joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47830f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x3ae]
mov esi, 0x490260
push ebx
sub esp, 0x5ec
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x5d0], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5be]
mov dword [ebp - 0x5c5], 0x4e495753
lea esi, [ebp - 0x5be]
mov dword [ebp - 0x5d4], 0x4e204f4e
mov dword [ebp - 0x5cd], 0x20202020
mov dword [ebp - 0x5c9], 0x4d9058eb
mov dword [ebp - 0x5c2], 0x312e344e
mov eax, ecx
mov ecx, 0x84
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5c9]
mov dword [esp], ebx
lea edi, [ebp - 0x3ae]
mov word [ebp - 0x5b0], 0xaa55
mov word [ebp - 0x3b0], 0xaa55
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x4783dc
call fcn.0047a5e2
test eax, eax
jne 0x478410
xor eax, eax
jmp 0x47846c
call fcn.0047a5e2
test eax, eax
je 0x4783d5
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5d4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x4783cc
xor ecx, ecx
mov dword [esp + 0xc], edi
xor edi, edi
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x52
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x4783d5
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x5ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4785b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x7c9]
lea edi, [ebp - 0x3ae]
mov esi, 0x490600
push ebx
sub esp, 0x7ec
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x7d0], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5be]
mov dword [ebp - 0x7c5], 0x4e495753
mov esi, 0x4b9d29
mov dword [ebp - 0x7d4], 0x4e204f4e
mov ecx, 0x84
mov dword [ebp - 0x7cd], 0x20202020
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x7be]
mov esi, 0x4b9f39
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x7c9], 0x4d9058eb
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x3ae]
lea esi, [ebp - 0x5be]
mov dword [ebp - 0x7c2], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x478684
call fcn.0047a5e2
test eax, eax
jne 0x4786b8
xor eax, eax
jmp 0x47874a
call fcn.0047a5e2
test eax, eax
je 0x47867d
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7d4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x478674
xor eax, eax
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x52
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x47867d
xor ecx, ecx
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], esi
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x47867d
xor eax, eax
xor edx, edx
mov dword [esp], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7be]
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1800
mov dword [esp + 8], edx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x7ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x478892
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x39b
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x7ce]
lea edi, [ebp - 0x3b3]
mov esi, str.FAT32___3
push ebx
sub esp, 0x7fc
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x7d5], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c3]
mov dword [ebp - 0x7ca], 0x4e495753
mov esi, 0x4b9d29
mov dword [ebp - 0x7d9], 0x4e204f4e
mov ecx, 0x84
mov dword [ebp - 0x7d2], 0x20202020
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x7c3]
mov esi, 0x4ba139
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x7ce], 0x4d9058eb
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x3b3]
lea esi, [ebp - 0x5c3]
mov dword [ebp - 0x7c7], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x478962
call fcn.0047a5e2
test eax, eax
jne 0x478996
xor eax, eax
jmp 0x478a28
call fcn.0047a5e2
test eax, eax
je 0x47895b
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7d9]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x478952
xor eax, eax
mov dword [esp + 0x10], 0x39b
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x52
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x47895b
xor ecx, ecx
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], esi
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x47895b
xor eax, eax
xor edx, edx
mov dword [esp], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7c3]
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1800
mov dword [esp + 8], edx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x7fc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x478b5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
mov esi, str.FAT32___1
push ebx
and esp, 0xfffffff0
sub esp, 0x5e0
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
movups xmm0, xmmword [0x4ba6f0]
lea eax, [esp + 0x2f]
mov dword [esp + 0x28], 0x20454d41
lea edi, [esp + 0x24a]
mov dword [esp + 0x33], 0x4e495753
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x24], 0x4e204f4e
lea edi, [esp + 0x4a]
mov esi, 0x4ba339
mov ecx, pe_nt_image_headers32
mov dword [esp + 0x2b], 0x20202020
rep movsd dword es:[edi], dword [esi]
movups xmmword [esp + 0x3a], xmm0
lea edi, [esp + 0x24a]
lea esi, [esp + 0x4a]
mov dword [esp + 0x2f], 0x4d9058eb
mov dword [esp + 0x36], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x478c1b
call fcn.0047a5e2
test eax, eax
jne 0x478c4d
xor eax, eax
jmp 0x478cdd
call fcn.0047a5e2
test eax, eax
je 0x478c14
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x478c0b
xor eax, eax
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x52
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x478c14
xor ecx, ecx
xor edi, edi
lea eax, [esp + 0x3a]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
je 0x478c14
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x200
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x1c00
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x478d93
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1ae
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1d1]
lea edi, [ebp - 0x1c6]
mov esi, 0x4ba539
push ebx
sub esp, 0x1fc
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1d8], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1c6]
mov dword [ebp - 0x1cd], 0x4e495753
mov dword [ebp - 0x1dc], 0x4e204f4e
mov dword [ebp - 0x1d5], 0x20202020
mov dword [ebp - 0x1d1], 0x4d9058eb
mov dword [ebp - 0x1ca], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x478e36
call fcn.0047a5e2
test eax, eax
jne 0x478e6a
xor eax, eax
jmp 0x478e9a
call fcn.0047a5e2
test eax, eax
je 0x478e32
xor ecx, ecx
lea eax, [ebp - 0x1dc]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], edi
jmp 0x478e29
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1ae
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x52
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047a5e2
test eax, eax
setne al
movzx eax, al
add esp, 0x1fc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47a279
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov ecx, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
imul ecx, ebx
imul eax, edi
add ecx, eax
mov eax, edi
mul ebx
mov dword [ebp - 0x2c], edx
add dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], eax
jbe 0x47a2cb
mov dword [esp], str.read_sectors:_nSectors_x_SectorSize_is_too_big_n
call fcn.0043d9e0
jmp 0x47a32c
mov eax, edi
mov ecx, dword [ebp - 0x34]
imul eax, ebx
imul ecx, esi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
imul eax, ebx
add ecx, eax
mov eax, ebx
mul esi
add edx, ecx
xor ecx, ecx
mov dword [esp + 4], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointerEx]
sub esp, 0x14
test eax, eax
jne 0x47a336
call fcn.0043df77
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], str.read_sectors:_Could_not_access_sector_0x_08I64x____s_n
mov dword [esp + 8], eax
call fcn.0043d9e0
or eax, 0xffffffff
mov edx, eax
jmp 0x47a3eb
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
sub esp, 0x14
test eax, eax
je 0x47a372
cmp dword [ebp - 0x2c], 0
jne 0x47a372
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x1c]
je 0x47a3e6
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
mov eax, 0x4bcf62
test edx, edx
je 0x47a388
call fcn.0043df77
mov dword [esp + 4], eax
mov dword [esp], str.read_sectors:_Read_error__s_n
call fcn.0043d9e0
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [ebp - 0x1c]
mov dword [esp], str.__Read:__d__Expected:__I64u_n
mov dword [esp + 4], eax
call fcn.0043d9e0
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], str.__StartSector:_0x_08I64x__nSectors:_0x_I64x__SectorSize:_0x_I64x_n
mov dword [esp + 8], eax
call fcn.0043d9e0
mov eax, dword [ebp - 0x1c]
xor edx, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47bfae
Capabilities:
Query environment variable

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x47c0a1
cmp byte [edx], 0
jne 0x47c001
cmp byte [edx + 1], 0
jne 0x47c001
cmp byte [edx + 2], 0
jne 0x47c001
cmp byte [edx + 3], 0
jne 0x47c001
cmp byte [edx + 4], 0
jne 0x47c001
cmp byte [edx + 5], 0
jne 0x47c001
xor edx, edx
lea eax, [ebp - 0x40]
lea esi, [ebp - 0x3c]
mov dword [ebp - 0x40], edx
mov dword [esp + 4], eax
jmp 0x47c081
xor eax, eax
mov ecx, 9
mov edi, ebx
rep stosd dword es:[edi], eax
movzx eax, byte [edx]
mov dword [ebx + 0x14], eax
movzx eax, byte [edx + 1]
dec eax
mov dword [ebx + 0x10], eax
movzx eax, byte [edx + 2]
mov dword [ebx + 0xc], eax
movzx eax, byte [edx + 3]
mov dword [ebx + 8], eax
movzx eax, byte [edx + 4]
mov dword [ebx + 4], eax
movsx eax, byte [edx + 6]
movzx edx, byte [edx + 5]
mov dword [ebx + 0x20], 0xffffffff
imul eax, eax, 0xfffffc7c
add eax, edx
mov dword [ebx], eax
xor eax, eax
mov dword [esp], 0x4bd508
mov dword [ebp - 0x40], eax
call sub.msvcrt.dll_getenv
call sub.msvcrt.dll__tzset
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_mktime]
mov edi, eax
call sub.msvcrt.dll__tzset
mov eax, esi
mov dword [ebp - 0x40], edi
lea esi, [ebp - 0x3c]
test al, al
je 0x47c08c
lea eax, [ebp - 0x40]
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [0x491240]
jmp 0x47c096
mov edx, esi
lea eax, [ebp - 0x40]
call fcn.0047bf99
mov ecx, 9
mov edi, ebx
mov al, 1
rep movsd dword es:[edi], dword [esi]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x484050
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00487040
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00487040
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4840b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x529870]
test esi, esi
jle 0x4841d0
mov eax, dword [0x529874]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x4840e4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x484167
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4840d0
mov dword [esp], ebx
call fcn.00484aa0
mov edi, eax
test eax, eax
je 0x4841f7
mov eax, dword [0x529874]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00484be0
mov edx, dword [0x529874]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4841d7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x484160
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x484170
add dword [0x529870], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x529874]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x484160
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00484050
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x4840ee
mov eax, dword [0x529874]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00484050
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00484050
lea esi, cs:[esi]
nop
Function at 0x484710
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x52988c
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov ebx, dword [0x529884]
sub esp, 4
test ebx, ebx
je 0x484765
mov ebp, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.DLL_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x48475e
test eax, eax
jne 0x48475e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x484740
mov dword [esp], 0x52988c
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x484aa0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x484ac5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x484ad0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x484ac5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x484b18
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x484b0e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x484b1a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x484b00
xor eax, eax
pop ebx
pop esi
ret
Function at 0x95b530
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3e2000]
push edi
or ebp, 0xffffffff
jmp 0x95b552
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x95b559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95b548
mov eax, 1
add ebx, ebx
jne 0x95b56b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x95b57c
jne 0x95b59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95b59b
dec eax
add ebx, ebx
jne 0x95b588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x95b560
add ebx, ebx
jne 0x95b597
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x95b5ed
xor ecx, ecx
sub eax, 3
jb 0x95b5b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x95b622
sar eax, 1
mov ebp, eax
jmp 0x95b5be
add ebx, ebx
jne 0x95b5be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95b58c
inc ecx
add ebx, ebx
jne 0x95b5cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x95b58c
add ebx, ebx
jne 0x95b5d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x95b5ce
jne 0x95b5ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x95b5ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x95b60c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x95b5fe
jmp 0x95b54e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x95b60c
add edi, ecx
jmp 0x95b54e
pop esi
mov edi, esi
mov ecx, 0x86b4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x95b62a
cmp byte [edi], 0x1d
jne 0x95b62a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x95b62f
lea edi, [esi + 0x557000]
mov eax, dword [edi]
or eax, eax
je 0x95b69e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x563290]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x563420]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x95b65c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x563424]
or eax, eax
je 0x95b698
mov dword [ebx], eax
add ebx, 4
jmp 0x95b679
call dword [esi + 0x56342c]
mov ebp, dword [esi + 0x563428]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x95b6d2
sub esp, 0xffffff80
jmp 0x4ff444
Function at 0x401000
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401021
push eax
push dword [esp + 8]
call fcn.0040195e
pop ecx
xor eax, eax
pop ecx
inc eax
ret

Function at 0x401022
Capabilities:
Delete file
Move file

Disassembly:
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret

Function at 0x4010dd
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x58
and dword [esp], 0
push edi
mov edi, dword [esp + 0x64]
cmp byte [edi], 0
je 0x40122b
push ebx
mov bl, byte [esp + 0x64]
cmp bl, 0x44
je 0x40110a
cmp bl, 0x54
je 0x40110a
cmp bl, 0x45
jne 0x40122a
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, 0x400
push ebp
push 0x40
call esi
push ebp
push 0x40
mov dword [esp + 0x78], eax
call esi
xor esi, esi
mov ebp, eax
inc esi
cmp bl, 0x45
jne 0x401147
push edi
push str.__s___regserver
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [esp + 0x7c]
add esp, 0xc
mov eax, esi
jmp 0x4011b1
cmp dword [esp + 0x74], 0
push 0x400
jne 0x401183
push dword [esp + 0x74]
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x4011a9
push edi
movsx eax, bl
mov ebx, dword [esp + 0x74]
push eax
push ebx
push str.__s____c_s
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov eax, esi
jmp 0x4011b1
mov ebx, dword [esp + 0x74]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4011ad
push edi
push ebx
push str.__s_regsvr32.exe___s___s_
push ebp
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
call fcn.00401b31
jmp 0x40117c
mov ebx, dword [esp + 0x70]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40121c
push 0x44
pop esi
push esi
lea eax, [esp + 0x28]
push 0
push eax
call fcn.00401bf6
add esp, 0xc
mov dword [esp + 0x24], esi
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40120d
push 0xffffffffffffffff
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x18]
call esi
cmp dword [esp + 0x74], 0
je 0x40121c
push 1
call fcn.00401b31
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call esi
push ebp
call esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x58
ret