joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454721
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x46e900
cmp edx, dword [eax]
je 0x454743
add eax, 8
inc ecx
cmp eax, 0x46e990
jl 0x454734
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x46e900]
jne 0x454871
mov eax, dword [0x485894]
cmp eax, 1
je 0x45484b
test eax, eax
jne 0x454774
cmp dword [0x46e388], 1
je 0x45484b
cmp edx, 0xfc
je 0x454871
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4547ab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00454ea0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00453cf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4547ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.00453cf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4679c8
push edi
call fcn.00451500
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00454ea0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00454eb0
lea eax, [ebp - 0xa0]
push 0x4679a8
push eax
call fcn.00454eb0
push dword [esi + 0x46e904]
lea eax, [ebp - 0xa0]
push eax
call fcn.00454eb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004561bb
add esp, 0x2c
pop edi
jmp 0x454871
lea eax, [ebp + 8]
lea esi, [esi + 0x46e904]
push 0
push eax
push dword [esi]
call fcn.00453cf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x8dcb85
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
jmp 0x8dcb98
movzx ebx, byte [eax]
movzx edx, byte [eax + 1]
movzx edi, byte [eax + 5]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 2]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
xor ebx, edx
movzx edx, byte [eax + 4]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 6]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 7]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 4]
movzx edi, byte [eax + 9]
mov dword [ebp - 4], edx
movzx edx, byte [eax + 8]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xa]
shl edx, 8
xor edx, edi
movzx edi, byte [eax + 0xb]
shl edx, 8
xor edx, edi
xor edx, dword [ecx + 8]
movzx edi, byte [eax + 0xd]
mov dword [ebp - 0x10], edx
movzx edx, byte [eax + 0xc]
shl edx, 8
xor edx, edi

Function at 0x909dfa
Capabilities:
Encrypt data using aes

Disassembly:
pop dword [esp + 0x10]
lea esp, [esp + 0x20]
popal
mov ebp, dword [esp]
mov bp, word [esp]
lea ebp, [eax + edi]
jmp 0x909de3
xor eax, edi
pushal
mov dword [esp], edx
pushal
push esp
jmp 0x909d95
lea esp, [esp + 4]
movzx edi, byte [edi*4 + 0x8e7158]
adc bp, 0x924
neg ebp
mov bp, 0xb605
jmp 0x909dfc
shr edi, 0x18
btr ebp, edx
jmp 0x909dc2
jmp 0x909db8
xor eax, edi
btr edi, esp
mov di, sp
mov edi, edx
jmp 0x909e0c
and edi, esi
mov bp, 0xf8e3
clc
jmp 0x909ec9
lea esp, [esp + 8]
xor eax, dword [ecx]
bswap edi
mov edi, dword [esp]
mov di, 0xb003
jmp 0x909e39
xor eax, edi
mov edi, 0x2d862854
bswap edi
lea edi, [edx*4]
push edx
jmp 0x909e51
and edi, ebp
clc
push edx
add esp, 1
sub esp, 4
lea esp, [esp + 3]
jmp 0x909e78
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
mov ebp, 0xff00
clc
jmp 0x909e8f

Function at 0x90a5b3
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 8]
mov dword [ecx], eax
mov eax, dword [edx + 4]
clc
jmp 0x90a5be
push esi
mov esi, ecx
mov edi, dword [esi]
pop esi
sub esp, 0x1c
jmp 0x90a596
pushal
push dword [esp + 0xe]
mov dword [edx], edi
mov edi, dword [ecx + 4]
jmp 0x90a5e5
mov eax, dword [edx]
mov dword [edx - 4], edi
lea edi, [ecx + edx]
jmp 0x90a5b3
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
lea esp, [esp + 0x4c]
jmp 0x90a629
mov dword [esi], eax
pop esi
neg ax
dec eax
neg ax
bswap eax
jmp 0x90a5db
lea esp, [esp + 4]
add ecx, 0x10
pushal
clc
sub esp, 0x12
jmp 0x90a6f3
sub ebx, 4
push esp
mov byte [esp + 1], bh
push word [esp + 1]
mov dword [esp], ebp
lea esp, [esp + 2]
jmp 0x90a613
sub esp, 0xc
lea esp, [esp + 0x10]
popal
lea esi, [esi - 4]
jmp 0x90a605
mov ax, word [esp]
mov ax, 0x4913
mov eax, dword [ebp - 8]
jmp 0x90a2df
cmp dword [ebp - 4], ebx
push esp
push dword [esp]
lea esp, [esp + 8]
jl 0x90a2c6
jge 0x90a65a
stc
lea esp, [esp + 2]
lea esp, [esp + 0x30]
sub edx, 0x10
jmp 0x90a67e
Function at 0x90a64d
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp + 8]
mov dword [ecx], eax
mov eax, dword [edx + 4]
clc
jmp 0x90a5be
push esi
mov esi, ecx
mov edi, dword [esi]
pop esi
sub esp, 0x1c
jmp 0x90a596
pushal
push dword [esp + 0xe]
mov dword [edx], edi
mov edi, dword [ecx + 4]
jmp 0x90a5e5
mov eax, dword [edx]
mov dword [edx - 4], edi
lea edi, [ecx + edx]
jmp 0x90a5b3
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
lea esp, [esp + 0x4c]
jmp 0x90a629
mov dword [esi], eax
pop esi
neg ax
dec eax
neg ax
bswap eax
jmp 0x90a5db
lea esp, [esp + 4]
add ecx, 0x10
pushal
clc
sub esp, 0x12
jmp 0x90a6f3
sub ebx, 4
push esp
mov byte [esp + 1], bh
push word [esp + 1]
mov dword [esp], ebp
lea esp, [esp + 2]
jmp 0x90a613
sub esp, 0xc
lea esp, [esp + 0x10]
popal
lea esi, [esi - 4]
jmp 0x90a605
mov ax, word [esp]
mov ax, 0x4913
mov eax, dword [ebp - 8]
jmp 0x90a2df
cmp dword [ebp - 4], ebx
push esp
push dword [esp]
lea esp, [esp + 8]
jl 0x90a2c6
jge 0x90a65a
stc
lea esp, [esp + 2]
lea esp, [esp + 0x30]
sub edx, 0x10
jmp 0x90a67e

Function at 0x90a6ae
Capabilities:
Encrypt data using aes

Disassembly:
push dword [esp]
lea esp, [esp + 8]
jle 0x90a48c
neg ch
bswap ebx
jmp 0x90a6d3
jmp 0x90a691
mov ecx, 0xff
jmp 0x90a403
mov bl, 0x30
rol bx, cl
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
jmp 0x90a6b0
Function at 0x90a847
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esi], edi
bswap edi
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
mov di, 0xa621
jmp 0x90a851
clc
add esp, 3
lea esp, [esp + 1]
jmp 0x90a82c
push esp
inc edi
neg edi
jmp 0x90a8c3
popal
shr edi, 0x18
pushal
lea esp, [esp + 3]
push word [esp + 0xd]
jmp 0x90a875
pushal
neg esi
inc ebx
mov dword [esp], edx
stc
jmp 0x90a89e

Function at 0x90a9fa
Capabilities:
Encrypt data using aes

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x90aa3d
mov edx, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
call fcn.0090aa03
and edx, ecx
call fcn.0090ac9c
lea esp, [esp + 0x28]
xor edi, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
push esp
jmp 0x90ac07
mov dword [esp + 0x1c], esi
cmc
clc
call fcn.0090aa85
mov edx, dword [esi + 8]
push eax
pushal
jmp 0x90aa9c

Function at 0x90ab95
Capabilities:
Encrypt data using aes

Disassembly:
lea eax, [eax + 4]
mov dword [eax], edi
pop eax
lea edi, [eax + 0xa9]
neg edi
jmp 0x90ab7f
push dword [esp]
lea esp, [esp + 8]
popal
jmp 0x90aa6f
lea edi, [ebx*4]
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
push esp
mov edi, edx
call fcn.0090aae8
jmp 0x90abf0
movzx ebx, byte [esi + 0xd]
pushal
lea esp, [esp + 0x11]
sub esp, 0xa
lea esp, [esp + 1]
jmp 0x90ac45
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
xchg bl, bh
cmc
jmp 0x90ab97
lea esp, [esp + 0x38]
xor edi, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x90ac6e
and edx, ecx
pushal
lea esp, [esp + 0x1d]
lea esp, [esp + 3]
jmp 0x90ac11
and edx, ecx
pushal
mov edx, dword [edx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x90ac28
push edx
push esi
mov esi, ebx
jmp 0x90ac82
dec edi
mov edi, edx
pushal
call fcn.0090ad66
out 0x77, eax
adc ah, cl
push ecx
lahf
sbb byte [esi - 0xa58e717], cl
in al, 0x8b
push esi
or al, 0x89
jle 0x90ac7c
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
lea edi, reloc.iphlpapi.dll_GetAdaptersInfo
lea edi, [esi + 0xc5]
lds eax, [eax]
add byte [eax], al
jmp 0x90ac51
lea esi, [esi*4]
lea esi, reloc.iphlpapi.dll_GetAdaptersInfo
mov ebx, dword [esi]
pop esi
bsr di, bp
jmp 0x90ac57

Function at 0x90ad07
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 1
lea esp, [esp + 1]
and edi, ecx
sub esp, 0x1e
sub esp, 2
jmp 0x90ace9
cmc
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
push edx
mov dword [esp], esi
push word [esp + 1]
jmp 0x90acb0
mov word [esp + 0xa], dx
mov edi, dword [edi*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x90ad47
jmp 0x90acd6
pushal
and edx, ecx
push edx
pushal
push dword [esp + 0x18]
jmp fcn.0090adae
mov bx, 0x96ef
mov ebx, dword [esp]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
jmp 0x90ad09
and ebx, ecx
lea esp, [esp + 0x50]
xor edi, dword [ebx*4 + reloc.iphlpapi.dll_GetAdaptersInfo]
mov bx, 0x1613
jmp 0x90ad23

Function at 0x90ade8
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 2]
lea esp, [esp + 8]
dec dword [ebp - 4]
call fcn.0090adbd
Function at 0x9b54a6
Capabilities:
Parse pe header

Disassembly:
jmp 0x9b5501
push bp
mov byte [esp + 3], ch
push edi
mov word [esp + 3], sp
lea esp, [esp + 2]
mov dword [esp + 0x34], esp
call fcn.009b54a8
mov byte [esp + 0xf], cl
push dword [esp + 0x19]
call fcn.009b5574
fld qword [ecx - 0x2f]
mov al, 0x43
mov ch, 0x45
aad 0xbc
dec edi
cdq
push esp
inc ebx
push ebx
jp 0x9b5563
sbb cl, byte [ecx + 0x6634246c]
push edx
pushal
pop word [esp + 2]
push dword [esp + 0x10]
pop dword [esp + 5]
jmp 0x9b551a

Function at 0x9b54a8
Capabilities:
Parse pe header

Disassembly:
jmp 0x9b54ea
mov dword [esp], eax
mov dword [esp], ecx
mov byte [esp + 1], bh
call fcn.009b54d3
outsd dx, dword [esi]
mul byte [ebx + eax - 2]
jns 0x9b554c
pop es
add eax, 0x8f66cbeb
inc esp
and al, 8
call fcn.009b55d4

Function at 0x9b54d3
Capabilities:
Parse pe header

Disassembly:
mov byte [esp + 2], bh
pop dword [esp]
mov byte [esp + 1], al
jmp 0x9b5539
mov dword [esp + 0x34], ebp
push dx

Function at 0x9b5559
Capabilities:
Parse pe header

Disassembly:
call fcn.009b403c
lea esp, [esp + 3]
mov byte [esp], cl
lea esp, [esp]
jmp 0x9b55aa
lea esp, [esp]
pushal
lea esp, [esp + 1]
mov dword [esp + 0x6c], edi
lea esp, [esp + 0x6c]
jmp 0x9b5604
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x9b55e1
push eax
jmp 0x9b4037
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x9b55bc

Function at 0x9b5574
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
pop word [esp + 8]
mov byte [esp + 0x23], dl
pop dword [esp + 0xf]
lea esp, [esp + 7]
push dword [esp + 0x19]
jmp 0x9b554f
Function at 0x4065ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406612
xor eax, eax
test eax, eax
je 0x406625
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406625
xor ecx, ecx
jmp 0x406628
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406751
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427d8c], 0
push esi
jne 0x406788
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406762
mov dword [ecx*4 + 0x427d88], eax
inc ecx
cmp ecx, 0x100
jl 0x40675d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067b9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427d88]
xor eax, esi
inc ecx
dec edx
jne 0x40679b
pop edi
not eax
pop esi
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push 0x5040d1
push 0x504088
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.USER32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.USER32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x4023a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sbb edx, 0x51
add edi, 0x19
ror edi, 0xc7
inc eax
or edi, 0xfd
bswap ebx
imul eax
and ebx, 0xb6
sub eax, 8
neg edi
sbb ebx, 0xb9
neg esi
neg edx
neg esi
sbb ebx, 0x88
or esi, 0x6c
imul eax
sub edx, 0x88
inc esi
neg edi
rcr ebx, 0x9f
dec esi
rcr eax, 0x28
inc eax
not esi
mov ebx, 0xe2
imul edi
imul edx
rol edi, 0x12
sub edi, 0xa9
add eax, 0xb1
rcl edx, 0x29
dec edx
imul esi
and edx, 6
not esi
not edi
inc ebx
rol edx, 0xa7
rcl edx, 0xc0
imul ebx
not ebx
and eax, 0x79
not eax
dec edi
ror eax, 0x8d
inc ebx
imul edx
neg eax
inc edi
xor ecx, ecx
xor edi, edi
neg edi
and edx, 0xf2
rcl esi, 0x30
rcr esi, 0x36
rol eax, 0xd5
add eax, 0x71
dec esi
not eax
rcl ebx, 0x8f
imul eax
and eax, 0x6d
sbb esi, 0x6e
and ebx, 0x85
rcl eax, 0x68
ror esi, 0xaa
sbb esi, 0xf
inc esi
inc ebx
neg esi
imul esi
rcr edi, 0xbb
not edi
imul edx
bswap eax
neg ebx
add esi, 0xce
ror edx, 0x20
sbb edi, 0
imul eax
rcl eax, 0xd1
sub eax, 0x1b
rcl edx, 0xd9
imul eax
bswap eax
add esi, 0x2c
ror edi, 0xaf
mov esi, 0xce
imul esi
not ebx
bswap eax
ror eax, 0x88
rcl esi, 0xa3
sub esi, 0x9d
ror eax, 0xe
not edx
inc esi
neg esi
and eax, 0xbc
imul edx
mov esi, 0x2e
mov ecx, dword [ebp + 0xc]
inc esi
sbb eax, 0xdd
inc edi
rcr eax, 0x70
add edx, 0x29
rcr esi, 0x55
rol ebx, 0xb5
inc edx
inc eax
bswap edi
mov edi, 8
ror esi, 0xe1
imul ebx
dec eax
dec ebx
bswap esi
rcr edi, 0xe6
bswap eax
dec ebx
imul edx
rol ebx, 0x5f
not edi
rcl eax, 0x67
rcl edx, 0x98
or edi, 0xd1
inc edi
neg esi
or ebx, 0xf0
imul ebx
not edi
sbb esi, 0xe0
mov ebx, 0xcd
sbb ebx, 0x5b
or edi, 0xd8
imul eax
bswap edi
neg ebx
and edi, 0xd2
bswap edi
imul edi
rcl edi, 0x74
and edi, 0x98
rcl edx, 0x57
imul edx
add edx, 0xa7
neg edx
rcr esi, 0x4c
imul ebx
inc esi
rcl ebx, 0x6f
mov edi, dword [ebp + 8]
xor eax, ebx
xor esi, eax
xor ebx, esi
not byte [edi]
mov ebx, eax
xor esi, eax
mov eax, esi
xor esi, esi
xor esi, ebx
mov ebx, eax
xor esi, eax
mov esi, ebx
xor ebx, esi
add byte [edi], 0x36
xor esi, ebx
mov ebx, esi
xor ebx, eax
xor eax, eax
mov ebx, esi
mov eax, esi
xor ebx, esi
mov ebx, esi
mov ebx, esi
sub byte [edi], 0x75
xor ebx, esi
mov eax, esi
xor eax, eax
mov ebx, esi
xor esi, eax
xor ebx, esi
mov eax, eax
mov esi, esi
xor esi, esi
imul byte [edi]
inc edi
loop 0x402559
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a85a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47ac90]
jne 0x40a864
repz ret
jmp fcn.00411ded
Function at 0x41676c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004106f6
and dword [ebp - 4], 0
cmp dword [0x47c7d0], 0
mov ebx, eax
jne 0x41681d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4168ce
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4168ce
push eax
call fcn.00410684
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x47c7d0], eax
call esi
push eax
call fcn.00410684
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47c7d4], eax
call esi
push eax
call fcn.00410684
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47c7d8], eax
call esi
push eax
call fcn.00410684
pop ecx
mov dword [0x47c7e0], eax
test eax, eax
je 0x41681d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410684
pop ecx
mov dword [0x47c7dc], eax
mov eax, dword [0x47c7dc]
cmp eax, ebx
je 0x416875
cmp dword [0x47c7e0], ebx
je 0x416875
push eax
call fcn.004106ff
push dword [0x47c7e0]
mov esi, eax
call fcn.004106ff
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416875
test edi, edi
je 0x416875
call esi
test eax, eax
je 0x41686c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41686c
test byte [ebp - 0xc], 1
jne 0x416875
or dword [ebp + 0x10], 0x200000
jmp 0x4168ae
mov eax, dword [0x47c7d4]
cmp eax, ebx
je 0x4168ae
push eax
call fcn.004106ff
pop ecx
test eax, eax
je 0x4168ae
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4168ae
mov eax, dword [0x47c7d8]
cmp eax, ebx
je 0x4168ae
push eax
call fcn.004106ff
pop ecx
test eax, eax
je 0x4168ae
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47c7d0]
call fcn.004106ff
pop ecx
test eax, eax
je 0x4168ce
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4168d0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x405e7c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x4239a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.TGOqOPny
lea edi, [esi - 0x19000]
push edi
or ebp, 0xffffffff
jmp 0x4239c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4239c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4239b8
mov eax, 1
add ebx, ebx
jne 0x4239db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4239d0
jne 0x4239ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4239d0
xor ecx, ecx
sub eax, 3
jb 0x423a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x423a72
mov ebp, eax
add ebx, ebx
jne 0x423a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x423a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x423a3c
inc ecx
add ebx, ebx
jne 0x423a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x423a1d
jne 0x423a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x423a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x423a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x423a4d
jmp 0x4239be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x423a5c
add edi, ecx
jmp 0x4239be
pop esi
mov edi, esi
mov ecx, 0x138
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x423a7a
cmp byte [edi], 6
jne 0x423a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x423a7f
lea edi, [esi + 0x21000]
mov eax, dword [edi]
or eax, eax
je 0x423aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x423aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23030]
or eax, eax
je 0x423ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x423ac9
call dword [esi + 0x2302c]
mov ebp, dword [esi + 0x23034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x423b22
sub esp, 0xffffff80
jmp 0x4038fc
Function at 0x414e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x414e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414e70
mov eax, 1
add ebx, ebx
jne 0x414e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414e88
jne 0x414ea4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414e88
xor ecx, ecx
sub eax, 3
jb 0x414eb8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414f2a
mov ebp, eax
add ebx, ebx
jne 0x414ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414ed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414ef4
inc ecx
add ebx, ebx
jne 0x414ee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414ed5
jne 0x414ef1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ed5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414f14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414f05
jmp 0x414e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414f14
add edi, ecx
jmp 0x414e76
pop esi
mov edi, esi
mov ecx, 0x5a7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414f32
cmp byte [edi], 5
jne 0x414f32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414f37
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414fa6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1551c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414f64
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15520]
or eax, eax
je 0x414fa0
mov dword [ebx], eax
add ebx, 4
jmp 0x414f81
call dword [esi + 0x15530]
mov ebp, dword [esi + 0x15524]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414fda
sub esp, 0xffffff80
jmp 0x40a764

Function at 0x42b1a9
Capabilities:
Terminate process

Disassembly:
jmp 0x42e6b0
jmp fcn.0042f690
cmp ecx, dword [0x49400c]
jne 0x42e6ba
repz ret
jmp 0x42b645
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219