joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42494b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425d17
mov eax, dword fs:[0]
push eax
mov eax, 0x10050
call fcn.0041e450
mov eax, dword [0x4312c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1003c], ecx
lea ecx, [ebp - 0x10038]
xor ebx, ebx
push ecx
mov esi, edx
mov dword [ebp - 0x10040], eax
mov dword [ebp - 0x10034], ebx
push eax
lea edi, [ebp - 0x10034]
mov eax, esi
mov dword [ebp - 0x10034], ebx
mov dword [ebp - 0x10038], ebx
call fcn.0042468c
mov eax, dword [ebp - 0x10038]
push ebx
shr eax, 1
push eax
lea ecx, [ebp - 0x10030]
call fcn.00403b18
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x10034]
mov edx, esi
call fcn.00424858
cmp dword [ebp - 0x10018], 8
mov eax, dword [ebp - 0x1002c]
jae 0x4249f1
lea eax, [ebp - 0x1002c]
mov ebx, dword [ebp - 0x10038]
push eax
push dword [ebp - 0x10040]
call fcn.0042475e
mov eax, dword [ebp - 0x1001c]
xor ebx, ebx
cmp eax, ebx
je 0x424a4a
lea esi, [eax - 1]
cmp eax, esi
ja 0x424a21
call fcn.0040c958
mov eax, dword [ebp - 0x1001c]
cmp dword [ebp - 0x10018], 8
mov ecx, dword [ebp - 0x1002c]
jae 0x424a36
lea ecx, [ebp - 0x1002c]
cmp word [ecx + esi*2], bx
jne 0x424a4a
push ebx
dec eax
push eax
lea ecx, [ebp - 0x10030]
call fcn.00405a44
cmp dword [ebp - 0x10034], 2
jne 0x424ab3
cmp dword [ebp - 0x10018], 8
mov eax, dword [ebp - 0x1002c]
jae 0x424a68
lea eax, [ebp - 0x1002c]
push 0x8000
lea ecx, [ebp - 0x10014]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
push eax
lea eax, [ebp - 0x10014]
push eax
lea ecx, [ebp - 0x1005c]
call fcn.00405e45
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x10030]
mov byte [ebp - 4], 1
call fcn.00404374
push ebx
push 1
lea ecx, [ebp - 0x1005c]
mov byte [ebp - 4], bl
call fcn.00404465
mov ecx, dword [ebp - 0x1003c]
lea eax, [ebp - 0x10030]
push eax
call fcn.00403b40
push ebx
push 1
lea ecx, [ebp - 0x10030]
call fcn.00404465
mov eax, dword [ebp - 0x1003c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040f3c4
leave
ret 4
Function at 0x424af5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x425d4f
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4312c8]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov eax, dword [0x4312c8]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00422d32
pop ecx
mov edx, dword [esp + 8]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x5c], ebx
call fcn.0042494b
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x64], 1
call fcn.00404374
push ebx
push 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x60], bl
call fcn.00404465
push 1
push ebx
lea edx, [esp + 0x34]
mov ecx, esi
call fcn.00422aba
pop ecx
pop ecx
push ebx
push 1
lea ecx, [esp + 0x34]
call fcn.00404465
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0040f3c4
mov esp, ebp
pop ebp
ret 4
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x100062fa
pop dword [ebp - 0x34]
mov eax, 0x100062fa
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3899c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xcc514dc3
sub ecx, 0xcc510773
xor esi, esi
add esi, eax
mov edx, 0xefadd70
sub edx, 0xfef95770
add edx, dword [ebp - 0x34]
mov ebx, 0x3777075e
sub ebx, 0x477ee554
mov dword [ebp - 0xc], 0xe4460187
mov edi, dword [edx]
mov dword [ebp - 0x24], 0x96ff7163
xor edi, ebx
sub dword [ebp - 0x14], ebx
mov dword [esi], edi
sub dword [ebp - 0x20], 0xeca8ecc4
add esi, 0xbd22ba20
add esi, 0x42dd45e4
add edx, 0xd51e0def
add edx, 0x2ae1f215
loop 0x10006351
add eax, 0x14d5a92b
add eax, 0xeb2b62e8
xor ebx, ebx
add ebx, eax
add eax, 0xd3c05ed7
sub eax, 0xd3c05ed2
mov ecx, 0x7df57601
sub ecx, 0x6df57601
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401d10
Capabilities:
Create process on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x688
mov ebx, dword [ecx + 8]
mov esi, dword [ecx]
cmp ebx, 0x1a1
je 0x401ea8
jbe 0x401d70
cmp ebx, 0x1a2
je 0x401e30
cmp ebx, 0x1a3
jne 0x401da0
mov dword [esp + 8], 0
mov dword [esp + 4], 3
mov dword [esp], 9
call dbg.MAIN_MessageBoxIDS
jmp 0x401d8d
cmp ebx, 1
je 0x401db0
cmp ebx, 2
jne 0x401da0
mov dword [esp + 4], 2
mov dword [esp], esi
call sym._EndDialog_8
sub esp, 8
lea esp, [ebp - 0x10]
mov eax, 1
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea edi, [ebp - 0x418]
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], edi
mov dword [esp + 4], 0x1a0
mov dword [esp], esi
call sym._GetDlgItemTextA_16
sub esp, 0x10
mov dword [esp + 4], 0x1a1
mov dword [esp], esi
call sym._IsDlgButtonChecked_8
sub esp, 8
test eax, eax
mov eax, 2
cmovne ebx, eax
mov dword [esp], edi
mov dword [esp + 4], ebx
call dword [sym.imp.kernel32.dll_WinExec]
mov eax, dword [0x4080c0]
sub esp, 8
test eax, eax
jne 0x401ee0
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._EndDialog_8
sub esp, 8
jmp 0x401d8d
lea ebx, [ebp - 0x67a]
mov ecx, str..exe_.pif_.com_.bat
mov edx, 0x14
mov byte [ebp - 0x418], 0
lea eax, [ebp - 0x680]
mov dword [ebp - 0x680], ebx
call dbg.DIALOG_AddFilterItem
mov edx, 0x13
lea eax, [ebp - 0x680]
mov ecx, 0x407018
call dbg.DIALOG_AddFilterItem
lea edx, [ebp - 0x418]
mov eax, ebx
call sym._DIALOG_Browse.constprop.0
test eax, eax
je 0x401d8d
lea eax, [ebp - 0x418]
mov dword [esp + 4], 0x1a0
mov dword [esp + 8], eax
mov dword [esp], esi
call sym._SetDlgItemTextA_12
sub esp, 0xc
jmp 0x401d8d
mov dword [esp + 4], 0x1a1
mov dword [esp], esi
call sym._IsDlgButtonChecked_8
sub esp, 8
test eax, eax
sete al
mov dword [esp + 4], 0x1a1
movzx eax, al
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._CheckDlgButton_12
sub esp, 0xc
jmp 0x401d8d
mov eax, dword [0x408088]
mov dword [esp], eax
call sym._CloseWindow_4
sub esp, 4
jmp 0x401e0f
Function at 0x404210
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x400]
push ebx
sub esp, 0x41c
mov eax, dword [0x4080b0]
mov dword [esp + 0x10], 0x3e8
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.Autostart
mov dword [esp + 4], str.AutoStart
mov dword [esp], str.Settings
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
sub esp, 0x18
call dbg.GROUP_FirstGroup
test eax, eax
je 0x4042c4
mov ebx, eax
jmp 0x404276
mov dword [esp], ebx
call dbg.GROUP_NextGroup
mov ebx, eax
test eax, eax
je 0x4042c4
mov dword [esp], ebx
call dbg.GROUP_GroupName
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
sub esp, 8
test eax, eax
jne 0x404268
mov dword [esp], ebx
call dbg.PROGRAM_FirstProgram
mov edi, eax
test eax, eax
je 0x404268
mov dword [esp], edi
call sym._PROGRAM_ExecuteProgram
mov dword [esp], edi
call dbg.PROGRAM_NextProgram
mov edi, eax
test eax, eax
jne 0x4042a0
mov dword [esp], ebx
call dbg.GROUP_NextGroup
mov ebx, eax
test eax, eax
jne 0x404276
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404a50
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x814]
lea esi, [ebp - 0x418]
push ebx
lea ebx, [ebp - 0x800]
sub esp, 0x84c
mov eax, dword [0x4080b0]
mov dword [esp + 0x10], 0x3e8
mov dword [esp + 0x14], eax
mov eax, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x407258
mov dword [esp + 4], str.Order
mov dword [esp], str.Settings
mov dword [ebp - 0x82c], eax
call eax
sub esp, 0x18
jmp 0x404b21
cmp eax, 1
jne 0x404b72
mov eax, dword [ebp - 0x81c]
mov dword [esp + 4], str.Group_d
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf.constprop.0
mov eax, dword [0x4080b0]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x400
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x407258
mov dword [esp + 4], edi
mov dword [esp], str.Groups
mov eax, dword [ebp - 0x82c]
call eax
sub esp, 0x18
cmp byte [ebp - 0x418], 0
je 0x404b1d
mov dword [esp], esi
call dbg.GRPFILE_ReadGroupFile
add ebx, dword [ebp - 0x818]
cmp ebx, esi
jae 0x404b72
lea eax, [ebp - 0x818]
mov dword [esp + 4], str._d_n
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x81c]
mov dword [esp + 8], eax
mov dword [esp], ebx
call dbg.sscanf
test eax, eax
jne 0x404ab0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov eax, dword [0x4080b0]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call dbg.MAIN_MessageBoxIDS_s
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405980
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.kernel32.dll_LocalLock]
mov dword [esp], eax
call esi
mov ebx, eax
mov eax, dword [eax + 0x24]
sub esp, 4
mov dword [esp], eax
call esi
mov edx, dword [ebx + 0x34]
sub esp, 4
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WinExec]
mov eax, dword [0x4080c0]
sub esp, 8
test eax, eax
jne 0x4059d0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [0x408088]
mov dword [esp], eax
call sym._CloseWindow_4
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x4061d0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.main
mov dword [esp], eax
call sym._exit

Function at 0x4062c0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dbg.__main
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ebx, eax
movzx eax, byte [eax]
test al, al
je 0x40632e
xor ecx, ecx
xor edx, edx
jmp 0x406306
cmp al, 0x5c
jne 0x406388
add edx, 1
movzx eax, byte [ebx + 1]
add ebx, 1
test al, al
je 0x406323
cmp al, 9
je 0x40630e
cmp al, 0x20
jne 0x4062f0
test ecx, ecx
je 0x406323
xor edx, edx
jmp 0x4062fb
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x406320
cmp al, 0x20
je 0x406320
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
sub esp, 4
test byte [ebp - 0x30], 1
jne 0x406349
mov word [ebp - 0x2c], 1
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call dbg.WinMain@16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
jne 0x406312
and edx, 1
jne 0x406312
xor ecx, 1
jmp 0x4062fb
Function at 0x40d750
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x40d76a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40d771
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40d760
mov eax, 1
add ebx, ebx
jne 0x40d783
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40d778
jne 0x40d794
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d778
xor ecx, ecx
sub eax, 3
jb 0x40d7a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40d81a
mov ebp, eax
add ebx, ebx
jne 0x40d7b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40d7c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40d7e4
inc ecx
add ebx, ebx
jne 0x40d7d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40d7c5
jne 0x40d7e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40d7c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40d804
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40d7f5
jmp 0x40d766
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40d804
add edi, ecx
jmp 0x40d766
pop esi
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40d86c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd554]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd610]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40d821
mov ecx, edi
jns 0x40d850
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd618]
or eax, eax
je 0x40d866
mov dword [ebx], eax
add ebx, 4
jmp 0x40d83e
call dword [esi + 0xd614]
mov ebp, dword [esi + 0xd61c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40d8a0
sub esp, 0xffffff80
jmp 0x403946

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0x2fa1
mov word [esp + 0x3e], 0x152a
mov dword [esp + 0x38], 0x3785
mov eax, dword [esp + 0x38]
mov ecx, eax
xor ecx, 0xf98
mov dword [esp + 0x34], ecx
mov dword [esp + 0xc], eax
jmp 0x4010dc
mov eax, 0x3787
sub eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
jmp 0x401092
mov eax, dword [sym.imp.ole32.dll_CoFreeLibrary]
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
jmp 0x40111a
mov eax, 0x401628
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], 0xa8195bea
mov eax, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 0x40], eax
jmp 0x401092
mov eax, dword [esp + 0x1c]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov ax, word [esp + 0x3e]
mov cx, 0x39b5
sub cx, ax
mov edx, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
xor edx, 0x79ee
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov word [esp + 0x32], cx
mov ax, word [esp + 0x3e]
movsd xmm0, qword [esp + 0x10]
mov di, 0x7ea1
sub di, ax
movsd qword [esp + 0x20], xmm0
cmp di, cx
jne 0x40118e
jmp 0x4010fa
mov eax, 0x40165e
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
mov eax, dword [sym.imp.comdlg32.dll_ChooseColorW]
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
jmp 0x401156
mov dword [esp + 0x54], 0
mov dword [esp + 0x50], 0x7f9b
mov eax, dword [sym.imp.KERNEL32.DLL_CreateTapePartition]
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
jmp 0x401167
mov eax, 0x401622
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
mov eax, dword [sym.imp.SETUPAPI.dll_SetupDiGetActualSectionToInstallA]
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
jmp 0x4011b4
mov al, byte [esp + 0x47]
or al, 0x48
mov byte [esp + 0x47], al
mov ecx, dword [sym.imp.NTDSAPI.dll_DsFreeSpnArrayW]
call ecx
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
jmp 0x401052
mov eax, 0x10e4
cmp eax, dword [esp + 0x34]
je 0x401092
jmp 0x401138
mov eax, dword [esp + 0x38]
add eax, 0xffffc87c
mov ecx, dword [sym.imp.SHELL32.dll_SHFileOperationA]
call ecx
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
and eax, dword [esp + 0x2c]
cmp eax, 0
jne 0x401043
jmp 0x4011c7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor edx, edx
mov esi, 0x7627
sub esi, eax
sbb edx, ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edx
jb 0x4010dc
jmp 0x401087
mov eax, dword [sym.imp.KERNEL32.DLL_FindNextVolumeMountPointA]
call eax
shl byte [ecx - 0x55], 1
mov dword [esp + 0x2c], eax
jmp 0x4010fa
jmp 0x401065