joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475b10
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a8410
mov eax, dword fs:[0]
push eax
mov eax, dword [0x4d1088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4d1064]
cmp eax, 0xffffffff
je 0x475b7e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475b7e
mov eax, dword [0x4d1064]
cmp eax, 0xffffffff
jne 0x475b55
xor eax, eax
jmp 0x475b5c
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0
push dword [eax + 0x34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
jne 0x475b7e
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x476140
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae32e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4d1088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4d1064]
cmp eax, 0xffffffff
jne 0x476176
xor ebx, ebx
jmp 0x47617f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x4761c1
nop dword [eax]
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x476200
test esi, esi
jne 0x476204
push 0x474fb0
push 0x4d66dc
call fcn.00474ca0
mov eax, dword [0x4d1064]
add esp, 8
cmp eax, 0xffffffff
je 0x4761c1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x4761ee
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x4761ee
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x476246
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x47622f
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x476204
cmp dword [ebx + 0x18], 0
je 0x476190
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x476269
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x476269
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.0042e630
cmp dword [ebx + 0x18], 0
jne 0x476250
jmp 0x476190
Function at 0x476290
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov edx, dword [edi]
lea eax, [edx + 0x10]
push eax
push 4
push edx
push 0x4762f0
push 0
push 0
call fcn.0048ef79
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4762b9
pop edi
xor al, al
pop ebx
ret
mov eax, dword [edi]
push esi
add eax, 4
lock inc dword [eax]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x4762d7
cmp eax, 0xffffffff
je 0x4762d7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x477b30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae648
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4d1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x477b6b
mov eax, dword [edi]
jmp 0x477b6d
mov eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x477b93
test esi, esi
je 0x477b8c
mov dword [esi], 0
call fcn.00477000
mov dword [esi + 4], eax
mov al, 1
jmp 0x477c19
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x64], 0
call fcn.00477000
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x6c]
push edi
push eax
call fcn.00478360
add esp, 0xc
cmp dword [ebp - 0x6c], 3
sete al
test al, al
je 0x477bd7
test esi, esi
je 0x477c17
mov dword [esi], 0
call fcn.00477000
jmp 0x477c14
test esi, esi
jne 0x477c0d
push str.boost::filesystem::create_directory
lea ecx, [ebp - 0x28]
call fcn.0041a940
mov dword [ebp - 4], esi
call fcn.00477000
push eax
push ebx
push edi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004772d0
push 0x4cdadc
lea eax, [ebp - 0x5c]
push eax
call fcn.0047d653
call fcn.00477000
mov dword [esi], ebx
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047a4d6
mov esp, ebp
pop ebp
ret
Function at 0x478360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae862
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4d1088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x34], esi
cmp dword [edi + 0x14], 8
jb 0x4783a1
mov eax, dword [edi]
jmp 0x4783a3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x38], eax
cmp eax, 0xffffffff
jne 0x4783c2
push esi
push edi
push ebx
call fcn.00478150
add esp, 0xc
jmp 0x4784be
test eax, 0x400
je 0x47847d
cmp dword [edi + 0x14], 8
jb 0x4783d7
mov eax, dword [edi]
jmp 0x4783d9
mov eax, edi
push eax
lea ecx, [ebp - 0x28]
call fcn.004774d0
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00432c80
cmp esi, 0xffffffff
jne 0x478432
push dword [ebp - 0x34]
push edi
push ebx
call fcn.00478150
add esp, 0xc
jmp 0x4784be
push edi
call fcn.00477cc0
add esp, 4
test al, al
jne 0x478465
mov eax, dword [ebp - 0x38]
push eax
push edi
call fcn.00477da0
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
push esi
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4784be
push esi
mov dword [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x47848f
mov dword [esi], 0
call fcn.00477000
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x30], 3
push eax
push edi
test al, 0x10
jne 0x4784a6
mov dword [ebp - 0x30], 2
call fcn.00477da0
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047a4d6
mov esp, ebp
pop ebp
ret

Function at 0x481fa8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.00481b5f
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00481baa
push eax
push esi
push dword [ebp + 8]
call fcn.00481b5f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00481b9a
sbb eax, 0x8862dc15
popfd
jl 0x48201f
invalid
invalid
Function at 0x49c060
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049bedf

Function at 0x49f95f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049f2cd

Function at 0x49f96a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0049f508

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x4d0818b6
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x37943ea2
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1001a7f
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1001f18
call fcn.01001c44
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1003378
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x1001836
cmp eax, esi
jne 0x1001829
xor esi, esi
inc esi
mov ebx, esi
jmp 0x1001839
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1001810
xor esi, esi
inc esi
mov eax, dword [0x1003374]
cmp eax, esi
jne 0x100184c
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100187b
mov eax, dword [0x1003374]
test eax, eax
jne 0x1001875
mov dword [0x1003374], esi
push 0x1001118
push 0x100110c
call fcn.01001775
pop ecx
pop ecx
test eax, eax
je 0x100187b
jmp 0x10019a3
mov dword [0x100303c], esi
mov eax, dword [0x1003374]
cmp eax, esi
jne 0x100189f
push 0x1001108
push 0x1001100
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1003374], 2
test ebx, ebx
jne 0x10018ab
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x100337c], 0
je 0x10018cf
push 0x100337c
call fcn.01001bb9
pop ecx
test eax, eax
je 0x10018cf
push 0
push 2
push 0
call dword [0x100337c]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x100192b
test al, al
je 0x10018e9
cmp dword [ebp - 0x1c], 0
jne 0x100192b
mov al, byte [esi]
test al, al
je 0x10018f9
cmp al, 0x20
ja 0x10018f9
inc esi
mov dword [ebp - 0x20], esi
jmp 0x10018e9
test byte [ebp - 0x3c], 1
je 0x1001905
movzx eax, word [ebp - 0x38]
jmp 0x1001908
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1003038], eax
cmp dword [0x100302c], 0
jne 0x100197f
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x100193a
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x100194d
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x10018d6
cmp dword [0x100303c], 0
jne 0x100198e
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1003038]
jmp 0x10019af
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01001c89
ret
call fcn.01001d91
jmp 0x10017d6
Function at 0x401290
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp], 0x40b2b0
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
mov dword [esp + 0x24], 0x40b2f4
mov dword [esp + 0x20], 0x40b2b0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401354
mov dword [esp + 4], 0xffffffff
mov eax, dword [0x40b2f4]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov eax, dword [0x40b2f4]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [0x40b2f8]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 4], 9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
jmp 0x40135d
mov dword [ebp - 8], 0
jmp 0x401364
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
leave
ret
Function at 0x407710
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00407c70
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x407748
jmp 0x4077e6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x407747
cmp cl, 0x22
je 0x4077a0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x4077c0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x4077c0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x407780
jmp 0x4077c0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x4077a0
cmp cl, 0x22
je 0x407822
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x4077e0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x4077d0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x407804
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x4077c0

Function at 0x408010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x2108a105
Capabilities:
Enumerate processes

Disassembly:
enter 0x12c, 0
push 0x128
lea eax, [ebp - 0x128]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 4
lea eax, [ebp - 0x12c]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0
push 0
push 0x184
push dword [0x401008]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x128], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_Process32First
or eax, eax
je 0x2108a1b3
lea eax, [ebp - 0x104]
push eax
push 0
push 0x180
push dword [0x401008]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 0x120]
push eax
push 0x19a
push dword [0x401008]
call sub.USER32.DLL_SendMessageA
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_Process32Next
jmp 0x2108a167
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x2108a1c3
leave
ret 0
Function at 0x2108d3dd
Capabilities:
Get graphical window text

Disassembly:
enter 0x18, 0
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0
mov byte [ebp - 0xc], 0x2d
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xd], 0
cmp dword [ebp + 0xc], 1
jne 0x2108d514
push 0xb
lea eax, [ebp - 0x17]
push eax
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x17]
push eax
call sub.SHELL32.DLL_StrStrA
or eax, eax
jne 0x2108d4d9
lea eax, [ebp - 0x17]
push eax
call fcn.21097ec5
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x17]
push eax
call sub.SHELL32.DLL_StrStrA
or eax, eax
jne 0x2108d491
cmp dword [ebp - 4], 0xff
jg 0x2108d457
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0xff
jle 0x2108d478
cmp dword [ebp - 4], 0xffff
jg 0x2108d478
mov dword [ebp - 8], 2
cmp dword [ebp - 4], 0xffff
jle 0x2108d48c
mov dword [ebp - 8], 3
jmp 0x2108d4d4
mov eax, 0xffffff01
mov ebx, 0xffff0001
cmp dword [ebp - 4], eax
jl 0x2108d4ab
mov dword [ebp - 8], 1
cmp dword [ebp - 4], eax
jge 0x2108d4c4
cmp dword [ebp - 4], ebx
jl 0x2108d4c4
mov dword [ebp - 8], 2
cmp dword [ebp - 4], ebx
jge 0x2108d4d4
mov dword [ebp - 8], 3
jmp 0x2108d4e0
mov dword [ebp - 8], 4
mov eax, dword [0x4010a4]
cmp dword [ebp - 8], eax
jle 0x2108d514
push 0x20
push 0x2108803a
push 0x210881c2
push dword [0x401004]
call sub.USER32.DLL_MessageBoxA
mov dword [0x4010dc], 1
jmp 0x2108d642
cmp dword [ebp + 0xc], 2
jne 0x2108d633
push 0xb
lea eax, [ebp - 0x17]
push eax
push dword [ebp + 8]
call sub.USER32.DLL_GetWindowTextA
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x17]
push eax
call sub.SHELL32.DLL_StrStrA
or eax, eax
jne 0x2108d5f8
lea eax, [ebp - 0x17]
push eax
call fcn.21097ec5
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x17]
push eax
call sub.SHELL32.DLL_StrStrA
or eax, eax
jne 0x2108d5b0
cmp dword [ebp - 4], 0xff
jg 0x2108d576
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0xff
jle 0x2108d597
cmp dword [ebp - 4], 0xffff
jg 0x2108d597
mov dword [ebp - 8], 2
cmp dword [ebp - 4], 0xffff
jle 0x2108d5ab
mov dword [ebp - 8], 3
jmp 0x2108d5f3
mov eax, 0xffffff01
mov ebx, 0xffff0001
cmp dword [ebp - 4], eax
jl 0x2108d5ca
mov dword [ebp - 8], 1
cmp dword [ebp - 4], eax
jge 0x2108d5e3
cmp dword [ebp - 4], ebx
jl 0x2108d5e3
mov dword [ebp - 8], 2
cmp dword [ebp - 4], ebx
jge 0x2108d5f3
mov dword [ebp - 8], 3
jmp 0x2108d5ff
mov dword [ebp - 8], 4
mov eax, dword [0x4010a8]
cmp dword [ebp - 8], eax
jle 0x2108d633
push 0x20
push 0x2108803a
push 0x210881f0
push dword [0x401004]
call sub.USER32.DLL_MessageBoxA
mov dword [0x4010dc], 1
jmp 0x2108d642
mov dword [0x4010dc], 2
jmp 0x2108d642
leave
ret 8
Function at 0x2108df79
Capabilities:
Create process on windows

Disassembly:
enter 0, 0
push 3
push 0
push 0
push 0x2108903d
push 0x21089038
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
jg 0x2108dfb4
push 0x40
push 0x21089075
push 0x2108904e
push dword [0x401004]
call sub.USER32.DLL_MessageBoxA
jmp 0x2108dfb9
leave
ret 0

Function at 0x2108dfbd
Capabilities:
Create process on windows

Disassembly:
enter 0, 0
push 3
push 0
push 0
push 0x2108907a
push 0x21089038
push 0
call sub.SHELL32.DLL_ShellExecuteA
jmp 0x2108dfdd
leave
ret 0

Function at 0x2108f458
Capabilities:
Enumerate processes

Disassembly:
enter 0x130, 0
push 2
push dword [0x33b0a54]
call fcn.2108ee2a
mov dword [ebp - 0x130], eax
push 0x128
lea eax, [ebp - 0x128]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 4
lea eax, [ebp - 0x12c]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push 0
push 0
push 0x184
push dword [ebp - 0x130]
call sub.USER32.DLL_SendMessageA
mov dword [ebp - 0x128], 0x128
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_Process32First
or eax, eax
je 0x2108f519
lea eax, [ebp - 0x104]
push eax
push 0
push 0x180
push dword [ebp - 0x130]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 0x120]
push eax
push 0x19a
push dword [ebp - 0x130]
call sub.USER32.DLL_SendMessageA
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_Process32Next
jmp 0x2108f4cd
push dword [ebp - 0x12c]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x130]
push eax
push 2
push dword [0x33b0a54]
call fcn.2108e770
jmp 0x2108f53d
leave
ret 0
Function at 0x421bd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x421bf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421be8
mov eax, 1
add ebx, ebx
jne 0x421c0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421c00
jne 0x421c1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421c00
xor ecx, ecx
sub eax, 3
jb 0x421c30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x421ca2
mov ebp, eax
add ebx, ebx
jne 0x421c3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421c48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x421c6c
inc ecx
add ebx, ebx
jne 0x421c58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x421c4d
jne 0x421c69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421c4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x421c8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x421c7d
jmp 0x421bee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x421c8c
add edi, ecx
jmp 0x421bee
pop esi
mov edi, esi
mov ecx, 0x843
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x421caa
cmp byte [edi], 0xd
jne 0x421caa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x421caf
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x421d27
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2293c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x229f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x421cdc
mov ecx, edi
jns 0x421d0b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x229f4]
or eax, eax
je 0x421d21
mov dword [ebx], eax
add ebx, 4
jmp 0x421cf9
call dword [esi + 0x229f8]
popal
jmp section.UPX0
Function at 0x402920
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d535
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4e2054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], 0x4c0074
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x4c007c
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
call dword [eax + 4]
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4029bf
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
call dword [eax + 4]
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4029c7
call ebx
mov esi, eax
test esi, esi
jne 0x4029e0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4029ea
call ebx
mov esi, eax
mov eax, 0xc
mov dword [edi + eax], esi
jmp 0x4029f6
push dword [ebp - 0x10]
mov ecx, edi
call fcn.00402eb0
mov esi, eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x4c007c
test eax, eax
je 0x402a0f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x4c0074
test eax, eax
je 0x402a34
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8