joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408816
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x426cdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004059e1
and dword [ebp - 0x14], 0
cmp dword [0x434418], 0
mov dword [ebp - 0x18], eax
jne 0x4088c9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408971
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408971
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x434418], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43441c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x434420], eax
call edi
push eax
call esi
mov dword [0x434428], eax
test eax, eax
je 0x4088c9
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x434424], eax
mov eax, dword [0x434424]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408922
cmp dword [0x434428], ecx
je 0x408922
push eax
call esi
push dword [0x434428]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408922
test ebx, ebx
je 0x408922
call edi
test eax, eax
je 0x408919
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408919
test byte [ebp - 8], 1
jne 0x408922
or dword [ebp + 0x10], 0x200000
jmp 0x408955
mov eax, dword [0x43441c]
cmp eax, dword [ebp - 0x18]
je 0x408955
push eax
call esi
test eax, eax
je 0x408955
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x408955
mov eax, dword [0x434420]
cmp eax, dword [ebp - 0x18]
je 0x408955
push eax
call esi
test eax, eax
je 0x408955
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x434418]
call esi
test eax, eax
je 0x408971
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408973
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004075c1
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x9d1cef
Capabilities:
Execute anti-debugging instructions

Disassembly:
test bx, ax
test eax, eax
pushfd
pushfd
jmp 0x9d9d26
lea esp, [esp + 0x2c]
je 0x9d6abb
and cl, 0xb5
cmc
mov dword [ebp - 0x90], eax
pushfd
bt bp, bx
lea eax, [ebp - 0xc]
sar dx, 9
cmc
pushal
rcl edx, 0xa
mov dword [esp + 0x20], eax
mov dl, ah
ror dl, 3
mov ecx, dword [ebp - 0x90]
test ah, ch
mov dword [esp + 0x1c], ecx
rol dh, cl
btc dx, 4
mov dword [esp + 0x18], 0
call fcn.009d79a1

Function at 0x9d23c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 8], edx
call fcn.009dc3b0

Function at 0x9d23d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub edx, edx
btc dx, si
mov dx, word [ecx + 0x10]
test cx, 0x43b8
bt esi, ecx
cmp bh, ch
push dword [esp]
cmp edx, 0x2e
jmp 0x9db5f2
lea esp, [esp + 8]
jne 0x9d949a
btc cx, 1
mov eax, dword [ebp - 0x104]
bts cx, ax
mov ecx, dword [eax + 0x30]
cmc
xor edx, edx
movzx dx, cl
mov dx, word [ecx + 0x12]
pushfd
cmp edx, 0x64
push 0x8aed3c7f
pushal
pushfd
call fcn.009d6715

Function at 0x9d41ed
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
clc
cmc
and edx, 4
pushal
jmp 0x9d5a0d

Function at 0x9d6f45
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.009d41fd
push 0x876d347e
mov dword [esp + 0x34], 0x3000
jmp 0x9d1cea

Function at 0x9d6f57
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x28]
jb 0x9d21d9
btc cx, 7
movsx cx, cl
rol ecx, cl
mov ecx, dword [ebp - 0xf8]
cmp cx, 0xcce7
pushal
jmp 0x9d2173

Function at 0x9d750b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0x50], edx
pop edx
movsx dx, cl
movzx dx, al
mov edx, dword [ebp - 0x34]
push dword [esp + 8]
jmp 0x9db431
mov byte [esp + 4], 0xfd
mov dword [esp + 0x4c], 0x9d23fd
call fcn.009ddfc5

Function at 0x9d80a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0xf4]
push esp
stc
add edx, 0xc
push 0xe37915bf
cmp dword [ebp - 0xfc], edx
mov byte [esp + 4], al
pushfd
push 0x7fdda343
lea esp, [esp + 0x38]
je 0x9d55c5
bt si, 7
aam 0x6e
stc
dec edx
mov eax, dword [ebp - 0xfc]
shld dx, dx, 0xa
test ch, al
mov dword [ebp - 0x100], eax
setb ch
jmp 0x9da167
xadd ch, dh
mov ecx, dword [ebp - 0x100]
inc dl
btr dx, sp
lea edx, [ecx*8 - 0x7ec1c873]
btc dx, si
mov edx, dword [ecx + 0x34]
call fcn.009d41ed
Function at 0x9d887e
Capabilities:
Execute anti-debugging instructions

Disassembly:
clc
cmc
xor edx, edx
rcl dh, 3
mov dx, word [ecx + 0x16]
cmp dh, al
cmp edx, 0x6c
mov byte [esp], bh
mov word [esp], 0x47f3
lea esp, [esp + 4]
je 0x9d1906
seto al
or ch, cl
or cl, 0x98
daa
mov eax, dword [ebp - 0x104]
xor ch, 0xba
stc
bsr ecx, esi
mov ecx, dword [eax + 0x30]
pushfd
pushfd
sub edx, edx
cmc
mov byte [esp], 5
clc
mov dx, word [ecx + 0x16]
push ecx
cmp edx, 0x4c
pushfd
push ecx
jmp 0x9d8606
jmp 0x9ddbfb
cmp edx, 0x4c
mov word [esp], ax
pushal
lea esp, [esp + 0x30]
jg 0x9d41f8
jne 0x9d949a
shld ax, bx, cl
call fcn.009d2f2c
pushal
push 0x6781185b
pushal
lea esp, [esp + 0x44]
jne 0x9d949a
btr cx, 3
cwde
mov eax, dword [ebp - 0x104]
bsr cx, cx
sub cx, sp
push ecx
mov ecx, dword [eax + 0x30]
jmp 0x9d3a17

Function at 0x9d8ce9
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
lea esp, [esp + 4]
je 0x9d356c
cmc
mov eax, dword [ebp - 0x100]
bswap ecx
inc ch
mov ecx, dword [eax + 0x30]
test esi, edx
sub edx, edx
rcl dh, cl
bts dx, 2
rcl dl, cl
neg dl
mov dx, word [ecx + 4]
cmc
pushal
clc
push 0xab8c58c9
cmp edx, 0x44
push dword [esp + 0xc]
pushfd
jmp 0x9d55f9
btr eax, 0x18
bsr ecx, ebp
pushfd
mov eax, dword [ebp - 0x100]
sbb ch, ch
stc
pushal
mov ecx, dword [eax + 0x30]
test dl, 0xee
xor edx, edx
sar dx, 0xb
cmp bx, 0x4d0c
mov dx, word [ecx + 6]
cmc
sub esp, 0xffffffdc
js 0x9db329
cmp edx, 0x6c
pushfd
lea esp, [esp + 4]
je 0x9d7818
das
mov eax, dword [ebp - 0x100]
jmp 0x9daf63
mov ecx, dword [eax + 0x30]
clc
pushfd
sub edx, edx
inc dl
sbb dh, 0x8e
mov dx, word [ecx + 4]
cmc
pushfd
bt di, si
clc
cmp edx, 0x64
lea esp, [esp + 0xc]
jae 0x9d3032
call fcn.009d9915
adc cx, 0x4391
mov ecx, dword [eax + 0x30]
push ebp
xor edx, edx
bsf dx, di
setne dh
mov dx, word [ecx + 6]
bt ebp, 3
stc
cmp edx, 0x4c
mov byte [esp], bl
call fcn.009da5f4
stc
cmp edx, 0x6c
call fcn.009d5d02

Function at 0x9d9f94
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x10001005
call fcn.009d750b
cmp eax, esi
or bl, 0x9e
shr bh, cl
add edx, 0x1000106e
xor bh, bh
or bx, 0xb969
stc
mov ebx, dword [edx]
ror dh, 3
shr dl, cl
xor dl, 0x8d
stc
mov dword [ebp - 0x10], ebx
bsf bx, ax
mov edx, dword [ebp - 0xac]
rol bl, 5
xor bl, 0x48
add edx, 0x10001072
dec bx
mov ebx, dword [edx]
btr edx, eax
shr dl, 3
mov dword [ebp - 0x18], ebx
shrd dx, cx, 2
clc
neg bx
mov edx, dword [ebp - 0xac]
sal ebx, 0x11
adc bl, 0x94
add edx, 0x10001076
sbb bh, 0x57
pop ebx
sal bh, cl
pop ebx
mov ebx, dword [edx]
clc
add dl, dl
movsx dx, dl
add ebx, dword [ebp - 0x50]
bsf edx, ebp
mov dword [ebp - 0x2c], ebx
movsx dx, al
pushfd
movsx dx, al
bt cx, 2
mov edx, dword [ebp - 0xac]
pushfd
test bl, dh
jmp 0x9d23ce

Function at 0x9da3c4
Capabilities:
Access peb ldr_data

Disassembly:
mov word [esp], sp
mov byte [esp], al
lea esp, [esp + 0x28]
je 0x9d3f6d
movzx edx, bl
bsf cx, ax
adc dx, 0xfc78
mov eax, dword fs:[0x30]
ror ch, 1
sar dl, 1
rcr ch, cl
inc ecx
mov eax, dword [eax + 0xc]
rcl dh, cl
jmp 0x9dada7
Function at 0x9db332
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x48]
jb 0x9d2c03
cmp dword [ebp - 0x108], edx
mov word [esp], 0x94d1
push ebx
lea esp, [esp + 0x30]
je 0x9d2c03
rcr al, cl
mov eax, dword [ebp - 0x108]
clc
cmp eax, dword [ebp - 0xf8]
pushfd
push dword [esp]
push esi
jmp 0x9db443
lea esp, [esp + 0xc]
jb 0x9d21d9
shld cx, ax, 4
mov ecx, dword [ebp - 0xf8]
cmp ch, dl
pushal
bt esp, 0x13
add ecx, dword [ebp - 0xf0]
pushal
cmp dl, 0xa5
cmp dword [ebp - 0x108], ecx
push dword [esp + 0xc]
push 0x826728dc
jmp 0x9d21cf

Function at 0x9dbdcf
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp], 0x2f9b8607
mov word [esp], 0x449e
lea esp, [esp + 0x28]
jne 0x9db5ec
movzx cx, bl
mov eax, dword [ebp - 0x124]
not cx

Function at 0x9dbe0a
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x14]
je 0x9db5c7
pushal
mov eax, dword [ebp - 0x124]
ror cl, 6
btc ecx, 2
shl ecx, cl
cmp ch, dh
mov ecx, dword [ebp - 0x9c]
clc
xor edx, edx
bswap dx
bswap dx
mov dx, word [ecx + eax*2]
test ch, 0x20
call fcn.009ddbf3

Function at 0x9dc4fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, dword [ebp - 0xb4]
call fcn.009d3d87

Function at 0x9dc54f
Capabilities:
Authenticate hmac

Disassembly:
xor eax, eax
adc al, 0x54
mov al, byte [edx + 6]
pushal
cmc
cmc
cmp eax, 0x2e
push 0xa3959c9a
lea esp, [esp + 0x28]
js 0x9da065
jne 0x9dcc7a
shld cx, sp, cl
mov ecx, ebp
mov ecx, dword [ebp - 0x44]
jmp 0x9db2fa
call fcn.009dab81
cmp ecx, 0x2e
mov byte [esp + 4], 0x7a
lea esp, [esp + 8]
je 0x9d47e4
cmp bx, bp
or dl, 0xb8
btr dx, sp
mov edx, dword [ebp - 0x44]
cmp bp, si
push 0x6b792c5b
mov byte [esp], 0x76
jmp 0x9d7dda

Function at 0x9dc5a7
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x28]
jne 0x9d98d1
stc
call fcn.009d933c
cmp edx, 0x4c
pushal
push edx
mov byte [esp + 8], 8
jmp 0x9d2725

Function at 0x9dc9c3
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
pushal
lea esp, [esp + 0x24]
jne 0x9d98d1
call fcn.009dd5b4
push edi
jmp 0x9d2f84
lea esp, [esp + 0xc]
jg 0x9d6dde
jne 0x9d98d1

Function at 0x9dcca1
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [ecx]
pushfd
mov dword [ebp - 0xfc], edx
push 0x9c8948af
pushal
mov word [esp], 0x8f52
pushfd
lea esp, [esp + 0x34]
jmp 0x9d232e

Function at 0x9dd208
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
mov ecx, dword [eax + 0x30]
push 0xba9643de
pushal
bt dx, si
cmp bh, dl
sub edx, edx
setge dl
dec dh
push ebp
mov dx, word [ecx + 4]
test ebx, edi
stc
cmp edx, 0x44
push 0x19ce71fa
mov word [esp + 0x14], 0xbcec
push esp
mov dword [esp], 0xfd935b40
lea esp, [esp + 0x30]
jne 0x9d98d1
lea esp, [esp + 8]
je 0x9d356c
shld ax, cx, 4
bts eax, 0x1d
mov eax, dword [ebp - 0x100]
ror cl, 6
inc ch
jmp 0x9d352c

Function at 0x9dd5b4
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov eax, dword [ebp - 0x100]
adc ch, ah
push 0x864c6269
shl ch, 2
xor ecx, 0x12511b42
mov ecx, dword [eax + 0x30]
pushfd
call fcn.009d4b2e
Function at 0x401996
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 0x20
mov eax, 1
mov dword [ebp - 0xc], 1
mov eax, 0x100
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov dword [eax], edx
jmp 0x401a3b
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x20
jne 0x401a1b
mov al, 0
xchg edx, eax
mov esi, dword [ebp - 0x1c]
mov byte [esi], dl
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x20
je 0x4019e4
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0
jne 0x401a06
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
jmp 0x401a1b
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0xc]
dec edi
mov dword [eax + edi*4], edx
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x22
jne 0x401a34
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0x22
jne 0x401a24
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x1c]
mov al, byte [esi]
cmp al, 0
jne 0x4019d3
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [0x40401c]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0xc]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x14]
xchg edx, eax
mov eax, dword [0x40401c]
mov dword [eax + 4], edx
mov eax, 0
xchg edx, eax
mov eax, dword [0x40401c]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x14]
xchg edx, eax
mov eax, dword [0x404048]
mov dword [eax], edx
leave
ret
Function at 0x401c8a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
sub esp, 4
mov eax, 0
mov edx, dword [ebp + 8]
cmp eax, edx
je 0x401ca2
xor eax, eax
jmp 0x401ca5
xor eax, eax
inc eax
xor al, 1
cmp eax, 0
je 0x402050
push 0
push 0x40422c
push 6
push 0
push dword [ebp + 8]
push 2
push 0
push 0x40422f
push 6
push 0
push dword [0x404016]
push 3
push 0x30
lea esi, [esp + 4]
push esi
push 4
call fcn.00401c47
mov eax, dword [ebp + 8]
cmp eax, 1
je 0x401ea8
cmp eax, 2
je 0x401eb2
cmp eax, 3
je 0x401ebc
cmp eax, 4
je 0x401ec6
cmp eax, 5
je 0x401ed0
cmp eax, 6
je 0x401eda
cmp eax, 7
je 0x401ee4
cmp eax, 8
je 0x401eee
cmp eax, 9
je 0x401ef8
cmp eax, 0xa
je 0x401f02
cmp eax, 0xb
je 0x401f0c
cmp eax, 0xc
je 0x401f16
cmp eax, 0xd
je 0x401f20
cmp eax, 0xe
je 0x401f2a
cmp eax, 0xf
je 0x401f34
cmp eax, 0x10
je 0x401f3e
cmp eax, 0x11
je 0x401f48
cmp eax, 0x12
je 0x401f52
cmp eax, 0x13
je 0x401f5c
cmp eax, 0x14
je 0x401f66
cmp eax, 0x15
je 0x401f70
cmp eax, 0x16
je 0x401f7a
cmp eax, 0x17
je 0x401f81
cmp eax, 0x18
je 0x401f88
cmp eax, 0x19
je 0x401f8f
cmp eax, 0x1a
je 0x401f96
cmp eax, 0x1b
je 0x401f9d
cmp eax, 0x1c
je 0x401fa4
cmp eax, 0x1d
je 0x401fab
cmp eax, 0x1e
je 0x401fb2
cmp eax, 0x1f
je 0x401fb9
cmp eax, 0x20
je 0x401fc0
cmp eax, 0x21
je 0x401fc7
cmp eax, 0x22
je 0x401fce
cmp eax, 0x60
je 0x401fd5
cmp eax, 0x61
je 0x401fdc
cmp eax, 0x62
je 0x401fe3
cmp eax, 0x63
je 0x401fea
cmp eax, 0x64
je 0x401ff1
cmp eax, 0x65
je 0x401ff8
mov eax, 0x404562
jmp 0x401ffd
mov eax, 0x404242
jmp 0x401ffd
mov eax, 0x404253
jmp 0x401ffd
mov eax, 0x404265
jmp 0x401ffd
mov eax, 0x404270
jmp 0x401ffd
mov eax, 0x40427c
jmp 0x401ffd
mov eax, 0x40428c
jmp 0x401ffd
mov eax, 0x4042a2
jmp 0x401ffd
mov eax, 0x4042b7
jmp 0x401ffd
mov eax, 0x4042cc
jmp 0x401ffd
mov eax, 0x4042e4
jmp 0x401ffd
mov eax, 0x4042f3
jmp 0x401ffd
mov eax, 0x404305
jmp 0x401ffd
mov eax, 0x404315
jmp 0x401ffd
mov eax, 0x40432c
jmp 0x401ffd
mov eax, 0x40433d
jmp 0x401ffd
mov eax, 0x404354
jmp 0x401ffd
mov eax, 0x40436c
jmp 0x401ffd
mov eax, 0x404380
jmp 0x401ffd
mov eax, 0x40439a
jmp 0x401ffd
mov eax, 0x4043b2
jmp 0x401ffd
mov eax, 0x4043c6
jmp 0x401ffd
mov eax, 0x4043d1
jmp 0x401ffd
mov eax, 0x4043e0
jmp 0x401ffd
mov eax, 0x4043f0
jmp 0x401ffd
mov eax, 0x404408
jmp 0x401ffd
mov eax, 0x404415
jmp 0x401ffd
mov eax, 0x404427
jmp 0x401ffd
mov eax, 0x404445
jmp 0x401ffd
mov eax, 0x404464
jmp 0x401ffd
mov eax, 0x404486
jmp 0x401ffd
mov eax, 0x4044a8
jmp 0x401ffd
mov eax, 0x4044bc
jmp 0x401ffd
mov eax, 0x4044cf
jmp 0x401ffd
mov eax, 0x4044d9
jmp 0x401ffd
mov eax, 0x4044e3
jmp 0x401ffd
mov eax, 0x404501
jmp 0x401ffd
mov eax, 0x40450f
jmp 0x401ffd
mov eax, 0x404520
jmp 0x401ffd
mov eax, 0x40452e
jmp 0x401ffd
mov eax, 0x404547
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.00401c47
push 0
push dword [0x404016]
push 3
push 0
push 0x404576
push 6
push 0
push dword [ebp + 0xc]
push 7
push 0
push 0x404578
push 6
push 0
push dword [0x404016]
push 3
push 0x3c
lea esi, [esp + 4]
push esi
push 5
call fcn.00401c47
call fcn.00401a93
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
leave
ret 8
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x358a01af
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x52435572
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x405720
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x546204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x800
lea eax, [ebp - 0x804]
mov ebx, ecx
push 0
push eax
call fcn.00470310
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.SmartChatInstaller
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x808], esi
test esi, esi
je 0x405807
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4057d4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x50a8e4
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x4057c2
push 0
push 0
push 0x1400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00445caa
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 8], eax
je 0x4057f2
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x4057ff
lea edx, [ebp - 0x808]
push edx
push eax
call fcn.00405210
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.00445caa
mov esp, ebp
pop ebp
ret