joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b9a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003a2dc]
jne 0x1001b9aa
repz ret
jmp fcn.10020b2b

Function at 0x10029965
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10020c92
xor ebx, ebx
cmp dword [0x1003c820], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10029a3a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x100299a5
xor eax, eax
jmp 0x10029afe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x1002999e
push eax
call fcn.10020c2f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003c820], eax
call esi
push eax
call fcn.10020c2f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003c824], eax
call esi
push eax
call fcn.10020c2f
mov dword [0x1003c828], eax
lea eax, [ebp - 8]
push eax
call fcn.1001bb4a
test eax, eax
pop ecx
pop ecx
je 0x10029a08
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001d597
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10029a3a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10020c2f
cmp eax, ebx
pop ecx
mov dword [0x1003c830], eax
je 0x10029a3a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10020c2f
pop ecx
mov dword [0x1003c82c], eax
mov eax, dword [0x1003c82c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x10029ab3
cmp dword [0x1003c830], esi
je 0x10029ab3
push eax
call fcn.10020c9b
pop ecx
call eax
cmp eax, ebx
je 0x10029a80
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1003c830]
call fcn.10020c9b
pop ecx
call eax
test eax, eax
je 0x10029a80
test byte [ebp - 0x18], 1
jne 0x10029ab3
lea eax, [ebp - 0xc]
push eax
call fcn.1001bb81
test eax, eax
pop ecx
je 0x10029a9b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001d597
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x10029aaa
or dword [ebp + 0x10], 0x200000
jmp 0x10029ae4
or dword [ebp + 0x10], 0x40000
jmp 0x10029ae4
mov eax, dword [0x1003c824]
cmp eax, esi
je 0x10029ae4
push eax
call fcn.10020c9b
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10029ae4
mov eax, dword [0x1003c828]
cmp eax, esi
je 0x10029ae4
push dword [ebp - 4]
push eax
call fcn.10020c9b
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1003c820]
call fcn.10020c9b
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xac0dcc
Capabilities:
Encode data using xor

Disassembly:
jmp 0xac0dd6
pushal
call 0xac0ddc
pop ebp
sub ebp, 0x10
sub ebp, 0x6c0dcc
jmp 0xac0df2
mov eax, 0x6c0dcc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fa
mov edx, 0x203cb4
xor byte [eax], dl
inc eax
dec ecx
jne 0xac0e09
jmp 0xac0e1c
aas
jns 0xac0e5e
cmp eax, 0xb4b4b488
xor eax, 0xb4b44c75
mov ah, 0xb7
jns 0xac0e39
mov al, 0xb4
mov ah, 0xb4
push cs
pushfd
mov ah, 0xb4
mov ah, 0x43
push esi
mov bh, 0x7c
aas
jl 0xac0e7a
xor eax, 0xb4b4b4b8
mov bh, 0x71
in al, 0x39
rcl byte [eax - 0x6f4fc2b8]
invalid
mov ah, 0xb4
mov ah, 0x5d
lcall 0x90d0, 0x39b4b4b4
dec eax
cmp eax, 0x583f9098
aas
xor dword [esp + esi*4 + 0x213fb4b4], edi
mov eax, 0x3fb4b4b4
mov ah, 0x3f
cmp dword [esp + esi*4 + 0x5d75b4b4], esp
mov dh, 0x85
mov dh, 0x37
jbe 0xac0e39
std
mov ebx, 0x4b4b4031
dec ebx
jmp 0x4060c70b
Function at 0x406b98
Capabilities:
Encode data using xor
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push 0
push 0
push 0
cld
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
sub eax, 3
mov edx, dword [ecx]
imul eax, edx
cmp al, 0x7c
je 0x406be6
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessId]
cmp eax, dword [edx + ebp]
je 0x406c29
mov eax, 0x406be1
lea eax, [edx + eax]
push ebp
push eax
push 0
call sub.KERNEL32.dll_EnumResourceTypesA
test eax, eax
jne 0x406bff
jmp 0x406c29
retf
cmc
nop
mov eax, esp
lea eax, [eax + 8]
mov ecx, eax
or eax, dword [ecx]
and eax, dword [ecx]
cld
or eax, 7
xchg dword [esp + 0xc], edx
lea eax, es:[eax + 0x789693]
xchg ebx, eax
xchg esi, eax
js 0x406c03
add eax, 0xff87c9b8
add dword es:[edx - 0x1b4], eax
mov ecx, dword [esp]
sub esp, 0xffffffec
mov eax, 0
push cs
pop dx
push dx
push ecx
jmp 0x406be4
add byte [eax], al
add byte [eax], al
or eax, 0x6900362f
jnp 0x406c96
add byte [ebx - 0x34e35ea9], cl
leave
call 0x193e6c56
mov dword [0xb5af3b3c], eax
in al, dx
cdq
xor eax, 0xe700d22e
int 0xb
inc eax
add byte [ebx - 0x2effdb44], cl
add al, 0
inc edi
out dx, al
sub eax, 0x60e0080
add byte [ecx - 0x19], dl
cli
jae 0x406c4e
das
ljmp 0xf4b9
dec edi
sbb dword [eax], 0xffffffe9
adc al, byte [eax]
xor dword [edi], edx
ja 0x406d10
add bh, bl
retf 0xa0f5
mov edi, 0xb00086
out 0, al
fisttp dword [ecx + edi*8 + 0x5c]
inc eax
add byte [ebx + 0x7e4d0052], cl
add byte [eax], 0x70
add byte [edi - 0x3474ffbe], dh
mov edx, 0x5eae7988
movsb byte es:[edi], byte [esi]
add byte [esi + 0x2a8bcde8], bl
out dx, eax
or cl, byte [ebx]
xlatb
mov bh, 0xb4
add byte [ecx], cl
push ebp
mov dword [ebx - 0x1c], edi
add ah, dl
add byte [esi - 0x315e0ec9], bh
mov esi, 0x798e57ad
cmc
lds eax, [esi]
jl 0x406d9d
add byte [esi], al
mov eax, dword [0xb40006]
lahf
cld
clc
sahf
mov bh, 0x43
sbb al, 0xde
pushfd
and al, 0
cli
jmp 0x406d73
add byte [edx - 0x33b63d00], ah
invalid
lahf
adc esi, dword gs:[eax - 0x44c44600]
add ebp, dword [esp + eax*8]
add byte [ebx - 0x6a71f6a2], dh
fld st(7)
stosd dword es:[edi], eax
pop esi
or dword [esi - 0x5438266b], ecx
stosb byte es:[edi], al
imul ebp, dword [ecx], 0x69c77de7
pop edx
and al, 0
and al, 0
mov esi, 0x50030044
add byte [eax + eax], ah
mov edx, 0x2d5c00c0
adc eax, 0x3b1ac9a1
in al, 0
xor byte [eax], al
lcall 0xf6ed, 0x5c00b06e
add byte [0xc2358fca], ah
add byte [edx - 0x35da3600], dl
aam 0
mov cl, byte [edx + 0x2d]
out 0, al
jecxz 0x406daa
test byte [eax], 0x73
scasd eax, dword es:[edi]
std
cmp byte [eax + eax], dl
movsd dword es:[edi], dword [esi]
pop ss
sbb al, 0x81
add byte [eax], 0x20
add byte [ebx - 0x112e35fd], cl
aad 0x26
add cl, bh
jmp 0x406e37
mov al, byte [0x34b39e00]
add byte [ebx], dh
cmp eax, 0xa673ec
adc esp, dword [edi + 0xd]
int 0xc0
add byte [esi + ebx*8 + 0x21290030], bl
pushfd
adc dword [ebx], ebp
push edi
jmp 0x9a55efb1
Function at 0x4033c0
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, 0x104c
call fcn.0040f790
mov eax, dword [0x1a163fc]
mov ecx, dword [0x1a13304]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403523
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x1a163fc], 0x959
jne 0x403509
push 0
push 0
call edi
lea eax, [esp + 0x38]
push eax
call ebx
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x5c]
push edx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x860]
push ecx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea edx, [esp + 0x45c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0x402e24
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0x402e44
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
push 0
push 0x402e48
push 0x402e50
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0x402e64
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004031f0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403404
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104c
ret
Function at 0x4051bd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4421f8]
jne 0x4051c7
repz ret
jmp fcn.0040be1c

Function at 0x40d47e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004098fb
and dword [ebp - 4], 0
cmp dword [0x445950], 0
mov ebx, eax
jne 0x40d52f
push 0x40248c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d5e0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402480
push edi
call esi
test eax, eax
je 0x40d5e0
push eax
call fcn.00409889
mov dword [esp], 0x402470
push edi
mov dword [0x445950], eax
call esi
push eax
call fcn.00409889
mov dword [esp], 0x40245c
push edi
mov dword [0x445954], eax
call esi
push eax
call fcn.00409889
mov dword [esp], 0x402440
push edi
mov dword [0x445958], eax
call esi
push eax
call fcn.00409889
pop ecx
mov dword [0x445960], eax
test eax, eax
je 0x40d52f
push 0x402428
push edi
call esi
push eax
call fcn.00409889
pop ecx
mov dword [0x44595c], eax
mov eax, dword [0x44595c]
cmp eax, ebx
je 0x40d587
cmp dword [0x445960], ebx
je 0x40d587
push eax
call fcn.00409904
push dword [0x445960]
mov esi, eax
call fcn.00409904
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d587
test edi, edi
je 0x40d587
call esi
test eax, eax
je 0x40d57e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d57e
test byte [ebp - 0xc], 1
jne 0x40d587
or dword [ebp + 0x10], 0x200000
jmp 0x40d5c0
mov eax, dword [0x445954]
cmp eax, ebx
je 0x40d5c0
push eax
call fcn.00409904
pop ecx
test eax, eax
je 0x40d5c0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d5c0
mov eax, dword [0x445958]
cmp eax, ebx
je 0x40d5c0
push eax
call fcn.00409904
pop ecx
test eax, eax
je 0x40d5c0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445950]
call fcn.00409904
pop ecx
test eax, eax
je 0x40d5e0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d5e2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1f894fc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1f89506
pushal
call 0x1f8950c
pop ebp
sub ebp, 0x10
sub ebp, 0x1b894fc
jmp 0x1f89522
mov eax, 0x1b894fc
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c6
mov edx, 0x4caa02c3
xor byte [eax], dl
inc eax
dec ecx
jne 0x1f89539
jmp 0x1f8954c
dec eax
push cs
dec eax
dec edx
inc ebx
ret
Function at 0x4095f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4193c8]
jne 0x4095fe
repz ret
jmp fcn.0040fe4c

Function at 0x4152e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040e6cc
and dword [ebp - 4], 0
cmp dword [0x449e3c], 0
mov ebx, eax
jne 0x415396
push 0x40349c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415447
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403490
push edi
call esi
test eax, eax
je 0x415447
push eax
call fcn.0040e65a
mov dword [esp], 0x403480
push edi
mov dword [0x449e3c], eax
call esi
push eax
call fcn.0040e65a
mov dword [esp], 0x40346c
push edi
mov dword [0x449e40], eax
call esi
push eax
call fcn.0040e65a
mov dword [esp], 0x403450
push edi
mov dword [0x449e44], eax
call esi
push eax
call fcn.0040e65a
pop ecx
mov dword [0x449e4c], eax
test eax, eax
je 0x415396
push 0x403438
push edi
call esi
push eax
call fcn.0040e65a
pop ecx
mov dword [0x449e48], eax
mov eax, dword [0x449e48]
cmp eax, ebx
je 0x4153ee
cmp dword [0x449e4c], ebx
je 0x4153ee
push eax
call fcn.0040e6d5
push dword [0x449e4c]
mov esi, eax
call fcn.0040e6d5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4153ee
test edi, edi
je 0x4153ee
call esi
test eax, eax
je 0x4153e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4153e5
test byte [ebp - 0xc], 1
jne 0x4153ee
or dword [ebp + 0x10], 0x200000
jmp 0x415427
mov eax, dword [0x449e40]
cmp eax, ebx
je 0x415427
push eax
call fcn.0040e6d5
pop ecx
test eax, eax
je 0x415427
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415427
mov eax, dword [0x449e44]
cmp eax, ebx
je 0x415427
push eax
call fcn.0040e6d5
pop ecx
test eax, eax
je 0x415427
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x449e3c]
call fcn.0040e6d5
pop ecx
test eax, eax
je 0x415447
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415449
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4092db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d410]
jne 0x4092e5
repz ret
jmp fcn.0040fac4

Function at 0x40c0ec
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41d410]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406a29
and dword [ebp - 0x14], 0
cmp dword [0x43da7c], 0
mov dword [ebp - 0x18], eax
jne 0x40c19f
push 0x402398
