joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405460
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x43dd54]
xor eax, esp
mov dword [esp + 0x228], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx + 4]
push edi
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
or esi, 0x2001f
push esi
push ebx
push edx
push eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
mov edi, eax
cmp edi, ebx
jne 0x4054df
xor eax, eax
cmp ecx, ebx
je 0x4054c7
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
and esi, 0x300
mov edi, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp eax, ebx
je 0x405503
cmp ecx, ebx
je 0x4054ea
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00419eb3
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x44]
push edx
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
jne 0x40556a
jmp 0x405530
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00405460
mov edi, eax
cmp edi, ebx
jne 0x4055b9
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x44]
push eax
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
je 0x405530
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40557d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov dword [esp + 0x18], ebx
call fcn.00404690
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4055a0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00419eb3
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4055c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x234]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00419eb3
mov esp, ebp
pop ebp
ret 4
Function at 0x405b70
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
sub esp, 0x20c
mov eax, dword [0x43dd54]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [0x43fb6c]
push esi
push 0xa
push 2
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x405bb1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00419eb3
add esp, 0x20c
ret
mov ecx, dword [0x43fb6c]
push edi
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x405bdd
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00419eb3
add esp, 0x20c
ret
movzx edx, word [0x43f428]
push edx
call fcn.0041bcf3
sub eax, 0x40
push eax
call fcn.0041bb3b
add esp, 8
push 0x43f428
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov eax, dword [0x43fb6c]
push esi
push eax
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push str.hsdiafwiuera
push eax
push edi
call fcn.00404230
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
mov dword [esp + 0x20], ecx
call fcn.00403ef0
add esp, 0x14
cmp eax, 1
jne 0x405c69
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.00405110
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00403ef0
add esp, 0x10
cmp eax, 1
je 0x405c46
mov ecx, dword [esp + 0x210]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00419eb3
add esp, 0x20c
ret
Function at 0x407970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42dc7b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x43dd54]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 8]
mov dword [esi + 4], 0
call fcn.0040dcad
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], 0
call fcn.0040dcad
mov dword [esi + 0x30], 0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x408c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x42e190
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x43dd54]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov edi, dword [ebp + 0x414]
mov ebx, dword [ebp + 0x418]
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp], edx
push 2
push edx
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
jne 0x408d12
call fcn.00404590
mov edi, eax
jmp 0x408dfc
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x408d2b
call fcn.00404590
jmp 0x408df3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
test ebx, ebx
jne 0x408d46
call fcn.00404590
jmp 0x408df3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
mov dword [ebp - 0x14], edi
cmp eax, edi
jae 0x408d7c
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x408d6a
lea ecx, [ebp]
call fcn.00404f30
lea ecx, [ebp - 0x18]
call fcn.00404ed0
mov eax, 0x8007000e
jmp 0x408e12
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00406290
mov dword [ebp - 4], 1
jmp 0x408db0
mov eax, dword [ebp]
test eax, eax
jne 0x408dbe
mov edi, 0x8007000e
jmp 0x408df5
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x408dd7
call fcn.00404590
jmp 0x408df3
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x41c]
mov ecx, dword [ebp]
push eax
push ecx
lea ecx, [ebp - 0x28]
call fcn.00408400
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edx, [ebp + 4]
cmp dword [ebp], edx
je 0x408e10
lea ecx, [ebp]
call fcn.00404f30
lea esp, [esp]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00419eb3
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42e206
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x43dd54]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebp, ebp
lea ecx, [esi + 0x10]
mov dword [esi + 8], ebp
call fcn.0040e468
mov dword [esp + 0x20], ebp
call fcn.0040e3a5
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x409466
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x38], eax
lea edi, [esi + 0x28]
push edi
mov byte [esp + 0x24], 1
mov dword [edi], ebp
call fcn.00408bc0
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 4]
push edi
call edx
lea edi, [esi + 0x2c]
lea ebx, [esi + 0x30]
mov dword [edi], ebp
mov dword [ebx], ebp
lea ebp, [esi + 0x34]
push edi
mov dword [ebp], 0
call fcn.00406c50
push ebx
call fcn.00406c50
push ebp
call fcn.00406c50
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, dword [ebp]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
call fcn.0041bfbd
mov ecx, dword [edi]
mov dword [ecx + 8], eax
call fcn.0041bfbd
mov edx, dword [ebx]
add eax, 0x20
mov dword [edx + 8], eax
call fcn.0041bfbd
mov ecx, dword [ebp]
add eax, 0x40
mov dword [ecx + 8], eax
mov dword [esi + 0xc], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x40a360
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20c
mov eax, dword [0x43dd54]
xor eax, esp
mov dword [esp + 0x208], eax
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x40a4a7
push esi
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
call fcn.0040d8bd
mov eax, dword [eax + 8]
push 0
push eax
push 0x43c148
mov ecx, 0x440e5c
call fcn.00404d90
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x440e8c], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx eax, word [esi]
cmp ax, 0x22
jne 0x40a4be
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x40a3f7
cmp ax, 0x22
je 0x40a3f7
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x40a3e5
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x40a414
cmp ax, 0x20
jne 0x40a414
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x40a402
push 0x431630
push esi
call fcn.0041a4bf
add esp, 8
cmp eax, esi
jne 0x40a433
add esi, 0x16
mov dword [0x440e50], 1
mov edx, 0x43fe40
mov eax, esi
sub edx, esi
pop esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x40a440
call fcn.0040d8bd
mov eax, dword [eax + 8]
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a470
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 4]
push edx
mov ecx, 0x440e58
call fcn.00401790
push 1
push 4
mov ecx, 0x440e5c
call fcn.00405700
test eax, eax
jge 0x40a4eb
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00419eb3
add esp, 0x20c
ret
test ax, ax
je 0x40a414
jmp 0x40a4d0
cmp ax, 0x20
je 0x40a3fa
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x40a4d0
jmp 0x40a414
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov eax, 1
call fcn.00419eb3
add esp, 0x20c
ret
Function at 0x40a510
Capabilities:
Extract resource via kernel32 functions
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x42e37b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x43dd54]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
push edi
mov eax, dword [0x43dd54]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov eax, dword [0x43fb6c]
push 0xa
push 4
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x40a574
push str.No_Script_files_n
call fcn.0041a3ea
add esp, 4
xor eax, eax
jmp 0x40a72c
mov ecx, dword [0x43fb6c]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40a56d
movzx edx, word [0x43f220]
push edx
call fcn.0041bcf3
sub eax, 0x40
push eax
call fcn.0041bb3b
add esp, 8
push 0x43f220
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [0x43fb6c]
push edi
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push str.hsdiafwiuera
push eax
push esi
call fcn.00404230
add esp, 0xc
xor ebx, ebx
call fcn.0040e3a5
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a5f1
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x20]
push edx
lea eax, [esp + 0x18]
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x238], 0
call fcn.00403df0
add esp, 0xc
test eax, eax
je 0x40a700
lea eax, [esp + 0x20]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40a640
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
call fcn.00401790
mov esi, dword [esp + 0x10]
mov edi, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40a684
push edi
lea ecx, [esp + 0x14]
call fcn.00401670
mov esi, dword [esp + 0x10]
lea eax, [edi + 1]
push eax
push esi
call fcn.0041baf2
add esp, 8
test edi, edi
jl 0x40a753
cmp edi, dword [esi - 8]
jg 0x40a753
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
cmp dword [esi - 0xc], ecx
jl 0x40a6d0
push 0x431648
push esi
call fcn.0041a4bf
add esp, 8
test eax, eax
je 0x40a6d0
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x40a6d0
mov ebx, 1
mov edi, dword [esp + 0x14]
push ebx
push edi
call fcn.004043b0
push edi
call fcn.0040cf17
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.00403df0
add esp, 0x18
test eax, eax
jne 0x40a633
lea eax, [esi - 0x10]
mov dword [esp + 0x22c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a727
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00419eb3
add esp, 0x220
ret
push 0x80070057
call fcn.004010a0
int3
Function at 0x40b9a0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x2c
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.0040ea3f
test eax, eax
je 0x40b9cf
call fcn.0040a360
test eax, eax
jne 0x40b9e5
push str.Fatal_Error:_MFC_initialization_failed
call fcn.0041bdca
add esp, 4
mov eax, 1
add esp, 0x2c
ret
call fcn.004057c0
test eax, eax
jne 0x40ba02
push str.Corrupt_image_file_
call fcn.0041bdca
add esp, 4
push 0xffffffffffffffff
call fcn.0041c412
cmp dword [0x43f950], 0
je 0x40bab9
mov ecx, dword [0x43f95c]
mov edx, dword [0x43f958]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov eax, dword [0x43f960]
add eax, 0xfffff894
push esi
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push edi
dec ecx
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], edx
call fcn.0041a818
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
mov edi, edx
call fcn.0041a82a
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edi
push esi
push edx
push eax
call fcn.0041a520
fdiv qword [0x431a20]
add esp, 0x18
call fcn.0041c4b0
cmp eax, 0x1f
pop edi
pop esi
jle 0x40baac
push str.This_script_package_was_created_with_a_ntrial_version_of_the_SAPIEN_Script_Packager_and_is_now_expired._nPlease_re_package_with_a_licensed_version_your_SAPIEN_product.
call fcn.0041bdca
add esp, 4
push 0xffffffffffffffff
call fcn.0041c412
push str.This_script_package_was_created_with_a_ntrial_version_of_the_SAPIEN_Script_Packager.
call fcn.0041bdca
add esp, 4
call fcn.0040b100
mov eax, dword [0x440e44]
add esp, 0x2c
ret

Function at 0x419eb3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43dd54]
jne 0x419ebd
repz ret
jmp fcn.0041f5fc

Function at 0x41b5a6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41b5d7
call fcn.0041c93c
mov dword [eax], esi
call fcn.0041c929
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041dfbf
add esp, 0x14
push 0x16
pop eax
jmp 0x41b62c
test dword [ebp + 0xc], 0xfffffff9
jne 0x41b5b3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41b604
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041c94f
pop ecx
call fcn.0041c929
mov eax, dword [eax]
jmp 0x41b62c
test al, 0x10
jne 0x41b62a
test al, 1
je 0x41b62a
test byte [ebp + 0xc], 2
je 0x41b62a
call fcn.0041c93c
mov dword [eax], 5
call fcn.0041c929
mov dword [eax], 0xd
jmp 0x41b5fb
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42899a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041f080
and dword [ebp - 4], 0
cmp dword [0x4439e8], 0
mov ebx, eax
jne 0x428a4b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x428afc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x428afc
push eax
call fcn.0041f00e
mov dword [esp], 0x43546c
push edi
mov dword [0x4439e8], eax
call esi
push eax
call fcn.0041f00e
mov dword [esp], 0x435458
push edi
mov dword [0x4439ec], eax
call esi
push eax
call fcn.0041f00e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4439f0], eax
call esi
push eax
call fcn.0041f00e
pop ecx
mov dword [0x4439f8], eax
test eax, eax
je 0x428a4b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041f00e
pop ecx
mov dword [0x4439f4], eax
mov eax, dword [0x4439f4]
cmp eax, ebx
je 0x428aa3
cmp dword [0x4439f8], ebx
je 0x428aa3
push eax
call fcn.0041f089
push dword [0x4439f8]
mov esi, eax
call fcn.0041f089
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x428aa3
test edi, edi
je 0x428aa3
call esi
test eax, eax
je 0x428a9a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x428a9a
test byte [ebp - 0xc], 1
jne 0x428aa3
or dword [ebp + 0x10], 0x200000
jmp 0x428adc
mov eax, dword [0x4439ec]
cmp eax, ebx
je 0x428adc
push eax
call fcn.0041f089
pop ecx
test eax, eax
je 0x428adc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x428adc
mov eax, dword [0x4439f0]
cmp eax, ebx
je 0x428adc
push eax
call fcn.0041f089
pop ecx
test eax, eax
je 0x428adc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4439e8]
call fcn.0041f089
pop ecx
test eax, eax
je 0x428afc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x428afe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5075b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd0000]
push edi
or ebp, 0xffffffff
jmp 0x5075d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5075d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5075c8
mov eax, 1
add ebx, ebx
jne 0x5075eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5075fc
jne 0x50760c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50760c
dec eax
add ebx, ebx
jne 0x507608
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5075e0
xor ecx, ecx
sub eax, 3
jb 0x507624
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x507696
sar eax, 1
mov ebp, eax
jmp 0x50762f
add ebx, ebx
jne 0x50762f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50763c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x507660
inc ecx
add ebx, ebx
jne 0x50764c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x507641
jne 0x50765d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x507641
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x507680
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x507671
jmp 0x5075ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x507680
add edi, ecx
jmp 0x5075ce
pop esi
mov edi, esi
mov ecx, 0x67d6
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x50769e
cmp byte [edi], 0x35
jne 0x50769e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x5076a3
lea edi, [esi + 0x103000]
mov eax, dword [edi]
or eax, eax
je 0x507712
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1080b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1081a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5076d0
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1081a4]
or eax, eax
je 0x50770c
mov dword [ebx], eax
add ebx, 4
jmp 0x5076ed
call dword [esi + 0x1081a8]
popal
jmp 0x4bd3d8
Function at 0x409b10
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x446998
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4555b4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov eax, edx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], di
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x409b56
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x20]
call fcn.00403890
lea eax, [esp + 0x10]
push eax
push ebx
mov eax, esi
mov dword [esp + 0x48], edi
call fcn.00409d30
cmp dword [esp + 0x30], 8
jb 0x409b95
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00429c36
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
mov edi, dword [ebx + 4]
je 0x409ba4
cmp esi, ebx
je 0x409ba9
call fcn.0042ab0d
mov ebx, dword [esp + 0x14]
cmp ebx, edi
jne 0x409bc6
xor eax, eax
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x409bcf
call fcn.0042ab0d
cmp ebx, dword [esi + 4]
jne 0x409bd9
call fcn.0042ab0d
add ebx, 0x28
cmp dword [ebx], 0
jne 0x409be6
call fcn.00409700
mov eax, dword [ebx]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429b72
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4555b4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00429ab1
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004315d0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x429bc1
cmp dword [ebp - 0x1c], 5
jb 0x429bd9
jmp 0x429bd5
cmp dword [ebp - 0x10], 1
jne 0x429bd9
cmp dword [ebp - 0x1c], 4
ja 0x429bd5
jne 0x429bd9
cmp dword [ebp - 0x18], 0
jbe 0x429bd9
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4497b8
call fcn.00429947
test eax, eax
jge 0x429bfa
mov byte [0x458a54], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00429d78
add ebp, 0x78
leave
ret

Function at 0x429d78
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4555b4]
jne 0x429d82
repz ret
jmp fcn.004326ff