joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4abb10
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x4abb19
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x4abd4e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004041ac
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4abd28
lea ecx, [ebp - 0x150]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x150]
mov edx, esi
call fcn.00408eb4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
cmp esi, 0
jl 0x4abbcd
lea ecx, [ebp - 0x154]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x154]
call fcn.00408d28
and eax, 0x10
cmp eax, 0x10
je 0x4abbc7
lea ecx, [ebp - 0x158]
mov edx, esi
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x158]
xor edx, edx
mov eax, dword [ebp - 4]
mov edi, dword [eax]
call dword [edi + 0x60]
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
dec esi
cmp esi, 0xffffffff
jne 0x4abb7d
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4abd19
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0xc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x48]
cmp dword [ebp - 8], 0
jle 0x4abbf5
dec dword [ebp - 8]
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x15c]
mov ecx, 0x4abd68
mov edx, dword [ebp - 0xc]
call fcn.004044d4
mov eax, dword [ebp - 0x15c]
call fcn.00404688
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4abd19
test byte [ebp - 0x14c], 0x10
jne 0x4abc76
push dword [ebp - 0xc]
push 0x4abd78
lea edx, [ebp - 0x164]
lea eax, [ebp - 0x120]
call fcn.004092a4
push dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, 3
call fcn.00404548
mov edx, dword [ebp - 0x160]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x4abcfe
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x120]
call fcn.004092a4
mov eax, dword [ebp - 0x168]
mov edx, 0x4abd84
call fcn.004045d4
je 0x4abcfe
lea edx, [ebp - 0x16c]
lea eax, [ebp - 0x120]
call fcn.004092a4
mov eax, dword [ebp - 0x16c]
mov edx, 0x4abd90
call fcn.004045d4
je 0x4abcfe
push dword [ebp - 0xc]
push 0x4abd78
lea edx, [ebp - 0x174]
lea eax, [ebp - 0x120]
call fcn.004092a4
push dword [ebp - 0x174]
lea eax, [ebp - 0x170]
mov edx, 3
call fcn.00404548
mov ecx, dword [ebp - 0x170]
mov edx, dword [ebp - 8]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
inc dword [ebp - 8]
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4abc2b
push esi
call sub.kernel32.dll_FindClose_1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jg 0x4abbd7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4abd55
lea eax, [ebp - 0x174]
mov edx, 0xa
call fcn.004041d0
lea eax, [ebp - 0xc]
call fcn.004041ac
ret
Function at 0x4af074
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
mov eax, esp
call fcn.004092a4
add esp, 0x100
pop ebx
ret

Function at 0x4af0a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4af1d9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.004af074
lea eax, [ebp - 0x10]
mov ecx, 0x4af1f0
mov edx, dword [ebp - 4]
call fcn.004044d4
mov eax, dword [ebp - 0x10]
call fcn.00408c9c
test al, al
je 0x4af0f9
lea eax, [ebp - 8]
mov ecx, 0x4af1f0
mov edx, dword [ebp - 4]
call fcn.004044d4
jmp 0x4af129
lea eax, [ebp - 0x14]
mov ecx, 0x4af210
mov edx, dword [ebp - 4]
call fcn.004044d4
mov eax, dword [ebp - 0x14]
call fcn.00408c9c
test al, al
je 0x4af1be
lea eax, [ebp - 8]
mov ecx, 0x4af210
mov edx, dword [ebp - 4]
call fcn.004044d4
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402a9c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408eb4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov ecx, 0x4af230
call fcn.004044d4
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0047fe74
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00404244
mov eax, dword [ebp - 0xc]
call fcn.00408c9c
test al, al
je 0x4af1be
test bl, bl
je 0x4af186
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4af248
call fcn.004044d4
jmp 0x4af196
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4af258
call fcn.004044d4
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404688
push eax
mov eax, dword [ebp - 8]
call fcn.00404688
push eax
push 0x4af264
mov eax, esi
call fcn.00463870
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af1e0
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004041d0
ret
Function at 0x4afec8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4b007b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x150]
mov eax, dword [0x4bad68]
mov eax, dword [eax]
call fcn.0047d3e4
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00408eb4
lea eax, [ebp - 0x14c]
mov edx, 0x4b0094
call fcn.00404490
mov eax, dword [ebp - 0x14c]
call fcn.00404688
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b004a
test byte [ebp - 0x148], 0x10
jne 0x4b0035
lea edx, [ebp - 0x154]
lea eax, [ebp - 0x11c]
call fcn.004092a4
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x15c]
mov eax, dword [0x4bad68]
mov eax, dword [eax]
call fcn.0047d3e4
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x158]
call fcn.00408eb4
mov edx, dword [ebp - 0x158]
lea eax, [ebp - 4]
pop ecx
call fcn.004044d4
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x438914]
call fcn.004389c4
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b00a4
mov edx, 0x4b00b4
mov eax, esi
mov edi, dword [eax]
call dword [edi]
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 8]
call fcn.00408448
mov eax, dword [ebp - 0x160]
mov edx, 0x4b00c4
call fcn.004045d4
jne 0x4b002e
push 0
lea eax, [ebp - 8]
push eax
mov ecx, 0x4b00d8
mov edx, 0x4b00b4
mov eax, esi
mov edi, dword [eax]
call dword [edi]
cmp dword [ebp - 8], 0
je 0x4b002e
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004afdb8
pop ecx
mov eax, esi
call fcn.00403398
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4aff64
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0082
lea eax, [ebp - 0x160]
mov edx, 6
call fcn.004041d0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004041d0
ret
Function at 0x4b00e4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0210
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4baf30]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
mov eax, dword [eax + 0x23c]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [0x4bad68]
mov eax, dword [eax]
call fcn.0047d3e4
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00408eb4
lea eax, [ebp - 0x148]
mov edx, 0x4b0224
call fcn.00404490
mov eax, dword [ebp - 0x148]
call fcn.00404688
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4b01e4
mov eax, dword [ebp - 0x144]
and eax, 0x10
cmp eax, 0x10
jne 0x4b01d3
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.0040441c
mov eax, dword [ebp - 4]
mov edx, 0x4b0238
call fcn.004045d4
je 0x4b01d3
mov eax, dword [ebp - 4]
mov edx, 0x4b0244
call fcn.004045d4
je 0x4b01d3
mov eax, dword [0x4baf30]
mov eax, dword [eax]
mov eax, dword [eax + 0x31c]
mov eax, dword [eax + 0x23c]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4b0179
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0217
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.004041d0
lea eax, [ebp - 4]
call fcn.004041ac
ret
Function at 0x4b33d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b350d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
call fcn.004af074
lea eax, [ebp - 0x10]
mov ecx, 0x4b3524
mov edx, dword [ebp - 4]
call fcn.004044d4
mov eax, dword [ebp - 0x10]
call fcn.00408c9c
test al, al
je 0x4b342d
lea eax, [ebp - 8]
mov ecx, 0x4b3524
mov edx, dword [ebp - 4]
call fcn.004044d4
jmp 0x4b345d
lea eax, [ebp - 0x14]
mov ecx, 0x4b3544
mov edx, dword [ebp - 4]
call fcn.004044d4
mov eax, dword [ebp - 0x14]
call fcn.00408c9c
test al, al
je 0x4b34f2
lea eax, [ebp - 8]
mov ecx, 0x4b3544
mov edx, dword [ebp - 4]
call fcn.004044d4
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402a9c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408eb4
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov ecx, 0x4b3564
call fcn.004044d4
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0047fe74
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00404244
mov eax, dword [ebp - 0xc]
call fcn.00408c9c
test al, al
je 0x4b34f2
test bl, bl
je 0x4b34ba
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4b3578
call fcn.004044d4
jmp 0x4b34ca
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, 0x4b3588
call fcn.004044d4
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404688
push eax
mov eax, dword [ebp - 8]
call fcn.00404688
push eax
push 0x4b3594
mov eax, esi
call fcn.00463870
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3514
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004041d0
ret

Function at 0x4b359c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret
Function at 0x4b563c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404678
xor eax, eax
push ebp
push 0x4b56c3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.00402d90
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x4b56d8
mov edx, dword [ebp - 4]
call fcn.004044d4
mov eax, dword [ebp - 0x28]
call fcn.00404688
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x50
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b56ca
lea eax, [ebp - 0x28]
call fcn.004041ac
lea eax, [ebp - 4]
call fcn.004041ac
ret
Function at 0x84e150
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x312000]
push edi
jmp 0x84e16a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x84e171
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84e160
mov eax, 1
add ebx, ebx
jne 0x84e183
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x84e194
jne 0x84e1b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84e1b3
dec eax
add ebx, ebx
jne 0x84e1a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x84e178
add ebx, ebx
jne 0x84e1af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x84e205
xor ecx, ecx
sub eax, 3
jb 0x84e1cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x84e23a
sar eax, 1
mov ebp, eax
jmp 0x84e1d6
add ebx, ebx
jne 0x84e1d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84e1a4
inc ecx
add ebx, ebx
jne 0x84e1e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x84e1a4
add ebx, ebx
jne 0x84e1f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x84e1e6
jne 0x84e202
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x84e1e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x84e224
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x84e216
jmp 0x84e166
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x84e224
add edi, ecx
jmp 0x84e166
pop esi
mov edi, esi
mov ecx, 0x8c57
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x84e242
cmp byte [edi], 0x29
jne 0x84e242
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x84e247
lea edi, [esi + 0x44a000]
mov eax, dword [edi]
or eax, eax
je 0x84e2bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4600a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4601e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x84e274
mov ecx, edi
jns 0x84e2a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4601e8]
or eax, eax
je 0x84e2b9
mov dword [ebx], eax
add ebx, 4
jmp 0x84e291
call dword [esi + 0x4601f8]
mov ebp, dword [esi + 0x4601ec]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x84e2f3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x1008a473
Capabilities:
Get number of processors

Disassembly:
jmp 0x1007e794
call fcn.1007e77f
salc
arpl word [ebp - 0x79], cx
loop 0x1007e78a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100a43b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x1009d1dd
jmp 0x10089476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x10098856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x100a0e32
jmp 0x1009886d
call fcn.10098858
adc byte [eax - 0x77], dl
loopne 0x1009887c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x1007e77d
jmp 0x1009d1f4
call fcn.1009d1df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x1007ebce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x1007f698
jmp 0x10080265

Function at 0x100a96f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x10098a70

Function at 0x102f347c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x102f34da
jmp 0x102f3499
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x102f3499
jmp 0x102f34da
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x40c470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40c492
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c499
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c488
mov eax, 1
add ebx, ebx
jne 0x40c4ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c4a0
jne 0x40c4bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4a0
xor ecx, ecx
sub eax, 3
jb 0x40c4d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c542
mov ebp, eax
add ebx, ebx
jne 0x40c4db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c4e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c50c
inc ecx
add ebx, ebx
jne 0x40c4f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c4ed
jne 0x40c509
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c4ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c52c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c51d
jmp 0x40c48e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c52c
add edi, ecx
jmp 0x40c48e
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c54a
cmp byte [edi], 1
jne 0x40c54a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40c54f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c5c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd70c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd748]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c57c
mov ecx, edi
jns 0x40c5ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd74c]
or eax, eax
je 0x40c5c1
mov dword [ebx], eax
add ebx, 4
jmp 0x40c599
call dword [esi + 0xd750]
popal
jmp 0x401128

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x9ba370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x9ba38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x9e3074
push ecx
mov edi, eax
call fcn.009ce198
mov esi, eax
add esp, 8
test esi, esi
jne 0x9ba3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.009ce02e
push esi
call fcn.009cdfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x9bd850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x9bd8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x9e8720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9bd8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.009ce1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x9bd8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x9e8720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x9bd92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.009cf082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x9bd957
mov word [eax], si
add eax, 2
push eax
call fcn.009cf030
add esp, 4
jmp 0x9bd959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x9bd8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x9bd8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x9bdff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret