joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f370
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48e2c0
mov eax, dword fs:[0]
push eax
sub esp, 0x47c
mov eax, dword [str.CombineRgn]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor eax, eax
push 0x400
push eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x418]
push eax
mov esi, ecx
mov dword [ebp - 0x488], 0x67452301
mov dword [ebp - 0x484], 0xefcdab89
mov dword [ebp - 0x480], 0x98badcfe
mov dword [ebp - 0x47c], 0x10325476
call fcn.00471b20
add esp, 0xc
push 0x49c018
push esi
call fcn.004705f9
mov esi, eax
add esp, 8
test esi, esi
je 0x41f460
jmp 0x41f410
push esi
push 0x400
lea ecx, [ebp - 0x418]
push 1
push ecx
call fcn.004708b0
add esp, 0x10
lea ecx, [ebp - 0x488]
test eax, eax
je 0x41f43f
lea edx, [ebp - 0x418]
push edx
call fcn.0041f480
jmp 0x41f410
call fcn.0041f520
push esi
call fcn.0047037b
add esp, 4
lea ecx, [ebp - 0x430]
call fcn.0041f180
jmp 0x41f462
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046ddb7
mov esp, ebp
pop ebp
ret

Function at 0x41fcf0
Capabilities:
Hash data using crc32b

Disassembly:
push esi
xor edx, edx
push edi
xor eax, eax
test dl, 1
je 0x41fd00
mov eax, 0x80
mov ecx, edx
shr ecx, 1
test cl, 1
je 0x41fd0c
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x41fd16
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x41fd20
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x41fd2a
or eax, 8
shr ecx, 1
test cl, 1
je 0x41fd34
or eax, 4
shr ecx, 1
test cl, 1
je 0x41fd3e
or eax, 2
test cl, 2
je 0x41fd46
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor esi, esi
mov dword [edx*4 + 0x4ae5b8], ecx
mov eax, ecx
lea ecx, [esi + 0x1f]
nop
test al, 1
je 0x41fe0d
mov edi, 1
shl edi, cl
or esi, edi
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x41fe00
mov dword [edx*4 + 0x4ae5b8], esi
inc edx
cmp edx, 0xff
jle 0x41fcf4
pop edi
pop esi
ret
Function at 0x41fe30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
call fcn.0041fcf0
mov edx, dword [esp + 8]
or eax, 0xffffffff
mov ecx, esi
test esi, esi
je 0x41fe6e
push edi
jmp 0x41fe50
movzx edi, byte [edx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x4ae5b8]
dec ecx
inc edx
test ecx, ecx
jne 0x41fe50
pop edi
not eax
pop esi
ret
Function at 0x426e50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48c168
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [str.CombineRgn]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xe0]
push eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], eax
call dword [0x490254]
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x1c]
lea eax, [esi + 4]
push edx
push eax
mov dword [esp + 0x30], eax
call fcn.004144f0
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 0x20]
mov edi, dword [esp + 0x18]
test eax, eax
je 0x426ebb
cmp eax, edi
je 0x426ec0
call fcn.0046f8fc
mov ebp, dword [esp + 0x1c]
cmp ebx, ebp
je 0x426fd8
xor ebx, ebx
cmp edi, ebx
jne 0x426f72
call fcn.0046f8fc
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x426ee7
call fcn.0046f8fc
cmp dword [ebp + 0x64], ebx
je 0x426f4c
cmp edi, ebx
jne 0x426f79
call fcn.0046f8fc
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x426f05
call fcn.0046f8fc
mov eax, dword [ebp + 0x64]
cmp byte [eax + 0xf2], bl
je 0x426f80
cmp byte [esp + 0x54], bl
je 0x426f4c
lea esi, [esp + 0x18]
call fcn.00413a60
mov eax, dword [eax + 0x5c]
cmp eax, ebx
je 0x426f30
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
lea esi, [esp + 0x18]
call fcn.00413a60
push ebp
push edi
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x20]
push ecx
mov dword [eax + 0x5c], ebx
call fcn.00415140
mov edx, dword [esp + 0x20]
push edx
call dword [0x490250]
cmp dword [esp + 0x50], 0x10
jb 0x426f6b
mov eax, dword [esp + 0x3c]
push eax
call fcn.0046ddac
add esp, 4
xor eax, eax
jmp 0x426ffc
mov eax, dword [edi]
jmp 0x426edd
mov eax, dword [edi]
jmp 0x426efb
cmp edi, ebx
jne 0x426fd0
call fcn.0046f8fc
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x426f95
call fcn.0046f8fc
mov ecx, dword [ebp + 0x64]
add esi, 0xf8
push esi
mov byte [ecx + 0xf2], 1
call dword [0x49025c]
cmp edi, ebx
jne 0x426fd4
call fcn.0046f8fc
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x426fc1
call fcn.0046f8fc
mov ecx, dword [ebp + 0x64]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
jmp 0x426f10
mov eax, dword [edi]
jmp 0x426f8b
mov eax, dword [edi]
jmp 0x426fb7
mov ecx, dword [esp + 0x20]
push ecx
call dword [0x490250]
cmp dword [esp + 0x50], 0x10
jb 0x426ff7
mov edx, dword [esp + 0x3c]
push edx
call fcn.0046ddac
add esp, 4
mov eax, 0x20000002
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x20
Function at 0x42b3b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x48b9db
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [str.CombineRgn]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], 0x49d42c
call fcn.00443297
push 4
mov dword [esp + 0x20], 0
call fcn.0046dfd9
mov edi, eax
add esp, 4
test edi, edi
je 0x42b42e
call fcn.00442f22
mov dword [edi], eax
call fcn.00442d50
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00442c74
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x42b423
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00442c9c
jmp 0x42b430
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x460b0c
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x460b17
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [esp + 0x14]
not eax
mov ecx, 0xff
cmp edi, 8
jb 0x460bd2
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x496688]
inc edx
sub edi, 8
dec esi
jne 0x460b37
pop ebx
test edi, edi
je 0x460beb
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x496688]
inc edx
dec edi
jne 0x460bd6
pop edi
not eax
pop esi
ret

Function at 0x468484
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov edi, eax
and edi, 7
je 0x4684a9
cmp eax, edi
jge 0x4684a1
mov eax, esi
call fcn.00467e38
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
xor ecx, ecx
cmp dword [esi + 8], ecx
jle 0x4684cb
mov al, byte [esi + 0xc]
shr dword [esi + 0xc], 8
add dword [esi + 8], 0xfffffff8
mov byte [ebp + ecx - 4], al
inc ecx
cmp dword [esi + 8], 0
jg 0x4684b0
cmp ecx, 4
jge 0x4684ea
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x4684d8
xor eax, eax
jmp 0x4684e0
mov dl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, dl
mov byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 4
jl 0x4684ce
movzx edi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl edi, 8
add edi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, edi
xor ecx, 0xffff
cmp eax, ecx
je 0x46851c
mov eax, 0x4971f8
call fcn.00465a55
jmp 0x468557
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x46852c
mov eax, 0x4971e4
jmp 0x468515
mov eax, dword [esi + 0x10]
add eax, edi
cmp eax, dword [esi + 0x18]
jbe 0x468541
mov ecx, edi
call fcn.00467e63
test eax, eax
je 0x468557
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00473ce0
add dword [esi], edi
add dword [esi + 0x10], edi
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x3002258e
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
cmp dword [0x300320c4], 0
je 0x300225aa
mov eax, 1
jmp 0x3002271c
push 0x30001e28
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x300225cf
push 0x30001c78
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call dword [sym.imp.KERNEL32.DLL_DebugBreak]
cmp dword [ebp - 4], 0
jne 0x300225dc
xor eax, eax
jmp 0x3002271c
mov eax, dword [ebp - 4]
push eax
call fcn.3002255b
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x300225ff
push 0x30001c78
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call dword [sym.imp.KERNEL32.DLL_DebugBreak]
push 0x30001e1c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x30022624
xor eax, eax
jmp 0x3002271c
mov edx, dword [ebp - 0xe4]
cmp edx, dword [ebp - 4]
jb 0x3002263d
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
cmp dword [ebp - 0xe4], eax
jbe 0x3002264c
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx + 1]
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 4]
jb 0x30022665
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
cmp dword [ebp - 0xe4], ecx
jbe 0x3002266c
xor eax, eax
jmp 0x3002271c
push pe_nt_image_headers32
mov edx, dword [ebp - 0xe4]
push edx
lea eax, [ebp - 0xd8]
push eax
call fcn.300281c0
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x30022699
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jae 0x30022703
lea edx, [ebp - 0xe0]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax*8 + 0x3002a39c]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x3002a398]
push eax
mov ecx, dword [ebp - 0xe4]
push ecx
lea edx, [ebp - 0xd8]
push edx
call fcn.300224f4
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
je 0x30022690
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 4]
jbe 0x30022690
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xc]
cmp dword [ebp - 0xe0], ecx
jae 0x30022690
mov edx, dword [ebp - 0xe0]
mov dword [0x300320c4], edx
cmp dword [ebp - 0xdc], 0
jne 0x30022716
mov dword [0x300320c4], 0
mov eax, dword [ebp - 0xdc]
mov esp, ebp
pop ebp
ret
Function at 0x300256b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x300256e4
cmp byte [eax], 0
je 0x30025728
lea eax, [eax + 1]
test eax, 3
je 0x300256e4
cmp byte [eax], 0
je 0x30025728
lea eax, [eax + 1]
test eax, 3
je 0x300256e4
cmp byte [eax], 0
je 0x30025728
lea eax, [eax + 1]
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x1010101
xor edx, ecx
and edx, 0x80808080
je 0x300256e4
test cl, cl
lea eax, [eax - 4]
je 0x30025728
test ecx, 0xff00
lea eax, [eax + 1]
je 0x30025728
test ecx, 0xff0000
lea eax, [eax + 1]
je 0x30025728
test ecx, 0xff000000
lea eax, [eax + 1]
je 0x30025728
lea eax, [eax + 1]
jmp 0x300256e4
sub eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x30025737
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
test eax, 3
je 0x3002575e
cmp word [eax], 0
je 0x30025757
lea eax, [eax + 2]
test eax, 3
je 0x3002575e
jmp 0x30025745
sub eax, dword [ebp + 8]
shr eax, 1
jmp 0x30025799
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sub edx, 0x10001
xor edx, ecx
and edx, 0x80008000
je 0x3002575e
sub eax, dword [ebp + 8]
shr eax, 1
test cx, cx
lea eax, [eax - 2]
je 0x30025799
test ecx, 0xffff0000
lea eax, [eax + 1]
je 0x30025799
lea eax, [eax*2 + 2]
add eax, dword [ebp + 8]
jmp 0x3002575e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x3002768d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
mov esi, ecx
cmp si, 0xffff
push edi
mov dword [ebp - 4], edx
je 0x30027702
test si, 0x3ff
je 0x30027702
push dword [ebp + 8]
call fcn.30027617
test eax, eax
jne 0x3002770b
movzx edi, si
mov esi, dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
push eax
push eax
push 0x58
push edi
call esi
test eax, eax
je 0x3002770b
lea eax, [ebp - 0x24]
push 0x20
push eax
push 0x58
push edi
call esi
and dword [ebp - 0x10], 0
lea edx, [ebp - 0x44]
push 3
lea ecx, [ebp - 0x14]
call fcn.3002758d
test eax, eax
je 0x300276fa
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x44]
mov byte [ecx], al
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x40]
mov dword [ecx], eax
jmp 0x3002770b
mov eax, dword [ebp - 4]
mov byte [eax], 1
jmp 0x30027705
mov byte [edx], 1
mov eax, dword [ebp + 8]
and dword [eax], 0
pop edi
pop esi
leave
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x124f0bce
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x56cd2e7d
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
push 5
pop ecx
mov esi, str.sktop.ini
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001222
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x401782
Capabilities:
Check if file exists
Move file
Shutdown system
Terminate process

Disassembly:
mov eax, ecx
push esi
push edi
xor ecx, ecx
mov dx, word [eax]
xor edi, edi
test dx, dx
je 0x4017ca
mov esi, 0x40a020
cmp dx, 0x20
jne 0x4017a1
test edi, edi
je 0x4017ca
cmp dx, 0x22
jne 0x4017b2
xor edx, edx
test edi, edi
sete dl
mov edi, edx
jmp 0x4017c0
cmp esi, 0x40a22e
jae 0x4017d6
mov word [esi], dx
inc ecx
inc esi
inc esi
inc eax
inc eax
mov dx, word [eax]
test dx, dx
jne 0x401797
and word [ecx*2 + 0x40a020], 0
pop edi
pop esi
ret
push 1
call dword [sym.imp.MSVCRT.dll_exit]
Function at 0x401fb1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
mov eax, dword [0x40a8b0]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ebx
jne 0x402043
lea eax, [ebp - 0x2e0]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x4020d9
cmp eax, 0x104
ja 0x4020d9
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 - 0x2e2], 0x5c
je 0x402016
mov word [ebp + eax*2 - 0x2e0], 0x5c
inc eax
lea eax, [ebp + eax*2 - 0x2e0]
push str.version.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2e0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [0x40a8b0], eax
je 0x4020d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetFileVersionInfoSizeW
push eax
call esi
mov edi, eax
push str.GetFileVersionInfoW
push dword [0x40a8b0]
call esi
mov dword [ebp - 4], eax
push str.VerQueryValueW
push dword [0x40a8b0]
call esi
cmp edi, ebx
mov dword [ebp - 0xc], eax
je 0x4020d9
cmp dword [ebp - 4], ebx
je 0x4020d9
cmp eax, ebx
je 0x4020d9
push ebx
push dword [ebp - 8]
call edi
mov esi, eax
cmp esi, ebx
je 0x4020d9
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
pop ecx
cmp edi, ebx
je 0x4020d9
push edi
push esi
push ebx
push dword [ebp - 8]
call dword [ebp - 4]
test eax, eax
je 0x4020ca
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 4]
push eax
push 0x4087f4
push edi
mov dword [ebp - 8], ebx
call dword [ebp - 0xc]
test eax, eax
je 0x4020ca
mov eax, dword [ebp - 4]
mov esi, dword [eax + 8]
jmp 0x4020cd
mov esi, dword [ebp - 0x10]
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, esi
jmp 0x4020db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret