx, byte [edx + eax]
add edx, ebx
add esi, edx
and esi, 0x800000ff
jns 0x100010b7
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [esi + 0x10010aa8]
mov byte [ecx + 0x10010aa8], al
inc ecx
mov byte [esi + 0x10010aa8], bl
cmp ecx, 0x100
jl 0x10001090
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10004340
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x10004366
push eax
push eax
push eax
push 0x10002170
push eax
push eax
call fcn.100046b9
add esp, 0x18
test eax, eax
je 0x10004366
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100043f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x100043fe
repz ret
jmp fcn.100049d6

Function at 0x1000a7f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10005b3f
and dword [ebp - 0x14], 0
cmp dword [0x10010a88], 0
mov dword [ebp - 0x18], eax
jne 0x1000a8a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000a94f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000a94f
mov esi, dword [0x1000fdb4]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10010a88], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10010a8c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10010a90], eax
call edi
push eax
call esi
mov dword [0x10010a98], eax
test eax, eax
je 0x1000a8a7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10010a94], eax
mov eax, dword [0x10010a94]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x1000fdb0]
cmp eax, ecx
je 0x1000a900
cmp dword [0x10010a98], ecx
je 0x1000a900
push eax
call esi
push dword [0x10010a98]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000a900
test ebx, ebx
je 0x1000a900
call edi
test eax, eax
je 0x1000a8f7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000a8f7
test byte [ebp - 8], 1
jne 0x1000a900
or dword [ebp + 0x10], 0x200000
jmp 0x1000a933
mov eax, dword [0x10010a8c]
cmp eax, dword [ebp - 0x18]
je 0x1000a933
push eax
call esi
test eax, eax
je 0x1000a933
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000a933
mov eax, dword [0x10010a90]
cmp eax, dword [ebp - 0x18]
je 0x1000a933
push eax
call esi
test eax, eax
je 0x1000a933
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10010a88]
call esi
test eax, eax
je 0x1000a94f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000a951
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100043f4
leave
ret
Function at 0x1000c2b0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1000c441
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x1000c2da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1000c2e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1000c2d0
mov eax, 1
add ebx, ebx
jne 0x1000c2f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1000c2e8
jne 0x1000c304
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000c2e8
xor ecx, ecx
sub eax, 3
jb 0x1000c318
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1000c38a
mov ebp, eax
add ebx, ebx
jne 0x1000c323
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1000c330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1000c354
inc ecx
add ebx, ebx
jne 0x1000c340
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1000c335
jne 0x1000c351
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1000c335
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1000c374
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1000c365
jmp 0x1000c2d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1000c374
add edi, ecx
jmp 0x1000c2d6
pop esi
mov edi, esi
mov ecx, 0xce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1000c392
cmp byte [edi], 1
jne 0x1000c392
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x1000c397
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x1000c40f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc0c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1000c3c4
mov ecx, edi
jns 0x1000c3f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc0cc]
or eax, eax
je 0x1000c409
mov dword [ebx], eax
add ebx, 4
jmp 0x1000c3e1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1000c440
cmp al, 0xef
ja 0x1000c433
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1000c415
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1000c422
popal
jmp 0x1000359a
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1d383519
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x28ca6538
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219