joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5239dd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 4

Function at 0x524a2a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x18
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0xf
je 0x524a58
cmp eax, 5
je 0x524a8f
mov dword [ebp - 0x20], 0
jmp 0x524b44
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
jmp 0x524b44
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
call fcn.0044134c
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
call fcn.00441382
mov dword [ebp - 0x14], eax
jmp 0x524b1a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf
je 0x524ad3
mov eax, dword [ebp - 0x1c]
cmp eax, 0x11
je 0x524ad3
xor eax, eax
jmp 0x524ad6
xor eax, eax
inc eax
cmp eax, 0
je 0x524b0f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
push eax
call fcn.0044ebdc
pop edx
xchg edx, eax
cmp eax, edx
sete al
xor ah, ah
cwde
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
xor al, 1
cmp eax, 0
je 0x524b32
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
jae 0x524b32
jmp 0x524b36
xor eax, eax
jmp 0x524b39
xor eax, eax
inc eax
cmp eax, 0
jne 0x524aae
mov eax, dword [0x576ddc]
mov dword [ebp - 0x18], eax
mov eax, 4
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
xchg edx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
leave
ret 8

Function at 0x5254a4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 8]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 5
je 0x5254d2
cmp eax, 0xf
je 0x525500
mov eax, 0
jmp 0x525747
push dword [ebp + 8]
call fcn.0044134c
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
call fcn.00441278
mov dword [ebp - 0x10], eax
mov eax, 0
mov edx, dword [ebp - 0x10]
cmp eax, edx
jne 0x5254fe
mov eax, 0
jmp 0x525747
jmp 0x525512
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0
jle 0x525744
Function at 0x529780
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
and eax, 0x1000000
cmp eax, 0
setne al
xor ah, ah
cwde
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
je 0x5297d8
cmp eax, 0x11
je 0x5297e8
cmp eax, 0x12
je 0x529803
mov eax, 0
jmp 0x52981c
push 3
push dword [ebp - 0xc]
call dword [sym.imp.USER32.DLL_MapVirtualKeyW]
mov dword [ebp - 0x10], eax
jmp 0x52981c
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x5297f9
mov eax, 0xa3
jmp 0x5297fe
mov eax, 0xa2
mov dword [ebp - 0x10], eax
jmp 0x52981c
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x529814
mov eax, 0xa5
jmp 0x529819
mov eax, 0xa4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x529823
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, 0
mov dword [ebp - 0xc], 0
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529859
mov eax, 0x10000000
mov dword [ebp - 0xc], 0x10000000
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529878
mov eax, dword [ebp - 0xc]
or eax, 0x20000000
mov dword [ebp - 0xc], eax
push 0x12
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529897
mov eax, dword [ebp - 0xc]
or eax, 0x40000000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
xor al, 1
cmp eax, 0
je 0x52991f
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x5298c2
mov eax, dword [ebp - 0xc]
or eax, 0x2000000
mov dword [ebp - 0xc], eax
push 2
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x5298e1
mov eax, dword [ebp - 0xc]
or eax, 0x800000
mov dword [ebp - 0xc], eax
push 4
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x529900
mov eax, dword [ebp - 0xc]
or eax, 0x1000000
mov dword [ebp - 0xc], eax
push 5
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52991f
mov eax, dword [ebp - 0xc]
or eax, 0x400000
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x531dcf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x582a5c]
xor al, 1
cmp eax, 0
je 0x531e17
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x531e06
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052fbcb
leave
ret 8
Function at 0x539a6a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xd0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x25
jne 0x539ab0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x10]
jmp 0x539ad7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
fld dword [eax + 4]
fstp dword [ebp - 0xc]
mov eax, dword [ebp - 0xd4]
fld dword [eax + 8]
fstp dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0x1c]
mov eax, 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
push 0x3f800000
fld dword [esp]
add esp, 4
fstp dword [ebp - 0x30]
jmp 0x539c35
Function at 0x53dad5
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [0x582904], eax
push 0
call dword [sym.imp.USER32.DLL_GetDC]
mov dword [0x58290c], eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
mov dword [0x582910], eax
mov eax, 0x11c
xchg edx, eax
mov eax, dword [0x582920]
mov dword [eax], edx
push dword [0x582920]
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
mov eax, dword [0x582920]
mov eax, dword [eax + 4]
cmp eax, 5
jne 0x53db43
mov eax, dword [0x582920]
mov eax, dword [eax + 8]
cmp eax, 1
jge 0x53db43
jmp 0x53db47
xor eax, eax
jmp 0x53db4a
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x53db58
call fcn.0053d88e
call fcn.0053e7f5
mov dword [0x582a64], eax
mov eax, dword [0x582920]
mov eax, dword [eax + 4]
cmp eax, 0xa
setge al
xor ah, ah
cwde
mov dword [0x582a58], eax
mov eax, dword [0x582920]
mov eax, dword [eax + 4]
cmp eax, 0xa
jge 0x53dbc7
mov eax, dword [0x582920]
mov eax, dword [eax + 4]
cmp eax, 6
jl 0x53dbb5
mov eax, dword [0x582920]
mov eax, dword [eax + 8]
cmp eax, 2
jl 0x53dbb5
jmp 0x53dbb9
xor eax, eax
jmp 0x53dbbc
xor eax, eax
inc eax
cmp eax, 0
jne 0x53dbc7
xor eax, eax
jmp 0x53dbca
xor eax, eax
inc eax
mov dword [0x582a5c], eax
mov eax, dword [0x582920]
mov eax, dword [eax + 4]
cmp eax, 6
setl al
xor ah, ah
cwde
mov dword [0x582a60], eax
push 0x1a
push dword [0x581690]
call fcn.0044fe05
mov dword [ebp - 0xc], eax
mov eax, 3
shl eax, 0x13
mov edx, eax
mov eax, 0x27
or eax, edx
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x582920]
mov eax, dword [eax + 8]
shl eax, 8
xchg edx, eax
mov eax, dword [0x582920]
mov eax, dword [eax + 4]
or eax, edx
and eax, 0xffff
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
call fcn.0053d8db
mov eax, dword [0x582a60]
xor al, 1
cmp eax, 0
je 0x53dc56
call fcn.005259e1
push 0
call fcn.0053d681
push dword [0x582910]
call fcn.00528449
push 0x1b
push dword [0x581690]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x582920]
mov eax, dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
mov eax, dword [0x582920]
mov eax, dword [eax + 0xc]
cmp eax, 0x55f0
setge al
xor ah, ah
cwde
mov dword [0x582a54], eax
push 0x1c
push dword [0x581690]
call fcn.0044fe05
mov dword [ebp - 0x10], eax
mov eax, 0xb
xchg edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
mov eax, dword [0x582920]
mov al, byte [eax + 0x11a]
and eax, 0xff
mov edx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 8], edx
call fcn.0053d9c4
mov eax, dword [0x582a58]
cmp eax, 0
je 0x53dd30
push 0x5856ac
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x53dd30
push 0x84
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x582ab4], eax
call fcn.0053dd47
mov dword [0x582ab0], eax
push 0x53dabb
call fcn.004a1680
push dword [0x5828c0]
call fcn.00525894
leave
ret
Function at 0x53e323
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
push dword [ebp + 8]
call fcn.0053c7a7
mov dword [ebp - 0x14], eax
mov eax, 0
mov edx, dword [ebp - 0x14]
cmp eax, edx
jne 0x53e349
jmp 0x53e436
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e365
push 0
push dword [ebp + 0xc]
push 0xe
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e378
push 0
push dword [ebp + 0xc]
push 0x149
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0
jl 0x53e436
push dword [ebp + 8]
call fcn.00456229
add eax, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e3b7
push 2
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.00447c38
mov eax, dword [ebp - 0x18]
cmp eax, 0
jne 0x53e3ce
push dword [ebp - 0xc]
call fcn.004460b6
jmp 0x53e436
mov eax, dword [ebp - 0x18]
inc eax
shl eax, 2
push eax
push dword [ebp - 0xc]
call fcn.00433262
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e400
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 0xd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e414
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push 0x148
push dword [ebp - 0x14]
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0
call fcn.0043299b
push dword [0x582148]
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0043951e
leave
ret 8
Function at 0x53e43a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e463
push 0
push dword [ebp + 0xc]
push 0xe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e479
push 0
push dword [ebp + 0xc]
push 0x149
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, 0
jl 0x53e560
push 3
push dword [ebp + 8]
call fcn.0053c647
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x53e4b5
push 2
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00447c38
mov eax, dword [ebp - 0xc]
cmp eax, 0
jne 0x53e4cc
push dword [ebp - 0x10]
call fcn.004460b6
jmp 0x53e560
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x10]
call fcn.00433262
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x53e501
push dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x53e518
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push 0x148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0
call fcn.0043299b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.0052882f
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x53e559
push dword [0x582148]
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0043951e
push 1
call fcn.0048b0b2
leave
ret 8

Function at 0x53ecdd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [0x58291c]
cmp eax, 0
je 0x53ecf9
call dword [sym.imp.USER32.DLL_ReleaseCapture]
call fcn.0053beac
push 0xa
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov eax, dword [0x582a5c]
xor al, 1
cmp eax, 0
je 0x53ed30
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052fbcb
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
push dword [ebp + 8]
call fcn.0053e17f
leave
ret 4
Function at 0x540ccf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x581e38]
cmp eax, edx
jne 0x540d0c
mov eax, dword [0x582a50]
sub eax, 0xc
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov edx, eax
mov eax, 2
and eax, edx
cmp eax, 0
je 0x540d0c
jmp 0x540d10
xor eax, eax
jmp 0x540d13
xor eax, eax
inc eax
cmp eax, 0
je 0x540d37
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x540d31
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0053d1f2
jmp 0x540d37
call dword [sym.imp.USER32.DLL_DestroyCaret]
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x540d5c
mov eax, dword [ebp + 0x14]
mov edx, dword [0x581e38]
cmp eax, edx
jne 0x540d55
mov eax, 8
jmp 0x540d5a
mov eax, 5
jmp 0x540d61
mov eax, 0
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x582a5c]
xor al, 1
cmp eax, 0
je 0x540d8e
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0052fbcb
mov eax, dword [ebp + 0x14]
mov edx, dword [0x581e64]
cmp eax, edx
jne 0x540dbe
mov eax, dword [0x582a50]
sub eax, 4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov dword [ebp + 8], eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebp + 0x14]
mov edx, dword [0x581e54]
cmp eax, edx
jne 0x540dd5
push 9
push dword [ebp + 8]
call fcn.00531e8d
leave
ret 0x10
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x19942682
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x91d02fc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x415b90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x415baa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415bb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415ba0
mov eax, 1
add ebx, ebx
jne 0x415bc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415bb8
jne 0x415bd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415bb8
xor ecx, ecx
sub eax, 3
jb 0x415be8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415c5a
mov ebp, eax
add ebx, ebx
jne 0x415bf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415c00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x415c24
inc ecx
add ebx, ebx
jne 0x415c10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x415c05
jne 0x415c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415c05
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x415c44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x415c35
jmp 0x415ba6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x415c44
add edi, ecx
jmp 0x415ba6
pop esi
mov edi, esi
mov ecx, 0x128
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x415c62
cmp byte [edi], 2
jne 0x415c62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x415c67
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x415cd6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x155f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15670]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415c94
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x15678]
or eax, eax
je 0x415cd0
mov dword [ebx], eax
add ebx, 4
jmp 0x415cb1
call dword [esi + 0x15674]
mov ebp, dword [esi + 0x1567c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x415d0a
sub esp, 0xffffff80
jmp 0x4059d0
Function at 0x40143f
Capabilities:
Allocate or change rwx memory
Enumerate pe sections
Execute shellcode via indirect call
Get file size
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x828
push ebx
push esi
push edi
sub eax, eax
mov word [ebp - reloc.comctl32.dll_PropertySheetA], ax
push 0x400
xor edi, edi
lea eax, [ebp - 0x828]
push eax
push edi
pop ebx
push edi
pop esi
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x828]
push edi
push 0x8000000
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
pop edi
cmp edi, 0xffffffff
je 0x4014e0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
pop ebx
mov ecx, ebx
mov dword [ebp - 0x14], eax
call fcn.00401720
push eax
pop esi
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4014c8
cmp dword [ebp - 0x20], ebx
je 0x4014d9
push esi
pop ecx
call fcn.00401790
xor esi, esi
sub ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ecx
mov ecx, esi
call fcn.00401271
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00401213
mov edi, dword [ebp - 0xc]
push reloc.winmm.dll_joyGetDevCapsW
mov eax, dword [edi + 0x3c]
add eax, edi
mov dword [ebp - 0x18], eax
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x1c], eax
add eax, 0x18
push 0x3000
add eax, ebx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push eax
pop ebx
mov dword [ebp - 8], ebx
or ebx, ebx
je 0x401650
push reloc.winmm.dll_joyGetDevCapsW
push edi
pop edx
push ebx
pop ecx
jmp section..htext
push edi
pop ecx
call fcn.00401790
mov ecx, esi
call fcn.00401790
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x41d326
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41d354
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41d372
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041d28c
jmp 0x41d372
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41d372
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041d28c
test edi, edi
mov eax, edi
jne 0x41d35c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219