joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402ca5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402cb4
pop dword [ebp - 0x48]
mov eax, 0x402cb4
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x5c728913
add dword [ebp - 0x58], 0xf1dfbc38
mov dword [ebp - 0x54], 0x74e10242
sub dword [ebp - 0x54], 0x42adb5fd
mov dword [ebp - 0x50], 0xf4467d10
add dword [ebp - 0x50], 0x5805c71e
mov dword [ebp - 0x4c], 0xf43b3594
sub dword [ebp - 0x4c], 0xf43b3594
lea eax, [ebp - 0x58]
push eax
mov eax, 0x9de2e3da
sub eax, 0x9da27296
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x24d2741e
sub dword [ebp - 0x58], 0xb0600ac8
mov dword [ebp - 0x54], 0x3432eae4
sub dword [ebp - 0x54], 0xf2c6896f
mov dword [ebp - 0x50], 0x6c70861
sub dword [ebp - 0x50], 0xa3579bf5
mov dword [ebp - 0x4c], 0x67afe76c
add dword [ebp - 0x4c], 0x98501894
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xa072a34b
sub eax, 0xa032323b
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3738f
push 0
call eax
mov ecx, 0x677a09bd
add ecx, 0x98863f43
xor edx, edx
add edx, eax
mov ebx, 0x163f0418
sub ebx, 0x15fba418
add ebx, dword [ebp - 0x48]
mov edi, 0x8d63f949
xor dword [ebp - 0x38], 0xf8152c27
mov esi, dword [ebx]
sub dword [ebp - 0x28], 0x2f76767e
add esi, edi
xor dword [ebp - 0x20], ebx
mov dword [edx], esi
sub dword [ebp - 0x24], esi
add edx, 4
add ebx, 4
loop 0x402dcd
add eax, 0x5f9866c8
add eax, 0xa068b00b
mov ebx, eax
add eax, 0x2fa9866
sub eax, 0x2fa9861
mov ecx, 0x37d9b0c5
sub ecx, 0x3799b0c5
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x25802400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x2580240f
pop dword [ebp - 0x40]
mov eax, 0x2580240f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xf5897bc2
add dword [ebp - 0x50], 0x58c8c989
mov dword [ebp - 0x4c], 0x706fae8d
add dword [ebp - 0x4c], 0xc1c39db8
mov dword [ebp - 0x48], 0x20fd187e
add dword [ebp - 0x48], 0x2b4f2bb0
mov dword [ebp - 0x44], 0xf08c3a62
sub dword [ebp - 0x44], 0xf08c3a62
lea eax, [ebp - 0x50]
push eax
mov eax, 0xb981d7a9
add eax, 0x6bfff89b
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xddf4bbd9
add dword [ebp - 0x50], 0x967dad7d
mov dword [ebp - 0x4c], 0x2cae1325
sub dword [ebp - 0x4c], 0xeb41b1b0
mov dword [ebp - 0x48], 0x79184683
add dword [ebp - 0x48], 0xea5725e9
mov dword [ebp - 0x44], 0x683c6998
add dword [ebp - 0x44], 0x97c39668
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xb5a23869
add eax, 0x6fdf9817
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3bc4f
push 0
call eax
mov ecx, 0xdd2b2c57
sub ecx, 0xdd2ae89d
xor edi, edi
add edi, eax
mov ebx, 0xf5ce2b3b
add ebx, 0x2fb46ac5
add ebx, dword [ebp - 0x40]
mov esi, 0xe0eb39f0
add esi, 0xe9758b5d
xor dword [ebp - 0x1c], 0x6368218
mov edx, dword [ebx]
mov dword [ebp - 0x28], 0x1578f175
xor edx, esi
sub dword [ebp - 0x1c], 0x7b71a53c
mov dword [edi], edx
add edi, 4
add ebx, 0xa4113f69
sub ebx, 0xa4113f65
loop 0x2580252e
add eax, 0x456020c7
sub eax, 0x455f1f0c
xor ebx, ebx
add ebx, eax
add eax, 0x893c22bb
sub eax, 0x893c22b6
mov ecx, 0x5be079a
sub ecx, 0xe03e079a
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x100193c
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push esi
mov esi, dword [0x100ba14]
test esi, esi
je 0x1001976
push edi
push dword [esi + 8]
push 0
push dword [esi]
call sub.msvcrt.dll_memset
mov edi, dword [esi + 4]
add esp, 0xc
cmp dword [esi + 0xc], 0
je 0x1001969
push dword [esi]
call fcn.010056b2
push esi
call fcn.010056b2
mov esi, edi
test edi, edi
jne 0x100194a
pop edi
and dword [0x100ba14], 0
xor esi, esi
mov eax, dword [esi + 0x100ade0]
test eax, eax
je 0x100199a
push eax
call fcn.010056f3
add esi, 4
cmp esi, 0x400
jb 0x100197f
xor esi, esi
inc esi
cmp dword [0x100ba0c], esi
jbe 0x10019bb
mov eax, dword [0x100ba10]
push dword [eax + esi*4]
call fcn.010056c2
inc esi
cmp esi, dword [0x100ba0c]
