joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd816
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x4dd816
lcall 0x5de5, 0x8b10c483
jmp loc.00a9cecc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x17f35df9
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x47f55360
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x402aa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4470ec], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
jne 0x402b5a
xor ebx, ebx
nop dword [eax]
mov edx, ebx
mov eax, ebx
shr eax, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [ebx*4 + 0x4470e8], eax
inc ebx
cmp ebx, 0x100
jb 0x402ac0
mov ebx, dword [ebp + 8]
not ebx
mov eax, ebx
test edi, edi
jle 0x402b86
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4470e8]
sub edi, 1
jne 0x402b65
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x402bb8
nop dword [eax]
cmp cl, 0x23
jne 0x402b9f
cmp byte [esi], cl
jne 0x402b9f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4470e8]
test cl, cl
jne 0x402b90
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x402d00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x402d12
mov dword [edi], 0
mov edx, 0x4354c4
call fcn.00402bc0
mov esi, eax
test esi, esi
jne 0x402d26
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x402dde
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x402dde
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x402dde
mov eax, dword [0x4474f0]
test eax, eax
je 0x402d76
inc dword [eax + 0x394]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402dde
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x402dc5
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x4474f0]
add esp, 4
test eax, eax
je 0x402db4
dec dword [eax + 0x394]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x402dd7
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x4123c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x4474f0]
mov eax, ecx
mov dword [ebp - 8], eax
mov dword [edi + 0x2c2c], 0
test eax, eax
je 0x4124b3
push esi
lea esi, [edi + 0x2c30]
mov dword [edi + 0x2c2c], 0
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x412414
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00413170
mov dword [esi], 0
cmp dword [esi + 4], 0
jne 0x412429
push 8
mov ecx, esi
call fcn.00413170
mov eax, dword [esi]
mov ecx, dword [esi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [esi]
cmp dword [edi + 0x2c3c], 0
jle 0x41246c
xor ebx, ebx
mov eax, dword [edi + 0x2c44]
add eax, ebx
push esi
push eax
push edi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [edi + 0x2c3c]
jl 0x412447
cmp dword [esi + 8], 0
je 0x412477
mov esi, dword [esi]
dec esi
jmp 0x412479
xor esi, esi
mov eax, dword [edi + 0x2c38]
mov ebx, 0x4474ec
mov ecx, dword [ebp - 8]
test eax, eax
mov edx, 0x4354c8
cmovne ebx, eax
call fcn.00402bc0
mov edi, eax
test edi, edi
je 0x4124b1
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41f530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4345d6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x30], 0
mov byte [ebp - 4], 2
mov eax, 0x3f
mov dword [esi + 4], 0x3f800000
mov word [esi + 0x3c], ax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0041f680
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42e990
Capabilities:
Acquire debug privileges
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x43c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x358]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x42ea2d
lea eax, [ebp - 0x218]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x42ea25
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
push 0
push 0
push 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x228]
push eax
push 0
push dword [ebp - 0x358]
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x358]
call esi
xor ebx, ebx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x350], 0x128
lea eax, [ebp - 0x350]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x42eab2
nop word [eax + eax]
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x32c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x210]
push str.lsass.exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x42eaac
lea eax, [ebp - 0x350]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x42ea60
jmp 0x42eab2
mov ebx, dword [ebp - 0x348]
push edi
call esi
test ebx, ebx
je 0x42eb1f
push ebx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x42eb1f
lea eax, [ebp - 0x354]
mov dword [ebp - 0x354], 0
push eax
push 2
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42eb1c
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x35c], 0
push eax
push 1
push 2
push 0
push 0xf
push dword [ebp - 0x354]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [ebp - 0x354]
test eax, eax
jne 0x42eb32
call esi
push edi
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00432b74
mov esp, ebp
pop ebp
ret
call esi
push edi
call esi
push dword [ebp - 0x35c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00432b74
mov esp, ebp
pop ebp
ret
Function at 0x432630
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4346cd
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x43c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
call fcn.00433141
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov dword [ecx], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push ecx
push 0x432b20
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x4326b2
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00432b74
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x43378c
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4337cb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4337cb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4337cb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4337cb
cmp dword [ecx + 0x74], 0xe
jbe 0x4337cb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7729179c
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x76c818fb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403c98
Capabilities:
Encode data using xor

Disassembly:
call 0x403b89
mov ecx, 0x1f0
call 0x403c98
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x403c9b
mov eax, 0x50402dc
out dx, al
clc
div esi
cmc
retf 0x3d52
Function at 0x405450
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x40d180]
cmp ax, 0xcb
je 0x40554c
cmp ax, 0xcc
je 0x40554c
mov edx, dword [0x4115e0]
test edx, edx
je 0x405482
mov eax, dword [0x411480]
call edx
mov ebx, eax
jmp 0x405487
mov ebx, 0x411484
cmp word [0x411470], 0
jle 0x4054aa
mov eax, 0x411450
call fcn.004056c0
mov eax, ebx
call fcn.00405030
mov eax, ebx
call fcn.004050a0
mov edi, dword [ebx]
jmp 0x4054ca
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4054c5
mov edx, edi
mov eax, ebx
call fcn.00404500
jmp 0x4054c8
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4054b0
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x411470], 0
jle 0x40554c
mov edx, 0x411390
mov eax, ebx
call fcn.00404630
mov edi, eax
test edi, edi
je 0x40551f
mov eax, dword [0x411424]
mov dword [edi + 0xc], eax
cmp dword [0x411424], 0
je 0x405514
mov eax, dword [0x411424]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x411424], eax
sub word [0x411470], 1
cmp word [0x411470], 0
sete bl
mov eax, 0x411450
call fcn.004056d0
test bl, bl
je 0x40554c
mov eax, 0x411450
call fcn.004056b0
pop edi
pop esi
pop ebx
ret
Function at 0x4073a0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x411290], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.00407580
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x411290]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402260
call sub.kernel32.dll_GetCommandLineA
mov dword [0x40d1f0], eax
mov esi, dword [0x40d1f0]
jmp 0x407540
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x407430
cmp byte [esi], 0
je 0x407549
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x4074a5
mov al, byte [esi]
cmp al, 1
jb 0x40749b
sub al, 0x20
jbe 0x40746c
sub al, 2
je 0x40747f
jmp 0x40749b
mov al, byte [ebp - 0x10c]
test al, al
je 0x4074aa
add dword [ebp - 0x110], 1
jmp 0x4074a2
cmp byte [esi + 1], 0x22
je 0x407496
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x4074a2
add esi, 1
jmp 0x4074a2
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x40745c
test dword [ebp - 0x114], 0xffffffff
je 0x407539
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.00407580
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x411290]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x407531
mov al, byte [esi]
cmp al, 1
jb 0x407527
sub al, 0x20
jbe 0x4074f8
sub al, 2
je 0x40750b
jmp 0x407527
mov al, byte [ebp - 0x10c]
test al, al
je 0x407536
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x40752e
cmp byte [esi + 1], 0x22
je 0x407522
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40752e
add esi, 1
jmp 0x40752e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x4074e8
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x407433
mov ebx, dword [ebp - 0x114]
mov dword [0x411280], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x411290
call fcn.004052b0
mov eax, dword [0x411290]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bcd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0
cmp byte [0x40d5d0], 0
je 0x40bdf1
push 0
push dword [0x4112f0]
push 0
push 0
movsx edx, word [0x411dd0]
add edx, dword [0x40d5e4]
mov eax, dword [0x40d5ec]
lea eax, [edx + eax]
lea ebx, [eax + 1]
push 0x21
call sub.user32.dll_GetSystemMetrics
shl eax, 1
lea ebx, [ebx + eax]
push 4
call sub.user32.dll_GetSystemMetrics
lea eax, [ebx + eax]
push eax
movsx eax, word [0x411dc0]
add eax, dword [0x40d5e0]
add eax, dword [0x40d5e8]
lea ebx, [eax + 1]
push 0x20
call sub.user32.dll_GetSystemMetrics
shl eax, 1
lea eax, [ebx + eax]
push eax
push 0
push 0x80000000
mov eax, dword [0x416d90]
or eax, 0x2cf0000
push eax
push dword [0x40d580]
mov eax, str.FPCGraphWindowMain
push eax
call fcn.00408620
mov dword [0x411c90], eax
test eax, eax
je 0x40be6e
push 5
push dword [0x411c90]
call sub.user32.dll_ShowWindow
push dword [0x411c90]
call sub.user32.dll_UpdateWindow
push 0
push dword [0x4112f0]
push 0
push dword [0x411c90]
movsx eax, word [0x411dd0]
add eax, 1
push eax
movsx eax, word [0x411dc0]
add eax, 1
push eax
push dword [0x40d5e4]
push dword [0x40d5e0]
push 0x40000000
push 0
mov eax, str.FPCGraphWindowChild
push eax
call fcn.00408620
mov ebx, eax
test ebx, ebx
