joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42c9c0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
movzx eax, word [ebp]
xor edi, edi
cmp ax, cx
je 0x407eae
inc edi
cmp word [ebp + edi*2], cx
jne 0x407ea6
cmp edi, 1
movzx ebx, ax
jl 0x408019
cmp bx, 0x5c
je 0x408019
cmp bx, 0x2e
jne 0x407ee2
cmp edi, 1
je 0x408019
cmp edi, 2
jne 0x407ee2
cmp word [ebp + 2], bx
je 0x408019
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call fcn.00404e70
cmp edi, 3
mov dword [esp + 0x4c], 0
jle 0x407f29
cmp word [ebp + 2], 0x3a
jne 0x407f29
cmp word [ebp + 4], 0x5c
jne 0x407f29
cmp bx, 0x61
jb 0x407f20
cmp bx, 0x7a
jbe 0x407f91
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x407f91
mov eax, dword [esp + 0x1c]
cmp eax, 0x105
jg 0x407f49
cmp eax, 0x106
je 0x407f49
push 0x106
lea esi, [esp + 0x18]
call fcn.00404e70
mov eax, dword [esp + 0x14]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [esp + 0x14]
mov edi, eax
call fcn.00405f70
test edi, edi
je 0x408031
cmp edi, 0x104
ja 0x408031
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x407f91
push 0x5c
mov eax, esi
call fcn.00404c40
mov ebx, 0x42ff70
lea eax, [esp + 0x38]
call fcn.00404b30
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
mov edi, eax
mov byte [esp + 0x54], 1
call fcn.00407940
push ebp
lea ecx, [esp + 0x24]
mov bl, 2
push ecx
mov edi, eax
mov byte [esp + 0x54], bl
call fcn.004082a0
mov edi, eax
mov eax, dword [esp + 0x58]
mov byte [esp + 0x4c], 3
call fcn.00404bf0
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0x20]
push edx
call fcn.004210fe
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x30]
push eax
call fcn.004210fe
mov byte [esp + 0x54], 0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004210fe
mov dword [esp + 0x58], 0xffffffff
mov edx, dword [esp + 0x20]
push edx
call fcn.004210fe
add esp, 0x10
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call fcn.004210fe
add esp, 4
xor al, al
jmp 0x40801b

Function at 0x4081c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x400000
jbe 0x4081e4
mov eax, 0x400000
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [edx]
push edi
push eax
mov dword [esp + 0x28], 0
call ebx
mov ecx, dword [esp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x40821a
test ecx, ecx
je 0x408212
add edi, ecx
sub ebp, ecx
jne 0x4081d5
pop edi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x4086a0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi]
mov dword [esi + 4], 0
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebx]
push edi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jne 0x4086cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4086e3
lea ecx, [edi + 1]
cmp ecx, eax
je 0x4086e3
push ecx
call fcn.00404e70
mov eax, dword [esi]
inc edi
push edi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x40870a
mov edx, edi
lea esp, [esp]
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x408700
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
test eax, eax
jne 0x408726
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret
pop edi
mov al, 1
pop esi
ret
Function at 0x413640
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c3a8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.004134c0
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
test eax, eax
je 0x4136a9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x418aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42cc09
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
call fcn.00418930
lea edx, [esp + 0xc]
mov dword [esp + 0x20], 0
push edx
mov dword [esp + 0xc], 1
call fcn.00405080
push ebx
mov ecx, eax
call fcn.00404fe0
mov eax, dword [esp + 0xc]
push eax
call fcn.004210fe
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x419a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xe], cx
mov dword [esp + 0x28], eax
mov byte [ebx], al
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], eax
mov eax, dword [ebp]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 0xc
push ecx
push eax
call edx
mov edi, eax
test edi, edi
je 0x419ace
lea ecx, [esp + 0xc]
call fcn.00408530
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
mov ax, word [esp + 0xc]
cmp ax, 0x40
jne 0x419ae8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x419b20
test ax, ax
je 0x419b0f
lea ecx, [esp + 0xc]
call fcn.00408530
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
cmp byte [ebp + 0x2c], 0
je 0x419b23
mov edx, dword [ebp + 0x24]
mov dword [esi], edx
mov eax, dword [ebp + 0x28]
mov dword [esi + 4], eax
mov byte [ebx], 1
lea ecx, [esp + 0xc]
call fcn.00408530
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
Function at 0x41ae10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42b61e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
mov dword [esi], eax
test eax, eax
je 0x41ae46
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea edi, [ebx + 4]
lea eax, [esi + 4]
mov dword [esp + 0x14], 0
call fcn.00404b90
lea edi, [ebx + 0x10]
lea eax, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.00404b90
mov byte [esp + 0x14], 2
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebx + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [ebx + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov cl, byte [ebx + 0x2c]
lea edi, [ebx + 0x30]
lea eax, [esi + 0x30]
mov byte [esi + 0x2c], cl
call fcn.00404b90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41d570
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x439d44]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
lea esi, [ebp + 0x118]
push esi
push 0x406160
push 0
push 0x1f6
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x41d5a1
mov dword [esi + 4], eax
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x430838
lea edi, [ebp + 0x14]
push ecx
call fcn.004082a0
call fcn.0041be80
mov bl, al
test bl, bl
je 0x41d5db
cmp byte [ebp + 0x169], 0
jne 0x41d5db
mov edx, dword [ebp + 0x11c]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [ebp + 0x169]
mov byte [ebp + 0x88], al
test bl, bl
je 0x41d5f3
mov ebx, dword [ebp + 0x11c]
jmp 0x41d5f5
xor ebx, ebx
mov edi, dword [esp + 0x28]
lea esi, [ebp + 0x70]
lea eax, [esi + 0x24]
call fcn.00404bf0
mov ecx, dword [0x439d44]
push esi
push 0x406160
push 0
push 0x1f4
push ecx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call esi
mov eax, 0x45
lea ecx, [esp + 0x14]
call fcn.0041b000
mov eax, dword [eax]
mov ecx, dword [ebp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x14]
push edx
call fcn.004210fe
mov eax, dword [ebp + 0x74]
add esp, 4
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
Function at 0x41e170
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42c0ee
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
lea esi, [edi + 4]
xor ebx, ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
lea esi, [edi + 0x10]
mov dword [esp + 0x18], ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
mov dword [edi + 0x20], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], 4
mov dword [edi + 0x28], vtable.CObjectVector_struct_CArc_.0
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], 4
mov dword [edi + 0x3c], vtable.CObjectVector_class_CStringBase_wchar_t__.0
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov byte [edi + 0x58], bl
lea esi, [edi + 0x64]
mov byte [esp + 0x18], 3
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e70
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x41ea60
Capabilities:
Set registry value

Disassembly:
mov eax, 0x200c
call fcn.00429390
mov eax, dword [0x437024]
xor eax, esp
mov dword [esp + 0x2008], eax
push 0x2000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00426770
add esp, 0xc
push 0x2000
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [esp]
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.004210ef
add esp, 0x200c
ret
Function at 0x41eb10
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x437024]
xor eax, esp
mov dword [esp + 0x418], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.00426770
add esp, 0xc
push 0x208
lea edx, [esp + 0x214]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00426770
push str.Applications_
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.00421bb6
lea eax, [esp + 0x228]
push 0x5c
push eax
call fcn.00421c25
add eax, 2
push eax
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.00421cb2
add esp, 0x2c
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp]
push 2
lea edx, [esp + 8]
push edx
push 1
xor ecx, ecx
push ecx
push str.IsHostApp
push eax
mov word [esp + 0x1c], cx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.004210ef
add esp, 0x41c
ret
Function at 0x4210ef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437024]
jne 0x4210f9
repz ret
jmp fcn.00421ee0

Function at 0x425861
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004234c1
and dword [ebp - 4], 0
cmp dword [0x439bd8], 0
mov ebx, eax
jne 0x425912
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4259c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4259c3
push eax
call fcn.0042344f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x439bd8], eax
call esi
push eax
call fcn.0042344f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x439bdc], eax
call esi
push eax
call fcn.0042344f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x439be0], eax
call esi
push eax
call fcn.0042344f
pop ecx
mov dword [0x439be8], eax
test eax, eax
je 0x425912
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042344f
pop ecx
mov dword [0x439be4], eax
mov eax, dword [0x439be4]
cmp eax, ebx
je 0x42596a
cmp dword [0x439be8], ebx
je 0x42596a
push eax
call fcn.004234ca
push dword [0x439be8]
mov esi, eax
call fcn.004234ca
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42596a
test edi, edi
je 0x42596a
call esi
test eax, eax
je 0x425961
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425961
test byte [ebp - 0xc], 1
jne 0x42596a
or dword [ebp + 0x10], 0x200000
jmp 0x4259a3
mov eax, dword [0x439bdc]
cmp eax, ebx
je 0x4259a3
push eax
call fcn.004234ca
pop ecx
test eax, eax
