joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71ed4a4c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x71ed4bf7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x71ed4bd8
mov dl, 1
mov eax, dword [0x71e92598]
call fcn.71e83984
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.71e847c8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x71ed4bc7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.71ec79c8
test al, al
je 0x71ed4bba
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x71ed4c08
lea eax, [ebp - 0x254]
call fcn.71e8953c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x71ed4bba
xor eax, eax
push ebp
push 0x71ed4bb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x71ed4c40
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x71ed4b9c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.71e84a38
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x71ed4b9c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.71e84a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71ed4bba
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x71ed4abd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.71e964b0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x71ed4bfe
lea eax, [ebp - 0x260]
call fcn.71e847c8
ret

Function at 0x71ed5570
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x71ee3580]
cmp byte [eax + 0xad], 0
jne 0x71ed55e1
cmp dword [0x71ee3598], 0
jne 0x71ed55a2
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x71ed552c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x71ee3598], eax
cmp dword [0x71ee3594], 0
jne 0x71ed55bd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x71ee3594], eax
cmp dword [0x71ee359c], 0
jne 0x71ed55e1
push esp
push 0
push 0
push 0x71ed54d0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x71ee359c], eax
pop edx
ret
Function at 0x71ed57b4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x71ed57cb
add esp, 0xfffffff0
call fcn.71e83cc0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.71e9a620
mov eax, dword [0x71edfc44]
cmp word [eax + 2], 0
jne 0x71ed57f3
mov eax, dword [0x71edfc44]
mov dword [eax + 4], ebx
mov dword [eax], fcn.71ed72f4
mov eax, dword [0x71edfd08]
cmp word [eax + 2], 0
jne 0x71ed580d
mov eax, dword [0x71edfd08]
mov dword [eax + 4], ebx
mov dword [eax], fcn.71ed7500
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x71e92174]
call fcn.71e83984
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x71e92174]
call fcn.71e83984
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x71e92174]
call fcn.71e83984
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x71e9e930]
call fcn.71ea4778
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x71ed59c4
mov eax, dword [0x71edfb4c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.71ea4b4c
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x71ed7bc0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x71edfb4c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.71e8cce4
test eax, eax
je 0x71ed5914
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.71e88ef4
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.71e8cd18
test eax, eax
je 0x71ed5928
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.71e84a38
mov byte [ebx + 0xd4], 0
push ebx
push 0x71ed6e54
call fcn.71e9b79c
mov dword [ebx + 0xc8], eax
mov eax, dword [0x71edf9d4]
cmp byte [eax], 0
jne 0x71ed5979
mov eax, ebx
call fcn.71ed5b08
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.71ed7d9c
mov eax, ebx
call fcn.71ed88fc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x71ed59b9
call fcn.71e83d18
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x71ed5d88
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x71ee3580]
cmp dword [eax + 0x30], 0
je 0x71ed5e32
cmp dword [ebx + 0x94], 0
jne 0x71ed5e2c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x71ed5d18
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x71ed5e2c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x71ed5df2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x71ed5e2c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.71e94520
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x71ed5e01
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x71ed6b4c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x71ed6b81
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.71e848b8
jmp 0x71ed6b8e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.71e8481c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x71ed7f80
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x71ed7fee
mov eax, esi
call fcn.71ec2688
test al, al
je 0x71ed7fee
mov eax, dword [ebx + 0x84]
call fcn.71ec22e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x71ed7fee
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x71ed7fe2
push 0
mov eax, dword [ebx + 0x84]
call fcn.71ec22e8
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.71eba708
jmp 0x71ed7fee
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.71ed7dbc
pop esi
pop ebx
ret
Function at 0x402a50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul ebx
dec esi
ror edx, 0xce
or esi, 0x74
rcr esi, 0xa8
ror eax, 0xe2
not ebx
inc edi
imul edx
bswap eax
rcr ebx, 0xe1
sub ebx, 0xce
rcr esi, 0x8d
not esi
neg edi
sub ebx, 0xfe
imul eax
and ebx, 0xf
bswap edi
imul edi
mov eax, 0xdf
ror esi, 0x5f
not edx
imul esi
neg ebx
imul eax
imul edi
rcr eax, 0xec
rol ebx, 0xea
ror edi, 0xe5
neg edi
rol edx, 0x96
sub edi, 0x99
add esi, 0xcd
not ebx
dec esi
imul esi
neg eax
bswap esi
imul esi
rol edi, 0x7e
add edi, 0x4d
neg esi
imul edx
sbb edi, 0x1c
dec esi
sbb edi, 0xea
sub ebx, 0x5b
not eax
inc eax
xor ecx, ecx
xor edi, edi
imul edi
bswap eax
mov edx, 0xf7
mov ebx, 0xcb
inc eax
dec edi
bswap ebx
neg esi
add edi, 0xbb
dec edx
rol esi, 0xbc
neg ebx
imul esi
rcl edi, 0xe5
imul edx
sbb eax, 0x6d
sbb edx, 0x61
sbb esi, 0xf
dec edx
rcl edi, 0xe0
rcr edi, 0x78
bswap eax
neg edx
inc ebx
not edi
sbb edi, 0xd2
sub edi, 0x2d
inc edx
rcr eax, 0x52
not edx
imul edx
dec esi
dec edi
rcr ebx, 9
imul ebx
neg edi
dec esi
rol edi, 0x99
bswap edi
neg ebx
neg edx
imul eax
mov eax, 0xd4
sub esi, 0xc1
or edx, 0x24
neg esi
rcl ebx, 0xc5
ror eax, 0xfd
rol edi, 0x7d
or edx, 0x2f
mov ecx, dword [ebp + 0xc]
add eax, 0xe5
sbb eax, 0x25
inc edx
rcr edi, 0xfa
or eax, 0x54
add edi, 0x49
mov edi, 0x30
mov edi, 0xc2
dec eax
or esi, 0x66
imul esi
and edx, 0x13
bswap edx
ror edx, 0x79
neg esi
imul ebx
bswap edi
not ebx
rol esi, 0xd4
rol edx, 0x64
imul esi
sub eax, 0xb2
rol eax, 0xa
bswap eax
inc eax
imul edx
ror ebx, 0x8b
imul edx
mov esi, 0x80
imul eax
ror edi, 0x77
and edx, 0xfb
add ebx, 0xb5
imul ebx
or eax, 0x60
sub edi, 0xd7
inc ebx
not esi
bswap edx
bswap esi
bswap ebx
and eax, 0xd0
sub edx, 0xed
and esi, 0x64
dec eax
bswap esi
inc eax
mov esi, 0xc8
or eax, 0x70
sbb edx, 0x3c
mov edi, dword [ebp + 8]
xor eax, eax
xor eax, ebx
mov ebx, eax
not byte [edi]
mov ebx, eax
xor esi, esi
xor eax, eax
xor esi, eax
xor ebx, ebx
xor esi, eax
mov esi, esi
xor eax, esi
xor esi, esi
add byte [edi], 0x34
mov ebx, esi
mov esi, ebx
mov eax, eax
xor ebx, esi
mov esi, esi
mov ebx, esi
xor eax, eax
xor eax, ebx
xor esi, ebx
sub byte [edi], 0x75
xor ebx, esi
mov esi, esi
xor eax, ebx
mov ebx, esi
mov ebx, esi
xor eax, esi
mov eax, eax
mov eax, eax
mov eax, esi
imul byte [edi]
inc edi
loop 0x402bff
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4044cf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40450e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40450e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40450e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40450e
cmp dword [ecx + 0x74], 0xe
jbe 0x40450e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40a016
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a0b3
push ebx
push esi
call fcn.00409fdf
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00409f28
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a060
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a0b2
push edi
push eax
call fcn.0040ac16
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a080
call fcn.00408b51
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a0b1
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00409f28
add esp, 0x20
test eax, eax
jne 0x40a09f
push edi
call fcn.00408b51
jmp 0x40a0a7
push ebx
call fcn.00408b51
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b399
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4131e0
push 0x4131d8
push str.FlsAlloc
push 0x1e
call fcn.0040b25a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b3cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x411130]
call esi
jmp 0x40b3d3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b417
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4131f0
push 0x4131e8
push str.FlsGetValue
push 0x20
call fcn.0040b25a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b44e
push dword [ebp + 8]
mov ecx, esi
call dword [0x411130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4108d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4108fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4108fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x4ec237f2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
mov ecx, 0x4aab4b68
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x405380
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x314
mov eax, dword [0x424044]
xor eax, esp
mov dword [esp + 0x310], eax
lea eax, [esp + 4]
push eax
push 0x104
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str._uninsep.bat
lea ecx, [esp + 8]
push 0x104
push ecx
call fcn.0040d4d2
add esp, 0xc
push 0x104
lea edx, [esp + 0x10c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x210]
push 0x104
push ecx
call fcn.0040bddb
lea edx, [esp + 0x218]
push 0x5c
push edx
call fcn.0040d110
add esp, 0x14
test eax, eax
je 0x40540b
mov byte [eax], 0
push ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405507
mov eax, 0x4bbb38
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405440
sub eax, edx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405457
sub eax, edx
mov ecx, eax
lea eax, [esp + 0x10]
lea esi, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x405470
sub eax, esi
lea edx, [eax + ecx*2]
add edx, ecx
lea edi, [edx + edi + 0x32]
push edi
call fcn.0040bead
push edi
mov esi, eax
push 0
push esi
call fcn.00412cf0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
lea edx, [esp + 0x12c]
push edx
mov eax, edx
push eax
push 0x4bbb38
push edi
push esi
call fcn.0040bdbd
mov eax, esi
add esp, 0x2c
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4054c0
push 0
sub eax, ecx
lea ecx, [esp + 0x10]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test esi, esi
je 0x405505
push esi
call fcn.0040c278
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x314]
pop ebx
xor ecx, esp
call fcn.0040bc96
add esp, 0x314
ret
Function at 0x408890
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
jmp 0x4088aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4088b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4088a0
mov eax, 1
add ebx, ebx
jne 0x4088c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4088b8
jne 0x4088d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4088b8
xor ecx, ecx
sub eax, 3
jb 0x4088e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40895a
mov ebp, eax
add ebx, ebx
jne 0x4088f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408900
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x408924
inc ecx
add ebx, ebx
jne 0x408910
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x408905
jne 0x408921
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408905
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x408944
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x408935
jmp 0x4088a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x408944
add edi, ecx
jmp 0x4088a6
pop esi
mov edi, esi
mov ecx, 0x1f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x408962
cmp byte [edi], 0
jne 0x408962
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x408967
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x4089df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa804]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa898]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x408994
mov ecx, edi
jns 0x4089c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa8a0]
or eax, eax
je 0x4089d9
mov dword [ebx], eax
add ebx, 4
jmp 0x4089b1
call dword [esi + 0xa89c]
mov ebp, dword [esi + 0xa8a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x408a13
sub esp, 0xffffff80
jmp 0x401610

Function at 0x408957
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov esi, 0x4085d8
and ebx, ebx
add edi, 1
call fcn.00408987
inc edi
mov ebx, 0x7f0f579c
xor dword [ecx], esi
mov ebx, ebx
sub ebx, 0x7d042efc
inc ecx
cmp ecx, eax
jne fcn.00408957
or ebx, edi
add edi, 0xbe5fcdd4
ret