je 0x40be6e
push 5
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_UpdateWindow
mov esi, ebx
jmp 0x40be6e
push 0
push dword [0x4112f0]
push 0
push 0
movsx eax, word [0x411dd0]
lea edi, [eax + 1]
push 0x21
call sub.user32.dll_GetSystemMetrics
shl eax, 1
lea edi, [edi + eax]
push 4
call sub.user32.dll_GetSystemMetrics
lea eax, [edi + eax]
push eax
movsx eax, word [0x411dc0]
lea edi, [eax + 1]
push 0x20
call sub.user32.dll_GetSystemMetrics
shl eax, 1
lea eax, [edi + eax]
push eax
push 0
push 0x80000000
mov eax, dword [0x416d90]
or eax, 0xcf0000
push eax
push dword [0x40d580]
mov eax, str.FPCGraphWindow
push eax
call fcn.00408620
mov ebx, eax
test ebx, ebx
je 0x40be6e
push 5
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_UpdateWindow
mov esi, ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x746a5c9e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
mov eax, section..rdata
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x731a0b7b
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push ebx
mov ebx, dword [esp + 0xc]
push edi
xor edi, edi
test ebx, ebx
je 0x412e87
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_InitializeAcl]
nop dword [eax]
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x91
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xab
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xa2
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x3b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xfe
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x28
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x4d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x6a
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x56
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x9c
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb7
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xbc
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0xa9
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x5b
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x4d
push 0
push 0
push 0
call esi
add byte [edi + ebp], 3
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x25
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x46
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x63
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xe3
push 0
push 0
push 0
call esi
add byte [edi + ebp], 8
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xb0
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xc5
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x36
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0xf5
push 0
push 0
push 0
call esi
xor byte [edi + ebp], 0x13
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x8e
push 0
push 0
push 0
call esi
add byte [edi + ebp], 0x5f
inc edi
cmp edi, ebx
jb 0x412d20
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451c59
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451c6a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405902
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b112
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b123
pop esi
ret
push ebx
push edi
push esi
call fcn.0049aff9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fd5
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b14b
push ebx
push esi
push edi
call fcn.004056f5
add esp, 0xc
push 0
call fcn.0040623f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x40a618
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427450]
jne 0x40a622
repz ret
jmp fcn.0040da16

Function at 0x40c93f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004089b9
and dword [ebp - 0x14], 0
cmp dword [0x429a24], 0
mov dword [ebp - 0x18], eax
jne 0x40c9f2
push 0x403e24
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ca9a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403e18
push ebx
call edi
test eax, eax
je 0x40ca9a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403e08
push ebx
mov dword [0x429a24], eax
call edi
push eax
call esi
push 0x403df4
push ebx
mov dword [0x429a28], eax
call edi
push eax
call esi
push 0x403dd8
push ebx
mov dword [0x429a2c], eax
call edi
push eax
call esi
mov dword [0x429a34], eax
test eax, eax
je 0x40c9f2
push 0x403dc0
push ebx
call edi
push eax
call esi
mov dword [0x429a30], eax
mov eax, dword [0x429a30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40ca4b
cmp dword [0x429a34], ecx
je 0x40ca4b
push eax
call esi
push dword [0x429a34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40ca4b
test ebx, ebx
je 0x40ca4b
call edi
test eax, eax
je 0x40ca42
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40ca42
test byte [ebp - 8], 1
jne 0x40ca4b
or dword [ebp + 0x10], 0x200000
jmp 0x40ca7e
mov eax, dword [0x429a28]
cmp eax, dword [ebp - 0x18]
je 0x40ca7e
push eax
call esi
test eax, eax
je 0x40ca7e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ca7e
mov eax, dword [0x429a2c]
cmp eax, dword [ebp - 0x18]
je 0x40ca7e
push eax
call esi
test eax, eax
je 0x40ca7e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x429a24]
call esi
test eax, eax
je 0x40ca9a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ca9c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a618
leave
ret