joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb7b32a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dl
mov dword [esp], esp
pushfd
mov word [esp], cx
push dword [esp]
jb 0xb7b3d4
mov dword [esp], eax
mov dword [esp + 4], ebp
pushal
jmp 0xb7b32c
jmp 0xb7b308
push dword [esp + 0xa]
call 0xb7b37e
push dword [esp + 0xa]
call fcn.00b7b3a8
add ecx, 0x3c082727
jmp 0xb7c04a
mov dword [esp], eax
mov dword [esp + 4], ebp
pushal
jmp 0xb7b342
jmp 0xb7b35e
jmp 0xb7c031

Function at 0xb7b3a8
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0x15], bx
mov word [esp + 0x20], bp
call fcn.00b7b3ec
jo 0xb7b41f
pop dword [esp + 0x16]
lea esp, [esp + 2]
jmp 0xb7b445
inc edx
and eax, 0x38d910d4
fnstcw word [eax]
sbb esi, dword [edx - 0x77]
sbb al, 0x24
call fcn.00b7b32a
call fcn.00b7b465
jo 0xb7b423
jge 0xb7b43c
test dword [ebx + 0x62], reloc.WINMM.dll_midiStreamStop
insb byte es:[edi], dx
or eax, dword [esi]
ret 0xd64f
mov dword [esp + 0x24], esi
pushfd
call 0xb7b42f
mov dword [esp + 4], ebx
jmp 0xb7b475
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0xb7b49d

Function at 0xb7b465
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xb]
jnp 0xb7b44f
mov dword [esp + 4], ebx
jmp 0xb7b4b3
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0xb7b49d

Function at 0xb7b698
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0b6cd28
jmp 0xb7b5eb
mov byte [esp + 1], ah
lea esp, [esp + 1]
mov dword [esp], edx
call fcn.00b7b427
pushfd
jmp 0xb7b335
mov dword [esp], ecx
pushal
lea esp, [esp + 0x1b]
jmp 0xb7b48d
lea ebp, [esp]
bsf edx, ebp
jp 0xb7b578
rdtsc
push bp
jmp 0xb7b529
cpuid
bswap eax
mov ax, word [esp]
jmp 0xb7b4d8
and esi, ecx
neg si
mov esi, dword [esp + 0x2c]
jmp 0xb7b4ee
mov edi, esp
mov bh, byte [esp]
inc cl
jno 0xb7b55a
inc dx
jmp 0xb7b562
lea edx, reloc.WINMM.dll_midiStreamStop
lea esp, [esp + 2]
jmp 0xb7b552
push bp
lea edx, reloc.WINMM.dll_midiStreamStop
lea esp, [esp + 2]
sub esp, 0xc0
jmp 0xb7b513
inc dx
jmp 0xb7b562
mov edx, esi
mov eax, 0x376d8f65
bsr eax, esi
jg 0xb7b57c
jle 0xb7b57c
adc bl, byte [ecx + 0x5d9b6809]
js 0xb7b5d3
rdtsc
jmp 0xb7b546
call fcn.00b7b592
mov esi, 0x30c1a630
invalid
xchg si, cx
jmp 0xb7b508
add esi, 0x58d16bd0
neg bh
jb 0xb7b614
mov eax, ecx
jmp 0xb7b616
add byte [eax], al
add byte [eax], al
jmp 0xb7b5b0
btr dx, bx
je 0xb7b5a8
xchg si, cx
and esi, ecx
neg si
jmp 0xb7b50d
mov eax, ecx
call fcn.00b7b5fe
inc esi
jmp 0xb7b622
not ah
neg cx
jne 0xb7b643
mov ecx, 0x82051012
jmp 0xb7b650
mov ecx, 0x82051012
xchg ebx, eax
call fcn.00b7b682
das
xchg ebx, eax
lea ecx, reloc.WINMM.dll_midiStreamStop
call fcn.00b7b741
and byte [edx + ebp + 0x2179bc4d], dh
pushal
mov dword [reloc.WINMM.dll_midiStreamStop], eax
invalid
jmp 0xb7b4ce
mov byte [esp], dl
pop word [esp]
push word [esp + 1]
jno 0xb7b667
mov dword [esp], ecx
pushal
lea esp, [esp + 0x1b]
mov byte [esp + 1], ah
lea esp, [esp + 1]
jmp 0xb7b495

Function at 0xba06ca
Capabilities:
Encrypt data using aes

Disassembly:
movzx esi, byte [eax + 0xd]
jmp 0xba0705
shl edx, 8
xor edx, esi
push ecx
jmp 0xba06ef
Function at 0xba1252
Capabilities:
Encrypt data using aes

Disassembly:
shr edi, 0x18
movzx edi, byte [edi*4 + 0xb78d30]
cmc
pushal
jmp 0xba0b21
xor ecx, edx
lea esp, [esp + 0x58]
xor ecx, dword [ebx]
mov dl, ah
mov dx, bx
jmp 0xba0b0b
and edx, esi
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamStop]
stc
sub esp, 0x1d
lea esp, [esp + 1]
jmp 0xba0ad0
mov edi, dword [esp]
jmp 0xba0b78
mov byte [esp + 6], cl
xor ecx, edi
and edx, ebp
jmp 0xba0adf
mov edi, edx
sub esp, 0x19
pop dword [esp + 7]
lea esp, [esp + 1]
jmp 0xba0af8
add ebx, 4
sub esp, 6
mov dx, 0xa288
mov dx, 0x50d1
lea esp, [esp + 2]
jmp 0xba11f0
lea edi, [eax + 0x10]
xor ecx, dword [eax]
xor dh, dh
mov dh, 0x37
jmp 0xba0b4e
mov edx, dword [eax + 0xc]
call fcn.00ba0bba
xor ecx, edx
mov dword [eax + 0x18], ecx
lea edx, [eax + ebp]
jmp 0xba0c2f
mov dword [eax + 0x14], edx
lea ecx, reloc.WINMM.dll_midiStreamStop
inc ecx
mov ecx, dword [eax + 8]
jmp 0xba0c89
mov dword [edi], ecx
mov edx, dword [eax + 4]
xor edx, ecx
jmp 0xba10e7
push word [esp]
xor ecx, edi
jmp 0xba0b3f

Function at 0xc6a0a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
bswap edx
rcl ax, 3
jmp 0xc6a0de
not dx
push word [esp + 0x10]
pop word [esp + 8]
jmp 0xc6a128
rdtsc
btc edx, edx
mov dl, byte [esp + 5]
pop edx
xchg byte [esp + 6], ah
mov dx, sp
jmp 0xc6a0c8
lea ebx, [edx + 0xaf]
neg ax
mov bx, si
xchg dword [esp + 8], ebx
lea edx, [edx*4]
lea esp, [esp]
jmp 0xc6a112

Function at 0xc6a796
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0xc6500c
call fcn.00c65011
call 0xc6958a
jmp 0xc6a832
movzx ebx, word [eax + 0x3c]
jmp 0xc6a860
lea esp, [esp + 0x42]
call fcn.00c6a674
rcl bx, 8
push dword [esp + 1]
setl al
mov word [esp], ax
rcl al, cl
mov bh, 0x12
jmp 0xc6a703
lea esp, [esp + 1]
mov al, 0xef
xchg bx, ax
sub esp, 6
jmp 0xc6a714
std
bsf dx, bp
xchg dword [esp], ebx
add esp, 3
bswap edx
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0xc6a6d0
mov bh, 0x4d
mov ah, bl
pop dword [esp]
rdtsc
btc ax, ax
xchg dh, ah
jmp 0xc6a6e6
pop word [esp + 1]
mov ebx, dword [esp + 3]
mov ebx, dword [esp + 0x23]
not dh
neg eax
mov dh, byte [esp]
jmp 0xc6a880
call fcn.00c6a762
push ebx
call 0xc6a7b6
arpl sp, sp
jp 0xc6a7a7
in al, dx
or al, 0x97
adc dword [ecx + reloc.WINMM.dll_midiStreamStop], eax
xchg ebx, eax
or ah, byte [ebp + 0x24048f66]
pop word [esp]
lea esp, [esp + 2]
jmp 0xc6a780
and al, 2
call 0xc6a7be
rcl dword [esi - 0x3c], cl
mov dword [reloc.WINMM.dll_midiStreamStop], eax
mov dword [esp], esp
call fcn.00c6a7a0
lea esp, [esp + 2]
mov dword [esp], ebp
jmp 0xc6a84a
sub esp, 0
mov eax, dword [esp + 0x3a]
lea esp, [esp + 0x54]
popfd
lea esp, [esp + 4]
jmp 0xc6a77b
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0xc6a8ad
push di
lea esp, [esp + 1]
lea esp, [esp + 1]
push esi
call fcn.00c6a81d
push eax
jmp 0xc69585
add ebx, eax
cmp word [ebx], 0x4550
je 0xc64fe2
jne 0xc6a8b3
scasd eax, dword es:[edi]
inc ebx
sal dword [esi + reloc.WINMM.dll_midiStreamStop], cl
lcall 0x3330, 0x31e50cfd
sub al, byte [ebp + 0xf]
retf 0xc38b
bswap edx
mov eax, ebx
add edx, 0xaa1c7d43
mov edx, dword [esp + 0x2d]
mov eax, esp
shr eax, cl
jmp 0xc6a7d9
je 0xc695ad
sub eax, 0x10000
jmp 0xc6a836
Function at 0xc6a7a0
Capabilities:
Parse pe header

Disassembly:
mov word [esp + 1], si
lea esp, [esp + 2]

Function at 0xc6a7b6
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0xc6500c
call fcn.00c65011
call 0xc6958a
jmp 0xc6a832
movzx ebx, word [eax + 0x3c]
jmp 0xc6a860
lea esp, [esp + 0x42]
call fcn.00c6a674
rcl bx, 8
push dword [esp + 1]
setl al
mov word [esp], ax
rcl al, cl
mov bh, 0x12
jmp 0xc6a703
lea esp, [esp + 1]
mov al, 0xef
xchg bx, ax
sub esp, 6
jmp 0xc6a714
std
bsf dx, bp
xchg dword [esp], ebx
add esp, 3
bswap edx
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0xc6a6d0
mov bh, 0x4d
mov ah, bl
pop dword [esp]
rdtsc
btc ax, ax
xchg dh, ah
jmp 0xc6a6e6
pop word [esp + 1]
mov ebx, dword [esp + 3]
mov ebx, dword [esp + 0x23]
not dh
neg eax
mov dh, byte [esp]
jmp 0xc6a880
call fcn.00c6a762
push ebx
call 0xc6a7b6
arpl sp, sp
jp 0xc6a7a7
in al, dx
or al, 0x97
adc dword [ecx + reloc.WINMM.dll_midiStreamStop], eax
xchg ebx, eax
or ah, byte [ebp + 0x24048f66]
pop word [esp]
lea esp, [esp + 2]
jmp 0xc6a780
and al, 2
call 0xc6a7be
rcl dword [esi - 0x3c], cl
mov dword [reloc.WINMM.dll_midiStreamStop], eax
mov dword [esp], esp
call fcn.00c6a7a0
lea esp, [esp + 2]
mov dword [esp], ebp
jmp 0xc6a84a
sub esp, 0
mov eax, dword [esp + 0x3a]
lea esp, [esp + 0x54]
popfd
lea esp, [esp + 4]
jmp 0xc6a77b
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0xc6a8ad
push di
lea esp, [esp + 1]
lea esp, [esp + 1]
push esi
call fcn.00c6a81d
push eax
jmp 0xc69585
add ebx, eax
cmp word [ebx], 0x4550
je 0xc64fe2
jne 0xc6a8b3
scasd eax, dword es:[edi]
inc ebx
sal dword [esi + reloc.WINMM.dll_midiStreamStop], cl
lcall 0x3330, 0x31e50cfd
sub al, byte [ebp + 0xf]
retf 0xc38b
bswap edx
mov eax, ebx
add edx, 0xaa1c7d43
mov edx, dword [esp + 0x2d]
mov eax, esp
shr eax, cl
jmp 0xc6a7d9
je 0xc695ad
sub eax, 0x10000
jmp 0xc6a836
Function at 0xc6a7be
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0xc6500c
call fcn.00c65011
call 0xc6958a
jmp 0xc6a832
movzx ebx, word [eax + 0x3c]
jmp 0xc6a860
lea esp, [esp + 0x42]
call fcn.00c6a674
rcl bx, 8
push dword [esp + 1]
setl al
mov word [esp], ax
rcl al, cl
mov bh, 0x12
jmp 0xc6a703
lea esp, [esp + 1]
mov al, 0xef
xchg bx, ax
sub esp, 6
jmp 0xc6a714
std
bsf dx, bp
xchg dword [esp], ebx
add esp, 3
bswap edx
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0xc6a6d0
mov bh, 0x4d
mov ah, bl
pop dword [esp]
rdtsc
btc ax, ax
xchg dh, ah
jmp 0xc6a6e6
pop word [esp + 1]
mov ebx, dword [esp + 3]
mov ebx, dword [esp + 0x23]
not dh
neg eax
mov dh, byte [esp]
jmp 0xc6a880
call fcn.00c6a762
push ebx
call 0xc6a7b6
arpl sp, sp
jp 0xc6a7a7
in al, dx
or al, 0x97
adc dword [ecx + reloc.WINMM.dll_midiStreamStop], eax
xchg ebx, eax
or ah, byte [ebp + 0x24048f66]
pop word [esp]
lea esp, [esp + 2]
jmp 0xc6a780
and al, 2
call 0xc6a7be
rcl dword [esi - 0x3c], cl
mov dword [reloc.WINMM.dll_midiStreamStop], eax
mov dword [esp], esp
call fcn.00c6a7a0
lea esp, [esp + 2]
mov dword [esp], ebp
jmp 0xc6a84a
sub esp, 0
mov eax, dword [esp + 0x3a]
lea esp, [esp + 0x54]
popfd
lea esp, [esp + 4]
jmp 0xc6a77b
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0xc6a8ad
push di
lea esp, [esp + 1]
lea esp, [esp + 1]
push esi
call fcn.00c6a81d
push eax
jmp 0xc69585
add ebx, eax
cmp word [ebx], 0x4550
je 0xc64fe2
jne 0xc6a8b3
scasd eax, dword es:[edi]
inc ebx
sal dword [esi + reloc.WINMM.dll_midiStreamStop], cl
lcall 0x3330, 0x31e50cfd
sub al, byte [ebp + 0xf]
retf 0xc38b
bswap edx
mov eax, ebx
add edx, 0xaa1c7d43
mov edx, dword [esp + 0x2d]
mov eax, esp
shr eax, cl
jmp 0xc6a7d9
je 0xc695ad
sub eax, 0x10000
jmp 0xc6a836

Function at 0xc6a81d
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [eax + 0xc]
jmp 0xc6a828
mov dword [esp], edi
mov eax, dword fs:[0x30]
jmp 0xc6a7eb
push word [esp + 3]
lea esp, [esp + 2]
jmp 0xc6a801
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xc6a85a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100235e
Capabilities:
Check mutex on windows
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x32c
mov eax, dword [0x1006074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x30c], ax
lea eax, [ebp - 0x30a]
push esi
push eax
xor ebx, ebx
mov dword [ebp - 0x310], 0x7f
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push 0x1001598
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x1002469
xor eax, eax
mov word [ebp - 0x104], ax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov ecx, dword [ebp - 0x310]
xor eax, eax
mov word [ebp + ecx*2 - 0x104], ax
lea eax, [ebp - 0x104]
push eax
push 0x1001588
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x1002469
push 0x1001574
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x1001564
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1006268], eax
cmp eax, esi
je 0x100241f
push esi
call eax
push esi
push 0x104
lea eax, [ebp - 0x30c]
push eax
push 0x1001538
call fcn.0100366b
lea eax, [ebp - 0x30c]
push eax
push esi
push esi
call fcn.01003445
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x100625c], eax
cmp eax, esi
jne 0x100245c
xor ebx, ebx
inc ebx
jmp 0x1002518
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1002471
xor ebx, ebx
inc ebx
jmp 0x100251e
push edi
call fcn.01002214
test eax, eax
je 0x1002498
push dword [ebp + 0x14]
push edi
call fcn.01001da0
test eax, eax
je 0x1002498
push dword [0x1006140]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100249d
xor ebx, ebx
inc ebx
jmp 0x10024fc
push 1
push 0x1ff
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
call fcn.01001eb4
call fcn.0100254e
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x10024df
cmp dword [ebp - 0x328], 0x10
je 0x10024f1
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0x32c]
push eax
call edi
test eax, eax
jne 0x10024bc
jmp 0x10024fc
push dword [ebp - 0x32c]
call fcn.01001d71
mov eax, dword [0x100625c]
cmp eax, esi
je 0x100251e
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x100625c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x100625c], esi
call fcn.010025fa
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01002cd8
leave
ret 0x10
Function at 0x1002cc9
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x10049d8
call fcn.01002e74
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x1006a3c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002a84
cmp eax, esi
jne 0x1002a77
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1002a87
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002a5e
xor esi, esi
inc esi
mov eax, dword [0x1006a38]
cmp eax, esi
jne 0x1002a9a
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002ac9
mov eax, dword [0x1006a38]
test eax, eax
jne 0x1002ac3
mov dword [0x1006a38], esi
push 0x1001208
push 0x10011fc
call fcn.010029c0
pop ecx
pop ecx
test eax, eax
je 0x1002ac9
jmp 0x1002bed
mov dword [0x10064ac], esi
mov eax, dword [0x1006a38]
cmp eax, esi
jne 0x1002aed
push 0x10011f8
push 0x10011f0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006a38], 2
cmp dword [ebp - 0x20], ebx
jne 0x1002afa
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006a40], ebx
je 0x1002b1b
push 0x1006a40
call fcn.01002de9
pop ecx
test eax, eax
je 0x1002b1b
push ebx
push 2
push ebx
call dword [0x1006a40]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x1002bed
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x1002b85
cmp cx, bx
je 0x1002b40
cmp dword [ebp - 0x1c], ebx
jne 0x1002b85
movzx ecx, word [eax]
cmp cx, bx
je 0x1002b55
cmp cx, 0x20
ja 0x1002b55
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1002b40
test byte [ebp - 0x40], 1
je 0x1002b61
movzx ecx, word [ebp - 0x3c]
jmp 0x1002b64
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x10064a8], eax
cmp dword [0x100649c], ebx
jne 0x1002bca
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x1002b96
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x1002b2a
cmp dword [0x10064ac], ebx
jne 0x1002bd8
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x10064a8]
jmp 0x1002bf9
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01002eb9
ret
call fcn.01003067
jmp 0x1002a21

Function at 0x1003767
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x100187c
mov dword [ebp - 4], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x10037a2
call fcn.010036f9
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1003799
inc esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
leave
ret
Function at 0x699380
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1bb000]
push edi
or ebp, 0xffffffff
jmp 0x6993a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6993a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x699398
mov eax, 1
add ebx, ebx
jne 0x6993bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6993cc
jne 0x6993eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6993eb
dec eax
add ebx, ebx
jne 0x6993d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6993b0
add ebx, ebx
jne 0x6993e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x69943d
xor ecx, ecx
sub eax, 3
jb 0x699403
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x699472
sar eax, 1
mov ebp, eax
jmp 0x69940e
add ebx, ebx
jne 0x69940e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6993dc
inc ecx
add ebx, ebx
jne 0x69941c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6993dc
add ebx, ebx
jne 0x699429
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x69941e
jne 0x69943a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x69941e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x69945c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x69944e
jmp 0x69939e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x69945c
add edi, ecx
jmp 0x69939e
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x69947a
cmp byte [edi], 0x13
jne 0x69947a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x69947f
lea edi, [esi + 0x296000]
mov eax, dword [edi]
or eax, eax
je 0x6994f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2b2b8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2b2c50]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6994ac
mov ecx, edi
jns 0x6994db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2b2c58]
or eax, eax
je 0x6994f1
mov dword [ebx], eax
add ebx, 4
jmp 0x6994c9
call dword [esi + 0x2b2c54]
mov ebp, dword [esi + 0x2b2c5c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x69952b
sub esp, 0xffffff80
jmp 0x46f1ee
Function at 0x3080194f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x308249ec]
jne 0x30801959
repz ret
jmp fcn.3081a014

Function at 0x30807ed2
Capabilities:
Get file attributes

Disassembly:
push 0x58
mov eax, 0x3081ac18
call fcn.3081997e
mov eax, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x2c], cx
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 4], esi
xor ebx, ebx
call fcn.30807c9a
pop ecx
pop ecx
test eax, eax
je 0x30807f69
push str.__
lea ecx, [ebp - 0x64]
call fcn.3080bb77
lea ecx, [ebp - 0x2c]
push ecx
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 1
call fcn.3080bb77
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.3080bb77
push esi
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.3080bb77
push esi
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], bl
call fcn.3080bb77
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807f60
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp - 0x2c]
and bl, 1
call fcn.3080bb77
mov al, bl
call fcn.308199b4
ret
Function at 0x30807f83
Capabilities:
Create directory

Disassembly:
push 0x88
mov eax, 0x3081ac6d
call fcn.3081997e
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x10]
push str.__
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x8c], eax
call fcn.3080bb77
push esi
push eax
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.3080bb77
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 2
call fcn.3080bb77
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x30807fe2
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
push 0x5c
pop esi
cmp word [eax + ecx*2 - 2], si
je 0x30807ffa
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.3080bb77
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x94], esi
or edi, 0xffffffff
mov ecx, dword [ebp - 0x90]
push 1
push dword [ebp - 0x88]
lea eax, [ebp - 0x94]
push eax
call fcn.3080bb77
mov ecx, dword [ebp - 0x90]
mov esi, eax
cmp esi, edi
je 0x30808078
sub eax, dword [ebp - 0x88]
push eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.3080bb77
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.3080bb77
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.3080bb77
push 0x5c
push 1
lea ecx, [ebp - 0x2c]
call fcn.3080bb77
inc esi
mov dword [ebp - 0x88], esi
jmp 0x308080ac
push edi
push dword [ebp - 0x88]
lea eax, [ebp - 0x48]
push eax
call fcn.3080bb77
push edi
push ebx
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.3080bb77
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.3080bb77
mov dword [ebp - 0x88], edi
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x308080b8
lea eax, [ebp - 0x2c]
push ebx
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
setne byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x308080f5
push edi
push 4
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3080bb77
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 5
call fcn.3080bb77
lea ecx, [ebp - 0x48]
jmp 0x30808153
mov eax, dword [ebp - 0x8c]
cmp dword [eax + 0x14], 8
mov dword [eax + 0x10], ebx
jb 0x30808106
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x88], edi
jne 0x30808009
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
sete byte [ebp - 0x81]
cmp byte [ebp - 0x81], bl
je 0x3080816b
push edi
push 4
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x2c]
call fcn.3080bb77
mov ecx, dword [ebp - 0x8c]
push eax
mov byte [ebp - 4], 6
call fcn.3080bb77
lea ecx, [ebp - 0x64]
push ebx
push 1
mov byte [ebp - 4], 2
call fcn.3080bb77
cmp dword [ebp - 0x88], edi
jne 0x30808009
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], edi
call fcn.3080bb77
mov al, byte [ebp - 0x81]
call fcn.308199b4
ret