joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54ccf0
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x59dffc
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x27c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28c]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x74], ax
lea eax, [esp + 0x76]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0x6c]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, str.MacromedFlashFlashHelperService.exe
mov dword [esp + 0x34], 0
xor eax, eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x54cd90
sub ecx, edx
sar ecx, 1
push ecx
push str.MacromedFlashFlashHelperService.exe
lea ecx, [esp + 0x2c]
call fcn.00404a80
mov dword [esp + 0x284], 0
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
cmp word [esp + 0x6c], ax
jne 0x54cdeb
xor ecx, ecx
jmp 0x54ce01
lea ecx, [esp + 0x6c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x54cdf2
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x14]
call fcn.00404a80
mov byte [esp + 0x284], 1
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x10]
lea ecx, [esp + 0x58]
call fcn.004b2290
add esp, 4
mov byte [esp + 0x284], 3
cmp dword [esp + 0x20], 8
jb 0x54ce48
push dword [esp + 0xc]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
mov byte [esp + 0x284], 4
cmp dword [esp + 0x38], 8
jb 0x54ce7a
push dword [esp + 0x24]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
lea ecx, [esp + 0x54]
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
call fcn.004b2f30
test al, al
jne 0x54cea2
xor bl, bl
jmp 0x54cf0a
lea edx, [esp + 0x54]
lea ecx, [esp + 0x3c]
call fcn.004b8b90
mov byte [esp + 0x284], 5
cmp dword [esp + 0x4c], 0
jne 0x54cec2
xor bl, bl
jmp 0x54ced8
lea eax, [esp + 0x3c]
cmp esi, eax
je 0x54ced6
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00404960
mov bl, 1
mov byte [esp + 0x284], 4
cmp dword [esp + 0x50], 8
jb 0x54cef3
push dword [esp + 0x3c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
mov dword [esp + 0x284], 0xffffffff
cmp dword [esp + 0x68], 8
jb 0x54cf28
push dword [esp + 0x54]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x68], 7
mov word [esp + 0x54], ax
mov al, bl
mov dword [esp + 0x64], 0
mov ecx, dword [esp + 0x27c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.00564de8
add esp, 0x27c
ret 4
Function at 0x54cf70
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x59e051
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x264]
mov dword fs:[0], eax
mov esi, dword [esp + 0x274]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x5c], ax
lea eax, [esp + 0x5e]
push eax
call fcn.0056cbb0
add esp, 0xc
lea eax, [esp + 0x54]
push eax
push 0
push 0
push 0x29
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, str.MacromedFlashFlashHelperService.exe
mov dword [esp + 0x1c], 0
xor eax, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x54d010
sub ecx, edx
sar ecx, 1
push ecx
push str.MacromedFlashFlashHelperService.exe
lea ecx, [esp + 0x14]
call fcn.00404a80
mov dword [esp + 0x26c], 0
xor eax, eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
cmp word [esp + 0x54], ax
jne 0x54d06b
xor ecx, ecx
jmp 0x54d081
lea ecx, [esp + 0x54]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x54d072
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x2c]
call fcn.00404a80
mov byte [esp + 0x26c], 1
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 0x28]
lea ecx, [esp + 0x40]
call fcn.004b2290
add esp, 4
mov byte [esp + 0x26c], 3
cmp dword [esp + 0x38], 8
jb 0x54d0c8
push dword [esp + 0x24]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
mov byte [esp + 0x26c], 4
cmp dword [esp + 0x20], 8
jb 0x54d0fa
push dword [esp + 0xc]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
call fcn.004b2f30
test al, al
jne 0x54d122
xor bl, bl
jmp 0x54d12f
mov edx, esi
lea ecx, [esp + 0x3c]
call fcn.0054c280
mov bl, al
mov dword [esp + 0x26c], 0xffffffff
cmp dword [esp + 0x50], 8
jb 0x54d14d
push dword [esp + 0x3c]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
mov word [esp + 0x3c], ax
mov al, bl
mov dword [esp + 0x4c], 0
mov ecx, dword [esp + 0x264]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x250]
xor ecx, esp
call fcn.00564de8
add esp, 0x264
ret 4
Function at 0x559330
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x59f60c
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x1c]
push 0x5c1ea0
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00404a80
mov dword [esp + 0x50], 0
mov eax, dword [0x7e23f4]
test al, 1
jne 0x5593cf
or eax, 1
mov dword [0x7e23f4], eax
mov byte [esp + 0x50], 1
mov dword [0x7e23f0], 0
call fcn.004c1de0
push 0x59ffb0
call fcn.00565027
add esp, 4
mov byte [esp + 0x50], 0
lea eax, [esp + 0x18]
mov ecx, 0x7e23f0
push eax
call fcn.004c1fa0
mov edi, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x5593fb
push dword [esp + 0x18]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
push 0xb
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], eax
push str.crypt32.dll
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], eax
mov word [esp + 0x38], ax
call fcn.00404a80
mov dword [esp + 0x50], 2
mov eax, dword [0x7e23f4]
test al, 1
jne 0x55947a
or eax, 1
mov dword [0x7e23f4], eax
mov byte [esp + 0x50], 3
mov dword [0x7e23f0], 0
call fcn.004c1de0
push 0x59ffb0
call fcn.00565027
add esp, 4
mov byte [esp + 0x50], 2
lea eax, [esp + 0x30]
mov ecx, 0x7e23f0
push eax
call fcn.004c1fa0
mov ebp, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x5594a6
push dword [esp + 0x30]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
test edi, edi
je 0x559539
test ebp, ebp
je 0x559539
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push ebp
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x55d530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59fb16
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], 0x5c20d4
mov dword [edi + 4], 0
mov dword [esp + 0x14], edi
mov byte [edi + 8], 0
mov dword [esp + 0x38], 0
mov dword [edi], 0x5c20e4
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [esp + 0x38], 2
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x20], 0
mov dword [edi], 0x5c20f4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 3
push 8
movq qword [esp + 0x28], xmm0
call fcn.0056590a
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x38], 4
test eax, eax
je 0x55d604
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
call fcn.00559030
jmp 0x55d606
xor eax, eax
mov byte [esp + 0x38], 3
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.00553b80
mov byte [esp + 0x38], 5
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.0055d7d0
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0xc]
call fcn.0055df20
mov byte [esp + 0x38], 3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x55d677
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x55d677
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x55d677
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [esp + 0x38], 2
mov esi, dword [esp + 0x18]
test esi, esi
je 0x55d6b5
push dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0055ce50
push esi
call fcn.00564de3
add esp, 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00564de8
add esp, 0x2c
ret
Function at 0x57b468
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5e173c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0056ce9c
mov dword [ebp - 0x14], eax
cmp dword [0x7e166c], esi
jne 0x57b55b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x57b4e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x57b63b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x57b63b
push 0x5c1e28
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x57b63b
push eax
call ebx
push 0x5a6e7c
push edi
mov dword [0x7e166c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x7e1670], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x7e1674], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x7e167c], eax
test eax, eax
je 0x57b558
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x7e1678], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x57b580
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x57b573
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x57b595
push 4
pop eax
jmp 0x57b63d
cmp dword [ebp - 0x14], esi
je 0x57b595
push dword [0x7e166c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x57b57a
mov eax, dword [0x7e1678]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x57b5f3
cmp dword [0x7e167c], edi
je 0x57b5f3
push eax
call ebx
push dword [0x7e167c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x57b5f3
test eax, eax
je 0x57b5f3
call ecx
test eax, eax
je 0x57b5e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x57b5e8
test byte [ebp - 8], 1
jne 0x57b5f3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x57b623
mov eax, dword [0x7e1670]
cmp eax, edi
je 0x57b620
push eax
call ebx
test eax, eax
je 0x57b620
call eax
mov esi, eax
test esi, esi
je 0x57b620
mov eax, dword [0x7e1674]
cmp eax, edi
je 0x57b620
push eax
call ebx
test eax, eax
je 0x57b620
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x7e166c]
call ebx
test eax, eax
je 0x57b63b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x57b63d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00564de8
mov esp, ebp
pop ebp
ret
Function at 0x40b118
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea esi, [esi]
lea edi, [edi]
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0040b058
mov dword [esp], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
call sym._read
cmp eax, 0xffffffff
mov ebx, eax
jne 0x40b164
call sym.__errno
cmp dword [eax], 4
je 0x40b138
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40d220
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov edx, eax
je 0x40d250
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov dword [esp], edx
mov dword [esp + 4], eax
call sym.___mingwthr_key_dtor
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret

Function at 0x40d400
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x44b540]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x40d440
mov dword [ebx + 0x30], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call sym.___mingwthr_key_dtor
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x2c], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x4248a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e46c
and dword [ebp - 4], 0
cmp dword [0x44c388], 0
mov ebx, eax
jne 0x424956
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424a07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424a07
push eax
call fcn.0041e3fa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44c388], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44c38c], eax
call esi
push eax
call fcn.0041e3fa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44c390], eax
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c398], eax
test eax, eax
je 0x424956
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e3fa
pop ecx
mov dword [0x44c394], eax
mov eax, dword [0x44c394]
cmp eax, ebx
je 0x4249ae
cmp dword [0x44c398], ebx
je 0x4249ae
push eax
call fcn.0041e475
push dword [0x44c398]
mov esi, eax
call fcn.0041e475
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4249ae
test edi, edi
je 0x4249ae
call esi
test eax, eax
je 0x4249a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4249a5
test byte [ebp - 0xc], 1
jne 0x4249ae
or dword [ebp + 0x10], 0x200000
jmp 0x4249e7
mov eax, dword [0x44c38c]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4249e7
mov eax, dword [0x44c390]
cmp eax, ebx
je 0x4249e7
push eax
call fcn.0041e475
pop ecx
test eax, eax
je 0x4249e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44c388]
call fcn.0041e475
pop ecx
test eax, eax
je 0x424a07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424a09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7ba67fc9
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7dbf5236
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x52a910
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x92000]
push edi
or ebp, 0xffffffff
jmp 0x52a932
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52a939
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52a928
mov eax, 1
add ebx, ebx
jne 0x52a94b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52a940
jne 0x52a95c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52a940
xor ecx, ecx
sub eax, 3
jb 0x52a970
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52a9e2
mov ebp, eax
add ebx, ebx
jne 0x52a97b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x52a988
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x52a9ac
inc ecx
add ebx, ebx
jne 0x52a998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52a98d
jne 0x52a9a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52a98d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52a9cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52a9bd
jmp 0x52a92e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52a9cc
add edi, ecx
jmp 0x52a92e
pop esi
mov edi, esi
mov ecx, 0x37ef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52a9ea
cmp byte [edi], 0x13
jne 0x52a9ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52a9ef
lea edi, [esi + 0x127000]
mov eax, dword [edi]
or eax, eax
je 0x52aa67
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12ed2c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12edf0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52aa1c
mov ecx, edi
jns 0x52aa4b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12edf8]
or eax, eax
je 0x52aa61
mov dword [ebx], eax
add ebx, 4
jmp 0x52aa39
call dword [esi + 0x12edf4]
mov ebp, dword [esi + 0x12edfc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52aa9b
sub esp, 0xffffff80
jmp 0x46ef3e
Function at 0x1002bc05
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1002b500
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002bc35
xor eax, eax
jmp 0x1002bd6f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002bc53
xor eax, eax
jmp 0x1002bd6f
push 0x7cc3
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0x1419
push 1
call fcn.1002b05b
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1002bc7b
xor eax, eax
jmp 0x1002bd6f
lea eax, [ebp - 0x10]
push eax
push 0x27e9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
push 0x59d0
lea eax, [ebp - 4]
push eax
call fcn.1002b547
add esp, 0x20
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 1
call fcn.1002b5dd
add esp, 0x10
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002b63f
add esp, 0xc
push dword [ebp - 4]
call fcn.1002af1c
pop ecx
test eax, eax
jne 0x1002bceb
xor eax, eax
jmp 0x1002bd6f
push 1
push dword [ebp - 4]
push 0x188b
push 0x1959
call fcn.10024e3e
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002bd57
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002bd21
xor eax, eax
jmp 0x1002bd6f
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002bd3a
xor eax, eax
jmp 0x1002bd6f
lea eax, [ebp - 4]
push eax
push 1
push 0x6b4b
push 0x27b0
push 0x21e
call fcn.1002b69d
add esp, 0x14
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002bd68
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002bd6c
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x5c0950
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x61d089
call fcn.0049c675
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.0049baf4
movsx ecx, ax
and ecx, 0x8000
je 0x5c099f
mov dword [ebp - 0xc4], 1
jmp 0x5c09a9
mov dword [ebp - 0xc4], 0
mov al, byte [ebp - 0xc4]
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.0049baf4
mov esp, ebp
pop ebp
ret