joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c8954
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5c896b
add esp, 0xfffffff0
call fcn.00408c2c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c0aa8
mov eax, dword [0x5e5c9c]
cmp byte [eax], 0
jne 0x5c8998
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x5e6000]
cmp word [eax + 2], 0
jne 0x5c89b2
mov eax, dword [0x5e6000]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cae18
mov eax, dword [0x5e613c]
cmp word [eax + 2], 0
jne 0x5c89cc
mov eax, dword [0x5e613c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cb230
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x507d98]
call fcn.0050e914
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5cb7dc
mov dl, 1
mov eax, dword [0x4800ac]
call fcn.00408610
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x4800ac]
call fcn.00408610
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x50cf08]
call fcn.00518f28
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5c8bbc
mov eax, dword [0x5e5ea4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00519444
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5cbac8
mov dl, 1
mov eax, dword [0x4800ac]
call fcn.00408610
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5e5ea4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425dd8
test eax, eax
je 0x5c8adf
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425c30
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425dbc
test eax, eax
je 0x5c8af7
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040aee8
push ebx
push 0x5ca7ec
call fcn.005bcde8
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5e5c9c]
cmp byte [eax], 0
jne 0x5c8b48
mov eax, ebx
call fcn.005c8d84
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005cbe70
mov eax, ebx
call fcn.005cc9ac
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5c8bb3
call fcn.00408c84
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5c90b4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5c9156
cmp dword [ebx + 0xac], 0
jne 0x5c9150
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5c8ff4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5c9150
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5c9116
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5c9150
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004aab58
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5c9125
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5c9498
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5edc10]
cmp dword [eax + 0x190], 0
je 0x5c9601
test bl, bl
jne 0x5c9554
cmp dword [esi + 0xb4], 0
jne 0x5c9549
mov eax, esi
call fcn.005cc7fc
push eax
push 0x5c9398
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5c951a
mov eax, dword [0x5edc10]
cmp byte [eax + 0xeb], 0
je 0x5c951a
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c94fb
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c951a
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c9503
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c9549
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aab58
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c9529
inc dword [esi + 0xb4]
jmp 0x5c9601
cmp dword [esi + 0xb4], 0
jle 0x5c9601
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5c9601
cmp dword [esi + 0x58], 0
je 0x5c95b6
mov eax, dword [0x5edc10]
cmp byte [eax + 0xeb], 0
je 0x5c95b6
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5c9597
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5c95b6
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5c959f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5c95e5
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004aab58
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5c95c5
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5b98e0]
call fcn.0040d1e4
pop edi
pop esi
pop ebx
ret
Function at 0x5ca3f8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5ca455
cmp byte [ebx + 0xeb], 0
jne 0x5ca455
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a580
mov eax, dword [esi]
test eax, eax
je 0x5ca442
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5ca462
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7d8
jmp 0x5ca462
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a7d8
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5cc084
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5cc0f5
mov eax, esi
call fcn.0053e198
test al, al
je 0x5cc0f5
mov eax, dword [ebx + 0x98]
call fcn.0053dd30
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5cc0f5
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5cc0e6
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053dd30
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00533f68
jmp 0x5cc0f5
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005cbe90
pop esi
pop ebx
ret
Function at 0x5d1c10
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x94], 0
jne 0x5d1c96
mov eax, dword [ebx + 8]
call fcn.0053dd30
mov ecx, eax
mov dl, 1
mov eax, dword [0x54aee4]
call fcn.00537814
mov dword [ebx + 0x94], eax
mov esi, dword [ebx + 0x94]
xor edx, edx
mov eax, esi
call fcn.0055053c
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5d14e0
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.0053dd30
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.0053dd30
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0xa4], 0
jne 0x5d1d18
mov eax, dword [ebx + 8]
call fcn.0053dd30
mov ecx, eax
mov dl, 1
mov eax, dword [0x54aee4]
call fcn.00537814
mov dword [ebx + 0xa4], eax
mov esi, dword [ebx + 0xa4]
mov dl, 1
mov eax, esi
call fcn.0055053c
mov dword [esi + 0x2dc], ebx
mov dword [esi + 0x2d8], 0x5d152c
push 8
push 0
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0053dd30
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0xa4]
call fcn.0053dd30
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d1d96
mov eax, dword [ebx + 8]
call fcn.0053dd30
mov ecx, eax
mov dl, 1
mov eax, dword [0x54b9d8]
call fcn.00537814
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov byte [esi + 0x2b0], 1
push 8
mov edx, 3
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xe0]
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0053dd30
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.0053dd30
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10013b94
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x10013ba3
pop dword [ebp - 0x14]
mov eax, 0x10013ba3
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x88b9ac19
sub dword [ebp - 0x24], 0x3a6766ce
mov dword [ebp - 0x20], 0x81bd3611
add dword [ebp - 0x20], 0xb0761634
mov dword [ebp - 0x1c], 0x6f96c74
sub dword [ebp - 0x1c], 0xbaad2846
mov dword [ebp - 0x18], 0x36b2af45
add dword [ebp - 0x18], 0xc94d50bb
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xd11e75a4
add dword [ebp - 0x24], 0xa353f3b2
mov dword [ebp - 0x20], 0xac638939
sub dword [ebp - 0x20], 0x6af727c4
mov dword [ebp - 0x1c], 0xe514c742
sub dword [ebp - 0x1c], 0x81a55ad6
mov dword [ebp - 0x18], 0x1479d7a
add dword [ebp - 0x18], 0xfeb86286
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x37e6f
push 0
call eax
mov ecx, 0xf7d2309b
sub ecx, 0xf7d1f68a
mov ebx, eax
mov edi, 0x39568f08
add edi, 0xd6ac7cf8
add edi, dword [ebp - 0x14]
mov edx, 0x8de46ce6
sub edx, 0xe10cf0bf
sub dword [ebp - 8], 0x31865bfd
mov esi, dword [edi]
xor dword [ebp - 0xc], eax
add esi, edx
sub dword [ebp - 0x10], ebx
mov dword [ebx], esi
add dword [ebp - 4], edi
add ebx, 0x1f3933fb
add ebx, 0xe0c6cc09
add edi, 0xb51e7ef3
add edi, 0x4ae18111
loop 0x10013cb6
add eax, 0xdb17
mov ebx, eax
add eax, 0xb7e417f9
sub eax, 0xb7e417f4
mov ecx, 0x52b334b2
sub ecx, 0x42b334b2
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x1001c6a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c73b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c6f2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c6f2
cmp esi, ebx
jge 0x1001c6f2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c735
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c735
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c74d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x4070d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x4070e3
pop dword [ebp - 0x34]
mov eax, 0x7fc5bac5
sub eax, 0x7f8549e2
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3d7478ba
sub dword [ebp - 0x44], 0xef22336f
mov dword [ebp - 0x40], 0xdb28db21
sub dword [ebp - 0x40], 0xa8f58edc
mov dword [ebp - 0x3c], 0x4ec3cda9
sub dword [ebp - 0x3c], 0x277897b
mov dword [ebp - 0x38], 0x73b3e9cb
add dword [ebp - 0x38], 0x8c4c1635
lea eax, [ebp - 0x44]
push eax
mov eax, 0xd4a938f4
add eax, 0x2b974810
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x85cdc55a
add dword [ebp - 0x44], 0xeea4a3fc
mov dword [ebp - 0x40], 0x732bf4b0
sub dword [ebp - 0x40], 0x31bf933b
mov dword [ebp - 0x3c], 0x6002739b
add dword [ebp - 0x3c], 0x36cf8d1
mov dword [ebp - 0x38], 0x1883fabf
sub dword [ebp - 0x38], 0x1883fabf
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39454
push 0
call eax
mov ecx, 0x50da
xor edi, edi
add edi, eax
mov esi, 0x432fc5c0
sub esi, 0x42eac1c0
add esi, dword [ebp - 0x34]
mov ebx, 0x932ad832
sub ebx, 0x97ef75c5
mov edx, dword [esi]
xor dword [ebp - 0x24], ebx
sub edx, ebx
mov dword [edi], edx
sub dword [ebp - 8], esi
add edi, 4
add esi, 0xb2ea0f84
sub esi, 0xb2ea0f80
loop 0x4071fc
add eax, 0x1363b
xor ebx, ebx
add ebx, eax
add eax, 0xba844b10
sub eax, 0xba844b0b
mov ecx, 0x7fe3d8e9
add ecx, 0x805c2717
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x402907
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x402916
pop dword [ebp - 0x2c]
mov eax, 0x402916
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xbb38eefa
add dword [ebp - 0x3c], 0x93195651
mov dword [ebp - 0x38], 0x9448a185
add dword [ebp - 0x38], 0x9deaaac0
mov dword [ebp - 0x34], 0x2c15780b
sub dword [ebp - 0x34], 0xdfc933dd
mov dword [ebp - 0x30], 0xcff7ce5b
sub dword [ebp - 0x30], 0xcff7ce5b
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x8ab08766
sub eax, 0x8a70174a
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x120e5455
sub dword [ebp - 0x3c], 0x9d9beaff
mov dword [ebp - 0x38], 0x5cc3558
sub dword [ebp - 0x38], 0xc45fd3e3
mov dword [ebp - 0x34], 0xf0f8462f
add dword [ebp - 0x34], 0x7277263d
mov dword [ebp - 0x30], 0xe877bc44
add dword [ebp - 0x30], 0x178843bc
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x194c7769
add eax, 0xe6f3f8b7
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x35e80
push 0
call eax
mov ecx, 0x9723dbef
add ecx, 0x68dc64bb
mov esi, eax
mov edx, 0x8e4e673d
sub edx, 0x8e0d9f3d
add edx, dword [ebp - 0x2c]
mov edi, 0xafb732e5
sub edi, 0x80337b73
mov ebx, dword [edx]
add dword [ebp - 0x20], ebx
xor ebx, edi
sub dword [ebp - 0x14], 0xac39e622
mov dword [esi], ebx
mov dword [ebp - 0x28], 0x78115d9d
add esi, 4
add edx, 0x8b3e2c78
sub edx, 0x8b3e2c74
loop 0x402a33
add eax, 0x4e9dd3db
sub eax, 0x4e9cde60
xor ebx, ebx
add ebx, eax
add eax, 0x5d811fc9
add eax, 0xa27ee03c
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00402907
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.00402907
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret
Function at 0x4d4490
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa2000]
push edi
or ebp, 0xffffffff
jmp 0x4d44b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d44b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d44a8
mov eax, 1
add ebx, ebx
jne 0x4d44cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d44dc
jne 0x4d44ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d44ec
dec eax
add ebx, ebx
jne 0x4d44e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d44c0
xor ecx, ecx
sub eax, 3
jb 0x4d4504
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d4576
sar eax, 1
mov ebp, eax
jmp 0x4d450f
add ebx, ebx
jne 0x4d450f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4d451c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4d4540
inc ecx
add ebx, ebx
jne 0x4d452c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d4521
jne 0x4d453d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d4521
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d4560
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d4551
jmp 0x4d44ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d4560
add edi, ecx
jmp 0x4d44ae
pop esi
mov edi, esi
mov ecx, 0x16d5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d457e
cmp byte [edi], 0xa
jne 0x4d457e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4d4583
lea edi, [esi + 0xd1000]
mov eax, dword [edi]
or eax, eax
je 0x4d45fb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd5388]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd548c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d45b0
mov ecx, edi
jns 0x4d45df
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd5490]
or eax, eax
je 0x4d45f5
mov dword [ebx], eax
add ebx, 4
jmp 0x4d45cd
call dword [esi + 0xd5494]
popal
jmp 0x4285df
Function at 0x10013074
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10013083
pop dword [ebp - 0x2c]
mov eax, 0x39dfd648
sub eax, 0x29dea5c5
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa522463d
sub dword [ebp - 0x3c], 0x56d000f2
mov dword [ebp - 0x38], 0x3ffe93b3
add dword [ebp - 0x38], 0xf234b892
mov dword [ebp - 0x34], 0x2dd0a93e
add dword [ebp - 0x34], 0x1e7b9af0
mov dword [ebp - 0x30], 0x24df286e
add dword [ebp - 0x30], 0xdb20d792
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x5030f2c4
add dword [ebp - 0x3c], 0x24417692
mov dword [ebp - 0x38], 0xba36410e
add dword [ebp - 0x38], 0x87362067
mov dword [ebp - 0x34], 0x5791e5bf
add dword [ebp - 0x34], 0xbdd86ad
mov dword [ebp - 0x30], 0x4787be9d
add dword [ebp - 0x30], 0xb8784163
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39d04
push 0
call eax
mov ecx, 0x4cb5
xor edi, edi
add edi, eax
mov esi, 0x7853f0bf
add esi, 0x97b02b41
add esi, dword [ebp - 0x2c]
mov ebx, 0xa85b96d5
mov dword [ebp - 0xc], 0x494921b4
mov edx, dword [esi]
sub dword [ebp - 4], 0xd337bcf2
xor edx, ebx
mov dword [edi], edx
sub dword [ebp - 4], 0x43cdcd59
add edi, 0x18e2bed
add edi, 0xfe71d417
add esi, 4
loop 0x10013191
add eax, 0x430bd3f7
sub eax, 0x430aae50
mov ebx, eax
add eax, 0xd82ade6d
add eax, 0x27d52198
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1000cac3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword fs:[0x2c]
push ebx
push esi
mov esi, dword [0x100139e8]
mov ebx, ecx
push edi
mov edi, edx
mov dword [ebp - 8], edi
mov esi, dword [eax + esi*4]
mov eax, dword [0x10013e80]
cmp eax, dword [esi + 4]
jg 0x1000cb78
lea eax, [ebx + edi]
cmp eax, ebx
ja 0x1000cb01
mov eax, 0x10dd
jmp 0x1000cb71
mov eax, dword [0x10013e7c]
cmp edi, eax
jbe 0x1000cb0f
push 0x32
pop eax
jmp 0x1000cb71
mov edi, dword [ebp + 8]
lea ecx, [ebp - 4]
and dword [ebp - 4], 0
lea esi, [eax - 1]
push ecx
not esi
push dword [edi]
and esi, ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
jne 0x1000cb37
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x1000cb71
mov ecx, dword [0x10013e7c]
mov eax, dword [ebp - 8]
dec ecx
mov edx, dword [ebp - 4]
dec eax
add eax, ebx
mov dword [edi], edx
not ecx
and ecx, eax
cmp ecx, esi
je 0x1000cb6c
lea eax, [ebp - 4]
push eax
push dword [edi + 4]
push dword [0x10013e7c]
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x1000cb2f
mov edx, dword [ebp - 4]
mov dword [edi + 4], edx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
mov esi, 0x10013e80
push esi
call fcn.1000cd54
cmp dword [0x10013e80], 0xffffffff
pop ecx
jne 0x1000caf3
push 9
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x28]
push esi
mov dword [0x10013e7c], eax
call fcn.1000cd54
mov edi, dword [ebp - 8]
pop ecx
jmp 0x1000caf3

Function at 0x1000cd54
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000cd63
pop dword [ebp - 0x48]
mov eax, 0x79f67dab
sub eax, 0x69f5b048
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x343e7
push 0
mov eax, 0xeb8e43bf
add eax, 0x2472fca5
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x34f0
mov edx, eax
mov ebx, 0xec174f33
sub ebx, 0xdc15c933
add ebx, dword [ebp - 0x48]
mov edi, 0x761901ae
mov esi, dword [ebx]
add esi, edi
mov dword [edx], esi
xor dword [ebp - 0x34], edx
add edx, 0x3f942ded
add edx, 0xc06bd217
add ebx, 0xd24a58d5
add ebx, 0x2db5a72f
loop 0x1000cdb6
add eax, 0xc1b5dfa0
sub eax, 0xc1b5190d
mov ebx, eax
add eax, 0x4505a9b
add eax, 0xfbafa56a
mov ecx, 0xcdf73717
sub ecx, 0xbdf73717
add ecx, dword [ebp - 0x48]
call ebx
leave
ret