joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52bba0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 1
call fcn.00527fa0
mov eax, dword [esp + 8]
add esp, 4
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.005268a0
cmp eax, 2
push 0
jne 0x52bbcb
push 0xd
jmp 0x52bbcd
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
call fcn.00527fa0
pop ecx
ret

Function at 0x533ff0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
mov edx, dword [0x5debe0]
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
mov eax, dword [edi + 0xa4]
mov ecx, dword [edi]
mov ebx, dword [ecx + 0x20]
mov dword [esp + 0xc], eax
call dword [edx + 0x2b4]
mov dword [esp + 0x10], eax
mov eax, dword [0x5debe0]
push 0x88
push 0x5e0388
call dword [eax + 0x4cc]
mov esi, eax
mov ecx, dword [esi]
add esp, 8
inc ecx
mov dword [esi], ecx
test dword [edi + 0x88], 0x20000000
je 0x53405f
mov ecx, dword [0x5debe0]
push edi
push fcn.00533a10
call dword [ecx + 0x148]
push edi
call fcn.00533a10
add esp, 0xc
push edi
call fcn.0057b6b0
add esp, 4
test eax, eax
je 0x534078
mov ecx, dword [esi]
dec ecx
pop edi
mov dword [esi], ecx
pop esi
pop ebx
add esp, 0x20
ret
cmp dword [edi], 0
jne 0x53408b
mov eax, dword [esi]
dec eax
pop edi
mov dword [esi], eax
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
test ebx, ebx
push ebp
mov ebp, dword [esp + 0x40]
jne 0x5340b6
mov ebx, dword [esp + 0x3c]
lea edx, [ebp - 0x32]
mov dword [esp + 0x24], edx
lea eax, [ebp + 0x32]
lea ecx, [ebx - 0x32]
lea edx, [ebx + 0x32]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], edx
jmp 0x5340ef
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x3c]
push ecx
push ebx
call fcn.004fdcb0
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov edx, dword [ebx + 0x44]
add edx, ecx
mov dword [esp + 0x38], edx
mov ecx, dword [ebx + 0x40]
mov ebx, dword [esp + 0x48]
add esp, 0xc
add ecx, eax
mov dword [esp + 0x28], ecx
mov edx, dword [0x5debe0]
push 0
call dword [edx + 0x3ac]
add esp, 4
push 0x17
xor edi, edi
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x53411d
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x53412f
jmp 0x53412a
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x53412f
mov edi, 2
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push ecx
push 0
push ebp
push ebx
push edi
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x5debe0]
push eax
call dword [ecx + 0x3ac]
add esp, 4
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
push 0
call fcn.00560090
mov eax, dword [esi]
add esp, 0xc
test eax, eax
pop ebp
je 0x534188
mov dword [esi], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x560000
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
xor edi, edi
call esi
test ah, 0x80
je 0x560018
mov edi, 1
push 0x11
call esi
test ah, 0x80
je 0x560024
or edi, 4
push 0x12
call esi
test ah, 0x80
je 0x560033
or edi, 0x20000
push 0x14
call esi
test al, 1
je 0x56003e
or edi, 2
push 0x90
call esi
test al, 1
je 0x56004c
or edi, 8
push 0x91
call esi
test al, 1
je 0x56005a
or edi, 0x20
push 1
call esi
test ah, 0x80
je 0x560069
or edi, 0x100
push 4
call esi
test ah, 0x80
je 0x560078
or edi, 0x200
push 2
call esi
test ah, 0x80
je 0x560087
or edi, 0x400
mov eax, edi
pop edi
pop esi
ret
Function at 0x561150
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x104
push ebx
push ebp
push esi
mov esi, dword [esp + 0x114]
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push 0
push esi
call edi
mov ebx, eax
mov eax, dword [esp + 0x120]
test eax, eax
jne 0x5612d9
cmp esi, 0x14
je 0x5612d9
cmp esi, 0x91
je 0x5612e1
cmp esi, 0x90
je 0x5612d9
push 2
push esi
call edi
cmp eax, 0x7fff
jbe 0x5611ba
pop edi
pop esi
pop ebp
mov eax, 0xff20
pop ebx
add esp, 0x104
ret
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov al, byte [esp + 0x11c]
test al, 1
je 0x5611d7
mov byte [esp + 0x24], 0x80
test al, 4
je 0x5611e0
mov byte [esp + 0x25], 0x80
test al, 0x10
je 0x5611e9
mov byte [esp + 0x26], 0x80
test al, 2
je 0x5611f2
mov byte [esp + 0x28], 1
test al, 0x20
je 0x5611fe
mov byte [esp + 0xa5], 1
test al, 8
je 0x56120a
mov byte [esp + 0xa4], 1
mov ebp, dword [sym.imp.USER32.dll_ToAscii]
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push esi
call ebp
test eax, eax
jge 0x561244
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, 0xff20
pop ebx
add esp, 0x104
ret
cmp eax, 2
jne 0x5612b8
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx esi, ax
mov ebx, esi
push 0
and esi, 0xff
push esi
sar ebx, 8
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov edx, eax
xor eax, eax
test bl, 1
mov ecx, 0x40
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
je 0x561284
mov byte [esp + 0x24], 0x80
test bl, 2
je 0x56128e
mov byte [esp + 0x25], 0x80
test bl, 4
je 0x561298
mov byte [esp + 0x26], 0x80
push 0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, 0xff20
pop ebx
add esp, 0x104
ret
cmp eax, 1
jne 0x5612d9
mov eax, dword [esp + 0x10]
cmp al, 0x20
jb 0x5612d9
cmp al, 0x7f
je 0x5612d9
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x104
ret
cmp esi, 0x91
ja 0x56135d
mov eax, esi
sub eax, 0x10
je 0x56132c
dec eax
je 0x56130d
dec eax
jne 0x56134b
push 0xa5
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
je 0x56134b
pop edi
pop esi
pop ebp
mov eax, 0xffea
pop ebx
add esp, 0x104
ret
push 0xa3
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
je 0x56134b
pop edi
pop esi
pop ebp
mov eax, 0xffe4
pop ebx
add esp, 0x104
ret
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
je 0x56134b
pop edi
pop esi
pop ebp
mov eax, 0xffe2
pop ebx
add esp, 0x104
ret
mov eax, dword [esi*4 + 0x5d210c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x104
ret

Function at 0x5616d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x561707
xor eax, eax
mov ecx, 0x5d210c
cmp dword [ecx], edx
je 0x561709
add ecx, 4
inc eax
cmp ecx, 0x5d2350
jle 0x5616df
cmp edx, 0x20
jb 0x561707
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
cmp ax, 0xffff
je 0x561707
and eax, 0xff
ret
xor eax, eax
ret
Function at 0x57de40
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push ebx
push ebp
push edi
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x10]
push ecx
call fcn.0057dfc0
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0xc], edi
jne 0x57de82
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x9c
ret
mov edx, dword [esp + 0xb0]
mov ebx, dword [esp + 0xac]
push str.winnative
push ebx
mov dword [edi + 0x24], edx
call fcn.00564730
push eax
push str.xpnative
push ebx
call fcn.00564580
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x57dec2
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x9c
ret
mov eax, dword [0x5debe0]
push esi
push 8
call dword [eax + 0x14]
mov esi, eax
push esi
mov dword [esi + 4], edi
mov ecx, dword [esp + 0x1c]
push 0x57e0c0
push ebp
mov dword [esi], ecx
call fcn.00564710
push 0x57e0a0
push esi
push ebx
call fcn.00564520
push esi
push 0x57e180
push str.vsapi
push ebx
call fcn.00564a80
mov eax, dword [esp + 0x54]
add esp, 0x2c
cmp eax, 2
jne 0x57df36
cmp dword [esp + 0x1c], 5
jbe 0x57df36
push ebp
push str.vista
push ebx
call fcn.00564580
add esp, 0xc
test eax, eax
je 0x57df36
push esi
push 0x57e0c0
push eax
call fcn.00564710
add esp, 0xc
mov eax, dword [str.Checkbutton.indicator]
test eax, eax
mov esi, 0x5dc120
je 0x57df7a
jmp 0x57df4a
mov edi, dword [esp + 0x10]
push esi
push edi
call fcn.0057e0f0
mov edx, dword [esi + 4]
mov edi, eax
mov eax, dword [esi]
push edi
push edx
push eax
push ebp
call fcn.00564c90
push 0x57e120
push edi
push ebx
call fcn.00564520
mov eax, dword [esi + 0x20]
add esi, 0x20
add esp, 0x24
test eax, eax
jne 0x57df46
push 0
push 0x5d66f0
push str.Scale.trough
push ebp
call fcn.00564c90
push 0x5dbf80
push ebp
call fcn.0057c730
mov ecx, dword [0x5debe0]
push 0x5a8824
push str.ttk::theme::xpnative
push ebx
call dword [ecx + 0x44c]
add esp, 0x24
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x9c
ret
Function at 0x57dfc0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
mov eax, dword [esp + 0x10]
mov dword [eax], edi
je 0x57e08d
mov ecx, dword [0x5debe0]
push 0x28
call dword [ecx + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
add esp, 4
push str.OpenThemeData
push edi
mov esi, eax
call ebx
test eax, eax
mov dword [esi], eax
je 0x57e080
push str.CloseThemeData
push edi
call ebx
test eax, eax
mov dword [esi + 4], eax
je 0x57e080
push str.GetThemePartSize
push edi
call ebx
test eax, eax
mov dword [esi + 8], eax
je 0x57e080
push str.GetThemeSysSize
push edi
call ebx
test eax, eax
mov dword [esi + 0xc], eax
je 0x57e080
push str.DrawThemeBackground
push edi
call ebx
test eax, eax
mov dword [esi + 0x10], eax
je 0x57e080
push str.GetThemeTextExtent
push edi
call ebx
test eax, eax
mov dword [esi + 0x18], eax
je 0x57e080
push str.DrawThemeText
push edi
call ebx
test eax, eax
mov dword [esi + 0x14], eax
je 0x57e080
push str.IsThemeActive
push edi
call ebx
test eax, eax
mov dword [esi + 0x1c], eax
je 0x57e080
push str.IsAppThemed
push edi
call ebx
test eax, eax
mov dword [esi + 0x20], eax
je 0x57e080
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov edx, dword [0x5debe0]
push esi
call dword [edx + 0x18]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x589381
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x5de070
cmp edx, dword [eax]
je 0x5893a3
add eax, 8
inc ecx
cmp eax, 0x5de100
jl 0x589394
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x5de070]
jne 0x5894d1
mov eax, dword [0x5e056c]
cmp eax, 1
je 0x5894ab
test eax, eax
jne 0x5893d4
cmp dword [0x5dcffc], 1
je 0x5894ab
cmp edx, 0xfc
je 0x5894d1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x58940b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00587390
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00584de0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x58944e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00584de0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x5ac9b0
push edi
call fcn.00584e60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00587390
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.005873a0
lea eax, [ebp - 0xa0]
push 0x5a460c
push eax
call fcn.005873a0
push dword [esi + 0x5de074]
lea eax, [ebp - 0xa0]
push eax
call fcn.005873a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0058ed00
add esp, 0x2c
pop edi
jmp 0x5894d1
lea eax, [ebp + 8]
lea esi, [esi + 0x5de074]
push 0
push eax
push dword [esi]
call fcn.00584de0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401ca4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x401cb3
pop dword [ebp - 0x10]
mov eax, 0x401cb3
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x36149
push 0
mov eax, 0x6c1cbbd3
sub eax, 0x6bdbdafb
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x3b68
xor edi, edi
add edi, eax
mov ebx, 0x6a7bf897
add ebx, 0x95c5432d
add ebx, dword [ebp - 0x10]
mov edx, 0x8a1d13d9
sub edx, 0x69197419
sub dword [ebp - 0xc], 0x47e380c9
mov esi, dword [ebx]
xor dword [ebp - 4], edi
add esi, edx
add dword [ebp - 4], 0x8f2ea1a1
mov dword [edi], esi
add dword [ebp - 4], ebx
add edi, 0xfc1271b7
sub edi, 0xfc1271b3
add ebx, 0xe076ab74
sub ebx, 0xe076ab70
loop 0x401d09
add eax, 0xe073
xor ebx, ebx
add ebx, eax
add eax, 0xc78f3b3e
add eax, 0x3870c4c7
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399
Function at 0x1000b950
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalARM_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b971
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b96d
xor eax, eax
ret

Function at 0x1000b97f
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push str.GlobalAcro_Update_Mutex
push 0
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexW]
test eax, eax
je 0x1000b9a0
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
xor eax, eax
inc eax
ret
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x1000b99c
xor eax, eax
ret

Function at 0x10013da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10013daf
pop dword [ebp - 0x3c]
mov eax, 0x10013daf
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xd2497eea
sub dword [ebp - 0x4c], 0x83f7399f
mov dword [ebp - 0x48], 0x88cb01f0
add dword [ebp - 0x48], 0xa9684a55
mov dword [ebp - 0x44], 0x7677923c
add dword [ebp - 0x44], 0xd5d4b1f2
mov dword [ebp - 0x40], 0x857cd4de
add dword [ebp - 0x40], 0x7a832b22
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x55188010
sub dword [ebp - 0x4c], 0xe0a616ba
mov dword [ebp - 0x48], 0x6ca3ffd4
add dword [ebp - 0x48], 0xd4c861a1
mov dword [ebp - 0x44], 0x5d2b4c0e
add dword [ebp - 0x44], 0x644205e
mov dword [ebp - 0x40], 0xf0329dc9
sub dword [ebp - 0x40], 0xf0329dc9
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x94df454d
sub eax, 0x84dcd3cd
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x43b30
push 0
call eax
mov ecx, 0x5438
xor edi, edi
add edi, eax
mov esi, 0x96814276
sub esi, 0x867daa76
add esi, dword [ebp - 0x3c]
mov ebx, 0xa431d51c
add dword [ebp - 0x14], 0x27fb458b
mov edx, dword [esi]
mov dword [ebp - 0x10], 0x750edab8
xor edx, ebx
sub dword [ebp - 0x38], edx
mov dword [edi], edx
sub dword [ebp - 0xc], ebx
add edi, 0x405b78e6
sub edi, 0x405b78e2
add esi, 4
loop 0x10013ebd
add eax, 0x143b3
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x748976e0
sub ecx, 0x648976e0
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x423440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443c18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x45600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x423593
cmp byte [ebx + 0x3d], 0
je 0x423593
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x423494
xor al, al
jmp 0x423595
push 0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0
push 8
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004225f0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
lea esi, [ebp - 0x28]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x423509
sub eax, 1
je 0x42350d
sub eax, 2
je 0x42355f
xor bl, bl
jmp 0x423561
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x423545
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.0042fd08
add esp, 0x10
cmp esi, eax
jne 0x423505
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp byte [ebx + 0x3d], 0
je 0x42355f
test esi, esi
jne 0x4234d0
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00422820
jmp 0x4234c7
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x42357d
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00423900
mov dword [ebp - 0x14], 0xf
mov al, bl
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jmp 0x423595
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret

Function at 0x433e28
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433aeb

Function at 0x433e33
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433c6c

Function at 0x438a2f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043839d

Function at 0x438a3a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004385d8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x413330
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x413352
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413359
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413348
mov eax, 1
add ebx, ebx
jne 0x41336b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413360
jne 0x41337c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413360
xor ecx, ecx
sub eax, 3
jb 0x413390
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x413402
mov ebp, eax
add ebx, ebx
jne 0x41339b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4133a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4133cc
inc ecx
add ebx, ebx
jne 0x4133b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4133ad
jne 0x4133c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4133ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4133ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4133dd
jmp 0x41334e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4133ec
add edi, ecx
jmp 0x41334e
pop esi
mov edi, esi
mov ecx, 0x211
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41340a
cmp byte [edi], 1
jne 0x41340a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41340f
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x413487
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x130f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41343c
mov ecx, edi
jns 0x41346b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x130f4]
or eax, eax
je 0x413481
mov dword [ebx], eax
add ebx, 4
jmp 0x413459
call dword [esi + 0x13104]
mov ebp, dword [esi + 0x130f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4134bb
sub esp, 0xffffff80
jmp 0x40b9da