joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61fcf0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x68b11e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x79cac4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x79cb08]
cmp eax, 0xffffffff
jne 0x61fd26
xor ebx, ebx
jmp 0x61fd2f
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x61fe37
cmp dword [ebx + 0x18], 0
jne 0x61fd51
cmp dword [ebx + 0xc], 0
je 0x61fe2d
mov esi, dword [ebx + 0xc]
test esi, esi
je 0x61fdd6
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x61fda4
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x61fda4
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.0046c420
add esp, 0x10
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x61fd51
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.0046c420
add esp, 0x10
jmp 0x61fd51
cmp dword [ebx + 0x18], 0
je 0x61fd47
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
cmp dword [esi + 0x14], 0
je 0x61fe1e
cmp dword [esi + 0x1c], 0
je 0x61fe1e
cmp dword [esi + 0x14], 0
jne 0x61fe13
push 0x2bf
push str.._boost_smart_ptr_shared_ptr.hpp
push str.struct_boost::detail::tss_cleanup_function___thiscall_boost::shared_ptr_struct_boost::detail::tss_cleanup_function_::operator__void__const
push str.px___0
call fcn.0046c420
add esp, 0x10
mov ecx, dword [esi + 0x14]
push dword [esi + 0x1c]
mov eax, dword [ecx]
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.0061ee30
jmp 0x61fdd6
push 0
call fcn.0061fea0
add esp, 4
mov dword [ebp - 4], 1
test ebx, ebx
je 0x61fe81
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x61fe81
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
jne 0x61fe81
push 0x49
push str.._boost_thread_win32_thread_heap_alloc.hpp
push str.void___cdecl_boost::detail::free_raw_heap_memory_void__
push str.detail::win32::HeapFree_detail::win32::GetProcessHeap___0_heap_memory__0
call fcn.0046c420
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x61fea0
Capabilities:
Set thread local storage value

Disassembly:
push 0x61eb60
push 0x7a9888
call fcn.0061e6b0
mov eax, dword [0x79cb08]
add esp, 8
cmp eax, 0xffffffff
je 0x61fee5
push dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x61fefe
push 0x6e
push str.libs_thread_srcwin32_thread.cpp
push str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
push str.TlsSetValue_current_thread_tls_key__new_data_
call fcn.0046c420
add esp, 0x10
ret
push 0x72
push str.libs_thread_srcwin32_thread.cpp
push str.void___cdecl_boost::_anonymous_namespace::set_current_thread_data_struct_boost::detail::thread_data_base__
push 0x6fc080
call fcn.0046c420
add esp, 0x10
ret

Function at 0x622f00
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub ecx, edx
push ebx
inc ecx
xor ebx, ebx
push esi
shr ecx, 1
xor esi, esi
push edi
xor edi, edi
cmp edx, dword [esp + 0x14]
cmova ecx, ebx
test ecx, ecx
je 0x622f49
movzx eax, word [edx]
lea edx, [edx + 2]
imul eax, eax, 0xcc9e2d51
inc edi
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp edi, ecx
jne 0x622f21
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x634bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x79cac4]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x6fbaa2
mov dword [esp + 4], str.___.___
mov dword [esp + 8], 0x7015b4
mov dword [esp + 0xc], 0x7015b8
mov dword [esp + 0x10], 0x7015bc
mov dword [esp + 0x14], 0x7015c0
mov dword [esp + 0x18], 0x6fba9c
mov dword [esp + 0x1c], 0x7015c4
mov dword [esp + 0x20], 0x6fcb18
mov dword [esp + 0x24], 0x7015c8
mov dword [esp + 0x28], 0x7015cc
mov dword [esp + 0x2c], 0x7015d0
mov dword [esp + 0x30], 0x7015d4
mov dword [esp + 0x34], 0x7015d8
mov dword [esp + 0x38], 0x7015dc
mov dword [esp + 0x3c], 0x7015e0
mov dword [esp + 0x40], 0x7015e4
mov dword [esp + 0x44], 0x7015e8
mov dword [esp + 0x48], 0x7011c8
mov dword [esp + 0x4c], 0x7011cc
mov dword [esp + 0x50], 0x7015f4
mov dword [esp + 0x54], 0x7015f8
mov dword [esp + 0x58], 0x6fbaa2
mov dword [esp + 0x5c], 0x6fbaa2
mov dword [esp + 0x60], 0x7015fc
mov dword [esp + 0x64], 0x701600
mov dword [esp + 0x68], str._n_:_
mov dword [esp + 0x6c], 0x701608
mov dword [esp + 0x70], 0x7011d0
mov dword [esp + 0x74], 0x7011d4
mov dword [esp + 0x78], 0x7011d8
mov dword [esp + 0x7c], 0x7011dc
mov dword [esp + 0x80], 0x7011e0
mov dword [esp + 0x84], 0x7011e4
mov dword [esp + 0x88], 0x7011e8
mov dword [esp + 0x8c], 0x7011ec
mov dword [esp + 0x90], 0x70160c
mov dword [esp + 0x94], 0x701610
mov dword [esp + 0x98], 0x7011f0
mov dword [esp + 0x9c], 0x6fbaa2
mov dword [esp + 0xa0], 0x6fbaa2
mov dword [esp + 0xa4], 0x6fbaa2
mov dword [esp + 0xa8], 0x6fbaa2
mov dword [esp + 0xac], 0x6fbaa2
mov dword [esp + 0xb0], 0x6fbaa2
mov dword [esp + 0xb4], 0x6fbaa2
mov dword [esp + 0xb8], 0x6fbaa2
mov dword [esp + 0xbc], 0x7011f4
mov dword [esp + 0xc0], 0x7011f8
mov dword [esp + 0xc4], 0x7011fc
mov dword [esp + 0xc8], 0x6fbaa0
mov dword [esp + 0xcc], 0x701200
mov dword [esp + 0xd0], 0x701204
mov dword [esp + 0xd4], 0x701614
mov dword [esp + 0xd8], 0x701208
mov dword [esp + 0xdc], 0x70120c
mov dword [esp + 0xe0], 0x701210
mov dword [esp + 0xe4], 0x701618
mov dword [esp + 0xe8], 0x701214
mov dword [esp + 0xec], 0x701218
cmp cl, 0x3c
jb 0x634e26
mov eax, 0x6fbaa2
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.00611399
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.00611399
add esp, 0xf4
ret
Function at 0x634e50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x79cac4]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x634fbb
add eax, 4
cmp word [eax], cx
jb 0x634fb3
sub eax, 2
cmp cx, word [eax]
jb 0x634fe0
cmp cx, word [eax + 2]
ja 0x634fe0
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00611399
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.00611399
add esp, 0x9c
ret

Function at 0x637ddb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x66f471
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0066f2f0

Function at 0x67511b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00674a89

Function at 0x675126
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00674cc4
Function at 0x402db1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
xor edi, edi
mov ebx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
cmp dword [esp + 0x10], eax
jle 0x402df7
sub ebx, 0x425680
mov ax, word [ebx + edi*2 + 0x425680]
mov ecx, esi
xor ax, word [edi*2 + 0x425680]
movzx eax, ax
push eax
call fcn.00402250
inc edi
cmp edi, dword [esp + 0x10]
jl 0x402dd5
pop edi
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x403733
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, edx
cmp dword [0x4800b0], ebx
jne 0x403779
mov ecx, ebx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x40375a
shr eax, 1
xor eax, 0xedb88320
jmp 0x40375c
shr eax, 1
dec edx
jne 0x40374d
mov dword [ecx*4 + 0x47fcb0], eax
inc ecx
cmp ecx, 0x100
jl 0x403748
mov dword [0x4800b0], 1
mov eax, dword [ebp + 8]
or edx, 0xffffffff
xor ecx, ecx
lea eax, [edi + eax*2]
mov esi, eax
sub esi, edi
inc esi
shr esi, 1
cmp edi, eax
cmova esi, ecx
test esi, esi
je 0x4037ae
movzx eax, byte [edi]
lea edi, [edi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x47fcb0]
inc ebx
cmp ebx, esi
jb 0x403794
pop edi
not edx
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4037bb
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x5c
mov eax, dword [esp + 0x70]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
add eax, 0x40
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], ebx
call fcn.00401663
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0x70]
push dword [esp + 0x70]
xor edx, edx
mov dword [esp + 0x50], 0xf
cmp dword [esp + 0x88], 8
mov dword [esp + 0x24], edx
cmovae ecx, dword [esp + 0x74]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x4c], edx
lea eax, [ecx + eax*2]
mov byte [esp + 0x3c], dl
lea ecx, [esp + 0x74]
cmovae ecx, dword [esp + 0x74]
push eax
push ecx
lea ecx, [esp + 0x44]
call fcn.0040397d
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x54]
call fcn.00402a8a
cmp dword [esp + 0x64], 8
lea edx, [esp + 0x50]
push dword [esp + 0x60]
cmovae edx, dword [esp + 0x54]
call fcn.00403733
push 0
push 1
lea ecx, [esp + 0x58]
mov esi, eax
call fcn.0040193d
xor edx, edx
mov ecx, 0x98967f
mov eax, esi
div ecx
lea ecx, [esp + 0x14]
inc edx
mov dword [esp + 0x14], edx
call fcn.0040125f
cmp dword [esp + 0x4c], 0x10
lea ecx, [esp + 0x38]
mov eax, dword [esp + 0x48]
cmovae ecx, dword [esp + 0x38]
mov ebp, dword [esp + 0x2c]
add eax, ecx
cmp dword [esp + 0x4c], 0x10
lea ecx, [esp + 0x38]
cmovae ecx, dword [esp + 0x38]
sub eax, ecx
push eax
push ecx
push ebp
call fcn.0040c310
add esp, 0xc
lea edx, [esp + 0x20]
lea ecx, [esp + 0x2c]
call fcn.004014f9
and dword [ebx + 0x10], 0
xor eax, eax
mov edi, dword [esp + 0x20]
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov eax, dword [esp + 0x24]
sub eax, edi
push 0
mov dword [esp + 0x20], eax
pop esi
je 0x403907
mov ebp, ebx
mov bl, byte [edi + esi]
lea ecx, [esp + 0x14]
call fcn.0040125f
xor al, bl
mov ecx, ebp
movzx eax, al
push eax
call fcn.00402250
inc esi
cmp esi, dword [esp + 0x1c]
jb 0x4038df
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
xor esi, esi
lea ecx, [esp + 0x38]
push esi
push 1
call fcn.004017dc
test edi, edi
je 0x403920
push edi
call fcn.0040cd82
pop ecx
test ebp, ebp
je 0x40392b
push ebp
call fcn.0040cd82
pop ecx
push esi
push 1
lea ecx, [esp + 0x78]
call fcn.0040193d
push esi
push 1
lea ecx, [esp + 0x90]
call fcn.0040193d
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x5c
ret 0x30
Function at 0x405b3b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
xor edi, edi
mov ebx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
cmp dword [esp + 0x10], eax
jle 0x405b81
sub ebx, 0x426230
mov ax, word [ebx + edi*2 + 0x426230]
mov ecx, esi
xor ax, word [edi*2 + 0x426230]
movzx eax, ax
push eax
call fcn.00402250
inc edi
cmp edi, dword [esp + 0x10]
jl 0x405b5f
pop edi
mov eax, esi
pop esi
pop ebx
ret 4

Function at 0x405c39
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [0x47fc94], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x405cde
push 7
mov edx, 0x4726e4
lea ecx, [ebp - 0x34]
call fcn.00405b3b
cmp dword [eax + 0x14], 8
jb 0x405c68
mov eax, dword [eax]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 1
lea ecx, [ebp - 0x34]
mov esi, eax
call fcn.0040193d
test esi, esi
je 0x405cde
mov edx, edi
lea ecx, [ebp - 0x1c]
call fcn.00405b89
push 0x4265bc
call fcn.0040c960
pop ecx
push eax
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00409061
cmp dword [ebp - 8], 0x10
lea ecx, [ebp - 4]
push ebx
push ecx
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.004017dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405ce5
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov edx, 0x42ed00
push ebx
push esi
push edi
mov ebx, ecx
lea ecx, [ebp - 0x18]
push 0x32
call fcn.00405b3b
cmp dword [eax + 0x14], 8
jb 0x405d0a
mov eax, dword [eax]
sub esp, 0x18
mov esi, ebx
push 6
pop ecx
mov edi, esp
push eax
lea eax, [ebp - 0x118]
push 0x7f
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.00405b1f
add esp, 0x24
lea ecx, [ebp - 0x18]
xor esi, esi
xor edi, edi
inc edi
push esi
push edi
call fcn.0040193d
xor eax, eax
mov dword [ebp - 4], 7
mov word [ebp - 0x18], ax
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x118]
mov dword [ebp - 8], esi
push eax
call fcn.0040181e
lea ecx, [ebp - 0x18]
call fcn.00405c39
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.0040193d
push 9
mov edx, 0x46e3f0
lea ecx, [ebp - 0x18]
call fcn.00405b3b
cmp dword [eax + 0x14], 8
jb 0x405d7f
mov eax, dword [eax]
cmp dword [ebx + 0x14], 8
jb 0x405d87
mov ebx, dword [ebx]
push 0x40040
push eax
push ebx
push esi
call dword [0x47f8e0]
push esi
push edi
lea ecx, [ebp - 0x18]
call fcn.0040193d
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x405da7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, 0x46e3f0
push esi
mov esi, ecx
lea ecx, [ebp - 0x18]
push 9
call fcn.00405b3b
cmp dword [eax + 0x14], 8
jb 0x405dc7
mov eax, dword [eax]
cmp dword [esi + 0x14], 8
jb 0x405dcf
mov esi, dword [esi]
push 0x40010
push eax
push esi
push 0
call dword [0x47f8e0]
push 0
push 1
lea ecx, [ebp - 0x18]
call fcn.0040193d
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4094c9
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
xor edi, edi
mov ebx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edi
mov word [esi], ax
cmp dword [esp + 0x10], eax
jle 0x40950f
sub ebx, 0x426310
mov ax, word [ebx + edi*2 + 0x426310]
mov ecx, esi
xor ax, word [edi*2 + 0x426310]
movzx eax, ax
push eax
call fcn.00402250
inc edi
cmp edi, dword [esp + 0x10]
jl 0x4094ed
pop edi
mov eax, esi
pop esi
pop ebx
ret 4
Function at 0x418614
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x428de0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00414ec5
mov dword [ebp - 0x14], eax
cmp dword [0x47f7e0], esi
jne 0x418707
push 0x800
push esi
push 0x421ec4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x418694
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4187e7
push esi
push esi
push 0x421ec4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4187e7
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4187e7
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x47f7e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x47f7e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x47f7e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47f7f0], eax
test eax, eax
je 0x418704
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x47f7ec], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41872c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41871f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x418741
push 4
pop eax
jmp 0x4187e9
cmp dword [ebp - 0x14], esi
je 0x418741
push dword [0x47f7e0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x418726
mov eax, dword [0x47f7ec]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41879f
cmp dword [0x47f7f0], edi
je 0x41879f
push eax
call ebx
push dword [0x47f7f0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41879f
test eax, eax
je 0x41879f
call ecx
test eax, eax
je 0x418794
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x418794
test byte [ebp - 8], 1
jne 0x41879f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4187cf
mov eax, dword [0x47f7e4]
cmp eax, edi
je 0x4187cc
push eax
call ebx
test eax, eax
je 0x4187cc
call eax
mov esi, eax
test esi, esi
je 0x4187cc
mov eax, dword [0x47f7e8]
cmp eax, edi
je 0x4187cc
push eax
call ebx
test eax, eax
je 0x4187cc
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x47f7e0]
call ebx
test eax, eax
je 0x4187e7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4187e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411731
mov esp, ebp
pop ebp
ret
Function at 0x50b9b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x50b9d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50b9d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50b9c8
mov eax, 1
add ebx, ebx
jne 0x50b9eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50b9e0
jne 0x50b9fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50b9e0
xor ecx, ecx
sub eax, 3
jb 0x50ba10
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50ba82
mov ebp, eax
add ebx, ebx
jne 0x50ba1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50ba28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ba4c
inc ecx
add ebx, ebx
jne 0x50ba38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50ba2d
jne 0x50ba49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ba2d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50ba6c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50ba5d
jmp 0x50b9ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50ba6c
add edi, ecx
jmp 0x50b9ce
pop esi
mov edi, esi
mov ecx, 0x1d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50ba8a
cmp byte [edi], 6
jne 0x50ba8a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x50ba8f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x50bafe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xdacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xdb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50babc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xdb2c]
or eax, eax
je 0x50baf8
mov dword [ebx], eax
add ebx, 4
jmp 0x50bad9
call dword [esi + 0xdb28]
mov ebp, dword [esi + 0xdb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50bb32
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x51407eb7
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
mov ecx, 0x7d6f4d89
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x73c370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x73c38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x765074
push ecx
mov edi, eax
call fcn.00750198
mov esi, eax
add esp, 8
test esi, esi
jne 0x73c3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0075002e
push esi
call fcn.0074ffb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret