joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a77cc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4a786e
cmp dword [ebx + 0x94], 0
jne 0x4a7868
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4a7718
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4a7868
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4a782e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4a7868
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0042f3a8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4a783d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4a7a8c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4ba280]
cmp dword [eax + 0x170], 0
je 0x4a7bf1
test bl, bl
jne 0x4a7b3f
cmp dword [esi + 0x9c], 0
jne 0x4a7b34
mov eax, esi
call fcn.004aa97c
push eax
push 0x4a7998
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4a7b05
mov eax, dword [0x4ba280]
cmp byte [eax + 0xd3], 0
je 0x4a7b05
mov eax, dword [esi + 0xd8]
call fcn.00407e3c
mov edi, eax
cmp edi, 0
jl 0x4a7b05
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a7aee
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a7b34
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f3a8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a7b14
inc dword [esi + 0x9c]
jmp 0x4a7bf1
cmp dword [esi + 0x9c], 0
jle 0x4a7bf1
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4a7bf1
cmp dword [esi + 0x44], 0
je 0x4a7b9c
mov eax, dword [0x4ba280]
cmp byte [eax + 0xd3], 0
je 0x4a7b9c
mov eax, dword [esi + 0xd8]
call fcn.00407e3c
mov edi, eax
cmp edi, 0
jl 0x4a7b9c
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4a7b85
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4a7bcb
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.0042f3a8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4a7bab
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x49ad14]
call fcn.00407ffc
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4a8840
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4a88ab
cmp byte [ebx + 0xd3], 0
jne 0x4a88ab
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406974
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4a8898
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4a88b8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406838
jmp 0x4a88b8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406838
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4aa0e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4aa14e
mov eax, esi
call fcn.00482704
test al, al
je 0x4aa14e
mov eax, dword [ebx + 0x84]
call fcn.00482358
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4aa14e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4aa142
push 0
mov eax, dword [ebx + 0x84]
call fcn.00482358
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0047932c
jmp 0x4aa14e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004a9f18
pop esi
pop ebx
ret

Function at 0x40106c
Capabilities:
Encode data using xor

Disassembly:
push esp
xchg dword [esp], ebp
sub ebp, 4
sub esp, 0x24
adc ecx, 0x680a6c2f
lea esi, [0x40302c]
push eax
mov ecx, esp
push ecx
push 0x40
mov ecx, 0xa1c
push ecx
push 0x403218
mov ebx, 0x65f1b5dd
push dword [ebx - 0x65b19599]
mov ebx, sym.imp.KERNEL32.dll_LoadLibraryA
pop dword [ebx]
call sub.KERNEL32.dll_LoadLibraryA
add esp, 4
xor eax, eax
dec eax
and eax, 0x403218
mov dword [esi + 0x34], eax
lea ebx, [eax]
xor ecx, ecx
xor ecx, 0x4025f1
xor eax, eax
mov edi, dword [ecx]
add ecx, 4
push edi
pop dword [ebx]
sbb edx, edi
add dword [ebx], 0xe3574ec9
xor dword [ebx], 0x7e4a219c
add ebx, 4
add eax, 4
cmp eax, 0x61c
jne 0x4010c4
push 0
call sub.KERNEL32.dll_FindClose
add esp, 0x24
pop ebp
ret 0x10

Function at 0x4016a8
Capabilities:
Get disk information

Disassembly:
push esp
xchg dword [esp], ebp
sub ebp, 4
sub esp, 0x2c
lea eax, [edx + 0x84]
adc dword [eax - 4], 0xffffffbe
push eax
call sub.KERNEL32.dll_GetLogicalDrives
pop eax
push eax
push dword [eax + 0x54]
push dword [eax + 0x118]
call fcn.0040122c
pop eax
push eax
mov ebx, 0
push ebx
call sub.KERNEL32.dll_GlobalLock
pop eax
add esp, 0x2c
pop ebp
pop edi
add esp, 0x10
jmp edi

Function at 0x40174c
Capabilities:
Get disk information

Disassembly:
push esp
xchg dword [esp], ebp
sub ebp, 4
sub esp, 0x44
mov esi, 0x403144
adc dword [ebp - 0x10], ebx
call sub.KERNEL32.dll_GetLogicalDrives
push esi
push ebx
push eax
push edi
call fcn.004013a4
pop esi
push 0
call sub.KERNEL32.dll_HeapDestroy
add esp, 0x44
pop ebp
pop ecx
add esp, 0x10
jmp ecx
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x34f006d2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x33b47d04
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406d60
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
imul ebx
sti
inc esi
mov edi, 0x90d1a7ac

Function at 0x407440
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov byte [esi], 0x30
mov ecx, dword [ebp - 4]
inc ecx
cmp ecx, eax
invalid
Function at 0x4ac318
Capabilities:
Encode data using xor

Disassembly:
xor dl, byte [edi - 0x1d]
test dword [0x90b2282c], esi
nop
push edi
jecxz 0x4ac2a1
xor eax, 0x90b2282c
dec ebp
je 0x4ac319
push esp
jb 0x4ac332
invalid

Function at 0x4c6d35
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d13a0
cmp edx, dword [eax]
je 0x4c6d57
add eax, 8
inc ecx
cmp eax, 0x4d1430
jl 0x4c6d48
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d13a0]
jne 0x4c6e85
mov eax, dword [0x4d6dd0]
cmp eax, 1
je 0x4c6e5f
test eax, eax
jne 0x4c6d88
cmp dword [0x4d12cc], 1
je 0x4c6e5f
cmp edx, 0xfc
je 0x4c6e85
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6dbf
lea eax, [ebp - 0x1a4]
push 0x4ccd48
push eax
call fcn.004c7720
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7bb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c6e02
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7bb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4ccd44
push edi
call fcn.004c9a80
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4ccd28
push eax
call fcn.004c7720
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c7730
lea eax, [ebp - 0xa0]
push 0x4ccd24
push eax
call fcn.004c7730
push dword [esi + 0x4d13a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c7730
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4cccfc
push eax
call fcn.004c99f4
add esp, 0x2c
pop edi
jmp 0x4c6e85
lea eax, [ebp + 8]
lea esi, [esi + 0x4d13a4]
push 0
push eax
push dword [esi]
call fcn.004c7bb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40dd54
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
test ebp, ebp
jg 0x40dd6e
jl 0x40dd65
test ebx, ebx
jne 0x40dd6e
xor eax, eax
xor edx, edx
jmp 0x40de33
cmp dword [esi + 0x38], 0
je 0x40dd84
push ebp
push ebx
push dword [esp + 0x1c]
call fcn.0040675c
jmp 0x40de33
mov eax, dword [esi + 0x1c]
push edi
mov edi, ebx
mov ecx, dword [eax]
test ecx, ecx
je 0x40ddca
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0x40ddca
cmp dword [eax], ebx
mov esi, ebx
mov edi, dword [esp + 0x18]
cmovb esi, dword [eax]
push esi
push ecx
push edi
call fcn.004054f5
mov ecx, dword [esp + 0x1c]
add edi, esi
mov dword [esp + 0x24], edi
add esp, 0xc
mov edi, ebx
sub edi, esi
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
jmp 0x40ddd2
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
cmp dword [esi + 0x4c], 0
je 0x40de29
mov ecx, esi
call fcn.0040cc42
mov ecx, dword [esp + 0x18]
mov edx, edi
mov eax, 0xfff
cmp edi, eax
jbe 0x40de14
push dword [esi + 0x4c]
push eax
push 1
push ecx
call fcn.00431cbb
mov ecx, dword [esp + 0x28]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [esp + 0x18], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x40de29
jmp 0x40dde5
test edx, edx
je 0x40de29
push dword [esi + 0x4c]
push edi
push 1
push ecx
call fcn.00431cbb
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb ebp, 0
mov edx, ebp
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x40ec47
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x148]
sub esp, 0x148
push 0xffffffffffffffff
push 0x44efcc
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x4711b0]
xor eax, ebp
mov dword [ebp + 0x144], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x150]
lea eax, [ebp + 0x40]
mov edi, dword [ebp + 0x154]
mov ebx, dword [ebp + 0x158]
push 0x104
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.0042cad0
add esp, 0xc
lea eax, [ebp + 0x40]
xor edx, edx
mov ecx, 0x8000
push eax
xor eax, eax
cmp ebx, 1
push edx
cmove eax, ecx
push edx
or eax, edi
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x40ed1d
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp + 0x28]
call fcn.00403439
lea eax, [ebp + 0x28]
mov dword [ebp - 4], 2
push eax
push esi
call fcn.0040d890
pop ecx
pop ecx
lea ecx, [ebp + 0x28]
call fcn.0040529d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x144]
xor ecx, ebp
call fcn.00429eb0
add ebp, 0x148
leave
ret
lea ecx, [ebp - 0xc8]
call fcn.0040385e
push dword [ebp - 0x10]
and dword [ebp - 4], 0
mov ecx, eax
push 0x454b8c
push ebx
push str.__mode
push edi
push 0x4111b7
push str.SHGetFolderPath_0x
call fcn.00402671
mov ecx, eax
call fcn.0040e93e
mov ecx, eax
call fcn.00409fb1
mov ecx, eax
call fcn.00402671
mov ecx, eax
call fcn.00409fb1
mov ecx, eax
call fcn.00402671
push eax
lea ecx, [ebp - 0x30]
call fcn.004189ee
mov esi, eax
push 0x1e7
push str.SysInfo::SHGetFolderPathAdapter
push str.c:_jenkins_workspace_8_2_build_windows_i586_cygwin_sans_NAS_jdk8u381_237_install_src_windows_common_SysInfo.cpp
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.0040371a
push eax
lea eax, [ebp]
push esi
push eax
call fcn.0040e57d
add esp, 0xc
lea eax, [ebp]
push 0x46b5d8
push eax
call fcn.0042ccac
int3

Function at 0x4115b2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.0042cad0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
sete al
leave
ret
Function at 0x408950
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
call fcn.0040898d
mov ecx, 0xcea65dbe
add ecx, 0x648e74b2
xor dword [ebx], edi
add esi, 0x7cbfb8f5
inc ebx
sub ecx, 0x26eae1a5
add esi, 0x698c2b35
cmp ebx, eax
jne fcn.00408950
sub ecx, 1
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push 8
call fcn.0040176d
add esp, 4
test eax, eax
jne 0x40102e
mov eax, dword [0x408e60]
inc eax
push eax
push 0x40804c
push 0x408320
call fcn.00401682
add esp, 0xc
push 1
call fcn.004015ad
mov ecx, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], ecx
mov edx, dword [0x408048]
mov dword [edx], eax
mov dword [0x408048], eax
inc dword [0x408e60]
ret

Function at 0x401050
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [0x408e68]
push esi
mov esi, dword [esp + 0x10]
cmp esi, ebp
jl 0x4010e6
mov eax, 0x66666667
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 0x3e8
jge 0x401083
add edx, 0x3e8
add ebp, edx
lea ecx, [ebp*4]
push ecx
call fcn.0040176d
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010b5
push esi
push 0x408080
push 0x408320
call fcn.00401682
add esp, 0xc
push 1
call fcn.004015ad
mov ecx, dword [0x408e68]
mov esi, dword [0x408e6c]
push edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov edx, dword [0x408e6c]
push edx
call fcn.0040196a
mov esi, dword [esp + 0x18]
add esp, 4
mov dword [0x408e6c], ebx
mov dword [0x408e68], ebp
pop edi
push 0x408300
call fcn.00401812
mov ecx, dword [0x408e6c]
push esi
push 0x408074
mov dword [ecx + esi*4], eax
call fcn.004017e1
add esp, 0xc
pop esi
pop ebp
pop ebx
ret
Function at 0x4013e0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov ecx, dword [eax + 4]
push ecx
call fcn.00401b7f
fmul qword [str.ffffff]
push 0x4082d4
fst dword [0x40803c]
fstp dword [0x408040]
call fcn.004017e1
mov eax, dword [0x408044]
mov dword [0x409098], eax
inc eax
mov dword [0x408044], eax
call fcn.00401240
mov eax, dword [0x408044]
mov edi, eax
inc eax
push edi
mov dword [0x408044], eax
call fcn.00401050
push 0x408284
call fcn.004017e1
mov edx, dword [0x409098]
push edx
call fcn.00401050
mov eax, dword [0x408e60]
push eax
push 0x408268
call fcn.004017e1
mov esi, dword [0x408e64]
push 0x408260
call fcn.004017e1
add esp, 0x20
test esi, esi
je 0x401488
mov ecx, dword [esi + 4]
push ecx
push 0x408258
call fcn.004017e1
mov esi, dword [esi]
add esp, 8
test esi, esi
jne 0x401471
push 0x408254
call fcn.004017e1
push edi
push 0x40821c
call fcn.004017e1
fld dword [0x408034]
add esp, 4
fstp qword [esp]
fld dword [0x408030]
sub esp, 8
fstp qword [esp]
push 0x408200
call fcn.004017e1
push 0x4081f4
call fcn.004017e1
mov eax, dword [0x408044]
mov edi, eax
inc eax
push edi
mov dword [0x408044], eax
call fcn.00401050
mov edx, dword [0x409098]
push edx
push 0x4081cc
call fcn.004017e1
push 0x408300
call fcn.00401812
push 0x4081c4
mov ebx, eax
call fcn.004017e1
mov eax, dword [0x408044]
push eax
push 0x4081bc
call fcn.004017e1
push 0x4081a4
call fcn.004017e1
mov eax, dword [0x408044]
mov esi, 1
add esp, 0x38
cmp eax, esi
jle 0x40154f
mov ecx, dword [0x408e6c]
mov edx, dword [ecx + esi*4]
push edx
push 0x408190
call fcn.004017e1
mov eax, dword [0x408044]
add esp, 8
inc esi
cmp esi, eax
jl 0x40152e
push edi
push eax
push 0x408168
call fcn.004017e1
push ebx
push 0x408150
call fcn.004017e1
add esp, 0x14
push 0
call fcn.004015ad
pop edi
pop esi
pop ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x404385
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408870
cmp edx, dword [eax]
je 0x4043a7
add eax, 8
inc ecx
cmp eax, 0x408900
jl 0x404398
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408870]
jne 0x4044d5
mov eax, dword [0x408ed0]
cmp eax, 1
je 0x4044af
test eax, eax
jne 0x4043d8
cmp dword [0x408584], 1
je 0x4044af
cmp edx, 0xfc
je 0x4044d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40440f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004051b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403ad0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404452
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403ad0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40745c
push edi
call fcn.004063f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004051b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004051c0
lea eax, [ebp - 0xa0]
push 0x40743c
push eax
call fcn.004051c0
push dword [esi + 0x408874]
lea eax, [ebp - 0xa0]
push eax
call fcn.004051c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00406365
add esp, 0x2c
pop edi
jmp 0x4044d5
lea eax, [ebp + 8]
lea esi, [esi + 0x408874]
push 0
push eax
push dword [esi]
call fcn.00403ad0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x413db0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x413dd2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413dd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413dc8
mov eax, 1
add ebx, ebx
jne 0x413deb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413de0
jne 0x413dfc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413de0
xor ecx, ecx
sub eax, 3
jb 0x413e10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413e82
mov ebp, eax
add ebx, ebx
jne 0x413e1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413e28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x413e4c
inc ecx
add ebx, ebx
jne 0x413e38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413e2d
jne 0x413e49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413e2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x413e6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x413e5d
jmp 0x413dce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x413e6c
add edi, ecx
jmp 0x413dce
pop esi
mov edi, esi
mov ecx, 7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x413e8a
cmp byte [edi], 1
jne 0x413e8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x413e8f
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x413f07
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x138d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13914]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x413ebc
mov ecx, edi
jns 0x413eeb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13918]
or eax, eax
je 0x413f01
mov dword [ebx], eax
add ebx, 4
jmp 0x413ed9
call dword [esi + 0x13928]
mov ebp, dword [esi + 0x1391c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x413f3b
sub esp, 0xffffff80
jmp 0x4011fc