joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d29e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407cfb
mov dword [ebp - 0x14], eax
cmp dword [0x813d78], esi
jne 0x40d391
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d31e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d471
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d471
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d471
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813d78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813d7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813d80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813d88], eax
test eax, eax
je 0x40d38e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813d84], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d3b6
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d3a9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push 4
pop eax
jmp 0x40d473
cmp dword [ebp - 0x14], esi
je 0x40d3cb
push dword [0x813d78]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d3b0
mov eax, dword [0x813d84]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d429
cmp dword [0x813d88], edi
je 0x40d429
push eax
call ebx
push dword [0x813d88]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d429
test eax, eax
je 0x40d429
call ecx
test eax, eax
je 0x40d41e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d41e
test byte [ebp - 8], 1
jne 0x40d429
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d459
mov eax, dword [0x813d7c]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
call eax
mov esi, eax
test esi, esi
je 0x40d456
mov eax, dword [0x813d80]
cmp eax, edi
je 0x40d456
push eax
call ebx
test eax, eax
je 0x40d456
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813d78]
call ebx
test eax, eax
je 0x40d471
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d473
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040440e
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401d5b
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x401dc0
call fcn.00401a06
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x401db0
cmp eax, 0xffffffff
je 0x401db0
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x401da9
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x401da9
cmp edx, 0x10000000
jae 0x401da9
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00401ddc
ret 4

Function at 0x402054
Capabilities:
Persist via active setup registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x406150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
lea edi, [ebp - 0xbc]
xor eax, eax
mov ecx, 0x2e
mov esi, 0x402168
rep movsd dword es:[edi], dword [esi]
mov word [ebx], ax
xor esi, esi
lea eax, [ebp - 0xc0]
push eax
push 0x101
push esi
lea eax, [ebp - 0xbc]
push eax
push 0x80000002
call dword [0x407110]
test eax, eax
jne 0x40214c
push 0x208
push eax
push ebx
mov dword [ebp - 0xc4], 0x208
mov dword [ebp - 0xc8], esi
call fcn.004023a9
add esp, 0xc
lea eax, [ebp - 0xc4]
push eax
push ebx
lea eax, [ebp - 0xc8]
push eax
push esi
push 0x402220
push dword [ebp - 0xc0]
call dword [0x40711c]
test eax, eax
jne 0x402140
mov eax, dword [ebp - 0xc8]
cmp eax, 1
jne 0x40215f
mov eax, dword [ebp - 0xc4]
xor ecx, ecx
shr eax, 1
mov word [ebx + eax*2 - 2], cx
lea eax, [ebp - 0xcc]
push eax
push ebx
mov dword [ebp - 0xcc], ecx
call dword [0x408024]
mov edi, eax
test edi, edi
je 0x402140
push dword [edi]
mov edx, 0x104
mov ecx, ebx
call fcn.004023df
push edi
call dword [0x4070e4]
mov esi, 1
push dword [ebp - 0xc0]
call dword [0x40712c]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004010e0
mov esp, ebp
pop ebp
ret
cmp eax, 2
jne 0x402140
jmp 0x4020fd

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41eca0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x41ecc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41ecc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41ecb8
mov eax, 1
add ebx, ebx
jne 0x41ecdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41ecd0
jne 0x41ecec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ecd0
xor ecx, ecx
sub eax, 3
jb 0x41ed00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ed72
mov ebp, eax
add ebx, ebx
jne 0x41ed0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41ed18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41ed3c
inc ecx
add ebx, ebx
jne 0x41ed28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41ed1d
jne 0x41ed39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41ed1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ed5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41ed4d
jmp 0x41ecbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ed5c
add edi, ecx
jmp 0x41ecbe
pop esi
mov edi, esi
mov ecx, 0x342
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ed7a
cmp byte [edi], 7
jne 0x41ed7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ed7f
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x41edf7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e7f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e8e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41edac
mov ecx, edi
jns 0x41eddb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e8e4]
or eax, eax
je 0x41edf1
mov dword [ebx], eax
add ebx, 4
jmp 0x41edc9
call dword [esi + 0x1e8f4]
mov ebp, dword [esi + 0x1e8e8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41ee2b
sub esp, 0xffffff80
jmp 0x406f41
Function at 0x401d50
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x4060e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
call fcn.00401eb0
mov edi, eax
add esp, 4
test edi, edi
je 0x401e75
lea eax, [ebp - 0x50c]
mov dword [ebp - 0x50c], 0
push eax
push 0x400
lea eax, [ebp - 0x508]
push eax
push edi
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
jne 0x401dcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Cant_get_process_modules._ErrorCode:__u_n
call fcn.00402af0
add esp, 8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp - 0x50c]
push esi
shr ebx, 2
xor esi, esi
test ebx, ebx
je 0x401e41
nop
push 0x104
lea eax, [ebp - 0x108]
push eax
push dword [ebp + esi*4 - 0x508]
push edi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x401e3c
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x108]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401e33
test dl, dl
je 0x401e2f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401e33
add ecx, 2
add eax, 2
test dl, dl
jne 0x401e13
xor eax, eax
jmp 0x401e38
sbb eax, eax
or eax, 1
test eax, eax
je 0x401e5b
inc esi
cmp esi, ebx
jb 0x401de0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
push str.Process_cant_be_opened.
call fcn.00402af0
push str.So_assume_that_there_is_no_injection._n
call fcn.00402af0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
pop edi
call fcn.004030b3
mov esp, ebp
pop ebp
ret
Function at 0x402920
Capabilities:
Execute command
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4060e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push str.Whiff__32_bit_
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push str.https:__github.com_Zedron_Whiff_n
call fcn.00402af0
push 0x4042dc
call fcn.00402af0
push 0x404314
call fcn.00402af0
push str._________________________________________n
call fcn.00402af0
push str._____________________________________________n
call fcn.00402af0
push 0x4043bc
call fcn.00402af0
push str.__________________________________________n
call fcn.00402af0
push str.______________________________________________________n
call fcn.00402af0
push str.Type_quit_or_CTRL_C_to_detach_the_sniffer_n_n
call fcn.00402af0
add esp, 0x24
cmp dword [ebp + 8], 2
jle 0x4029d8
push str.ERROR:_Invalid_parameters.
call fcn.00402af0
push str.Example:__Whiff.exe__wow_exe_name___n_n
call fcn.00402af0
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
jne 0x4029df
mov eax, dword [esi + 4]
jmp 0x4029e1
xor eax, eax
push edi
push eax
call fcn.00402010
mov edi, eax
add esp, 4
test edi, edi
je 0x402ad1
push ebx
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, eax
test ebx, ebx
jne 0x402a65
push str.ERROR:_Cant_get_the_injectors_path_
call fcn.00402af0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ErrorCode:__u_n_n
call fcn.00402af0
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 0xc
xor eax, eax
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
push 0x104
call fcn.00402e54
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
push 0x104
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
add esp, 0x14
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.Whiff.dll
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push esi
push str.DLL:__s_n
call fcn.00402af0
push esi
push edi
call fcn.00401ad0
test al, al
mov edx, str._nInjection_of__s_is_NOT_successful._n_n
mov ecx, str._nInjection_of__s_is_successful._n_n
cmove ecx, edx
push str.Whiff.dll
push ecx
call fcn.00402af0
push esi
call fcn.00402e5d
add esp, 0x1c
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.004030b3
mov esp, ebp
pop ebp
ret
Function at 0x402b50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4060e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x104
test eax, eax
jne 0x402b80
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x402b8f
lea ecx, [ebp - 0x108]
push ecx
push 0
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
jne 0x402bb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Cant_get_path_of_the_process_exe__ErrorCode:__u_n
call fcn.00402af0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x108]
push eax
push str.ExePath:__s_n
call fcn.00402af0
add esp, 8
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x402c12
push str.ERROR:_Cant_get_size_of_the_file_version_info_
call fcn.00402af0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ErrorCode:__u_n
call fcn.00402af0
add esp, 8
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
push edi
push esi
call fcn.00402e54
add esp, 4
mov edi, eax
lea eax, [ebp - 0x108]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x402c5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Cant_get_file_version_info__ErrorCode:__u_n
call fcn.00402af0
push edi
call fcn.00402e5d
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0
push eax
push 0x404b5c
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x402ca5
push str.ERROR:_File_version_info_query_is_failed._n
call fcn.00402af0
push edi
call fcn.00402e5d
add esp, 8
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004030b3
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10c]
push edi
movzx esi, word [eax + 0xc]
call fcn.00402e5d
mov ecx, dword [ebp - 4]
add esp, 4
mov ax, si
xor ecx, ebp
pop edi
pop esi
call fcn.004030b3
mov esp, ebp
pop ebp
ret
Function at 0x40ce48
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004078db
mov dword [ebp - 0x14], eax
cmp dword [0x4371d8], esi
jne 0x40cf3b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40cec8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d01b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d01b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d01b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4371d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4371dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4371e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4371e8], eax
test eax, eax
je 0x40cf38
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4371e4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cf60
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cf53
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cf75
push 4
pop eax
jmp 0x40d01d
cmp dword [ebp - 0x14], esi
je 0x40cf75
push dword [0x4371d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40cf5a
mov eax, dword [0x4371e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cfd3
cmp dword [0x4371e8], edi
je 0x40cfd3
push eax
call ebx
push dword [0x4371e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cfd3
test eax, eax
je 0x40cfd3
call ecx
test eax, eax
je 0x40cfc8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cfc8
test byte [ebp - 8], 1
jne 0x40cfd3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d003
mov eax, dword [0x4371dc]
cmp eax, edi
je 0x40d000
push eax
call ebx
test eax, eax
je 0x40d000
call eax
mov esi, eax
test esi, esi
je 0x40d000
mov eax, dword [0x4371e0]
cmp eax, edi
je 0x40d000
push eax
call ebx
test eax, eax
je 0x40d000
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4371d8]
call ebx
test eax, eax
je 0x40d01b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d01d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004041ee
mov esp, ebp
pop ebp
ret
Function at 0x51bc60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd9000]
push edi
jmp 0x51bc7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51bc81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bc70
mov eax, 1
add ebx, ebx
jne 0x51bc93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51bca4
jne 0x51bcc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bcc3
dec eax
add ebx, ebx
jne 0x51bcb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51bc88
add ebx, ebx
jne 0x51bcbf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51bd15
xor ecx, ecx
sub eax, 3
jb 0x51bcdb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51bd4a
sar eax, 1
mov ebp, eax
jmp 0x51bce6
add ebx, ebx
jne 0x51bce6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bcb4
inc ecx
add ebx, ebx
jne 0x51bcf4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51bcb4
add ebx, ebx
jne 0x51bd01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51bcf6
jne 0x51bd12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51bcf6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51bd34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51bd26
jmp 0x51bc76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51bd34
add edi, ecx
jmp 0x51bc76
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51bd52
cmp byte [edi], 0x11
jne 0x51bd52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51bd57
lea edi, [esi + 0x117000]
mov eax, dword [edi]
or eax, eax
je 0x51bdcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x185638]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18578c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51bd84
mov ecx, edi
jns 0x51bdb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x185790]
or eax, eax
je 0x51bdc9
mov dword [ebx], eax
add ebx, 4
jmp 0x51bda1
call dword [esi + 0x1857a0]
mov ebp, dword [esi + 0x185794]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51be03
sub esp, 0xffffff80
jmp 0x416310