joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44bec0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3f000]
push edi
jmp 0x44beda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44bee1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44bed0
mov eax, 1
add ebx, ebx
jne 0x44bef3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44bf04
jne 0x44bf23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44bf23
dec eax
add ebx, ebx
jne 0x44bf10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44bee8
add ebx, ebx
jne 0x44bf1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x44bf75
xor ecx, ecx
sub eax, 3
jb 0x44bf3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44bfaa
sar eax, 1
mov ebp, eax
jmp 0x44bf46
add ebx, ebx
jne 0x44bf46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44bf14
inc ecx
add ebx, ebx
jne 0x44bf54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44bf14
add ebx, ebx
jne 0x44bf61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44bf56
jne 0x44bf72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44bf56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44bf94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44bf86
jmp 0x44bed6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44bf94
add edi, ecx
jmp 0x44bed6
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44bfb2
cmp byte [edi], 9
jne 0x44bfb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44bfb7
lea edi, [esi + 0x49000]
mov eax, dword [edi]
or eax, eax
je 0x44c02f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x79aec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x79bcc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44bfe4
mov ecx, edi
jns 0x44c013
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x79bd4]
or eax, eax
je 0x44c029
mov dword [ebx], eax
add ebx, 4
jmp 0x44c001
call dword [esi + 0x79bd0]
mov ebp, dword [esi + 0x79bd8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x44c063
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x414cad
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]

Function at 0x414ed2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x4f], 0x11
mov byte [ebp - 0x4e], 0x16
mov byte [ebp - 0x4d], 7
mov byte [ebp - 0x4c], 0xf
mov byte [ebp - 0x4b], 0x2b
mov byte [ebp - 0x4a], 0xc
mov byte [ebp - 0x49], 4
mov byte [ebp - 0x48], 0xd
mov byte [ebp - 0x47], 0x62
call fcn.00414c6d
test al, 0xef
cmp dword [edi - 0x73], ebp
inc ebp
test al, 0x50
call fcn.00414c7d
mov edi, dword [ebp + 0xc]
push eax
push edi
push dword [ebp + 8]
call fcn.00414c32
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xc]
div ecx
test edx, edx
je 0x414f45
invalid
invalid
je 0x414f42
Function at 0x41502f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
popfd
dec esp
mov byte [ebp - 0x62], 0x41
mov byte [ebp - 0x61], 0x7d
mov byte [ebp - 0x60], 0x5f
mov byte [ebp - 0x5f], 0x42
mov byte [ebp - 0x5e], 0x59
mov byte [ebp - 0x5d], 0x48
mov byte [ebp - 0x5c], 0x4e
mov byte [ebp - 0x5b], 0x59
mov byte [ebp - 0x5a], 0x2d
call fcn.00414c7d
push eax
push edi
push dword [ebp + 8]
call fcn.00414c32
mov dword [ebp - 0xc4], eax
mov byte [ebp - 0x44], bl
lea eax, [ebp - 0x44]
mov byte [ebp - 0x43], bl
push eax
mov byte [ebp - 0x42], 0xfd
mov byte [ebp - 0x41], bl
mov byte [ebp - 0x40], 0x4e
mov byte [ebp - 0x3f], 0x6d
mov byte [ebp - 0x3e], 0x63
mov byte [ebp - 0x3d], 0x66
mov byte [ebp - 0x3c], 0x4e
mov byte [ebp - 0x3b], 0x6b
mov byte [ebp - 0x3a], 0x60
mov byte [ebp - 0x39], 0x70
mov byte [ebp - 0x38], 0x63
mov byte [ebp - 0x37], 0x70
mov byte [ebp - 0x36], 0x7b
mov byte [ebp - 0x35], 0x43
mov byte [ebp - 0x34], 2
call fcn.00414c7d
push eax
push edi
push dword [ebp + 8]
call fcn.00414c32
add esp, 0x20
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0x84], bl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
invalid
jnp 0x415063
popfd
jg 0x4150dd
invalid
inc esi
inc ebp
add bl, 0xc6
inc ebp
and ecx, 0xf08245c6
mov byte [ebp - 0x7d], 0xc9
mov byte [ebp - 0x7c], 0xeb
mov byte [ebp - 0x7b], 0xe0
mov byte [ebp - 0x7a], 0xf1
mov byte [ebp - 0x79], 0xe8
mov byte [ebp - 0x78], 0xe1
mov byte [ebp - 0x77], 0xcc
mov byte [ebp - 0x76], 0xe5
mov byte [ebp - 0x75], 0xea
mov byte [ebp - 0x74], 0xe0
mov byte [ebp - 0x73], 0xe8
mov byte [ebp - 0x72], 0xe1
mov byte [ebp - 0x71], 0xc5
mov byte [ebp - 0x70], 0x84
call fcn.00414c6d
popfd
leave
test al, 0x9f
lea eax, [ebp - 0x84]
push eax
call fcn.00414c7d
push eax
push edi
push dword [ebp + 8]
call fcn.00414c32
add esp, 0x10
mov dword [ebp - 0xb8], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov edi, eax
mov dword [ebp + 0xc], edi
call fcn.00414c6d
xchg ebx, eax
sub ecx, dword [edx + 0x3e]
cmp edi, ebx
je 0x415484
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push edi
call fcn.00414bde
add esp, 0xc
cmp word [esi + 6], bx
mov dword [ebp - 8], ebx
jbe 0x4151e7
movzx eax, word [ebp - 8]
mov ecx, dword [ebp - 0xc0]
lea eax, [eax + eax*4]
lea edi, [ecx + eax*8]
mov eax, dword [ecx + eax*8 + 0xc]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xbc], eax
mov eax, dword [edi + 0x14]
add eax, dword [ebp + 0x10]
mov dword [ebp - 0x88], eax
call fcn.00414c6d
and eax, 0xff36174c
ja 0x4151d3
invalid
invalid
Function at 0x41531b
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x41532c
lea edi, [eax + 8]
mov ecx, dword [eax + 4]
add ecx, eax
cmp edi, ecx
jae 0x415327
movzx ecx, word [edi]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne fcn.0041531b
mov edx, dword [ebp + 0xc]
and ecx, 0xfff
add ecx, dword [ebp + 0xc]
sub edx, dword [esi + 0x34]
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x415323
cmp edx, ebx
jne 0x415478
inc edi
inc edi
jmp 0x4152ea
add eax, dword [eax + 4]
jmp 0x4152e3
mov dword [ebp - 8], ebx
jmp 0x415337
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
inc esi
push es
jne 0x415350
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x415378
call fcn.00414c6d
mov ss, word [ecx]
jne 0x4152e5
movzx eax, word [ebp - 8]
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp + 8], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x4153ce
mov edx, esi
mov edi, esi
and edx, 0x20000000
and edi, 0x40000000
and esi, 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4153b7
or byte [eax + ecx], 1
cmp edi, ebx
je 0x4153bf
or byte [eax + ecx], 2
cmp esi, ebx
je 0x4153c8
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe 0x4153ac
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x415331
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41541b
dec eax
je 0x415412
sub eax, 3
je 0x415409
mov dword [ebp - 4], 0x40
jmp 0x41541e
mov dword [ebp - 4], 4
jmp 0x41541e
mov dword [ebp - 4], 0x20
jmp 0x41541e
mov dword [ebp - 4], ecx
call fcn.00414c6d
mov eax, dword [0x83d48638]
aam 0x83
jge 0x415426
inc eax
je 0x415445
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push esi
call dword [ebp - 0xc4]
test eax, eax
je 0x415478
add esi, dword [ebp - 0xac]
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4153ea
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 0x28]
add esi, dword [ebp + 0xc]
call fcn.00414c6d
push ds
iretd
push 0x8000
push ebx
push dword [ebp + 0xc]
call dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41533d
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x41532c
lea edi, [eax + 8]
mov ecx, dword [eax + 4]
add ecx, eax
cmp edi, ecx
jae 0x415327
movzx ecx, word [edi]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne fcn.0041531b
mov edx, dword [ebp + 0xc]
and ecx, 0xfff
add ecx, dword [ebp + 0xc]
sub edx, dword [esi + 0x34]
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x415323
cmp edx, ebx
jne 0x415478
inc edi
inc edi
jmp 0x4152ea
add eax, dword [eax + 4]
jmp 0x4152e3
mov dword [ebp - 8], ebx
jmp 0x415337
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
inc esi
push es
jne 0x415350
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x415378
call fcn.00414c6d
mov ss, word [ecx]
jne 0x4152e5
movzx eax, word [ebp - 8]
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp + 8], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x4153ce
mov edx, esi
mov edi, esi
and edx, 0x20000000
and edi, 0x40000000
and esi, 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4153b7
or byte [eax + ecx], 1
cmp edi, ebx
je 0x4153bf
or byte [eax + ecx], 2
cmp esi, ebx
je 0x4153c8
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe 0x4153ac
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x415331
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41541b
dec eax
je 0x415412
sub eax, 3
je 0x415409
mov dword [ebp - 4], 0x40
jmp 0x41541e
mov dword [ebp - 4], 4
jmp 0x41541e
mov dword [ebp - 4], 0x20
jmp 0x41541e
mov dword [ebp - 4], ecx
call fcn.00414c6d
mov eax, dword [0x83d48638]
aam 0x83
jge 0x415426
inc eax
je 0x415445
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push esi
call dword [ebp - 0xc4]
test eax, eax
je 0x415478
add esi, dword [ebp - 0xac]
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4153ea
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 0x28]
add esi, dword [ebp + 0xc]
call fcn.00414c6d
push ds
iretd
push 0x8000
push ebx
push dword [ebp + 0xc]
call dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417e52
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
lea eax, [esi + 4]
xor ebx, ebx
cmp dword [eax], ebx
jne 0x417e6c
push ebx
push ebx
push eax
call fcn.00417ce5
cmp eax, ebx
jne 0x417ec5
push edi
lea edi, [esi + 8]
cmp dword [edi], ebx
jne 0x417e80
push ebx
push ebx
push edi
call fcn.00417ce5
cmp eax, ebx
jne 0x417ec4
lea eax, [esi + 4]
call fcn.00417df7
mov eax, edi
call fcn.00417df7
mov byte [esi + 0x10], bl
cmp dword [esi + 0xc], ebx
je 0x417e9b
xor eax, eax
jmp 0x417ec4
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x417e12
push ebx
push ebx
call fcn.00423107
add esp, 0x18
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x417e97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x417ec4
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret

Function at 0x418ef1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429050]
jne 0x418efb
repz ret
jmp fcn.0041a95a

Function at 0x41d28b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0041a188
and dword [ebp - 0x14], 0
cmp dword [0x42aeb0], 0
mov dword [ebp - 0x18], eax
jne 0x41d33e
push 0x401fa0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41d3e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401f94
push ebx
call edi
test eax, eax
je 0x41d3e6
mov esi, dword [fcn.004028b4]
push eax
call esi
push 0x401f84
push ebx
mov dword [0x42aeb0], eax
call edi
push eax
call esi
push 0x401f70
push ebx
mov dword [0x42aeb4], eax
call edi
push eax
call esi
push 0x401f54
push ebx
mov dword [0x42aeb8], eax
call edi
push eax
call esi
mov dword [0x42aec0], eax
test eax, eax
je 0x41d33e
push 0x401f3c
push ebx
call edi
push eax
call esi
mov dword [0x42aebc], eax
mov eax, dword [0x42aebc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004028b0]
cmp eax, ecx
je 0x41d397
cmp dword [0x42aec0], ecx
je 0x41d397
push eax
call esi
push dword [0x42aec0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41d397
test ebx, ebx
je 0x41d397
call edi
test eax, eax
je 0x41d38e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41d38e
test byte [ebp - 8], 1
jne 0x41d397
or dword [ebp + 0x10], 0x200000
jmp 0x41d3ca
mov eax, dword [0x42aeb4]
cmp eax, dword [ebp - 0x18]
je 0x41d3ca
push eax
call esi
test eax, eax
je 0x41d3ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41d3ca
mov eax, dword [0x42aeb8]
cmp eax, dword [ebp - 0x18]
je 0x41d3ca
push eax
call esi
test eax, eax
je 0x41d3ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42aeb0]
call esi
test eax, eax
je 0x41d3e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41d3e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418ef1
leave
ret
Function at 0x424290
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x429050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
cmp edi, 8
mov dword [ebp - 0x50], eax
ja 0x4242c5
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.0041d8a0
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.00424380
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.00424180
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.00424380
xor eax, eax
push 0x40
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push eax
add esi, 0x28
push esi
call fcn.0041d8a0
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418ef1
mov esp, ebp
pop ebp
ret 8

Function at 0xc654d8
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub eax, dword [edx + ecx + 0x10]
jmp 0xbd6afd
je 0xd27633
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x837261
je 0xd27633
mov eax, dword [eax + ecx + 0x7c]
cmp cl, 0xc7
clc
cmc
push ebx
push edi
cmc
clc
mov dword [ebp - 0x10], eax
stc
mov dword [ebp - 8], 0xffffffff
clc
cmc
cmp esi, 0xffff
jmp 0x891b09
mov edi, dword [edx + ecx + 0x18]
jmp 0xc9647b
je 0xd27633
mov eax, 0x5a4d
cmp al, 0xa1
jmp 0xc13037
ja 0x81fcac
mov eax, esi
test ecx, ecx
jmp 0x7a22c7
cmp dword [eax + ecx], 0x4550
jmp 0xbe98bc
mov dword [ebp - 8], eax
jmp 0xd08ac7
jne 0xd27633
mov edx, dword [eax + ecx + 0x78]
cmp ax, di
jmp 0xca3894
add eax, ecx
cmp ah, 0xb
cmp bp, si
xor ebx, ebx
jmp 0xd01ca8
cmp word [ecx], ax
jmp 0xd2762d
push ebp
mov ebp, esp
xor cl, 0xf2
ror cl, cl
mov ecx, dword [ebp + 8]
lea esp, [esp - 0x114]
push esi
clc
test ecx, ecx
jmp 0x7ca930
js 0x8302a4
jmp 0xd16cda
je 0x8302a4
mov eax, dword [edx + ecx + 0x20]
test bx, 0x78ab
cmp ah, dl
jmp 0xbefab2
mov eax, dword [ecx + 0x3c]
jmp 0xbd537c
test edi, edi
jmp 0xc74b18
mov dword [ebp - 4], edx
test edx, edx
jmp 0x81bf06
ret
dec edi
jmp 0xd1b746
jmp 0x8302a4
mov dword [ebp - 0xc], eax
jmp 0xc66898
je 0xc85398
xor eax, eax
pop esi
mov esp, ebp
pop ebp
jmp 0xcd1877
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x4015e6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x401613
call fcn.00401ad0
mov dword [eax], esi
call fcn.00401abd
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00401a5e
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4015ef
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401642
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401ae3
pop ecx
call fcn.00401abd
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x401669
test al, 1
je 0x401669
test byte [esp + 0xc], 2
je 0x401669
call fcn.00401ad0
mov dword [eax], 5
call fcn.00401abd
mov dword [eax], 0xd
jmp 0x401639
xor eax, eax
pop esi
ret

Function at 0x401681
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40168b
repz ret
jmp fcn.00401b01
Function at 0x403b71
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00402b52
xor ebx, ebx
cmp dword [0x40b700], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x403c46
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x403bb1
xor eax, eax
jmp 0x403d0a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x403baa
push eax
call fcn.00402aef
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b700], eax
call esi
push eax
call fcn.00402aef
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b704], eax
call esi
push eax
call fcn.00402aef
mov dword [0x40b708], eax
lea eax, [ebp - 8]
push eax
call fcn.00401da8
test eax, eax
pop ecx
pop ecx
je 0x403c14
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00401962
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x403c46
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00402aef
cmp eax, ebx
pop ecx
mov dword [0x40b710], eax
je 0x403c46
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402aef
pop ecx
mov dword [0x40b70c], eax
mov eax, dword [0x40b70c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x403cbf
cmp dword [0x40b710], esi
je 0x403cbf
push eax
call fcn.00402b5b
pop ecx
call eax
cmp eax, ebx
je 0x403c8c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x40b710]
call fcn.00402b5b
pop ecx
call eax
test eax, eax
je 0x403c8c
test byte [ebp - 0x18], 1
jne 0x403cbf
lea eax, [ebp - 0xc]
push eax
call fcn.00401ddf
test eax, eax
pop ecx
je 0x403ca7
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00401962
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x403cb6
or dword [ebp + 0x10], 0x200000
jmp 0x403cf0
or dword [ebp + 0x10], 0x40000
jmp 0x403cf0
mov eax, dword [0x40b704]
cmp eax, esi
je 0x403cf0
push eax
call fcn.00402b5b
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x403cf0
mov eax, dword [0x40b708]
cmp eax, esi
je 0x403cf0
push dword [ebp - 4]
push eax
call fcn.00402b5b
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x40b700]
call fcn.00402b5b
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4010a0
Capabilities:
Schedule task via itaskservice

Disassembly:
push ebx
sub esp, 0xa8
lea eax, [esp + 0x5c]
mov dword [esp + 0xc], 0x40446c
mov dword [esp + 0x10], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x40431c
call sym._CoCreateInstance_20
sub esp, 0x14
test eax, eax
js 0x401229
xor edx, edx
xor ecx, ecx
mov eax, dword [esp + 0x5c]
xor ebx, ebx
mov word [esp + 0x60], dx
xor edx, edx
mov word [esp + 0x70], cx
mov word [esp + 0x90], dx
mov ecx, dword [esp + 0x90]
mov edx, dword [eax]
mov word [esp + 0x80], bx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x94]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x10], ecx
call dword [edx + 0x28]
sub esp, 0x44
test eax, eax
js 0x4011f8
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x90]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x1c]
sub esp, 0xc
mov ebx, eax
mov eax, dword [esp + 0x5c]
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
sub esp, 4
mov eax, dword [esp + 0x90]
test ebx, ebx
js 0x401238
add esp, 0xa8
pop ebx
ret
test byte [0x403000], 1
je 0x401229
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Connect_failed:__08x_n
mov dword [esp + 8], global___FUNCTION__
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
add esp, 0xa8
xor eax, eax
pop ebx
ret
test byte [0x403000], 1
je 0x401229
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.GetFolder_failed:__08x_n
jmp 0x40120d