joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b817
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c3d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406319
mov dword [ebp - 0x14], eax
cmp dword [0x41e928], esi
jne 0x40b90a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40b897
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b9ea
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40b9ea
push 0x416910
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b9ea
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x41e928], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x41e92c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x41e930], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41e938], eax
test eax, eax
je 0x40b907
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x41e934], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b92f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b922
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40b944
push 4
pop eax
jmp 0x40b9ec
cmp dword [ebp - 0x14], esi
je 0x40b944
push dword [0x41e928]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b929
mov eax, dword [0x41e934]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40b9a2
cmp dword [0x41e938], edi
je 0x40b9a2
push eax
call ebx
push dword [0x41e938]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b9a2
test eax, eax
je 0x40b9a2
call ecx
test eax, eax
je 0x40b997
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b997
test byte [ebp - 8], 1
jne 0x40b9a2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40b9d2
mov eax, dword [0x41e92c]
cmp eax, edi
je 0x40b9cf
push eax
call ebx
test eax, eax
je 0x40b9cf
call eax
mov esi, eax
test esi, esi
je 0x40b9cf
mov eax, dword [0x41e930]
cmp eax, edi
je 0x40b9cf
push eax
call ebx
test eax, eax
je 0x40b9cf
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x41e928]
call ebx
test eax, eax
je 0x40b9ea
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40b9ec
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ecc
mov esp, ebp
pop ebp
ret
Function at 0x1000d156
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x1000d164
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x1000d245
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x5da0cd0]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x5da0cd0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x5da0cd0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x5da0cd0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x5da0cd0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x5da0cd0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x5da0cd0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x5da0cd0]
xor eax, esi
inc edx
dec edi
jne 0x1000d181
pop ebx
cmp dword [ebp + 0x10], 0
je 0x1000d266
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x5da0cd0]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x1000d24b
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1b41431b
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x88b5a04
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401195
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4011b1
xor al, al
leave
ret
mov eax, dword [0x40f0a4]
push ebx
push esi
push edi
mov ecx, 0x40f0a4
call dword [eax + 0xc]
add eax, 0x10
mov edi, 0x104
push edi
lea esi, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.00401762
mov ebx, dword [ebp - 8]
cmp dword [ebx - 8], edi
jge 0x4011e7
push 0x80070057
call fcn.00401000
push edi
push eax
push dword [ebp - 4]
xor ecx, ecx
mov dword [ebx - 0xc], edi
mov word [ebx + 0x208], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40131a
mov edi, ebx
lea esi, [ebp - 4]
call fcn.004016a6
mov eax, dword [ebp - 4]
push dword [eax - 0xc]
call fcn.00401762
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [ebp - 4]
push dword [esi - 8]
push esi
call fcn.004047b5
pop ecx
pop ecx
lea edx, [ebp - 4]
call fcn.00401788
lea eax, [esi - 0x10]
mov dword [ebp - 4], eax
call fcn.00401897
add eax, 0x10
lea edi, [eax - 0x10]
lea esi, [ebx - 0x10]
cmp edi, esi
je 0x401283
cmp dword [esi + 0xc], 0
jl 0x401274
mov ecx, dword [edi]
cmp ecx, dword [esi]
jne 0x401274
mov eax, edi
call fcn.00401897
mov ebx, eax
mov eax, esi
call fcn.004010b5
add ebx, 0x10
mov dword [ebp - 8], ebx
jmp 0x401283
mov ebx, dword [eax - 0xc]
push eax
lea eax, [ebp - 8]
call fcn.00401821
mov ebx, dword [ebp - 8]
mov eax, edi
call fcn.004010b5
xor eax, eax
push 0x206
mov word [ebp - 0x224], ax
xor esi, esi
lea eax, [ebp - 0x222]
push esi
push eax
call fcn.00404ae0
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push 0x26
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x401312
lea edi, [ebp - 0x224]
lea esi, [ebp - 0x10]
call fcn.004016a6
or dword [ebp - 0x14], 0xffffffff
mov eax, esi
push 0x104
mov dword [ebp - 0x1c], eax
call fcn.00401762
push 0x412c48
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
neg eax
sbb al, al
inc al
lea ecx, [ebp - 0x1c]
mov byte [ebp - 9], al
call fcn.0040173d
cmp byte [ebp - 9], 0
je 0x401326
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004010b5
mov eax, dword [ebp - 4]
call fcn.004010b5
lea eax, [ebx - 0x10]
call fcn.004010b5
xor al, al
jmp 0x40137a
lea eax, [ebp - 0x10]
call fcn.00401703
lea eax, [ebp - 8]
call fcn.00401703
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
test ebx, ebx
je 0x40134f
cmp dword [edi - 0xc], 0
jl 0x40134f
call fcn.00401aa1
test eax, eax
jne 0x401354
or esi, 0xffffffff
jmp 0x40135a
sub eax, edi
sar eax, 1
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004010b5
mov eax, dword [ebp - 4]
call fcn.004010b5
lea eax, [edi - 0x10]
call fcn.004010b5
test esi, esi
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
xor eax, eax
cmp byte [ebp + 8], bl
push 0x20019
setne al
push ebx
push 0x412c70
mov dword [ebp - 4], ebx
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x401411
jle 0x40146f
and eax, 0xffff
or eax, 0x80070000
jmp 0x40146f
or dword [ebp - 0xc], 0xffffffff
push 0x32
pop eax
push eax
mov dword [ebp + 8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], esi
call fcn.00401762
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
push eax
push ebx
push 0x412bb0
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.0040173d
cmp esi, ebx
je 0x401462
jle 0x40145e
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
jmp 0x40146f
mov eax, dword [ebp + 8]
dec eax
neg eax
sbb eax, eax
and eax, 0x8000ffff
pop esi
pop ebx
leave
ret

Function at 0x4015d8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call fcn.00401195
mov byte [ebp - 8], al
mov eax, dword [0x40f0a4]
mov ecx, 0x40f0a4
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00401473
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x401623
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004010b5
mov eax, esi
pop esi
leave
ret 0x10
push ebx
push dword [ebp - 8]
mov ebx, dword [ebp - 4]
push ebx
call fcn.0040137f
pop ecx
pop ecx
test eax, eax
jge 0x401645
mov esi, eax
lea eax, [ebx - 0x10]
call fcn.004010b5
mov eax, esi
pop ebx
jmp 0x40161e
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40165d
call fcn.004010cd
jmp 0x401636
push edi
push 0x412ba4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401680
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call edi
mov edi, eax
jmp 0x401685
mov edi, 0x80004005
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, edi
pop edi
jmp 0x401638

Function at 0x405ada
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e2d0]
jne 0x405ae4
repz ret
jmp fcn.004088c8
Function at 0x44a420
Capabilities:
Encode data using xor

Disassembly:
push ds
push esi
fidivr dword [esi + 0x1b]
push cs
lea edx, [eax + 0x41]
add byte [ebp + 0x63029d6d], 0xdf
popal
add al, 0x7e
popfd
sbb edx, dword [ecx - 0x3a]
ror byte [ecx + 0x51afb4cc], 0x95
add ch, byte [edi + 0x61cd8365]
call 0x9da229c9
add dh, byte [ebx - 0x21]
popal
cmp al, 0x9f
daa
or dl, bl
and dword [edi], 0x75
mov eax, dword [0xfc51cd]
adc eax, ebx
invalid

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x100134a2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x769c
push 0x7e86
lea eax, [ebp - 0x10]
push eax
push 0x28d7
lea eax, [ebp + 8]
push eax
push 1
push 0x4cbd
push 0x6509
call fcn.1001317e
add esp, 0x20
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100134eb
xor eax, eax
jmp 0x10013632
push 1
push 0x6d1
push 0x2677
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x569
call fcn.100132b3
add esp, 0x1c
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10013522
xor eax, eax
jmp 0x10013632
push 1
push 0x321c
lea eax, [ebp - 8]
push eax
push 0x24b2
lea eax, [ebp - 0xc]
push eax
call fcn.10013339
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x1001354b
xor eax, eax
jmp 0x10013632
push 0x6475
push dword [ebp - 0x10]
push 0x6a5e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x29b0
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
push 1
call fcn.10012f9f
add esp, 0x24
push 0x7d7f
push 0
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.100121cd
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x100135b8
push 0x28f7
push 0x4763
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 1
call fcn.100133c7
add esp, 0x14
push dword [ebp - 4]
call fcn.10012028
pop ecx
test eax, eax
jne 0x100135c9
xor eax, eax
jmp 0x10013632
push 0
push dword [ebp - 4]
call fcn.1000e417
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1001361a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x100135f4
xor eax, eax
jmp 0x10013632
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1001360d
xor eax, eax
jmp 0x10013632
push 1
lea eax, [ebp - 4]
push eax
call fcn.1001345c
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1001362b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1001362f
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10042f6f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
mov edi, ecx
cmp dword [edi], 0
je 0x100430df
push ebx
push esi
push dword [edi]
xor ebx, ebx
push ebx
push dword [edi + 4]
call fcn.1001edf9
add esp, 0xc
mov dword [ebp - 0xc], 0x25d1
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x24]
push 3
call fcn.1000a48a
mov dword [ebp - 8], ebx
jmp 0x10042fc0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov dword [eax + ecx*4], 5
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10042fb0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
jmp 0x10042ffd
mov dword [ebp - 8], ebx
jmp 0x10042ff4
mov ecx, dword [ebp - 8]
xor edx, edx
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
cmp dword [eax + ecx*4], 0xcb61d225
setne dl
mov dword [eax + esi*4], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x10042fd9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xe
jne 0x10042fd4
lea ecx, [ebp - 0x24]
call fcn.1000a4e6
push dword [edi + 4]
call fcn.10060b8d
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
pop ecx
xor ecx, ecx
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
inc ecx
mov byte [ebp - 1], bl
sub ecx, eax
je 0x10043041
cmp byte [ebp - 1], bl
je 0x10043055
push ebx
push 0xb81
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10043055
cmp byte [ebp - 1], bl
je 0x10043055
push ebx
push 0x158c
call esi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 1
lea ecx, [ebp - 0x18]
mov dword [edi + 4], ebx
call fcn.1000a48a
mov dword [ebp - 0xc], ebx
jmp 0x10043077
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x10043067
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [eax], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 1], cl
cmp byte [ebp - 1], 0
je 0x100430a6
push 0x188c
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
inc dword [eax]
cmp dword [eax], 0x12
jl 0x1004308a
mov byte [ebp - 1], cl
cmp byte [ebp - 1], 0
je 0x100430d2
push ecx
push 0xea4
push ecx
push 0x2608
push ecx
call esi
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
lea ecx, [ebp - 0x18]
call fcn.1000a4e6
and dword [edi], 0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1006e453
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10080330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006577c
mov dword [ebp - 0x14], eax
cmp dword [0x1117d34c], esi
jne 0x1006e546
push 0x800
push esi
push 0x10005ffc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006e4d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006e626
push esi
push esi
push 0x10005ffc
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006e626
push 0x10006014
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006e626
push eax
call ebx
push 0x10006020
push edi
mov dword [0x1117d34c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006030
push edi
mov dword [0x1117d350], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006044
push edi
mov dword [0x1117d354], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1117d35c], eax
test eax, eax
je 0x1006e543
push 0x10006060
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1117d358], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006e56b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006e55e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006e580
push 4
pop eax
jmp 0x1006e628
cmp dword [ebp - 0x14], esi
je 0x1006e580
push dword [0x1117d34c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006e565
mov eax, dword [0x1117d358]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006e5de
cmp dword [0x1117d35c], edi
je 0x1006e5de
push eax
call ebx
push dword [0x1117d35c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006e5de
test eax, eax
je 0x1006e5de
call ecx
test eax, eax
je 0x1006e5d3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006e5d3
test byte [ebp - 8], 1
jne 0x1006e5de
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006e60e
mov eax, dword [0x1117d350]
cmp eax, edi
je 0x1006e60b
push eax
call ebx
test eax, eax
je 0x1006e60b
call eax
mov esi, eax
test esi, esi
je 0x1006e60b
mov eax, dword [0x1117d354]
cmp eax, edi
je 0x1006e60b
push eax
call ebx
test eax, eax
je 0x1006e60b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1117d34c]
call ebx
test eax, eax
je 0x1006e626
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006e628
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x408510
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x43120c], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408551
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x40852e
mov dword [edx*4 + 0x431208], eax
inc edx
cmp edx, 0x100
jne 0x408527
mov eax, dword [ebp + 8]
not eax
jmp 0x40856b
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x431208]
test ebx, ebx
jne 0x408558
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0xdce8c8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdce8d2
pushal
call 0xdce8d8
pop ebp
sub ebp, 0x10
sub ebp, 0x9ce8c8
jmp 0xdce8ee
mov eax, 0x9ce8c8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0xca02be8d
xor byte [eax], dl
inc eax
dec ecx
jne 0xdce905
jmp 0xdce918
push es
inc eax
push es
add al, 0xb1
lea ecx, [ebp + 0x754c0c8d]
lea ecx, [ebp + 0x35408e8d]
mov dword [ebp - 0x5ac87273], ecx
lea ecx, [ebp - 0x71908573]
inc ebp
push es
or al, 0x81
lea ecx, [ebp - 0x22b77173]
fucom st(5)
xchg ecx, eax
imul ebp, dword [ebp + ecx*4 - 0x970de1b], 0xffffff8d
mov word [ecx + 0x20b0e5a9], fs
invalid
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ed0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5c215021
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x18d0d88
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219