joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d6d2e7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x6d6d2e8d
pop dword [ebp - 0xc]
mov eax, 0xcc1028c5
sub eax, 0x5ea2fa38
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x608fbe05
add dword [ebp - 0x1c], 0xedc28746
mov dword [ebp - 0x18], 0x949c0801
sub dword [ebp - 0x18], 0x6268bbbc
mov dword [ebp - 0x14], 0xe2cb514e
add dword [ebp - 0x14], 0x6980f2e0
mov dword [ebp - 0x10], 0x6dc90d
add dword [ebp - 0x10], 0xff9236f3
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x9f170dfc
sub eax, 0x31a9cd84
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x681caca4
add dword [ebp - 0x1c], 0xc55bcb2
mov dword [ebp - 0x18], 0xe3ac72e8
sub dword [ebp - 0x18], 0xa2401173
mov dword [ebp - 0x14], 0xc45551cd
add dword [ebp - 0x14], 0x9f1a1a9f
mov dword [ebp - 0x10], 0x41f067c
sub dword [ebp - 0x10], 0x41f067c
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xda0affec
add eax, 0x93624088
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x38ab7
push 0
call eax
mov ecx, 0x93e64930
add ecx, 0x6c1a0739
xor esi, esi
add esi, eax
mov edi, 0x14314e57
sub edi, 0xa6c3b857
add edi, dword [ebp - 0xc]
mov edx, 0x2a45b945
xor dword [ebp - 4], 0x226c71c5
mov ebx, dword [edi]
xor dword [ebp - 8], edx
sub ebx, edx
add dword [ebp - 8], 0xa19e472d
mov dword [esi], ebx
add esi, 4
add edi, 0xa8109b65
add edi, 0x57ef649f
loop 0x6d6d2fab
add eax, 0xfccc8bb7
sub eax, 0xfccb5740
xor ebx, ebx
add ebx, eax
add eax, 0x7abb9b21
sub eax, 0x7abb9b1c
mov ecx, 0x6d6d0000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1002ed10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
and esi, 0xfffffffc
je 0x1002edcb
lea eax, [esi - 1]
mov edi, eax
shr edi, 2
add edi, 1
mov ecx, edi
and ecx, 3
cmp eax, 0xc
jae 0x1002ed40
xor eax, eax
xor ebx, ebx
jmp 0x1002ed8b
and edi, 0xfffffffc
neg edi
xor eax, eax
xor ebx, ebx
nop dword [eax]
rol eax, 5
xor eax, dword [edx + ebx]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 4]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 8]
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, dword [edx + ebx + 0xc]
imul eax, eax, 0x9e3779b9
add ebx, 0x10
add edi, 4
jne 0x1002ed50
test ecx, ecx
je 0x1002eda9
add ebx, edx
shl ecx, 2
xor edi, edi
rol eax, 5
xor eax, dword [ebx + edi]
imul eax, eax, 0x9e3779b9
add edi, 4
cmp ecx, edi
jne 0x1002ed96
mov edi, dword [ebp + 0xc]
cmp esi, edi
jae 0x1002edc6
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
add esi, 1
cmp edi, esi
jne 0x1002edb0
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x1002eda9

Function at 0x1002ff22
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1002ff31
pop dword [ebp - 0x10]
mov eax, 0x107fed66
add eax, 0xff8311cb
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x39c78
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x5200
xor edx, edx
add edx, eax
mov ebx, 0xf450f4ae
add ebx, 0x1bb76952
add ebx, dword [ebp - 0x10]
mov esi, 0x14ab651d
mov edi, dword [ebx]
xor dword [ebp - 0xc], eax
add edi, esi
add dword [ebp - 0xc], 0x684e03f0
mov dword [edx], edi
xor dword [ebp - 4], ebx
add edx, 4
add ebx, 0xaf90a517
add ebx, 0x506f5aed
loop 0x1002ff81
add eax, 0xcd7e66dd
sub eax, 0xcd7d2c0a
mov ebx, eax
add eax, 5
mov ecx, sym.mozglue.dll_Ordinal_0
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40288e
pop dword [ebp - 0x48]
mov eax, 0x40288e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x16dd4d1e
add dword [ebp - 0x58], 0x3774f82d
mov dword [ebp - 0x54], 0x7036e75c
add dword [ebp - 0x54], 0xc1fc64e9
mov dword [ebp - 0x50], 0x343b5bdf
sub dword [ebp - 0x50], 0xe7ef17b1
mov dword [ebp - 0x4c], 0x17b83192
add dword [ebp - 0x4c], 0xe847ce6e
lea eax, [ebp - 0x58]
push eax
mov eax, 0x1a7d16e7
sub eax, 0x1a3ca683
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xf30d3471
sub dword [ebp - 0x58], 0x7e9acb1b
mov dword [ebp - 0x54], 0xd44db045
sub dword [ebp - 0x54], 0x92e14ed0
mov dword [ebp - 0x50], 0x7be439b8
sub dword [ebp - 0x50], 0x1874cd4c
mov dword [ebp - 0x4c], 0xcdd433f6
sub dword [ebp - 0x4c], 0xcdd433f6
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xa20dc8a1
sub eax, 0xa1cd57f9
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3882a
push 0
call eax
mov ecx, 0x7aaa563d
sub ecx, 0x7aaa0695
xor edx, edx
add edx, eax
mov ebx, 0xf5f796fb
add ebx, 0xa496905
add ebx, dword [ebp - 0x48]
mov esi, 0xfc4db227
add esi, 0xb7e6ed2c
sub dword [ebp - 0x10], eax
mov edi, dword [ebx]
xor dword [ebp - 0x20], 0xa8a9d19
sub edi, esi
sub dword [ebp - 0x2c], 0x3d912375
mov dword [edx], edi
add edx, 0xc7b51bcc
sub edx, 0xc7b51bc8
add ebx, 0xf2b1a9ac
sub ebx, 0xf2b1a9a8
loop 0x4029ad
add eax, 0x735215a2
add eax, 0x8caf1bd1
mov ebx, eax
add eax, 5
mov ecx, 0x8dd4b5de
add ecx, 0x726b4a22
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1002e8a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jg 0x1002db63
add al, 0x20
mov ah, ah
jmp 0x1002db63
nop dword [esp]
pop ebx
leave
jmp 0x10018294
xchg bh, bh
add esp, 0xfffffef4
xchg ch, ch
jmp 0x1003bf24
push esi
cmp dword [ebp + 8], 0
je 0x10031fd1
jmp 0x10031fc9
nop
jl 0x1002db63
nop
jmp 0x1001d912
push edx
nop dword [eax]
push edi
jmp 0x10004d34
xor eax, eax
jmp 0x10024d68
mov bl, bl
call fcn.1000d55c
xor eax, dword [ebp + 0xc]
jmp 0x1003be34
xor eax, dword [ebp + 0x10]
test eax, eax
je 0x1002c241
jmp 0x10033f7c
mov al, al
xchg al, al
pop edx
jmp 0x1003969b
add esi, 4
inc ecx
call fcn.1000d55c
jmp 0x1000b33f
mov eax, ecx
shl eax, 1
add eax, dword [ebx + 0x24]
jmp 0x100256cd
cmp dword [ebp + 0x14], 0
xchg dh, dh
jne 0x1003daf3
jmp 0x10024164
movzx eax, word [eax]
nop
shl eax, 2
jmp 0x1002c3ed
mov ah, ah
xchg dl, dl
mov ebx, edi
jmp 0x1002ce14
ret 0x10
mov dl, dl
xchg ch, ch
add esi, edi
jmp 0x1002e894
mov ecx, dword [ecx + 0xc]
nop dword [esp]
mov ecx, dword [ecx + 0xc]
jmp 0x100393d6
add ebx, edi
push dword [ebx + 0x10]
pop dword [ebp - 0x10c]
jmp 0x10010c9b
nop dword [eax]
xchg ah, ah
pop eax
jmp 0x1000ac6c
jne 0x1003ebbb
mov edi, dword [ebp + 0xc]
nop dword [esp]
jmp 0x1003ebb5
cmp al, 0x5b
nop dword [edi]
mov ch, ch
jmp 0x10002389
lea edi, [ebp - 0x104]
push edi
nop
jmp 0x10024d58
mov eax, dword [eax]
mov dl, dl
add eax, edi
jmp 0x10024d64
push dword [ebx + 0x18]
pop dword [ebp - 0x108]
mov esi, dword [ebx + 0x20]
jmp 0x1001b868
lea edx, [ecx + 0x30]
mov edx, dword [edx]
or edx, edx
jmp 0x1001d0bc
nop dword [ebp]
pop esi
pop edi
jmp 0x1000bc69
mov dl, dl
add eax, edi
nop
jmp 0x10010d3d
xchg bl, bl
nop
jne 0x1003bedb
jmp 0x1001cf87
mov eax, dword [esi]
or eax, eax
mov ah, ah
jmp 0x1003a7fb
mov dl, dl
mov eax, dword [ebx + 8]
mov ebx, dword [ebx]
jmp 0x100318a3
sub eax, dword [ebp - 0x10c]
jmp 0x1002c3ed
sub ecx, 1
jmp 0x1000df04
add eax, dword [ebx + 0x1c]
add eax, edi
mov al, al
jmp 0x1002411c
nop dword [esp]
add ebx, dword [ebx + 0x3c]
lea ebx, [ebx + 0x78]
jmp 0x1002bca9
stosb byte es:[edi], al
mov cl, cl
xchg cl, cl
jmp 0x10031427
xor ecx, ecx
jmp 0x10033f7c
push ebp
xchg bl, bl
jmp 0x100382c5
mov bh, bh
mov al, al
jmp 0x10008690
inc ebx
test ax, ax
xchg ah, ah
jmp 0x10025c10
nop dword [eax]
nop dword [edx]
nop dword [edi]
jmp 0x1001cbae
mov edi, dword [ebp + 8]
jmp 0x1001828d
mov ecx, dword fs:[0x30]
jmp 0x1001be2d
cmp dword [ebp - 0x108], ecx
jne 0x10028b7d
nop
jmp 0x1002ed26
cmp al, 0x40
mov al, al
nop dword [esi]
jmp 0x100061a3
xchg dh, dh
mov ebp, esp
nop
jmp 0x10004685
nop
xchg cl, cl
mov ecx, dword [ecx]
jmp 0x1001e760
pop ecx
xchg ch, ch
nop
jmp 0x10002fbd
jne 0x1003a806
jmp 0x10008690
add eax, edi
jmp 0x1000ccb1
xchg bh, bh
jne 0x100393d9
mov edi, dword [ecx + 0x18]
jmp 0x10018289
xchg ah, ah
xchg cl, cl
mov ax, word [edx + ebx*2]
jmp 0x100348c3
push ebx
push ecx
mov cl, cl
jmp 0x1000826e
mov eax, dword [ebp + 0x10]
mov dh, dh
jmp 0x1002c236
nop
jmp 0x1001828d
xor ebx, ebx
jmp 0x1003bed7
Function at 0x1011fb59
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1020a858], 0
push esi
push edi
je 0x1011fbe1
cmp dword [0x1020a99c], 0xfffffffe
jne 0x1011fbcd
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x1011fbe1
mov edi, 0x10212fc8
push edi
call dword [fcn.101b7438]
cmp dword [0x10212fe0], 0
jne 0x1011fbe5
push 0
push 0
push 0x1011fbeb
call fcn.10190dd7
add esp, 0xc
mov dword [0x10212fe0], eax
test eax, eax
je 0x1011fbbd
cmp eax, 0xffffffff
je 0x1011fbbd
push 0xffffffffffffffff
push eax
call dword [0x101b733c]
mov dword [0x1020a99c], esi
jmp 0x1011fbc4
and dword [0x10212fe0], 0
push edi
call dword [fcn.101b7434]
jmp 0x1011fbe1
mov eax, dword [ebp + 8]
mov dword [0x1020a99c], eax
cmp eax, 0xffffffff
jne 0x1011fbe1
and dword [0x10212fe0], 0
pop edi
pop esi
pop ebp
ret
call fcn.1005462c
int3

Function at 0x101901d9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [fcn.101b73c8]
test eax, eax
je 0x10190218
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10190218
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10190218
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10190218
cmp dword [ecx + 0x74], 0xe
jbe 0x10190218
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x101a61e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x101a620d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x101a620d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x404dd8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x404de7
pop dword [ebp - 0x24]
mov eax, 0xff00728e
add eax, 0x13fdb59
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd7ee797e
add dword [ebp - 0x34], 0x7663cbcd
mov dword [ebp - 0x30], 0x743da604
add dword [ebp - 0x30], 0xbdf5a641
mov dword [ebp - 0x2c], 0xdc66b017
sub dword [ebp - 0x2c], 0x901a6be9
mov dword [ebp - 0x28], 0xb6cef41c
add dword [ebp - 0x28], 0x49310be4
lea eax, [ebp - 0x34]
push eax
mov eax, 0x8322dd1d
sub eax, 0x82e0aca9
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x3a695a5a
sub dword [ebp - 0x34], 0xc5f6f104
mov dword [ebp - 0x30], 0xf11309a8
add dword [ebp - 0x30], 0x505957cd
mov dword [ebp - 0x2c], 0x8ca36202
sub dword [ebp - 0x2c], 0x2933f596
mov dword [ebp - 0x28], 0xcde4e4ad
sub dword [ebp - 0x28], 0xcde4e4ad
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xa75d04fc
sub eax, 0xa71ad3d8
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3b0e1
push 0
call eax
mov ecx, 0x8a70420b
sub ecx, 0x8a7004ca
xor edi, edi
add edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x24]
mov esi, 0xd74c6ad6
add dword [ebp - 0x20], esi
mov edx, dword [ebx]
sub dword [ebp - 8], 0x53a4ac48
xor edx, esi
xor dword [ebp - 0x10], ecx
mov dword [edi], edx
mov dword [ebp - 0x1c], 0x8c5d1cf1
add edi, 4
add ebx, 0xaa6d63bc
add ebx, 0x55929c48
loop 0x404eff
add eax, 0xe7d7
xor ebx, ebx
add ebx, eax
add eax, 0x417a0de3
add eax, 0xbe85f222
mov ecx, 0x94f692a
sub ecx, 0x90f692a
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x10002412
Capabilities:
Check mutex on windows

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esp + 0xc], 1
push esi
jne 0x100024a5
push edi
push 0x100237c0
mov dword [0x100237dc], ebx
mov dword [0x100237d8], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push eax
push str.KcMV3D_EVE_TerminateApp__6d
mov esi, 0x100236b8
push esi
call fcn.1000aab9
add esp, 0xc
push esi
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x100237bc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000247e
push dword [0x100237bc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
call edi
push eax
push str.KcMV3D_MTX_WindowRegister__6d
mov esi, 0x100235b8
push esi
call fcn.1000aab9
add esp, 0xc
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x100237b8], eax
pop edi
jmp 0x1000251b
cmp dword [esp + 0x10], ebx
jne 0x1000251b
mov eax, dword [0x100237bc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x100024d4
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x100237bc]
call esi
mov eax, dword [0x100237b8]
cmp eax, ebx
je 0x100024e0
push eax
call esi
push 0x100237c0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [0x100237dc]
cmp ecx, ebx
je 0x10002503
mov esi, ecx
call sym.KcMV3Da.dll_public:_void___thiscall_CMV3DBmp::destructor_void_
push esi
call fcn.1000a566
pop ecx
mov ecx, dword [0x100237d8]
cmp ecx, ebx
je 0x1000251b
mov esi, ecx
call sym.KcMV3Da.dll_public:_void___thiscall_CMV3DBmp::destructor_void_
push esi
call fcn.1000a566
pop ecx
xor eax, eax
pop esi
inc eax
pop ebx
ret 0xc
Function at 0x10009483
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x24
lea eax, [ebp - 0x28]
push 0
push eax
call fcn.1000aa30
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x28]
sub eax, 0
je 0x100094dd
dec eax
je 0x100094d9
dec eax
je 0x100094cc
dec eax
jne 0x1000950c
movzx eax, word [ebp - 8]
dec eax
je 0x10009508
dec eax
dec eax
je 0x10009508
dec eax
je 0x10009508
dec eax
dec eax
je 0x100094d9
sub eax, 3
jmp 0x100094d9
movzx eax, word [ebp - 8]
sub eax, 0x5248
je 0x100094d9
dec eax
dec eax
mov cl, 2
jmp 0x1000950e
movzx eax, word [ebp - 8]
sub eax, 3
je 0x1000950c
dec eax
je 0x1000950c
dec eax
je 0x10009508
dec eax
je 0x100094f9
cmp word [ebp - 8], 6
seta cl
jmp 0x10009504
mov eax, dword [ebp - 6]
shr eax, 8
cmp al, 5
setae cl
inc cl
jmp 0x1000950e
mov cl, 1
jmp 0x1000950e
xor cl, cl
mov al, byte [ebp - 0x14]
imul cl
leave
ret

Function at 0x1000aaaa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022160]
jne 0x1000aab4
repz ret
jmp fcn.100107c1
Function at 0x1001b92a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000f9f1
and dword [ebp - 4], 0
cmp dword [0x10024208], 0
mov ebx, eax
jne 0x1001b9db
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001ba8c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001ba8c
push eax
call fcn.1000f97f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10024208], eax
call esi
push eax
call fcn.1000f97f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1002420c], eax
call esi
push eax
call fcn.1000f97f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10024210], eax
call esi
push eax
call fcn.1000f97f
pop ecx
mov dword [0x10024218], eax
test eax, eax
je 0x1001b9db
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000f97f
pop ecx
mov dword [0x10024214], eax
mov eax, dword [0x10024214]
cmp eax, ebx
je 0x1001ba33
cmp dword [0x10024218], ebx
je 0x1001ba33
push eax
call fcn.1000f9fa
push dword [0x10024218]
mov esi, eax
call fcn.1000f9fa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001ba33
test edi, edi
je 0x1001ba33
call esi
test eax, eax
je 0x1001ba2a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001ba2a
test byte [ebp - 0xc], 1
jne 0x1001ba33
or dword [ebp + 0x10], 0x200000
jmp 0x1001ba6c
mov eax, dword [0x1002420c]
cmp eax, ebx
je 0x1001ba6c
push eax
call fcn.1000f9fa
pop ecx
test eax, eax
je 0x1001ba6c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001ba6c
mov eax, dword [0x10024210]
cmp eax, ebx
je 0x1001ba6c
push eax
call fcn.1000f9fa
pop ecx
test eax, eax
je 0x1001ba6c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10024208]
call fcn.1000f9fa
pop ecx
test eax, eax
je 0x1001ba8c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001ba8e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x237038f4
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x51c359f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x7040f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x236000]
push edi
jmp 0x70410a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x704111
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x704100
mov eax, 1
add ebx, ebx
jne 0x704123
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x704134
jne 0x704153
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x704153
dec eax
add ebx, ebx
jne 0x704140
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x704118
add ebx, ebx
jne 0x70414f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7041a5
xor ecx, ecx
sub eax, 3
jb 0x70416b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7041da
sar eax, 1
mov ebp, eax
jmp 0x704176
add ebx, ebx
jne 0x704176
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x704144
inc ecx
add ebx, ebx
jne 0x704184
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x704144
add ebx, ebx
jne 0x704191
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x704186
jne 0x7041a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x704186
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7041c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7041b6
jmp 0x704106
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7041c4
add edi, ecx
jmp 0x704106
pop esi
mov edi, esi
mov ecx, 0x8f0a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7041e2
cmp byte [edi], 0x36
jne 0x7041e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7041e7
lea edi, [esi + 0x300000]
mov eax, dword [edi]
or eax, eax
je 0x70425f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3605e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x360778]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x704214
mov ecx, edi
jns 0x704243
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x36077c]
or eax, eax
je 0x704259
mov dword [ebx], eax
add ebx, 4
jmp 0x704231
call dword [esi + 0x36078c]
mov ebp, dword [esi + 0x360780]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x704293
sub esp, 0xffffff80
jmp 0x537c90