joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a6799
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x42c], eax
call fcn.004d3968
cmp dword [0x667644], 8
mov ecx, 0x667630
push 0
cmovae ecx, dword [0x667630]
mov edx, dword [eax]
push ecx
push 0
push 0
mov ecx, eax
call dword [edx + 0x1a4]
mov ebx, eax
jmp 0x5a6985
call fcn.004d3968
cmp dword [0x6676a4], 8
mov ecx, 0x667690
cmovae ecx, dword [0x667690]
mov edx, dword [eax]
push ecx
push ebx
mov ecx, eax
call dword [edx + 0x1b0]
mov dword [ebp - 0x430], eax
call fcn.004d3968
cmp dword [0x667674], 8
mov ecx, 0x667660
cmovae ecx, dword [0x667660]
mov edx, dword [eax]
push ecx
push ebx
mov ecx, eax
call dword [edx + 0x1b0]
push 0x400
mov esi, eax
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0056dc10
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
lea edi, [ebp - 0x410]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x428]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x404]
push eax
call fcn.00417c00
push 0x26
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004d2cd6
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.00417a51
cmp word [ebp - 0x404], 0
je 0x5a6949
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 0x410]
sub eax, ecx
push 0x18
cdq
pop edi
idiv edi
cmp eax, 2
jbe 0x5a6949
lea eax, [ecx + 0x18]
mov ecx, dword [ebp - 0x42c]
push eax
call int.0041eaff
mov eax, dword [ebp - 0x410]
lea ecx, [ebp - 0x428]
and dword [ebp - 0x418], 0
add eax, 0x30
and dword [ebp - 0x414], 0
push eax
call fcn.0041ec95
cmp dword [ebp - 0x414], 8
lea ecx, [ebp - 0x404]
mov edi, dword [ebp - 0x430]
lea eax, [ebp - 0x428]
cmovae eax, dword [ebp - 0x428]
push ecx
push eax
push esi
push edi
push str.CQuickLaunchImpl::FindStandbyWindow____find_standby_window__launchtype:_d__standbystatus:_d__client_build_version:_s__window_name:_s
call fcn.005a9728
add esp, 0x14
cmp edi, 2
jne 0x5a693e
cmp esi, 0x14
je 0x5a69a0
lea ecx, [ebp - 0x428]
call fcn.00417a51
call fcn.004d3968
cmp dword [0x667644], 8
mov ecx, 0x667630
push 0
cmovae ecx, dword [0x667630]
mov edi, eax
push ecx
push ebx
mov esi, dword [edi]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, edi
call dword [esi + 0x1a4]
lea ecx, [ebp - 0x410]
mov ebx, eax
call fcn.0041d643
test ebx, ebx
jne 0x5a67f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ac5f
leave
ret 8
mov ecx, dword [ebp - 0x434]
lea eax, [ebp - 0x428]
push eax
call int.0041eaff
lea ecx, [ebp - 0x428]
call fcn.00417a51
lea ecx, [ebp - 0x410]
call fcn.0041d643
mov eax, ebx
jmp 0x5a698f
Function at 0x5a92b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x10
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
mov esi, eax
push esi
push 0x605598
call fcn.005a9728
pop ecx
pop ecx
cmp esi, 0x27
je 0x5a92d8
xor al, al
jmp 0x5a93b1
push ebx
push edi
push 0x48
call fcn.0056aca1
mov esi, eax
xor ebx, ebx
pop ecx
test esi, esi
je 0x5a9301
push 0x48
push ebx
push esi
call fcn.0056dc10
add esp, 0xc
mov ecx, esi
call fcn.004e1913
mov edi, eax
jmp 0x5a9303
mov edi, ebx
mov dword [ebp - 4], edi
test edi, edi
je 0x5a939a
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov eax, dword [edi]
mov ecx, edi
push reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWAREWebExCASL
call dword [eax + 0x14]
test eax, eax
je 0x5a9350
mov eax, dword [edi]
mov ecx, edi
push ebx
push str.CASLDISCLAIMED
call dword [eax + 0x18]
mov esi, eax
push esi
push str.CQuickLaunchImpl::NeedPopCASLStatement.LocalMachine_GetValueInt_:_d
call fcn.005a9728
mov edx, dword [edi]
pop ecx
pop ecx
mov ecx, edi
call dword [edx + 0x10]
test esi, esi
jne 0x5a93a5
mov eax, dword [edi]
mov ecx, edi
push ebx
push str.SOFTWAREWebExCASL
call dword [eax + 0x14]
test eax, eax
jne 0x5a936f
push str.CQuickLaunchImpl::NeedPopCASLStatement.Open_failed
call fcn.005a9728
mov bl, 1
jmp 0x5a93a4
mov eax, dword [edi]
mov ecx, edi
push ebx
push str.CASLDISCLAIMED
call dword [eax + 0x18]
mov esi, eax
push esi
push str.CQuickLaunchImpl::NeedPopCASLStatement.GetValueInt_:_d
call fcn.005a9728
mov edx, dword [edi]
pop ecx
pop ecx
mov ecx, edi
call dword [edx + 0x10]
test esi, esi
jne 0x5a93a5
mov bl, 1
jmp 0x5a93a5
push str.CQuickLaunchImpl::NeedPopCASLStatement.new__CGPCRegistryImpl_failed
call fcn.005a970b
pop ecx
lea ecx, [ebp - 4]
call fcn.0044fe57
pop edi
mov al, bl
pop ebx
pop esi
leave
ret

Function at 0x5aa8d1
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
xor eax, eax
lea edi, [esi + 0x40]
push edi
push eax
push esi
push 0x5aa6c0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x3c], eax
add esi, 0x48
test eax, eax
je 0x5aa90b
cmp dword [esi + 0x14], 8
jb 0x5aa8fc
mov esi, dword [esi]
push dword [edi]
push esi
push str.gpc__thread___s__create_download_thread_success__tid_d
call fcn.005aa6f2
jmp 0x5aa925
cmp dword [esi + 0x14], 8
jb 0x5aa913
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.gpc__thread___s__DownloadFile_failed_to_create_thread_error_d
call fcn.005aa6d5
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret
Function at 0x5b04fb
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0xf003f
push str.ServicesActive
xor edi, edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x5b0616
push esi
push 0xf01ff
push str.Spooler
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x5b0550
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x5b0615
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x5b0607
cmp dword [ebp - 0x1c], 4
jne 0x5b0571
xor edi, edi
inc edi
jmp 0x5b0607
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x5b0607
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x5b0607
jmp 0x5b05d2
mov eax, dword [ebp - 8]
xor edx, edx
push 0xa
pop ecx
div ecx
mov ecx, 0x3e8
cmp eax, ecx
jae 0x5b05aa
mov eax, ecx
jmp 0x5b05b4
mov ecx, 0x2710
cmp eax, ecx
cmova eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x5b05fb
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xc], eax
jbe 0x5b05e3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
jmp 0x5b05f1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 8]
ja 0x5b05fb
mov ecx, dword [ebp - 0x1c]
cmp ecx, 2
je 0x5b0593
jmp 0x5b05fe
mov ecx, dword [ebp - 0x1c]
xor eax, eax
inc eax
cmp ecx, 4
cmove edi, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push ebx
call esi
mov eax, edi
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0056ac5f
leave
ret
Function at 0x5b10c7
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a8
mov eax, dword [0x654b34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x34]
push 0x6086c0
push edi
push eax
mov ebx, ecx
call fcn.0041d9d5
add esp, 0xc
lea ecx, [ebp - 0x284]
cmp dword [ebp - 0x20], 8
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5b111a
push eax
jmp 0x5b11fd
cmp word [ebp - 0x258], 0x2e
je 0x5b11e6
test byte [ebp - 0x284], 0x10
lea eax, [ebp - 0x258]
push eax
push 0x60de24
lea eax, [ebp - 0x2a8]
push edi
push eax
je 0x5b1172
call fcn.0041d9d5
add esp, 0xc
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0044ffb3
add esp, 0xc
lea ecx, [ebp - 0x2a8]
call fcn.00417a51
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.005b10c7
jmp 0x5b11de
call fcn.0041d9d5
add esp, 0xc
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0044ffb3
add esp, 0xc
lea ecx, [ebp - 0x2a8]
call fcn.00417a51
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x288]
push eax
mov eax, 0x609e5c
push eax
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.005b017b
add esp, 0x18
lea ecx, [ebx + 4]
push eax
call fcn.005b00d1
mov ecx, dword [ebp - 0x28c]
test ecx, ecx
je 0x5b11de
call fcn.00417572
lea ecx, [ebp - 0x1c]
call fcn.00417a51
lea eax, [ebp - 0x284]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x5b111a
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x34]
call fcn.00417a51
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056ac5f
leave
ret 4
Function at 0x4019fb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401a3a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a3a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a3a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a3a
cmp dword [ecx + 0x74], 0xe
jbe 0x401a3a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40acfc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40ad99
push ebx
push esi
call fcn.0040acc5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040ac59
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40ad46
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ad98
push edi
push eax
call fcn.00407ea5
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40ad66
call fcn.00407e6b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ad97
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040ac59
add esp, 0x20
test eax, eax
jne 0x40ad85
push edi
call fcn.00407e6b
jmp 0x40ad8d
push ebx
call fcn.00407e6b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40ba55
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415160
push 0x415158
push str.FlsAlloc
push 0x1f
call fcn.0040b971
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ba89
push dword [ebp + 8]
mov ecx, esi
call dword [0x41310c]
call esi
jmp 0x40ba8f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40bad3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415170
push 0x415168
push str.FlsGetValue
push 0x21
call fcn.0040b971
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40bb0a
push dword [ebp + 8]
mov ecx, esi
call dword [0x41310c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40bb12
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415178
push 0x415170
push str.FlsSetValue
push 0x22
call fcn.0040b971
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40bb4c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41310c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412850
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41287d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41287d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x53cc40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x137000]
push edi
jmp 0x53cc5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53cc61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53cc50
mov eax, 1
add ebx, ebx
jne 0x53cc73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53cc84
jne 0x53cca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53cca3
dec eax
add ebx, ebx
jne 0x53cc90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53cc68
add ebx, ebx
jne 0x53cc9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53ccf5
xor ecx, ecx
sub eax, 3
jb 0x53ccbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53cd2a
sar eax, 1
mov ebp, eax
jmp 0x53ccc6
add ebx, ebx
jne 0x53ccc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53cc94
inc ecx
add ebx, ebx
jne 0x53ccd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53cc94
add ebx, ebx
jne 0x53cce1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53ccd6
jne 0x53ccf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53ccd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53cd14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53cd06
jmp 0x53cc56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53cd14
add edi, ecx
jmp 0x53cc56
pop esi
mov edi, esi
mov ecx, 0x255
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53cd32
cmp byte [edi], 1
jne 0x53cd32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53cd37
lea edi, [esi + 0x13a000]
mov eax, dword [edi]
or eax, eax
je 0x53cdaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x144664]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x144718]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53cd64
mov ecx, edi
jns 0x53cd93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14471c]
or eax, eax
je 0x53cda9
mov dword [ebx], eax
add ebx, 4
jmp 0x53cd81
call dword [esi + 0x14472c]
mov ebp, dword [esi + 0x144720]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53cde3
sub esp, 0xffffff80
jmp 0x40354b
Function at 0x4014e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x401538
cmp byte [ebx + esi - 1], 0xa
je 0x40150c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x401b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x401d14
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x405084]
cmp dword [edx + 0x24], edi
je 0x401c37
test byte [0x402018], 8
jne 0x401cc0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x402028], 8
jne 0x401c83
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401bd9
cmp esi, 3
jbe 0x401c42
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x401bea
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4040e4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x401bd9
mov dword [esp], 0x402028
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401bb0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401bb0
mov dword [esp], 0x402018
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x401b9b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401ba3
mov eax, 0xffffffff
jmp 0x401c37

Function at 0x401d80
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x614c7495
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x77a07554
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0xac94b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4ca000]
push edi
jmp 0xac94ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xac94d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac94c0
mov eax, 1
add ebx, ebx
jne 0xac94e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xac94f4
jne 0xac9513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac9513
dec eax
add ebx, ebx
jne 0xac9500
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xac94d8
add ebx, ebx
jne 0xac950f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xac9565
xor ecx, ecx
sub eax, 3
jb 0xac952b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xac959a
sar eax, 1
mov ebp, eax
jmp 0xac9536
add ebx, ebx
jne 0xac9536
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac9504
inc ecx
add ebx, ebx
jne 0xac9544
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xac9504
add ebx, ebx
jne 0xac9551
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xac9546
jne 0xac9562
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xac9546
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xac9584
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xac9576
jmp 0xac94c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xac9584
add edi, ecx
jmp 0xac94c6
pop esi
mov edi, esi
mov ecx, 0x2c9b9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xac95a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xac95a7
lea edi, [esi + 0x6c4000]
mov eax, dword [edi]
or eax, eax
je 0xac9618
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6d8e00]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6d8fcc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xac95cd
mov ecx, edi
jns 0xac95fc
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6d8fd0]
or eax, eax
je 0xac9612
mov dword [ebx], eax
add ebx, 4
jmp 0xac95ea
call dword [esi + 0x6d8fe0]
mov ebp, dword [esi + 0x6d8fd4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xac964c
sub esp, 0xffffff80
jmp 0x6fe9ef