joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007320
Capabilities:
Inspect section memory permissions

Disassembly:
push edx
push ecx
push ebx
push edi
inc ecx
push eax
inc ecx
push ecx
inc ecx
push edx
inc ecx
push ebx
inc ecx
push esp
inc ecx
push ebp
inc ecx
push esi
dec eax
sub esp, 0x30
inc ecx
mov ebp, eax
xor eax, eax
cpuid
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x20], 0
je 0x1007850
inc ecx
cmp ebp, 1
je 0x1007872
mov eax, 1
cpuid
inc ecx
mov ecx, edx
mov edi, edx
inc ecx
and ecx, 0x8000
and edi, 1
inc ecx
mov eax, ecx
inc ecx
mov esp, eax
dec ecx
shr ecx, 0xd
test edx, 0x800000
dec ecx
lea edi, [ecx + edi*2 + 1]
dec esp
lea edx, [edi + 8]
dec ecx
cmovne edi, edx
test edx, 0x1000000
jne 0x10073c5
inc ebp
mov ebx, eax
dec esp
lea ecx, [edi + 0x10]
dec eax
add edi, 0x30
test edx, 0x2000000
dec esp
cmovne ecx, edi
and edx, 0x4000000
inc ecx
and ebx, 0x200
dec eax
shr edx, 0x14
inc ecx
test eax, 1
dec edx
lea edi, [edx + ecx]
dec ebp
lea edx, [ecx + edx + 0x80]
inc ebp
mov ecx, eax
dec ecx
cmovne edi, edx
inc ecx
and ecx, 0x80000
dec ecx
shr ebx, 1
inc esp
mov edx, eax
dec ecx
or edi, ebx
inc ebp
mov ebx, eax
dec ecx
mov esi, edi
inc ecx
and ebx, 0x800000
dec ecx
or esi, 0x800
inc ecx
test eax, 0x400000
dec ecx
cmovne edi, esi
and edx, 0x2000000
dec ecx
shr ecx, 0xa
dec ecx
or edi, ecx
dec ecx
mov edx, edi
dec ecx
or edx, 0x400
inc ecx
test eax, 0x100000
dec ecx
cmovne edi, edx
dec ecx
shr ebx, 0xb
dec ecx
or edi, ebx
dec eax
mov eax, edi
dec eax
or eax, 0x2000
inc ecx
test eax, 2
dec eax
cmovne edi, eax
dec eax
shr edx, 0xb
dec eax
or edi, edx
mov eax, 7
xor ecx, ecx
cpuid
inc ecx
mov edx, ecx
inc ecx
mov ecx, ebx
dec eax
mov ecx, 0
or byte [eax], al
add byte [eax], al
inc esp
mov ebx, eax
dec eax
or ecx, edi
inc ecx
test ecx, 0x20000000
inc ecx
mov ebx, edx
dec eax
cmovne edi, ecx
and ebx, 0x40000000
dec eax
shr ebx, 0xd
dec eax
or edi, ebx
dec eax
mov dword [0x5c6cd], 1
dec eax
add esp, 0x30
inc ecx
pop esi
inc ecx
pop ebp
inc ecx
pop esp
inc ecx
pop ebx
inc ecx
pop edx
inc ecx
pop ecx
inc ecx
pop eax
pop edi
pop ebx
pop ecx
pop edx
ret
cmp dword [esp + 0x24], 0x756e6547
jne 0x1007850
cmp dword [esp + 0x2c], 0x49656e69
jne 0x1007850
cmp dword [esp + 0x28], 0x6c65746e
jne 0x1007850
jmp 0x1007362
Function at 0x1001578d
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10015810
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x100157dc
mov dword [ebp - 0x10], 1
jmp 0x100157e0
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jne 0x100157f7
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x100157f7
and dword [ebp - 0x14], 0
jmp 0x100157fe
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 8]
push 5
pop ecx
sub ecx, dword [eax]
add ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x10015861
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10015832
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x14
jge 0x10015861
mov dword [ebp - 0x30], 0xf9e923e6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10015857
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [ebp - 0x30], 0
je 0x1001585f
jmp 0x10015861
jmp 0x10015827
mov esp, ebp
pop ebp
ret

Function at 0x10015865
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001587b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x100158c3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100158a9
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100158c3
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001807e
and dword [eax], 0
jmp 0x1001589e
mov esp, ebp
pop ebp
ret
Function at 0x10015df4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10015e16
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10015e90
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10015e44
or eax, 0xffffffff
je 0x10015e44
mov dword [ebp - 8], 1
jmp 0x10015e48
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10015e6a
mov eax, dword [ebp - 4]
mov ecx, 0xd94b
sub ecx, dword [eax]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax]
je 0x10015e6a
mov dword [ebp - 0xc], 1
jmp 0x10015e6e
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0xc]
jge 0x10015e84
mov dword [ebp - 0x10], 1
jmp 0x10015e88
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001e0bb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001e116
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001e0f7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001e114
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001807e
mov dword [eax], 1
jmp 0x1001e0ec
jmp 0x1001e139
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001e139
push 0x19a0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret
Function at 0x1002abff
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002ad11
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 2
mov ecx, dword [ebp - 0xc]
call fcn.1001807e
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
neg ecx
cmp dword [eax], ecx
jne 0x1002ac77
mov dword [ebp - 0x10], 1
jmp 0x1002ac7b
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 0
jb 0x1002aca4
mov dword [ebp - 8], 1
jmp 0x1002aca8
and dword [ebp - 8], 0
push 0
mov ecx, dword [ebp - 0x40]
call fcn.1001807e
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
push 0
mov ecx, dword [ebp - 0xc]
call fcn.1001807e
mov eax, dword [eax]
imul eax, dword [ebp - 8]
cmp eax, 0x46df
jg 0x1002acd7
mov dword [ebp - 0x14], 1
jmp 0x1002acdb
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jg 0x1002acec
mov dword [ebp - 0x1c], 1
jmp 0x1002acf0
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jl 0x1002ad03
mov dword [ebp - 0x20], 1
jmp 0x1002ad07
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
jmp 0x1002ad17
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x1002af0e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002af48
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002af43
push 0
push 0x127
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1002b03a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 0xffffffff
jg 0x1002afad
mov dword [ebp - 8], 1
jmp 0x1002afb1
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x40]
mov dword [eax], 6
push 6
pop eax
test eax, eax
je 0x1002afdf
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x1002afdf
or eax, 0xffffffff
je 0x1002afdf
mov dword [ebp - 4], 1
jmp 0x1002afe3
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
sub eax, 6
mov ecx, dword [ebp - 0x48]
imul eax, dword [ecx]
cmp dword [ebp - 8], eax
jg 0x1002affd
mov dword [ebp - 0x4c], 1
jmp 0x1002b001
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
xor eax, eax
inc eax
jne 0x1002b017
mov dword [ebp - 0x10], 1
jmp 0x1002b01b
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jge 0x1002b02e
mov dword [ebp - 0x14], 1
jmp 0x1002b032
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002ff28
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10030016
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1002ff79
mov eax, 0x1a969ac5
test eax, eax
je 0x1002ff79
mov dword [ebp - 0x24], 1
jmp 0x1002ff7d
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x28]
mov dword [eax], 0x8eb98764
mov eax, dword [ebp - 4]
cmp dword [eax], 0x8eb98764
jge 0x1002ffaa
mov dword [ebp - 8], 1
jmp 0x1002ffae
and dword [ebp - 8], 0
mov eax, dword [ebp - 8]
inc eax
cmp eax, 0x3b3f3656
jle 0x1002ffc2
mov dword [ebp - 0xc], 1
jmp 0x1002ffc6
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0xc]
cmp eax, 0xe52509e7
jae 0x1002ffdf
mov dword [ebp - 0x10], 1
jmp 0x1002ffe3
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
cmp eax, dword [ecx]
jg 0x1002fffb
mov dword [ebp - 0x14], 1
jmp 0x1002ffff
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov esi, dword [eax]
imul esi, dword [ebp - 0x14]
push 0
mov ecx, dword [ebp - 0x2c]
call fcn.1001807e
mov dword [eax], esi
jmp 0x1003003b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1003003b
push 0
push 0x106a
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100310cd
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100310f1
xor eax, eax
jmp 0x10031213
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1003110f
xor eax, eax
jmp 0x10031213
push dword [ebp - 8]
push 1
lea eax, [ebp - 0xc]
push eax
call fcn.10030c58
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1003112d
xor eax, eax
jmp 0x10031213
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4cfb
call fcn.10030f07
add esp, 0x1c
push dword [ebp - 4]
push dword [ebp - 8]
push 0x2e6e
push 0
push dword [ebp + 8]
call fcn.10028f2d
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1003118d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 1
push 0x6443
call fcn.10030fa1
add esp, 0x10
push dword [ebp - 4]
call fcn.10030b24
pop ecx
test eax, eax
jne 0x1003119e
xor eax, eax
jmp 0x10031213
lea eax, [ebp - 4]
push eax
push 0x17b2
push 0x2635
push 1
call fcn.10031002
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100311fb
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x100311d5
xor eax, eax
jmp 0x10031213
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100311ee
xor eax, eax
jmp 0x10031213
push 1
lea eax, [ebp - 4]
push eax
call fcn.10031086
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1003120c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10031210
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004714c
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10047183
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10047181
push 0
push 0x127
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1004719c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004719c
push 0x1e96
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret

Function at 0x100486a2
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100486d7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax + 0xc], ecx
jmp 0x100486dd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret

Function at 0x100486e1
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10048728
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x18]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1004873e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1004873e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x1007be50
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100863b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006b5aa
mov dword [ebp - 0x14], eax
cmp dword [0x10672c74], esi
jne 0x1007bf43
push 0x800
push esi
push 0x10007a3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007bed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007c023
push esi
push esi
push 0x10007a3c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007c023
push 0x10007a54
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007c023
push eax
call ebx
push 0x10007a60
push edi
mov dword [0x10672c74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007a70
push edi
mov dword [0x10672c78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007a84
push edi
mov dword [0x10672c7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10672c84], eax
test eax, eax
je 0x1007bf40
push 0x10007aa0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10672c80], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007bf68
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007bf5b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007bf7d
push 4
pop eax
jmp 0x1007c025
cmp dword [ebp - 0x14], esi
je 0x1007bf7d
push dword [0x10672c74]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007bf62
mov eax, dword [0x10672c80]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007bfdb
cmp dword [0x10672c84], edi
je 0x1007bfdb
push eax
call ebx
push dword [0x10672c84]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007bfdb
test eax, eax
je 0x1007bfdb
call ecx
test eax, eax
je 0x1007bfd0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007bfd0
test byte [ebp - 8], 1
jne 0x1007bfdb
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007c00b
mov eax, dword [0x10672c78]
cmp eax, edi
je 0x1007c008
push eax
call ebx
test eax, eax
je 0x1007c008
call eax
mov esi, eax
test esi, esi
je 0x1007c008
mov eax, dword [0x10672c7c]
cmp eax, edi
je 0x1007c008
push eax
call ebx
test eax, eax
je 0x1007c008
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10672c74]
call ebx
test eax, eax
je 0x1007c023
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007c025
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10067b85
mov esp, ebp
pop ebp
ret
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219