joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100062b2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
test byte [0x10019d5c], 1
push edi
jne 0x1000635f
or dword [0x10019d5c], 1
mov dword [0x10019d24], 0x2800
mov dword [0x10019d28], 0x5e3
mov dword [0x10019d2c], 0x295a
mov dword [0x10019d30], 0x5e7
mov dword [0x10019d34], 0x3839
mov dword [0x10019d38], 0x647
mov dword [0x10019d3c], 0x3ad7
mov dword [0x10019d40], 0x6a7
mov dword [0x10019d44], 0x3fab
mov dword [0x10019d48], 0x6ad
mov dword [0x10019d4c], 0x42ee
mov dword [0x10019d50], 0x70b
mov dword [0x10019d54], 0x4563
mov dword [0x10019d58], 0x711
or dword [esi], 0xffffffff
lea eax, [esp + 7]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
lea edi, [esp + 0x18]
call fcn.10005aa8
add esp, 0xc
test al, al
je 0x10006493
cmp dword [esp + 8], 0xa
jae 0x10006393
xor eax, eax
jmp 0x10006496
lea eax, [esp + 7]
push eax
lea edi, [esp + 0xc]
call fcn.10005d51
xor edi, edi
pop ecx
test al, al
je 0x100063c1
xor eax, eax
mov ecx, dword [esp + 8]
cmp ecx, dword [eax*8 + 0x10019d24]
je 0x10006450
inc eax
cmp eax, 7
jb 0x100063aa
lea eax, [esp + 0x10]
push eax
push 0x20001
push edi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006485
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
push eax
push edi
push str.ReleaseId
push dword [esp + 0x24]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000647b
mov eax, dword [esp + 8]
cmp eax, 1
je 0x10006426
cmp eax, 2
je 0x10006426
cmp eax, 7
jne 0x1000645e
cmp dword [esp + 0xc], 2
jb 0x1000645e
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x1c]
push 0x10016224
push eax
call dword [sym.imp.MSVCRT.dll_swscanf]
add esp, 0xc
cmp eax, 1
jne 0x1000647b
mov eax, dword [esp + 0x14]
jmp 0x10006479
mov eax, dword [eax*8 + 0x10019d28]
mov dword [esi], eax
xor eax, eax
inc eax
jmp 0x10006496
cmp eax, 4
jne 0x10006469
cmp dword [esp + 0xc], eax
jmp 0x10006473
cmp eax, 0xb
jne 0x1000647b
cmp dword [esp + 0xc], 8
jb 0x1000647b
mov eax, dword [esp + 0x18]
mov dword [esi], eax
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esi], 0xffffffff
setne al
lea eax, [eax + eax - 1]
jmp 0x10006496
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10006819
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
test eax, eax
je 0x100068ae
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax + 0x4c], 0
je 0x100068ae
push ebx
push esi
push edi
push 0x104
lea ecx, [ebp - 0x208]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_FatalAppExitW]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
dec eax
cmp eax, 0x102
ja 0x1000689b
lea eax, [ebp - 0x208]
push eax
push str._s_is_not_a_valid_Win32_application_
lea eax, [ebp - 0x460]
push 0x12c
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
test eax, eax
jle 0x1000689b
lea eax, [ebp - 0x460]
push eax
push 0
call esi
push 0xffffffffffffffff
call ebx
push eax
call edi
push str.This_is_not_a_valid_Win32_application_
push 0
call esi
push 0xffffffffffffffff
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006cba
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
push ebx
push esi
push edi
push 0x200
xor ebx, ebx
mov esi, eax
push ebx
push esi
mov edi, ecx
call sub.MSVCRT.dll_memset
lea eax, [edi - 1]
add esp, 0xc
mov dword [esi], edi
cmp eax, 0xe
ja case.default.0x10006ce0
jmp dword [eax*4 + 0x10006e86]
mov dword [esi + 0x40], ebx
mov al, 1
jmp 0x10006e81
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], 0x67452301
mov dword [esi + 0x8c], 0xefcdab89
mov dword [esi + 0x90], 0x98badcfe
mov dword [esi + 0x94], 0x10325476
jmp 0x10006cea
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], 0x67452301
mov dword [esi + 0x8c], 0xefcdab89
mov dword [esi + 0x90], 0x98badcfe
mov dword [esi + 0x94], 0x10325476
mov dword [esi + 0x98], 0xc3d2e1f0
