joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402a86
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov eax, 0x4165d2
call fcn.00415f10
sub esp, 0x124
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], edi
lea esi, [ebx + 0x10]
mov dword [ebp - 4], edi
call fcn.00402f43
push 0x105
mov byte [ebp - 4], 1
or dword [ebx + 0x38], 0xffffffff
or dword [ebx + 0x3c], 0xffffffff
lea eax, [ebp - 0x130]
push eax
push edi
mov dword [ebx + 0x2c], edi
mov dword [ebx + 0x30], edi
mov byte [ebx + 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x402ba5
lea eax, [ebp - 0x130]
push eax
lea esi, [ebp - 0x28]
call fcn.004076b7
pop ecx
push 0xffffffffffffffff
push edi
lea esi, [ebx + 0x10]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00402fcf
push edi
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00403082
cmp dword [esi + 0x18], 0x10
jb 0x402b28
mov esi, dword [esi + 4]
jmp 0x402b2b
add esi, 4
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx + 0x38], eax
cmp eax, 0xffffffff
je 0x402b7b
push edi
push edi
push edi
push 2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebx + 0x3c], eax
cmp eax, 0xffffffff
je 0x402b7b
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
push dword [ebx + 0x38]
mov dword [ebx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx + 0x2c], eax
mov ecx, dword [ebx + 0x30]
cmp ecx, edi
je 0x402ba5
mov eax, dword [ecx + 0x3c]
mov edi, dword [ebx + 0x2c]
add eax, ecx
mov edx, dword [eax + 0x9c]
add edx, dword [eax + 0x98]
cmp edx, edi
jne 0x402ba5
push ecx
mov esi, ebx
call fcn.00402916
mov byte [ebx + 0x34], al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x403530
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x416812
push eax
mov dword fs:[0], esp
sub esp, 0x168
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push dword [ebp + 8]
call fcn.00407150
pop ecx
pop ecx
test al, al
jne 0x40359e
push 1
push dword [ebp + 8]
call fcn.00407150
pop ecx
pop ecx
test al, al
jne 0x40359e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x403587
cmp eax, 3
jne 0x40359e
mov al, 1
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x403587
push 0xf
pop esi
push ebx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], esi
call fcn.004031b2
mov dword [esp + 0x17c], ebx
push ebx
lea ecx, [esp + 0x50]
mov dword [esp + 0x68], esi
call fcn.004031b2
lea eax, [esp + 0x68]
push eax
push 0x104
mov byte [esp + 0x184], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4035fb
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x18]
call fcn.00403063
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x403650
lea edi, [eax - 1]
lea eax, [esp + 0x14]
call fcn.0040468b
cmp byte [eax], 0x5c
jne 0x403650
mov eax, dword [esp + 0x28]
dec eax
push eax
push ebx
lea eax, [esp + 0x1c]
push eax
lea esi, [esp + 0x3c]
call fcn.0040473b
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x188], 2
call fcn.00402fcf
push ebx
push 1
mov ecx, esi
mov byte [esp + 0x184], 1
call fcn.00403082
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x40365f
lea eax, [esp + 0x18]
push 1
push eax
call fcn.00407150
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop ecx
pop ecx
test al, al
je 0x403711
call fcn.0040b1ad
mov esi, eax
shl esi, 0xf
call fcn.0040b1ad
or eax, esi
push eax
lea eax, [esp + 0x34]
push str.__tmp__08x
push eax
call fcn.00406f28
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea esi, [esp + 0x1c]
mov byte [esp + 0x184], 3
call fcn.004048fd
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.00403082
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x4036ca
lea eax, [esp + 0x18]
push 1
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x403711
cmp dword [esp + 0x2c], 0x10
mov eax, dword [esp + 0x18]
jae 0x4036e5
lea eax, [esp + 0x18]
push 4
push ebx
push eax
call edi
mov byte [esp + 0x13], 1
push ebx
push 1
lea ecx, [esp + 0x54]
call fcn.00403082
push ebx
push 1
lea ecx, [esp + 0x1c]
call fcn.00403082
mov al, byte [esp + 0x13]
jmp 0x403589
push 4
push ebx
push dword [ebp + 8]
call edi
test eax, eax
setne byte [esp + 0x13]
jmp 0x4036f0
Function at 0x406141
Capabilities:
Delete directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [0x41cfa4]
push edi
cmp esi, dword [0x41cfa8]
jbe 0x406161
call fcn.0040af86
mov eax, dword [0x41cf98]
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov esi, dword [0x41cfa8]
cmp dword [0x41cfa4], esi
jbe 0x406181
call fcn.0040af86
mov eax, dword [esp + 8]
test eax, eax
je 0x406191
cmp eax, dword [0x41cf98]
je 0x406196
call fcn.0040af86
cmp dword [esp + 0xc], esi
je 0x4061c9
lea esi, [esp + 8]
call fcn.004088a0
cmp dword [eax + 0x18], 0x10
jb 0x4061b0
mov eax, dword [eax + 4]
jmp 0x4061b3
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea edi, [esp + 0x10]
lea esi, [esp + 8]
call fcn.004088c8
jmp 0x40616e
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406aca
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4167bc
call fcn.00415f10
sub esp, 0x144
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x10], 0xf
call fcn.004031b2
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
jne 0x406b3e
lea eax, [ebp - 0x150]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x406b1f
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403063
cmp dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x24]
jae 0x406b2b
lea eax, [ebp - 0x24]
push 1
push eax
call fcn.00407150
pop ecx
pop ecx
test al, al
jne 0x406b49
push dword [ebp + 0x10]
jmp 0x406b41
push dword [ebp + 0xc]
lea ecx, [ebp - 0x28]
call fcn.00403063
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x406b6a
lea edi, [eax - 1]
lea eax, [ebp - 0x28]
call fcn.0040468b
cmp byte [eax], 0x5c
je 0x406b6a
push 0x5c
lea esi, [ebp - 0x28]
call fcn.0040836e
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x10], 0x10
mov edi, dword [ebp - 0x24]
jae 0x406b79
lea edi, [ebp - 0x24]
call fcn.0040b1ad
mov esi, eax
shl esi, 0x10
call fcn.0040b1ad
or eax, esi
push eax
push edi
lea eax, [ebp - 0x44]
push str._spl_08x.ftf
push eax
call fcn.00406f28
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [ebp - 0x2c], 0x10
mov eax, dword [ebp - 0x40]
jae 0x406bad
lea eax, [ebp - 0x40]
push eax
call fcn.00406e6e
cmp dword [ebp - 0x2c], 0x10
mov eax, dword [ebp - 0x40]
pop ecx
jae 0x406bc0
lea eax, [ebp - 0x40]
push ebx
push 0x80
xor esi, esi
inc esi
push esi
push ebx
push ebx
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x406c1e
push ebx
push esi
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], bl
call fcn.00403082
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x200
jl 0x406b6d
mov esi, dword [ebp + 8]
call fcn.00402f43
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403082
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x44]
push eax
call fcn.00402f7a
push ebx
push esi
lea ecx, [ebp - 0x44]
call fcn.00403082
push ebx
push esi
lea ecx, [ebp - 0x28]
call fcn.00403082
mov eax, dword [ebp + 8]
jmp 0x406c0f
Function at 0x406db4
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x416567
call fcn.00415f10
sub esp, 0x1c
push ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 0x10
jb 0x406dd1
mov eax, dword [edi + 4]
jmp 0x406dd4
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406e51
mov ebx, edi
call fcn.0040845a
cmp eax, 0xffffffff
je 0x406e28
push esi
push eax
push 0
push edi
lea esi, [ebp - 0x28]
call fcn.0040473b
push dword [ebp + 0xc]
and dword [ebp - 4], 0
push eax
call fcn.00406db4
pop ecx
pop ecx
mov bl, al
neg bl
sbb bl, bl
or dword [ebp - 4], 0xffffffff
push 0
push 1
mov ecx, esi
inc bl
call fcn.00403082
pop esi
test bl, bl
je 0x406e28
xor al, al
jmp 0x406e60
cmp dword [edi + 0x18], 0x10
jb 0x406e33
mov eax, dword [edi + 4]
jmp 0x406e36
lea eax, [edi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406e24
push edi
call fcn.004088fd
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
jmp 0x406e5e
test eax, 0x410
je 0x406e24
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4077ec
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x40784c
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x407843
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 4], ebx
pop ebx
setne al
leave
ret

Function at 0x407855
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x416506
call fcn.00415f10
mov eax, 0x103c
call fcn.00414b40
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push 0x80000001
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [ebp + 8]
mov edi, eax
call fcn.00402f43
xor esi, esi
inc esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], esi
cmp edi, ebx
jne 0x407929
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], 0x1000
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x14]
mov byte [ebp + ecx - 0x1048], bl
cmp eax, ebx
jne 0x407920
cmp dword [ebp - 0x10], ebx
jbe 0x40793b
cmp dword [ebp - 0x10], 3
ja 0x40793b
mov edi, ecx
push ebx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x20], 0xf
call fcn.004031b2
push edi
lea eax, [ebp - 0x1048]
push eax
lea ecx, [ebp - 0x38]
call fcn.004030cd
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x38]
mov dword [ebp - 4], esi
mov ecx, dword [ebp + 8]
push eax
call fcn.00402fcf
push ebx
push esi
lea ecx, [ebp - 0x38]
call fcn.00403082
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
lea ecx, [ebp - 0x44]
call fcn.0040ab27
push 0x41b4fc
lea eax, [ebp - 0x44]
push eax
call fcn.0040f648
int3
Function at 0x407952
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x416618
call fcn.00415f10
sub esp, 0x168
push ebx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x1c], 0xf
call fcn.004031b2
mov eax, dword [ebp + 0xc]
sub eax, 0x1a
mov dword [ebp - 4], ebx
je 0x4079d6
dec eax
dec eax
je 0x4079b1
sub eax, 0xa
je 0x4079a2
lea ecx, [ebp - 0x18]
call fcn.0040ab27
push 0x41b4fc
lea eax, [ebp - 0x18]
push eax
call fcn.0040f648
push str._ProgramFiles_
lea ecx, [ebp - 0x34]
call fcn.00403063
jmp 0x407a04
lea eax, [ebp - 0x54]
push str.Local_AppData
push eax
call fcn.00407855
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.00402fcf
lea ecx, [ebp - 0x54]
jmp 0x4079f9
lea eax, [ebp - 0x70]
push str.AppData
push eax
call fcn.00407855
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.00402fcf
lea ecx, [ebp - 0x70]
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.00403082
cmp dword [ebp - 0x1c], 0x10
mov eax, dword [ebp - 0x30]
jae 0x407a10
lea eax, [ebp - 0x30]
push 0x104
lea ecx, [ebp - 0x174]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x40798c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x174]
push eax
call fcn.00402f56
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00403082
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x407f3f
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x416518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
and dword [esp], 0
push ebx
push esi
push edi
push dword [ebp + 0x10]
lea ecx, [esp + 0x30]
call fcn.00402f7a
and dword [esp + 0x54], 0
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
call fcn.004083b7
mov esi, eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x2c]
call fcn.004083d9
mov edi, eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
call fcn.004083b7
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [esp + 0x3c]
push eax
call fcn.0040a0c2
mov ebx, dword [ebp + 8]
add esp, 0x1c
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
add ebx, 0x18
push eax
call fcn.0040868b
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
lea edi, [esp + 0xc]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], eax
call fcn.00408e33
test al, al
jne 0x407ffb
call fcn.00408f85
add eax, 0x1c
jmp 0x408000
mov eax, 0x418ac0
mov ecx, dword [ebp + 0xc]
push eax
call fcn.00402f7a
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.00403082
mov ecx, dword [esp + 0x4c]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40802d
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x416518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push esi
push dword [ebp + 0xc]
lea ecx, [esp + 0x30]
call fcn.00402f7a
and dword [esp + 0x54], 0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x2c]
call fcn.004083b7
mov esi, eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
call fcn.004083d9
mov ebx, eax
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x2c]
call fcn.004083b7
push dword [esi + 4]
push dword [esi]
push dword [ebx + 4]
push dword [ebx]
push dword [eax + 4]
push dword [eax]
lea eax, [esp + 0x3c]
push eax
call fcn.0040a0c2
mov ebx, dword [ebp + 8]
add esp, 0x1c
lea eax, [esp + 0x2c]
push eax
add ebx, 0x18
call fcn.004085a7
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov ecx, eax
call fcn.00402fcf
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.00403082
mov ecx, dword [esp + 0x4c]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408226
Capabilities:
Check for vm using instruction vpcext
Reference the vmware io port

Disassembly:
push 0xc
push 0x41b548
call fcn.00415da0
mov dword [ebp - 0x1c], 0
and dword [ebp - 4], 0
push edx
push ecx
push ebx
mov eax, 0x564d5868
xor ebx, ebx
mov ecx, 0x14
mov edx, 0x5658
in eax, dx
cmp eax, 0x20
jl 0x408266
cmp eax, 0x4000
jg 0x408266
mov eax, 2
or dword [ebp - 0x1c], eax
pop ebx
pop ecx
pop edx
jmp 0x408272
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], 1
push ebx
xor eax, eax
xor ebx, ebx
inc eax
invalid

Function at 0x40f540
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4175a8]
jne 0x40f54a
repz ret
jmp fcn.00412e2c
Function at 0x412816
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040eb70
and dword [ebp - 4], 0
cmp dword [0x41cb28], 0
mov ebx, eax
jne 0x4128c7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412978
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412978
push eax
call fcn.0040eafe
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41cb28], eax
call esi
push eax
call fcn.0040eafe
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41cb2c], eax
call esi
push eax
call fcn.0040eafe
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41cb30], eax
call esi
push eax
call fcn.0040eafe
pop ecx
mov dword [0x41cb38], eax
test eax, eax
je 0x4128c7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040eafe
pop ecx
mov dword [0x41cb34], eax
mov eax, dword [0x41cb34]
cmp eax, ebx
je 0x41291f
cmp dword [0x41cb38], ebx
je 0x41291f
push eax
call fcn.0040eb79
push dword [0x41cb38]
mov esi, eax
call fcn.0040eb79
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41291f
test edi, edi
je 0x41291f
call esi
test eax, eax
je 0x412916
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x412916
test byte [ebp - 0xc], 1
jne 0x41291f
or dword [ebp + 0x10], 0x200000
jmp 0x412958
mov eax, dword [0x41cb2c]
cmp eax, ebx
je 0x412958
push eax
call fcn.0040eb79
pop ecx
test eax, eax
je 0x412958
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x412958
mov eax, dword [0x41cb30]
cmp eax, ebx
je 0x412958
push eax
call fcn.0040eb79
pop ecx
test eax, eax
je 0x412958
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41cb28]
call fcn.0040eb79
pop ecx
test eax, eax
je 0x412978
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41297a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ef30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1b000]
push edi
or ebp, 0xffffffff
jmp 0x42ef52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42ef59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42ef48
mov eax, 1
add ebx, ebx
jne 0x42ef6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x42ef60
jne 0x42ef7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42ef60
xor ecx, ecx
sub eax, 3
jb 0x42ef90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42f002
mov ebp, eax
add ebx, ebx
jne 0x42ef9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42efa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42efcc
inc ecx
add ebx, ebx
jne 0x42efb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42efad
jne 0x42efc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42efad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42efec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42efdd
jmp 0x42ef4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42efec
add edi, ecx
jmp 0x42ef4e
pop esi
mov edi, esi
mov ecx, 0xafc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42f00a
cmp byte [edi], 2
jne 0x42f00a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42f00f
lea edi, [esi + 0x2b000]
mov eax, dword [edi]
or eax, eax
je 0x42f087
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30e30]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30f40]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42f03c
mov ecx, edi
jns 0x42f06b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30f48]
or eax, eax
je 0x42f081
mov dword [ebx], eax
add ebx, 4
jmp 0x42f059
call dword [esi + 0x30f44]
mov ebp, dword [esi + 0x30f4c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42f0bb
sub esp, 0xffffff80
jmp 0x41a7c2
Function at 0x401cd0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0x40
push 0x1000
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
pop ebp
ret

Function at 0x401cf0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x44b9f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.HSP1
lea edi, [esi - 0x2c000]
push edi
or ebp, 0xffffffff
jmp 0x44ba12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44ba19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44ba08
mov eax, 1
add ebx, ebx
jne 0x44ba2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44ba3c
jne 0x44ba4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44ba4c
dec eax
add ebx, ebx
jne 0x44ba48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44ba20
xor ecx, ecx
sub eax, 3
jb 0x44ba64
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44bad6
sar eax, 1
mov ebp, eax
jmp 0x44ba6f
add ebx, ebx
jne 0x44ba6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x44ba7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44baa0
inc ecx
add ebx, ebx
jne 0x44ba8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44ba81
jne 0x44ba9d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44ba81
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44bac0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44bab1
jmp 0x44ba0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44bac0
add edi, ecx
jmp 0x44ba0e
pop esi
mov edi, esi
mov ecx, 0x328
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44bade
cmp byte [edi], 2
jne 0x44bade
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x44bae3
lea edi, [esi + 0x49000]
mov eax, dword [edi]
or eax, eax
je 0x44bb5b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4d140]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4d17c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44bb10
mov ecx, edi
jns 0x44bb3f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4d180]
or eax, eax
je 0x44bb55
mov dword [ebx], eax
add ebx, 4
jmp 0x44bb2d
call dword [esi + 0x4d184]
popal
jmp 0x402940