joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039f0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x104
push 0
push 0x4034d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [0x40787c]
test eax, eax
je 0x403a08
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push edi
push 0x4074d4
push str.Button
push 0
push eax
call esi
mov dword [0x40789c], eax
mov eax, dword [0x40787c]
push 0
push str.32770
push 0
push eax
call esi
mov ebp, dword [sym.imp.USER32.dll_GetWindow]
push 2
push eax
mov dword [0x407880], eax
call ebp
push 2
push eax
mov dword [0x407880], eax
call ebp
push 0
push str.Edit
push 0
push eax
mov dword [0x407884], eax
mov dword [esp + 0x20], 0
call esi
mov ebx, dword [sym.imp.USER32.dll_GetClassNameA]
mov dword [0x407898], eax
mov ecx, dword [0x407898]
push 2
push ecx
call ebp
mov edx, eax
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
push 0x100
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
mov dword [0x407898], edx
push eax
push edx
call ebx
lea ecx, [esp + 0x14]
push str.Edit
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x403a79
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 4
mov dword [esp + 0x10], eax
jne 0x403a79
mov edx, dword [0x407880]
push 0
push str.Edit
push 0
push edx
call esi
push 2
push eax
mov dword [0x407888], eax
call ebp
mov esi, eax
test esi, esi
je 0x403b41
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push 0x100
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push str.Edit
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x403b3b
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x403af5
jmp 0x403b41
mov dword [0x40788c], esi
push 2
push esi
call ebp
mov esi, eax
test esi, esi
je 0x403b98
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x14]
push 0x100
push edx
push esi
stosb byte es:[edi], al
call ebx
lea eax, [esp + 0x14]
push str.Edit
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x403b92
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x403b4c
jmp 0x403b98
mov dword [0x407890], esi
push 2
push esi
call ebp
mov esi, eax
test esi, esi
je 0x403bf8
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push 0x100
push ecx
push esi
stosb byte es:[edi], al
call ebx
lea edx, [esp + 0x14]
push str.Edit
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x403bf2
push 2
push esi
call ebp
mov esi, eax
test esi, esi
jne 0x403ba3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
mov dword [0x407894], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x403c10
Capabilities:
Access peb ldr_data
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x404cdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
xor eax, eax
push esi
mov dword [esp + 8], eax
mov esi, ecx
mov dword [esp + 0xc], eax
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x11
lea edi, [esp + 0x1c]
mov dword [esp + 0x18], eax
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x60]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x60]
lea ecx, [esp + 8]
push edx
call sub.MFC42.DLL_CString::CString_1
xor edi, edi
push str._Remote_HyCam2.exe
lea ecx, [esp + 0xc]
mov dword [esp + 0x170], edi
call fcn.00404532
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x1c]
push ecx
push edx
push edi
push edi
push edi
mov dword [esp + 0x30], 0x44
mov word [esp + 0x60], di
mov dword [esp + 0x5c], 1
mov eax, dword [eax - 8]
push edi
push edi
push edi
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403ccd
mov eax, dword [esp + 0xc]
mov dword [esi + 0x84], eax
lea ecx, [esp + 8]
mov dword [esp + 0x16c], 0xffffffff
call fcn.004044d8
mov ecx, dword [esp + 0x164]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x168
ret
Function at 0x100b6b5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 0x100b590
cmp edi, eax
jb 0x100b708
test edi, 3
jne 0x100b5ac
shr ecx, 2
and edx, 3
cmp ecx, 8
jb switch.0x0100b5cc
rep movsd dword es:[edi], dword [esi]
jmp dword [edx*4 + 0x100b6b8]
mov eax, edi
mov edx, 3
sub ecx, 4
jb 0x100b5c4
and eax, 3
add ecx, eax
jmp dword [eax*4 + 0x100b5d0]
jmp dword [ecx*4 + case.0x100b5a5.0]
jmp dword [ecx*4 + 0x100b64c]
mov eax, dword [esi + ecx*4 - 0x1c]
mov dword [edi + ecx*4 - 0x1c], eax
mov eax, dword [esi + ecx*4 - 0x18]
mov dword [edi + ecx*4 - 0x18], eax
mov eax, dword [esi + ecx*4 - 0x14]
mov dword [edi + ecx*4 - 0x14], eax
mov eax, dword [esi + ecx*4 - 0x10]
mov dword [edi + ecx*4 - 0x10], eax
mov eax, dword [esi + ecx*4 - 0xc]
mov dword [edi + ecx*4 - 0xc], eax
mov eax, dword [esi + ecx*4 - 8]
mov dword [edi + ecx*4 - 8], eax
mov eax, dword [esi + ecx*4 - 4]
mov dword [edi + ecx*4 - 4], eax
lea eax, [ecx*4]
add esi, eax
add edi, eax
jmp dword [edx*4 + 0x100b6b8]
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret
mov al, byte [esi]
mov byte [edi], al
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret
mov al, byte [esi]
mov byte [edi], al
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret
mov al, byte [esi]
mov byte [edi], al
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov al, byte [esi + 2]
mov byte [edi + 2], al
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret
lea esi, [ecx + esi - 4]
lea edi, [ecx + edi - 4]
test edi, 3
jne 0x100b73c
shr ecx, 2
and edx, 3
cmp ecx, 8
jb case.default.0x100b727
std
rep movsd dword es:[edi], dword [esi]
cld
jmp dword [edx*4 + 0x100b850]
neg ecx
jmp dword [ecx*4 + 0x100b800]
mov eax, edi
mov edx, 3
cmp ecx, 4
jb switch.0x0100b754
and eax, 3
sub ecx, eax
jmp dword [eax*4 + 0x100b758]
jmp dword [ecx*4 + 0x100b850]
jmp dword [edx*4 + 0x100b850]
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret
mov al, byte [esi + 3]
mov byte [edi + 3], al
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret
mov al, byte [esi + 3]
mov byte [edi + 3], al
mov al, byte [esi + 2]
mov byte [edi + 2], al
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret
mov al, byte [esi + 3]
mov byte [edi + 3], al
mov al, byte [esi + 2]
mov byte [edi + 2], al
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov eax, dword [ebp + 8]
pop esi
pop edi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4b91c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6e000]
add word [edi + 0xbc2a8], 2
push edi
or ebp, 0xffffffff
jmp 0x4b91ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b91f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b91e0
mov eax, 1
add ebx, ebx
jne 0x4b9203
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b9214
jne 0x4b9233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9233
dec eax
add ebx, ebx
jne 0x4b9220
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b91f8
add ebx, ebx
jne 0x4b922f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b9285
xor ecx, ecx
sub eax, 3
jb 0x4b924b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b92ba
sar eax, 1
mov ebp, eax
jmp 0x4b9256
add ebx, ebx
jne 0x4b9256
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9224
inc ecx
add ebx, ebx
jne 0x4b9264
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9224
add ebx, ebx
jne 0x4b9271
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b9266
jne 0x4b9282
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b9266
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b92a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b9296
jmp 0x4b91e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b92a4
add edi, ecx
jmp 0x4b91e6
pop esi
mov edi, esi
mov ecx, 0x3649
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b92c2
cmp byte [edi], 0x16
jne 0x4b92c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b92c7
lea edi, [esi + 0xb6000]
mov eax, dword [edi]
or eax, eax
je 0x4b9336
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbc534]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbc610]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b92f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbc614]
or eax, eax
je 0x4b9330
mov dword [ebx], eax
add ebx, 4
jmp 0x4b9311
call dword [esi + 0xbc61c]
mov ebp, dword [esi + 0xbc618]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b936a
sub esp, 0xffffff80
jmp 0x46b418
Function at 0x8f5083
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 3]
jo 0x8f50c0
lea esp, [esp + 2]
mov dword [esp], esp
pushfd
jmp 0x8f50c9
jmp 0x8f506d
lea esp, [esp + 2]
mov dword [esp], esp
jmp 0x8f50a8
push word [esp + 1]
lea esp, [esp + 2]
jmp 0x8f50b2

Function at 0x91dacb
Capabilities:
Encode data using xor

Disassembly:
sub ecx, eax
call fcn.0091daa1
enter 0x23e8, 0
add byte [eax], al
aad 0x55
lds ebp, [edi + ebx*2 + 0x54c64598]
xor ecx, esi
jle 0x91da80
jnp 0x91da78
invalid
lea esp, [esp + 4]
test edx, edx
pushal
lea esp, [esp + 0x20]
jbe 0x91da61
ja 0x91da77
jmp 0x91da92

Function at 0x91fe92
Capabilities:
Encrypt data using aes

Disassembly:
mov ecx, dword [esp]
jmp 0x8e114c
pushal
rdtsc
lea esi, [ebx*4]
mov cx, si
mov dword [esp + 0x1c], edi
jmp 0x91fef7
mov dword [edi], eax
jmp 0x91feb4
lea esp, [esp + 2]
xor ebx, eax
jmp 0x91fe7c
xor eax, ebx
mov dword [ecx + 0x14], ebx
mov bh, byte [esp]
lea ebx, reloc.KERNEL32.dll_GetDriveTypeA
bswap ebx
jmp 0x91fec3
mov eax, dword [ecx + 8]
sub esp, 7
add esp, 6
lea esp, [esp + 1]
jmp 0x91fe9a
mov bx, di
push edi
pushal
mov di, 0x2100
jmp 0x91fed3
mov dword [esp], ecx
popal
add edi, 0x18
mov dword [edi], eax
pop edi
jmp 0x91ff46
mov dword [ecx + 0x1c], edx
mov ebx, 0x8edb88
lea esp, [esp + 4]
jmp 0x8e1143
setb bl
lea ebx, [esi + esi]
inc ebx
xor edx, eax
jmp 0x91ff0d

Function at 0x920034
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x1c]
movzx edi, byte [edi*4 + 0x8ec384]
jmp 0x92006d
pop word [esp]
stc
lea esp, [esp + 2]
jmp 0x92001e
mov di, dx
jmp 0x920078
xor ecx, edi
mov di, word [esp]
dec edi
and edx, ebp
jmp 0x920057
xor ecx, edx
btr di, cx
xor ecx, dword [ebx]
cmc
jmp 0x9200c0
xor ecx, dword [eax]
jmp 0x9200aa
add ebx, 4
mov dx, word [esp]
xchg dl, dh
jmp 0x920316
lea edx, [edi + edi]
mov dl, 0x50
lea edi, [eax + 0x10]
stc
jmp 0x920083
bsr dx, di
mov edx, dword [eax + 4]
cmc
xor edx, ecx
call fcn.009200e5
push ebx
mov ebx, edi
mov dword [ebx], ecx
pop ebx
jmp 0x92023f

Function at 0x92010c
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
lea esp, [esp + 1]
jmp 0x92011a
jne 0x8e1143
push 0xa
jmp 0x92014a

Function at 0x9fe450
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 0xa
lea ecx, [edx - 0x4a]
xchg dword [esp + 1], eax
mov ch, al
lea ebp, [edx*4]
rdtsc
jmp 0x9fe45a
mov ah, bh
xchg dh, al
mov byte [esp + 7], ch
jmp 0x9fe42e
pop edi
cpuid
lea esi, [eax + 7]
add esp, 5
mov bh, dl
inc dl
jmp 0x9fe56a
add dx, cx
mov esi, dword [esp]
sub esp, 3
xchg word [esp], bp
mov dword [esp], edx
std
xchg edi, esi
xchg ecx, ebp
lea edi, [esi - 0xa0]
mov ebp, dword [esp]
mov ah, 0xea
xchg al, bl
jmp 0x9fe4b4
neg bh
not ch
mov word [esp], si
add esp, 1
add esp, 0
mov bl, 0x22
jmp 0x9fe50a
Function at 0x9fed28
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 9]
rdtsc
rdtsc
jmp 0x9fed37
lea edx, [esi*4]
pushal
mov byte [esp + 0x12], ch
add esp, 0x2a
mov edi, esi
jmp 0x9fed7c
bswap eax
xchg word [esp], cx
xchg dh, bh
xchg ecx, ebp
mov dl, byte [esp + 4]
lea ebp, [eax + ebp]
jmp 0x9fedab
not si
xchg word [esp + 3], bp
cmc
mov word [esp + 2], sp
mov cx, word [esp + 3]
xchg byte [esp + 1], dh
jmp 0x9fed61
clc
mov eax, dword [esp]
bswap ebp
mov ecx, dword [esp]
cld
cpuid
jmp 0x9fedf3
mov ax, word [esp]
cld
mov eax, esi
xchg dword [esp], ebx
pop esi
mov esi, ecx
jmp 0x9fed95
bts ebx, ecx
cpuid
xchg cx, bx
mov eax, 0xb27af799
mov ah, 0x76
clc
jmp 0x9fee05
add esp, 1
bswap esi
push ebx
lea edi, [esp + edx]
xchg word [esp + 1], bx
push sp
jmp 0x9feddb
mov dl, 0xed
clc
lea edx, [edi*4]
mov ah, byte [esp + 2]
pop ebx
cld
jmp 0x9feed3
mov dx, 0x877
pushfd
neg dh
lea esi, [edi*4]
mov edi, edx
pop dword [esp + 4]
jmp 0x9fee8e
xchg ecx, eax
bt di, sp
lea ebp, [edi + ebp]
mov ebx, 0xcc789e70
pushfd
push dword [esp + 2]
jmp 0x9fee2a
mov dword [esp + 4], ebp
cmc
push word [esp + 6]
xchg byte [esp + 8], ah
jmp 0x9feeb6
mov ch, 0x54
mov dx, bx
lea ecx, [esp + ecx]
push dword [esp + 4]
xchg byte [esp + 6], ch
jmp 0x9fee61
xchg ebx, esi
sub esp, 6
add esp, 6
mov ebx, dword [esp + 4]
lea ebp, [eax + eax]
pop ecx
jmp 0x9fee77
add esp, 2
pop dword [esp + 1]
mov dword [esp + 3], edx
call fcn.009feefe
inc esi
int1
ljmp 0x8966
add esp, 8
mov word [esp], sp
push word [esp]
mov di, sp
sub esp, 0x15
not ax
jmp 0x9feea0
xchg word [esp], bx
setp al
pop ax
rdtsc
bswap edx
xchg byte [esp], bl
jmp 0x9fee4c
Function at 0x9ff5c0
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, 0xf8739b7c
mov dh, 0x44
mov ch, 0xa5
not ch
jmp 0x9ff4cc
bswap eax
lea ecx, reloc.KERNEL32.dll_GetDriveTypeA
mov bl, byte [esp]
lea ebp, [ebp - 0xc6]
cpuid
xchg ebx, ebp
jmp 0x9ff465
lea ebx, [ebx + edi]
mov ax, si
mov eax, ecx
cpuid
mov dl, byte [esp]
mov di, bp
jmp 0x9ff58c
xchg dl, bl
lea ebx, [edx*4]
rdtsc
mov di, 0xd237
lea ecx, [ebx*4]
setns cl
jmp 0x9ff492
lea edi, [ebx*4]
bswap edi
lea edx, reloc.KERNEL32.dll_GetDriveTypeA
mov eax, 0x374b95d8
mov cx, word [esp]
mov cx, 0xb9b5
jmp 0x9ff4a8
lea eax, [ebx + ebp]
setnp cl
mov eax, dword [esp]
xchg ah, cl
bswap ebx
xchg ch, ah
call fcn.009ff52b
call fcn.009ff5d6
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc esi
insb byte es:[edi], dx
popal
jae 0x9ff5b1
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
lea esp, [esp + 4]
popal
call 0x9ff5a0
lea esp, [esp + 0xc]
jmp 0x9ff5df
push 0
pushal
mov dx, di
not edx
xchg dx, si
jmp 0x9ff611
mov edx, eax
xchg ebx, esi
mov eax, 0xa33ded9e
bswap esi
mov ch, bl
not edx
jmp 0x9ff6fe
mov di, 0x836
xchg cl, bh
mov ebp, 0x7e9f82c5
xchg ecx, eax
lea edx, [ebx*4]
lea edi, [edx + ebp]
jmp 0x9ff47b
xchg byte [esp + 4], dh
xchg dx, bx
lea esp, [esp + 0x19]
mov cl, byte [esp + 1]
jmp 0x9ff6d2
mov esi, ebp
xchg word [esp + 0x19], ax
mov ax, word [esp + 0x1b]
mov al, ch
pushfd
jmp 0x9ff650
mov cl, byte [esp]
mov edx, dword [esp]
lea esi, [edi*4]
mov bl, 0x2c
rdtsc
pushal
jmp 0x9ff666
bswap ebx
cpuid
mov word [esp + 6], dx
mov bp, 0xf483
mov word [esp + 8], bx
mov bp, cx
call fcn.009ff692
push edx
popal
imul esi, dword [ebx + 0x65], 0x65637845
jo 0x9ff741
imul ebp, dword [edi + 0x6e], reloc.KERNEL32.dll_GetDriveTypeA
mov dh, 0x3e
lea eax, [eax*4]
xchg di, dx
setp dh
xchg byte [esp + 5], bl
rdtsc
jmp 0x9ff6a8
mov dh, dl
mov si, bp
rdtsc
mov bl, byte [esp]
mov di, word [esp]
xchg edx, esi
jmp 0x9ff67e
push esi
pop ecx
push es
xchg ch, bh
jmp 0x9ff635
Function at 0x427c70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
jmp 0x427c8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x427c91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x427c80
mov eax, 1
add ebx, ebx
jne 0x427ca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x427c98
jne 0x427cb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427c98
xor ecx, ecx
sub eax, 3
jb 0x427cc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x427d3a
mov ebp, eax
add ebx, ebx
jne 0x427cd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x427ce0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x427d04
inc ecx
add ebx, ebx
jne 0x427cf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x427ce5
jne 0x427d01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x427ce5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x427d24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x427d15
jmp 0x427c86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x427d24
add edi, ecx
jmp 0x427c86
pop esi
mov edi, esi
mov ecx, 0x6e6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x427d42
cmp byte [edi], 1
jne 0x427d42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x427d47
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x427dbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x27000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x270a8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x427d74
mov ecx, edi
jns 0x427da3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x270b0]
or eax, eax
je 0x427db9
mov dword [ebx], eax
add ebx, 4
jmp 0x427d91
call dword [esi + 0x270ac]
mov ebp, dword [esi + 0x270b4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x427df3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x1002ec10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bce71
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100da040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x420], 0
push eax
mov byte [ecx + 0x3424], 0
mov dword [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov byte [ecx + 0x344d], 0
mov byte [ecx + 0x3458], 0
mov byte [ecx + 0x3744], 0
mov dword [ecx + 0x3748], 0
mov dword [ecx + 0x374c], 0
mov dword [ecx + 0x3750], 0
mov dword [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov byte [ecx + 0x3764], 0
mov dword [ecx + 0x3774], 0
mov byte [ecx + 0x377a], 0
mov dword [ecx + 0x377c], 0
mov dword [ecx + 0x3780], 0
call fcn.100248e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002f1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x1002f21e
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.10027980
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x1002f1f0
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x1002f235
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x1002f235
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x1002f280
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.10027980
test al, al
je 0x1002f271
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x1002f240
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100da040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1003640c
cmp byte [esi + 0x3d], 0
je 0x1003640c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100363fa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100363c1
sub eax, 1
je 0x100363c5
sub eax, 2
jne 0x100363fa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba5dc
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100363e3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100363fa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba5dc
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ba5dc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100ba5dc
mov esp, ebp
pop ebp
ret