joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f0b5
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push 0x7d458b
and byte [ebp + 0x68], dh
push 0x33
push cs
hlt
add byte [eax + 0x48], bl
aas
cmc
dec esi
adc al, 0xd9
fild dword [ebp + 0x41]
rol byte [edx], 0xdb
add dword [esp], esi
inc esi
lock sub byte [ebp - 0xd], ah
add ch, bl
pop ds
clc
sbb al, 0x56
jge 0x42f00b
invalid
inc byte [esi]
xor byte [ecx - 0x7a1764], cl
jne 0x42f063
lsl ecx, word [ecx - 0x3840765d]
sub al, byte [eax]
pop eax
dec eax
aas
cmc
dec esi
adc al, 0xd9
fild dword [ebp + 0x41]
rol byte [edx], 0x89
mov dword [0x2ac7bf89], eax
add byte [eax + 0x48], bl
aas
jle 0x42f15d
cmovae edi, dword [ecx]
sub ah, 0x8b
jne 0x42f166
inc ebp
je 0x42f116
pushfd
call 0xb9b4f976
invalid
pop esi
mov dword [edi + 0x58242ac7], edi

Function at 0x42f0f1
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc eax
jne 0x42f105
dec esi
adc al, 0xd9
fild dword [ebp - 0x69]
xor eax, dword [esp + ecx*8]
mov esi, 0x78e85653
jp 0x42f113
invalid
cmpsb byte [esi], byte es:[edi]
add bl, al
je 0x42f112
pushfd
call 0xa4b8f095
invalid
mov dword [ebx + 0x2ac7bf89], esp
mov dword [0x2ac7bf89], eax
sbb dword [eax - 0x6e], 0xf
cmp eax, 0xdb38e8e8
inc ebp
inc ecx
rol byte [edx], 0x89
mov dword [0x2ac7bf89], eax
sbb dword [eax - 0x6e], 0xf
jle 0x42f1ae
jnp 0x8c2f7170
jne 0x42f1b7
inc ebp
je 0x42f167
pushfd
call 0xb9b4f9c7
inc eax
jne 0x42f156
call 0x461e2a32
xchg edi, eax
xor eax, dword [esp + ecx*8]
mov esi, 0x78e85653
push ebp
mov ebp, esp
sub esp, 0x66
call 0x5e806f7a
inc ebp
sub cl, byte [eax + 0x3f]
rol byte [edx], 0x89
mov dword [0x2ac7bf89], eax
and al, 0x58
mov edi, 0x58242ac7
xchg edx, eax
movd dword [ebp + 0xf], mm7
pop edi
add esp, dword [0x78744357]
call 0x2b0ab17c
add byte [eax - 0x3b], bl
inc esp
jle 0x42f200
pop eax
lds eax, [esi + edi*2 + 0x7d]
psubsw mm5, mm7
std
inc edx
and eax, 0x4d10ad05
inc ebp
sbb eax, 0x35146a47
jbe 0x42f17e
jmp 0x42f20e
inc eax
and al, byte [eax]
add al, ah
invalid
call 0x70b37b76
add eax, 0xed8d392d
or byte [0xe8bbeb50], dl
js 0x42f241
sbb byte [edi - 0x18], dl
hlt
and ch, al
inc esi
push ebp
nop
test eax, 0xf540389
push eax
or al, 0x6e
or al, 0xe8
mov edi, 0x1cfe150d
add edx, dword [esi + eax*2]
call 0xfe57ffd2
sbb al, 3
adc al, 0x46
push ebp
je 0x42f228
mov eax, 0x33d874e8
push cs
dec esi
adc al, 0xd9
push es
sub byte [edi + 0x50], al
push cs
mov ebp, dword [ebx]
xor byte [ebx], bl
mov ebx, 0xc27878e8
cmp ecx, dword [eax]
or byte [ecx + ecx*4], cl
jo 0x42f295
invalid
push ebp
push esi
int1
mov cx, word [eax]
cmp dword [ebp + 0xce8c183], ebx
sub byte [eax + 0x67], dh
fsub st(0), st(0)
add eax, 0x7a4a34b9
call 0x762bf189
call 0xec2b3762
jbe 0x42f279
invalid
or byte [eax - 0x3e], dl
add eax, ebp
pop ebp
loopne 0x42f244
xor ax, word [edx]
cmp byte [eax], dl
call 0x38cd22a0
call 0xc1627178
and eax, 0x89836684
push eax
push eax
invalid

Function at 0x42fddd
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp al, 0x6a
mov dword [esi + 0x68e885c9], esi
mov eax, dword [ebp + 0x7d]
mov eax, dword [esp + 0x68]
push 0x46
imul ecx, dword [ecx*2 + 0x1477ff30], 0x1cd88b8d
push eax
invalid
Function at 0x43288c
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov edi, 0x588b2ac7
inc ebp
inc ecx
jle 0x432912
pcmpeqw mm7, qword [ecx]
sub ah, 0x8b
jne 0x43291b
inc ebp
je 0x4328cb
pushfd
call 0x8c2b312b
push es
jmp [esi + 0x4e]
mov edi, 0x588b2ac7
dec eax
or byte [ebx + eax], bl
adc al, 0xe0
invalid
and edi, 0x75
or dword [eax - 0x72c6d2fb], 0xffffffed
or byte [0xffbbeb50], dl
and dword [esi], 0x57
push cs
or al, 0x89
xor byte [eax], ah
dec eax
aas
rol byte [edx], 0
fdiv dword [ebx]
push cs
hlt
Function at 0x10001000
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], str.MyKeyContainer
push 0
push 1
push 0x10015050
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10001064
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x1000105a
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10001058
mov eax, 0x20e
jmp 0x1000119e
jmp 0x10001064
mov eax, 0x20f
jmp 0x1000119e
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
push 0x800001
push 0x6801
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x1000108f
mov eax, 0x20d
jmp 0x1000119e
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x100010bc
mov eax, 0x20c
jmp 0x1000119e
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0
push 0
push 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x100010eb
mov eax, 0x20b
jmp 0x1000119e
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
push eax
call fcn.1000d152
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
jne 0x10001113
mov eax, 0x20a
jmp 0x1000119e
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
push 0
push 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
jne 0x10001144
mov eax, 0x20b
jmp 0x1000119e
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x20], 0x2710
mov edx, 1
test edx, edx
je 0x10001168
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
add ecx, 8
mov edx, dword [ebp + 8]
mov dword [edx + 0x24], ecx
jmp 0x10001174
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x24], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
push ecx
call fcn.1000d152
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
jne 0x10001199
mov eax, 0x20a
jmp 0x1000119e
mov eax, 9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10001d6f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x10001e2f
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 0x10]
ja 0x10001e2a
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x20]
jbe 0x10001dab
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1000cffe
test eax, eax
jne 0x10001dc5
xor eax, eax
jmp 0x10001ed1
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x10017800]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10001dea
xor eax, eax
jmp 0x10001ed1
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [0x10017800]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
push ecx
call fcn.1000d240
add esp, 0xc
push 0
mov edx, dword [ebp + 0x14]
add edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1000cffe
test eax, eax
jne 0x10001e20
xor eax, eax
jmp 0x10001ed1
mov eax, 1
jmp 0x10001ed1
jmp 0x10001ecf
mov ecx, dword [ebp - 8]
neg ecx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x20]
jae 0x10001ecf
mov eax, dword [ebp + 0x20]
sub eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0x10]
jbe 0x10001e5a
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
push 0
mov eax, dword [ebp + 0x1c]
add eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000cffe
test eax, eax
jne 0x10001e74
xor eax, eax
jmp 0x10001ed1
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x10017800]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10001e97
xor eax, eax
jmp 0x10001ed1
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [0x10017800]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1000d240
add esp, 0xc
push 0
mov eax, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000cffe
test eax, eax
jne 0x10001ec8
xor eax, eax
jmp 0x10001ed1
mov eax, 1
jmp 0x10001ed1
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10004620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x10004639
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x10004680
invalid
test esp, ebp
clc
invalid
Function at 0x10006190
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
pop ebp
ret
Function at 0x10008c90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10008cb0
or eax, 0xffffffff
jmp 0x10008d1d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10008cd9
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 0xc], eax
jmp 0x10008cde
or eax, 0xffffffff
jmp 0x10008d1d
mov word [ebp - 0x1c], 2
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x18], eax
mov ax, word [ebp + 0xc]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1a], ax
push 0x10
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10008d1a
or eax, 0xffffffff
jmp 0x10008d1d
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x10009905
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret 8

Function at 0x1000a590
Capabilities:
Copy file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push esi
mov dword [ebp - 0x10c], str.Load_library
mov dword [ebp - 0x118], 0x100167c0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
je 0x1000a5cb
cmp dword [ebp - 0x11c], 2
je 0x1000a60e
jmp 0x1000a62b
push 0
push 0x24
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne 0x1000a5ec
mov eax, 0x30e
jmp 0x1000a72a
push str.explorer.exe
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
jne 0x1000a60c
mov eax, 0x30a
jmp 0x1000a72a
jmp 0x1000a62b
lea eax, [ebp - 0x108]
push eax
push str.messenger
call fcn.1000cd4b
test eax, eax
jne 0x1000a62b
or eax, 0xffffffff
jmp 0x1000a72a
push str..local
push 0x105
lea ecx, [ebp - 0x108]
push ecx
call fcn.10004620
test eax, eax
jne 0x1000a6ad
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
je 0x1000a6ad
push 0
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.1000d590
add esp, 4
push eax
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x108]
push edx
call fcn.1000d590
add esp, 4
mov esi, eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
call fcn.1000d590
add esp, 4
sub esi, eax
mov byte [ebp + esi - 0x108], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test eax, eax
jne 0x1000a6fa
mov eax, 0x30a
jmp 0x1000a72a
push 1
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x1000a727
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10008084
jmp 0x1000a72a
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000cd4b
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov dword [ebp - 4], 1
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0xffffffff
jne 0x1000cd7a
xor eax, eax
jmp 0x1000ce8b
mov dword [ebp - 0x12c], 0x128
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 0x358]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x1000cdaf
mov edx, dword [ebp - 0x358]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1000ce8b
mov eax, dword [ebp - 0x124]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
jne 0x1000cdd1
jmp 0x1000ce61
mov dword [ebp - 0x354], 0x224
lea ecx, [ebp - 0x354]
push ecx
mov edx, dword [ebp - 0x130]
push edx
call sub.KERNEL32.dll_Module32First
test eax, eax
jne 0x1000ce01
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000ce61
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x234]
push edx
call fcn.1000c2f2
test eax, eax
je 0x1000ce54
lea eax, [ebp - 0x234]
push eax
push 0x105
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10006150
test eax, eax
je 0x1000ce35
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x358]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x1000ce8b
mov ecx, dword [ebp - 0x130]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp - 0x358]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1000cdaf
mov ecx, dword [ebp - 0x358]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x1000d07b
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x1000d089
xor eax, eax
jmp 0x1000d0b8
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1000d0a9
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x100103f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10016c80
cmp edx, dword [eax]
je 0x10010418
add eax, 8
inc ecx
cmp eax, 0x10016d10
jl 0x10010409
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10016c80]
jne 0x10010546
mov eax, dword [0x10017870]
cmp eax, 1
je 0x10010520
test eax, eax
jne 0x10010449
cmp dword [0x10017874], 1
je 0x10010520
cmp edx, 0xfc
je 0x10010546
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10010480
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.100110a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1000d590
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x100104c3
lea eax, [ebp - 0x1a4]
push eax
call fcn.1000d590
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1001366c
push edi
call fcn.10011610
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.100110a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.100110b0
lea eax, [ebp - 0xa0]
push 0x1001364c
push eax
call fcn.100110b0
push dword [esi + 0x10016c84]
lea eax, [ebp - 0xa0]
push eax
call fcn.100110b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.10011584
add esp, 0x2c
pop edi
jmp 0x10010546
lea eax, [ebp + 8]
lea esi, [esi + 0x10016c84]
push 0
push eax
push dword [esi]
call fcn.1000d590
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1012475
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x10015e0
call fcn.010127c8
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10124b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10124b2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10124ca
cmp eax, 0x20b
je 0x10124b7
mov dword [ebp - 0x1c], ebx
jmp 0x10124de
cmp dword [ecx + 0x84], 0xe
jbe 0x10124b2
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x10124d8
cmp dword [ecx + 0x74], 0xe
jbe 0x10124b2
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1015010], 0xffffffff
or dword [0x1015014], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x101500c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1015008]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1015018], eax
call fcn.010127c2
cmp dword [0x10149d0], ebx
jne 0x1012539
push fcn.010127c2
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010127b0
push 0x1001234
push 0x1001230
call sub.msvcrt.dll__initterm
mov eax, dword [0x1015004]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1015000]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x100122c
push 0x1001228
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x10125cf
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10125a3
cmp al, 0x22
jne 0x1012595
cmp byte [esi], 0x22
jne 0x10125ac
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10125b6
cmp al, 0x20
jbe 0x10125a8
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
jmp 0x10136cc
cmp byte [esi], 0x20
jbe 0x10125ac
inc esi
mov dword [ebp - 0x34], esi
jmp 0x10125cf
and eax, eax
dec ecx
mov eax, eax
mov eax, 0x21c63b66
nop
jmp 0x101376a
mov ecx, 0xd4f353ab
mov eax, 0x4202b186
mov ch, 0x1e
not eax
adc ch, cl
mov cl, 0x2d
push 0x6b1a
clc
pop edx
lea eax, [eax + 0x6c]
seto cl
cld
jmp 0x1013720
lea eax, [esi]
not eax
xchg cl, cl
sbb word [edx + 0x101ec00], 0xa55b
mov al, 0xaf
mov eax, 0x4dac423a
add al, 0x9f
or cl, 0x78
mov ah, ah
test eax, 0xeb53b28
clc
nop
jmp 0x10136b0
dec eax
not ch
sub edx, 2
mov ecx, esi
xchg al, al
xchg ecx, eax
xchg cl, cl
xchg cl, cl
jmp 0x101377e
mov eax, 0x9b6bbf29
mov ecx, 0xc7a7bcac
mov ecx, 0xb83d3b3
mov ch, 0xab
jge 0x1013720
dec ecx
cmp eax, esi
nop
not edx
jmp 0x10252e4
Function at 0x4f9f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa5000]
push edi
jmp 0x4f9f3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4f9f41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f9f30
mov eax, 1
add ebx, ebx
jne 0x4f9f53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4f9f64
jne 0x4f9f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f9f83
dec eax
add ebx, ebx
jne 0x4f9f70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4f9f48
add ebx, ebx
jne 0x4f9f7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4f9fd5
xor ecx, ecx
sub eax, 3
jb 0x4f9f9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4fa00a
sar eax, 1
mov ebp, eax
jmp 0x4f9fa6
add ebx, ebx
jne 0x4f9fa6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f9f74
inc ecx
add ebx, ebx
jne 0x4f9fb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4f9f74
add ebx, ebx
jne 0x4f9fc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4f9fb6
jne 0x4f9fd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4f9fb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4f9ff4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4f9fe6
jmp 0x4f9f36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4f9ff4
add edi, ecx
jmp 0x4f9f36
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4fa012
cmp byte [edi], 0x11
jne 0x4fa012
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4fa017
lea edi, [esi + 0xf2000]
mov eax, dword [edi]
or eax, eax
je 0x4fa08f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11b7d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11b950]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4fa044
mov ecx, edi
jns 0x4fa073
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11b954]
or eax, eax
je 0x4fa089
mov dword [ebx], eax
add ebx, 4
jmp 0x4fa061
call dword [esi + 0x11b964]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4fa0c0
cmp al, 0xef
ja 0x4fa0b3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4fa095
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4fa0a2
mov ebp, dword [esi + 0x11b958]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4fa0f4
sub esp, 0xffffff80
jmp 0x425f74