jmp 0x10006cea
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xa8], 0x1c
lea edi, [esi + 0x88]
mov esi, 0x10015358
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10006cea
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xa8], 0x20
lea edi, [esi + 0x88]
mov esi, 0x10015338
jmp 0x10006d88
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x108], 0x30
lea edi, [esi + 0xc8]
push 0x10
mov esi, 0x100151f8
jmp 0x10006d8a
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x108], 0x40
lea edi, [esi + 0xc8]
push 0x10
mov esi, 0x100151b8
jmp 0x10006d8a
push 0xe0
add esi, 0x40
call fcn.1000a815
pop ecx
jmp 0x10006cea
push 0x100
jmp 0x10006e04
push 0x180
jmp 0x10006e04
push 0x200
jmp 0x10006e04
mov eax, edi
add esi, 0x40
call fcn.10006bef
push esi
call fcn.10001481
pop ecx
test eax, eax
je 0x10006cea
push 0x40010
push str.StdUtils::HashFunction_Init
push str.Blake2_Init_internal_error__going_to_abort_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
call dword [sym.imp.MSVCRT.dll_abort]
jmp 0x10006cea
cmp byte [0x10019582], bl
je 0x10006e7f
push 0x40010
push 0x10015588
push str.The_specified_hash_type_is_unknown_unsupported_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
pop edi
pop esi
pop ebx
ret
Function at 0x100070c9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x12b4
call fcn.100138e0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x10019d64]
push edi
call fcn.10006c2e
mov dword [esp + 0x3c], eax
cmp eax, 0xffffffff
je 0x10007242
shr esi, 1
cmp eax, esi
jae 0x10007222
xor esi, esi
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [esp + 0x38], edi
cmp edi, esi
je 0x10007207
cmp edi, 0xffffffff
je 0x10007207
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc0]
call fcn.10006cba
test al, al
jne 0x1000714e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10007242
push esi
lea eax, [esp + 0x38]
push eax
mov ebx, 0x1000
push ebx
lea eax, [esp + 0x2cc]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 0x48], esi
call edi
test eax, eax
je 0x100071b0
mov ecx, dword [esp + 0x34]
cmp ecx, 1
jb 0x100071d8
lea edx, [esp + 0x2c0]
lea esi, [esp + 0xc0]
call fcn.10006ec2
and dword [esp + 0x34], 0
push 0
lea eax, [esp + 0x38]
push eax
push ebx
lea eax, [esp + 0x2cc]
push eax
push dword [esp + 0x48]
call edi
test eax, eax
jne 0x10007173
xor esi, esi
cmp byte [0x10019582], 0
je 0x100071cf
push 0x40010
push 0x10015978
push str.Failed_to_read_data_from_input_file_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [esp + 0x38]
jmp 0x10007143
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [esp + 0x40]
lea eax, [esp + 0xc0]
call fcn.10006fa1
mov edx, dword [ebp + 0x10]
mov eax, edi
push eax
push dword [esp + 0x40]
call fcn.10007080
pop ecx
pop ecx
mov al, 1
jmp 0x10007244
cmp byte [0x10019582], 0
je 0x10007242
push 0x40010
push 0x10015900
push str.Failed_to_open_input_file_for_reading_
push esi
jmp 0x1000723c
cmp byte [0x10019582], 0
je 0x10007242
push 0x40010
push 0x10015834
push 0x10015898
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007664
Capabilities:
Check if file exists
Check os version
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [ebp + 8]
mov byte [ebp - 8], 1
mov dword [ebp - 0xc], 1
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x1000767e
sub eax, ecx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp + 0xc]
push ebx
lea edx, [eax + 2]
push esi
mov si, word [eax]
add eax, 2
test si, si
jne 0x10007697
sub eax, edx
sar eax, 1
lea eax, [eax + ecx + 3]
push 2
push eax
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x1000775c
mov eax, dword [ebp + 8]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100076c4
push edi
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x100076d5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100076f4
mov eax, dword [ebp + 0xc]
mov esi, 0x100153a8
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000770b
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x1000771b
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
push ebx
setne byte [ebp - 1]
call dword [sym.imp.MSVCRT.dll_free]
cmp byte [ebp - 1], 0
pop ecx
pop edi
jne 0x1000775c
push 4
pop eax
jmp 0x100077dd
mov esi, 0x114
push esi
lea eax, [ebp - 0x12c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x100077da
cmp dword [ebp - 0x11c], 2
jne 0x100077d3
cmp dword [ebp - 0x128], 6
ja 0x100077a7
jne 0x100077d3
cmp dword [ebp - 0x124], 1
jb 0x100077d3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x100073c5
call fcn.1000ea22
add esp, 0xc
mov dword [ebp - 0xc], eax
jmp 0x100077da
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret

Function at 0x1000830c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
invalid
stosb byte es:[edi], al
Function at 0x1000a83a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x58
push ebx
push esi
xor ecx, ecx
push edi
add eax, 0x78
mov edx, dword [eax - 0x78]
xor edx, dword [eax - 0x50]
mov esi, dword [eax - 0x74]
xor esi, dword [eax - 0x4c]
xor edx, dword [eax - 0x28]
xor esi, dword [eax - 0x24]
xor edx, dword [eax + 0x28]
xor esi, dword [eax + 0x2c]
xor edx, dword [eax]
xor esi, dword [eax + 4]
mov dword [ebp + ecx*8 - 0x30], edx
mov dword [ebp + ecx*8 - 0x2c], esi
inc ecx
add eax, 8
cmp ecx, 5
jb 0x1000a84b
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
shld esi, eax, 1
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x14]
xor edx, edx
xor edx, esi
xor edx, dword [ebp - 0xc]
add eax, eax
shr ecx, 0x1f
xor ecx, eax
mov eax, dword [ebp - 0x10]
xor ecx, eax
mov dword [ebp - 0x54], edx
mov edx, dword [ebp - 0x1c]
shr edx, 0x1f
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x20]
shld edi, ecx, 1
xor esi, esi
xor esi, edi
xor esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x18]
add ecx, ecx
xor edx, ecx
mov ecx, dword [ebp - 0x30]
xor edx, ecx
mov dword [ebp - 0x50], edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x4c], esi
shr edx, 0x1f
shld ebx, edi, 1
xor esi, esi
xor esi, ebx
xor esi, dword [ebp - 0x24]
add edi, edi
xor edx, edi
xor edx, dword [ebp - 0x28]
mov edi, dword [ebp - 0xc]
shld edi, eax, 1
mov dword [ebp - 0x44], esi
xor esi, esi
mov dword [ebp - 0x48], edx
mov edx, dword [ebp - 0xc]
xor esi, edi
xor esi, dword [ebp - 0x1c]
add eax, eax
shr edx, 0x1f
xor edx, eax
xor edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], esi
mov esi, dword [ebp - 0x2c]
shld esi, ecx, 1
shr eax, 0x1f
add ecx, ecx
mov dword [ebp - 0x40], edx
xor eax, ecx
xor eax, dword [ebp - 0x18]
xor edx, edx
xor edx, esi
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x34], edx
add eax, 0x50
mov ecx, dword [ebp + esi*8 - 0x58]
mov edx, dword [ebp + esi*8 - 0x54]
xor dword [eax - 0x50], ecx
xor dword [eax - 0x4c], edx
xor dword [eax - 0x28], ecx
xor dword [eax - 0x24], edx
xor dword [eax], ecx
xor dword [eax + 4], edx
xor dword [eax + 0x28], ecx
xor dword [eax + 0x2c], edx
xor dword [eax + 0x50], ecx
xor dword [eax + 0x54], edx
inc esi
add eax, 8
cmp esi, 5
jb 0x1000a933
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000aaf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
add eax, 0x10
mov dword [ebp - 4], 5
mov esi, dword [eax - 8]
mov edi, dword [eax - 4]
mov edx, dword [eax - 0xc]
mov ecx, dword [eax - 0x10]
mov dword [ebp - 0x10], esi
mov esi, dword [eax]
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edi
not ebx
and ebx, esi
not edi
and edi, dword [eax + 4]
xor ebx, ecx
xor edi, edx
not esi
and esi, dword [eax + 8]
mov dword [eax - 0xc], edi
xor esi, dword [eax - 8]
mov edi, dword [eax + 8]
mov dword [eax - 0x10], ebx
mov ebx, dword [eax + 4]
mov dword [eax - 8], esi
mov esi, dword [eax + 0x10]
not edi
and edi, esi
xor edi, dword [eax]
not ebx
and ebx, dword [eax + 0xc]
mov dword [eax], edi
xor ebx, dword [eax - 4]
mov edi, dword [eax + 0x14]
mov dword [eax - 4], ebx
mov ebx, dword [eax + 0xc]
not esi
and esi, ecx
xor esi, dword [eax + 8]
not edi
and edi, edx
xor edi, dword [eax + 0xc]
not ebx
and ebx, dword [eax + 0x14]
not ecx
and ecx, dword [ebp - 0x10]
xor ebx, dword [eax + 4]
xor ecx, dword [eax + 0x10]
not edx
and edx, dword [ebp - 0xc]
mov dword [eax + 4], ebx
xor edx, dword [eax + 0x14]
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], edx
add eax, 0x28
dec dword [ebp - 4]
jne 0x1000ab0c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e75f
Capabilities:
Check if file exists
Check os version
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1000e780
push 4
pop eax
jmp 0x1000e829
push esi
mov esi, 0x114
push esi
lea eax, [ebp - 0x128]
push 0
push eax
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
mov dword [ebp - 0x128], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1000e806
cmp dword [ebp - 0x118], 2
push 3
pop esi
jne 0x1000e7f8
cmp dword [ebp - 0x124], 6
jb 0x1000e7f8
mov eax, dword [edi]
push dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push 0x1000e664
mov dword [ebp - 0xc], ebx
call fcn.1000ea22
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x1000e7fb
mov dword [ebp - 4], esi
cmp dword [ebp - 4], 1
je 0x1000e806
cmp dword [ebp - 4], esi
jne 0x1000e825
push 1
push 0
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jle 0x1000e825
mov dword [ebp - 4], 5
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x1000ea22
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
push esi
push edi
xor edi, edi
xor ebx, ebx
inc edi
cmp byte [eax], bl
je 0x1000eaa1
mov eax, dword [ebp + 8]
or dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push ebx
push ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x14]
push eax
push 0x1000e82c
push ebx
push ebx
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov esi, eax
add esp, 0x18
cmp esi, ebx
je 0x1000eab0
cmp esi, 0xffffffff
je 0x1000eab0
push 0x7530
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
jne 0x1000ea85
mov edi, dword [esp + 0xc]
jmp 0x1000ea98
cmp eax, 0x102
jne 0x1000ea98
push 2
pop edi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000eab0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1000e889
pop ecx
pop ecx
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4092b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x4092ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4092d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4092c0
mov eax, 1
add ebx, ebx
jne 0x4092e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4092d8
jne 0x4092f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4092d8
xor ecx, ecx
sub eax, 3
jb 0x409308
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40937a
mov ebp, eax
add ebx, ebx
jne 0x409313
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x409320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x409344
inc ecx
add ebx, ebx
jne 0x409330
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x409325
jne 0x409341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409325
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x409364
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x409355
jmp 0x4092c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x409364
add edi, ecx
jmp 0x4092c6
pop esi
mov edi, esi
mov ecx, 0x1c1
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x409382
cmp byte [edi], 5
jne 0x409382
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x409387
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x4093f6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x91dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9234]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4093b4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x923c]
or eax, eax
je 0x4093f0
mov dword [ebx], eax
add ebx, 4
jmp 0x4093d1
call dword [esi + 0x9238]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x409427
cmp al, 0xef
ja 0x40941a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4093fc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x409409
mov ebp, dword [esi + 0x9240]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40945b
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x40119d
Capabilities:
Check for time delay via queryperformancecounter
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x405018]
add eax, 7
mov dword [0x405014], eax
push 0x3ff
push 0x40b6b0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4011dc
push 0x40bac0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
push 0x40b6b0
jmp loc.0041b034

Function at 0x4014a2
Capabilities:
Check for time delay via queryperformancecounter
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
and dword [ebp - 0x44c], 0
mov dword [0x41a534], 0x6538
push 0x6538
call fcn.0040384e
pop ecx
mov dword [0x41a52c], eax
push 0x6538
push 0x405030
push dword [0x41a52c]
jmp loc.0041b000
Function at 0x4022d9
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x40bac0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [ebp + 0x10], 1
jae 0x4022f7
xor eax, eax
jmp 0x4025a8
mov eax, dword [0x405018]
xor edx, edx
mov ecx, 0xc
div ecx
mov dword [0x405018], eax
mov edx, dword [0x405014]
sub edx, 4
mov dword [0x405018], edx
mov eax, dword [ebp + 8]
mov cl, byte [eax]
mov byte [ebp - 0x18], cl
mov edx, dword [0x405018]
add edx, 8
mov dword [0x405018], edx
mov dword [ebp - 0x14], 1
mov eax, dword [0x405014]
imul eax, dword [0x405018]
mov ecx, dword [0x405018]
imul ecx, ecx, 5
sub eax, ecx
mov dword [0x405014], eax
mov edx, dword [0x405014]
sub edx, 4
mov dword [0x405018], edx
mov dword [ebp - 0x10], 0
mov eax, dword [0x405018]
add eax, 8
mov dword [0x405018], eax
mov ecx, dword [0x405018]
add ecx, 7
mov dword [0x405014], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 0x18]
and eax, 0xff
cmp edx, eax
jne 0x402541
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
test edx, edx
jne 0x402424
push 0x40bac0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [0x405018]
shl eax, 1
mov dword [0x405014], eax
mov ecx, dword [0x405014]
imul ecx, dword [0x405018]
mov edx, dword [0x405018]
imul edx, edx, 5
sub ecx, edx
mov dword [0x405014], ecx
mov eax, dword [0x405018]
shl eax, 3
mov dword [0x405018], eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0x18]
mov byte [ecx], dl
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x40253f
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 8]
push eax
call fcn.004025ac
add esp, 8
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x14], ecx
mov edx, dword [0x405014]
mov eax, dword [0x405018]
lea ecx, [eax + edx - 9]
mov dword [0x405014], ecx
mov edx, dword [0x405014]
sub edx, 4
mov dword [0x405018], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
push eax
lea ecx, [ebp - 0xc]
push ecx
jmp 0x41b04d
jmp 0x40258c
mov edx, dword [0x405018]
shl edx, 3
mov dword [0x405018], edx
mov eax, dword [0x405018]
xor edx, edx
mov ecx, 0xc
div ecx
mov dword [0x405018], eax
mov edx, dword [0x405014]
mov eax, dword [0x405018]
lea ecx, [eax + edx - 9]
mov dword [0x405014], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp + 0x10]
jb 0x402369
mov eax, dword [0x405014]
sub eax, 4
mov dword [0x405018], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret