joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x14], 0x65
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x14], 0x72
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x32
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x6f
mov edx, 1
imul eax, edx, 0xa
mov byte [ebp + eax - 0x14], 0x69
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x14], 0x50
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x14], 0x63
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x73
mov ecx, 1
imul edx, ecx, 0xc
mov byte [ebp + edx - 0x14], 0x73
mov eax, 1
imul ecx, eax, 0xe
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xf
jae 0x1000212e
jmp 0x10002133
call fcn.100093d7
mov edx, dword [ebp - 0x20]
mov byte [ebp + edx - 0x14], 0
mov eax, 1
imul ecx, eax, 0xd
mov byte [ebp + ecx - 0x14], 0x74
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x14], 0x73
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x14], 0x72
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x33
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x14], 0x46
lea eax, [ebp - 0x14]
push eax
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100021a3
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret

Function at 0x10002500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x10], 0x4f
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x10], 0x73
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x10], 0x6e
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x10], 0x63
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x10], 0x65
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x10], 0x65
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x10], 0x6f
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x10], 0x73
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x10], 0x50
mov eax, 1
imul ecx, eax, 0xb
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0xc
jae 0x1000259e
jmp 0x100025a3
call fcn.100093d7
mov edx, dword [ebp - 0x1c]
mov byte [ebp + edx - 0x10], 0
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x10], 0x70
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x10], 0x72
lea eax, [ebp - 0x10]
push eax
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100025f0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret
Function at 0x10002800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
call fcn.10001c60
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1000291a
mov eax, 1
imul ecx, eax, 0xd
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0xe
jae 0x1000283c
jmp 0x10002841
call fcn.100093d7
mov edx, dword [ebp - 0x24]
mov byte [ebp + edx - 0x14], 0
mov eax, 1
imul ecx, eax, 0xc
mov byte [ebp + ecx - 0x14], 0x6e
mov edx, 1
imul eax, edx, 0xb
mov byte [ebp + eax - 0x14], 0x69
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x14], 0x6d
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x6e
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x14], 0x65
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x14], 0x72
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x64
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x41
mov edx, 1
shl edx, 1
mov byte [ebp + edx - 0x14], 0x55
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x49
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0x73
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x14], 0x73
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x41
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x1000290e
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
push eax
call fcn.100034d0
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret
Function at 0x10002930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x18], 0x6d
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x18], 0x73
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x18], 0x72
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x18], 0x65
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x18], 0x50
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x18], 0x63
mov ecx, 1
imul edx, ecx, 0xe
mov byte [ebp + edx - 0x18], 0x73
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x18], 0x6f
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x18], 0x69
mov eax, 1
shl eax, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x11
jae 0x100029ce
jmp 0x100029d3
call fcn.100093d7
mov ecx, dword [ebp - 0x24]
mov byte [ebp + ecx - 0x18], 0
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x18], 0x6e
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x18], 0x72
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x18], 0x74
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x18], 0x61
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x18], 0x65
mov edx, 1
imul eax, edx, 0xd
mov byte [ebp + eax - 0x18], 0x65
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x18], 0x54
lea eax, [ebp - 0x18]
push eax
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10002a5d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret
Function at 0x10002e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov eax, 1
imul ecx, eax, 0xb
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0xc
jae 0x10002e4a
jmp 0x10002e4f
call fcn.100093d7
mov edx, dword [ebp - 0x1c]
mov byte [ebp + edx - 0x10], 0
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x10], 0x63
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x10], 0x6c
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x10], 0x41
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x10], 0x6f
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x10], 0x62
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x10], 0x6f
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x10], 0x61
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x10], 0x47
lea eax, [ebp - 0x10]
push eax
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10002f0c
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret

Function at 0x10002f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, 1
imul edx, ecx, 0xa
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0xb
jae 0x10002f49
jmp 0x10002f4e
call fcn.100093d7
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0x10], 0
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x10], 0x61
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x10], 0x46
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x10], 0x72
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x10], 0x62
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x10], 0x65
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x10], 0x65
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x10], 0x47
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x10], 0x6c
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x10], 0x6f
lea edx, [ebp - 0x10]
push edx
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10002ffa
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret
Function at 0x100030b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x14], 0x74
mov edx, 1
shl edx, 2
mov byte [ebp + edx - 0x14], 0x69
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x14], 0x65
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x14], 0x74
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x43
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x14], 0x6e
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x14], 0x75
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x14], 0x6f
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x14], 0x54
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x14], 0x6b
mov ecx, 1
imul edx, ecx, 0xc
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0xd
jae 0x1000315b
jmp 0x10003160
call fcn.100093d7
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax - 0x14], 0
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x14], 0x47
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x14], 0x63
lea edx, [ebp - 0x14]
push edx
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100031a1
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret

Function at 0x100031c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x14], 0x61
mov ecx, 1
shl ecx, 0
mov byte [ebp + ecx - 0x14], 0x6f
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x72
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x14], 0x69
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x14], 0x79
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x14], 0x64
mov ecx, 1
imul edx, ecx, 0xb
mov byte [ebp + edx - 0x14], 0x41
mov eax, 1
shl eax, 3
mov byte [ebp + eax - 0x14], 0x61
mov ecx, 1
imul edx, ecx, 6
mov byte [ebp + edx - 0x14], 0x62
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x14], 0x4c
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x14], 0x4c
mov eax, 1
imul ecx, eax, 7
mov byte [ebp + ecx - 0x14], 0x72
mov edx, 1
imul eax, edx, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xd
jae 0x10003285
jmp 0x1000328a
call fcn.100093d7
mov ecx, dword [ebp - 0x20]
mov byte [ebp + ecx - 0x14], 0
lea edx, [ebp - 0x14]
push edx
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100032b5
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret
Function at 0x100033d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov eax, 1
imul ecx, eax, 0xb
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0xc
jae 0x100033fa
jmp 0x100033ff
call fcn.100093d7
mov edx, dword [ebp - 0x1c]
mov byte [ebp + edx - 0x10], 0
mov eax, 1
imul ecx, eax, 9
mov byte [ebp + ecx - 0x10], 0x45
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x10], 0x74
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x10], 0x64
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x10], 0x6d
mov eax, 1
imul ecx, eax, 5
mov byte [ebp + ecx - 0x10], 0x6e
mov edx, 1
imul eax, edx, 3
mov byte [ebp + eax - 0x10], 0x52
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x10], 0x6f
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x10], 0x6c
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x10], 0x78
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x10], 0x61
mov ecx, 1
imul edx, ecx, 0
mov byte [ebp + edx - 0x10], 0x52
lea eax, [ebp - 0x10]
push eax
call fcn.10001d40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100034b8
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret

Function at 0x100034d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10033010]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov eax, 1
shl eax, 0
mov byte [ebp + eax - 0x10], 0x72
mov ecx, 1
imul edx, ecx, 9
mov byte [ebp + edx - 0x10], 0x72
mov eax, 1
imul ecx, eax, 0xb
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0xc
jae 0x10003514
jmp 0x10003519
call fcn.100093d7
mov edx, dword [ebp - 0x1c]
mov byte [ebp + edx - 0x10], 0
mov eax, 1
imul ecx, eax, 0xa
mov byte [ebp + ecx - 0x10], 0x79
mov edx, 1
imul eax, edx, 6
mov byte [ebp + eax - 0x10], 0x62
mov ecx, 1
shl ecx, 2
mov byte [ebp + ecx - 0x10], 0x4c
mov edx, 1
shl edx, 3
mov byte [ebp + edx - 0x10], 0x61
mov eax, 1
imul ecx, eax, 3
mov byte [ebp + ecx - 0x10], 0x65
mov edx, 1
imul eax, edx, 0
mov byte [ebp + eax - 0x10], 0x46
mov ecx, 1
shl ecx, 1
mov byte [ebp + ecx - 0x10], 0x65
mov edx, 1
imul eax, edx, 5
mov byte [ebp + eax - 0x10], 0x69
mov ecx, 1
imul edx, ecx, 7
mov byte [ebp + edx - 0x10], 0x72
lea eax, [ebp - 0x10]
push eax
call fcn.10001b70
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100035b8
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008404
mov esp, ebp
pop ebp
ret
Function at 0x10004e70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10004e94
xor eax, eax
jmp 0x10004f14
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10004eab
xor eax, eax
jmp 0x10004f14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x10004ef7
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x10004ef7
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x10004ece
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x10004f03
xor eax, eax
jmp 0x10004f14
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x10004f11
xor eax, eax
jmp 0x10004f14
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x50e846d2
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x20dd2419
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x40892e
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
call fcn.00408943
xor dword [edi], ecx
inc edi
cmp edi, edx
jne fcn.0040892e
mov eax, eax
ret
Function at 0x4098c4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409997
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4099b0
push ebx
push 0x4099bc
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409944
mov al, 0x62
call fcn.0040949c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409898
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x40994d
call fcn.00409898
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40999e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a50
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
jmp 0x409af9
cmp dword [esi + 0x10], 0x1000
jne 0x409ae5
test byte [esi + 0x15], 1
jne 0x409ae5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409aa4
cmp eax, 2
je 0x409aa4
cmp eax, 0x10
je 0x409aa4
cmp eax, 0x20
jne 0x409ab9
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409ab9
mov bl, 1
xor ebp, ebp
jmp 0x409aca
mov eax, dword [esi]
add eax, ebp
call fcn.00409a48
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409abd
test bl, bl
je 0x409ae5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409b04
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a7c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp loc.00401219