joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435968
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x1f8], 0
je 0x435984
cmp dword [esi + 4], 0
je 0x4359b1
test byte [ebx + 0x55], 1
jne 0x4359a3
mov eax, ebx
call fcn.00434574
test eax, eax
jne 0x4359a3
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x435ac1
mov edx, esi
mov eax, ebx
call fcn.0043548c
jmp 0x435ac1
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x435aba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004377d8
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.00432290
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.00435968
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.004377d8
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x435ac1
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43bed0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x457494]
cmp byte [eax + 0xc], 0
je 0x43c03d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43c036
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x458b68], 0
jne 0x43bf24
push 0x43c044
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43c04c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b68], eax
cmp dword [0x456c18], 0
jne 0x43c01f
push 0x43c05c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x456c18], eax
cmp dword [0x456c18], 0
je 0x43c01f
push 0x43c068
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b6c], eax
push 0x43c078
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b70], eax
push 0x43c08c
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b74], eax
push 0x43c0a4
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b78], eax
push 0x43c0bc
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b7c], eax
push 0x43c0d0
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b80], eax
push 0x43c0e8
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b84], eax
push 0x43c100
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b88], eax
push 0x43c11c
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b8c], eax
push 0x43c128
mov eax, dword [0x456c18]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x458b90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43c03d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43fec8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.0040404c
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43ff17
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.004042bc
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44762c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44767c]
test si, 4
je 0x447640
or bl, 1
test si, 8
je 0x44764a
or bl, 4
test si, 1
je 0x447654
or bl, 8
test si, 2
je 0x44765e
or bl, 0x10
test si, 0x10
je 0x447668
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x447677
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x447680
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x4476b8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x447699
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4476a8
or bl, 4
test esi, 0x20000000
je 0x4476b3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44dd60
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44dd72
add esp, 0xfffffff0
call fcn.00403620
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e0c4
mov eax, dword [0x457134]
mov dword [eax + 4], ebx
mov dword [eax], 0x44e104
mov eax, dword [0x457140]
mov dword [eax + 4], ebx
mov dword [eax], 0x44e110
mov eax, ebx
call fcn.0044e11c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.004032e4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.004032e4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.004032e4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.004032e4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.004032e4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44a538
push eax
push 0
push 0
mov eax, dword [0x457298]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41fb04]
call fcn.00420f48
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41fb04]
call fcn.00420f48
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41fb04]
call fcn.00420f48
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044e53c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e418
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e418
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44e418
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44deaf
call fcn.00403678
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44e1fc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44e3a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44e388
mov dl, 1
mov eax, dword [0x4167d8]
call fcn.004032e4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040404c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44e377
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043c230
test al, al
je 0x44e36a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44e3b8
lea eax, [ebp - 0x254]
call fcn.00408f08
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44e36a
xor eax, eax
push ebp
push 0x44e363
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44e3f0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44e34c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004042bc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44e34c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004042bc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e36a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44e26d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041a2b4
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44e3ae
lea eax, [ebp - 0x260]
call fcn.0040404c
ret

Function at 0x44ecdc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x458bb4]
cmp byte [eax + 0xa5], 0
jne 0x44ed4d
cmp dword [0x458bcc], 0
jne 0x44ed0e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44ec98
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x458bcc], eax
cmp dword [0x458bc8], 0
jne 0x44ed29
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x458bc8], eax
cmp dword [0x458bd0], 0
jne 0x44ed4d
push esp
push 0
push 0
push 0x44ec3c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x458bd0], eax
pop edx
ret
Function at 0x44ee44
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44ee5b
add esp, 0xfffffff0
call fcn.00403620
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041e0c4
mov eax, dword [0x457284]
cmp word [eax + 2], 0
jne 0x44ee83
mov eax, dword [0x457284]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045051c
mov eax, dword [0x457334]
cmp word [eax + 2], 0
jne 0x44ee9d
mov eax, dword [0x457334]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00450714
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.004032e4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4163bc]
call fcn.004032e4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x4202b4]
call fcn.00425efc
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44f024
mov eax, dword [0x45719c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004262cc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x450cb4
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45719c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c648
test eax, eax
je 0x44ef92
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004088fc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c670
test eax, eax
je 0x44efa6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004042bc
mov eax, dword [0x457084]
cmp byte [eax], 0
jne 0x44efda
mov eax, ebx
call fcn.0044f14c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00450e90
mov eax, ebx
call fcn.00451854
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44f01a
call fcn.00403678
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f3cc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x458bb4]
cmp dword [eax + 0x30], 0
je 0x44f476
cmp dword [ebx + 0x94], 0
jne 0x44f470
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44f35c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44f470
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44f436
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44f470
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418724
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44f445
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44ffd8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45000d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040413c
jmp 0x45001a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004040a0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45106c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4510ad
mov eax, esi
call fcn.00437a38
test al, al
je 0x4510ad
mov eax, dword [ebx + 0x84]
call fcn.004377d8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4510ad
push 0
mov eax, dword [ebx + 0x84]
call fcn.004377d8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4540b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4541d2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00405a20
push eax
push 0
push 0x457050
call sub.oleaut32.dll_GetActiveObject
call fcn.00415cac
test al, al
jne 0x45417b
xor eax, eax
push ebp
push 0x45416c
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x454139
push 1
lea eax, [ebp - 0x10]
call fcn.00453fac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.004087a4
lea eax, [ebp - 0xc]
mov edx, 0x4541e8
call fcn.00404314
mov eax, dword [ebp - 0xc]
call fcn.0040450c
push eax
call sub.kernel32.dll_WinExec
push 0x14
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x457318]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
call fcn.0045406c
lea eax, [ebp - 4]
call fcn.00405a20
push eax
push 0
push 0x457050
call sub.oleaut32.dll_GetActiveObject
call fcn.00451cf4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45417b
lea eax, [ebp - 8]
call fcn.00405a20
push eax
push 0x4541f8
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax]
call fcn.00451cf4
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00413408
mov byte [0x458c04], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4541d9
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404070
lea eax, [ebp - 8]
call fcn.00405a20
lea eax, [ebp - 4]
call fcn.00405a20
ret

Function at 0x45477c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor ebx, ebx
mov dword [ebp - 0x104], ebx
mov ebx, ecx
xor ecx, ecx
push ebp
push 0x4547f0
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dl, 1
cmc
sbb edx, edx
push edx
push eax
lea eax, [ebp - 0x100]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathA
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004042bc
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.0040c51c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4547f7
lea eax, [ebp - 0x104]
call fcn.0040404c
ret
Function at 0x409769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d190
cmp edx, dword [eax]
je 0x40978b
add eax, 8
inc ecx
cmp eax, 0x40d220
jl 0x40977c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d190]
jne 0x4098b9
mov eax, dword [0x40dbb0]
cmp eax, 1
je 0x409893
test eax, eax
jne 0x4097bc
cmp dword [0x40d0e4], 1
je 0x409893
cmp edx, 0xfc
je 0x4098b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4097f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040a670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040a490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x409836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040a490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c45c
push edi
call fcn.0040af00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040a670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040a680
lea eax, [ebp - 0xa0]
push 0x40c43c
push eax
call fcn.0040a680
push dword [esi + 0x40d194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040a680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040ae75
add esp, 0x2c
pop edi
jmp 0x4098b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40d194]
push 0
push eax
push dword [esi]
call fcn.0040a490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x405f99
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00405c59
Function at 0x40ea20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40ea42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40ea49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40ea38
mov eax, 1
add ebx, ebx
jne 0x40ea5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40ea50
jne 0x40ea6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40ea50
xor ecx, ecx
sub eax, 3
jb 0x40ea80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40eaf2
mov ebp, eax
add ebx, ebx
jne 0x40ea8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40ea98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40eabc
inc ecx
add ebx, ebx
jne 0x40eaa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40ea9d
jne 0x40eab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40ea9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40eadc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40eacd
jmp 0x40ea3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40eadc
add edi, ecx
jmp 0x40ea3e
pop esi
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40eb44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40eaf9
mov ecx, edi
jns 0x40eb28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe07c]
or eax, eax
je 0x40eb3e
mov dword [ebx], eax
add ebx, 4
jmp 0x40eb16
call dword [esi + 0xe08c]
mov ebp, dword [esi + 0xe080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40eb78
sub esp, 0xffffff80
jmp fcn.0040c8ec
Function at 0xeb3cec
Capabilities:
Encode data using xor

Disassembly:
jmp 0xeb3cf6
inc esi
adc al, byte [eax]
add byte [eax], al
add byte [eax], al
pushal
call 0xeb3cfc
pop ebp
sub ebp, 0x10
sub ebp, 0xab3cec
jmp 0xeb3d12
mov eax, 0xab3cec
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b7
cmp al, 0xab
add byte [ebx], al
lds eax, [ecx + 0x4cc0]
add byte [ecx + 0x5b7], bh
mov edx, 0xf5e7e995
xor byte [eax], dl
inc eax
dec ecx
jne 0xeb3d29
test esi, esi
invalid
jmp 0xeb3d3c
push ds
pop eax
push ds
sbb al, 0xa9
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
adc al, 0x54
insd dword es:[edi], dx
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
xchg esi, eax
pop eax
sub eax, 0x95959593
das
mov ebp, 0x62959595
ja 0xeb3cef
pop ebp
push ds
adc al, 0x99
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
xchg esi, eax
push eax
sbb cl, dh
mov cl, 0x69
sbb al, 0x91
mov cl, 0x18
int1
mov cl, 0x69
sbb al, 0x91
mov cl, 0xfd
in eax, 0x33
mov dl, byte [ebp + 0x1e03eefd]
xchg ebp, eax
xchg esp, eax
mov ecx, 0xbd0fdb1
cmp ch, dl
jge 0xeb3d14
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
jl 0xeb3d2e
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
sbb cl, dh
mov cl, 0x69
sbb al, 0xb9
mov cl, 0x18
stc
mov cl, 0x95
push ds
adc byte [ebp + 0x1e959595], bl
add byte [ecx + 0x1e959595], bl
sbb byte [ebp + 0x54959595], al
jl 0xeb3d43
movsb byte es:[edi], byte [esi]
xchg edi, eax
push ss
push edi
xchg ecx, eax
fcomp qword [edx + 0x6a6a6110]
push 0xffffffffffffffc8
push edi
cdq
xchg ebp, eax
push ds
sbb dword [ecx - 0x6a6a6a6f], esi
std
in eax, 0x33
mov dl, byte [ebp + 0x1e03eefd]
xchg ebp, eax
xchg esp, eax
mov ecx, 0x907dc4b1
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
jl 0xeb3d82
xchg edi, eax
xchg ebp, eax
xchg ebp, eax
rcr byte [esi], 0x79
push 0xffffffffffffffe0
cdq
push 0xffffffffffffffe0
popfd
jge 0xeb3dcd
xchg ebp, eax
xchg ebp, eax
xchg ebp, eax
push ds
sub byte [ebp - 0x596a6a6b], bl
pop esp
adc al, 0x67
mov cl, 0x6b
xchg esp, ebp
adc al, 0x67
mov cl, 0x6b
xchg esp, ebp
cmpsb byte [esi], byte es:[edi]
inc edi
push ss
jge 0xeb3d92
fstp qword [edx - 0x6a6a24ef]
xchg ebp, eax
lcall 0xf395, 0x9595dd1d
push ds
mov dword [ebp + edx + 0x119a7d6e], ebp
invalid