jb 0x10019a5
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.010056f3
pop esi
ret
Function at 0x1001c58
Capabilities:
Accept command line arguments
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x60]
push ebx
push eax
mov dword [ebp - 0xc], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x60], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x20
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov dword [ebp - 8], eax
mov eax, esi
pop ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x1001c97
sub eax, ecx
sar eax, 1
lea esi, [eax + 0x10a]
lea eax, [ebp - 4]
push eax
lea eax, [esi + esi]
push eax
call fcn.01005686
cmp eax, ebx
je 0x1001cc2
push eax
call fcn.0100544f
push 0x104
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
cmp edi, ebx
jne 0x1001ce2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100544f
mov eax, esi
sub eax, edi
push 0x1001260
push eax
mov eax, dword [ebp - 4]
lea eax, [eax + edi*2]
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
cmp dword [ebp - 8], ebx
je 0x1001d0f
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push 0x20
push 1
push ebx
push ebx
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1001d39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100544f
push dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x1c]
call esi
push dword [ebp - 0xc]
call fcn.01001c3f
int3
Function at 0x100207c
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [eax], ebx
push 0x800
mov dword [ebp - 8], ebx
mov dword [esi], 0x40
call fcn.01005686
cmp eax, ebx
je 0x10020b1
push eax
call fcn.0100544f
lea eax, [ebp - 0xc]
mov edi, 0x1000
push eax
push edi
mov dword [ebp - 0x10], edi
call fcn.01005686
cmp eax, ebx
je 0x10020cd
push eax
call fcn.0100544f
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push 1
call sub.MPR.dll_WNetOpenEnumW
cmp eax, ebx
jne 0x100221d
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call sub.MPR.dll_WNetEnumResourceW
mov dword [ebp - 0x18], eax
test eax, eax
je 0x100210c
cmp eax, 0x103
jne 0x100221d
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add eax, ebx
cmp eax, dword [esi]
jb 0x1002131
push dword [ebp + 0xc]
add eax, 0x40
mov dword [esi], eax
shl eax, 5
push eax
call fcn.01005696
test eax, eax
jne 0x100221d
mov ecx, dword [ebp + 0xc]
mov eax, ebx
shl eax, 5
add eax, dword [ecx]
xor ebx, ebx
cmp dword [ebp - 4], ebx
jbe 0x10021e5
mov ecx, dword [ebp - 0xc]
add ecx, 0x14
mov edx, dword [ecx - 4]
test edx, edx
jne 0x1002159
mov edx, dword [0x10092b8]
mov dword [eax], edx
mov edx, dword [ecx]
test edx, edx
jne 0x1002167
mov edx, dword [0x10092b8]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
test edx, edx
jne 0x1002177
mov edx, dword [0x10092b8]
mov dword [eax + 8], edx
mov edx, dword [ecx - 0x10]
mov dword [eax + 0xc], edx
mov esi, dword [0x100c0d4]
mov edx, dword [ecx + 8]
mov di, word [edx]
cmp di, word [esi]
jne 0x10021af
test di, di
je 0x10021ab
mov di, word [edx + 2]
cmp di, word [esi + 2]
jne 0x10021af
add edx, 4
add esi, 4
test di, di
jne 0x1002189
xor esi, esi
jmp 0x10021b4
sbb esi, esi
sbb esi, 0xffffffff
xor edx, edx
test esi, esi
sete dl
or dword [eax + 0x10], 0xffffffff
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
inc ebx
inc dword [ebp - 8]
add eax, 0x20
mov dword [eax - 4], edx
add ecx, 0x20
cmp ebx, dword [ebp - 4]
jb 0x100214c
mov esi, dword [ebp + 0x10]
mov edi, 0x1000
cmp dword [ebp - 0x18], 0
jne 0x100220b
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 0x10], edi
call fcn.01005686
test eax, eax
je 0x10020e3
push eax
call fcn.0100544f
jmp 0x10020e3
push dword [ebp - 0x14]
call sub.MPR.dll_WNetCloseEnum
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002229
Capabilities:
Enumerate network shares

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push esi
push edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xc]
mov edi, 0x1000
push eax
push edi
mov dword [ebp - 0x1c], edi
call fcn.01005686
xor esi, esi
cmp eax, esi
je 0x100225a
push eax
call fcn.0100544f
lea eax, [ebp - 0x20]
push eax
push esi
push esi
push esi
push 3
call sub.MPR.dll_WNetOpenEnumW
mov esi, eax
test esi, esi
je 0x100227d
push dword [ebp - 0xc]
call fcn.010056b2
mov eax, esi
jmp 0x10023ef
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x20]
call sub.MPR.dll_WNetEnumResourceW
xor ecx, ecx
mov dword [ebp - 0x24], eax
cmp eax, ecx
je 0x10022a8
cmp eax, 0x103
jne 0x10023ef
cmp dword [ebp - 4], 0xffffffff
je 0x10023e5
cmp dword [ebp - 4], ecx
je 0x10023e5
mov dword [ebp - 0x18], ecx
jbe 0x10023bf
mov esi, dword [ebp - 0xc]
add esi, 0x10
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
and dword [ebp - 8], 0
cmp dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
jbe 0x1002337
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x100231d
mov edx, dword [esi]
test edx, edx
je 0x100231d
cmp word [ecx], 0
je 0x1002317
mov eax, ecx
lea ebx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
test di, di
jne 0x10022f6
sub eax, ebx
sar eax, 1
push eax
push ecx
push edx
call dword [sym.imp.msvcrt.dll__wcsnicmp]
mov ebx, dword [ebp + 8]
add esp, 0xc
test eax, eax
jmp 0x100231b
cmp word [edx], 0
je 0x100232c
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add dword [ebp - 0x10], 0x20
cmp eax, dword [ebp - 0x14]
jb 0x10022dc
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jb 0x10023a8
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
cmp dword [ebx], eax
jb 0x1002357
add eax, 0x40
mov dword [ecx], eax
push edi
shl eax, 5
push eax
call fcn.01005696
test eax, eax
jne 0x10023ef
mov eax, dword [ebx]
mov ecx, dword [esi]
shl eax, 5
add eax, dword [edi]
mov edi, dword [0x10092bc]
test ecx, ecx
jne 0x100236c
mov ecx, edi
mov dword [eax], ecx
mov edx, dword [esi + 4]
test edx, edx
jne 0x1002377
mov edx, edi
mov dword [eax + 4], edx
mov edx, dword [esi + 0xc]
test edx, edx
jne 0x1002383
mov edx, edi
mov dword [eax + 8], edx
mov edx, dword [esi - 0xc]
mov dword [eax + 0xc], edx
xor edx, edx
push ecx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x10], 0xfffe
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
call dword [sym.imp.msvcrt.dll__wcsupr]
inc dword [ebx]
pop ecx
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add esi, 0x20
cmp eax, dword [ebp - 4]
jb 0x10022ca
mov edi, 0x1000
cmp dword [ebp - 0x24], 0
jne 0x10023e5
lea eax, [ebp - 0xc]
push eax
push edi
mov dword [ebp - 0x1c], edi
call fcn.01005686
test eax, eax
je 0x100227d
push eax
call fcn.0100544f
jmp 0x100227d
push dword [ebp - 0x20]
call sub.MPR.dll_WNetCloseEnum
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1002a1b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea ecx, [ebp - 4]
mov eax, 0x200
xor esi, esi
push ecx
inc esi
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
call fcn.01005686
test eax, eax
je 0x1002a46
push eax
call fcn.0100544f
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0x1001310
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1002a6d
push dword [ebp - 4]
call fcn.010056b2
xor eax, eax
jmp 0x1002adf
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0
mov edi, 0x1001304
push edi
push dword [ebp - 8]
call esi
mov ebx, eax
cmp ebx, 0xea
jne 0x1002acd
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.01005696
mov ebx, eax
test ebx, ebx
je 0x1002ab8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0100544f
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0
push edi
push dword [ebp - 8]
call esi
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test ebx, ebx
pop ebx
jne 0x1002a61
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x1002ae7
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1009320]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.01005eda
test eax, eax
jne 0x1002b12
mov eax, edi
jmp 0x1002b9a
test esi, esi
je 0x1002b19
push esi
jmp 0x1002b1e
push 0x1001398
push 0x51
mov esi, 0x100c030
push esi
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jne 0x1002b72
xor eax, eax
mov word [0x100c034], ax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
mov dword [ebp - 0x58], 0x28
call sub.MPR.dll_WNetGetConnectionW
cmp eax, 0x4b1
je 0x1002b69
cmp eax, 0xea
je 0x1002b69
test eax, eax
jne 0x1002b94
push 0x5c
pop eax
mov word [0x100c034], ax
cmp word [0x100c030], 0x61
je 0x1002b98
cmp word [0x100c030], 0x41
je 0x1002b98
mov eax, 0xffff
add word [0x100c030], ax
jmp 0x1002b2e
mov eax, esi
jmp 0x1002b9a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100492b
leave
ret 8
Function at 0x1002baf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1009320]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x18], 0
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 0x18]
push eax
xor edi, edi
inc edi
push edi
push 0
push 0x10013a0
push 0x80000001
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0xe
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002c39
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0x10012c8
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002c2c
lea eax, [ebp - 0x14]
push 0x10012e8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [esi], eax
jmp 0x1002c2e
mov dword [esi], edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002c3b
mov dword [esi], edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100492b
leave
ret 4

Function at 0x1002c50
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
push 0xf003f
push esi
push esi
push esi
push 0x10013a0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x1002cba
mov eax, 0x10012e8
cmp dword [ebp + 8], esi
jne 0x1002c8e
mov eax, 0x10012f0
xor ecx, ecx
cmp dword [ebp + 8], esi
setne cl
lea ecx, [ecx + ecx + 6]
push ecx
push eax
push 1
push esi
push 0x10012c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4
Function at 0x10063c0
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x1009320]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x414], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x410], ecx
test bl, 4
je 0x1006400
test bl, 0xa
je 0x1006400
push 0x57
pop eax
jmp 0x10064b4
push esi
push edi
lea ecx, [ebp - 0x40c]
push ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0x404]
push 0x200
push ecx
push dword [ebp + 0xc]
mov esi, ebx
mov edi, ebx
push eax
and esi, 8
and edi, 2
call fcn.01007e06
mov dword [ebp - 0x408], eax
test eax, eax
je 0x100643a
test bl, 4
jne 0x1006477
push dword [ebp - 0x40c]
lea eax, [ebp - 0x404]
push eax
push 0x1001
mov ebx, 0x10134c0
push ebx
call sub.msvcrt.dll_wcsncpy_s
mov ecx, dword [ebp - 0x40c]
add esp, 0x10
xor eax, eax
push eax
push ebx
push dword [ebp - 0x410]
mov word [ecx*2 + 0x10134c0], ax
call fcn.0100767f
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x1006489
mov ecx, dword [ebp - 0x40c]
mov dword [eax], ecx
test si, si
je 0x10064a3
cmp dword [ebp - 0x408], 0
je 0x10064a3
push dword [ebp - 0x408]
call dword [sym.imp.msvcrt.dll_exit]
test di, di
pop edi
pop esi
je 0x10064ae
push 0xffffffffffffffff
jmp 0x100649d
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0100492b
leave
ret 0x18

Function at 0x100685a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [0x1010ed4]
call dword [sym.imp.KERNEL32.dll_GetFileType]
test al, 2
je 0x10068b4
lea eax, [ebp - 0x10]
push eax
push dword [0x1010ed4]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x10068b4
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
xor esi, esi
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x100688f
push esi
sub eax, edx
lea ecx, [ebp - 0xc]
push ecx
sar eax, 1
push eax
push dword [ebp + 8]
push dword [0x1010ed4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x100691f
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor esi, esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
call ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 8], eax
cmp eax, esi
je 0x100691b
push esi
push esi
push dword [ebp - 4]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
call edi
push eax
call ebx
push esi
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
dec eax
push eax
push dword [ebp - 8]
push dword [0x1010ed4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
mov eax, esi
pop ebx
pop esi
leave
ret 4
Function at 0x1007600
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.010075c6
test eax, eax
je 0x1007628
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1007676
mov eax, dword [ebp + 0x10]
push esi
push edi
add eax, eax
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, esi
je 0x1007674
mov eax, dword [ebp + 0x10]
push esi
push esi
lea ecx, [eax + eax]
push ecx
push edi
push eax
push dword [ebp + 0xc]
push esi
push 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp + 0x10], eax
cmp eax, esi
je 0x100766d
push esi
lea ecx, [ebp + 0x10]
push ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10076dc
Capabilities:
List domain servers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push dword [ebp + 0x1c]
lea eax, [ebp + 0x18]
push dword [ebp + 0x18]
push eax
push esi
push 0xffffffffffffffff
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.browcli.dll_NetServerEnum
mov dword [ebp + 0x1c], eax
cmp eax, ebx
je 0x1007714
cmp eax, 0xea
jne 0x1007768
cmp dword [ebp + 0xc], 0x64
mov edi, dword [edi]
jne 0x1007743
cmp dword [esi], ebx
jbe 0x1007768
lea eax, [edi + 4]
mov dword [ebp + 0xc], eax
push 4
push dword [ebp + 0xc]
push edi
call dword [sym.imp.msvcrt.dll_memmove]
add dword [ebp + 0xc], 8
add esp, 0xc
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x1007726
jmp 0x1007768
cmp dword [esi], ebx
jbe 0x1007768
lea eax, [edi + 4]
mov dword [ebp + 0xc], eax
push 0x14
push dword [ebp + 0xc]
push edi
call dword [sym.imp.msvcrt.dll_memmove]
add dword [ebp + 0xc], 0x18
add esp, 0xc
inc ebx
add edi, 0x14
cmp ebx, dword [esi]
jb 0x100774d
mov eax, dword [ebp + 0x1c]
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x415b90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x415baa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415ba0
mov eax, 1
add ebx, ebx
jne 0x415bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415bb8
jne 0x415bd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415bb8
xor ecx, ecx
sub eax, 3
jb 0x415be8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415c5a
mov ebp, eax
add ebx, ebx
jne 0x415bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x415c24
inc ecx
add ebx, ebx
jne 0x415c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415c05
jne 0x415c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415c05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x415c44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x415c35
jmp 0x415ba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x415c44
add edi, ecx
jmp 0x415ba6
pop esi
mov edi, esi
mov ecx, 0x128
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x415c62
cmp byte [edi], 2
jne 0x415c62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x415c67
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x415cd6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x155f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15670]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415c94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15678]
or eax, eax
je 0x415cd0
mov dword [ebx], eax
add ebx, 4
jmp 0x415cb1
call dword [esi + 0x15674]
mov ebp, dword [esi + 0x1567c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415d0a
sub esp, 0xffffff80
jmp 0x4059d0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx