joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd7c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd7c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
invalid
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x657560
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x47d05e
Capabilities:
Check for software breakpoints

Disassembly:
invalid
in eax, 0x2f
daa
ror edx, 1
pop esp
pop esp
pop es
adc al, 0xb7
dec ebp
cdq
mov ebp, 0x342459a9
adc dword [eax], esi
or dword [esi + 0x20], edx
and dword [eax - 0x5f], eax
outsb dx, byte [esi]
jb 0x47d012
pop ebp
add eax, 0x9d55d85b
pop ebx
fcom dword [ebp - 0x63]
les eax, [edi]
pushal
add al, 0x82
jbe 0x47d017
ja 0x47cff9
cmp al, 0xcc
jno 0x47cfb4
cmpsd dword [esi], dword es:[edi]
and byte [edx + 0x65afaf3f], dl
pop eax
push esp
in ax, 0x2b
pop esp
retf
pop edi
cli
js 0x47d0ac
jl 0x47d005
sbb eax, 0xaf3be20
pop esi
fsub dword [esi + eax*4 + 0x5a9822c0]
jmp fcn.0047d05e
int 5
mov edx, dword [eax]
mov dh, 0x74
scasb al, byte es:[edi]
test al, 0xc4
dec ecx
jbe 0x47d0c5
mov byte [ecx + esi*2 - 0x1c], ch
fmul qword [ebx]
mov edx, 0xf126abf6
and al, 0xb8
cmc
lodsd eax, dword [esi]
cmp eax, 0xdc2f30df
ljmp 0xe95a
mov eax, 0xdf3dadf5
xor byte [edi], ch
fsub st(2), st(0)
test byte [edx], dh
lea ebx, [edx + ebx*2 - 0x17]
sbb eax, 0x5f20d7ca
aas
cmp al, 0xcb
lahf
add edi, dword [edx + 0x1a]
push ds
xor eax, 0x8932f8
sbb dl, byte [edi + ebp + 0x22]
mov dl, 0xb8
push ds
dec edx
and cl, byte [edi]
stosb byte es:[edi], al

Function at 0x4859d1
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax + 9], dh
jle 0x485a1a
push edi
imul esp, dword [ecx + 0x7f], 0xffffffec
pop es
test byte [esi - 0x41155311], bl
movsb byte es:[edi], byte [esi]
xor dword [ebx + ebx*8], ebx
xchg ebp, eax
sub dword [esi], eax
stosb byte es:[edi], al
jns 0x4859dc
dec edx
xor eax, 0xdcacbe0a
push ss
cli
invalid
cmp ch, byte [edx + 6]
sbb byte [ebx + 0x25], 0xe9
or ah, ah
cmpsd dword [esi], dword es:[edi]
invalid

Function at 0x4aa983
Capabilities:
Encode data using xor

Disassembly:
nop
inc esi
invalid
xor cl, bl
add dh, cl
push eax
adc esi, dword [ebx - 0x47]
add byte [ebx - 0x11], 0xd1
jno 0x4aa930
mov dh, dl
push 0xb417dfa2
inc edx
mov ecx, 0xf7c7c195
cdq
add byte [eax], 0x18
test al, 0x18
inc esi
and dword [0x2d49504f], 0xb449eff5
add dword [ecx + edx*8], esi
xchg edx, eax
jno 0x4aaa29
sal dword [ebp - 0x5a], 0x89
mov edx, dword [esi - 0x50]
mov bh, 0x93
mov bh, 0xf6
xchg dword [edx - 0x22], eax
lcall 0x5eab, 0x5a2240b2
xor dword [eax + edx*4 - 0x58], esi
and al, 0x74
fdecstp
lodsd eax, dword [esi]
ja 0x4aaa00
pop ds
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
lfs edx, [edi - 0x201f723c]
and dword [eax + 0x4b], ecx
push esp
invalid
sbb ch, byte fs:[ecx + 0x7a42f73c]
hlt
clc
and al, 0xb7
ret
Function at 0x4d0084
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
add dl, byte [ecx - 0x756fe51f]
sbb byte [edx], ah
dec edx
mov byte [0x1785114c], al
int 0xf4
sub ebx, dword [ecx + edi*8]
les edx, [edx - 0x7f7bad42]
push ss
push ecx
cmc
lahf
mov bh, 0xa0
loope 0x4d0078
into
jo 0x4d0087
je 0x4d00f2
insd dword es:[edi], dx
xor ah, byte [esi]
mov cs, word [edx]
mov edi, 0xe06bf617
mov ah, 0x4e
mov ecx, dword [ebx + 0x1ef06e76]
movsd dword es:[edi], dword [esi]
mov dh, 0x87
arpl word [ecx - 0x90fdc40], sp
sbb byte [esi + 0x3f7277ff], cl
pop ebp
jb 0x4d00da
pop esp
mov edi, 0xc6313974
xchg ecx, eax
or ah, byte [edx]
in al, dx
and bh, byte [edx + 0x58]
jnp 0x4d00d4
sbb bl, byte [0x77788b6b]
sbb eax, 0x77788b6b
jl 0x4d005d
call [ecx + eax - 0x5c]
and esi, ecx
mov esi, 0x75162333
push edi
mov ebp, edx
in al, 0x5f
invalid
jecxz 0x4d00ec
dec esp
dec edi
je 0x4d00b9
imul ecx, dword [edi + 0x40b76924], 0x26
xor byte [edx], 0xd8
fsub qword [esi + 0x45331b7a]
daa
pop esi
inc edx
push esi
enter 0xffffffffffffd665, 0xffffffffffffff81
adc eax, 0xde935290
in al, 2
dec esp
inc esi
jne 0x4d0136
mov bh, byte [eax]
out 0xb6, al
dec esi
push ss
pop es
cmpsd dword [esi], dword es:[edi]
cmp ecx, edx
add byte [ebp + 0x2e], al
push edi
in al, dx
call [edx]
xchg ecx, eax
ret 0xd35e
adc eax, 0xc4d48c25
push ss
dec edi
jns 0x4d0180
pop edx
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
adc esi, esi
xchg edx, eax
ja 0x4d0159
adc al, 0x50
jmp 0x479a6895
popfd
xlatb
jle 0x4d0183
in al, dx
push es
sbb byte [ebx + 0x5d], dl
dec ecx
int1
mov ebx, dword [0xb6b83072]
enter 0x7793, 0xffffffffffffff90
inc ecx
push ebx
fistp qword [esi - 0x7b5f6fca]
ror dword [ecx], cl
pop ss
and al, 0xdc
push edi
cmpsd dword [esi], dword es:[edi]
xor esi, dword [eax + 0x4766485a]
dec eax
inc di
inc edi
xchg byte [bp + si], ch
xchg ecx, eax
and byte [eax + eax + 0x12], bl
dec edx
popal
cld
pop ecx
mov al, dl
mov bl, 0xb6
ror dword [edi + ebp], 0x91
idiv bh
cwde
xor dword [ebx + 0x216972fa], ebp
lahf
push esi
sal dword [ecx], 1
and dh, byte [edx]
loop 0x4d0142
salc
invalid
Function at 0x5521f3
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx - 0xa6965b1], 0xd273e071
lcall 0xd273, 0xe071f596
inc eax
cmc
jl 0x5521f6
push es
inc ecx
jno 0x5521fd
outsd dx, dword [si]
jge 0x55221a
dec edx
jbe 0x552282
cmp ebp, dword [eax]
fbld tbyte [edx + 0x4adcb5ea]
pop esp
or dword [edx], 0xffffffe4
mov byte [eax - 0x422055cd], ch
mov ah, 0xd5
or dh, byte [edx - 0x72]
jne 0x552293
test al, 0x33
stosb byte es:[edi], al
fistp qword [ebp + 0x720ad5b4]
invalid
sub bl, byte [ebp - 0x4c47a02a]
rcl bl, 0x50
push ds
aad 0x5e
fidivr word [eax - 0x3cc622bb]
mov cl, 0x82
test byte [esi - 0x4c], bl
jmp 0x4f6aa554
push eax
fdiv qword [esi + esi*2]
mov ch, 0xee
push 0x37cf19bc
adc al, 0x34
sbb bh, bh
cmp eax, 0x84c1c5a8
int 0xf2
add al, 0xa1
mov bh, 0xac
push ss
scasd eax, dword es:[edi]
mov dh, 0xfd
mov edi, 0x641cfb7d
test al, 0xfe
pop ds
fld xword [eax]
movsb byte es:[edi], byte [esi]
jg 0x552324
invalid
cmp al, 0x15
xchg edx, eax
xchg esp, eax
pop esi
add bl, ah
xchg edi, eax
add edi, dword [ebp - 0x3d19bc51]
lodsb al, byte [esi]
pop ecx
lodsb al, byte [esi]
dec edx
push cs
xor eax, 0x8266c35f
jle 0x5522b2
pushal
out 2, eax
or al, 0xba
lodsd eax, dword [esi]
aas
or dword [eax + 0x7f], ebx
mov eax, dword [0x2666f4c4]
dec edx
stc
loope 0x5522fc
int1
invalid
pop edi
invalid
mov edi, 0xe7c9c002
mov cl, 0x55
fdivp st(0)
push 0xe63e19b5
fdivrp st(0)
mov edi, 0xd59b0b8a
jo 0x5522fb
mov cl, 0xee
retf 0x1993

Function at 0x565b11
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
dec esi
fadd qword [esi]
lodsd eax, dword [esi]
stc
dec esp
in eax, 0xcc
mov ch, 0x17
xor dword [0xf8012c24], esp
and al, 0x59
dec esi
pushfd
fiadd word [eax]
invalid
Function at 0x63d7c2
Capabilities:
Encode data using xor

Disassembly:
sbb edi, eax
xchg esp, eax
cmp byte [esi], dl
cdq
or dl, byte [edi + eax*8]
pop edx
jle 0x63d74a
cdq
out 0x46, eax
ja 0x63d7a9
cmp ah, dl
mov ebp, 0xa9cbbbb2
jo 0x63d7b0
cwde
pop es
stosd dword es:[edi], eax
vpaddq ymm3, ymm0, ymmword [esi]
cmpsb byte [esi], byte es:[edi]
sar eax, 0x78
test al, 0xbc
cwde
test al, 5
add byte [ebx + 0x55], bh
jge 0x63d817
add eax, 0x7d557b00
push 0xa7bb6413
adc esp, dword [ebx + edi*4 - 0x59]
mov ebx, 0x4e0527a7
inc esi
push es
dec edx
daa
add eax, 0x4a06464e
xlatb
and dword [esi - 0x12], ebp
dec edx
out 0xf3, al
xchg ebx, eax
invalid
and al, 0x37
xor al, 0x2c
xor ebp, edi
xlatb
mov bh, 0xa2
push ebx
je 0x63d77f
push 0x45
enter 0x2899, 0x43
inc esp
cli
dec eax
xchg edi, eax
dec eax
les esi, [edx]
hlt
jle 0x63d7d4
aaa
xchg edi, eax
call 0xda0820b2
adc eax, eax
std
loop 0x63d83c
sub ebp, ecx
xlatb
out dx, al
xor al, 0xed
out dx, al
sub ecx, ebx
push esp
add dword [edi + 0x4b], edi
jb 0x63d83f
xchg esp, eax
cmpsb byte [esi], byte es:[edi]
push esp
xchg dword [ebx], ebp
mov dl, 0x42
mov eax, 0x353ca048
sub esp, edi
mov al, byte [0xfc29353c]
cmpsd dword [esi], dword es:[edi]
test eax, 0x5714d5cc
or byte [esi - 0x1a], bl
loope 0x63d7ee
invalid
fistp dword ss:[0x3b72537]
fstp qword [ebx]
aaa
and eax, 0x1bdd03b7
push edi
push 0x49951857
mov al, byte fs:[ebp - 0xc]
pushfd
les esp, [ebx - 0x474b69b3]
mov word [ebx - 0x8f7834f], ds
push cs
in eax, 0xf8
sbb byte [ecx + ebp*2], al
xor dword fs:[ecx - 0x6b7e270c], ebp
out 0x88, al
outsd dx, dword [esi]
invalid
Function at 0x63ec78
Capabilities:
Encode data using xor

Disassembly:
enter 0xfffffffffffff89a, 0x5d
popal
pop ecx
out 0x4e, eax
add dword [ebp + 0x77], ebp
mov ss, word fs:[ebx - 0x4682277b]
leave
movsb byte es:[edi], byte [esi]
pop ss
fsub st(6), st(0)
enter 0xffffffffffffb8f6, 0xfffffffffffffff6
imul eax, dword [eax], 0x14
xor ecx, dword [eax]
push ds
xchg esp, eax
invalid
scasb al, byte es:[edi]
js 0x63eccd
inc esi
mov dword [ebp - 0x6bab2a6e], ebp
salc
stc
jae 0x63ec23
inc ebp
mov bh, 9
mov eax, dword [0x6d21141d]
mov esp, 0x29894833
mov al, 0x68
test dword [edx - 0x40b3f7be], ebx
out 0xf8, eax
mov ebx, 0x2836c166
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
aaa
cmp al, byte [esi - 0x3f]
xor esi, dword [esi + 0x7fc60848]
push ebp
dec edx
rcr byte [ecx - 0x3c], 0x20
push edi
sahf
cmc
mov ecx, 0xb07c8b99
sbb al, 0xf8
cdq
mov edi, dword [eax + esi*4 + 0x1c]
clc
add al, 0xe9
jno 0x63ec60
jne 0x63eca6
out 0x6c, eax
ror dword [eax], 0x74
invalid
push 0x2f
inc ecx
push edi
mov esp, 0x5ab9f09b
mov dl, 0x4b
cld
mov edx, 0xeaaea837
wait
rol byte [edi + 0x4c], 1
push esp
fnstsw word [edi + 0x1cab9ccf]
cmp al, bh
cmp dword [ebx], edi
xchg al, ch
push ebp
jnp 0x63ec51
into
test ebp, 0xa7926bce
jo 0x63ed04
int 0xce
imul edx, dword [edx + 0x713070a7], 0xffffffbd
jno 0x63ec93
stosd dword es:[edi], eax
invalid
xchg ch, dh
mov esi, 0x9a7dd4f3
aad 0xce
pop ecx
push ss
and eax, 0x5ac65954
and al, 0xb5
sub al, 0xf5
dec ecx
cmp dword [0x3901e816], 0x6edb6be2
cli
lds eax, [eax]
aad 0x81
fnstenv [ebx + 0x17]
cwde
arpl word fs:[eax - 0x38f26538], bx
ror dword [ebx], 0x13
aas
cmpsb byte [esi], byte es:[edi]
aad 0x9e
xlatb
mov ecx, 0x677ee68f
out 0x9d, al
imul ecx, esi, 0x51
cmpsb byte [esi], byte es:[edi]
cmp dword [ecx + 0x1b], ebx
inc ebp
or al, 0xc9
cmp al, 0x41
inc ebp
fld qword [esi - 0x13]
mov eax, 0x8f97a6f5
xchg esi, eax
pop ds
mov esp, 0x3fdabbea
adc dword [ebx + ebx + 0x53], 0x56fb5019
push eax
invalid

Function at 0x645ac6
Capabilities:
Encode data using xor

Disassembly:
cdq
stosb byte es:[edi], al
mov edx, 0x465466df
invalid
pop ebp
fld qword [edi + 0x39]
pop ss
mov dh, dh
xchg byte [edx + ebx*2], dh
inc ecx
je 0x645a55
pop esi
inc ebx
pop eax
das
jbe 0x645a90
js 0x645a6b
hlt
Function at 0x5cb18a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 0x78
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x20]
test eax, eax
jne 0x5cb1d0
mov eax, 0
jmp 0x5cb263
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x20]
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x24]
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [eax + 0x1c]
mov eax, dword [ebp - 0x24]
add eax, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
cmp dword [ebp - 4], eax
jae 0x5cb25e
mov eax, dword [ebp - 4]
lea edx, [eax*4]
mov eax, dword [ebp - 0x14]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
add eax, edx
mov edx, eax
mov eax, dword [ebp - 0x28]
mov ecx, eax
call fcn.005cb139
test al, al
je 0x5cb258
mov eax, dword [ebp - 4]
lea edx, [eax + eax]
mov eax, dword [ebp - 0x18]
add eax, edx
movzx eax, word [eax]
movzx eax, ax
lea edx, [eax*4]
mov eax, dword [ebp - 0x1c]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x24]
add eax, edx
jmp 0x5cb263
add dword [ebp - 4], 1
jmp 0x5cb201
mov eax, 0
leave
ret
Function at 0x5cb46b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x4b], 0x74726956
mov dword [ebp - 0x47], 0x506c6175
mov dword [ebp - 0x43], 0x65746f72
mov word [ebp - 0x3f], 0x7463
mov byte [ebp - 0x3d], 0
lea eax, [ebp - 0x4b]
mov ecx, eax
call fcn.005cb265
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x30
mov eax, dword [ebp - 0x10]
mov eax, dword fs:[eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
mov dword [ebp - 0x18], 0x30
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x3c]
add eax, edx
lea edx, [eax + 0x78]
lea eax, [ebp - 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0x78
mov dword [esp], edx
mov eax, dword [ebp - 0xc]
call eax
sub esp, 0x10
call fcn.005cb42b
mov ecx, eax
mov dword [ebp - 0x20], 0x30
mov eax, dword [ebp - 0x20]
mov eax, dword fs:[eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + 8]
mov dword [ebp - 0x28], 0x30
mov eax, dword [ebp - 0x28]
mov eax, dword fs:[eax]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x3c]
add eax, edx
add eax, 0x78
mov dword [esp], 0x78
mov edx, ecx
mov ecx, eax
call fcn.005cb3ad
sub esp, 4
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x30], 0x30
mov edx, dword [ebp - 0x30]
mov edx, dword fs:[edx]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x34]
mov ecx, dword [edx + 8]
mov dword [ebp - 0x38], 0x30
mov edx, dword [ebp - 0x38]
mov edx, dword fs:[edx]
mov dword [ebp - 0x3c], edx
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx + 8]
mov edx, dword [edx + 0x3c]
add edx, ecx
lea ecx, [edx + 0x78]
lea edx, [ebp - 0x50]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x78
mov dword [esp], ecx
mov eax, dword [ebp - 0xc]
call eax
sub esp, 0x10
nop
leave
ret
Function at 0x403288
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4041fc
sub eax, eax
test esi, esi
je 0x403360
sub eax, 1
test ecx, ecx
je 0x40335e
test esi, 3
je 0x4032c6
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032ab
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x403345
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032d0
mov ecx, edx
test ecx, ecx
je 0x40335e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40334b
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x43b647
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
sub ecx, 0xfe84cf14
inc ecx
sub edi, edi
call fcn.0043b680
push 0x615467c6
pop edi
dec ecx
xor dword [esi], ebx
add edi, 1
add ecx, 0xbed56900
inc esi
inc edi
cmp esi, edx
jne fcn.0043b647
and edi, ecx
ret
Function at 0x404bef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40db60]
jne 0x404bf9
repz ret
jmp fcn.0040883b

Function at 0x4060f3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004029c4
and dword [ebp - 4], 0
cmp dword [0x40e54c], 0
mov ebx, eax
jne 0x4061a4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406255
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40aa14
push edi
call esi
test eax, eax
je 0x406255
push eax
call fcn.00402952
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40e54c], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40e550], eax
call esi
push eax
call fcn.00402952
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40e554], eax
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e55c], eax
test eax, eax
je 0x4061a4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402952
pop ecx
mov dword [0x40e558], eax
mov eax, dword [0x40e558]
cmp eax, ebx
je 0x4061fc
cmp dword [0x40e55c], ebx
je 0x4061fc
push eax
call fcn.004029cd
push dword [0x40e55c]
mov esi, eax
call fcn.004029cd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061fc
test edi, edi
je 0x4061fc
call esi
test eax, eax
je 0x4061f3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061f3
test byte [ebp - 0xc], 1
jne 0x4061fc
or dword [ebp + 0x10], 0x200000
jmp 0x406235
mov eax, dword [0x40e550]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406235
mov eax, dword [0x40e554]
cmp eax, ebx
je 0x406235
push eax
call fcn.004029cd
pop ecx
test eax, eax
je 0x406235
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40e54c]
call fcn.004029cd
pop ecx
test eax, eax
je 0x406255
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406257
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x10013540
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001356d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001356d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rdata
nop
mov ebx, 0x40de38
nop
mov ecx, 0x38923708
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x52e21e06
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x418180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x4181a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4181a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418198
mov eax, 1
add ebx, ebx
jne 0x4181bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4181b0
jne 0x4181cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181b0
xor ecx, ecx
sub eax, 3
jb 0x4181e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418252
mov ebp, eax
add ebx, ebx
jne 0x4181eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4181f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41821c
inc ecx
add ebx, ebx
jne 0x418208
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4181fd
jne 0x418219
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4181fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41823c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41822d
jmp 0x41819e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41823c
add edi, ecx
jmp 0x41819e
pop esi
mov edi, esi
mov ecx, 0x3b2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41825a
cmp byte [edi], 0
jne 0x41825a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41825f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x4182ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18114]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41828c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18118]
or eax, eax
je 0x4182c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4182a9
call dword [esi + 0x1811c]
popal
jmp 0x40a630