joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4126e0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43b91e
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x2a4], 0
lea ecx, [ebp - 0x2a0]
call fcn.00405120
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x4cc]
add eax, 0xf8
push eax
lea ecx, [ebp - 0x4c8]
call fcn.00404cb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a0]
push ecx
lea edx, [ebp - 0x4c8]
push edx
call fcn.0040f060
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4c8]
call fcn.00404cf0
lea ecx, [ebp - 0x2a0]
call fcn.004052b0
mov dword [ebp - 0x2a4], eax
xor eax, eax
mov word [ebp - 0x4ac], ax
push 0x206
push 0
lea ecx, [ebp - 0x4aa]
push ecx
call fcn.00426300
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x4cc]
call fcn.00412560
push eax
push str.TSLOG
mov eax, dword [ebp - 0x2a4]
push eax
push str._s_s._s__d_..log
push 0x104
lea ecx, [ebp - 0x4ac]
push ecx
call fcn.0042934a
add esp, 0x1c
mov dword [ebp - 0x10], 0xffffffff
lea edx, [ebp - 0x284]
push edx
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x30]
call fcn.00405120
mov byte [ebp - 4], 2
cmp dword [ebp - 0x10], 0xffffffff
je 0x412873
mov ecx, dword [ebp - 0x2a4]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00405250
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x30]
call fcn.00405290
lea ecx, [ebp - 0x30]
call fcn.004052b0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41285e
lea ecx, [ebp - 0x30]
call fcn.004052b0
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteLogFile_Failed__ErrorCode_:__d_0x_08x___LogFilePath_:__s
mov eax, dword [ebp - 0x4cc]
push eax
call fcn.004129b0
add esp, 0x14
lea ecx, [ebp - 0x284]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x412802
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00405210
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a0]
call fcn.00405210
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret 4
Function at 0x41a090
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
push 0x4b3c58
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x24
push 0
mov edx, dword [ebp - 4]
add edx, 8
push edx
call fcn.00426300
add esp, 0xc
mov eax, dword [ebp - 4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push str.mlang.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 4]
mov dword [edx + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b209c], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b20a0], eax
cmp dword [0x4b209c], 0xffffffff
jne 0x41a11c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b209c], eax
cmp dword [0x4b20a0], 0xffffffff
jne 0x41a130
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x4b20a0], eax
push 0
push 0
call fcn.0040e820
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x41ec80
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov ecx, dword [0x4b3ed4]
mov edx, dword [ecx + 8]
sub edx, 1
push edx
mov eax, dword [0x4b3ee0]
push eax
push str.TSLOG
push 0x4b3c70
push str.Module_Unload._Path___s__Current_LogGroup_:___s___ModuleID_:__d__RefCount_:__d
mov ecx, dword [0x4b3ed4]
push ecx
call fcn.004129b0
add esp, 0x18
push 0x4b3c58
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov edx, dword [0x4b209c]
push edx
call dword [sym.imp.KERNEL32.dll_TlsFree]
mov eax, dword [0x4b20a0]
push eax
call dword [sym.imp.KERNEL32.dll_TlsFree]
cmp dword [0x4b3ecc], 0
jne 0x41ecf8
jmp 0x41ee7f
push 0xffffffffffffffff
mov ecx, dword [0x4b3ecc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x4b3ecc]
mov dword [ebp - 4], edx
mov dword [0x4b3ecc], 0
mov eax, dword [0x4b3ed4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jg 0x41ee1c
mov ecx, dword [0x4b3ed4]
cmp dword [ecx + 0x24], 0xffffffff
je 0x41ed52
mov edx, dword [0x4b3ed4]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov ecx, dword [0x4b3ed4]
cmp dword [ecx + 0xe8], 0xffffffff
je 0x41ed74
mov edx, dword [0x4b3ed4]
mov eax, dword [edx + 0xe8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x4b3ed4]
add ecx, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [0x4b3ed4]
add ecx, 0x34
call fcn.0040f780
mov ecx, dword [0x4b3ed4]
add ecx, 0x88
call fcn.0040f780
mov edx, dword [0x4b3ed4]
mov eax, dword [edx + 0x240]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41ede2
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [ebp - 0xc], 0
mov eax, dword [0x4b3ed4]
mov dword [eax + 0x240], 0
cmp dword [0x4b3ed0], 0
je 0x41ee1c
push 0
push 0x4b3b58
