joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448960
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x120
mov eax, dword [0x45e380]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], edi
xor ebp, ebp
xor esi, esi
call dword [sym.imp.MSVCR100.dll__strdup]
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x4489cc
push 0x100
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b0c0
push eax
push ebx
push str.schannel:_invalid_path_name_for_CA_file__s:__s
push edi
call fcn.00414090
add esp, 0x1c
lea esi, [ebp + 0x4d]
jmp 0x448b01
push 0
push 0x80
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x448a1e
push 0x100
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b0c0
push eax
push ebx
push str.schannel:_failed_to_open_CA_file__s:__s
push edi
call fcn.00414090
add esp, 0x1c
mov esi, 0x4d
jmp 0x448b01
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x448a5e
push 0x100
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b0c0
push eax
push ebx
push str.schannel:_failed_to_determine_size_of_CA_file__s:__s
push edi
call fcn.00414090
add esp, 0x1c
mov esi, 0x4d
jmp 0x448af6
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x24], esi
jl 0x448a88
jg 0x448a71
cmp eax, 0x100000
jbe 0x448a88
push 0x100000
push str.schannel:_CA_file_exceeds_max_size_of__u_bytes
push edi
call fcn.00414090
mov esi, 0x4d
jmp 0x448af3
mov edi, eax
inc eax
push eax
call dword [section..data]
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x448aa0
lea esi, [eax + 0x1b]
jmp 0x448af6
test edi, edi
je 0x448ad9
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [esi + ebp]
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x448b3b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x448b37
add esi, eax
cmp esi, edi
jb 0x448aa4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
mov edx, ebx
mov ecx, edi
mov byte [edi + ebp], 0
call fcn.00448750
mov esi, eax
add esp, 0xc
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [0x45e004]
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
je 0x448b1d
push eax
call dword [sym.imp.MSVCR100.dll_free]
add esp, 4
mov ecx, dword [esp + 0x128]
pop edi
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.0044c8e4
add esp, 0x120
ret
mov edi, esi
jmp 0x448ad9
push 0x100
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b0c0
mov edx, dword [esp + 0x18]
push eax
push ebx
push str.schannel:_failed_to_read_from_CA_file__s:__s
push edx
call fcn.00414090
add esp, 0x1c
mov esi, 0x4d
jmp 0x448af6
Function at 0x449db0
Capabilities:
Check http status code

Disassembly:
push ebx
push esi
push edi
push 0x11
mov esi, eax
push str.WWW_Authenticate:
push esi
mov ebx, ecx
mov edi, edx
call fcn.0040c670
add esp, 0xc
test eax, eax
je 0x449dda
mov eax, dword [edi + 0xe0]
cmp eax, 0x191
je 0x449dfb
push 0x13
push str.Proxy_authenticate:
push esi
call fcn.0040c670
add esp, 0xc
test eax, eax
je 0x449e3d
mov eax, dword [edi + 0xe0]
cmp eax, 0x197
jne 0x449e3d
xor ebx, ebx
cmp eax, 0x197
push esi
sete bl
call fcn.0042b360
mov esi, eax
add esp, 4
test esi, esi
jne 0x449e1b
pop edi
lea eax, [esi + 0x1b]
pop esi
pop ebx
ret
push esi
push ebx
push edi
call fcn.0042bb30
push esi
mov edi, eax
call dword [0x45e004]
add esp, 0x10
test edi, edi
je 0x449fee
mov eax, edi
pop edi
pop esi
pop ebx
ret
push 0xf
push str.Content_Length:
push esi
call fcn.0040c670
add esp, 0xc
test eax, eax
je 0x449e9f
mov ecx, dword [edi + 0xe0]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jne 0x449e82
push ecx
push str.Ignoring_Content_Length_in_CONNECT__03d_response
push edi
call fcn.004141d0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret
add ebx, 0x208
push ebx
push 0xa
push 0
add esi, 0xf
push esi
call fcn.00439870
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 5
push str.close
push 0xb
push str.Connection:
push esi
call fcn.0042c270
add esp, 0x14
test eax, eax
jne 0x449f61
push 0x12
push str.Transfer_Encoding:
push esi
call fcn.0040c670
add esp, 0xc
test eax, eax
je 0x449f46
mov ecx, dword [edi + 0xe0]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 2
jne 0x449f03
push ecx
push str.Ignoring_Transfer_Encoding_in_CONNECT__03d_response
push edi
call fcn.004141d0
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 7
push str.chunked
push 0x12
push str.Transfer_Encoding:
push esi
call fcn.0042c270
add esp, 0x14
test eax, eax
je 0x449fee
push str.CONNECT_responded_chunked
push edi
call fcn.004141d0
push edi
mov dword [ebx + 0x214], 1
call fcn.00439d00
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 5
push str.close
push 0x11
push str.Proxy_Connection:
push esi
call fcn.0042c270
add esp, 0x14
test eax, eax
je 0x449f71
pop edi
pop esi
mov dword [ebx + 0x218], 1
xor eax, eax
pop ebx
ret
push 7
push str.HTTP_1.
push esi
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x449fee
mov al, byte [esi + 7]
cmp al, 0x30
je 0x449f91
cmp al, 0x31
jne 0x449fee
cmp byte [esi + 8], 0x20
jne 0x449fee
mov bl, byte [esi + 9]
cmp bl, 0x30
jl 0x449fee
cmp bl, 0x39
jg 0x449fee
mov dl, byte [esi + 0xa]
cmp dl, 0x30
jl 0x449fee
cmp dl, 0x39
jg 0x449fee
mov cl, byte [esi + 0xb]
cmp cl, 0x30
jl 0x449fee
cmp cl, 0x39
jg 0x449fee
mov al, byte [esi + 0xc]
cmp al, 0x30
jl 0x449fc9
cmp al, 0x39
jle 0x449fee
movsx eax, bl
lea eax, [eax + eax*4]
movsx edx, dl
lea eax, [edx + eax*2]
movsx ecx, cl
lea eax, [eax + eax*4]
lea eax, [ecx + eax*2 - 0x14d0]
mov dword [edi + 0xe0], eax
mov dword [edi + 0xedc], eax
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x44b7e0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x44b826
mov edx, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0x8002
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.00413670
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add esp, 4
push 0
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea eax, [esp + 8]
push eax
push 0
push 2
push ecx
mov dword [esp + 0x18], 0
call esi
cmp dword [esp + 4], 0x10
jne 0x44b883
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push 0
lea edx, [esp + 8]
push edx
push eax
push 2
push ecx
call esi
mov eax, dword [esp + 0xc]
pop esi
test eax, eax
je 0x44b893
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x44b8a4
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret
Function at 0x44c4c0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 8
push 0xf0000040
push 0x18
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x44c4f5
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push 0
push 0
push 0x800c
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov eax, dword [esp + 0x14]
push eax
call fcn.00413670
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
add esp, 4
push 0
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push eax
push ecx
call fcn.0044c450
xor eax, eax
add esp, 0x10
ret

Function at 0x44c530
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x44c555
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x44c59c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x44c5a0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x44c5fc
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
dec ebp
jne 0x44c5c3
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x44c638
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x45a944
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x45a945
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x44c607
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x44c8e4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45e380]
jne 0x44c8ee
repz ret
jmp fcn.0044d139
Function at 0x414f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
jmp 0x414f3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414f41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414f30
mov eax, 1
add ebx, ebx
jne 0x414f53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414f48
jne 0x414f64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414f48
xor ecx, ecx
sub eax, 3
jb 0x414f78
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414fea
mov ebp, eax
add ebx, ebx
jne 0x414f83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414f90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414fb4
inc ecx
add ebx, ebx
jne 0x414fa0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414f95
jne 0x414fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414f95
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414fd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414fc5
jmp 0x414f36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414fd4
add edi, ecx
jmp 0x414f36
pop esi
mov edi, esi
mov ecx, 0xf
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414ff2
cmp byte [edi], 0
jne 0x414ff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414ff7
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x415066
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18bf8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18c34]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415024
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18c38]
or eax, eax
je 0x415060
mov dword [ebx], eax
add ebx, 4
jmp 0x415041
call dword [esi + 0x18c48]
mov ebp, dword [esi + 0x18c3c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41509a
sub esp, 0xffffff80
jmp 0x4012ad

Function at 0x40891d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
and ecx, ecx
sub ecx, ecx
call fcn.0040895a
sub edi, 0x29a852eb
xor dword [ebx], edx
and ecx, ecx
push 0x2d969eda
pop ecx
inc ebx
sub ecx, 0xcc6855bf
sub ecx, 0x43b4810f
cmp ebx, eax
jne fcn.0040891d
add ecx, 0xc6cbfcbb
ret
Function at 0x42e006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..rdata
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x686c7535
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section._RDATA
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x1db30b9f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xfb0704c
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x2cad54ac
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x7f2e419e
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..text_1
mov ebx, 0x42f314
nop
nop
mov ecx, 0x70da11c6
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40f140
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x40f162
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f169
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f158
mov eax, 1
add ebx, ebx
jne 0x40f17b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f170
jne 0x40f18c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f170
xor ecx, ecx
sub eax, 3
jb 0x40f1a0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f212
mov ebp, eax
add ebx, ebx
jne 0x40f1ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f1b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f1dc
inc ecx
add ebx, ebx
jne 0x40f1c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f1bd
jne 0x40f1d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f1bd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f1fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f1ed
jmp 0x40f15e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f1fc
add edi, ecx
jmp 0x40f15e
pop esi
mov edi, esi
mov ecx, 0x1ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f21a
cmp byte [edi], 7
jne 0x40f21a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40f21f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f28e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f24c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf030]
or eax, eax
je 0x40f288
mov dword [ebx], eax
add ebx, 4
jmp 0x40f269
call dword [esi + 0xf02c]
mov ebp, dword [esi + 0xf034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40f2c2
sub esp, 0xffffff80
jmp 0x40144e
Function at 0x100020b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor dl, dl
mov dword [ebp - 4], ecx
test eax, eax
je 0x100021bf
test eax, 0xffff0000
jne 0x100021bf
push ebx
push edi
movzx edi, ax
push edi
call fcn.10018cff
mov ebx, eax
test ebx, ebx
je 0x100021bb
mov eax, edi
shr eax, 4
push 6
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp + 8], eax
test eax, eax
je 0x100021bb
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x100021bb
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x100021ba
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and edi, 0xf
jbe 0x10002149
cmp esi, ecx
jae 0x100021ba
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edi, 1
jne 0x10002133
cmp esi, ecx
jae 0x100021ba
movzx eax, word [esi]
test ax, ax
je 0x100021ba
push 0
push 0
push 0
push 0
push eax
lea ecx, [esi + 2]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
js 0x100021c7
mov ebx, dword [ebp - 4]
mov ecx, 1
mov edx, dword [ebx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x10002192
push edi
mov ecx, ebx
call fcn.10002810
mov edx, dword [ebx]
movzx eax, word [esi]
push 0
push 0
push edi
push edx
push eax
lea eax, [esi + 2]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x100021c7
mov dword [eax - 0xc], edi
mov eax, dword [ebx]
mov byte [edi + eax], 0
pop esi
pop edi
mov dl, 1
pop ebx
mov al, dl
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.10002080
int3

Function at 0x10002240
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1002280b
Function at 0x10006680
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017c1db
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
push esi
push edi
mov eax, dword [0x101e3ef8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push esi
call fcn.10006810
push esi
call fcn.100063e0
add esp, 8
lea ecx, [ebp + 8]
push dword [esi]
call fcn.10005010
mov eax, dword [str.STS_SCALE_DIALOG]
mov dword [ebp - 4], 0
test eax, eax
je 0x10006804
push eax
push dword [ebp + 8]
call fcn.1015bb5e
add esp, 8
test eax, eax
jne 0x100067ca
push dword [esi + 4]
lea ecx, [ebp - 0x30]
call fcn.1000ed30
movss xmm0, dword [0x1018cc60]
lea ecx, [ebp - 0x30]
mov edi, dword [esi + 8]
push str.SCALE
mov byte [ebp - 4], 1
movss dword [ebp - 0x10], xmm0
call fcn.1000fcb0
mov ecx, eax
call fcn.10013940
test al, al
jne 0x10006746
push str.SCALE
lea ecx, [ebp - 0x30]
call fcn.1000fcb0
mov ecx, eax
call fcn.10011720
fstp dword [ebp - 0x10]
movss xmm0, dword [ebp - 0x10]
movss dword [ebp - 0x10], xmm0
mov eax, dword [0x101e8c34]
test eax, eax
jne 0x10006776
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x10006380
mov dword [ebp - 0x14], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 0x14]
mov dword [0x101e8c34], eax
push eax
call fcn.1001cd00
push eax
lea ecx, [ebp - 0x108]
call fcn.10016720
movss xmm0, dword [ebp - 0x10]
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 2
movss dword [ebp - 0x38], xmm0
call fcn.10022b84
cmp eax, 1
jne 0x100067b1
movss xmm0, dword [ebp - 0x38]
movss dword [edi], xmm0
jmp 0x100067b7
mov dword [edi], 0
lea ecx, [ebp - 0x108]
call fcn.10016750
lea ecx, [ebp - 0x30]
call fcn.1000f4e0
mov edx, dword [ebp + 8]
or eax, 0xffffffff
add edx, 0xfffffff0
mov dword [ebp - 4], eax
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100067e8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
call fcn.10007c40
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10002080
int3