joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459d1c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47ff30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0045602d
mov dword [ebp - 0x14], eax
cmp dword [0x49e0c4], esi
jne 0x459e0f
push 0x800
push esi
push 0x471210
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x459d9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x459eef
push esi
push esi
push 0x471210
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x459eef
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x459eef
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x49e0c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49e0c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49e0cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49e0d4], eax
test eax, eax
je 0x459e0c
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49e0d0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x459e34
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x459e27
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x459e49
push 4
pop eax
jmp 0x459ef1
cmp dword [ebp - 0x14], esi
je 0x459e49
push dword [0x49e0c4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x459e2e
mov eax, dword [0x49e0d0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x459ea7
cmp dword [0x49e0d4], edi
je 0x459ea7
push eax
call ebx
push dword [0x49e0d4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x459ea7
test eax, eax
je 0x459ea7
call ecx
test eax, eax
je 0x459e9c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x459e9c
test byte [ebp - 8], 1
jne 0x459ea7
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x459ed7
mov eax, dword [0x49e0c8]
cmp eax, edi
je 0x459ed4
push eax
call ebx
test eax, eax
je 0x459ed4
call eax
mov esi, eax
test esi, esi
je 0x459ed4
mov eax, dword [0x49e0cc]
cmp eax, edi
je 0x459ed4
push eax
call ebx
test eax, eax
je 0x459ed4
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x49e0c4]
call ebx
test eax, eax
je 0x459eef
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x459ef1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00459f20
mov esp, ebp
pop ebp
ret
Function at 0x417e10
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4c7aac], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [0x4c7aac]
push 0x10
add ecx, eax
mov dword [0x4c7aac], ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x417e4d
or dword [esi], 0x2000000
mov eax, esi
pop esi
ret

Function at 0x42826c
Capabilities:
Encode data using xor

Disassembly:
jne 0x4282d1
xchg bl, bl
adc edx, dword [ebp + 2]
invalid
xor dword [eax + 0x7f], edx
adc al, 0x6e
mov dl, byte [eax - 0x2ff632d5]
ljmp 0x2991
je 0x428313
outsb dx, byte [esi]
pushal
fild qword cs:[ecx]
daa
adc eax, 0x79deea95
idiv byte [edi + 0x58d7605b]
leave
mov dl, 0x16
enter 0xffffffffffff821c, 0x75
mov esi, 0x3b86e1b6
jns 0x428274
invalid
pop ds
cmp ah, byte [esi + 0x29e0d05d]
stosd dword es:[edi], eax
shl byte [eax + esi*4 + 0x7b], 0x11
pop esp
mov word [edx], ss
push ebx
mov edx, 0xdf372e77
sub dl, byte [ecx + 0x2674603e]
fcomi st(2)
fcomi st(2)
or bh, ch
mov dword [0xde33305a], eax
xor byte [esi - 0x36349099], al
outsb dx, byte [esi]
pop ebp
mov ebx, 0xb05b38dd
mov dword [esi + 0x78ecbf08], esi
push ecx
mov bl, 8
sbb byte [esi], 0xcd
jle 0x428320
jl 0x42832f
mov esi, dword [ecx]
dec eax
sbb eax, 0x110792ed
sbb esi, dword [ebp - 0x32]
mov dword [0x57bbbc3f], eax
pushal
imul ebx, dword [esi - 0x7b], 0x5868612d
fadd qword [ecx + 0x49099b73]
mov edx, 0xe268d7a0
invalid
Function at 0x43d43e
Capabilities:
Encode data using xor

Disassembly:
inc esi
cmp al, 0x86
push ebx
nop
imul eax, dword [ebp - 0x1b], 0xfffffff1
fsub qword [edx]
aas
ja 0x43d3fe
sub eax, 0xad421c08
inc esp
stosd dword es:[edi], eax
in al, dx
mov eax, dword [0xb497b300]
rcr dword [ebp + 0x1f0a4db2], 0x5e
aam 0x8b
add dword [eax + ecx*4 - 0x617d03d], edx
enter 0x60af, 0xfffffffffffffff3
jg 0x43d434
out dx, al
invalid
pop esi
arpl word [ebx - 0xd3b278], si
mov edx, 0x763b50b1
test al, 0x7c
pop edx
invalid
xchg edi, eax
cmp eax, esp
mov esp, 0x56c55287
loopne 0x43d3ef
xchg dword [edx - 0x3b], edx
push esi
push edx
lds edx, [esi + 0x70]
mov al, byte [0x19562581]
retf 0x227f
jg 0x43d462
jo 0x43d3d9
and dword [0x7fca1956], 0xb55ab222
jae 0x43d44a
jg 0x43d462
mov dl, 0x5a
mov ch, 0x66
jae 0x43d44a
jae 0x43d497
xchg esp, eax
mov ch, 0x55
push ebp
jno 0x43d420
inc eax
sub byte [ecx], dh
in eax, 0x70
rcl byte [ebp - 0x7d], 0x50
je 0x43d491
sub bh, byte [esi]
dec ecx
rol dword [ecx], 0x3a
add dword [edx], edi
xchg ecx, eax
pushal
xor byte [edx - 0x27], dh
or al, 0x56
fldenv [edi + 0xc]
push esi
adc eax, 0xdc3fd63a
add esp, 0x61
jecxz 0x43d472
enter 0xffffffffffffeacb, 0x20
cmp dword [edi + 0x60], ecx
shl dword [edi + 0x62], cl
into
out dx, al
nop
bound esi, qword [esi - 0x3e]
ret
ljmp 0x67d3:0x604f3920
out 0xad, al
push ss
xchg dl, ah
pop ss
xchg ebx, eax
mov ebp, dword [ebx]
loope 0x43d4ce
mov esi, esp
cmp dword [ebx - 0x54a9192e], 0xe04f1f8c
adc ah, byte [eax + 0x73]
xchg ebx, eax
mov ebx, 0xab56e6d2
mov word [edi], ds
pop ds
dec edi
loopne 0x43d4ad
pushal
jae 0x43d431
add al, 0x26
je 0x43d460
xchg esp, eax
loope 0x43d426
xor eax, 0x60cfbb80
salc
out dx, al
jle 0x43d45c
scasb al, byte es:[edi]
push cs
push eax
adc eax, 0x64431283
les ebp, [edi + 0x2f]
loopne 0x43d4da
xor byte [eax + 0x12], al
test eax, 0xaa4c6f63
stosb byte es:[edi], al
aaa
dec eax
jae 0x43d506
xor esp, edi
jae 0x43d4c1
xor esi, dword [ebx]
mov dword [edi + 0x13], 0xb35e6045
jno 0x43d482
adc eax, dword [ebp + 0x60]
pop esi
mov bl, 0x71
lodsd eax, dword [esi]
inc eax
sbb eax, 0x5ea6796d
pop esi
into
add eax, 0x7e7976c0
ror edx, 1
leave
add dword [eax], edx
jae 0x43d54c
test eax, 0x95bc1ac
int3
sbb dword [eax], esp
pop esp
cmpsd dword [esi], dword es:[edi]
adc byte [0x67f79970], 0xd5
or dword [eax - 0x3e371ff0], esp
ljmp 0x68c5
ljmp 0xd97:0x8f760710
Function at 0x43fb53
Capabilities:
Encode data using xor

Disassembly:
clc
js 0x43fb8a
jae 0x43fbd1
cli
or eax, 0x8f0cad33
add al, 0x18
ja 0x43fbb2
push eax
mov ah, 0x96
or edi, dword [ecx + 0x7c]
js 0x43fb61
add ah, byte [eax + 0x35]
sbb dword [eax + 0x1b6958b1], ebp
jne 0x43fbcd
invalid
sal dword [eax - 3], 0x3b
cmp dword [edi], esi
jo 0x43fbb1
cmp edi, dword [ecx]
aaa
sbb byte [ecx + 0x7c], bh
cli
pop esp
mov eax, 0x38a123f1
and esp, dword [ecx - 0x28b2d7c8]
dec ebp
xlatb
dec eax
call 0x8a3d2b10
mov byte [ecx + 2], dl
push esi
sub al, 0x81
xlatb
push 0xb51efef9
inc edi
sbb cl, byte [esi + eax*4 - 0x6bde83c2]
je 0x43fb61
jge 0x43fc1b
jns 0x43fc0a
in eax, dx
inc eax
push ds
aad 0xd
hlt
xchg dword [eax], edi
sub ebx, edi
sbb dword [0x68669a58], esi
std
pushfd
cmp al, 0x50
out 0xd9, eax
xchg esp, eax
mov esp, 0x4f65c740
jnp 0x43fbc2
sbb byte [ebp - 0x7c], al
lcall 0x1407, 0xf6574e91
mov ah, 0x6a
test eax, 0xd831d8ea
pushfd
lahf
hlt

Function at 0x43fe27
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
out 0x9e, eax
in al, 0xf5
dec edi
and eax, 0x86202701
xor byte [eax + 0x406eacdf], ah
and dword [ebp + 0x31], esi
push ebp
mov dh, 0xf7
pop edi
xchg edi, eax
xor dword [ebp - 0x4a], edx
neg dword [edi - 0x69]
jecxz 0x43fdb0
test dword [edi + 0x55], esi
sub dword [eax], edx
out 0xb3, eax
mov bh, 0xaf
popal
and al, byte [esi + 0x12306644]
rcl dword [ebp - 0x1ad9e5ee], cl
dec edi
push esi
xchg edi, eax
invalid
pop dword [edx + 0x151efbea]
or al, 0x90
loop 0x43fdc3
inc ebx
imul ebx, dword [ebx], 0xffffffaa
salc
or bl, 0x46
jne 0x43fe38
cdq
xor al, 0x9b
push ss
in al, 0xff
cmp al, 0x9d
js 0x43fe6e
aaa
pushfd
invalid
cmp eax, 0x8f4e21a1
fcomp dword [edx + ecx*2 + 0xff4aea5]
fsub qword [edx - 0x54]
jmp 0x43fe0d

Function at 0x47f853
Capabilities:
Encode data using xor

Disassembly:
aad 0xd8
aas
sub byte [edx + 0x6ad4e4a8], cl
add dword [edx + 0x6fd45fdf], ebx
mov eax, dword [0x556148bb]
sbb ecx, dword [esi + 0x69]
dec esi
imul ebp, eax, 0x14df9c05
dec esi
imul ebp, eax, 0x14df9c05
add byte [edx - 0x6d], al
cdq
and dword [esi - 0x2dbce5d8], ecx
cmpsb byte [esi], byte es:[edi]
xchg esi, eax
dec edx
fild qword [edi]
cli
dec ecx
sub eax, 0x601b3640
call 0x4d9ec6dd
cmpsd dword [esi], dword es:[edi]
mov byte [0x9fc1ee05], al
and eax, 0xee2c5864
pop eax
sub al, 0xee
pop ebp
in eax, dx
xor edx, esi
push edi
adc al, 0xca
xchg ebx, eax
dec ebp
jo 0x47f83e
pop ebx
fidiv word [ecx - 0x4d87a631]
or eax, 0xe9281211
mov bl, 0xb9
outsb dx, byte [esi]
inc esi
cmp al, 0x66
lahf
xor byte [ecx + esi], 0x2b
ja 0x47f87c
enter 0xffffffffffff93ff, 0x1a
rcr edi, 1
mov eax, 0xd5543d8f
xchg esi, eax
and eax, 0x3fd75114
sti
psubd mm5, qword [eax + 0x13]
dec ebx
retf 0x969d
Function at 0x49976d
Capabilities:
Authenticate hmac

Disassembly:
mov cl, 0xe2
nop
call [edx]
imul eax, dword [esi - 0x46a226b2], 0xf1590f24
jae 0x4997f9
loop 0x4997b4
movsd dword es:[edi], dword [esi]
mov byte [0xcad00688], al
test dh, ah
add byte [ecx], bh
cli
neg esi
adc esi, dword [eax + 0x78c840b2]
xchg ecx, eax
or al, 0x36
xor bh, byte [eax + 0x58fe06dc]
inc eax
enter 0xffffffffffff9178, 0xc
xor bh, byte ss:[eax + 0x58fe06dc]
enter 0x502c, 0x39
xchg ecx, eax
fcom dword [esp + edx*4 + 0x39]
sbb dword [eax - 0xdd9a9aa], esi
pop es
aaa
ficom word [esi]
xor al, 0x1e
cmp bl, byte [edx]
push edx
cmp cl, byte [edx - 0x1c7d3408]
sub al, 0xe9
push ebx
xor dl, byte [ecx + ecx*4]
adc al, 0x89
cmc
in eax, 0x98
mov esi, 0x8bceba2
or dword [ebx], ebp
push ebp
sti
js 0x499790
les edi, [eax]
fld qword [ebx - 0x4f3ccb67]
cmp cl, 0x18
sbb byte [eax - 0x16], 0xc1
mov al, 0x48
jae 0x49983f
invalid
xlatb
jb 0x499842
call 0x7ad7aca7
adc dword [edi + esi*8 + 0x77], ebx
mov edi, 0x96ae99aa
fist word [edi - 0x5661881d]
dec ebp
inc ebp
dec eax
and dword [ebx + 0x19], edi
bound ecx, qword [edx - 0x189fd96a]
je 0x4997be
cmp eax, 0x785830ac
sbb al, 0x5c
jmp 0x12f522f8
mov byte [0x74b1442c], al
mov cl, 0x74
jl 0x499814
sbb al, byte [0x2825519]
mov ecx, 0x9bd9486d
and ebx, dword [edi - 0x18cf558b]
ret 0xe82e

Function at 0x49b34f
Capabilities:
Encode data using xor

Disassembly:
invalid
scasd eax, dword es:[edi]
shl edx, cl
jp 0x49b25a
invalid
loope 0x49b2d2
and dword [ecx - 0x67e6c85a], edi
sub eax, 0x52215086
mov ebx, 0x989fccf6
test dword [ebx], esp
cwde
test dword [edx], eax
or eax, 0x956bdf11
push ebx
mul byte [edi + 0x2f]
popal
xchg ebx, eax
pop esp
jae 0x49b37b
mov ah, byte [ecx + 0x23ec709d]
push edx
imul ecx, dword [edx], 0x3a
push ebp
inc esi
invalid

Function at 0x49e28e
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x952c28b
das
aad 0xeb
aad 0x40
invalid
Function at 0x4bb959
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4368
cmp edx, dword [eax]
je 0x4bb97b
add eax, 8
inc ecx
cmp eax, 0x4c43f8
jl 0x4bb96c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4368]
jne 0x4bbaa9
mov eax, dword [0x4c8cfc]
cmp eax, 1
je 0x4bba83
test eax, eax
jne 0x4bb9ac
cmp dword [0x4c4290], 1
je 0x4bba83
cmp edx, 0xfc
je 0x4bbaa9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
invalid
jne 0x4bb9e3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc7d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bba26
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc7d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b5c
push edi
call fcn.004be6a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc350
lea eax, [ebp - 0xa0]
push 0x4c0b3c
push eax
call fcn.004bc350
push dword [esi + 0x4c436c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc350
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be614
add esp, 0x2c
pop edi
jmp 0x4bbaa9
lea eax, [ebp + 8]
lea esi, [esi + 0x4c436c]
push 0
push eax
push dword [esi]
call fcn.004bc7d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40cce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x43c080]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x73d81d14
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub eax, 0xe1a49bb2
je 0x40cd44
jmp 0x40cd1a
mov eax, dword [ebp - 0x20]
sub eax, 0x73d81d14
je 0x40cd32
jmp 0x40cd2d
jmp 0x40cd8b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0xe1a49bb2
jmp 0x40cd8b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
not byte [edi]
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
add byte [edi], 0x72
sub byte [edi], 0x25
pop eax
push eax
mov eax, eax
xor eax, 0x85
nop
imul byte [edi]
inc edi
loop 0x40cd5a
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00426240
add esp, 0x1c
pop edi
pop ebp
ret
jmp 0x40cd04
Function at 0x40d330
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xce66744a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
sub eax, 0x80eaf0ab
je 0x40d42f
jmp 0x40d35a
mov eax, dword [ebp - 0x1c]
sub eax, 0xac1b80f7
je 0x40d549
jmp 0x40d36d
mov eax, dword [ebp - 0x1c]
sub eax, 0xb08c9798
je 0x40d570
jmp 0x40d380
mov eax, dword [ebp - 0x1c]
sub eax, 0xb341084a
je 0x40d52b
jmp 0x40d393
mov eax, dword [ebp - 0x1c]
sub eax, 0xc63e8fa7
je 0x40d582
jmp 0x40d3a6
mov eax, dword [ebp - 0x1c]
sub eax, 0xc693aa16
je 0x40d57c
jmp 0x40d3b9
mov eax, dword [ebp - 0x1c]
sub eax, 0xce66744a
je 0x40d41d
jmp 0x40d3cc
mov eax, dword [ebp - 0x1c]
sub eax, 0xeaeaa353
je 0x40d564
jmp 0x40d3df
mov eax, dword [ebp - 0x1c]
sub eax, 0xf0260b45
je 0x40d51f
jmp 0x40d3f2
mov eax, dword [ebp - 0x1c]
sub eax, 0x3d47e083
je 0x40d458
jmp 0x40d405
mov eax, dword [ebp - 0x1c]
sub eax, 0x5fb61e31
je 0x40d4cb
jmp 0x40d418
jmp 0x40d589
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x80eaf0ab
jmp 0x40d589
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov edx, eax
mov eax, 0xc693aa16
mov ecx, 0x3d47e083
cmp edx, 0xffffffff
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x40d589
mov ecx, dword [0x43d534]
mov eax, dword [0x43d530]
mov edx, ecx
sub edx, 0x69389991
sub edx, 1
add edx, 0x69389991
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc63e8fa7
mov ecx, 0x5fb61e31
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x40d589
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [0x43d534]
mov ecx, dword [0x43d530]
mov edx, eax
sub edx, 0x7c6785be
sub edx, 1
add edx, 0x7c6785be
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc63e8fa7
mov ecx, 0xf0260b45
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x40d589
mov dword [ebp - 0x14], 0xb341084a
jmp 0x40d589
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0xac1b80f7
jmp 0x40d589
mov edx, dword [ebp - 8]
mov eax, 0xeaeaa353
mov ecx, 0xb08c9798
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x40d589
mov dword [ebp - 0x14], 0xc693aa16
jmp 0x40d589
mov dword [ebp - 0x14], 0xc693aa16
jmp 0x40d589
add esp, 0x1c
pop ebx
pop ebp
ret
mov dword [ebp - 0x14], 0x5fb61e31
jmp 0x40d344
Function at 0x426b0b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426b4a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426b4a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426b4a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426b4a
cmp dword [ecx + 0x74], 0xe
jbe 0x426b4a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42e2ab
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x42e348
push ebx
push esi
call fcn.0042e274
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0042e208
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x42e2f5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42e347
push edi
push eax
call fcn.0042cd40
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x42e315
call fcn.0042cd8e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x42e346
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0042e208
add esp, 0x20
test eax, eax
jne 0x42e334
push edi
call fcn.0042cd8e
jmp 0x42e33c
push ebx
call fcn.0042cd8e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42f557
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4379b0
push 0x4379a8
push str.FlsAlloc
push 0x1f
call fcn.0042f416
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f58b
push dword [ebp + 8]
mov ecx, esi
call dword [0x43514c]
call esi
jmp 0x42f591
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x42f5d5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4379c0
push 0x4379b8
push str.FlsGetValue
push 0x21
call fcn.0042f416
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f60c
push dword [ebp + 8]
mov ecx, esi
call dword [0x43514c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x42f614
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4379c8
push 0x4379c0
push str.FlsSetValue
push 0x22
call fcn.0042f416
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42f64e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43514c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x434920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43494d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43494d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130