joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cdc2
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000ce1b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1000cdff
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x1000ce16
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000ce16
push 0x444
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x1000cee1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 1
mov dword [ebp - 0x30], 0x16db6d03
mov dword [ebp - 0x34], 0xaf8b5131
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1000ce53
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 8], 0xfffffffc
jmp 0x1000ce63
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffffc
jle 0x1000ceca
mov dword [ebp - 0x38], 0x5223fa3a
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x40], 1
mov dword [ebp - 0xc], 0x82bdb979
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jge 0x1000ce96
mov dword [ebp - 0x14], 1
jmp 0x1000ce9a
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
jle 0x1000ceab
mov dword [ebp - 0x18], 1
jmp 0x1000ceaf
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 1
jne 0x1000cebe
mov dword [ebp - 0x1c], 1
jmp 0x1000cec2
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x1000ce5c
push 0x153e
push dword [ebp - 0x2c]
push 0x216c
push 0
call fcn.1000a306
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1000cee5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000cf1b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 1
push 0x7535
push 0x5af7
push dword [ebp - 8]
call fcn.1000cf88
add esp, 0x14
jmp 0x1000cf84
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000cf61
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1000cf84
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1000cf84
push 0x23f2
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov esp, ebp
pop ebp
ret

Function at 0x1000d13f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000d173
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0x1e6b
push 0
push dword [ebp - 0xc]
call fcn.100108a5
add esp, 0x10
jmp 0x1000d203
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000d1c1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000d1bf
push 0xfa6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1000d203
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x13
jmp 0x1000d1ef
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xfffffff0
jle 0x1000d203
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
je 0x1000d201
jmp 0x1000d203
jmp 0x1000d1e4
mov esp, ebp
pop ebp
ret
Function at 0x10010321
Capabilities:
Get graphical window text
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100104a0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x34], 0x228f
cmp dword [ebp - 0x34], 0xae4
jge 0x10010478
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
and dword [ebp - 0x3c], 0
and dword [ebp - 0x38], 0
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x10007c58
call fcn.1005459b
add esp, 0x1c
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 4]
mov dword [ebp - 0x24], edx
and dword [ebp - 0x10], 0
jmp 0x100103ab
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x24]
jge 0x100103c6
mov eax, dword [ebp - 0x28]
inc eax
push eax
push 0x10007bb0
call fcn.100549f9
pop ecx
pop ecx
jmp 0x100103a4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
jmp 0x100103d5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 4]
jge 0x100103ee
push dword [ebp - 0x28]
push 0x10007bb0
call fcn.100549f9
pop ecx
pop ecx
jmp 0x100103ce
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jge 0x1001046d
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
cdq
idiv ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
cdq
idiv ecx
mov dword [ebp - 0x2c], edx
and dword [ebp - 0x1c], 0
jmp 0x10010427
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
jge 0x10010442
mov eax, dword [ebp - 0x30]
inc eax
push eax
push 0x10007bb0
call fcn.100549f9
pop ecx
pop ecx
jmp 0x10010420
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
jmp 0x10010451
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
cmp dword [ebp - 0x20], eax
jge 0x1001046d
push dword [ebp - 0x30]
push 0x10007bb0
call fcn.100549f9
pop ecx
pop ecx
jmp 0x1001044a
push 0x10007bc4
call fcn.100549f9
pop ecx
push 0x1fbc
push 0
push 0x3ed8
push 0x662c
push 0x117e
push 0x7df1
push dword [ebp - 0x40]
call fcn.10010a2a
add esp, 0x1c
jmp 0x100104d1
lea eax, [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x100104bd
push 0x444
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x100104d1
push 0xfa6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret
Function at 0x1001b4e7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001b513
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push dword [ebp - 8]
call fcn.1001b57d
add esp, 0xc
jmp 0x1001b579
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001b54f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001b54d
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1001b579
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001b579
push 0xfa6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret
Function at 0x1001f85a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f8bf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001f898
push 0x124
push 0
push 0
push 0
push 0xb57
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x1001f8bd
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001f8bd
push 0x13a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x1001f8d7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x112
push 1
call fcn.1000fb74
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10028698
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100286c6
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x1002871f
mov dword [ebp - 0xc], 0xb80be39e
push 0x3e16
push 1
push 0
lea eax, [ebp - 0xc]
push eax
push 0x3808
push 0x2e2d
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0x5884
call fcn.1001f041
add esp, 0x28
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002871d
push 0x13a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x100286bb
mov esp, ebp
pop ebp
ret
Function at 0x10045cdd
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
pop ebp
ret
Function at 0x1004c42e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1006c2f7
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
je 0x1004c552
cmp byte [ebx + 0x45], 0
je 0x1004c552
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x1004c478
xor al, al
jmp 0x1004c554
xor eax, eax
mov dword [esp + 0x24], 0xf
push eax
push 8
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], eax
mov byte [esp + 0x18], al
call fcn.1003061c
and dword [esp + 0x34], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
cmp ecx, 0x10
lea eax, [esp + 0xc]
mov ecx, dword [ebx + 0x40]
lea edi, [esp + 0x10]
push eax
mov eax, dword [esp + 0x24]
lea esi, [esp + 0x14]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1004c4dd
dec eax
je 0x1004c4e1
dec eax
dec eax
je 0x1004c53f
xor bl, bl
jmp 0x1004c541
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
mov edx, dword [esp + 0x10]
cmp ecx, 0x10
mov esi, dword [esp + 0xc]
cmovae eax, edx
sub esi, eax
je 0x1004c520
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [esp + 0x14]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100564b9
add esp, 0x10
cmp esi, eax
jne 0x1004c4d9
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
cmp byte [ebx + 0x45], 0
je 0x1004c53f
test esi, esi
jne 0x1004c4a3
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.1002d58d
jmp 0x1004c49b
mov bl, 1
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1002d74b
mov al, bl
jmp 0x1004c554
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10065ba7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10071750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100590a8
mov dword [ebp - 0x14], eax
cmp dword [0x1065ed28], esi
jne 0x10065c9a
push 0x800
push esi
push 0x10006904
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10065c27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10065d7a
push esi
push esi
push 0x10006904
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10065d7a
push 0x1000691c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10065d7a
push eax
call ebx
push 0x10006928
push edi
mov dword [0x1065ed28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006938
push edi
mov dword [0x1065ed2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000694c
push edi
mov dword [0x1065ed30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065ed38], eax
test eax, eax
je 0x10065c97
push 0x10006968
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1065ed34], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10065cbf
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10065cb2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10065cd4
push 4
pop eax
jmp 0x10065d7c
cmp dword [ebp - 0x14], esi
je 0x10065cd4
push dword [0x1065ed28]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10065cb9
mov eax, dword [0x1065ed34]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10065d32
cmp dword [0x1065ed38], edi
je 0x10065d32
push eax
call ebx
push dword [0x1065ed38]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10065d32
test eax, eax
je 0x10065d32
call ecx
test eax, eax
je 0x10065d27
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10065d27
test byte [ebp - 8], 1
jne 0x10065d32
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10065d62
mov eax, dword [0x1065ed2c]
cmp eax, edi
je 0x10065d5f
push eax
call ebx
test eax, eax
je 0x10065d5f
call eax
mov esi, eax
test esi, esi
je 0x10065d5f
mov eax, dword [0x1065ed30]
cmp eax, edi
je 0x10065d5f
push eax
call ebx
test eax, eax
je 0x10065d5f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1065ed28]
call ebx
test eax, eax
je 0x10065d7a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10065d7c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100570b1
mov esp, ebp
pop ebp
ret
Function at 0x1004d530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1004d53f
pop dword [ebp - 0x34]
mov eax, 0x1004d53f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xecde8954
add dword [ebp - 0x44], 0x6173bbf7
mov dword [ebp - 0x40], 0x9901c51
sub dword [ebp - 0x40], 0xd75cd00c
mov dword [ebp - 0x3c], 0x9b5d38de
sub dword [ebp - 0x3c], 0x4f10f4b0
mov dword [ebp - 0x38], 0x12bcaf45
sub dword [ebp - 0x38], 0x12bcaf45
lea eax, [ebp - 0x44]
push eax
mov eax, 0xb837277
sub eax, 0xfb7a1177
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xb63fe2b2
sub dword [ebp - 0x44], 0x41cd795c
mov dword [ebp - 0x40], 0x24369232
add dword [ebp - 0x40], 0x1d35cf43
mov dword [ebp - 0x3c], 0xbea0c885
sub dword [ebp - 0x3c], 0x5b315c19
mov dword [ebp - 0x38], 0x543b2a12
add dword [ebp - 0x38], 0xabc4d5ee
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xaf5928f4
add eax, 0x60b0381c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x5af74
push 0
call eax
mov ecx, 0x4a22
xor edx, edx
add edx, eax
mov ebx, 0x92c4fc60
sub ebx, 0x82b81c60
add ebx, dword [ebp - 0x34]
mov edi, 0xc95a42c9
sub edi, 0xe2d4c78b
mov esi, dword [ebx]
xor dword [ebp - 8], 0x928c9a30
add esi, edi
xor dword [ebp - 4], 0x10e03326
mov dword [edx], esi
add dword [ebp - 0x28], edx
add edx, 0xc414207a
sub edx, 0xc4142076
add ebx, 0x47926a75
add ebx, 0xb86d958f
loop 0x1004d658
add eax, 0xf350cd0f
add eax, 0xcb04e4c
mov ebx, eax
add eax, 5
mov ecx, 0xe436e2f9
add ecx, 0x2bc91d07
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x100858d9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100858ea
pop esi
ret
push ebx
push edi
push esi
call fcn.1004d530
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1004d530
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10085912
push ebx
push esi
push edi
call fcn.10067180
add esp, 0xc
push 0
call fcn.1004d530
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x54f530
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x118000]
push edi
or ebp, 0xffffffff
jmp 0x54f552
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54f559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f548
mov eax, 1
add ebx, ebx
jne 0x54f56b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54f57c
jne 0x54f59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f59b
dec eax
add ebx, ebx
jne 0x54f588
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54f560
add ebx, ebx
jne 0x54f597
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54f5ed
xor ecx, ecx
sub eax, 3
jb 0x54f5b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54f622
sar eax, 1
mov ebp, eax
jmp 0x54f5be
add ebx, ebx
jne 0x54f5be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f58c
inc ecx
add ebx, ebx
jne 0x54f5cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54f58c
add ebx, ebx
jne 0x54f5d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54f5ce
jne 0x54f5ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54f5ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54f60c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54f5fe
jmp 0x54f54e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54f60c
add edi, ecx
jmp 0x54f54e
pop esi
mov edi, esi
mov ecx, 0x3916
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54f62a
cmp byte [edi], 0x14
jne 0x54f62a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54f62f
lea edi, [esi + 0x14c000]
mov eax, dword [edi]
or eax, eax
je 0x54f69e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x150a28]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x150b10]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54f65c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x150b18]
or eax, eax
je 0x54f698
mov dword [ebx], eax
add ebx, 4
jmp 0x54f679
call dword [esi + 0x150b14]
mov ebp, dword [esi + 0x150b1c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54f6d2
sub esp, 0xffffff80
jmp 0x471578
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x403e57
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp byte [edi], 0x25
jne 0x403ed4
lea eax, [edi + 1]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
call fcn.00403093
lea eax, [ebp + eax - 0x105]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x25
jne 0x403ebc
and byte [eax], 0
push dword [ebp + 0x1c]
lea eax, [ebp - 0x104]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push eax
push 0x4016ec
call esi
pop edi
pop esi
leave
ret 0x18

Function at 0x4041d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40422c
push esi
push esi
push esi
lea eax, [ebp - 4]
push esi
push eax
push esi
lea eax, [ebp + 8]
push esi
push eax
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404223
cmp dword [ebp + 8], esi
jne 0x404223
cmp dword [ebp - 4], esi
jne 0x404223
push 1
pop esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 8

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1c493b53
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x44ae2076
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219