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c247
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40238c
push ebx
call edi
test eax, eax
je 0x40c247
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40237c
push ebx
mov dword [0x43da7c], eax
call edi
push eax
call esi
push 0x402368
push ebx
mov dword [0x43da80], eax
call edi
push eax
call esi
push 0x40234c
push ebx
mov dword [0x43da84], eax
call edi
push eax
call esi
mov dword [0x43da8c], eax
test eax, eax
je 0x40c19f
push 0x402334
push ebx
call edi
push eax
call esi
mov dword [0x43da88], eax
mov eax, dword [0x43da88]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40c1f8
cmp dword [0x43da8c], ecx
je 0x40c1f8
push eax
call esi
push dword [0x43da8c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40c1f8
test ebx, ebx
je 0x40c1f8
call edi
test eax, eax
je 0x40c1ef
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40c1ef
test byte [ebp - 8], 1
jne 0x40c1f8
or dword [ebp + 0x10], 0x200000
jmp 0x40c22b
mov eax, dword [0x43da80]
cmp eax, dword [ebp - 0x18]
je 0x40c22b
push eax
call esi
test eax, eax
je 0x40c22b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c22b
mov eax, dword [0x43da84]
cmp eax, dword [ebp - 0x18]
je 0x40c22b
push eax
call esi
test eax, eax
je 0x40c22b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43da7c]
call esi
test eax, eax
je 0x40c247
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40c249
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004092db
leave
ret

Function at 0x41b1a0
Capabilities:
Delete file
Get uefi variable

Disassembly:
sub esp, 0x800
cmp dword [0x2b675e4], 0x37
jne 0x41b210
push 0x4035c8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x4035f8
push 0x403648
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
push 0
lea eax, [esp + 4]
push eax
push 0x40367c
push 0x4036a4
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
lea ecx, [esp + 0x404]
push ecx
push 0x4036c8
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov edx, dword [0x2b679f8]
mov ecx, dword [0x2b670c8]
mov al, byte [edx + esi + 0x38d6]
mov byte [ecx + esi], al
add esp, 0x800
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
nop
mov ecx, 0x2f0c127a
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x47cb77b5
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10004fc2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
lea ebx, [esi + 0x34]
mov dword [esi + 4], edi
mov ecx, ebx
mov dword [esi + 0x18], edi
call fcn.10001000
lea ecx, [esi + 0x40]
call fcn.10001000
lea ecx, [esi + 0x48]
call fcn.10001000
lea ecx, [esi + 0x50]
call fcn.10001000
lea ecx, [esi + 0x58]
call fcn.10001000
lea ecx, [esi + 0x60]
call fcn.10001000
lea ecx, [esi + 0x68]
call fcn.10001000
lea ecx, [esi + 0x78]
call fcn.10001000
lea ecx, [esi + 0x80]
call fcn.10001000
lea ecx, [esi + 0x40]
mov dword [esi], 0x10015234
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], edi
call fcn.10001392
lea ecx, [esi + 0x48]
call fcn.10001392
lea ecx, [esi + 0x50]
call fcn.10001392
lea ecx, [esi + 0x60]
call fcn.10001392
lea ecx, [esi + 0x68]
call fcn.10001392
mov dword [0x1001ab7c], edi
mov dword [0x1001ab80], edi
push str.c:_re
mov ecx, ebx
mov dword [esi + 0x70], edi
call fcn.10001576
push 0x100173d0
mov ecx, ebx
call fcn.1000171e
push str.led_
mov ecx, ebx
call fcn.1000171e
push 0x9c
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.1000f530
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x9c
push eax
call edi
test eax, eax
jne 0x100050e4
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
push eax
call edi
cmp dword [ebp - 0x98], 6
jb 0x10005111
push str.c:_Re
mov ecx, ebx
call fcn.10001576
push 0x100173d0
mov ecx, ebx
call fcn.1000171e
push str.le.bin_
mov ecx, ebx
call fcn.1000171e
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100074aa
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x18]
call fcn.10001000
lea ecx, [ebp - 8]
call fcn.10001000
lea ecx, [ebp - 0x28]
call fcn.10001000
mov edi, dword [ebp + 8]
push 0
push 0x80
push 3
mov eax, dword [edi + 4]
push 0
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp dword [ebp + 0xc], 0x14
mov ebx, eax
mov dword [ebp - 0xc], 0x1c48345
mov dword [ebp - 0x10], 0x8aed3500
jne 0x10007509
mov dword [ebp - 0x10], 0x92ee0c00
cmp ebx, 0xffffffff
je 0x100075bf
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x100075bf
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x34]
lea ecx, [ebp - 0x18]
push eax
call fcn.10001553
mov eax, dword [ebp + 0xc]
sub eax, 3
je 0x1000757a
dec eax
je 0x10007573
dec eax
je 0x1000756c
sub eax, 0xf
je 0x1000757a
dec eax
je 0x10007565
dec eax
je 0x1000755e
dec eax
je 0x10007573
jmp 0x10007594
push 0x100175c8
jmp 0x1000757f
push 0x100175c4
jmp 0x1000757f
push 0x100175c0
jmp 0x1000757f
push 0x100175bc
jmp 0x1000757f
push 0x100175b8
lea ecx, [ebp - 8]
call fcn.10001576
push str..dat
lea ecx, [ebp - 8]
call fcn.1000171e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10001661
mov eax, dword [eax + 4]
add esp, 0xc
push 0
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x20]
call fcn.10001171
push dword [esi + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0x7c]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea ecx, [ebp - 0x28]
call fcn.10001171
lea ecx, [ebp - 8]
call fcn.10001171
lea ecx, [ebp - 0x18]
call fcn.10001171
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x1000763b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 8]
lea ecx, [esi + 0x78]
call fcn.10001576
lea ecx, [esi + 0x80]
call fcn.10001392
mov ecx, dword [esi + 4]
lea eax, [esi + 0x74]
mov dword [eax], ecx
lea ecx, [ebp + 8]
push ecx
xor ecx, ecx
push ecx
push eax
push 0x100075f3
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x70], eax
pop esi
pop ebp
ret 4
Function at 0x1000767c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0xc]
call fcn.10001000
lea eax, [ebp - 4]
push eax
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x100076b4
cmp dword [ebp - 4], 0x103
jne 0x100076b4
push 0xffffffffffffffff
push dword [esi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edi, [esi + 0x80]
xor ebx, ebx
mov ecx, edi
mov dword [esi + 0x70], ebx
call fcn.100013ec
test al, al
je 0x100076fe
lea ecx, [esi + 0x48]
call fcn.100013ec
test al, al
je 0x100076e2
mov ecx, esi
call fcn.100077e9
jmp 0x10007771
cmp byte [0x1001add1], bl
je 0x100076f9
cmp byte [0x1001add2], bl
je 0x100076f9
mov ecx, esi
call fcn.1000883e
mov dword [esi + 0x28], ebx
jmp 0x10007771
push 0x100175d0
lea ecx, [ebp - 0xc]
call fcn.10001576
push 0x100175cc
lea ecx, [ebp - 0xc]
call fcn.1000171e
lea ecx, [esi + 0x48]
call fcn.100013ec
test al, al
je 0x1000778b
push dword [ebp - 8]
mov ecx, edi
call fcn.10001504
test eax, eax
jle 0x10007782
push 1
mov ecx, esi
call fcn.100051ce
push dword [esi + 0x84]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi + 0x7c]
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
cmp byte [0x1001add1], bl
je 0x10007771
cmp byte [0x1001add2], bl
je 0x10007771
cmp dword [esi + 0x28], ebx
jne 0x10007771
cmp dword [esi + 0x70], ebx
jne 0x10007771
mov ecx, esi
call fcn.1000883e
lea ecx, [ebp - 0xc]
call fcn.10001171
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
mov ecx, esi
call fcn.100077e9
jmp 0x1000773b
push dword [0x10019ecc]
mov ecx, edi
call fcn.10001504
test eax, eax
jle 0x100077a3
push 0x10019ec8
jmp 0x100077d1
push dword [0x10019ebc]
mov ecx, edi
call fcn.10001504
test eax, eax
jle 0x100077bb
push 0x10019eb8
jmp 0x100077d1
push dword [0x10019eac]
mov ecx, edi
call fcn.10001504
test eax, eax
jle 0x100077dd
push 0x10019ea8
mov ecx, esi
call fcn.10007a3e
jmp 0x1000773b
mov ecx, esi
call fcn.100070b8
jmp 0x10007750