joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003016
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb ah, dl
imul edx, dword [eax + eax*4 - 0x5b], 0xfffff8d4
add byte [eax - 0x72a5b], al
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54

Function at 0x10003044
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.10001bbb
cmp ch, byte [ecx + 0x7a]
ljmp 0xffff

Function at 0x10003b77
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10001b80
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x10003b9e
jmp 0x1000355d
cmp dword [ebp - 0x37c], 0
je 0x10003bac
jmp 0x10003c61
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x10003c05
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x10003c0a
jmp 0x1000355d
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x10003c51
lea eax, [ebp - 0x714]
push eax
call fcn.10001bcb
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10001b80
add esp, 0xc
mov dword [ebp - 0x37c], eax
invalid
cmp dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0
jne 0x10003d0b

Function at 0x10004aa1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x10004acf
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10004aed
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.10004a0b
jmp 0x10004aed
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10004aed
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.10004a0b
test edi, edi
mov eax, edi
jne 0x10004ad7
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x10029094]
test ecx, ecx
je 0x10004bb0
jmp 0x10004aa0
ret 8

Function at 0x1000d0d6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10027d38]
jne 0x1000d0e0
repz ret
jmp fcn.10012afc
Function at 0x10011b85
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10027f58]
je 0x10011ba0
inc edi
cmp edi, 0x17
jb 0x10011b91
cmp edi, 0x17
jae 0x10011d20
push ebp
push 3
call fcn.100179e3
cmp eax, 1
pop ecx
je 0x10011cec
push 3
call fcn.100179e3
test eax, eax
pop ecx
jne 0x10011bd4
cmp dword [0x1002af3c], 1
je 0x10011cec
cmp ebx, 0xfc
je 0x10011d1f
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1002b218
push ebp
call fcn.10016be2
add esp, 0xc
test eax, eax
je 0x10011c0a
push esi
push esi
push esi
push esi
push esi
call fcn.10012c0a
add esp, 0x14
push 0x104
mov esi, 0x1002b231
push esi
push 0
mov byte [0x1002b335], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10011c4e
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10016be2
add esp, 0xc
test eax, eax
je 0x10011c4e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10012c0a
add esp, 0x14
push esi
call fcn.10016c50
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10011c93
push esi
call fcn.10016c50
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1002b52c
push 0x100222f4
sub ecx, eax
push ecx
push eax
call fcn.10017930
add esp, 0x14
test eax, eax
je 0x10011c93
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10012c0a
add esp, 0x14
jmp 0x10011c95
xor esi, esi
push 0x100222f0
push ebx
push ebp
call fcn.100178bf
add esp, 0xc
test eax, eax
je 0x10011cb5
push esi
push esi
push esi
push esi
push esi
call fcn.10012c0a
add esp, 0x14
push dword [edi*8 + 0x10027f5c]
push ebx
push ebp
call fcn.100178bf
add esp, 0xc
test eax, eax
je 0x10011cd7
push esi
push esi
push esi
push esi
push esi
call fcn.10012c0a
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10017702
add esp, 0xc
jmp 0x10011d1f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10011d1f
cmp ebp, 0xffffffff
je 0x10011d1f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10027f5c]
push dword [esi]
call fcn.10016c50
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10017702
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.1000fdf2
xor ebx, ebx
cmp dword [0x1002b9bc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x100177d8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x100178b8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x100178b8
push eax
call fcn.1000fd84
mov dword [esp], 0x10022bf8
push edi
mov dword [0x1002b9bc], eax
call esi
push eax
call fcn.1000fd84
mov dword [esp], 0x10022be4
push edi
mov dword [0x1002b9c0], eax
call esi
push eax
call fcn.1000fd84
mov dword [0x1002b9c4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1000d20b
test eax, eax
pop ecx
pop ecx
je 0x100177a6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012c0a
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x100177d8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.1000fd84
cmp eax, ebx
pop ecx
mov dword [0x1002b9cc], eax
je 0x100177d8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000fd84
pop ecx
mov dword [0x1002b9c8], eax
mov eax, dword [0x1002b9c8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001785d
cmp dword [0x1002b9cc], ecx
je 0x1001785d
push eax
call fcn.1000fdfb
push dword [0x1002b9cc]
mov esi, eax
call fcn.1000fdfb
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001785d
cmp edi, ebx
je 0x1001785d
call esi
cmp eax, ebx
je 0x1001782a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001782a
test byte [ebp - 0x18], 1
jne 0x1001785d
lea eax, [ebp - 0x10]
push eax
call fcn.1000d242
test eax, eax
pop ecx
je 0x10017845
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012c0a
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10017854
or dword [ebp + 0x10], 0x200000
jmp 0x10017898
or dword [ebp + 0x10], 0x40000
jmp 0x10017898
mov eax, dword [0x1002b9c0]
cmp eax, dword [ebp - 8]
je 0x10017898
push eax
call fcn.1000fdfb
cmp eax, ebx
pop ecx
je 0x10017898
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10017898
mov eax, dword [0x1002b9c4]
cmp eax, dword [ebp - 8]
je 0x10017898
push eax
call fcn.1000fdfb
cmp eax, ebx
pop ecx
je 0x10017898
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1002b9bc]
call fcn.1000fdfb
cmp eax, ebx
pop ecx
je 0x100178b8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100178ba
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001e6be
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10027d38]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1001e653
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1000d980
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1001e70d
cmp dword [ebp - 0x1c], 5
jb 0x1001e725
jmp 0x1001e721
cmp dword [ebp - 0x10], 1
jne 0x1001e725
cmp dword [ebp - 0x1c], 4
ja 0x1001e721
jne 0x1001e725
cmp dword [ebp - 0x18], 0
jbe 0x1001e725
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100236a8
call fcn.1001e544
test eax, eax
jge 0x1001e746
mov byte [0x10029044], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000d0d6
add ebp, 0x78
leave
ret
Function at 0x406b95
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x406bd0
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x406bb7
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x406bc8
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x406bd2
inc edi
add eax, 0x28
cmp edi, esi
jb 0x406bad
xor eax, eax
pop edi
pop esi
ret

Function at 0x406e1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x406e43
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
invalid
inc ebp
invalid

Function at 0x407256
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40722c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40724a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
add byte [ebx + 0x108c794], cl
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4072a8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40728f
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x407298
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4072a2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x407284
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40720e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4072f5
dec eax
je 0x4072ec
sub eax, 3
je 0x4072e3
mov dword [ebp - 4], 0x40
jmp 0x407312
mov dword [ebp - 4], 4
jmp 0x4072f8
mov dword [ebp - 4], 0x20
jmp 0x4072f8
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
invalid
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x407344
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
push dword [esi - 0x60]
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00406b55
cmp edi, dword [ebx + 0x1475ff54]
push 1
push esi
call edi
mov eax, esi
jmp 0x407350
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407e84
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
call fcn.00406b55
push esp
or cl, ch
inc esp
lea eax, [ebp - 0x6dc]
push eax
call fcn.00406b65
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406b1a
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x408ce8
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00406ac6
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x407f62
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x407fab
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x407f55
call fcn.00406b55
or al, 0x30
xchg ebp, eax
xlatb
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00406b55
dec esp
inc ebx
or dword [esi], eax
lea eax, [ebp - 0x72c]
push eax
call fcn.00406b65
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00406b1a
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.00406b55
or dl, byte [ecx - 0x7a729a09]
call 0x5140806c
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.00406ac6
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
call fcn.00406b55
sub eax, 0x830d2213
movsd dword es:[edi], dword [esi]
add cl, bh
invalid
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b8e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x76000]
push edi
jmp 0x4b8e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b8e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8e80
mov eax, 1
add ebx, ebx
jne 0x4b8ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b8eb4
jne 0x4b8ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8ed3
dec eax
add ebx, ebx
jne 0x4b8ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b8e98
add ebx, ebx
jne 0x4b8ecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b8f25
xor ecx, ecx
sub eax, 3
jb 0x4b8eeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b8f5a
sar eax, 1
mov ebp, eax
jmp 0x4b8ef6
add ebx, ebx
jne 0x4b8ef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8ec4
inc ecx
add ebx, ebx
jne 0x4b8f04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b8ec4
add ebx, ebx
jne 0x4b8f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b8f06
jne 0x4b8f22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b8f06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b8f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b8f36
jmp 0x4b8e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b8f44
add edi, ecx
jmp 0x4b8e86
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b8f62
cmp byte [edi], 0x13
jne 0x4b8f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b8f67
lea edi, [esi + 0xb4000]
mov eax, dword [edi]
or eax, eax
je 0x4b8fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc0038]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc018c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b8f94
mov ecx, edi
jns 0x4b8fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc0190]
or eax, eax
je 0x4b8fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b8fb1
call dword [esi + 0xc01a0]
mov ebp, dword [esi + 0xc0194]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b9013
sub esp, 0xffffff80
jmp 0x4165c1

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x6b7a00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1aa000]
push edi
jmp 0x6b7a1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6b7a21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7a10
mov eax, 1
add ebx, ebx
jne 0x6b7a33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6b7a44
jne 0x6b7a63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7a63
dec eax
add ebx, ebx
jne 0x6b7a50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6b7a28
add ebx, ebx
jne 0x6b7a5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6b7ab5
xor ecx, ecx
sub eax, 3
jb 0x6b7a7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6b7aea
sar eax, 1
mov ebp, eax
jmp 0x6b7a86
add ebx, ebx
jne 0x6b7a86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7a54
inc ecx
add ebx, ebx
jne 0x6b7a94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6b7a54
add ebx, ebx
jne 0x6b7aa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6b7a96
jne 0x6b7ab2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6b7a96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6b7ad4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6b7ac6
jmp 0x6b7a16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6b7ad4
add edi, ecx
jmp 0x6b7a16
pop esi
mov edi, esi
mov ecx, 0x501f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6b7af2
cmp byte [edi], 0x22
jne 0x6b7af2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6b7af7
lea edi, [esi + 0x2b4000]
mov eax, dword [edi]
or eax, eax
je 0x6b7b6f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2c8550]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2c86cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6b7b24
mov ecx, edi
jns 0x6b7b53
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2c86d4]
or eax, eax
je 0x6b7b69
mov dword [ebx], eax
add ebx, 4
jmp 0x6b7b41
call dword [esi + 0x2c86d0]
mov ebp, dword [esi + 0x2c86d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6b7ba3
sub esp, 0xffffff80
jmp 0x4ba6cc
Function at 0x4035ab
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x403600
push dword [esp + 0x10]
push 0x40352a
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x60a7f8]
test esi, esi
je 0x403659
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x4035f8
cmp byte [esi + 0x10], 0
je 0x4035f8
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x4035d4
jmp 0x403659
mov esi, dword [0x60a7f8]
test esi, esi
je 0x403659
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x403652
cmp byte [esi + 0x11], 0
je 0x40362e
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x403645
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x60a7f8
call fcn.0040ef9f
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40360d
pop ebp
pop edi
pop esi
pop ebx
ret 4