joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100117b0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 4
shl eax, 0
mov ecx, 4
shl ecx, 1
mov edx, dword [eax + 0x100734e0]
mov dword [ecx + 0x100734e0], edx
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [eax + 0x100734e0]
cmp edx, dword [ecx + 0x100734e0]
jae 0x10011812
mov eax, 4
imul eax, eax, 3
mov ecx, dword [eax + 0x100734e0]
push ecx
push 0
call dword [0x1005e27c]
mov edx, 4
shl edx, 1
mov dword [edx + 0x100734e0], eax
mov dword [ebp - 0x10], 0x11eece0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xe
call dword [0x1005e264]
mov ecx, dword [ebp - 8]
mov dword [ecx*4 + 0x100734e0], eax
jmp 0x10011848
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
je 0x100118f8
mov eax, 4
shl eax, 0
mov ecx, 4
shl ecx, 1
mov edx, dword [eax + 0x100734e0]
mov dword [ecx + 0x100734e0], edx
mov eax, 4
shl eax, 1
mov ecx, 4
shl ecx, 0
mov edx, dword [eax + 0x100734e0]
cmp edx, dword [ecx + 0x100734e0]
jae 0x100118ae
mov eax, 4
imul eax, eax, 3
mov ecx, dword [eax + 0x100734e0]
push ecx
push 0
call dword [0x1005e27c]
mov edx, 4
shl edx, 1
mov dword [edx + 0x100734e0], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
cdq
xor eax, dword [ebp - 0x10]
xor edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 0
push 0x1000193
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.10044d50
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
and edx, 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
jmp 0x1001183f
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10021680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edx, dword [ebp + 0xc]
lea eax, [ecx + edx*2]
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x100217b9
mov dword [ebp - 0x20], 0xf
call dword [0x1005e264]
mov edx, dword [ebp - 0x20]
mov dword [edx*4 + 0x10073b68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
jmp 0x100216d4
mov ecx, dword [ebp - 0x10]
add ecx, 2
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax + 8]
jae 0x100217b4
mov edx, dword [ebp - 0x10]
mov ax, word [edx]
mov word [ebp - 4], ax
movzx ecx, word [ebp - 4]
movzx edx, word [ebp + 8]
cmp ecx, edx
je 0x1002173f
movzx eax, word [ebp - 4]
cmp eax, 0x5a
jg 0x1002171a
movzx ecx, word [ebp - 4]
cmp ecx, 0x41
jl 0x1002171a
movzx edx, word [ebp - 4]
add edx, 0x20
movzx eax, word [ebp + 8]
cmp edx, eax
je 0x1002173f
movzx ecx, word [ebp - 4]
cmp ecx, 0x7a
jg 0x100217af
movzx edx, word [ebp - 4]
cmp edx, 0x61
jl 0x100217af
movzx eax, word [ebp - 4]
sub eax, 0x20
movzx ecx, word [ebp + 8]
cmp eax, ecx
jne 0x100217af
mov dword [ebp - 0x24], 0xf
call dword [0x1005e264]
mov edx, dword [ebp - 0x24]
mov dword [edx*4 + 0x10073b68], eax
mov eax, dword [ebp - 0x14]
jmp 0x10021841
jmp 0x100216c2
jmp 0x1002183e
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
jmp 0x100217ca
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
cmp edx, dword [ecx + 8]
jae 0x1002183e
mov eax, 4
shl eax, 0
mov ecx, dword [eax + 0x10073b68]
xor ecx, 0xfffff9f4
mov edx, 4
shl edx, 0
mov dword [edx + 0x10073b68], ecx
mov eax, dword [ebp - 0x10]
mov cx, word [eax]
mov word [ebp - 0xc], cx
mov edx, dword [ebp - 0x10]
add edx, 2
mov dword [ebp - 0x10], edx
movzx eax, word [ebp - 0xc]
movzx ecx, word [ebp + 8]
cmp eax, ecx
jne 0x1002183c
mov eax, dword [ebp - 0x18]
jmp 0x10021841
jmp 0x100217c1
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10037760
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051fc8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100746b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x1c], 8
cmp dword [ebp + 0x14], 0
je 0x100377a0
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
jmp 0x100377a7
mov dword [ebp - 0x18], str.Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_535.7__KHTML__like_Gecko__Chrome_16.0.912.75_Safari_535.7
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
call fcn.1001b640
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.1001bc90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100124d0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.100298c0
mov edx, 4
imul edx, edx, 3
mov eax, dword [edx + 0x100744a8]
add eax, 0x1b926f
mov ecx, 4
imul ecx, ecx, 0xb
mov dword [ecx + 0x100744a8], eax
mov edx, 4
shl edx, 0
mov eax, 4
shl eax, 1
mov ecx, dword [edx + 0x100744a8]
mov dword [eax + 0x100744a8], ecx
mov edx, 4
shl edx, 1
mov eax, 4
shl eax, 0
mov ecx, dword [edx + 0x100744a8]
cmp ecx, dword [eax + 0x100744a8]
jae 0x10037866
mov edx, 4
imul edx, edx, 3
mov eax, dword [edx + 0x100744a8]
push eax
push 0
call dword [0x1005e27c]
mov ecx, 4
shl ecx, 1
mov dword [ecx + 0x100744a8], eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.100298c0
mov dword [ebp - 0x1c], 0x1006b554
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
movsx ecx, byte [eax]
cmp ecx, 0x61
jne 0x100378c4
call dword [0x1005e264]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x100378c4
mov edx, 4
imul edx, edx, 0xb
mov eax, dword [edx + 0x100744a8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [0x1005e27c]
mov edx, 4
imul edx, edx, 0xc
mov dword [edx + 0x100744a8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x48], ecx
mov edx, 4
shl edx, 1
mov eax, dword [edx + 0x100744a8]
xor eax, 0xffffff02
mov ecx, 4
shl ecx, 1
mov dword [ecx + 0x100744a8], eax
push 0
push 0
push 1
push 0
call dword [0x1005e0e0]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.100141a0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x4c], 0
jne 0x10037998
mov eax, 4
shl eax, 0
mov ecx, dword [eax + 0x100744a8]
xor ecx, 0xfffffef8
mov edx, 4
shl edx, 0
mov dword [edx + 0x100744a8], ecx
mov eax, 0x80004005
jmp 0x100379a7
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x10]
mov eax, dword [edx + 0x54]
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1003a5b0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10052248
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100746b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], str.User_Agent:_Mozilla_5.0__Windows_NT_6.2__WOW64__AppleWebKit_535.7__KHTML__like_Gecko__Chrome_16.0.912.75_Safari_535.7_nPragma:_no_cache_nExpect:_100_continue_n
mov eax, 4
imul eax, eax, 3
mov ecx, dword [eax + 0x100744a8]
add ecx, 0x39c75ea
mov edx, 4
imul edx, edx, 0xb
mov dword [edx + 0x100744a8], ecx
mov dword [ebp - 0x20], 0
mov eax, 4
shl eax, 1
mov ecx, dword [eax + 0x100744a8]
xor ecx, 0xfffff600
mov edx, 4
shl edx, 1
mov dword [edx + 0x100744a8], ecx
push 1
lea ecx, [ebp - 0x14]
call fcn.1002e5e0
push 0
lea ecx, [ebp - 0x14]
call fcn.10030d10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10012920
push eax
push 0x10064c0c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ecx]
call eax
mov dword [ebp - 0x20], eax
mov ecx, 9
mov word [ebp - 0x1c], cx
movsx edx, word [ebp - 0x1c]
cmp dword [edx*4 + 0x100744a8], 1
jne 0x1003a691
movsx eax, word [ebp - 0x1c]
mov ecx, dword [eax*4 + 0x100744a8]
add ecx, 1
movsx edx, word [ebp - 0x1c]
mov dword [edx*4 + 0x100744a8], ecx
cmp dword [ebp - 0x20], 0
jge 0x1003a6fb
mov eax, 5
mov word [ebp - 0x18], ax
movsx ecx, word [ebp - 0x18]
cmp dword [ecx*4 + 0x100744a8], 1
jne 0x1003a6c7
movsx edx, word [ebp - 0x18]
mov eax, dword [edx*4 + 0x100744a8]
add eax, 1
movsx ecx, word [ebp - 0x18]
mov dword [ecx*4 + 0x100744a8], eax
mov dword [ebp - 0x2c], 3
call dword [0x1005e264]
mov edx, dword [ebp - 0x2c]
mov dword [edx*4 + 0x100744a8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10029400
mov eax, dword [ebp - 0x34]
jmp 0x1003a798
lea ecx, [ebp - 0x14]
call fcn.10029b00
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
call edx
mov dword [ebp - 0x20], eax
mov eax, 4
shl eax, 0
mov ecx, dword [eax + 0x100744a8]
xor ecx, 0xfffff5c2
mov edx, 4
shl edx, 0
mov dword [edx + 0x100744a8], ecx
cmp dword [ebp - 0x20], 0
jge 0x1003a77f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10029400
mov eax, dword [ebp - 0x30]
jmp 0x1003a798
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10029400
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10042134
mov esp, ebp
pop ebp
ret
Function at 0x1003ef10
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100525c1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x100746b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 8], 0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.1001b520
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.1001b520
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.1001b520
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0xffffffff
call fcn.100409a0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], edx
push 1
push 0
push 0
call dword [0x1005e06c]
push eax
call fcn.1000f790
add esp, 0xc
mov ecx, dword [ebp - 0x10]
call fcn.10040350
mov dword [ebp - 0x18], 0x10075b84
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x18]
movsx eax, byte [edx]
cmp eax, 0x61
jne 0x1003f016
call dword [0x1005e264]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1003f016
mov ecx, 4
imul ecx, ecx, 0xb
mov edx, dword [ecx + 0x100745b0]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [0x1005e27c]
mov ecx, 4
imul ecx, ecx, 0xc
mov dword [ecx + 0x100745b0], eax
mov ecx, dword [ebp - 0x10]
call fcn.1003f6b0
mov ecx, dword [ebp - 0x10]
call fcn.1003f740
mov edx, 4
shl edx, 1
mov eax, dword [edx + 0x100745b0]
xor eax, 0xfffffee1
mov ecx, 4
shl ecx, 1
mov dword [ecx + 0x100745b0], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412040
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x412062
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412069
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x412058
mov eax, 1
add ebx, ebx
jne 0x41207b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412070
jne 0x41208c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412070
xor ecx, ecx
sub eax, 3
jb 0x4120a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x412112
mov ebp, eax
add ebx, ebx
jne 0x4120ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4120b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4120dc
inc ecx
add ebx, ebx
jne 0x4120c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4120bd
jne 0x4120d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4120bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4120fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4120ed
jmp 0x41205e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4120fc
add edi, ecx
jmp 0x41205e
pop esi
mov edi, esi
mov ecx, 0x81
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41211a
cmp byte [edi], 4
jne 0x41211a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41211f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x412197
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x131b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x131ec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41214c
mov ecx, edi
jns 0x41217b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x131f0]
or eax, eax
je 0x412191
mov dword [ebx], eax
add ebx, 4
jmp 0x412169
call dword [esi + 0x13200]
mov ebp, dword [esi + 0x131f4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1df]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4121cb
sub esp, 0xffffff80
jmp 0x4015d4
Function at 0x407c7f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ec40]
jne 0x407c89
repz ret
jmp fcn.0040c3bd

Function at 0x40b110
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405eb0
and dword [ebp - 4], 0
cmp dword [0x438600], 0
mov ebx, eax
jne 0x40b1c1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b272
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b272
push eax
call fcn.00405e3e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x438600], eax
call esi
push eax
call fcn.00405e3e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x438604], eax
call esi
push eax
call fcn.00405e3e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438608], eax
call esi
push eax
call fcn.00405e3e
pop ecx
mov dword [0x438610], eax
test eax, eax
je 0x40b1c1
push 0x42aec0
push edi
call esi
push eax
call fcn.00405e3e
pop ecx
mov dword [0x43860c], eax
mov eax, dword [0x43860c]
cmp eax, ebx
je 0x40b219
cmp dword [0x438610], ebx
je 0x40b219
push eax
call fcn.00405eb9
push dword [0x438610]
mov esi, eax
call fcn.00405eb9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b219
test edi, edi
je 0x40b219
call esi
test eax, eax
je 0x40b210
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b210
test byte [ebp - 0xc], 1
jne 0x40b219
or dword [ebp + 0x10], 0x200000
jmp 0x40b252
mov eax, dword [0x438604]
cmp eax, ebx
je 0x40b252
push eax
call fcn.00405eb9
pop ecx
test eax, eax
je 0x40b252
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b252
mov eax, dword [0x438608]
cmp eax, ebx
je 0x40b252
push eax
call fcn.00405eb9
pop ecx
test eax, eax
je 0x40b252
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x438600]
call fcn.00405eb9
pop ecx
test eax, eax
je 0x40b272
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b274
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41cb00
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x425dc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1ef9f28]
push edi
mov edi, dword [0x1efa584]
push eax
call fcn.0041ca30
add esp, 4
cmp dword [0x1efa584], 0x2f
jne 0x41cb5d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.0041ca80
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ce20
Capabilities:
Get disk information
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.004076f0
mov eax, dword [0x425004]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x41ce49
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xbbe2aa2
jge 0x41cef1
cmp dword [0x1efa584], 0xa5f
jne 0x41ce95
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
lea edx, [ebp - 0x818]
push edx
push str.wefanecidageziroxefojuvu
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 4], 0x84526b
jne 0x41ceba
mov eax, dword [0x426be0]
mov dword [0x1efa584], eax
mov ecx, dword [0x1efa584]
add ecx, 0xa231
mov dword [0x1efa584], ecx
cmp dword [0x1efa584], 0x141
jne 0x41ceec
push str.jisaxivemuvanacucoxoxobo_necogoduhutevepipojomaji_kadesezimini_joretevigusopibiyigibiga_wemakihumovuyo
lea edx, [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [0x4282a0], 0xec58acac
mov dword [0x4282a4], 0xffffffff
jmp 0x41ce40
call fcn.0041cb70
jmp dword [0x1ef9f28]
Function at 0x100176c0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [0x1001e7f8]
mov eax, dword [eax]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x22c]
call eax
test eax, eax
je 0x10017710
push 0x50e
push str.hprof_util.c
push str.Unable_to_get_potential_JVMTI_capabilities.
push 0
push 0
call fcn.10005d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d10
ret

Function at 0x10017720
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x1001e7f8]
mov eax, dword [eax]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x234]
call eax
test eax, eax
je 0x10017763
push 0x51b
push str.hprof_util.c
push str.Unable_to_get_necessary_JVMTI_capabilities.
push 0
push 0
call fcn.10005d70
add esp, 0x14
mov dword [esp + 4], 1
jmp fcn.10005d10
ret

Function at 0x10017ff3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e108]
jne 0x10017ffd
repz ret
jmp fcn.10018482

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x452830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4b000]
push edi
or ebp, 0xffffffff
jmp 0x452852
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x452859
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x452848
mov eax, 1
add ebx, ebx
jne 0x45286b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45287c
jne 0x45289b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45289b
dec eax
add ebx, ebx
jne 0x452888
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x452860
add ebx, ebx
jne 0x452897
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4528ed
xor ecx, ecx
sub eax, 3
jb 0x4528b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x452922
sar eax, 1
mov ebp, eax
jmp 0x4528be
add ebx, ebx
jne 0x4528be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45288c
inc ecx
add ebx, ebx
jne 0x4528cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45288c
add ebx, ebx
jne 0x4528d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4528ce
jne 0x4528ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4528ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45290c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4528fe
jmp 0x45284e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45290c
add edi, ecx
jmp 0x45284e
pop esi
mov edi, esi
mov ecx, 0xaf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45292a
cmp byte [edi], 1
jne 0x45292a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45292f
lea edi, [esi + 0x50000]
mov eax, dword [edi]
or eax, eax
je 0x4529a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x52fb0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x52fec]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45295c
mov ecx, edi
jns 0x45298b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x52ff0]
or eax, eax
je 0x4529a1
mov dword [ebx], eax
add ebx, 4
jmp 0x452979
call dword [esi + 0x53000]
mov ebp, dword [esi + 0x52ff4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4529db
sub esp, 0xffffff80
jmp 0x4018cc