joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046d8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x40473e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403c00
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402ac4
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404728
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404745
lea eax, [ebp - 0x10]
call fcn.004039b8
ret

Function at 0x40593c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403d88
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x405955
test al, 0x10
jne 0x405959
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4065b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4065e9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403aa8
jmp 0x4065f2
mov eax, ebx
mov edx, esi
call fcn.00403a0c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4065fc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40661d
mov al, byte [esp]
jmp 0x40661f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x406cb4
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x406b1c
mov eax, dword [0x564848]
cmp byte [eax], 0
je 0x406d30
mov eax, dword [0x5647a4]
call fcn.00402a40
call fcn.00402968
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00405a84
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x406d78
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x406d66
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x564784]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x565660]
call fcn.004040a8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x408548
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x408508
call fcn.00404950
xor eax, eax
push ebp
push 0x408653
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x408668
call fcn.0040593c
test al, al
jne 0x40857e
mov eax, 0x408668
call fcn.00405a68
mov eax, 0x40867c
call fcn.0040593c
test al, al
je 0x40859f
push 0
push 0x408688
push 0x40868c
push 0
call sub.user32.dll_MessageBoxA_1
mov edx, 0x409294
mov eax, 0x565798
mov ecx, 0xda2a8
call fcn.00403aa8
mov edx, dword [0x565798]
mov eax, 0x408698
call fcn.0040832c
mov eax, 0x40867c
call fcn.0040593c
test al, al
je 0x4085e4
push 0
push 0x408688
push 0x4086b0
push 0
call sub.user32.dll_MessageBoxA_1
mov edx, 0x4e353c
mov eax, 0x565798
mov ecx, 0x811fc
call fcn.00403aa8
mov edx, dword [0x565798]
mov eax, 0x4086bc
call fcn.0040832c
mov eax, 0x40867c
call fcn.0040593c
test al, al
je 0x408629
push 0
push 0x408688
push 0x4086d0
push 0
call sub.user32.dll_MessageBoxA_1
mov edx, 0x4086bc
mov eax, 0x408698
call fcn.004083ac
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40865a
ret
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x546a50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf0000]
push edi
jmp 0x546a6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x546a71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x546a60
mov eax, 1
add ebx, ebx
jne 0x546a83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x546a94
jne 0x546ab3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x546ab3
dec eax
add ebx, ebx
jne 0x546aa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x546a78
add ebx, ebx
jne 0x546aaf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x546b05
xor ecx, ecx
sub eax, 3
jb 0x546acb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x546b3a
sar eax, 1
mov ebp, eax
jmp 0x546ad6
add ebx, ebx
jne 0x546ad6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x546aa4
inc ecx
add ebx, ebx
jne 0x546ae4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x546aa4
add ebx, ebx
jne 0x546af1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x546ae6
jne 0x546b02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x546ae6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x546b24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x546b16
jmp 0x546a66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x546b24
add edi, ecx
jmp 0x546a66
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x546b42
cmp byte [edi], 0x11
jne 0x546b42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x546b47
lea edi, [esi + 0x13f000]
mov eax, dword [edi]
or eax, eax
je 0x546bbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b3d80]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b3efc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x546b74
mov ecx, edi
jns 0x546ba3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b3f00]
or eax, eax
je 0x546bb9
mov dword [ebx], eax
add ebx, 4
jmp 0x546b91
call dword [esi + 0x1b3f10]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x546bf0
cmp al, 0xef
ja 0x546be3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x546bc5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x546bd2
mov ebp, dword [esi + 0x1b3f04]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x546c24
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x431005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x60774711
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..reloc
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0xd5d5a67
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2ada624f
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2b926d45
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x42e006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3677369f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x42e0d2
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x54372c88
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4021a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x4021eb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x4021e4
test esi, esi
je 0x4021e4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4021c0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4023d0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402420
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4024f8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40245e
cmp eax, 4
jne 0x402480
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40246e
cmp edx, 4
je 0x40246e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004023d0
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x1002429b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100242aa
pop dword [ebp - 0x10]
mov eax, 0x1cd1f53b
add eax, 0xf3304d6f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x78a146d5
add dword [ebp - 0x20], 0xd5b0fe76
mov dword [ebp - 0x1c], 0xccff237a
sub dword [ebp - 0x1c], 0x9acbd735
mov dword [ebp - 0x18], 0x85919cf
add dword [ebp - 0x18], 0x43f32a5f
mov dword [ebp - 0x14], 0x41e961cf
sub dword [ebp - 0x14], 0x41e961cf
lea eax, [ebp - 0x20]
push eax
mov eax, 0xb97a9184
sub eax, 0xa9739078
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xb243d264
sub dword [ebp - 0x20], 0x3dd1690e
mov dword [ebp - 0x1c], 0x87c51186
add dword [ebp - 0x1c], 0xb9a74fef
mov dword [ebp - 0x18], 0xe9f3119e
sub dword [ebp - 0x18], 0x8683a532
mov dword [ebp - 0x14], 0xa6f425e8
sub dword [ebp - 0x14], 0xa6f425e8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x67d37
push 0
call eax
mov ecx, 0x67771598
add ecx, 0x988933c2
xor ebx, ebx
add ebx, eax
mov edi, 0x74e07f81
add edi, 0x9b27cc7f
add edi, dword [ebp - 0x10]
mov edx, 0xf9e0dfa8
add edx, 0x831456c5
add dword [ebp - 0xc], 0x42e0fe7
mov esi, dword [edi]
xor dword [ebp - 8], 0xd6ad7252
sub esi, edx
xor dword [ebp - 0xc], 0x7a4a6fab
mov dword [ebx], esi
add dword [ebp - 0xc], ecx
add ebx, 0xc9d1741e
sub ebx, 0xc9d1741a
add edi, 4
loop 0x100243c9
add eax, 0x86c9983c
sub eax, 0x86c88001
mov ebx, eax
add eax, 0x236cad8a
add eax, 0xdc93527b
mov ecx, 0xcff9a22d
add ecx, 0x40065dd3
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10029e30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1005bca0
push 0x1003b73d
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x10061008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0x438], esi
mov ecx, 0x100631ab
call fcn.1003d885
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10029e93
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
call fcn.10029f70
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x10029ece
test bl, bl
jne 0x10029f4d
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x10029ee3
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp - 0x430]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push 0x1004bd10
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x430]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10029f20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.10003f30
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003b6ee
mov esp, ebp
pop ebp
ret
Function at 0x1003ad60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004689c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x10061008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
mov ebx, dword [ebp + 8]
mov ecx, 0x100631ab
call fcn.1003d885
mov eax, dword [esi]
test eax, eax
je 0x1003adb0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov word [esi + 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0x2c
call fcn.1003b6ff
mov esi, eax
lea ecx, [ebp - 0x34]
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [esi], 0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0xc
mov dword [esi + 0xc], edi
push 0x1004b730
mov dword [esi + 0x10], 0
call fcn.10003930
mov byte [ebp - 4], 1
lea eax, [ebp - 0x34]
push eax
call fcn.10033630
mov ecx, eax
call fcn.10033720
mov dword [esi + 0x28], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.10003e60
mov byte [ebp - 4], 0
mov byte [ebp - 4], 0
sub esp, 8
lea ecx, [ebp - 0x14]
push edi
call fcn.1003b140
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov dword [ebp - 4], 6
cmp dword [ecx], 0
je 0x1003ae4e
add ecx, 8
jmp 0x1003ae50
xor ecx, ecx
cmp dword [ebx + 0x10], 0
je 0x1003ae60
cmp dword [ebx + 0x14], 8
jb 0x1003ae62
mov ebx, dword [ebx]
jmp 0x1003ae62
xor ebx, ebx
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [ebp - 0x18]
mov dword [esi], eax
test eax, eax
je 0x1003ae86
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1003ae86
mov byte [esi + 5], 1
cmp dword [esi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1003b090
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003b6ee
mov esp, ebp
pop ebp
ret 4
Function at 0x405f6d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a0aa4], 0
push esi
jne 0x405fa4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f7e
mov dword [ecx*4 + 0x7a0aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405f79
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405fd5
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a0aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405fb7
pop edi
not eax
pop esi
ret 0xc

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130