je 0x4259a3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4259a3
mov eax, dword [0x439be0]
cmp eax, ebx
je 0x4259a3
push eax
call fcn.004234ca
pop ecx
test eax, eax
je 0x4259a3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439bd8]
call fcn.004234ca
pop ecx
test eax, eax
je 0x4259c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4259c5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x9aff5b
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror edx, 3
inc edx
stc
clc
not edx
ror edx, 3
lea edx, [edx - 0x2a824fec]
cmp ebp, 0x4b300712
test esp, edi
xor edx, 0x338704ea
test ebp, 0xf8451cc
cmp esi, 0x7d7b4817
xor ebx, edx
test bh, dl
jmp 0xf857aa
push ebx
movzx ebx, ax
push ebp
jmp 0x9f7d37
push eax
bswap ax
mov ah, dh
not ebp
push edx
push edi
rdtsc
push esi
rdtsc
cbw
pushfd
push ecx
btc di, bp
mov eax, 0
push eax
cwd
mov edi, dword [esp + 0x28]
rcr dx, 0xe6
stc
setl bh
bswap edi
btr bp, 0xcf
ror bp, 0x33
rol edi, 3
shld bp, cx, 0x2e
mov si, bp
rcr ebp, 0xf8
sub edi, 0x3c157740
adc edx, 0x637915cd
or ebx, ecx
not edi
shrd bp, bx, 0xbf
lea edi, [edi + eax]
cmp sp, si
sar ebp, 0xc7
xor bl, ch
mov ebp, esp
lea esp, [esp - 0xc0]
mov ebx, edi
xor edx, 0x39d84433
and esi, 0x312c2946
mov edx, 0
ror si, 0x5d
movzx esi, bx
sub ebx, edx
xadd esi, edx
lea esi, [0x9f7dc3]
test bp, bx
mov edx, dword [edi]
add edi, 4
xor edx, ebx
clc
add edx, 0x17f93d27
jmp 0x9a56f1
add esi, edx
push esi
ret
Function at 0x5012cc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x2c], 1
je 0x5012e5
movzx esi, word [esp + 0x30]
xor eax, eax
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x4c], 0x30
call fcn.005012c4
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x501134
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Jungo
mov dword [ebp - 0x20], eax
call fcn.005012b7
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x5013b0
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.180000
push str.Jungo
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x503758], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x503758]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x5013b0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x501395
mov esp, ebp
pop ebp
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x53f30de
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..rdata
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x339e1513
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10007be0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [0x10023d1c], 0xfba
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10023d1c], 0xb30
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x10007c88
mov eax, dword [ebp - 0x18]
mov dword [0x10023d20], 0xb13
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x10007caf
jmp 0x10007c77
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
mov dword [0x10023d20], 0x2308
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10007d2a
xor eax, eax
mov dword [0x10023d1c], 0x187b
mov dword [ebp - 0x20], eax
jmp 0x10007c52
mov dword [0x10023d1c], 0x9a7
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x10007c1e
jmp 0x10007c34
mov dword [0x10023d20], 0x7b7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10007c77
mov dword [0x10023d1c], 0x1cec
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10007c77
mov dword [0x10023d1c], 0x14d8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10007c77
mov dword [0x10023d1c], 0xffffef9a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0x12]
mov word [ebp - 0x22], dx
mov ax, word [ebp - 0x22]
cmp ax, 0x64
je 0x10007c5a
jmp 0x10007c77
mov eax, 1
mov dword [0x10023d1c], 0xcfb
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x10007c52
jmp 0x10007c77
Function at 0x10007da0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x10023d1c], 0x135
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.100074f0
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x20], eax
lea eax, [0x10008400]
mov dword [esp + 0x88], 0x14ac00
mov ecx, dword [0x10023d08]
mov dword [esp + 0x70], ecx
mov ecx, dword [0x10023d0c]
mov dword [esp + 0x3c], ecx
mov ecx, dword [0x10023d10]
mov dword [esp + 0x6c], ecx
mov ecx, dword [0x10023d14]
mov dword [esp + 0x7c], ecx
mov ecx, dword [0x10023d18]
mov dword [esp + 0x40], ecx
mov dword [0x10023d1c], 0x25a4
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x10007e4e
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x10007e6a
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
jmp 0x10007e27
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov dword [0x10023d1c], 0x1227
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x74], eax
call fcn.10007be0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x10007ee0
lea eax, [esp + 0x38]
mov dword [0x10023d20], 0xb4a
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10008900
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x10023d20]
add ecx, 0xffffee6a
mov dword [0x10023d1c], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret