joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452b00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, 0x45
push ebx
mov byte [ebp - 0x37], al
mov byte [ebp - 0x34], al
mov al, 0x4c
push esi
mov byte [ebp - 0x33], al
mov byte [ebp - 0x28], al
mov byte [ebp - 0x24], al
mov al, 0x72
mov cl, 0x6c
push edi
mov byte [ebp - 0x21], al
mov byte [ebp - 0x1f], al
mov byte [ebp - 0x2e], cl
mov byte [ebp - 0x2d], cl
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x38]
mov dl, 0x64
mov ebx, 0x61
push eax
push ecx
mov byte [ebp - 0x38], 0x4b
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x4e
mov byte [ebp - 0x32], 0x33
mov byte [ebp - 0x31], 0x32
mov byte [ebp - 0x30], 0x2e
mov byte [ebp - 0x2f], dl
mov byte [ebp - 0x2c], 0
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], bl
mov byte [ebp - 0x25], dl
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x20], bl
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], 0x41
mov byte [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0x14]
push 0x4630c0
push edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], ebx
call fcn.004104e9
mov eax, dword [ebp + 8]
test eax, eax
je 0x40196a
mov ecx, dword [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x10], eax
mov eax, 0x401956
ret
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x401980
push esi
call dword [ebp - 0x18]
test eax, eax
je 0x4019a8
mov edx, dword [ebp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp + 0x10], eax
mov eax, 0x401994
ret
mov eax, 0x4019ae
ret

Function at 0x402750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452b10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
push 0x4630c0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0x63
call fcn.004104e9
mov eax, dword [ebp + 0x10]
mov ecx, 0xda90b
and eax, 0xff
mov esi, dword [ebp + 0xc]
cdq
idiv ecx
sub dl, 0x14
test esi, esi
jbe 0x4027ba
mov eax, dword [ebp + 8]
mov cl, byte [eax]
add cl, dl
xor cl, dl
add cl, dl
xor cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0x4027aa
mov eax, 0x4027c0
ret
Function at 0x4278d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00410fb0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42799b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42799b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42794e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x427959
or bh, 8
and edi, 0x8000000
je 0x427974
mov eax, dword [0x4817dc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42799b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x427d9b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x427dbf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x427dda
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x42fce4
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x42fd1c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004337a9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00433781
jmp 0x42fd28
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x431ae6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x431b28
call fcn.00449e96
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x431b28
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x431b1f
xor eax, eax
jmp 0x431b30
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00431b36
pop edi
pop esi
pop ebx
ret 4

Function at 0x433c52
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.00449e96
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x433c83
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.00433ca8
pop edi
pop esi
pop ebx
ret 8
Function at 0x434017
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x453394
call fcn.00410878
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.00449e96
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x434056
call fcn.00449e96
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x434064
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x434072
or eax, 0xffffffff
jmp 0x43415a
mov ecx, esi
call fcn.00433f8d
mov dword [ebp - 0x14], eax
call fcn.0042f7ec
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x4340a9
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4340a9
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.0042f7a0
push dword [ebp - 0x14]
call fcn.0042f2d1
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.00433ca8
cmp eax, edi
je 0x43411c
test byte [esi + 0x24], 0x10
je 0x4340ea
push 4
mov ecx, esi
pop ebx
call fcn.00432653
test ah, 1
je 0x4340e2
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00431d3d
cmp dword [esi + 0x1c], edi
je 0x43411c
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004327df
jmp 0x43411c
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x434130
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x434149
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x434149
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.00433fc7
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x593faa70
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SetFocus]
mov esi, ecx
push dword [esi + 8]
call edi
push dword [esi + 0xc]
call edi
push 5
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x18]
call edi
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x70]
push 0
mov dword [esi], 1
push dword [ecx + eax*4 + 0x24]
push 0x186
push dword [esi + 0x18]
call dword [sym.imp.vsansi.dll_SendMessageW]
and dword [esi], 0
pop edi
xor eax, eax
pop esi
ret

Function at 0x593fbcd7
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
cmp edi, dword [esi + 8]
je 0x593fbd16
call fcn.594014a5
push 0
push dword [esi + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, dword [esi + 0x14]
je 0x593fbd06
mov eax, dword [esi + 0x3c]
test eax, eax
jle 0x593fbd0f
dec eax
mov dword [esi + 0x3c], eax
jmp 0x593fbd0f
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.593fb8d4
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x593fc691
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
ret 8

Function at 0x593fc6ab
Capabilities:
Set registry value

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, ecx
call dword [sym.imp.vsansi.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0
push dword [esp + 0x18]
push dword [esi]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop esi
ret 0xc

Function at 0x593fc6d7
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.vsansi.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x593fc6e2
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.vsansi.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
ret 8
Function at 0x594014a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x594014b4
pop dword [ebp - 0x40]
mov eax, 0xbba36e08
sub eax, 0x62635954
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x4e7e4a22
add dword [ebp - 0x50], 0xffd3fb29
mov dword [ebp - 0x4c], 0x9ad4cddc
sub dword [ebp - 0x4c], 0x68a18197
mov dword [ebp - 0x48], 0x30aa684d
sub dword [ebp - 0x48], 0xe45e241f
mov dword [ebp - 0x44], 0x55e86c52
add dword [ebp - 0x44], 0xaa1793ae
lea eax, [ebp - 0x50]
push eax
mov eax, 0x21f94583
sub eax, 0xc8ba351f
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xfe67ed1a
sub dword [ebp - 0x50], 0x89f583c4
mov dword [ebp - 0x4c], 0x52b9e826
add dword [ebp - 0x4c], 0xeeb2794f
mov dword [ebp - 0x48], 0xb8063d91
sub dword [ebp - 0x48], 0x5496d125
mov dword [ebp - 0x44], 0x1afedf4d
sub dword [ebp - 0x44], 0x1afedf4d
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38cf5
push 0
call eax
mov ecx, 0x834cac98
sub ecx, 0x834c60ee
mov ebx, eax
mov esi, 0xbf3393c3
sub esi, 0x65f2a3c3
add esi, dword [ebp - 0x40]
mov edx, 0xc059d228
sub edx, 0x8e3b4811
mov dword [ebp - 0x34], 0xa2f97eed
mov edi, dword [esi]
add dword [ebp - 0x18], 0x3c91fd37
xor edi, edx
mov dword [ebp - 0x24], 0xfdb14fdb
mov dword [ebx], edi
xor dword [ebp - 0x20], 0x2abff490
add ebx, 4
add esi, 4
loop 0x594015d1
add eax, 0xe5fbeb59
sub eax, 0xe5fac9de
mov ebx, eax
add eax, 0x925dc4ce
add eax, 0x6da23b37
mov ecx, 0x593f0000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x59404d9b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.59404d84
and byte [esi + 0xc], 0
mov eax, 0x593f0000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x59404df5
cmp dword [ebp - 0x18], 5
jb 0x59404e0d
jmp 0x59404e09
cmp dword [ebp - 0xc], 1
jne 0x59404e0d
cmp dword [ebp - 0x18], 4
ja 0x59404e09
jne 0x59404e0d
cmp dword [ebp - 0x14], 0
jbe 0x59404e0d
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x59407090
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x1000b3eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000b3fa
pop dword [ebp - 8]
mov eax, 0xaeb1d360
sub eax, 0x9eb11f66
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x3bbacb8
add dword [ebp - 0x18], 0x4a969893
mov dword [ebp - 0x14], 0xf9fa0283
sub dword [ebp - 0x14], 0xc7c6b63e
mov dword [ebp - 0x10], 0xe618f447
sub dword [ebp - 0x10], 0x99ccb019
mov dword [ebp - 0xc], 0x887d96bf
sub dword [ebp - 0xc], 0x887d96bf
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xf2c0a1a6
sub dword [ebp - 0x18], 0x7e4e3850
mov dword [ebp - 0x14], 0x52ccc4ae
add dword [ebp - 0x14], 0xee9f9cc7
mov dword [ebp - 0x10], 0xc8dd7c22
sub dword [ebp - 0x10], 0x656e0fb6
mov dword [ebp - 0xc], 0x2adc1fca
add dword [ebp - 0xc], 0xd523e036
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x89c576c7
add eax, 0x863b797d
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3f779
push 0
call eax
mov ecx, 0x62e7
xor edx, edx
add edx, eax
mov edi, 0x30b39a64
add edi, 0xdf4e099c
add edi, dword [ebp - 8]
mov esi, 0x80e36843
add esi, 0x3e1e5161
xor dword [ebp - 4], esi
mov ebx, dword [edi]
mov dword [ebp - 4], 0xf5021a1d
add ebx, esi
mov dword [edx], ebx
mov dword [ebp - 4], 0x5c198125
add edx, 0xbf3efcfe
add edx, 0x40c10306
add edi, 0xe82e03bf
add edi, 0x17d1fc45
loop 0x1000b513
add eax, 0xba00bcf8
sub eax, 0xb9ff3e89
mov ebx, eax
add eax, 0x3cbd8a34
add eax, 0xc34275d1
mov ecx, 0x384c8648
add ecx, 0xd7b379b8
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x1000b904
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10015820]
jne 0x1000b90e
repz ret
jmp fcn.1000c082
Function at 0x401188
Capabilities:
Encode data using xor

Disassembly:
push 0x40d4d0
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x39], bl
mov dh, 0xe1
fisttp qword [eax + 0x21a446ec]
imul esp, edx, 0xffffffcb
mov esp, 0x8f2b
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push eax
jb 0x401236
push 0x65
arpl word [ecx + esi], si
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
int3
add byte [eax], al
add byte [eax], al
add eax, 0x726f4600
insd dword es:[edi], dx
xor dword [eax], eax
or eax, 0x46000501
outsd dx, dword [esi]
jb 0x4012b7
xor dword [eax], eax
or al, byte [edx]
sbb dword [ecx], eax
add byte [edx], al
and al, byte [eax]
and edi, edi
invalid
or byte [eax], al
or eax, dword [eax + edx]
add edi, edi
add esp, dword [0x2800000]
or byte [eax], al
add al, byte [eax]
push ebx
xor dword [eax], eax
push ss
add dword [eax], ecx
add byte [edx], al
add bh, bh
add byte [eax], al
add al, 0x2b
and byte [edx - 0x10fe10ef], dh
add dword [eax], ecx
add byte [ebx], cl
add al, 0x10
add edi, edi
add esp, dword [0x2800000]
pop es
add byte [edx], al
add byte [ebx + 0x31], dl
add byte [esi], dl
add dword [edi], eax
add byte [edx], al
cmp bh, 0x80
add byte [ebx + ebx*2], al
sbb eax, 0x1ef11b2
out dx, eax
add dword [eax], ecx
add byte [ebx], cl
add al, 0x10
add edi, edi
add esp, dword [0x2800000]
push es
add byte [edx], al
add byte [ebx + 0x31], dl
add byte [esi], dl
add dword [esi], eax
add byte [edx], al
sar bh, 0xc0
add byte [ebx + ecx*4], al
sbb dh, byte [edx - 0x10fe10ef]
add dword [eax], ecx
add byte [ebx], cl
add al, 0x10
or eax, dword [eax + edx]
add edi, edi
add esp, dword [0x2800000]
add eax, 0x53000200
xor dword [eax], eax
push ss
add dword [0xffff0200], eax
rol byte [eax], 4
mov ebx, 0xef11b217
add edi, ebp
add dword [eax], ecx
add byte [ebx], cl
add al, 0x10
add edi, edi
add esp, dword [0x2800000]
add al, 0
add al, byte [eax]
push ebx
xor dword [eax], eax
push ss
add dword [eax + eax], eax
add bh, bh
loopne 0x40132b
add byte [ebx + ebp*8], al
adc al, 0xb2
adc edi, ebp
add edi, ebp
add dword [eax], ecx
add byte [ebx], cl
add al, 0x10
add edi, edi
add esp, dword [0x2800000]
add eax, dword [eax]
add al, byte [eax]
push ebx
xor dword [eax], eax
push ss
add dword [ebx], eax
add byte [edx], al
invalid
Function at 0x5c3950
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12d000]
push edi
jmp 0x5c396a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5c3971
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c3960
mov eax, 1
add ebx, ebx
jne 0x5c3983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5c3994
jne 0x5c39b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c39b3
dec eax
add ebx, ebx
jne 0x5c39a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5c3978
add ebx, ebx
jne 0x5c39af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5c3a05
xor ecx, ecx
sub eax, 3
jb 0x5c39cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5c3a3a
sar eax, 1
mov ebp, eax
jmp 0x5c39d6
add ebx, ebx
jne 0x5c39d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c39a4
inc ecx
add ebx, ebx
jne 0x5c39e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5c39a4
add ebx, ebx
jne 0x5c39f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5c39e6
jne 0x5c3a02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5c39e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5c3a24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5c3a16
jmp 0x5c3966
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5c3a24
add edi, ecx
jmp 0x5c3966
pop esi
mov edi, esi
mov ecx, 0x574b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5c3a42
cmp byte [edi], 0xe
jne 0x5c3a42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5c3a47
lea edi, [esi + 0x1c0000]
mov eax, dword [edi]
or eax, eax
je 0x5c3abf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1c50d0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1c5208]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5c3a74
mov ecx, edi
jns 0x5c3aa3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1c5210]
or eax, eax
je 0x5c3ab9
mov dword [ebx], eax
add ebx, 4
jmp 0x5c3a91
call dword [esi + 0x1c520c]
mov ebp, dword [esi + 0x1c5214]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5c3af3
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4022c2
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x403f18
call fcn.0040281c
push 1
call fcn.00402599
pop ecx
test al, al
jne 0x402179
push 7
call fcn.00402a30
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00402564
mov byte [ebp - 0x24], al
mov eax, dword [0x405338]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x402172
test eax, eax
jne 0x4021e3
mov dword [0x405338], ecx
push 0x4032a4
push 0x40328c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4021c6
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4022bc
push 0x403288
push 0x403274
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x405338], 2
jmp 0x4021e8
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00402706
pop ecx
call fcn.00402a24
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x402218
push esi
call fcn.0040267c
pop ecx
test al, al
je 0x402218
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004027cc
call esi
call fcn.00402a2a
mov esi, eax
cmp dword [esi], edi
je 0x402236
push esi
call fcn.0040267c
pop ecx
test al, al
je 0x402236
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00402b46
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00402b79
test al, al
jne 0x402261
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x40226a
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00402723
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4022bc
call fcn.00402861
ret
call fcn.0040200b
jmp 0x40215a

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0