joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x39000]
push edi
jmp 0x450e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x450e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450e80
mov eax, 1
add ebx, ebx
jne 0x450ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x450eb4
jne 0x450ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450ed3
dec eax
add ebx, ebx
jne 0x450ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x450e98
add ebx, ebx
jne 0x450ecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x450f25
xor ecx, ecx
sub eax, 3
jb 0x450eeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x450f5a
sar eax, 1
mov ebp, eax
jmp 0x450ef6
add ebx, ebx
jne 0x450ef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450ec4
inc ecx
add ebx, ebx
jne 0x450f04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x450ec4
add ebx, ebx
jne 0x450f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x450f06
jne 0x450f22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x450f06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x450f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x450f36
jmp 0x450e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x450f44
add edi, ecx
jmp 0x450e86
pop esi
mov edi, esi
mov ecx, 0xc7f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x450f62
cmp byte [edi], 0x11
jne 0x450f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x450f67
lea edi, [esi + 0x4d000]
mov eax, dword [edi]
or eax, eax
je 0x450fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5fa54]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5faac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x450f94
mov ecx, edi
jns 0x450fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5fab4]
or eax, eax
je 0x450fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x450fb1
call dword [esi + 0x5fab0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x451010
cmp al, 0xef
ja 0x451003
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x450fe5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x450ff2
mov ebp, dword [esi + 0x5fab8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x451044
sub esp, 0xffffff80
jmp 0x407e9a
Function at 0x4038be
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x4038e7
cmp al, 0x22
je 0x4038df
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4038d3
cmp byte [esi], 0x22
jne 0x4038f1
inc esi
jmp 0x4038f1
cmp al, 0x20
jle 0x4038f1
inc esi
cmp byte [esi], 0x20
jg 0x4038eb
mov al, byte [esi]
test al, al
je 0x4038fb
cmp al, 0x20
jle 0x4038e4
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00403969
push 0x405004
push section..data
call fcn.0040394f
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40392b
movzx eax, word [ebp - 0x14]
jmp 0x40392e
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
jmp 0x41b230

Function at 0x507580
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd0000]
push edi
or ebp, 0xffffffff
jmp 0x5075a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5075a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x507598
mov eax, 1
add ebx, ebx
jne 0x5075bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5075cc
jne 0x5075dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5075dc
dec eax
add ebx, ebx
jne 0x5075d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5075b0
xor ecx, ecx
sub eax, 3
jb 0x5075f4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x507666
sar eax, 1
mov ebp, eax
jmp 0x5075ff
add ebx, ebx
jne 0x5075ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50760c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x507630
inc ecx
add ebx, ebx
jne 0x50761c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x507611
jne 0x50762d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x507611
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x507650
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x507641
jmp 0x50759e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x507650
add edi, ecx
jmp 0x50759e
pop esi
mov edi, esi
mov ecx, 0x67ca
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50766e
cmp byte [edi], 0x35
jne 0x50766e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x507673
lea edi, [esi + 0x103000]
mov eax, dword [edi]
or eax, eax
je 0x5076e2
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1080b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1081a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5076a0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1081a4]
or eax, eax
je 0x5076dc
mov dword [ebx], eax
add ebx, 4
jmp 0x5076bd
call dword [esi + 0x1081a8]
popal
jmp 0x4bd3d8
Function at 0x2fa3c70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
jmp 0x2fa3c8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x2fa3c91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2fa3c80
mov eax, 1
add ebx, ebx
jne 0x2fa3ca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x2fa3cb4
jne 0x2fa3cd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2fa3cd3
dec eax
add ebx, ebx
jne 0x2fa3cc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x2fa3c98
add ebx, ebx
jne 0x2fa3ccf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x2fa3d25
xor ecx, ecx
sub eax, 3
jb 0x2fa3ceb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x2fa3d5a
sar eax, 1
mov ebp, eax
jmp 0x2fa3cf6
add ebx, ebx
jne 0x2fa3cf6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2fa3cc4
inc ecx
add ebx, ebx
jne 0x2fa3d04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x2fa3cc4
add ebx, ebx
jne 0x2fa3d11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x2fa3d06
jne 0x2fa3d22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x2fa3d06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x2fa3d44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x2fa3d36
jmp 0x2fa3c86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x2fa3d44
add edi, ecx
jmp 0x2fa3c86
pop esi
mov edi, esi
mov ecx, 0x181
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x2fa3d62
cmp byte [edi], 0x48
jne 0x2fa3d62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x2fa3d67
mov ebp, dword [esi + 0x63034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x2fa3dc2
sub esp, 0xffffff80
jmp 0x2f41758
Function at 0x42d221
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x42d230
pop dword [ebp - 0x34]
mov eax, 0x42d230
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x51cf5
push 0
mov eax, 0xf0d884b4
add eax, 0xf6c2dfc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xf41c5a86
sub ecx, 0xf41c0c45
xor esi, esi
add esi, eax
mov edi, 0x3917ed7
add edi, 0xfcb5df29
add edi, dword [ebp - 0x34]
mov edx, 0x43f860d7
add edx, 0xa34e7e5b
sub dword [ebp - 0x10], edi
mov ebx, dword [edi]
xor dword [ebp - 0x28], 0xb212e4c9
sub ebx, edx
mov dword [ebp - 0x2c], 0x6ca4727c
mov dword [esi], ebx
add dword [ebp - 0x30], edx
add esi, 0xbecff465
sub esi, 0xbecff461
add edi, 0xbd412099
add edi, 0x42bedf6b
loop 0x42d28c
add eax, 0x7ad4de9b
add eax, 0x852c4d3c
mov ebx, eax
add eax, 5
mov ecx, 0xd9a0f542
sub ecx, 0xd960f542
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43f004]
jne 0x40100a
repz ret
jmp fcn.004016b5

Function at 0x405d4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004031ad
and dword [ebp - 0x14], 0
cmp dword [0x441c74], 0
mov dword [ebp - 0x18], eax
jne 0x405dfd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405ea5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405ea5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x441c74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x441c78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x441c7c], eax
call edi
push eax
call esi
mov dword [0x441c84], eax
test eax, eax
je 0x405dfd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x441c80], eax
mov eax, dword [0x441c80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405e56
cmp dword [0x441c84], ecx
je 0x405e56
push eax
call esi
push dword [0x441c84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405e56
test ebx, ebx
je 0x405e56
call edi
test eax, eax
je 0x405e4d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405e4d
test byte [ebp - 8], 1
jne 0x405e56
or dword [ebp + 0x10], 0x200000
jmp 0x405e89
mov eax, dword [0x441c78]
cmp eax, dword [ebp - 0x18]
je 0x405e89
push eax
call esi
test eax, eax
je 0x405e89
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405e89
mov eax, dword [0x441c7c]
cmp eax, dword [ebp - 0x18]
je 0x405e89
push eax
call esi
test eax, eax
je 0x405e89
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x441c74]
call esi
test eax, eax
je 0x405ea5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405ea7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x40a240
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
jmp 0x40a25a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40a261
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40a250
mov eax, 1
add ebx, ebx
jne 0x40a273
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40a268
jne 0x40a284
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a268
xor ecx, ecx
sub eax, 3
jb 0x40a298
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40a30a
mov ebp, eax
add ebx, ebx
jne 0x40a2a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40a2b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40a2d4
inc ecx
add ebx, ebx
jne 0x40a2c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40a2b5
jne 0x40a2d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40a2b5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40a2f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40a2e5
jmp 0x40a256
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40a2f4
add edi, ecx
jmp 0x40a256
pop esi
lea edi, [esi + 0x8000]
mov eax, dword [edi]
or eax, eax
je 0x40a353
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbb6c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbbc4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40a311
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbbcc]
or eax, eax
je 0x40a34d
mov dword [ebx], eax
add ebx, 4
jmp 0x40a32e
call dword [esi + 0xbbc8]
mov ebp, dword [esi + 0xbbd0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40a387
sub esp, 0xffffff80
jmp 0x4014c4
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0xfd3558d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x37a67182
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1001aa95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001aaa4
pop dword [ebp - 0x20]
mov eax, 0xee1890ce
sub eax, 0xde16e62a
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x6cfa3cbd
sub dword [ebp - 0x30], 0x1ea7f772
mov dword [ebp - 0x2c], 0xc9a16296
add dword [ebp - 0x2c], 0x6891e9af
mov dword [ebp - 0x28], 0xc2ce5a7c
add dword [ebp - 0x28], 0x897de9b2
mov dword [ebp - 0x24], 0x6cd69c45
add dword [ebp - 0x24], 0x932963bb
lea eax, [ebp - 0x30]
push eax
mov eax, 0xab19b44
add eax, 0x553f5c8
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x1096e8cf
add dword [ebp - 0x30], 0x63db8087
mov dword [ebp - 0x2c], 0xa9bdd144
add dword [ebp - 0x2c], 0x97ae9031
mov dword [ebp - 0x28], 0xa26894fc
add dword [ebp - 0x28], 0xc106d770
mov dword [ebp - 0x24], 0xcf061baf
sub dword [ebp - 0x24], 0xcf061baf
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xb1f2d07c
add eax, 0x5e12bfc4
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x5d801
push 0
call eax
mov ecx, 0x329e4808
add ecx, 0xcd61fff2
mov esi, eax
mov edi, 0x9b37cf0e
sub edi, 0x8b313b0e
add edi, dword [ebp - 0x20]
mov edx, 0x1d10b542
add edx, 0xe751bd51
mov ebx, dword [edi]
xor ebx, edx
mov dword [ebp - 0x10], 0x79fe5d82
mov dword [esi], ebx
add dword [ebp - 0xc], 0x16f483e2
add esi, 4
add edi, 0x317ef165
sub edi, 0x317ef161
loop 0x1001abc6
add eax, 0x112bb
mov ebx, eax
add eax, 0x9bbdbf15
sub eax, 0x9bbdbf10
mov ecx, 0x48574ac5
add ecx, 0xc7a8b53b
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x41b140
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x426138], 0
jne 0x41b1c1
cmp dword [0x426158], 0
jne 0x41b170
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x426158], eax
test eax, eax
jne 0x41b170
push str.GetEnvironmentStrings_failed
call fcn.0041a95c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x426158]
jmp 0x41b184
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b17c
lea edi, [ebp + 1]
push edi
call fcn.00414de8
pop ecx
mov ebx, eax
mov dword [0x42613c], ebx
test ebx, ebx
jne 0x41b1ae
xor eax, eax
jmp 0x41b284
push edi
mov edx, dword [0x426158]
push edx
push ebx
call fcn.00415394
add esp, 0xc
jmp 0x41b1e1
xor esi, esi
mov ebx, dword [0x426138]
jmp 0x41b1db
push eax
call fcn.004154e4
pop ecx
test eax, eax
jne 0x41b1d7
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b1cb
lea ebx, [esi + 4]
push 4
mov dword [0x426140], ebx
inc ebx
push ebx
call fcn.004148c0
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41b204
xor eax, eax
jmp 0x41b284
cmp dword [0x426138], 0
jne 0x41b235
xor esi, esi
mov ebx, dword [0x42613c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41b226
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004154e4
pop ecx
mov edi, eax
test eax, eax
jne 0x41b21c
jmp 0x41b266
xor esi, esi
mov ebx, dword [0x426138]
mov eax, dword [esp]
mov edi, eax
jmp 0x41b260
push eax
call fcn.004154e4
pop ecx
test eax, eax
je 0x41b255
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41b259
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41b244
mov eax, dword [0x426138]
test eax, eax
je 0x41b276
push eax
call fcn.00414df8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x426138], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x296018
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4fc96ff5
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push edi
push esi
mov esi, 1
push ebx
add esp, 0xffffff80
lea eax, [esp + 0x10]
mov dword [esp], str.browseui.dll
mov dword [esp + 4], eax
call sym._GetFileVersionInfoSizeW_8
sub esp, 8
test eax, eax
jne 0x401030
sub esp, 0xffffff80
mov eax, esi
pop ebx
pop esi
pop edi
ret
mov ebx, eax
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], str.browseui.dll
call sym._GetFileVersionInfoW_16
sub esp, 0x10
lea ebx, [esp + 0x18]
lea eax, [esp + 0x1c]
mov dword [esp + 4], str.VarFileInfoTranslation
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], edi
call sym._VerQueryValueW_16
sub esp, 0x10
test eax, eax
jne 0x4010d0
mov esi, 1
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
sub esp, 0xc
sub esp, 0xffffff80
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x1c]
lea esi, [esp + 0x20]
movzx edx, word [eax + 2]
mov dword [esp + 0xc], edx
movzx eax, word [eax]
mov dword [esp + 4], str.StringFileInfo_04x_04xFileDescription
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._wsprintfW
lea eax, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._VerQueryValueW_16
sub esp, 0x10
test eax, eax
je 0x40109e
mov eax, dword [esp + 0x14]
mov dword [esp + 4], 0x4030a2
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
sete al
movzx eax, al
mov esi, eax
jmp 0x4010a3

Function at 0x401340
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit