joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415a50
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
push edi
and ebx, 0xffff
push 0xf1
mov esi, ecx
push ebx
call sub.MFC42.DLL_AfxFindResourceHandle
mov edi, eax
xor ebp, ebp
cmp edi, ebp
jne 0x4123c2
xor al, al
jmp 0x4124e4
push 0xf1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x4123da
xor al, al
jmp 0x4124e4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x4123ed
xor al, al
jmp 0x4124e4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x412401
xor al, al
jmp 0x4124e4
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call sub.MFC42.DLL_CImageList::Create
test eax, eax
jne 0x412435
xor al, al
jmp 0x4124e4
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x4171cc
push ebx
push 2
push ebx
mov dword [esp + 0x2c], ebp
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CGdiObject::Attach
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CGdiObject::DeleteObject
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x4124c9
mov ax, word [ebx]
test ax, ax
je 0x4124bb
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.00412500
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x41249f
mov dword [esp + 0x10], 0x4171f4
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x412b80
Capabilities:
Enumerate threads

Disassembly:
push 0xffffffffffffffff
push 0x415b08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov al, byte [esp + 0x44]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
push ebx
push 4
mov dword [esp + 0x4c], ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [esp + 0x20]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x28], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x412c08
mov edi, dword [esp + 0x50]
cmp dword [esp + 0x2c], edi
jne 0x412bf9
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x28]
push edx
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.00413230
lea ecx, [esp + 0x20]
push ecx
push esi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x412bde
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x4c]
mov ecx, dword [esp + 0x14]
mov dl, byte [esp + 0x10]
cmp ecx, ebx
mov byte [esi], dl
jne 0x412c25
xor eax, eax
jmp 0x412c2e
mov eax, dword [esp + 0x18]
sub eax, ecx
sar eax, 2
cmp eax, ebx
jge 0x412c34
xor eax, eax
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
add esp, 4
cmp ecx, edx
mov dword [esi + 4], eax
je 0x412c65
cmp eax, ebx
je 0x412c57
mov edi, dword [ecx]
mov dword [eax], edi
add ecx, 4
add eax, 4
cmp ecx, edx
jne 0x412c4f
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x40]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret

Function at 0x412d30
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebx
push ebp
push esi
xor ebp, ebp
push edi
push ebp
push 2
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [esp + 0x10]
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x412d9b
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x34]
push edi
push ecx
call ebx
add esp, 8
test eax, eax
je 0x412d97
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x412d9b
lea eax, [esp + 0x34]
push edi
push eax
call ebx
add esp, 8
test eax, eax
jne 0x412d79
mov ebp, dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x128
ret
Function at 0x853470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2c7000]
push edi
jmp 0x85348a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x853491
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x853480
mov eax, 1
add ebx, ebx
jne 0x8534a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x8534b4
jne 0x8534d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8534d3
dec eax
add ebx, ebx
jne 0x8534c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x853498
add ebx, ebx
jne 0x8534cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x853525
xor ecx, ecx
sub eax, 3
jb 0x8534eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x85355a
sar eax, 1
mov ebp, eax
jmp 0x8534f6
add ebx, ebx
jne 0x8534f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8534c4
inc ecx
add ebx, ebx
jne 0x853504
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x8534c4
add ebx, ebx
jne 0x853511
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x853506
jne 0x853522
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x853506
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x853544
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x853536
jmp 0x853486
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x853544
add edi, ecx
jmp 0x853486
pop esi
mov edi, esi
mov ecx, 0xe4cf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x853562
cmp byte [edi], 0x2d
jne 0x853562
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x853567
lea edi, [esi + 0x43d000]
mov eax, dword [edi]
or eax, eax
je 0x8535df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x47862c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4787d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x853594
mov ecx, edi
jns 0x8535c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4787d8]
or eax, eax
je 0x8535d9
mov dword [ebx], eax
add ebx, 4
jmp 0x8535b1
call dword [esi + 0x4787d4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x853610
cmp al, 0xef
ja 0x853603
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x8535e5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x8535f2
mov ebp, dword [esi + 0x4787dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x853644
sub esp, 0xffffff80
jmp 0x57ec13
Function at 0x805d78
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805d7e
pop ebp
sub ebp, 6
sub ebp, 0x405d78
jmp 0x805ddc
jmp 0x805de5
mov eax, 0x405d78
add eax, ebp
add eax, 0x93
mov ecx, 0x621
mov edx, 0xfdddc009
xor byte [eax], dl
inc eax
dec ecx
jne 0x805dfc
jmp 0x805e0f
arpl word [ecx + 0x61], cx
or dword [ecx], ebx
or dword [ecx], ecx
popal
or ebp, eax
and eax, 0xcef98809
xor dword [edx], 0xcef98848
xor dword [edx], 0x59c93a48
neg byte [ecx + ecx + 0x59093fd8]
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x909090f]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0x805e58
popal
enter 0x3c, 9
popal
mov edi, 0x8093e2e
and eax, 0x909612d
or dword [ecx], ecx
loope 0x805e78
or dword [ecx], ecx
or eax, esp
and ecx, dword [ecx]
or dword [ecx], ecx
pop esp
test byte [ebp + 0x2d], ah
or dword [edx + 0x909018c], eax
or dword [edx + 0x909059c], eax
or dword [edx + 0x9091984], eax
or eax, ecx
loopne 0x805e99
cmp byte [ebx], cl
mov cl, bl
or eax, 0xfd8c0640
div dh
not byte [ebx + ecx*8 + 5]
or dword [edx + 0x90d2d85], eax
or dword [ecx], ecx
popal
enter 0x3c, 9
popal
mov edi, 0x8093e2e
and eax, 0xce1582d
or dword [ecx], ecx
or eax, esp
cmp al, 0xb
or dword [ecx], ecx
pop esp
test byte [ebp + 0x2d], ah
or esi, esi
jl 0x805eca
idiv byte [ecx + eax - 0x1f]
outsd dx, dword [esi]
or dword [ecx], ecx
or dword [edx + 0x90901b4], eax
mov ah, 1
or dword [ecx], ecx
or dword [edx], edi
sar byte [edx], 0xdb
mov ah, cl
or al, 0x41
push es
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0x805ed0
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0x805f25
loopne 0x805ece
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe20a6d0c
jecxz 0x805f34
mov ah, cl
or al, 0xe0
mov byte [0x54f6f6f6], al
retf
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x30093e45
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..text_1
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x111113e3
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x805f10
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805f16
pop ebp
sub ebp, 6
sub ebp, 0x405f10
jmp 0x805f74
jmp 0x805f7d
mov eax, 0x405f10
add eax, ebp
add eax, 0x93
mov ecx, 0x645
mov edx, 0x62a60c3f
xor byte [eax], dl
inc eax
dec ecx
jne 0x805f94
jmp 0x805fa7
push ebp
jg 0x806001
aas
das
aas
aas
push edi
aas
adc edi, dword [edi]
mov esi, 0x65738cf
push ds
mov esi, 0x65738cf
push ds
or al, 0xff
outsd dx, dword [esi]
shr byte [edx + 0x3f09ee3f], 0x6f
mov ah, 0xf2
mov ah, 0xb6
add edi, dword [edi]
aas
aas
mov esi, 0x3f3fc7fe
aas
cmp al, 0xf2
xchg dword [ecx], edi
aas
aas
aas
test dword [edi], edx
aas
aas
aas
enter 0x3cdd, 0xfffffffffffffff7
mov ah, 0xbe
xor edi, dword [edi]
aas
aas
cmp al, 0xfa
outsd dx, dword [esi]
push edi
or byte [esi], dh
aas
push edi
mov ebx, dword [eax]
or byte [edi], bh
adc ebx, dword ds:[ebx]
push edi
aas
aas
aas
aas
xlatb
cmp bh, byte [edi]
aas
aas
salc
pop ss
aas
aas
aas
push 0xffffffffffffffb4
sal dword [edx + edi*4 + 0x3f3f3f37], cl
mov ah, 0xaa
xor edi, dword [edi]
aas
aas
mov ah, 0xb2
das
aas
aas
aas
invalid
Function at 0x402000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [0x403010], 0x400000
push 0x7f02
push 0
call dword [sym.imp.user32.dll_LoadIconA]
sub esp, 8
mov dword [0x403014], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
sub esp, 8
mov dword [0x403018], eax
mov eax, section..data_1
mov dword [esp], eax
call dword [sym.imp.user32.dll_RegisterClassA]
sub esp, 4
test eax, eax
je 0x402111
mov dword [esp], 0
mov dword [esp + 4], 0x403059
mov dword [esp + 8], 0x40305e
mov dword [esp + 0xc], 0x10080000
mov dword [esp + 0x10], pe_nt_image_headers32
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x18], 0x100
mov dword [esp + 0x1c], 0xc0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov eax, dword [0x403010]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.user32.dll_CreateWindowExA]
sub esp, 0x30
test eax, eax
je 0x402111
mov dword [esp], 0x403028
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.user32.dll_GetMessageA]
sub esp, 0x10
cmp eax, 1
jb 0x402111
jne 0x4020c0
mov dword [esp], 0x403028
call dword [sym.imp.user32.dll_TranslateMessage]
sub esp, 4
mov dword [esp], 0x403028
call dword [sym.imp.user32.dll_DispatchMessageA]
sub esp, 4
jmp 0x4020c0
leave
mov eax, dword [0x403030]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x40215d
Capabilities:
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov byte [0x403063], al
push 0x403063
push 0x40305e
call dword [sym.imp.kernel32.dll_SetEnvironmentVariableA]
call fcn.004026a2
push 0
push 2
push 0x403080
push 0x403044
call dword [0x40568e]
cmp eax, 0x122
jne 0x4021b8
call fcn.00402120
pop eax
xor ebx, ebx
push edx
push 2
push 0x403065
push 0x40305e
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
mov bl, byte [0x403065]
pop edx
add edx, ebx
call edx
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x402685
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
push 0x40
push ebx
push eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
ret

Function at 0x401ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x404080]
or dl, 1
imul edx, eax
mov eax, dword [0x404080]
sub eax, edx
mov ebx, esi
mov edx, eax
mov eax, 0x404084
call fcn.00401be9
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x4034ed
push eax
sub edi, fcn.00402c97
push edi
push fcn.00402c97
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401d1c
mov eax, fcn.00402c97
mov ebx, esi
mov edx, edi
call fcn.00401be9
mov edx, 0x1c000
mov eax, 0x404084
mov ebx, esi
call section.AUTO
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.0040189e
lea edx, [esi + 0x1c000]
add edx, esi
lea eax, [esi - 1]
lea ebx, [ebp - 2]
and eax, 0x404084
call fcn.00402c97
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4010fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427004]
jne 0x401106
repz ret
jmp fcn.00401332

Function at 0x403bcb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x427004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004023b9
and dword [ebp - 0x14], 0
cmp dword [0x429acc], 0
mov dword [ebp - 0x18], eax
jne 0x403c7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403d26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403d26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x429acc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x429ad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x429ad4], eax
call edi
push eax
call esi
mov dword [0x429adc], eax
test eax, eax
je 0x403c7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x429ad8], eax
mov eax, dword [0x429ad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x403cd7
cmp dword [0x429adc], ecx
je 0x403cd7
push eax
call esi
push dword [0x429adc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x403cd7
test ebx, ebx
je 0x403cd7
call edi
test eax, eax
je 0x403cce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x403cce
test byte [ebp - 8], 1
jne 0x403cd7
or dword [ebp + 0x10], 0x200000
jmp 0x403d0a
mov eax, dword [0x429ad0]
cmp eax, dword [ebp - 0x18]
je 0x403d0a
push eax
call esi
test eax, eax
je 0x403d0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x403d0a
mov eax, dword [0x429ad4]
cmp eax, dword [ebp - 0x18]
je 0x403d0a
push eax
call esi
test eax, eax
je 0x403d0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x429acc]
call esi
test eax, eax
je 0x403d26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403d28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010fc
leave
ret
Function at 0x4168b0
Capabilities:
Read file on windows
Set file attributes

Disassembly:
sub esp, 0x41c
mov eax, dword [0x427004]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x42a7cc]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov ebp, 0x1519a5
mov ebx, 0x8e46a7b8
mov dword [0x42a434], ebx
cmp eax, 0x3dc
jne 0x416902
push 0
push 0x424a20
call esi
push 0
call edi
mov eax, dword [0x42a7cc]
dec ebp
jne 0x4168e3
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CancelIo]
xor esi, esi
cmp eax, 0x997
jne 0x41694b
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
lea edx, [esp + 0x34]
push edx
push ebp
mov dword [esp + 0x24], ebp
call edi
push ebp
call ebx
mov eax, dword [0x42a7cc]
cmp esi, 0x845f8b
jne 0x416962
mov eax, dword [0x428940]
add eax, 0xa231
mov dword [0x42a7cc], eax
cmp eax, 0x141
jne 0x41697d
mov dword [0x42a008], 0xec58acac
mov dword [0x42a00c], 0xffffffff
inc esi
cmp esi, 0x12cca12
jl 0x416913
call fcn.004164f0
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004010fc
add esp, 0x41c
ret 0x10
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
add eax, 0x7838833d
push esi
mov esi, dword [ebp + 0xc]
push esi
lea eax, [ebp - 0x6a]
push 0x78
xor dl, byte [esi - 0x18]
mov dword [esi], eax
add byte [ebx + 0x15f3084d], cl
enter 0x40c0, 0
push cs
push ecx
and dword [ecx - 0x6c5397c0], 0x47
add byte [edx + 0x21], dl
adc eax, 0x22c180
mov eax, dword [0x41d750]
add esp, 0x14
clc
sal byte [edi + ecx + 0x3e], 0x68
push esp
sar byte [ecx], cl
push edi
call dword [0x3a40c164]
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
invalid
Function at 0x40d790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x40d7b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d7b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d7a8
mov eax, 1
add ebx, ebx
jne 0x40d7cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d7c0
jne 0x40d7dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d7c0
xor ecx, ecx
sub eax, 3
jb 0x40d7f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d862
mov ebp, eax
add ebx, ebx
jne 0x40d7fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d808
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d82c
inc ecx
add ebx, ebx
jne 0x40d818
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d80d
jne 0x40d829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d80d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d84c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d83d
jmp 0x40d7ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d84c
add edi, ecx
jmp 0x40d7ae
pop esi
mov edi, esi
mov ecx, 0x1a9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40d86a
cmp byte [edi], 7
jne 0x40d86a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40d86f
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d8de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d89c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd02c]
or eax, eax
je 0x40d8d8
mov dword [ebx], eax
add ebx, 4
jmp 0x40d8b9
call dword [esi + 0xd030]
popal
jmp 0x4016f7
Function at 0x10011be0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ecx
push edi
push ecx
push str.Enabled
mov ebx, edx
mov dword [esp + 0x1c], eax
call fcn.1001f310
add esp, 4
mov edx, ebx
mov ecx, eax
call fcn.1001f4b0
lea eax, [edi + 1]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.Only_During_Freeze_Time
call fcn.1001f310
add esp, 4
lea edx, [ebx + 1]
mov ecx, eax
call fcn.1001f4b0
lea eax, [edi + 2]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.Show_Prices
call fcn.1001f310
add esp, 4
lea edx, [ebx + 2]
mov ecx, eax
call fcn.1001f4b0
lea eax, [edi + 3]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push str.No_Title_Bar
call fcn.1001f310
add esp, 4
lea edx, [ebx + 3]
mov ecx, eax
call fcn.1001f4b0
mov ecx, dword [esp + 0x10]
push 0x1015ff14
call fcn.1001f310
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x14], eax
cmp esi, dword [edi + 0xc]
je 0x10011cd9
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x20]
push dword [esp + 0x18]
xorps xmm0, xmm0
movq qword [esp + 0x24], xmm0
call fcn.1001c150
mov ebx, dword [esp + 0x14]
mov eax, esi
cdq
mov cl, byte [ebx]
mov byte [ebx], 5
mov esi, dword [ebx + 0xc]
mov byte [esp + 0x14], cl
push dword [esp + 0x14]
mov byte [esp + 0x1c], cl
mov ecx, dword [ebx + 8]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x24]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov dword [esp + 0x28], esi
call fcn.1001c150
or ecx, 0xffffffff
mov esi, 0x10160bfd
mov al, 0x50
or edi, 0xffffffff
cmp al, 0x23
jne 0x10011cf4
cmp byte [esi], al
jne 0x10011cf4
cmp byte [esi + 1], al
cmove ecx, edi
movzx edx, cl
movzx eax, al
xor edx, eax
shr ecx, 8
mov al, byte [esi]
inc esi
xor ecx, dword [edx*4 + 0x1017d228]
test al, al
jne 0x10011ce6
not ecx
call fcn.100e3850
test eax, eax
je 0x10011d6e
add eax, 0xc
lea ecx, [esp + 0x18]
push eax
call fcn.10021410
mov ecx, dword [esp + 0x10]
push 0x10160474
call fcn.1001f310
mov cl, byte [esp + 0x18]
mov edi, eax
mov eax, dword [esp + 0x20]
mov dl, byte [edi]
mov byte [edi], cl
mov esi, dword [edi + 0xc]
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x14], dl
push dword [esp + 0x14]
mov byte [esp + 0x1c], dl
mov edx, dword [edi + 8]
mov dword [edi + 0xc], ecx
lea ecx, [esp + 0x24]
mov dword [edi + 8], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
call fcn.1001c150
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4