joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x404b19
pop dword [ebp - 0x2c]
mov eax, 0x404b19
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xffc8e79f
sub dword [ebp - 0x3c], 0xb176a254
mov dword [ebp - 0x38], 0xb8640321
add dword [ebp - 0x38], 0x79cf4924
mov dword [ebp - 0x34], 0x3adb4326
sub dword [ebp - 0x34], 0xee8efef8
mov dword [ebp - 0x30], 0x8f08c604
add dword [ebp - 0x30], 0x70f739fc
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x895fec7e
add dword [ebp - 0x3c], 0xeb127cd8
mov dword [ebp - 0x38], 0x4f94cd10
sub dword [ebp - 0x38], 0xe286b9b
mov dword [ebp - 0x34], 0x1d8c9d2a
add dword [ebp - 0x34], 0x45e2cf42
mov dword [ebp - 0x30], 0xa2a7aba2
add dword [ebp - 0x30], 0x5d58545e
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x32b30
push 0
call eax
mov ecx, 0x4ed6661c
sub ecx, 0x4ed62ef1
mov edx, eax
mov esi, 0x42f600
add esi, dword [ebp - 0x2c]
mov ebx, 0xf66ffcfb
sub ebx, 0x58a42671
sub dword [ebp - 0xc], ebx
mov edi, dword [esi]
xor dword [ebp - 0x18], eax
sub edi, ebx
add dword [ebp - 8], 0x2a463d79
mov dword [edx], edi
xor dword [ebp - 0xc], ecx
add edx, 0xbddb224e
sub edx, 0xbddb224a
add esi, 0xe189e2a4
sub esi, 0xe189e2a0
loop 0x404c26
add eax, 0xcf7f
mov ebx, eax
add eax, 5
mov ecx, 0xd5318e42
add ecx, 0x2b0e71be
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0xed066c
Capabilities:
Encode data using xor

Disassembly:
out 0x4f, al
dec ecx
outsb dx, byte [esi]
int1
js 0xed06b4
jmp 0xed0676
pushal
call 0xed067c
pop ebp
sub ebp, 0x10
sub ebp, 0xad066c
jmp 0xed0692
or al, 0x9a
mov eax, 0xad066c
mov eax, 0xad066c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0xf0bbbc6a
add byte [edx - 0xf444396], bh
xor byte [eax], dl
inc eax
dec ecx
jne 0xed06a9
jmp 0xed06bc
add al, 0
add byte [eax], al
mov ebx, dword [edx]
fist dword [edx - 0x1c1e581f]
loope 0xed0665
loope 0xed06a3
push esi
push 0x6a
push 0xffffffffffffffeb
stosd dword es:[edi], eax
xchg edx, eax
push 0x6a
push 0x69
cmpsd dword [esi], dword es:[edi]
shr byte [edi + 0x6a], cl
push 0x6a
rol byte [edx + 0x6a], 1
push 0x6a
popfd
mov byte [ecx - 0x5e], ch
loope 0xed06c7
push 0x6a
push 0x69
scasd eax, dword es:[edi]
cmp bh, byte [edx]
add al, byte [edx + 0x2c]
dec edx
push 2
stosb byte es:[edi], al
out 0x6a, al
imul eax, dword [esi + 0x4e], 2
sti
xor al, 0x72
and al, byte [edx + 0x6a6a6a6f]
sbb dword [esi + 0x6a], 0x6a
push 0xffffffffffffff83
pop esi
push 0x6a
push 0xffffffffffffffe7
push cs
dec esi
xchg esi, eax
jecxz 0xed074c
dec esi
loope 0xed068f
loope 0xed06fa
bound ebp, qword [edx + 0x6a]
push 0xffffffffffffffe1
jmp dword [esi + 0x6a]
stosd dword es:[edi], eax
sub dword [eax + 0x5b], 0x68
jmp 0x661075cd
inc esi
dec esi
out 0xe, eax
push cs
dec esi
xchg esi, eax
jecxz 0xed07b4
dec esi
sub byte [edi + 0x6a], 0x6a
push 0xffffffffffffff83
cmp ebp, dword [eax + 0x6a]
push 0xffffffffffffffe7
push cs
dec esi
xchg esi, eax
jecxz 0xed07a5
dec esi
aaa
xchg ebp, eax
pop ds
xchg bp, ax
pop ds
bound eax, qword [edx + 0x6a6a6a14]
loope 0xed0746
bound ebp, qword [edx + 0x6a]
push 0xffffffffffffffeb
wait
aad 0x4e
dec esp
sbb ch, bl
wait
aad 0x4e
dec esp
sbb bl, byte [ecx - 0x5d]
jmp 0xed071b
and byte [ebp - 0x12], 0x70
push 0x6a
push 0xffffffffffffffea
xchg ecx, eax
and dword [ebp - 0x12], 0x7b
push 0x6a
push 0xc
jmp 0xed0749
Function at 0x4056e0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x42c040]
xor eax, esp
mov dword [esp + 0x44], eax
push 0x40
lea eax, [esp + 4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp], 0x40
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 8]
xor ecx, esp
mov edx, dword [esp + 0xc]
call fcn.0041faf4
mov esp, ebp
pop ebp
ret

Function at 0x405730
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1214
call fcn.00420810
mov eax, dword [0x42c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1210]
mov dword [ebp - 0x1214], ecx
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x4057d9
mov ebx, dword [ebp - 0x1210]
xor esi, esi
shr ebx, 2
test ebx, ebx
je 0x4057d9
nop dword [eax]
push dword [ebp + esi*4 - 0x120c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4057d4
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x4057cd
push dword [ebp - 0x1214]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x4057ec
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jb 0x405780
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041faf4
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041faf4
mov esp, ebp
pop ebp
ret
Function at 0x408720
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1210
call fcn.00420810
mov eax, dword [0x42c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x1210]
push eax
push 0x1000
lea eax, [ebp - 0x120c]
push eax
call dword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x4087eb
mov ebx, dword [ebp - 0x1210]
xor esi, esi
shr ebx, 2
test ebx, ebx
je 0x4087eb
nop
push dword [ebp + esi*4 - 0x120c]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4087e6
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x4087df
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20c]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4087d6
test dx, dx
je 0x4087d2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4087d6
add ecx, 4
add eax, 4
test dx, dx
jne 0x4087b0
xor eax, eax
jmp 0x4087db
sbb eax, eax
or eax, 1
test eax, eax
je 0x408800
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, ebx
jb 0x408770
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041faf4
mov esp, ebp
pop ebp
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041faf4
mov esp, ebp
pop ebp
ret 4

Function at 0x40a7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421370
mov eax, dword fs:[0]
push eax
sub esp, 0x414
mov eax, dword [0x42c040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0x400
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x410]
push 0
push eax
mov dword [ebp - 0x418], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x414], 0x400
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a90a
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40a8fe
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x410]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x40a8d0
test dl, dl
je 0x40a8cc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x40a8d0
add eax, 2
add ecx, 2
test dl, dl
jne 0x40a8b0
xor eax, eax
jmp 0x40a8d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40a8fe
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
mov dword [ebp - 4], 0
push eax
call fcn.0040d3d0
inc dword [eax]
mov eax, dword [ebx]
inc byte [eax]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041faf4
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40df70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
sar esi, 1
add esi, esi
je 0x40dfa1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40df90
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x40e1c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x40e1f1
nop dword [eax]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x40e1e0
pop edi
mov eax, edx
pop esi
pop ebp
ret 8

Function at 0x40eee0
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4222b4
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x42c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 0xa8
mov dword [ebp - 0x10], edi
call fcn.0041fb07
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
movups xmmword [esi + 0x18], xmm0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0xf
mov byte [esi + 0x18], 0
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0xf
mov byte [esi + 0x30], 0
movups xmmword [esi + 0x48], xmm0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0xf
mov byte [esi + 0x48], 0
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0xf
mov byte [esi + 0x60], 0
movups xmmword [esi + 0x78], xmm0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0xf
mov byte [esi + 0x78], 0
movups xmmword [esi + 0x90], xmm0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0xf
mov byte [esi + 0x90], 0
push 0
push 0
push 0
push 0x52534d42
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov dword [edi], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422543
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x42c040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
lea edx, [edi + 0x40]
mov dword [edx], 0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x20]
mov byte [ebp - 4], 2
mov dword [edi + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x5c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x58], esi
mov dword [edi + 0x60], ecx
mov byte [edi + 0x64], 0
mov dword [edi + 0x68], eax
test byte [esi + 8], 8
je 0x41117b
test cl, 0x10
jne 0x41117b
mov al, 1
jmp 0x41117d
xor al, al
mov byte [edi + 0x6c], al
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x70], eax
mov ebx, dword [edx + 4]
mov ecx, ebx
mov esi, dword [esi + 0x18]
sar ecx, 3
cmp esi, ecx
jae 0x4111a1
lea ecx, [esi*8]
mov dword [edx + 4], ecx
jmp 0x4111d3
jbe 0x4111d3
mov eax, dword [edx + 8]
sar eax, 3
cmp esi, eax
jbe 0x4111b8
push ecx
push esi
mov ecx, edx
call fcn.00414c40
jmp 0x4111d3
sub esi, ecx
je 0x4111d0
shl esi, 3
push esi
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [edi + 0x40]
add ebx, esi
mov dword [edx + 4], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x41df60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41df84
push eax
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0xec]
push edi
mov edi, dword [ebp + 0xc]
add eax, edi
cmp eax, dword [esi + 0xe8]
jle 0x41dfe3
push ebx
lea ebx, [eax + eax]
push ebx
call fcn.0041feab
push dword [esi + 0xec]
mov dword [ebp + 0xc], eax
push dword [esi + 0xd0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0xd0]
lea eax, [esi + 0xd4]
add esp, 0x10
cmp ecx, eax
je 0x41dfd3
push ecx
call fcn.0041fb02
add esp, 4
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xd0], eax
pop ebx
mov eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xd0]
add ecx, eax
add eax, edi
push edi
push dword [ebp + 8]
mov dword [esi + 0xec], eax
lea esi, [ecx - 1]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [esi + edi], 0
pop edi
pop esi
pop ebp
ret 8

Function at 0x4205ff
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42063e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42063e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42063e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42063e
cmp dword [ecx + 0x74], 0xe
jbe 0x42063e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401977
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x800
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x58ced85
jg 0x40199d
inc edi
cmp edi, 0x1f6502b1
jl 0x401983
cmp dword [0x281eac4], 0x400
jne 0x4019e6
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push esi
push esi
call fcn.00401de1
push esi
call fcn.00401f57
push esi
call fcn.00401f66
add esp, 0x10
xor edi, edi
cmp edi, 0xd09a
jge 0x4019f7
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp edi, 0xd2ced2
jg 0x401a1f
inc edi
cmp edi, 0x263ff
jl 0x4019e8
mov eax, dword [0x430c14]
mov dword [0x281eac4], eax
call fcn.004016ec
mov edi, 0x3078f
cmp dword [0x281eac4], 0x51f
jne 0x401a4b
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x401a33
pop edi
xor eax, eax
pop esi
add esp, 0x800
ret 0x10
Function at 0x404f9b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x430a80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403353
and dword [ebp - 0x14], 0
cmp dword [0x43b784], 0
mov dword [ebp - 0x18], eax
jne 0x40504e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4050f6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4050f6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x43b784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43b788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x43b78c], eax
call edi
push eax
call esi
mov dword [0x43b794], eax
test eax, eax
je 0x40504e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x43b790], eax
mov eax, dword [0x43b790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4050a7
cmp dword [0x43b794], ecx
je 0x4050a7
push eax
call esi
push dword [0x43b794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4050a7
test ebx, ebx
je 0x4050a7
call edi
test eax, eax
je 0x40509e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40509e
test byte [ebp - 8], 1
jne 0x4050a7
or dword [ebp + 0x10], 0x200000
jmp 0x4050da
mov eax, dword [0x43b788]
cmp eax, dword [ebp - 0x18]
je 0x4050da
push eax
call esi
test eax, eax
je 0x4050da
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4050da
mov eax, dword [0x43b78c]
cmp eax, dword [ebp - 0x18]
je 0x4050da
push eax
call esi
test eax, eax
je 0x4050da
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x43b784]
call esi
test eax, eax
je 0x4050f6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4050f8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405306
leave
ret

Function at 0x405306
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430a80]
jne 0x405310
repz ret
jmp fcn.004060bf
Function at 0xca0758
Capabilities:
Encode data using xor

Disassembly:
jmp 0xca0762
pushal
call 0xca0768
pop ebp
sub ebp, 0x10
sub ebp, 0x8a0758
jmp 0xca077e
mov eax, 0x8a0758
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b4
mov edx, 0x8cf41544
xor byte [eax], dl
inc eax
dec ecx
jne 0xca0795
jmp 0xca07a8
iretd

Function at 0x404fdf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x404fee
pop dword [ebp - 0x44]
mov eax, 0x404fee
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xd09c30a0
sub dword [ebp - 0x54], 0x8249eb55
mov dword [ebp - 0x50], 0x583b1d73
sub dword [ebp - 0x50], 0x2607d12e
mov dword [ebp - 0x4c], 0xfe9a181e
sub dword [ebp - 0x4c], 0xb24dd3f0
mov dword [ebp - 0x48], 0x6f1aa91c
add dword [ebp - 0x48], 0x90e556e4
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x8023c393
sub dword [ebp - 0x54], 0xbb15a3d
mov dword [ebp - 0x50], 0x9d1e4c88
sub dword [ebp - 0x50], 0x5bb1eb13
mov dword [ebp - 0x4c], 0x400062e1
add dword [ebp - 0x4c], 0x236f098b
mov dword [ebp - 0x48], 0x3ec34d0b
add dword [ebp - 0x48], 0xc13cb2f5
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x5a4f415f
add eax, 0xa5f15eb5
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39717
push 0
call eax
mov ecx, 0x754ae4f7
add ecx, 0x8ab5659e
xor ebx, ebx
add ebx, eax
mov edi, 0x43be00
add edi, dword [ebp - 0x44]
mov edx, 0x15be9b6
add edx, 0xdd996bf5
mov dword [ebp - 0x18], 0xda43578c
mov esi, dword [edi]
sub dword [ebp - 0x24], 0x9c7b35fe
xor esi, edx
xor dword [ebp - 8], 0x29631a2f
mov dword [ebx], esi
sub dword [ebp - 0x3c], 0xca6c1a3a
add ebx, 0x61b6fc5c
sub ebx, 0x61b6fc58
add edi, 0x4050df3a
sub edi, 0x4050df36
loop 0x405102
add eax, 0x11d27
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x6fd6a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x29b000]
push edi
or ebp, 0xffffffff
jmp 0x6fd6c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6fd6c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd6b8
mov eax, 1
add ebx, ebx
jne 0x6fd6db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6fd6ec
jne 0x6fd70b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd70b
dec eax
add ebx, ebx
jne 0x6fd6f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6fd6d0
add ebx, ebx
jne 0x6fd707
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6fd75d
xor ecx, ecx
sub eax, 3
jb 0x6fd723
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6fd792
sar eax, 1
mov ebp, eax
jmp 0x6fd72e
add ebx, ebx
jne 0x6fd72e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd6fc
inc ecx
add ebx, ebx
jne 0x6fd73c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fd6fc
add ebx, ebx
jne 0x6fd749
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6fd73e
jne 0x6fd75a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6fd73e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6fd77c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6fd76e
jmp 0x6fd6be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6fd77c
add edi, ecx
jmp 0x6fd6be
pop esi
mov edi, esi
mov ecx, 0x5a56
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6fd79a
cmp byte [edi], 0x27
jne 0x6fd79a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6fd79f
lea edi, [esi + 0x2fa000]
mov eax, dword [edi]
or eax, eax
je 0x6fd80e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x30b548]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x30b674]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6fd7cc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x30b678]
or eax, eax
je 0x6fd808
mov dword [ebx], eax
add ebx, 4
jmp 0x6fd7e9
call dword [esi + 0x30b688]
mov ebp, dword [esi + 0x30b67c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6fd842
sub esp, 0xffffff80
jmp 0x4f2598