joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402585
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x230
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
xor ebp, ebp
mov ebx, ecx
push ebp
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov esi, eax
lea eax, [esp + 0x14]
push ebp
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0xc], 0x22c
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40263b
jmp 0x40260e
lea edx, [esp + 0x30]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, bp
jne 0x4025df
sub edx, ecx
mov ecx, ebx
sar edx, 1
cmp dword [ebx + 0x14], 7
jbe 0x4025f8
mov ecx, dword [ebx]
cmp dword [ebx + 0x10], edx
jne 0x40260e
push dword [ebx + 0x10]
lea edx, [esp + 0x34]
call fcn.0040542a
pop ecx
test eax, eax
je 0x402620
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4025d8
jmp 0x40263b
push dword [esp + 0x14]
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x238]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004067ea
add esp, 0x230
ret

Function at 0x402696
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, 0x7ffffffe
push ebx
push esi
mov esi, dword [ecx + 0x10]
xor ebx, ebx
sub eax, esi
push edi
mov edi, edx
cmp eax, 0x17
jb 0x40270e
cmp dword [ecx + 0x14], 7
jbe 0x4026ba
mov ecx, dword [ecx]
push esi
push ecx
push 0x17
push ecx
push ecx
push dword [ebp - 4]
lea ecx, [ebp - 0x1c]
call fcn.00405e06
cmp dword [ebp - 8], 7
lea ecx, [ebp - 0x1c]
jbe 0x4026d7
mov ecx, dword [ebp - 0x1c]
imul eax, edi, 0x20a
push ebx
push ebx
lea esi, [eax + 0x40e788]
push esi
push ecx
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea ecx, [ebp - 0x1c]
call fcn.00405306
sub esp, 0x18
mov ecx, esp
push esi
call fcn.004050f8
call fcn.0040265a
add esp, 0x18
pop edi
pop esi
pop ebx
leave
ret
call fcn.004010d9
int3

Function at 0x402714
Capabilities:
Download url
Receive data

Disassembly:
push ecx
cmp dword [ecx + 0x14], 7
push esi
jbe 0x40271e
mov ecx, dword [ecx]
imul eax, edx, 0x20a
lea esi, [eax + 0x40e788]
xor eax, eax
push eax
push eax
push esi
push ecx
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
sub esp, 0x18
mov ecx, esp
push esi
call fcn.004050f8
call fcn.0040265a
add esp, 0x18
pop esi
pop ecx
ret
Function at 0x4037bb
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x408262
call fcn.004077de
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x418ebc], ax
call fcn.004023ae
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00405146
push 0x52
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
pop ecx
call fcn.00402476
lea ecx, [ebp - 0x28]
call fcn.00405306
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00405306
call fcn.0040274d
test eax, eax
je 0x40386a
push str.jdk_22_windows_x64_bin.exe
lea ecx, [ebp - 0x28]
call fcn.004050f8
push 0x52
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
pop ecx
call fcn.00402476
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405306
push str.https:__download.oracle.com_java_22_latest_jdk_22_windows_x64_bin.exe
lea ecx, [ebp - 0x28]
call fcn.004050f8
push 0x52
pop edx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.00402714
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405306
push 0x3c
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x418ebc
mov dword [0x4190d0], 0x3c
push eax
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e0], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
test eax, eax
je 0x4038d0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.00405653
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.004022ab
lea ecx, [ebp - 0x44]
call fcn.00405306
push 0
push 0x409558
push str.Minecraft_Launcher___Minecraft:_Java_Edition___Installations___Latest___Edit___More_Options___Java_Executable_Path____drive_:Program_FilesJavajdk_22_binjavaw.exe
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.004077bb
ret
Function at 0x40390b
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x408262
call fcn.004077de
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x418ebc], ax
call fcn.004023ae
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00405146
push 0x52
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
pop ecx
call fcn.00402476
lea ecx, [ebp - 0x28]
call fcn.00405306
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00405306
push str.dxwebsetup.exe
lea ecx, [ebp - 0x28]
call fcn.004050f8
push 0x52
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
pop ecx
call fcn.00402476
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405306
push str.https:__download.microsoft.com_download_1_7_1_1718CCC4_6315_4D8E_9543_8E28A4E18C4C_dxwebsetup.exe
lea ecx, [ebp - 0x28]
call fcn.004050f8
push 0x52
pop edx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 3
call fcn.00402714
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405306
push 0x3c
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x418ebc
mov dword [0x4190d0], 0x3c
push eax
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e4], 0x40aa94
mov dword [0x4190e0], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
test eax, eax
je 0x403a21
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.00405653
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.004022ab
lea ecx, [ebp - 0x44]
call fcn.00405306
call fcn.004077bb
ret
Function at 0x403a48
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x4082b7
call fcn.004077de
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x40e788], ax
call fcn.004023ae
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00405146
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
xor ecx, ecx
call fcn.00402476
lea ecx, [ebp - 0x28]
call fcn.00405306
or ebx, 0xffffffff
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], ebx
call fcn.00405306
push str.7z.exe
lea ecx, [ebp - 0x28]
call fcn.004050f8
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.00402476
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00405306
call fcn.0040274d
lea ecx, [ebp - 0x28]
test eax, eax
je 0x403ae1
push str.https:__7_zip.org_a_7z2407_x64.exe
call fcn.004050f8
mov dword [ebp - 4], 3
jmp 0x403af2
push str.https:__7_zip.org_a_7z2407.exe
call fcn.004050f8
mov dword [ebp - 4], 4
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.00402714
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.00405306
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push 5
pop esi
mov edi, 0x40e788
mov dword [0x4190d0], ebx
push eax
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], esi
mov dword [0x4190e4], 0x40ab38
mov dword [0x4190e0], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
test eax, eax
je 0x403b74
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push edi
lea ecx, [ebp - 0x44]
call fcn.00405653
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], esi
call fcn.004022ab
lea ecx, [ebp - 0x44]
call fcn.00405306
call fcn.004077bb
ret
Function at 0x403bac
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x408262
call fcn.004077de
xor eax, eax
lea ecx, [ebp - 0x5c]
xor esi, esi
mov word [0x40e788], ax
call fcn.004023ae
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], esi
call fcn.00405146
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
xor ecx, ecx
call fcn.00402476
lea ecx, [ebp - 0x28]
call fcn.00405306
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.00405306
push str.VisualCppRedist_AIO_x86_x64.exe
lea ecx, [ebp - 0x28]
call fcn.004050f8
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.00402476
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405306
push str.https:__github.com_abbodi1406_vcredist_releases_download_v0.82.0_VisualCppRedist_AIO_x86_x64.exe
lea ecx, [ebp - 0x28]
call fcn.004050f8
xor edx, edx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00402714
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405306
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x98]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x4190d0], ebx
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e4], 0x40ac8c
mov dword [0x4190e0], 0x40e788
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x403cbe
push 0xffffffffffffffff
push eax
call ebx
push 0x3c
lea eax, [ebp - 0x98]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x98]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x40e788
mov dword [0x4190d0], 0x3c
push eax
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e4], 0x40aca0
mov dword [0x4190e0], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
test eax, eax
je 0x403d2b
push 0xffffffffffffffff
push eax
call ebx
push ecx
push esi
lea ecx, [ebp - 0x44]
call fcn.00405653
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 4
call fcn.004022ab
lea ecx, [ebp - 0x44]
call fcn.00405306
call fcn.004077bb
ret
Function at 0x404069
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x84
mov eax, 0x4083c9
call fcn.004077de
call fcn.0040274d
test eax, eax
je 0x40426b
xor eax, eax
lea ecx, [ebp - 0x3c]
mov word [0x418ebc], ax
call fcn.004023ae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.004017ed
push 0x52
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 1
pop ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
call fcn.0040197a
or ebx, 0xffffffff
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040197a
push str.MAME.exe
lea ecx, [ebp - 0x24]
call fcn.004050f8
push 0x52
lea edx, [ebp - 0x24]
mov dword [ebp - 4], 2
pop ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push str.https:__github.com_mamedev_mame_releases_download_mame0267_mame0267b_64bit.exe
lea ecx, [ebp - 0x24]
call fcn.004050f8
push 0x52
pop edx
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 3
call fcn.00402714
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
xor eax, eax
lea ecx, [ebp - 0x3c]
mov word [0x40e992], ax
call fcn.004023ae
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.004017ed
xor ecx, ecx
mov byte [ebp - 4], 5
lea edx, [ebp - 0x24]
inc ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
call fcn.0040197a
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040197a
mov esi, str.7z.exe
lea ecx, [ebp - 0x24]
push esi
call fcn.004050f8
xor ecx, ecx
mov dword [ebp - 4], 6
lea edx, [ebp - 0x24]
inc ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push esi
lea ecx, [ebp - 0x24]
call fcn.004050f8
xor edx, edx
mov dword [ebp - 4], 7
inc edx
lea ecx, [ebp - 0x24]
call fcn.00402696
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x90]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x90]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x40e992
mov dword [0x4190d0], ebx
push eax
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e0], esi
mov dword [0x4190e4], 0x40aef8
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
test eax, eax
je 0x404221
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push esi
lea ecx, [ebp - 0x24]
call fcn.00405653
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 8
call fcn.004022ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040197a
push ecx
push 0x418ebc
lea ecx, [ebp - 0x54]
call fcn.00405653
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 9
call fcn.004022ab
lea ecx, [ebp - 0x54]
call fcn.0040197a
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x404a02
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x84
mov eax, 0x4083c9
call fcn.004077de
call fcn.0040274d
test eax, eax
je 0x404bff
xor eax, eax
lea ecx, [ebp - 0x3c]
mov word [0x40e788], ax
mov word [0x40e992], ax
call fcn.004023ae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.004017ed
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 1
xor ecx, ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
call fcn.0040197a
or ebx, 0xffffffff
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040197a
mov esi, str.7z.exe
lea ecx, [ebp - 0x24]
push esi
call fcn.004050f8
lea edx, [ebp - 0x24]
mov dword [ebp - 4], 2
xor ecx, ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push esi
lea ecx, [ebp - 0x24]
call fcn.004050f8
xor edx, edx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00402696
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
lea ecx, [ebp - 0x3c]
call fcn.004023ae
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.004017ed
xor ecx, ecx
mov byte [ebp - 4], 5
lea edx, [ebp - 0x24]
inc ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
call fcn.0040197a
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040197a
push str.HBMAME.7z
lea ecx, [ebp - 0x24]
call fcn.004050f8
xor ecx, ecx
mov dword [ebp - 4], 6
lea edx, [ebp - 0x24]
inc ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push str.https:__hbmame.1emulation.com_hbmameui20.7z
lea ecx, [ebp - 0x24]
call fcn.004050f8
mov dword [ebp - 4], 7
xor edx, edx
lea ecx, [ebp - 0x24]
inc edx
call fcn.00402714
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x90]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x90]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, 0x40e788
mov dword [0x4190d0], ebx
push eax
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e0], esi
mov dword [0x4190e4], 0x40b388
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
test eax, eax
je 0x404bb5
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push 0x40e992
lea ecx, [ebp - 0x24]
call fcn.00405653
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 8
call fcn.004022ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040197a
push ecx
push esi
lea ecx, [ebp - 0x54]
call fcn.00405653
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 9
call fcn.004022ab
lea ecx, [ebp - 0x54]
call fcn.0040197a
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x404d12
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
push esi
push str.GlobalCSAPP
xor ebp, ebp
mov dword [esp + 0x10], edx
push ebp
push ebp
push ebp
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
test esi, esi
jne 0x404e0b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
mov eax, 0x80000000
push ebx
push ebp
push ebp
push 0x82
push 0x186
push eax
push eax
push 0xcb0000
push str.LoLSuite
push 0x40e6c0
push ebp
call esi
push ebp
push ebx
push 1
mov edi, eax
mov ebp, str.BUTTON
push edi
push 0x4b
push 0x4b
push 0xa
push 0xa
push 0x50010000
push str.Patch
push ebp
push 0
call esi
push 0
push ebx
push 2
push edi
push 0x4b
push 0x4b
push 0xa
push 0x122
push 0x50010000
push str.Restore
push ebp
xor ebp, ebp
push ebp
call esi
push ebp
push ebx
push ebp
push edi
push 0x16d
push 0xbe
push 0xa
push 0x5a
push 0x50000202
push 0x40a738
push str.ComboBox
push ebp
call esi
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
mov esi, 0x40e138
push dword [esi]
push 0
push 0x143
push ebx
call ebp
add esi, 4
cmp esi, 0x40e160
jne 0x404de0
push 0
push 0
push 0x14e
push ebx
call ebp
test edi, edi
jne 0x404e3c
xor eax, eax
jmp 0x404e51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404d3d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
push 0x409558
push str.Only_one_instance_is_allowed
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebp
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
push dword [esp + 0x10]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x406796
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x4067bd
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x4067c0
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.00406772
pop esi
leave
ret 8

Function at 0x407246
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407285
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407285
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407285
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407285
cmp dword [ecx + 0x74], 0xe
jbe 0x407285
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x3e160f72
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x25801063
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41d36b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
scasd eax, dword es:[edi]
salc
cmp al, 0x31
xor eax, 0x57485e56
scasd eax, dword es:[edi]
enter 0x313c, 0x35
das
aaa
sti
inc ebp
xor dword [edi], esi
movsb byte es:[edi], byte [esi]
rdpmc
xor dword [ebx], edi
push esi
mov cl, 0xd6
cmp al, 0x31
xor eax, 0x3131b159
pop esp
cmp ebx, dword [edi + eax*4 + 0x36]
dec edx
xor dword fs:[ebx], 0x31323659
aaa
mov al, byte [0x3b313336]
pop ecx
mov dl, 0x31
xor dword [esi + ebx*2 + 0x3a], ebx
xor ebx, dword [ecx + 0x5e]
xor dh, byte [ecx]
aaa
cmp ebx, dword [eax + edi + 0x33]
pop ecx
pop edi
xor dh, byte [ecx]
aaa
cmp esi, dword [edi]
mov al, byte [0x3b31319a]
inc esp
aaa
pop esp
inc edx
aaa
mov al, byte [0x3b313199]
dec eax
mov al, byte [0x3b313310]
inc edx
aaa
mov al, byte [0x3b313159]
pop esi
sbb ecx, dword [edi]
aas
inc edx
aaa
pop ebp
cmp byte [edx + 0x37], al
mov al, byte [0x3b313158]
or eax, 0x3734ab38
xor eax, 0xd4ac3336
xor dword [ecx], esi
xor eax, 0x3133c2a4
aaa
push esi
xor esp, dword [eax + 0x373133d1]
push esi
xor ebp, dword [edx + edi*8 - 0x5fcacecf]
lds esi, [ebx]
xor dword [edi], esi
push esi
xor ebp, dword [esi + edi*8 - 0x5fcacecf]
invalid
Function at 0x42fa86
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor dword [ebx], edi
cmp ch, byte ds:[edi + 0x35313477]
dec esp
mov al, byte [0x3b3131ef]
pop esi
inc edx
cmp ch, byte [edi + 0x35313478]
dec esp
mov al, byte [0x3b3131ef]
push 0xffffffffffffffd4
xor dword [ecx], esi
xor dword [ebx], esi
lodsb al, byte [esi]
jnp 0x42fae0
xor dword [0xc8a04545], esi
xor dword ss:[ebx], edi
inc esp
cmp dh, byte [ebx]
lodsb al, byte [esi]
jnp 0x42faef
xor dword [0x4a493a42], esi
inc edi
mov al, byte [0x3b3133a1]
inc esp
cmp esi, dword [edx + eax*2]
cmp ebx, dword [ecx + 0x16]
aaa
xor dword [edi], esi
invalid
cmp cl, byte [edx + 0x48]
dec eax
push ecx
xor dword [ecx + 0x31], eax
xor dword [ecx + 0x31], edx
xor dword [ecx], esi
cmp dword [eax + eax + 0x443b3136], esp
add byte [esi], dh
xor dword [ebx], edi
inc esp
cmp al, 0x33
inc edx
cmp al, 0x42
cmp dh, byte [0x31375759]
aaa
cmp eax, 0x3c42830f
pop ebp
cmp byte [edx + 0x3c], al
mov al, byte [0x3b313158]
or eax, 0x593a4231
sbb byte [edi], dh
xor dword [edi], esi
push edi
punpcklwd mm2, dword [edi + 0x33]
lodsb al, byte [esi]
jl 0x42fb53
xor dword [0x57345e56], esi
pop esp
push edx
scasd eax, dword es:[edi]
jns 0x42fb5e
xor dword [0x31e44ba3], esi
mov eax, dword [0x51a33a42]
xor dword ds:[ecx + 0x3131e259], esp
cmp eax, dword [edi - 0x42]
dec esp
xor dword [ecx], esi
xor ah, byte [eax + 0x3b3131b2]
rdtsc
or eax, 0x45353433
pop ecx
push edi
aaa
xor dword [edi], esi
aaa
cmp eax, 0x353fa039
xor dword [ebx], edi
push esi
pop esi
xor eax, 0x365c4557
pop ecx
push edi
inc ebp
pop esp
pop ecx
loopne 0x42fb96
xor dword [esp + eax*2 + 0x35], ebx
cmp dword [eax + 0x3b3131f4], esp
inc esp
cmp eax, 0xbd473d43
xchg ecx, eax
xor dword [ecx], esi
xor ch, byte [edi]
inc edi
xchg ecx, eax
xor dword [ecx], esi
xor ah, byte [eax + 0x3b313548]
pop ebp
push 0x42
xor eax, 0x3131fb59
cmp ebx, dword [ebp + 0x61]
xor esi, dword [esi + 0x31375859]
aaa
push esi
pop esi
xor eax, 0x365c4557
pop ecx
add dword [esi], esi
xor dword [ebx], edi
inc esp
xor eax, 0xfb593542
xor dword [ecx], esi
cmp ebx, dword [esi + 0x42]
cmp dword [eax - 0x42], ecx
inc eax
xor esi, dword [ecx]
xor dl, byte [esi + 0x47]
inc edx
xor eax, 0x3602a0d3
xor dword [ebx], edi
cmp dword [eax + 0x3b3131f4], esp
inc esp
cmp eax, 0xbd4a3d43
xchg ecx, eax
xor dword [ecx], esi
xor ch, byte [edi]
inc edi
xchg ecx, eax
xor dword [ecx], esi
xor ah, byte [eax + 0x3b313548]
pop ebp
push eax
inc edx
xor eax, 0x3131fb59
cmp ebx, dword [esi + 0x47]
inc edx
xor eax, 0x3134eaaf
xor eax, 0x32dc594c
xor dword [ebx], edi
pop ebp
cmp byte [ecx], bh
dec ebx
mov al, byte [0x3b313542]
cmp dword [ebx + 0x31], ebx
xor dword [edx], esi
xor dword gs:[ecx], esi
xor esi, dword [ecx]
arpl word [edx], si
cmp ebp, dword [ebp + 0x32]
cmp eax, 0x31313131
xor esi, dword [ecx]
invalid