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [0x4b3ed0]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x4b3ed0]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [0x4b3ed0], 0
cmp dword [0x4b20a8], 0xffffffff
je 0x41ee31
mov eax, dword [0x4b20a8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4b3ed0], 0
mov dword [0x4b3ed4], 0
cmp dword [ebp - 4], 0
je 0x41ee5f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x41ee7f
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0
mov esp, ebp
pop ebp
ret
Function at 0x41fa60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
push 0x442914
push 0x442940
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41fac7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41fac7
push 0x4429a8
call fcn.0040de50
add esp, 4
test eax, eax
jne 0x41fac0
push str.Another_Instance_Running._EXIT_
mov ecx, dword [ebp - 0x1c]
push ecx
push 0x442a18
call fcn.0040e820
add esp, 8
push eax
call fcn.0041ada0
add esp, 8
xor al, al
jmp 0x41fbf2
push str.PetalSetup_3CE3CCB6_5964_451f_9760_E92B02D3C895
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xb7
je 0x41fafd
cmp dword [ebp - 0xc], 5
je 0x41fafd
mov dword [ebp - 0x20], 0
jmp 0x41fb04
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41fb65
push 0x442b38
call fcn.0040de50
add esp, 4
test eax, eax
jne 0x41fb5e
push 2
push str.__Another_Instance_Running._EXIT_
mov ecx, dword [ebp - 0xc]
push ecx
push str.Single_Mutex_Created._With_Error:
mov edx, dword [ebp - 0x1c]
push edx
push 0x442ba8
call fcn.0040e820
add esp, 8
mov ecx, eax
call fcn.0041adf0
mov ecx, eax
call fcn.0040d7c0
mov ecx, eax
call fcn.0040d970
mov ecx, eax
call fcn.0040de00
xor al, al
jmp 0x41fbf2
push 0
push ecx
mov ecx, esp
push 0
call fcn.0040bd30
push 0
push 0
push str.PetalSetup.Singleton
push ecx
mov ecx, esp
push 0
call fcn.0040bd30
push 0xfffffffffffffffd
mov ecx, dword [ebp - 0x1c]
call fcn.004223c0
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x50], eax
push 0x442c48
call fcn.0040de50
add esp, 4
test eax, eax
jne 0x41fbe2
push 1
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x50]
push eax
push str.Env_Build_Tick_Count_
mov ecx, dword [ebp - 0x1c]
push ecx
push str.CKKPSetupEnvironment::HandleSingleton
call fcn.0040e820
add esp, 8
mov ecx, eax
call fcn.0040d970
mov ecx, eax
call fcn.0040d7c0
mov ecx, eax
call fcn.0040de00
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.00422d20
test eax, eax
setne al
mov esp, ebp
pop ebp
ret
Function at 0x41fc00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43beab
mov eax, dword fs:[0]
push eax
sub esp, 0x674
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x680], ecx
mov dword [ebp - 0x67c], 0
xor eax, eax
mov word [ebp - 0x44c], ax
push 0x208
push 0
lea ecx, [ebp - 0x44a]
push ecx
call fcn.00426300
add esp, 0xc
push 0x104
lea edx, [ebp - 0x44c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x678]
call fcn.00405190
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x678]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00401a40
add esp, 8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x678]
call fcn.00405210
xor eax, eax
mov word [ebp - 0x23c], ax
push 0x208
push 0
lea ecx, [ebp - 0x23a]
push ecx
call fcn.00426300
add esp, 0xc
lea edx, [ebp - 0x23c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor ecx, ecx
mov word [ebp - 0x65c], cx
push 0x208
push 0
lea edx, [ebp - 0x65a]
push edx
call fcn.00426300
add esp, 0xc
lea ecx, [ebp - 0x2c]
call fcn.004052b0
push eax
lea eax, [ebp - 0x23c]
push eax
push str._sPetalSetup__s_
push 0xffffffffffffffff
push 0x104
lea ecx, [ebp - 0x65c]
push ecx
call fcn.004262dd
add esp, 0x18
lea edx, [ebp - 0x65c]
push edx
mov ecx, dword [ebp + 8]
call fcn.00403a00
mov eax, dword [ebp - 0x67c]
or eax, 1
mov dword [ebp - 0x67c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00405210
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret 4
Function at 0x420a60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43bf98
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4b249c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], ebp
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0x443680
call fcn.00412a50
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x420abc
mov dword [ebp - 0x10], 0x443720
push 0
push 0
push 0
mov ecx, dword [ebp - 0x38]
push ecx
push str.bool___thiscall_CKKPSetupEnvironment::DeleteDirectory_const_class_std::basic_string_wchar_t_struct_std::char_traits_wchar_t__class_std::allocator_wchar_t_____
push 0x4439a0
mov edx, dword [ebp - 0x10]
push edx
lea ecx, [ebp - 0x30]
call fcn.0040e100
mov dword [ebp - 4], 0
cmp dword [ebp - 0x10], 0
jne 0x420aeb
push ebp
pop ebp
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.00420bd0
mov byte [ebp - 0x11], al
mov ecx, dword [ebp + 8]
call fcn.004052b0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x420b60
push 0x4439f0
call fcn.0040de50
add esp, 4
test eax, eax
jne 0x420b47
push 1
push str.Try_Again_
mov ecx, dword [ebp - 0x38]
push ecx
push 0x443a48
call fcn.0040e820
add esp, 8
mov ecx, eax
call fcn.0040d970
mov ecx, eax
call fcn.0040de00
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x38]
call fcn.00420bd0
mov byte [ebp - 0x11], al
push 0x443ab0
call fcn.0040de50
add esp, 4
test eax, eax
jne 0x420ba3
push 1
movzx eax, byte [ebp - 0x11]
push eax
push str.DeleteDirectory_Returns_:
mov ecx, dword [ebp - 0x38]
push ecx
push str.CKKPSetupEnvironment::DeleteDirectory
call fcn.0040e820
add esp, 8
mov ecx, eax
call fcn.0040d970
mov ecx, eax
call fcn.00423340
mov ecx, eax
call fcn.0040de00
mov dl, byte [ebp - 0x11]
mov byte [ebp - 0x31], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040e4a0
mov al, byte [ebp - 0x31]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x421450
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c0ae
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0x24], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x1c]
call fcn.00404b40
mov dword [ebp - 4], 0
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x1c]
push eax
push 0x443ecc
call fcn.00421ab0
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x4214e4
movzx ecx, word [ebp - 0x1c]
cmp ecx, 8
jne 0x4214e4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4214e4
mov dword [ebp - 0x238], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404b60
mov eax, dword [ebp - 0x238]
jmp 0x4215b5
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x1c]
push eax
push 0x443ed8
call fcn.00421ab0
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x421596
movzx ecx, word [ebp - 0x1c]
cmp ecx, 8
jne 0x421596
xor edx, edx
mov word [ebp - 0x234], dx
push 0x208
push 0
lea eax, [ebp - 0x232]
push eax
call fcn.00426300
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
push 0x443ee8
push 0xffffffffffffffff
push 0x104
lea edx, [ebp - 0x234]
push edx
call fcn.004262dd
add esp, 0x14
push str.ProgramPetal.exe
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x234]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421596
mov dword [ebp - 0x23c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404b60
mov eax, dword [ebp - 0x23c]
jmp 0x4215b5
mov dword [ebp - 0x240], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404b60
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret
Function at 0x421950
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43c1ac
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x4b249c]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x1c], 0x1900000
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24c]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x421a8d
cmp dword [ebp - 0x10], 0
ja 0x421a76
jb 0x4219d6
cmp dword [ebp - 0x14], 0x1900000
jae 0x421a76
xor eax, eax
mov word [ebp - 0x22c], ax
push 0x206
push 0
lea ecx, [ebp - 0x22a]
push ecx
call fcn.00426300
add esp, 0xc
mov edx, dword [ebp - 0x24c]
mov eax, dword [edx + 0x28]
push eax
push 0x443f50
push 0xffffffffffffffff
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
call fcn.004262dd
add esp, 0x14
push 0x443f58
lea edx, [ebp - 0x22c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x248]
call fcn.00405190
mov dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x248]
push ecx
mov ecx, dword [ebp - 0x24c]
call fcn.00420bd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00405210
mov ecx, dword [ebp - 0x24c]
call fcn.0041fe10
cmp dword [ebp - 0x10], 0
ja 0x421a8b
jb 0x421a87
cmp dword [ebp - 0x14], 0x1900000
jae 0x421a8b
xor al, al
jmp 0x421a93
jmp 0x421a91
xor al, al
jmp 0x421a93
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.0042624f
mov esp, ebp
pop ebp
ret
Function at 0x425bbd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4b5744], 0
push esi
jne 0x425b30
call fcn.00425a56
test eax, eax
je 0x425b73
mov eax, dword [0x4b5744]
cmp eax, 1
jne 0x425b51
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x425b73
pop esi
ret
push eax
call dword [0x4b574c]
test eax, eax
jne 0x425bbb
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x425b77
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4b5744]
call dword [0x4b574c]
mov edi, eax
test edi, edi
je 0x425b9c
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x425bb8
mov edi, esi
add esi, 0xff0
push edi
push dword [0x4b5744]
call dword [0x4b5748]
add edi, 0x10
cmp edi, esi
jb 0x425ba4
mov eax, edi
pop edi
pop esi
ret
jmp 0x425b1d

Function at 0x42624f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b249c]
jne 0x426259
repz ret
jmp fcn.0042bf6d

Function at 0x43554b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042b955
and dword [ebp - 4], 0
cmp dword [0x4b6364], 0
mov ebx, eax
jne 0x4355fc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4356ad
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4356ad
push eax
call fcn.0042b8e3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b6364], eax
call esi
push eax
call fcn.0042b8e3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b6368], eax
call esi
push eax
call fcn.0042b8e3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b636c], eax
call esi
push eax
call fcn.0042b8e3
pop ecx
mov dword [0x4b6374], eax
test eax, eax
je 0x4355fc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042b8e3
pop ecx
mov dword [0x4b6370], eax
mov eax, dword [0x4b6370]
cmp eax, ebx
je 0x435654
cmp dword [0x4b6374], ebx
je 0x435654
push eax
call fcn.0042b95e
push dword [0x4b6374]
mov esi, eax
call fcn.0042b95e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x435654
test edi, edi
je 0x435654
call esi
test eax, eax
je 0x43564b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43564b
test byte [ebp - 0xc], 1
jne 0x435654
or dword [ebp + 0x10], 0x200000
jmp 0x43568d
mov eax, dword [0x4b6368]
cmp eax, ebx
je 0x43568d
push eax
call fcn.0042b95e
pop ecx
test eax, eax
je 0x43568d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43568d
mov eax, dword [0x4b636c]
cmp eax, ebx
je 0x43568d
push eax
call fcn.0042b95e
pop ecx
test eax, eax
je 0x43568d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b6364]
call fcn.0042b95e
pop ecx
test eax, eax
je 0x4356ad
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4356af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x106ec40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x129000]
push edi
jmp 0x106ec5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x106ec61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x106ec50
mov eax, 1
add ebx, ebx
jne 0x106ec73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x106ec84
jne 0x106eca3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x106eca3
dec eax
add ebx, ebx
jne 0x106ec90
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x106ec68
add ebx, ebx
jne 0x106ec9f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x106ecf5
xor ecx, ecx
sub eax, 3
jb 0x106ecbb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x106ed2a
sar eax, 1
mov ebp, eax
jmp 0x106ecc6
add ebx, ebx
jne 0x106ecc6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x106ec94
inc ecx
add ebx, ebx
jne 0x106ecd4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x106ec94
add ebx, ebx
jne 0x106ece1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x106ecd6
jne 0x106ecf2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x106ecd6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x106ed14
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x106ed06
jmp 0x106ec56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x106ed14
add edi, ecx
jmp 0x106ec56
pop esi
mov edi, esi
mov ecx, 0x63f3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x106ed32
cmp byte [edi], 0x1e
jne 0x106ed32
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x106ed37
lea edi, [esi + 0xc6b000]
mov eax, dword [edi]
or eax, eax
je 0x106edaf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xcb4b7c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xcb4cbc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x106ed64
mov ecx, edi
jns 0x106ed93
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xcb4cc0]
or eax, eax
je 0x106eda9
mov dword [ebx], eax
add ebx, 4
jmp 0x106ed81
call dword [esi + 0xcb4cd0]
mov ebp, dword [esi + 0xcb4cc4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x106ede3
sub esp, 0xffffff80
jmp 0x4e8ee3
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1d5d3304
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x283655c1
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x100280ca
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10027f49

Function at 0x1002d08a
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002cf8f