joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100038de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100610a6
push eax
mov dword fs:[0], esp
sub esp, 0x60
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, edx
je 0x10003a01
sub esp, 0x18
mov ecx, esp
push dword [ebp + 0x18]
call fcn.10005e3c
lea ecx, [esp + 0x2c]
call fcn.10002fef
add esp, 0x18
xor ebx, ebx
mov dword [esp + 0x74], ebx
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x14], eax
je 0x10003994
push dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x38], 7
push eax
push dword [esp + 0x1c]
mov word [esp + 0x2c], cx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], ebx
call fcn.1000923e
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x20]
mov byte [esp + 0x74], 1
call fcn.10003891
lea ecx, [esp + 0x20]
push ebx
push 1
test eax, eax
jns 0x1000398b
mov byte [esi], 1
call fcn.10006b7b
lea ecx, [esp + 0x14]
call fcn.10006e34
jmp 0x10003a30
mov byte [esp + 0x7c], bl
call fcn.10006b7b
mov byte [esi], bl
mov dword [esp + 0x10], 0x38c2
cmp dword [esp + 0x10], 0x3b64
jle 0x1000397d
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x38]
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100039c8
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push ebx
push 1
lea ecx, [esp + 0x40]
call fcn.10006880
inc edi
cmp edi, 0x3e5f
jl 0x100039ac
inc esi
cmp esi, 0x5db4
jl 0x100039aa
push ebx
push ebx
push 0x6e2
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x1000397d
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax]
lea eax, [esp + 0x58]
push eax
call fcn.10005ffe
mov ecx, dword [ebp + 0x14]
push eax
mov dword [esp + 0x78], 4
call fcn.1000614b
push 0
push 1
lea ecx, [esp + 0x58]
call fcn.10006b7b
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100098fa
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061395
call fcn.100608e8
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x3f7f
mov esi, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x1c], 0x3f98
mov dword [ebp - 0x18], esi
jle 0x1000994e
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x1007cdd8
xor eax, edi
cdq
push edx
push eax
call fcn.10005d27
inc esi
cmp esi, 0x696
jl 0x10009928
inc edi
cmp edi, 0x6514
jl 0x10009926
mov esi, dword [ebp - 0x18]
mov eax, dword [esi + 0x10]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x3e40
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
jge 0x10009975
mov edx, str.fudjnukz_lrvmfqsqe_mjovs_ukdfsg_didicobvb_tqafw_imsfjv_mrxiegf_upzx_apbuphczj_rmlpud_luagtjkqf_uiaa_qknfis
mov ecx, 0x1007cdd8
call fcn.100089dc
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x20], ecx
test ecx, ecx
je 0x100099c4
cmp ecx, ebx
jbe 0x10009a03
cmp dword [esi + 0x14], 8
jb 0x1000998f
mov esi, dword [esi]
movzx esi, word [esi + ebx*2]
lea edx, [ebx + 0x50cd]
mov ecx, esi
call fcn.1001f8e5
movzx edi, ax
xor edx, edx
lea eax, [ebx + esi]
mov esi, dword [ebp - 0x18]
push 0x19
pop ecx
div ecx
mov eax, dword [ebp - 0x14]
mov ecx, edx
shl edi, cl
mov ecx, dword [ebp - 0x20]
add eax, edi
inc ebx
mov dword [ebp - 0x14], eax
cmp ebx, ecx
jb 0x10009983
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push str.uSQDZVSlqhjKnjqgEObKryP
call fcn.10043ba1
int3
Function at 0x10025f5b
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10025f87
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
push dword [ebp - 8]
call fcn.1002cadc
add esp, 0xc
jmp 0x10025fc9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10025fc1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10025fbf
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
jmp 0x10025fc9
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esp, ebp
pop ebp
ret
Function at 0x1003230e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061f92
call fcn.100608e8
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
je 0x10032334
and dword [ecx], 0
jmp 0x100323c6
mov dword [ebp - 0x14], 0x61f8
cmp dword [ebp - 0x14], 0x63d8
jle 0x1003236b
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007cdd8
xor eax, edi
cdq
push edx
push eax
call fcn.10005d27
inc ebx
cmp ebx, 0x2b24
jl 0x10032348
inc edi
cmp edi, 0x7bce
jl 0x10032346
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x602a
jge 0x100323a6
mov edx, str.xjgo_cezmircks_dcscrv_rutknbita_qghsuxra_hhywbtk_phqkni_tqpjhnwx_vteu_inijsi_fuo_kvrqwwj_zsto_ajvqcih
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x100323a6
mov dword [esi], 0
cmp dword [esi], 2
jge 0x100323c6
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xb90d
inc dword [esi]
cmp dword [esi], 2
jl 0x100323b4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035b67
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0xc], 0
je 0x10035b84
cmp byte [edx], 0
je 0x10035ba8
push 0xd5f
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10035ba8
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push ecx
push 0x6533
push 1
push 0x1e2a
push ecx
push ecx
mov edx, 0x26dd
call fcn.1003aeb5
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x10036d92
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
mov esi, ecx
je 0x10036dd7
cmp byte [ebp + 0x14], 0
je 0x10036dc6
mov dword [esi], 0
cmp dword [esi], 2
jge 0x10036df9
mov edx, dword [ebp + 0x24]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xda268580
inc dword [esi]
cmp dword [esi], 2
jl 0x10036db2
jmp 0x10036df9
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + ecx*4]
mov dword [edx], eax
jmp 0x10036df9
cmp byte [ebp + 0x1c], 0
je 0x10036df1
mov eax, dword [ebp + 0x20]
xor ecx, ecx
mov eax, dword [eax]
cmp dword [eax + 8], ecx
mov eax, dword [ebp + 0x10]
sete cl
mov dword [eax], ecx
jmp 0x10036df9
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop esi
pop ebp
ret

Function at 0x10036e15
Capabilities:
Get disk information

Disassembly:
mov eax, 0x100621df
call fcn.100608e8
sub esp, 0x18
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10036e4d
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10036efa
push 0
push 0x6df
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x10036efa
mov dword [ebp - 0x24], 0x4d91
cmp dword [ebp - 0x24], 0x4ec5
jle 0x10036ebb
xor edi, edi
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x657c
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov ebx, 0x1a64
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1007cdd8
cdq
push edx
push eax
call fcn.10005d27
dec esi
dec ebx
jne 0x10036e77
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
add ebx, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
jne 0x10036e70
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x77a
jl 0x10036e64
inc edi
cmp edi, 0x42ba
jl 0x10036e5f
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4aa4
jge 0x10036ed7
mov edx, str.ygjsrczs_lssmal_wol
mov ecx, 0x1007cdd8
call fcn.100089dc
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10036efa
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x10036ee8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037082
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
je 0x1003709f
cmp byte [ecx], 0
je 0x100370ba
push 0xbdc
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
lea eax, [ecx + 2]
mov dword [edx], eax
call fcn.10035a06
mov ecx, dword [ebp + 0xc]
movzx eax, ax
push eax
call fcn.10030dbf
pop ebp
ret

Function at 0x10037175
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov eax, 0x100621e9
call fcn.100608e8
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x18], cl
je 0x1003723b
cmp byte [ebp + 0x10], 0
je 0x1003722e
mov dword [ebp - 0x1c], 0x4b8e
cmp dword [ebp - 0x1c], 0x4c91
jle 0x100371f6
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100371d1
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10006880
inc edi
cmp edi, 0x1427
jl 0x100371b6
inc esi
cmp esi, 0x6a83
jl 0x100371b4
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x10037211
push 0
push 0
push 0
push 0x2431
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
cmp dword [ebp - 0x1c], 0x4a51
jge 0x1003732a
push str.xvlhw_sjeuds_ttvnqfbc_gnawvtgv_weyndoja_bcncbmyw_jekw_saocfwfhs
call fcn.10048acd
pop ecx
jmp 0x1003732a
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1003732a
test cl, cl
je 0x10037267
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1003732a
push 0
push 0x1355
push 0x171
push 0xb4c
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x1003732a
mov dword [ebp - 0x20], 0x1bef
cmp dword [ebp - 0x20], 0x1ea4
jle 0x100372e8
push 0
push 0x420
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], 0x2cf8
mov dword [ebp + 8], ecx
mov eax, edi
sar eax, cl
mov ecx, 0x1007cdd8
xor eax, esi
cdq
push edx
push eax
call fcn.10005d27
mov ecx, dword [ebp + 8]
add ecx, ebx
dec dword [ebp - 0x1c]
mov dword [ebp + 8], ecx
jne 0x10037298
inc ebx
cmp ebx, 0x3fd
jl 0x1003728c
inc edi
cmp edi, 0x22f9
jl 0x1003728a
inc esi
cmp esi, 0x78d2
jl 0x10037288
push 0x1c4a
push 0x130f
push 0x109e
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x1a8a
jge 0x10037307
mov edx, str.asiwrcf_vsq_itgg_djjcpnlqt_xetb_rsmvw_twapsgos_duxsrm
mov ecx, 0x1007cdd8
call fcn.100089dc
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003732a
mov esi, dword [ebp - 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xb90d
inc dword [edx]
cmp dword [edx], 2
jl 0x10037318
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038b14
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062259
call fcn.100608e8
push ecx
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10038bc4
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10038ba8
push 0x5663
push 0
push 0x6748
push 1
mov edx, 0x6398
mov cl, 1
call fcn.10037175
mov dword [ebp - 0x14], 0x6ca5
add esp, 0x10
cmp dword [ebp - 0x14], 0x6f6b
jle 0x10038b8c
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007cdd8
xor eax, edi
cdq
push edx
push eax
call fcn.10005d27
inc ebx
cmp ebx, 0x16b6
jl 0x10038b69
inc edi
cmp edi, 0x2f8e
jl 0x10038b67
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x69b6
jge 0x10038ba8
mov edx, str.tpgnbple_hrtnlsu_zmmskrd_kbozvzq
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x10038bd7
cmp byte [ecx], 0
je 0x10038bd7
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003aa53
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 8], 0
mov byte [ebp - 4], cl
je 0x1003ab1a
test cl, cl
je 0x1003aa9c
cmp byte [edx], 0
je 0x1003ab42
push 0x35d7
push 0xf6f
xor ecx, ecx
push 0x6457
inc ecx
push 0x7f9b
push ecx
mov dl, cl
xor cl, cl
call fcn.10038634
add esp, 0x14
jmp 0x1003ab42
mov dword [ebp - 8], 0xf57a7c2
xor ecx, ecx
inc ecx
mov dword [ebp + 8], ecx
mov dword [ebp + 8], 0xffffffff
push 2
mov dword [ebp + 8], 0xffffffff
mov dword [ebp + 8], 0
pop edx
jmp 0x1003aad1
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10], 0x62fd
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1003aac3
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jl 0x1003ab42
mov dword [ebp + 8], 0x3367
mov dword [ebp + 8], 0xfffffff7
mov dword [ebp + 8], 0xffffffff
inc dword [ebp + 8]
mov dword [ebp + 8], 0
jmp 0x1003ab0e
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10], 0xf6d4
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1003ab00
dec dword [ebp - 8]
jns 0x1003aadf
jmp 0x1003ab42
cmp byte [ebp + 0x10], 0
je 0x1003ab37
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003ab42
push 0
push 0x1b89
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x1003ab42
push 0xd5f
call dword [sym.imp.USER32.dll_GetKeyState]
mov esp, ebp
pop ebp
ret

Function at 0x1003aeb5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100622f5
call fcn.100608e8
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], 0x5127
mov ebx, edx
cmp dword [ebp - 0x1c], 0x539d
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
jle 0x1003af34
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov eax, esi
mov dword [ebp - 0x14], 0x13e1
cdq
xor ebx, ebx
idiv edi
mov dword [ebp - 0x24], edx
xor esi, esi
mov eax, ebx
mov ecx, 0x1007cdd8
xor eax, esi
cdq
push edx
push eax
call fcn.10005d27
inc esi
cmp esi, 0x2a12
jl 0x1003aef7
add ebx, dword [ebp - 0x24]
dec dword [ebp - 0x14]
jne 0x1003aef5
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x2c15
jl 0x1003aee4
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x7b1d
jl 0x1003aee2
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4fcc
jge 0x1003af6f
mov edx, str.nnioqirj_ncerikpj_mys_yvvkixkl_tzim_rtn_jdkfs_qfexpmcd_jmdmxzw_hbhwc_eoxyhwfi
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x1003af6f
cmp byte [ebp + 0x14], 0
je 0x1003af87
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x1003afa9
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
jmp 0x1003afa9
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jg 0x1003afa9
mov esi, dword [ebp + 0x18]
mov ecx, dword [ebx]
mov eax, dword [esi]
cmp dword [eax + ecx*4], 0
jne 0x1003afa9
inc dword [edx]
cmp dword [edx], 3
jle 0x1003af98
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100426c3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100426da
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100426fc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x108202e4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10820670
jl 0x1004270a
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10820914
jl 0x1004274a
mov ecx, dword [0x10821660]
xor ecx, dword [0x108202e4]
and ecx, edi
xor ecx, dword [0x10821660]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x108202e0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10820914]
mov dword [0x10820ca0], eax
pop esi
ret
Function at 0x4053dd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40d420]
jne 0x4053e7
repz ret
jmp fcn.00407594

Function at 0x405ba7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40d420]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004038fe
and dword [ebp - 0x14], 0
cmp dword [0x40e898], 0
mov dword [ebp - 0x18], eax
jne 0x405c5a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405d02
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405d02
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40e898], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40e89c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40e8a0], eax
call edi
push eax
call esi
mov dword [0x40e8a8], eax
test eax, eax
je 0x405c5a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40e8a4], eax
mov eax, dword [0x40e8a4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405cb3
cmp dword [0x40e8a8], ecx
je 0x405cb3
push eax
call esi
push dword [0x40e8a8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405cb3
test ebx, ebx
je 0x405cb3
call edi
test eax, eax
je 0x405caa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405caa
test byte [ebp - 8], 1
jne 0x405cb3
or dword [ebp + 0x10], 0x200000
jmp 0x405ce6
mov eax, dword [0x40e89c]
cmp eax, dword [ebp - 0x18]
je 0x405ce6
push eax
call esi
test eax, eax
je 0x405ce6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405ce6
mov eax, dword [0x40e8a0]
cmp eax, dword [ebp - 0x18]
je 0x405ce6
push eax
call esi
test eax, eax
je 0x405ce6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40e898]
call esi
test eax, eax
je 0x405d02
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405d04
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004053dd
leave
ret
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x1844330
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1172000]
push edi
or ebp, 0xffffffff
jmp 0x1844352
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1844359
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1844348
mov eax, 1
add ebx, ebx
jne 0x184436b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x184437c
jne 0x184439b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x184439b
dec eax
add ebx, ebx
jne 0x1844388
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1844360
add ebx, ebx
jne 0x1844397
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x18443ed
xor ecx, ecx
sub eax, 3
jb 0x18443b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1844422
sar eax, 1
mov ebp, eax
jmp 0x18443be
add ebx, ebx
jne 0x18443be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x184438c
inc ecx
add ebx, ebx
jne 0x18443cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x184438c
add ebx, ebx
jne 0x18443d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x18443ce
jne 0x18443ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x18443ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x184440c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x18443fe
jmp 0x184434e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x184440c
add edi, ecx
jmp 0x184434e
pop esi
mov edi, esi
mov ecx, 0xdd9a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x184442a
cmp byte [edi], 0x1e
jne 0x184442a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x184442f
lea edi, [esi + 0x1440000]
mov eax, dword [edi]
or eax, eax
je 0x184449e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14471d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1447318]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x184445c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1447320]
or eax, eax
je 0x1844498
mov dword [ebx], eax
add ebx, 4
jmp 0x1844479
call dword [esi + 0x144731c]
mov ebp, dword [esi + 0x1447324]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x18444d2
sub esp, 0xffffff80
jmp 0x5b0914
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x40676a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4067a9
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4067a9
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4067a9
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4067a9
cmp dword [ecx + 0x74], 0xe
jbe 0x4067a9
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x410aba
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4204fc
push 0x4204f4
push str.FlsAlloc
push 0x1e
call fcn.00410963
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410aee
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d154]
call esi
jmp 0x410af4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x410b38
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42050c
push 0x420504
push str.FlsGetValue
push 0x20
call fcn.00410963
mov esi, eax
add esp, 0x10
test esi, esi
je 0x410b6f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41d154]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4127b0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412452

Function at 0x4127bb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004125e1