joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c08c1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x5c08c239
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x5c08c1e0
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x5c08c1ef
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x5c491e92
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x5c08c240
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.5c0730b6
cmp eax, dword [ebp + 0xc]
pop eax
je 0x5c08c2df
add edi, 4
add eax, 2
dec ecx
jne 0x5c08c225
call 0x5c08c28c
loope 0x5c08c282
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x5c08c2dc
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x5c08c2ed
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x5c08c2a0
cmp eax, ecx
ja 0x5c08c2a0
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x5c08c32a
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x5c08c320
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.5c073595
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x5c08c1ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x5c08c239
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x5c08c1e0
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x5c08c1ef
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x5c491e92
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x5c08c240
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.5c0730b6
cmp eax, dword [ebp + 0xc]
pop eax
je 0x5c08c2df
add edi, 4
add eax, 2
dec ecx
jne 0x5c08c225
call 0x5c08c28c
loope 0x5c08c282
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x5c08c2dc
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x5c08c2ed
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x5c08c2a0
cmp eax, ecx
ja 0x5c08c2a0
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x5c08c32a
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x5c08c320
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.5c073595
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x47c70f3
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x71191763
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x580800
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x114000]
push edi
or ebp, 0xffffffff
jmp 0x580822
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x580829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x580818
mov eax, 1
add ebx, ebx
jne 0x58083b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x58084c
jne 0x58086b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58086b
dec eax
add ebx, ebx
jne 0x580858
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x580830
add ebx, ebx
jne 0x580867
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5808bd
xor ecx, ecx
sub eax, 3
jb 0x580883
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5808f2
sar eax, 1
mov ebp, eax
jmp 0x58088e
add ebx, ebx
jne 0x58088e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58085c
inc ecx
add ebx, ebx
jne 0x58089c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x58085c
add ebx, ebx
jne 0x5808a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x58089e
jne 0x5808ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58089e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5808dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5808ce
jmp 0x58081e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5808dc
add edi, ecx
jmp 0x58081e
pop esi
mov edi, esi
mov ecx, 0x5816
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5808fa
cmp byte [edi], 0x15
jne 0x5808fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5808ff
lea edi, [esi + 0x177000]
mov eax, dword [edi]
or eax, eax
je 0x580977
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18b1f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18b314]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x58092c
mov ecx, edi
jns 0x58095b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18b31c]
or eax, eax
je 0x580971
mov dword [ebx], eax
add ebx, 4
jmp 0x580949
call dword [esi + 0x18b318]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5809a8
cmp al, 0xef
ja 0x58099b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x58097d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x58098a
mov ebp, dword [esi + 0x18b320]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5809dc
sub esp, 0xffffff80
jmp 0x4aeaf0
Function at 0x52d070
Capabilities:
Get session user name

Disassembly:
push ebp
lea ebp, [esp - 0x210]
sub esp, 0x210
push 0xffffffffffffffff
push 0x552078
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x592174]
xor eax, ebp
mov dword [ebp + 0x20c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x595500]
test eax, eax
jle 0x52d0c1
inc eax
mov dword [0x595500], eax
mov al, 1
jmp 0x52d1b3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x10], 0
xor bh, bh
mov dword [ebp - 0x14], 0
call fcn.00432ad0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x18]
call fcn.00433980
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00432b50
test bl, bl
je 0x52d1a3
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x52d1a3
push str.ImpersonateLoggedOnUser
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [ebp - 0x10]
call eax
test eax, eax
je 0x52d19c
inc dword [0x595500]
mov eax, dword [edi]
test eax, eax
je 0x52d146
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
mov bh, 1
mov dword [edi], eax
cmp dword [0x59290c], 0
mov dword [ebp - 0x10], 0
jne 0x52d19c
push 0x20a
lea eax, [ebp]
push 0
push eax
call fcn.0050d580
add esp, 0xc
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov ecx, 0x5928fc
mov word [ebp + 0x206], ax
lea eax, [ebp]
push eax
call fcn.00418460
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x52d1b1
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bh
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x20c]
xor ecx, ebp
call fcn.0050b067
lea esp, [ebp + 0x210]
pop ebp
ret
Function at 0x10199670
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1019985d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x109000]
push edi
or ebp, 0xffffffff
jmp 0x1019969a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x101996a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10199690
mov eax, 1
add ebx, ebx
jne 0x101996b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x101996c4
jne 0x101996e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101996e3
dec eax
add ebx, ebx
jne 0x101996d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x101996a8
add ebx, ebx
jne 0x101996df
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10199735
xor ecx, ecx
sub eax, 3
jb 0x101996fb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1019976a
sar eax, 1
mov ebp, eax
jmp 0x10199706
add ebx, ebx
jne 0x10199706
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101996d4
inc ecx
add ebx, ebx
jne 0x10199714
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x101996d4
add ebx, ebx
jne 0x10199721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10199716
jne 0x10199732
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10199716
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10199754
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10199746
jmp 0x10199696
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10199754
add edi, ecx
jmp 0x10199696
pop esi
mov edi, esi
mov ecx, 0x8374
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10199772
cmp byte [edi], 0x19
jne 0x10199772
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10199777
lea edi, [esi + 0x189000]
mov eax, dword [edi]
or eax, eax
je 0x101997ef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199558]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1996c0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x101997a4
mov ecx, edi
jns 0x101997d3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1996c4]
or eax, eax
je 0x101997e9
mov dword [ebx], eax
add ebx, 4
jmp 0x101997c1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x10199820
cmp al, 0xef
ja 0x10199813
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x101997f5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x10199802
mov ebp, dword [esi + 0x1996c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10199854
sub esp, 0xffffff80
jmp 0x100f008a
Function at 0x4659a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x457015
lea edi, [esi - 0x56015]
push edi
or ebp, 0xffffffff
jmp 0x4659c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4659c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4659b8
mov eax, 1
add ebx, ebx
jne 0x4659db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4659d0
jne 0x4659ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4659d0
xor ecx, ecx
sub eax, 3
jb 0x465a00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x465a72
mov ebp, eax
add ebx, ebx
jne 0x465a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x465a18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x465a3c
inc ecx
add ebx, ebx
jne 0x465a28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x465a1d
jne 0x465a39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x465a1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x465a5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x465a4d
jmp 0x4659be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x465a5c
add edi, ecx
jmp 0x4659be
pop esi
mov edi, esi
mov ecx, 0x33e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x465a7a
cmp byte [edi], 0
jne 0x465a7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x465a7f
lea edi, [esi + 0x63000]
mov eax, dword [edi]
or eax, eax
je 0x465aee
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x651f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x65254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x465aac
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x65258]
or eax, eax
je 0x465ae8
mov dword [ebx], eax
add ebx, 4
jmp 0x465ac9
call dword [esi + 0x6525c]
popal
jmp 0x40da18

Function at 0x440d8f
Capabilities:
Encode data using xor

Disassembly:
sub al, al
pushal
push 0x12daacbd
cmp dh, bl
repne scasb al, byte es:[edi]
push edi
jmp 0x440274
Function at 0x409c00
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push 0
push esi
push ebp
mov dword [0x21b4974], ebp
call section..text
mov al, byte [ebp*2 + 0x4a7fe8]
add esp, 0xc
test al, 1
je 0x409c33
inc dword [0x21b4980]
jmp 0x409d68
mov al, byte [0x21af790]
test al, al
jne 0x409d5a
cmp esi, 6
jl 0x409d5a
lea eax, [ebp*8]
sub eax, ebp
lea esi, [eax + eax*2]
shl esi, 6
mov al, byte [esi + 0x11861d4]
cmp al, 2
ja 0x409d5a
mov cl, byte [0x21af7a6]
test cl, cl
jne 0x409c7e
mov dl, byte [0x21af7a5]
test dl, dl
je 0x409d5a
mov edi, dword [esi + 0x11861d8]
test cl, cl
je 0x409cc5
cmp al, 2
jne 0x409cc5
lea eax, [edi + edi*4]
shl eax, 5
add eax, edi
mov cl, byte [eax*8 + 0x1b726e0]
test cl, cl
je 0x409cc5
push ebp
call fcn.00407eb0
add esp, 4
test al, al
je 0x409cc5
push ebp
call fcn.0040a730
add esp, 4
test al, al
je 0x409cc5
add dword [0x21b4980], 2
jmp 0x409d68
mov al, byte [0x21af7a5]
test al, al
je 0x409d3c
cmp byte [esi + 0x11861d4], 2
ja 0x409d3c
lea ecx, [edi + edi*4]
shl ecx, 5
add ecx, edi
mov al, byte [ecx*8 + 0x1b726e1]
test al, al
je 0x409d3c
push ebp
call fcn.00407f30
add esp, 4
test eax, eax
jle 0x409d3c
lea ecx, [eax*8]
sub ecx, eax
lea edx, [ecx + ecx*2]
shl edx, 6
mov cl, byte [edx + 0x11861c8]
test cl, cl
je 0x409d21
mov cl, byte [eax*2 + 0x4a7fe8]
mov esi, 1
test cl, 1
jne 0x409d26
mov esi, 2
push eax
push ebp
call fcn.0040a350
add esp, 8
test al, al
je 0x409d3c
add dword [0x21b4980], esi
jmp 0x409d68
mov al, byte [0x21af7a6]
test al, al
je 0x409d5a
push ebp
call fcn.0040a920
add esp, 4
test al, al
je 0x409d5a
inc dword [0x21b4980]
jmp 0x409d68
mov al, byte [esp + 0x18]
test al, al
je 0x409d68
inc dword [0x21b4978]
mov eax, dword [0x416034]
mov ecx, dword [0x21af798]
cdq
push edx
push eax
mov eax, dword [0x21af79c]
push eax
push ecx
call fcn.0040b1d0
or eax, edx
jne 0x409d8f
push ebp
call fcn.00409170
add esp, 4
mov al, byte [0x21af790]
pop edi
pop esi
pop ebp
test al, al
je 0x409daf
call fcn.00402060
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call fcn.0040bbc7
ret
Function at 0x40aa30
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov byte [0x4190b1], bl
mov byte [0x4190b2], bl
call fcn.0040aef0
mov esi, dword [esp + 0x30]
push esi
call fcn.0040ab20
push 1
push esi
call fcn.0040abc0
mov eax, dword [0x21b45d8]
add esp, 0xc
mov dword [0x21b45dc], eax
mov al, byte [0x4190b0]
cmp al, bl
jne 0x40aa87
call fcn.00408100
call fcn.00408b30
call fcn.0040a0c0
push ebx
call fcn.0040bbc7
mov ecx, dword [0x21b4988]
push ebx
push 0x40ade0
push ebx
push 0x81
push ecx
mov byte [0x4190b2], bl
mov byte [0x4190b1], bl
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov esi, eax
mov edx, dword [esp + 0x3c]
push edx
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea eax, [esp + 0x18]
push ebx
push eax
call edi
cmp eax, ebx
je 0x40ab09
mov ebp, dword [sym.imp.USER32.dll_IsDialogMessageA]
cmp eax, 0xffffffff
je 0x40ab0f
lea ecx, [esp + 0x10]
push ecx
push esi
call ebp
test eax, eax
jne 0x40aafb
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
lea ecx, [esp + 0x18]
push ebx
push ecx
call edi
cmp eax, ebx
jne 0x40aad4
push ebx
call fcn.0040bbc7
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x430001
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42ffd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10001440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x10009008]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 0xc]
push esi
sub eax, 0
je 0x10001586
sub eax, 1
jne 0x100015da
call fcn.10001eb0
push 0x10009700
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.hook.ini
push 0x10009700
push str._ls_ls
push 0x10009908
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x10]
push 0x10009908
push 0x104
push eax
push 0x100062a0
push str.DICT
push str.FileName
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push 0
push 0x104
push 0x10009b10
push 0xffffffffffffffff
lea eax, [esp + 0x24]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call fcn.100018c0
mov esi, dword [0x100096f8]
push 0x100096ec
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10002530
mov byte [0x100096e4], 0xe9
sub eax, esi
sub eax, 5
mov dword [0x100096e5], eax
mov eax, dword [esi]
mov dword [0x100096dc], eax
movzx eax, byte [esi + 4]
mov byte [0x100096e0], al
mov eax, dword [0x100096e4]
push 0x100096d0
mov dword [esi], eax
movzx eax, byte [0x100096e8]
push 0x40
mov byte [esi + 4], al
mov esi, dword [0x100096d8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10002870
mov byte [0x100096c8], 0xe9
sub eax, esi
sub eax, 5
mov dword [0x100096c9], eax
mov eax, dword [esi]
mov dword [0x100096c0], eax
movzx eax, byte [esi + 4]
mov byte [0x100096c4], al
mov eax, dword [0x100096c8]
mov dword [esi], eax
movzx eax, byte [0x100096cc]
mov byte [esi + 4], al
jmp 0x100015da
mov ecx, dword [0x100096f8]
mov eax, dword [0x100096dc]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ecx], eax
movzx eax, byte [0x100096e0]
mov byte [ecx + 4], al
lea eax, [esp + 8]
push eax
push dword [0x100096ec]
push 5
push ecx
call esi
mov ecx, dword [0x100096d8]
mov eax, dword [0x100096c0]
mov dword [ecx], eax
movzx eax, byte [0x100096c4]
mov byte [ecx + 4], al
lea eax, [esp + 0xc]
push eax
push dword [0x100096d0]
push 5
push ecx
call esi
mov ecx, dword [esp + 0x21c]
mov eax, 1
pop esi
xor ecx, esp
call fcn.10004a7b
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10001870
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, dword [0x100096f8]
push 0x100096ec
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10002530
mov byte [0x100096e4], 0xe9
sub eax, esi
sub eax, 5
mov dword [0x100096e5], eax
mov eax, dword [esi]
mov dword [0x100096dc], eax
movzx eax, byte [esi + 4]
mov byte [0x100096e0], al
mov eax, dword [0x100096e4]
mov dword [esi], eax
movzx eax, byte [0x100096e8]
mov byte [esi + 4], al
pop esi
ret