joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d1af4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.005d2838
test byte [ebp + 0xd], 0xc0
jne 0x5d1b18
mov eax, dword [0x61cab0]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x5d1b25
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x5d1b52
je 0x5d1b64
sub ecx, 0x100
je 0x5d1b76
sub ecx, 0x100
je 0x5d1b7f
sub ecx, 0x100
je 0x5d1b6d
jmp 0x5d1b88
sub ecx, 0x600
je 0x5d1b7f
sub ecx, 0x100
je 0x5d1b64
jmp 0x5d1b88
mov dword [ebp - 8], 1
jmp 0x5d1b8f
mov dword [ebp - 8], 2
jmp 0x5d1b8f
mov dword [ebp - 8], 4
jmp 0x5d1b8f
mov dword [ebp - 8], 5
jmp 0x5d1b8f
mov dword [ebp - 8], 3
test byte [ebp + 0xd], 1
je 0x5d1bb6
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x61c528]
test al, 0x80
je 0x5d1baf
mov ebx, 0x80
jmp 0x5d1bc8
mov ebx, 1
jmp 0x5d1bc8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x5d1bc8
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x5d1bda
je 0x5d1be3
dec eax
je 0x5d1bec
jmp 0x5d1bf5
mov dword [ebp - 4], SysStringLen
jmp 0x5d1c04
mov dword [ebp - 4], 0x40000000
jmp 0x5d1c04
mov dword [ebp - 4], 0xc0000000
jmp 0x5d1c04
push 1
call fcn.005d2c50
pop ecx
mov ebx, eax
jmp 0x5d1d04
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x5d1c20
sub eax, 0x10
je 0x5d1c24
sub eax, 0x10
je 0x5d1c2b
sub eax, 0x10
je 0x5d1c32
jmp 0x5d1c32
xor edi, edi
jmp 0x5d1c37
mov edi, 1
jmp 0x5d1c37
mov edi, 2
jmp 0x5d1c37
mov edi, 3
test byte [ebp + 0xc], 4
je 0x5d1c4f
cmp dword [ebp - 4], 0x80000000
jne 0x5d1c4d
mov edi, 1
jmp 0x5d1c4f
xor edi, edi
mov dword [ebp - 0x14], 0xc
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
and edx, 0x80
cmp edx, 1
sbb ecx, ecx
neg ecx
mov dword [ebp - 0xc], ecx
push 0
push ebx
mov ecx, dword [ebp - 8]
push ecx
lea eax, [ebp - 0x14]
push eax
push edi
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x5d1cbd
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x5d1cb2
test byte [ebp + 0xd], 1
je 0x5d1cad
mov ebx, 0x50
jmp 0x5d1cb2
mov ebx, 2
push ebx
call fcn.005d2c50
pop ecx
mov ebx, eax
jmp 0x5d1d04
mov edi, esi
push edi
call fcn.005d1a58
pop ecx
test eax, eax
je 0x5d1cd1
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x5d1cdd
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.005d2978
add esp, 8
mov ebx, eax
inc eax
jne 0x5d1d04
push 4
call fcn.005d2c50
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.005d286c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d6198
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.005d05ec
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
call fcn.005d06ec
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.005d06ec
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x61d6dd
lea ecx, [ebp - 0x200]
push ecx
call fcn.005d05ec
add esp, 8
push 0xa
lea ecx, [ebp - 0x200]
push ecx
call fcn.005d06ec
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov eax, dword [ebx]
push eax
call fcn.005d75b0
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x5d62a9
push esi
call fcn.005d06ec
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.005d06ec
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.005cf744
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x5d6280
xor eax, eax
jmp 0x5d6330
push esi
call fcn.005d06ec
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.005d06ec
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.005d051b
add esp, 0xc
jmp 0x5d62e9
mov edi, dword [ebx + 0x24]
push edi
call fcn.005d06ec
pop ecx
push eax
push esi
call fcn.005d06ec
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.005d06ec
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.005cf764
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x5d62e9
xor eax, eax
jmp 0x5d6330
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.005d05ec
add esp, 8
push 0x61d6df
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.005d05ec
add esp, 8
lea ecx, [ebp - 0x200]
push ecx
mov eax, dword [ebx + 0x24]
push eax
call fcn.005d05ec
add esp, 8
push 0x61d6e1
mov edx, dword [ebx + 0x24]
push edx
call fcn.005d05ec
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5d9a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
jne 0x5d9a4d
jmp 0x5d9a84
call fcn.005d99d0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.005d06ec
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.005d06ec
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5d9b08
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x61dd18], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x5d9be2
cmp dword [0x61dd14], 0
jne 0x5d9be2
cmp dword [0x61df3c], 0
je 0x5d9b9c
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.005d94d8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5d9b82
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.005d94d8
add esp, 8
mov ebx, eax
test eax, eax
jne 0x5d9b82
lea ebx, [ebp - 0x84]
jmp 0x5d9b83
inc ebx
call fcn.005d9ac0
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x5d9c1d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x61dd1c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.005d06ec
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x61dd1f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x5d9c1d
cmp dword [0x61dd14], 0
je 0x5d9bfc
cmp dword [0x61dd14], 0xffffffff
je 0x5d9c1d
push esi
call dword [0x61dd14]
pop ecx
mov eax, dword [0x61dd18]
test eax, eax
je 0x5d9c1d
cmp dword [0x61dd18], 0xffffffff
je 0x5d9c1d
cmp byte [eax], 0
je 0x5d9c1d
push esi
push eax
call fcn.005d9a20
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5da534
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x6a7ff4], 0
jne 0x5da5c0
cmp dword [0x6a8028], 0
jne 0x5da564
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov dword [0x6a8028], eax
test eax, eax
jne 0x5da564
push str.GetEnvironmentStrings_failed
call fcn.005d9c34
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x6a8028]
jmp 0x5da57d
lea eax, [edi + 1]
add edi, edi
add edi, 2
add ebp, eax
inc esi
add ebx, edi
push ebx
call fcn.005d09ac
pop ecx
mov edi, eax
test eax, eax
jne 0x5da570
lea edi, [ebp + 1]
mov eax, edi
add eax, eax
push eax
call fcn.005cf744
pop ecx
mov ebx, eax
mov dword [0x6a7ff8], ebx
test ebx, ebx
jne 0x5da5ab
xor eax, eax
jmp 0x5da687
add edi, edi
mov edx, dword [0x6a8028]
push edi
push edx
push ebx
call fcn.005d0350
add esp, 0xc
jmp 0x5da5e0
xor esi, esi
mov ebx, dword [0x6a7ff4]
jmp 0x5da5da
push eax
call fcn.005d09ac
pop ecx
test eax, eax
jne 0x5da5d6
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x5da5ca
lea ebx, [esi + 4]
push 4
mov dword [0x6a7ffc], ebx
inc ebx
push ebx
call fcn.005cf6a8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x5da603
xor eax, eax
jmp 0x5da687
cmp dword [0x6a7ff4], 0
jne 0x5da638
xor esi, esi
mov ebx, dword [0x6a7ff8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x5da629
mov dword [ebp], ebx
add edi, edi
add ebp, 4
add edi, 2
inc esi
add ebx, edi
push ebx
call fcn.005d09ac
pop ecx
mov edi, eax
test eax, eax
jne 0x5da61b
jmp 0x5da669
xor esi, esi
mov ebx, dword [0x6a7ff4]
mov eax, dword [esp]
mov edi, eax
jmp 0x5da663
push eax
call fcn.005d09ac
pop ecx
test eax, eax
je 0x5da658
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x5da65c
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x5da647
mov eax, dword [0x6a7ff4]
test eax, eax
je 0x5da679
push eax
call fcn.005cf754
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x6a7ff4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5dd714
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, eax
mov eax, esi
call fcn.00485b20
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x469305
call sub.KERNEL32.DLL_GetLastError
mov edi, eax
push ebp
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4692ff
test ah, 4
je 0x4692ff
test al, 0x10
je 0x4692ff
mov eax, esi
call fcn.00485b20
push eax
call sub.KERNEL32.DLL_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x469305
push edi
call sub.KERNEL32.DLL_SetLastError
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
jmp 0x4692b0
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41f60a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x41f619
pop dword [ebp - 0x2c]
mov eax, 0x8d15f7d6
add eax, 0x732bfe43
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x5e85322a
sub dword [ebp - 0x3c], 0x1032ecdf
mov dword [ebp - 0x38], 0xe45959fc
sub dword [ebp - 0x38], 0xb2260db7
mov dword [ebp - 0x34], 0xe9825ea6
add dword [ebp - 0x34], 0x62c9e588
mov dword [ebp - 0x30], 0xe6c91d73
sub dword [ebp - 0x30], 0xe6c91d73
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xa1041eed
add eax, 0x5f3e1187
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x62b027cb
add dword [ebp - 0x3c], 0x11c2418b
mov dword [ebp - 0x38], 0xe0e0f473
sub dword [ebp - 0x38], 0x9f7492fe
mov dword [ebp - 0x34], 0x1b25ccd1
sub dword [ebp - 0x34], 0xb7b66065
mov dword [ebp - 0x30], 0x7d286e88
add dword [ebp - 0x30], 0x82d79178
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xc570da7c
sub eax, 0xc52ea958
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e43b
push 0
call eax
mov ecx, 0x4a52
xor edx, edx
add edx, eax
mov ebx, 0xf479ce9c
sub ebx, 0xf4368a9c
add ebx, dword [ebp - 0x2c]
mov esi, 0xa55ec900
add esi, 0x35ef8706
add dword [ebp - 0xc], ebx
mov edi, dword [ebx]
sub dword [ebp - 0x10], eax
xor edi, esi
add dword [ebp - 0x20], esi
mov dword [edx], edi
sub dword [ebp - 4], eax
add edx, 0xd4c79674
add edx, 0x2b386990
add ebx, 4
loop 0x41f737
add eax, 0xc8536dd1
add eax, 0x37adae4a
mov ebx, eax
add eax, 0x64ae734a
add eax, 0x9b518cbb
mov ecx, 0x277c62a5
sub ecx, 0x273c62a5
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x4014d1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0x134]
sub esp, 0x154
mov dword [ebp - 0x134], 0
mov dword [esp], eax
lea ebx, [ebp - 0x10c]
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 6
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [ebp - 4]
leave
sub eax, 3
ret

Function at 0x40159e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.004014d1
test eax, eax
jne 0x401638
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4020ce
sub eax, 0x40166c
mov dword [esp], 0x40166c
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401638
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.004013d1
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.0040144c
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], str.g_n_p
call fcn.00401dd1
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x5c30826
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1e7f5e40
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x4011e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0xde
not eax
or edx, 0x8d
dec eax
dec edx
inc edi
and edx, 0x1f
dec esi
dec eax
ror eax, 2
inc eax
mov edx, 0x39
ror eax, 0xc6
sbb ebx, 0xea
or ebx, 0xf2
and edi, 0x85
bswap edx
inc edi
and edx, 0x50
imul eax
dec esi
add esi, 0xb9
rol ebx, 0x90
rcr eax, 0xff
add eax, 0x15
imul edx
ror esi, 0x5d
sub ebx, 0xde
bswap esi
not edi
neg ebx
not ebx
inc ebx
or eax, 0xd8
not edi
or esi, 0x35
sub eax, 0x2e
rol eax, 0x5a
inc edi
imul edi
not esi
neg edi
dec eax
rcl eax, 0x60
rcl edi, 0xa9
imul ebx
imul esi
imul edi
not eax
bswap ebx
xor ecx, ecx
xor edi, edi
dec edi
bswap ebx
and ebx, 0x4b
dec eax
and esi, 0x71
dec eax
dec eax
neg edi
ror esi, 0x80
inc ebx
not ebx
or esi, 0x2f
bswap eax
ror ebx, 0x61
rol esi, 0xae
rcr ebx, 0x1d
dec esi
rcr esi, 0xd4
ror edi, 0x8d
mov edx, 0xb1
or edi, 0x49
rcr edi, 0xfa
imul ebx
mov ebx, 0x2a
or edi, 0x2c
imul ebx
imul edx
inc ebx
sub eax, 0xce
rcr eax, 5
not edx
imul edx
imul edx
inc eax
mov edi, 0xfe
ror eax, 3
neg ebx
imul eax
sub ebx, 0xb0
rol esi, 0x3e
dec esi
rol eax, 0x70
inc ebx
ror ebx, 0x6f
neg edi
not esi
sub edi, 0x76
bswap edx
not edi
dec edx
mov ecx, dword [ebp + 0xc]
inc esi
and eax, 0x26
rcr esi, 0x69
or eax, 0x91
rol edx, 0x34
neg ebx
inc eax
rol edx, 0x76
bswap esi
bswap eax
not ebx
rol ebx, 0x59
bswap edi
neg eax
rcr ebx, 0xb7
dec eax
or esi, 0xc9
sub eax, 0x5a
add esi, 0x7b
imul ebx
and edi, 0xe4
add edi, 0xb6
imul edi
imul eax
neg edi
rcl eax, 0xe3
dec eax
add edi, 0xd
and edx, 0x2a
rcr edi, 0x5d
inc edx
neg edi
neg eax
inc edx
sub edx, 0x5c
bswap ebx
dec ebx
sbb esi, 0xa5
not esi
bswap edx
not edx
inc edi
dec eax
rcl eax, 0xad
sbb edi, 0xb5
or edx, 0x1b
neg edi
or edi, 0x8d
not eax
neg ebx
mov edi, dword [ebp + 8]
mov ebx, eax
xor esi, esi
mov eax, esi
not byte [edi]
mov esi, ebx
xor eax, esi
mov ebx, ebx
sub byte [edi], 0x88
xor esi, ebx
mov esi, esi
mov eax, ebx
add byte [edi], 0x49
xor eax, esi
xor ebx, eax
xor ebx, ebx
imul byte [edi]
inc edi
loop 0x40137d
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407554
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4108f0]
jne 0x40755e
repz ret
jmp fcn.0040b4bc
Function at 0x407ec3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004057ea
and dword [ebp - 4], 0
cmp dword [0x4115d4], 0
mov ebx, eax
jne 0x407f74
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408025
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408025
push eax
call fcn.00405778
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4115d4], eax
call esi
push eax
call fcn.00405778
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4115d8], eax
call esi
push eax
call fcn.00405778
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4115dc], eax
call esi
push eax
call fcn.00405778
pop ecx
mov dword [0x4115e4], eax
test eax, eax
je 0x407f74
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405778
pop ecx
mov dword [0x4115e0], eax
mov eax, dword [0x4115e0]
cmp eax, ebx
je 0x407fcc
cmp dword [0x4115e4], ebx
je 0x407fcc
push eax
call fcn.004057f3
push dword [0x4115e4]
mov esi, eax
call fcn.004057f3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407fcc
test edi, edi
je 0x407fcc
call esi
test eax, eax
je 0x407fc3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407fc3
test byte [ebp - 0xc], 1
jne 0x407fcc
or dword [ebp + 0x10], 0x200000
jmp 0x408005
mov eax, dword [0x4115d8]
cmp eax, ebx
je 0x408005
push eax
call fcn.004057f3
pop ecx
test eax, eax
je 0x408005
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408005
mov eax, dword [0x4115dc]
cmp eax, ebx
je 0x408005
push eax
call fcn.004057f3
pop ecx
test eax, eax
je 0x408005
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4115d4]
call fcn.004057f3
pop ecx
test eax, eax
je 0x408025
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408027
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret