joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001efa1
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
push 0x50
mov eax, 0x1002dcac
call fcn.1002b09b
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x54], eax
xor eax, eax
cmp word [ebp + 0x1c], ax
setne al
movzx eax, ax
push eax
push esi
call fcn.10026ba5
pop ecx
pop ecx
test eax, eax
jne 0x1001f0c5
mov eax, dword [esi + 4]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], esi
inc dword [eax + 0x38]
inc dword [esi + 0x14]
and dword [ebp - 4], 0
xor eax, eax
mov ebx, dword [esi + 4]
mov word [ebp - 0x4c], ax
lea eax, [esi + 0xc]
mov dword [ebp - 0x48], eax
xor eax, eax
push 4
pop ecx
mov word [ebp - 0x3c], ax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor eax, eax
push 0
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x54]
push 0x7fffffff
push eax
mov dword [ebp - 0x50], 0x50525350
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0x52535043
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], 0x52535048
mov dword [ebp - 0x28], eax
call fcn.10026ba5
mov dword [ebp - 0x24], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x20], 0x55524544
cmp byte [0x1003cdfb], 0
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
jne 0x1001f069
cmp byte [0x1003cdfa], 0
je 0x1001f09d
push ebx
push str.__lx__PDFXSendOrSave_kPDFXPushResponse_
mov esi, 0x1003d228
push esi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x1001f08d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1001f09d
push esi
call fcn.10005eb0
pop ecx
xor eax, eax
cmp word [ebp + 0x1c], ax
push 8
pop ecx
cmovne eax, ecx
push eax
push 4
lea eax, [ebp - 0x50]
push eax
push ebx
call fcn.1001ec31
add esp, 0x10
lea ecx, [ebp - 0x5c]
mov esi, eax
call fcn.10026ba5
mov eax, esi
call fcn.1002b045
ret
Function at 0x100223c5
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x440
mov eax, 0x1002dd87
call fcn.1002b109
mov eax, dword [ebp + 8]
mov esi, 0x208
mov dword [ebp - 0x438], eax
xor edi, edi
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x424]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x434], 0x104
lea eax, [ebp - 0x428]
xorps xmm0, xmm0
movsd qword [ebp - 0x430], xmm0
push eax
push 0x20019
push edi
push 0x100333cc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100225e4
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
mov ebx, edi
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
jmp 0x100224d1
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtof]
fstp qword [ebp - 0x44c]
movsd xmm0, qword [ebp - 0x44c]
comisd xmm0, xmmword [0x100336a8]
pop ecx
jbe 0x100224bd
comisd xmm0, xmmword [ebp - 0x430]
jbe 0x100224bd
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x430], xmm0
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x434]
inc ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x10022469
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x100225e4
push str.ClientUserInterface
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov esi, eax
mov dword [esp], str.SoftwareMicrosoftSoftGrid_
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor ecx, ecx
mov dword [ebp - 0x42c], edi
push 2
pop edx
lea ebx, [eax + 0x105]
mov dword [ebp - 4], edi
add ebx, esi
mov eax, ebx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10026ba5
mov esi, eax
mov dword [ebp - 0x42c], esi
pop ecx
pop ecx
test esi, esi
je 0x100225e4
push ebx
push edi
push esi
call fcn.10026ba5
push str.SoftwareMicrosoftSoftGrid_
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push str.ClientUserInterface
push ebx
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0x30
lea eax, [ebp - 0x428]
push eax
push 0x20019
push edi
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100225dd
push dword [ebp - 0x438]
push str.LaunchCommand
push dword [ebp - 0x428]
call fcn.10022617
add esp, 0xc
push dword [ebp - 0x43c]
push str.DDELaunchCommand
push dword [ebp - 0x428]
call fcn.10022617
add esp, 0xc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.1002b601
pop ecx
call fcn.1002b056
ret
Function at 0x10022617
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x1002ddaf
call fcn.1002b0d2
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002275c
cmp dword [ebp - 0x18], 1
jne 0x1002275c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
inc eax
mov dword [ebp - 4], ebx
push 2
pop edx
mov dword [ebp - 0x14], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10026ba5
mov esi, eax
mov dword [ebp - 0x1c], esi
pop ecx
test esi, esi
je 0x1002275c
push dword [ebp - 0x14]
push ebx
push esi
call fcn.10026ba5
mov eax, dword [ebp - 0x14]
add esp, 0xc
lea eax, [eax*2 - 2]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10022751
cmp dword [ebp - 0x18], 1
jne 0x10022751
mov eax, dword [ebp - 0x14]
xor ecx, ecx
shr eax, 1
mov dword [ebp - 0x14], eax
inc eax
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10026ba5
mov dword [edi], eax
pop ecx
test eax, eax
je 0x10022751
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
push ebx
push eax
call fcn.10026ba5
lea eax, [ebp - 0x20]
push eax
push 0x100333c8
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcstok_s]
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x10022735
push ebx
call fcn.10026ba5
pop ecx
test al, al
je 0x10022735
mov eax, dword [ebp - 0x14]
push ebx
inc eax
push eax
push dword [edi]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x10022751
push dword [edi]
call fcn.1002b601
and dword [edi], 0
pop ecx
jmp 0x10022751
test esi, esi
je 0x1002275c
push esi
call fcn.1002b601
pop ecx
call fcn.1002b030
ret

Function at 0x10022f02
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10033124
xor esi, esi
call fcn.10026ba5
pop ecx
test eax, eax
jne 0x10022f23
push 0x1003313c
call fcn.10026ba5
pop ecx
test eax, eax
je 0x10022f26
xor esi, esi
inc esi
cmp byte [0x1003cdfb], 0
jne 0x10022f38
cmp byte [0x1003cdfa], 0
je 0x10022f6e
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d640
push edi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10022f5d
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10022f6d
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x100252bb
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x10025339
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cdfb], 0
jne 0x100252fd
cmp byte [0x1003cdfa], 0
je 0x10025334
movzx eax, bl
mov esi, 0x1003e1a8
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10025324
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10025334
push esi
call fcn.10005eb0
pop ecx
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cdfb], 0
jne 0x1002534b
cmp byte [0x1003cdfa], 0
je 0x1002537d
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e1a8
push esi
call fcn.10026ba5
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x1002536d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002537d
push esi
call fcn.10005eb0
pop ecx
mov al, 1
pop esi
ret

Function at 0x10026ba5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10026bb4
pop dword [ebp - 0x3c]
mov eax, 0x10026bb4
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xda80e797
sub dword [ebp - 0x4c], 0x8c2ea24c
mov dword [ebp - 0x48], 0xf003497
add dword [ebp - 0x48], 0x233317ae
mov dword [ebp - 0x44], 0xe5731481
add dword [ebp - 0x44], 0x66d92fad
mov dword [ebp - 0x40], 0x4aca2f01
add dword [ebp - 0x40], 0xb535d0ff
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd2bfdc26
sub dword [ebp - 0x4c], 0x5e4d72d0
mov dword [ebp - 0x48], 0x6e814334
sub dword [ebp - 0x48], 0x2d14e1bf
mov dword [ebp - 0x44], 0x50c24db7
add dword [ebp - 0x44], 0x12ad1eb5
mov dword [ebp - 0x40], 0x1163e5e9
sub dword [ebp - 0x40], 0x1163e5e9
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x96cb75b6
sub eax, 0x86c884ca
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x44993
push 0
call eax
mov ecx, 0x7bf22a8e
sub ecx, 0x7bf1e307
mov edx, eax
mov ebx, 0x10046400
add ebx, dword [ebp - 0x3c]
mov esi, 0x978c64c3
sub esi, 0xb28fff54
mov dword [ebp - 4], 0x8e9da63
mov edi, dword [ebx]
xor dword [ebp - 0x34], 0x9baa848f
sub edi, esi
add dword [ebp - 0x20], esi
mov dword [edx], edi
sub dword [ebp - 0x30], 0xa87780bf
add edx, 4
add ebx, 0xb689c36e
add ebx, 0x49763c96
loop 0x10026cc6
add eax, 0x339b2da9
add eax, 0xcc65e346
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x42ff6a2b
sub ecx, 0x32ff6a2b
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x10028019
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [0x1003cdfb], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
jne 0x10028036
cmp byte [0x1003cdfa], 0
je 0x1002806b
push dword [esi]
mov edi, 0x1003e1a8
push str._ACTWinBrowser__ACTSetSandboxBrokerHandles_handle__0x_x
push edi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x1002805b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x1002806b
push edi
call fcn.10005eb0
pop ecx
push dword [ebp + 8]
call fcn.10026ba5
pop ecx
test al, al
jne 0x1002807c
inc al
jmp 0x100280b6
cmp dword [ebp + 8], 0
je 0x100280b4
mov ecx, dword [ebp + 0x10]
cmp ecx, 0xa
ja 0x100280b4
movzx eax, byte [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x1002809d
lea edi, [ebp - 0x28]
rep movsd dword es:[edi], dword [esi]
push 0
push 0x30
lea eax, [ebp - 0x30]
push eax
push 5
push dword [ebp + 8]
call fcn.1002704a
add esp, 0x14
jmp 0x100280b6
xor al, al
pop edi
pop esi
leave
ret

Function at 0x10028be1
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10028bfe
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cdfb], 0
jne 0x10028c14
cmp byte [0x1003cdfa], 0
je 0x10028d53
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5f8
push edi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c3a
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c53
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c5c
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push 4
push str.sizeof_Uns32____d
push edi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028c7c
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028c95
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028c9e
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028cbe
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028cd7
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028ce0
cmp byte [0x1003cdfa], 0
je 0x10028d00
push 4
push str.sizeof_Handle32____d
push edi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d00
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d19
push edi
call fcn.10005eb0
cmp byte [0x1003cdfb], 0
pop ecx
jne 0x10028d22
cmp byte [0x1003cdfa], 0
je 0x10028d42
push 4
push str.sizeof_void____d
push edi
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028d42
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028d52
push edi
call fcn.10005eb0
pop ecx
pop edi
mov eax, esi
pop esi
ret
Function at 0x10028dec
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002e03a
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, 0x1003e5f8
mov edi, dword [ebp + 8]
jne 0x10028e17
mov al, byte [0x1003cdfa]
test al, al
jne 0x10028e17
lea esi, [edi + 4]
jmp 0x10028e2e
lea esi, [edi + 4]
push esi
push str.ASM_Release__s
push ebx
call fcn.10026ba5
mov al, byte [0x1003cdfa]
add esp, 0xc
test al, al
je 0x10028e39
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028e49
push ebx
call fcn.10005eb0
pop ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.10026ba5
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x10028e7c
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100031be
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002b045
ret
Function at 0x10028e92
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002e067
call fcn.1002b09b
cmp byte [0x1003cdfb], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
jne 0x10028ebf
cmp byte [0x1003cdfa], 0
je 0x10028f0e
call fcn.10026ba5
test al, al
mov edx, 0x1002fb8c
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5f8
call fcn.10026ba5
add esp, 0xc
cmp byte [0x1003cdfa], 0
je 0x10028efa
push 0x1003e5f8
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10028f0e
push 0x1003e5f8
call fcn.10005eb0
pop ecx
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10026ba5
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.100028d9
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100031be
test ebx, ebx
jne 0x10028f8c
cmp byte [0x1003cdfb], bl
jne 0x10028f58
cmp byte [0x1003cdfa], bl
je 0x10029000
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5f8
push ebx
call fcn.10026ba5
cmp byte [0x1003cdfa], 0
pop ecx
pop ecx
je 0x10028f7a
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cdfb], 0
je 0x10029000
push ebx
call fcn.10005eb0
pop ecx
jmp 0x10029000
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10028fbb
cmp byte [0x1003cdfb], al
jne 0x10028fb4
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10028f5d
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002f5c0]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10028ff0
cmp byte [0x1003cdfb], al
jne 0x10028fe6
cmp byte [0x1003cdfa], al
je 0x10029000
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10028f5d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002b045
ret
Function at 0x41fe40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
jmp 0x41fe5a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41fe61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41fe50
mov eax, 1
add ebx, ebx
jne 0x41fe73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41fe68
jne 0x41fe84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41fe68
xor ecx, ecx
sub eax, 3
jb 0x41fe98
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41ff0a
mov ebp, eax
add ebx, ebx
jne 0x41fea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41feb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41fed4
inc ecx
add ebx, ebx
jne 0x41fec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41feb5
jne 0x41fed1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41feb5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41fef4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41fee5
jmp 0x41fe56
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41fef4
add edi, ecx
jmp 0x41fe56
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ff12
cmp byte [edi], 9
jne 0x41ff12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41ff17
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41ff8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x20904]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x209e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ff44
mov ecx, edi
jns 0x41ff73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x209ec]
or eax, eax
je 0x41ff89
mov dword [ebx], eax
add ebx, 4
jmp 0x41ff61
call dword [esi + 0x209e8]
mov ebp, dword [esi + 0x209f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41ffc3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x10002e23
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebx]
mov esi, eax
sub esi, dword [edx]
js 0x10002ea4
cmp dword [edi], 0
jle 0x10002e7d
cmp esi, dword [edi]
jl 0x10002e7a
push ecx
push 0x100
push dword [edi]
xor edx, edx
mov ecx, edi
inc edx
call fcn.10008ab5
test eax, eax
js 0x10002ea4
push 0x42
push dword [edi]
mov edi, dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
je 0x10002ea4
mov dword [edi], eax
add eax, esi
mov dword [ebx], eax
jmp 0x10002e7f
cmp dword [edi], 0
jl 0x10002ea4
push 0
lea ecx, [ebp - 8]
push ecx
push 1
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10002ea0
cmp dword [ebp - 8], 0
je 0x10002ea0
xor eax, eax
inc eax
jmp 0x10002ea7
xor eax, eax
jmp 0x10002ea7
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10008370
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x1000a004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x418]
push 0x20a
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0x41c], esi
lea eax, [ebp + 0x14]
mov ebx, 0x105
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x418]
push ebx
push eax
push dword [ebp + 0xc]
push dword [0x1000abe0]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x420]
push eax
push ebx
lea eax, [ebp - 0x41c]
push eax
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x500
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x10008492
dec ebx
lea eax, [ebp - 0x20c]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10008423
sub ecx, edx
sar ecx, 1
jne 0x1000846d
push ebx
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10008453
sub ecx, edx
sar ecx, 1
jne 0x1000846d
xor eax, eax
mov word [ebp - 0x20c], ax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x41c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10009160
leave
ret