joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438020
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x464f98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0045e142
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.004379c0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0045e070
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0045a934
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0045a934
push 1
push 0
push 0
mov ecx, esi
call fcn.0045a8dc
push 1
push 0
push 1
mov ecx, esi
call fcn.0045a8dc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045e1b4
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4381a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x464fb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0045e142
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.004379c0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0045e070
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x438264
cmp dword [esp + 0x40], 1
jne 0x438262
cmp ecx, eax
jge 0x438264
mov eax, ecx
cmp eax, 0xc8
jge 0x438270
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00438020
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0045e1b4
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x4389f0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x465023
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00458d54
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0045e3ea
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0045f906
test eax, eax
je 0x438b0c
mov ecx, dword [esp + 0x3c]
call fcn.0045e417
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x438ad0
push edi
mov ecx, esi
call fcn.0045ba7b
mov ecx, esi
call fcn.00438c70
cmp dword [esp + 0x38], 1
jne 0x438b05
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0045bbb6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43b530
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43b563
push esi
call fcn.0043e620
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43b55c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43b5e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43b5d2
mov eax, dword [esi + 8]
test eax, eax
je 0x43b587
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43b5ce
cmp eax, 2
je 0x43b5d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43b57a
cmp eax, 3
je 0x43b5ad
cmp eax, 1
jne 0x43b57a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43b57a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43b57a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043b610
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43b5f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043b610
add esp, 4
pop esi
ret

Function at 0x459b4a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x459b82
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00457bfe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00457bd6
jmp 0x459b8e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45b238
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45b27a
call fcn.00460cf1
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45b27a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45b271
xor eax, eax
jmp 0x45b282
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045b288
pop edi
pop esi
pop ebx
ret 4

Function at 0x461221
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x46124f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46126d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00461187
jmp 0x46126d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x46126d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00461187
test edi, edi
mov eax, edi
jne 0x461257
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4b3436
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x4b34b6
mov dword [ecx + 8], edx
lea ebx, [ebp + 7]
mov di, word [esp]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x4b34cd
lea esp, [esp + 0x14]
movzx esi, byte [eax + 0xd]
mov bl, byte [esp]
mov edi, 0x22733d04
sub di, 0xaf08
jmp 0x4b3492
lea esp, [esp + 0x18]
movzx edx, byte [eax + 0xc]
push edx
xor di, 0x57b4
mov di, word [esp]
jmp 0x4b3548
sub esp, 0x14
jmp 0x4b352d
lea esp, [esp + 0xc]
movzx eax, byte [eax + 0xf]
xchg bp, di
mov ebp, 0x472c413a
mov bl, byte [esp]
jmp 0x4b3583
lea esp, [esp + 0x18]
movzx esi, byte [eax + 0xe]
sub esp, 0xc
lea edi, [ebx + ebx]
jmp 0x4b350a
shl edx, 8
neg bl
xor edx, esi
bswap ebx
jmp 0x4b34e1
xor edx, eax
mov dword [ecx + 0xc], edx
neg ah
jmp 0x4b35a6
shl edx, 8
mov esi, 0x124fe462
lea ebx, [edx*4]
jmp 0x4b3553
shl edx, 8
bts edi, ebx
xor edx, esi
jmp 0x4b356b
push edx
bsf bp, ax
mov word [esp], dx
mov bl, 0xbc
jmp 0x4b35dc
mov eax, edx
mov bl, byte [esp]
not bl
shr eax, 0x10
jmp 0x4b358d
mov ebx, ecx
rol edi, 3
mov eax, dword [eax*4 + reloc.MSVCRT.dll_strncpy]
mov bl, byte [esp]
jmp 0x4b3661
xchg bh, bl
mov bp, word [esp]
mov bp, 0xb931
jmp 0x4b363e
lea esp, [esp + 4]
mov esi, 0xff
mov bl, byte [esp]
and eax, esi
jmp 0x4b35b2
lea ebx, [esp + eax]
jmp 0x4b370d
and edi, esi
mov edi, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
mov ebx, 0x9f056970
mov bl, 0x34
jmp 0x4b360d
shr edi, 8
lea ebx, [eax + 1]
mov bl, bh
mov ebp, 0x530977cc
inc bl
jmp 0x4b3625
xor eax, 0x1000000
xchg edi, ebx
lea ebp, [ebx*4]
lea ebp, [eax + edx]
mov edi, edx
jmp 0x4b35c6
bswap ebp
jmp 0x4b36d8
mov bp, 0x8bb3
cmc
and eax, 0xff000000
inc bp
bsr bp, bp
jmp 0x4b3679
mov edx, ecx
lea edx, [edx + 4]
mov ebx, dword [edx]
pop edx
jmp 0x4b3690
mov bp, word [esp]
mov ebp, 0x3575928c
jmp 0x4b36e5
xor eax, edi
mov edi, edx
bt ebp, edx
mov bp, word [esp]
jmp 0x4b36bc
shr edi, 0x18
btr ebp, esp
clc
dec ebp
jmp 0x4b373b
xor eax, edi
lea edi, [ecx - 0x7b]
pushal
mov dword [esp + 0xb], eax
jmp 0x4b371e
and edi, 0xff0000
lea ebp, reloc.MSVCRT.dll_strncpy
mov bl, 0x58
push edx
jmp 0x4b36b2
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + reloc.MSVCRT.dll_strncpy]
jmp 0x4b376a
movzx edi, byte [edi*4 + 0x490a78]
mov bp, 0x5c37
jmp 0x4b36ef
pushal
lea esp, [esp + 0x40]
mov ebp, 0xff00
clc
sub esp, 0x16
jmp 0x4b37c8
mov word [esp], di
mov dword [esp], ebp
xor eax, edi
lea esp, [esp + 0x18]
jmp 0x4b380e
lea edi, [ecx + 0x10]
jmp 0x4b37f2
mov dword [esp + 0x11], ebp
mov word [esp + 0xe], sp
lea esp, [esp + 2]
and edi, ebp
push edx
jmp 0x4b37a2
push ebx
pushal
bswap eax
mov dh, 0x52
jmp 0x4b3821
xor ebx, eax
mov dword [edi], eax
bts eax, edx
neg ax
jmp 0x4b37da
xor eax, dword [ecx]
sub esp, 8
mov di, word [esp]
xchg dword [esp + 3], edi
lea esp, [esp + 8]
jmp 0x4b37b1
mov di, word [esp]
bsf bp, ax
mov dword [esp + 0x10], ecx
clc
clc
sub esp, 8
jmp 0x4b3d5b
pop ebx
stc
xor eax, ebx
mov dword [ecx + 0x14], ebx
call fcn.004b3a7f
mov dword [esp + 1], ecx
lea esp, [esp + 8]
popal
lea ebx, [ebx + 8]
mov eax, dword [ebx]
jmp 0x4b3ad6
Function at 0x4b98b3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
mov dword [esp + 9], ebp
mov dword [esp + 3], esi
jmp 0x4b9b97
lea esp, [esp + 2]
lea esp, [esp + 4]
inc eax
stc
jmp 0x4b98f0
push esp
add esp, 3
lea esp, [esp + 1]
test edx, edx
push esp
jmp 0x4b9901
push dword [esp]
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0x4b9c90
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
mov dword [esp + 0x44], eax
call fcn.004b99ec
push edi
salc
inc esp
and ebx, esi
imul eax, edi, 0xb858796e
inc esi
ret 0x1387
mov eax, 0x1387c246
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub esp, 0x1e
jmp 0x4b9a32
lea esp, [esp + 0x20]
add dword [esp + 8], ecx
mov eax, ecx
bt ecx, esp
inc cl
jmp 0x4b9a4d
lea esp, [esp + 4]
jne 0x4b96ee
je 0x4b9704
push dword [esp]
pop dword [esp]
lea esp, [esp + 8]
call fcn.00487158
xchg dh, dl
jmp 0x4b9d11
movzx ecx, byte [esi + 9]
xchg edi, eax
xchg di, dx
bsf ax, si
stc
jmp 0x4b9cde
mov byte [esi + 0x59], cl
bsf cx, si
mov edi, dword [esp]
jmp 0x4b9d49
mov byte [esi + 0x58], al
lea ecx, [edi*4]
mov cx, word [esp]
lea edi, [esi - 0x8d]
lea ecx, [edx + edi]
jmp 0x4b9ccb
movzx eax, byte [ecx]
mov edx, 0xd3f55bb4
not ch
bswap edi
jmp 0x4b9cf4
mov byte [esi + 0x5a], dl
bswap edi
xchg edi, edx
movzx eax, byte [esi + 0xb]
jmp 0x4b9d30
not di
mov cx, word [esp]
jmp 0x4b9e31
movzx edx, byte [esi + 0xa]
bswap eax
mov ch, bh
inc eax
mov di, sp
jmp 0x4b9d1f
mov al, 0x8e
rdtsc
lea edx, [ebx + ebx]
mov byte [esi + 0x5c], cl
call fcn.004b9d6f
mov byte [esi + 0x5b], al
dec di
mov edx, dword [esp]
movzx ecx, byte [esi + 0xc]
jmp 0x4b9d91

Function at 0x4b991a
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp + 1]
mov dword [esp + 3], esi
lea esp, [esp + 2]
lea esp, [esp + 8]
je 0x4b9704
call fcn.004b9858
push dword [esp + 2]
jmp 0x4b9897

Function at 0x4bced1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 5], ecx
xchg dh, dl
mov edx, eax
jmp 0x4bceac

Function at 0x4bd0a9
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [esi*4]
pop dx
lea esp, [esp + 2]
jmp 0x4bd1e6
clc
bsf dx, si
jmp 0x494846
clc
bsf dx, si
jmp 0x494846
mov dword [ebp], ebx
lea edx, reloc.MSVCRT.dll_strncpy
bts edx, edi
je 0x4bd17e
jne 0x4bd15d
lea eax, [edx*4]
mov dx, 0x83b9
jmp 0x4bd243
mov dx, word [esp + 4]
jmp 0x4bd260
sub ebp, 4
sub esp, 0xe
jge 0x4bd229
mov dx, word [esp + 4]
rdtsc
stc
jmp 0x4bd2c1
rdtsc
stc
lea esp, [esp + 2]
jmp 0x4bd2a7
mov dword [ebp], ebx
mov al, ah
mov eax, edx
not edx
mov al, 0xe
jmp 0x494846
lea esp, [esp + 2]
jmp 0x4bd2a7
Function at 0x56c89b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cl, 0xaa
btc eax, edi
push word [esp + 0x2a]
lea esp, [esp + 0x41]
not ah
mov cl, 0xc2
jmp 0x56c87b
clc
mov dl, dh
xchg ecx, edx
neg cx
mov edx, 0x7754cd06
jmp 0x56c801
add esp, 1
adc edx, ecx
mov cx, word [esp]
mov dx, ax
mov byte [esp], bh
jmp 0x56c88d
mov ax, word [esp]
push edx
pop word [esp]
shl edx, 0x15
mov dx, word [esp]
neg ecx
jmp 0x56c84c
bts eax, ebx
mov cx, si
mov eax, esi
rdtsc
neg cx
setp cl
jmp 0x56c862
mov eax, 0xe8cf133c
inc ax
push esp
call 0x56c89b
sub al, byte [esi + 0x6602246c]
mov dword [esp + 3], edi
lea edx, [ecx + ebx]
jmp 0x56c932
bswap ecx
mov word [esp + 1], bx
btc edx, ebx
mov eax, esp
add esp, 4
xchg dword [esp], ecx
jmp 0x56c909
pop dword [esp]
mov ecx, dword [esp + 1]
mov dl, 0xc
xchg dword [esp], ecx
push dword [esp + 3]
rdtsc
jmp 0x56c8cd
dec ax
mov word [esp + 1], bx
sub esp, 0x1e
inc ch
cmc
pop dx
jmp 0x56c945
mov edx, dword [esp + 0x19]
lea edx, reloc.MSVCRT.dll_strncpy
lea edx, [esi + 0xd5]
jmp 0x56c95b
setbe cl
rdtsc
cmc
xchg cl, ch
xchg word [esp + 2], cx
xchg byte [esp + 2], ch
jmp 0x56c8f5
and cl, bh
mov dx, si
mov dword [esp + 3], esi
lea esp, [esp + 9]
push word [esp + 0xb]
rdtsc
jmp 0x56c91a
push dword [esp + 0xc]
lea ecx, [edx + edx]
bswap eax
xchg word [esp + 1], dx
mov dl, dh
jmp 0x56c9d9
not eax
mov byte [esp + 5], dh
pop dword [esp + 6]
mov ax, 0x1927
pop cx
mov dx, word [esp]
call fcn.0056c9ba
or dword [edx], reloc.MSVCRT.dll_strncpy
and dword [edi + reloc.MSVCRT.dll_strncpy], ebp
inc edx
std
int3
pop edx
mov eax, ebx
mov ax, word [esp + 3]
not ch
xchg word [esp + 5], dx
pop edx
jmp 0x56c97f
push dword [esp + 0xc]
add esp, 9
push word [esp + 6]
xchg dx, ax
btc ecx, edi
pop edx
jmp 0x56c9a8

Function at 0x56cc24
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf ax, ax
rdtsc
mov ax, bx
add esp, 6
xor dl, ch
mov dx, 0x892d
jmp 0x56cc2f
lea eax, [edx + esi]
btr edx, edx
neg ax
jmp 0x56cc09
xchg dh, al
lea ecx, [eax + 0x69]
mov cl, ch
pop dword [esp + 8]
mov ch, 0x18
not ch
jmp 0x56cc77
xchg ecx, eax
xchg dx, ax
lea ecx, [edx + ebp]
mov ax, 0x3827
mov edx, 0xd3b22338
lea esp, [esp + 0x10]
jmp 0x56ce82
add esp, 6
lea ecx, [eax*4]
pop dx
pop ecx
lea esp, [esp]
inc edx
jmp 0x56ccd7
sete dh
lea esp, [esp]
bswap edx
sub esp, 0xc
mov dword [esp + 8], ebp
dec cx
jmp 0x56cd9c

Function at 0x56f50c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push dword [esp + 0xb]
mov dword [esp + 0xe], eax
jmp 0x56f712
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x56f53d
push dword [esp + 2]
mov dword [esp + 0x94], edi
lea esp, [esp + 0x94]
mov eax, dword fs:[0x30]
jmp 0x56f553
pop dword [esp + 1]
lea esp, [esp + 0xc]
pushal
push edx
lea esp, [esp + 0x41]
push edx
jmp 0x56f697

Function at 0x43b657
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
dec eax
call fcn.0043b685
add eax, 0x8002e9a6
xor dword [ebx], edi
mov esi, eax
dec esi
inc ebx
add esi, 0x4aef6203
add eax, 0xc9bc3421
inc esi
cmp ebx, ecx
jne fcn.0043b657
and eax, esi
inc eax
ret
Function at 0x52d880
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc8000]
push edi
or ebp, 0xffffffff
jmp 0x52d8a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52d8a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d898
mov eax, 1
add ebx, ebx
jne 0x52d8bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52d8cc
jne 0x52d8eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d8eb
dec eax
add ebx, ebx
jne 0x52d8d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52d8b0
add ebx, ebx
jne 0x52d8e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52d93d
xor ecx, ecx
sub eax, 3
jb 0x52d903
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52d972
sar eax, 1
mov ebp, eax
jmp 0x52d90e
add ebx, ebx
jne 0x52d90e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d8dc
inc ecx
add ebx, ebx
jne 0x52d91c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52d8dc
add ebx, ebx
jne 0x52d929
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52d91e
jne 0x52d93a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52d91e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52d95c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52d94e
jmp 0x52d89e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52d95c
add edi, ecx
jmp 0x52d89e
pop esi
mov edi, esi
mov ecx, 0x3e0b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52d97a
cmp byte [edi], 0x1e
jne 0x52d97a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52d97f
lea edi, [esi + 0x12a000]
mov eax, dword [edi]
or eax, eax
je 0x52d9f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x134168]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x134280]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52d9ac
mov ecx, edi
jns 0x52d9db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x134284]
or eax, eax
je 0x52d9f1
mov dword [ebx], eax
add ebx, 4
jmp 0x52d9c9
call dword [esi + 0x134294]
mov ebp, dword [esi + 0x134288]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52da2b
sub esp, 0xffffff80
jmp 0x474da0
Function at 0x40ce70
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x40cf24
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0040ce00
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x40cefd
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40cf30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x40cf4b
test ebp, ebp
je 0x40cf4b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x40cf53
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x40cf93
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x40cfef
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40cfea
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x40cfd5
test dl, dl
je 0x40cfd1
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x40cfd5
add ecx, 2
add eax, 2
test dl, dl
jne 0x40cfb5
xor eax, eax
jmp 0x40cfda
sbb eax, eax
or eax, 1
test eax, eax
je 0x40cff9
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x40cfa2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x40d010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.0040ce70
test eax, eax
jne 0x40d028
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.0040cf30
mov esi, eax
test esi, esi
jne 0x40d05e
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40d078
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret