joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ab2d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.004f3bd0
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.004e6fc0
mov eax, dword [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.004f3e00
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.004f3c10
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5ab390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5d1ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.004f3bd0
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.004e6fc0
fld qword [esi + 0x10]
sub esp, 8
lea ecx, [esp + 0x20]
fstp qword [esp]
call fcn.004f3f30
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.004f3c10
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5ab480
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.004f3bd0
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.004e6fc0
movzx eax, byte [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.004f3e90
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.004f3c10
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x5ab560
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.004f3bd0
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.004e6fc0
movzx eax, word [esi + 0xc]
push eax
lea ecx, [esp + 0x1c]
call fcn.004f3fd0
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.004f3c10
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5ab5f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1ac0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
mov dword [esp + 8], vtable.wxConvAuto.0
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x38]
lea ecx, [esp + 8]
push ecx
push eax
push edx
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], eax
call fcn.004f3bd0
lea ecx, [esp + 8]
mov byte [esp + 0x30], 2
call fcn.004e6fc0
add esi, 0xc
push esi
lea ecx, [esp + 0x1c]
call fcn.004f43b0
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.004f3c10
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4

Function at 0x5ab9d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1b28
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x67ff88]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [0x5f09fc]
mov esi, dword [esp + 0x50]
push eax
push 0
mov edi, ecx
push 0x5f8280
lea ecx, [esp + 0x18]
call fcn.004cf3b0
mov dword [esp + 0x48], 0
mov dword [esp + 0x14], vtable.wxConvAuto.0
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call fcn.004f4080
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 3
call fcn.004e6fc0
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x48], 4
cmp eax, 0xffffffff
je 0x5aba7b
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5aba7b
call fcn.004ce2e0
lea ecx, [esp + 0x24]
call fcn.004f45b0
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
lea ecx, [esp + 0x24]
fstp qword [edi + 0x10]
mov dword [esp + 0x48], 0xffffffff
call fcn.004f3c30
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0057ac48
add esp, 0x40
ret 4
Function at 0x5abe50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1bb0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x67ff88]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [0x5f09fc]
mov esi, dword [esp + 0x50]
push eax
push 0
mov edi, ecx
push 0x5f8280
lea ecx, [esp + 0x18]
call fcn.004cf3b0
mov dword [esp + 0x48], 0
mov dword [esp + 0x14], vtable.wxConvAuto.0
mov dword [esp + 0x18], 0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 1
call fcn.004f4080
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 3
call fcn.004e6fc0
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x48], 4
cmp eax, 0xffffffff
je 0x5abefb
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5abefb
call fcn.004ce2e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
call fcn.004f4110
lea ecx, [edi + 0xc]
push eax
mov byte [esp + 0x4c], 5
call fcn.004cecf0
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x48], 4
cmp eax, 0xffffffff
je 0x5abf37
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5abf37
call fcn.004ce2e0
lea ecx, [esp + 0x24]
mov dword [esp + 0x48], 0xffffffff
call fcn.004f3c30
mov al, 1
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.0057ac48
add esp, 0x40
ret 4

Function at 0x5ac3f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5d1bf8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x67ff88]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x5f09fc]
push eax
push 0
push 0x5f1948
lea ecx, [esp + 0x14]
call fcn.004cf3b0
mov edx, dword [esp + 0x38]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0
call fcn.004edcb0
mov ecx, dword [esp + 8]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x30], 2
cmp eax, 0xffffffff
je 0x5ac469
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5ac469
call fcn.004ce2e0
lea ecx, [esp + 0xc]
call fcn.004edaa0
test al, al
je 0x5ac4ca
add esi, 0xc
lea esp, [esp]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x10]
call fcn.004edb80
push 1
push eax
mov ecx, esi
mov byte [esp + 0x38], 3
call fcn.004cf710
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx - 0xc]
add ecx, 0xfffffff4
mov byte [esp + 0x30], 2
cmp eax, 0xffffffff
je 0x5ac4bd
add eax, 0xffffffff
mov dword [ecx], eax
jne 0x5ac4bd
call fcn.004ce2e0
lea ecx, [esp + 0xc]
call fcn.004edaa0
test al, al
jne 0x5ac480
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.005146d0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x5b1200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x10
push ebx
mov bl, byte [edx + 8]
cmp bl, 3
je 0x5b13aa
mov ecx, dword [esp + 0x20]
push ebp
mov ebp, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0x24], esi
test bl, 2
je 0x5b1258
movzx eax, byte [edx + 9]
movzx esi, byte [ecx]
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 1]
mov dword [esp + 0x10], edi
mov edi, eax
sub edi, esi
movzx esi, byte [ecx + 2]
sub eax, esi
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov edi, 3
jmp 0x5b126b
movzx eax, byte [ecx + 3]
movzx edi, byte [edx + 9]
sub edi, eax
mov dword [esp + 0x10], edi
mov edi, 1
test bl, 4
je 0x5b127f
movzx ecx, byte [ecx + 4]
movzx eax, byte [edx + 9]
sub eax, ecx
mov dword [esp + edi*4 + 0x10], eax
inc edi
xor ecx, ecx
xor eax, eax
cmp edi, ecx
jle case.0x5b12c6.3
jmp 0x5b1290
cmp dword [esp + eax*4 + 0x10], ecx
jg 0x5b129c
mov dword [esp + eax*4 + 0x10], ecx
jmp 0x5b12a1
mov esi, 1
inc eax
cmp eax, edi
jl 0x5b1290
cmp si, cx
je case.0x5b12c6.3
movzx eax, byte [edx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x5b12c6.3
movzx eax, byte [eax + 0x5b13c4]
jmp dword [eax*4 + 0x5b13b0]
mov edx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp edx, ecx
jbe case.0x5b12c6.3
lea esp, [esp]
mov cl, byte [eax]
shr cl, 1
and cl, 0x55
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x5b12e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov edi, dword [edx + 4]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x5b12c6.3
mov edi, edi
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x5b1320
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5b12c6.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x10]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x5b1346
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov esi, dword [esp + 0x28]
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x5b12c6.3
mov edi, edi
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, 0x100
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x10]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x5b1370
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5b7cb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x67ff88]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 3
jne 0x5b7d3a
movzx eax, word [esi + 0x118]
test ax, ax
jne 0x5b7ce6
test byte [esi + 0x230], 1
jne 0x5b7d0e
movzx cx, byte [edi]
cmp cx, ax
jbe 0x5b7d0e
push str.Invalid_background_palette_index
push esi
call fcn.005b5aa0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0057ac48
add esp, 0xc
ret
mov dl, byte [edi]
push 1
lea eax, [esp + 0xc]
push eax
push str.bKGD
push esi
mov byte [esp + 0x18], dl
call fcn.005b6e90
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0057ac48
add esp, 0xc
ret
test al, 2
je 0x5b7dce
movzx ecx, word [edi + 2]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.005b5ea0
movzx eax, word [edi + 4]
push eax
lea ecx, [esp + 0x16]
push ecx
call fcn.005b5ea0
movzx edx, word [edi + 6]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.005b5ea0
add esp, 0x18
cmp byte [esi + 0x127], 8
jne 0x5b7da8
mov cl, byte [esp + 0xc]
or cl, byte [esp + 0xa]
or cl, byte [esp + 8]
je 0x5b7da8
push str.Ignoring_attempt_to_write_16_bit_bKGD_chunk_when_bit_depth_is_8
push esi
call fcn.005b5aa0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0057ac48
add esp, 0xc
ret
push 6
lea edx, [esp + 0xc]
push edx
push str.bKGD
push esi
call fcn.005b6e90
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0057ac48
add esp, 0xc
ret
mov cl, byte [esi + 0x127]
movzx eax, word [edi + 8]
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x5b7e02
push str.Ignoring_attempt_to_write_bKGD_chunk_out_of_range_for_bit_depth
push esi
call fcn.005b5aa0
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0057ac48
add esp, 0xc
ret
push eax
lea eax, [esp + 0xc]
push eax
call fcn.005b5ea0
push 2
lea ecx, [esp + 0x14]
push ecx
push str.bKGD
push esi
call fcn.005b6e90
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
pop esi
xor ecx, esp
call fcn.0057ac48
add esp, 0xc
ret
Function at 0x5bf230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x5bf2ae
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00576950
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5bf281
sub eax, ebx
jmp 0x5bf283
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x5bf272
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5bf2a2
sub eax, ebx
jmp 0x5bf2a4
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x5bf293
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x5bf309
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.005bef30
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x5bf2f5
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x5bf309
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x5bf236
pop esi
pop ebp
pop ebx
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x409e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x409dd3
movzx ecx, word [edx + 0x26]
nop
jmp 0x409de8
xor edi, edi
jmp 0x409dfa
mov esi, dword [edx + 0x28]
nop
xor eax, eax
nop
lodsb al, byte [esi]
nop
cmp al, 0x61
jmp 0x409e11
jl 0x409e27
nop
jmp 0x409e25
sub al, 0x20
ror edi, 0xd
add edi, eax
nop
jmp 0x409e3c
dec ecx
nop
jne 0x409dfd
nop
jmp 0x409e4f
push edx
mov edx, dword [edx + 0x10]
nop
mov eax, dword [edx + 0x3c]
nop
jmp 0x409e68
add eax, edx
jmp 0x409e77
push edi
jmp 0x409e86
mov eax, dword [eax + 0x78]
jmp 0x409e94
test eax, eax
jmp 0x409ea5
je 0x40a0c6
nop
jmp 0x409ebb
add eax, edx
nop
jmp 0x409ec9
mov ecx, dword [eax + 0x18]
nop
jmp 0x409ede
mov ebx, dword [eax + 0x20]
nop
jmp 0x409eec
push eax
jmp 0x409ef8
add ebx, edx
jmp 0x409f0b
jmp 0x409f18
test ecx, ecx
jmp 0x409f29
je 0x40a0b5
nop
nop
dec ecx
xor edi, edi
nop
jmp 0x409f3f
mov esi, dword [ebx + ecx*4]
add esi, edx
nop
jmp 0x409f52
jmp 0x409f63
xor eax, eax
lodsb al, byte [esi]
ror edi, 0xd
jmp 0x409f76
add edi, eax
nop
cmp al, ah
jne 0x409f52
nop
jmp 0x409f96
jmp 0x409fa9
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jne 0x409f0b
nop
jmp 0x409fcb
nop
jmp 0x409fdf
pop eax
nop
mov ebx, dword [eax + 0x24]
add ebx, edx
jmp 0x409ff8
mov cx, word [ebx + ecx*2]
nop
jmp 0x40a011
mov ebx, dword [eax + 0x1c]
jmp 0x40a023
add ebx, edx
nop
jmp 0x40a038
mov eax, dword [ebx + ecx*4]
nop
jmp 0x40a04f
add eax, edx
nop
mov dword [esp + 0x24], eax
jmp 0x40a066
pop ebx
pop ebx
nop
jmp 0x40a079
popal
pop ecx
jmp 0x40a08f
pop edx
nop
jmp 0x40a09e
push ecx
nop
jmp eax
pop eax
nop
jmp 0x40a0c6
pop edi
nop
pop edx
jmp 0x40a0d6
mov edx, dword [edx]
nop
jmp 0x409dc8

Function at 0x40a30d
Capabilities:
Terminate process

Disassembly:
pop ebp
push 0x3233
push 0x5f327377
push esp
push 0x726774c
call ebp
mov eax, 0x190
sub esp, eax
push esp
push eax
push 0x6b8029
call ebp
push eax
push eax
push eax
push eax
inc eax
push eax
inc eax
push eax
push 0xe0df0fea
call ebp
xchg edi, eax

Function at 0x40a48b
Capabilities:
Terminate process

Disassembly:
push ebp
mov edx, esi
mov eax, dword [ebp - 0x14]
mov ecx, eax
adc dword [eax + eax - 0x7e3f1f00], 0xefdd00f9
add cl, ah
rol byte [ecx - 0x1022ff07], 0xc0
and cl, al
test eax, 0x3ffff100
out dx, eax
add al, byte [eax]
add byte [eax], al
je 0x40a4a5
fiadd word [ecx]
add byte [eax], al
add byte [ebp - 0x3d], bl
nop
nop
nop
nop
nop
nop
nop
add byte [eax], al
pop ebp
ret
Function at 0x40a4b0
Capabilities:
Terminate process

Disassembly:
pop ebp
add eax, 0x84e5d5e
add bh, bh
pop ss
add eax, 0xafc80
cdq
pop ebp
ret 8
inc ecx
add bh, bh
fild word [eax + 0x66]
inc eax
loop 0x40a3d3
inc ebp
fbld tbyte fs:[eax]
push edi
xchg esi, eax
salc
adc esi, dword [eax]
movsb byte es:[edi], byte [esi]
inc eax
add byte [eax + 0x28], ch
pop es
movsd dword es:[edi], dword [esi]
add byte [eax - 0x18], dl
mov eax, dword [0x33ffffb1]
aam 0x5d
push esi
nop
nop
jbe 0x40a3f7
nop
nop
nop
nop
nop
add dl, byte [eax + 0x28689090]
pop es
inc ecx
add bh, bh
adc eax, sym.imp.KERNEL32.dll_DeleteCriticalSection
xor eax, eax
ret
push ebp
das
jp 0x40a43f
pop esp
sbb byte [esi + 0x50], dl
jne 0x40a4c2
or ebx, eax
mov esp, 0x2939b9c0
push eax
mov eax, dword [esi + 0x14]
js 0x40a4da
adc eax, 0xfe40c09c
test eax, eax
mov dword [ebp + 0x62], eax
jne 0x40a51e
jl 0x40a4f0
adc al, 1
dec ebp
adc al, 0x51
push edx
dec dword [ecx + 0x24]
rol byte [eax], 0x85
rcr byte [edi], 0x4a
mov edx, ebp
or al, 0x6e
dec ebp
adc al, 0x85
pop ecx
daa
dec esi
mov dword [eax], ecx
or byte [ebx - 0x2df8efab], cl
je 0x40a503
mov edx, dword [ebp + 0x10]
pop es
sal byte [ebx + ecx - 8], cl
clc
call fcn.0040a480
lahf
les eax, [ecx + ecx*4]
add bl, byte [edx - 0xafeb9d]
inc ebx
inc ecx
lcall 0x4143, 0xff501463
rol byte [eax], 0xc7
adc dl, byte [eax + eax]
add byte [eax], al
add byte [eax + 0x11175], bh
pop esi
out 0x48, al
adc byte [eax], al
cmp eax, 0xf232014b
cld
dec ebp
jo 0x40a58d
add dword [eax], eax
pop esi
pop ebp
ret 0x10
movsd dword es:[edi], dword [esi]

Function at 0x401701
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmpsd dword [esi], dword es:[edi]
shr byte [ebx + 0x1d], 0xe5
inc edx
inc ebx
xchg byte [ecx - 0x16dbdbbc], cl
or eax, 0x92000000
dec esi
test dword [esi - 0x312593ee], ecx
sbb al, 0x4d
pushal
jbe 0x401786
stc
stosd dword es:[edi], eax
out dx, al
out dx, al

Function at 0x40625c
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x20
mov bh, byte [ecx + ecx*4]
shl ebx, 2
shl edi, 0x74
sub edx, ecx
mov dword [ecx - 0x47], esi
mov dword [ebp - 4], edx
mov ecx, dword [eax + 0x301c]
mov eax, 0x528b0c55
or al, 0x8d
xor al, 0xf
cmp edx, dword [esi + 0x61]
inc ebp
add eax, 0xeb0448ff
dec edx
lea edi, [ebx + ecx]
mov ecx, 0x9c0005
xrelease xchg byte [ebx - 0x3c7cf783], cl
adc al, 0xa4
dec ebp
cld
add edi, 0x14
dec ecx
mov dword [esi], ecx
or bl, bh
dec ebp
cld
jne 0x40626f
mov edi, dword [ebp - 8]
pushfd
push eax
or al, 0x99
leave
test edx, edx
jbe 0x4062e1
lea esi, [eax + 0x10]
cmp dword [esi], edi
je 0x4062b3
inc ecx
add esi, 4
cmp ecx, dword [ebx + 0x28ebf472]
dec edx
ret
mov edx, dword [eax + 0x8b10f7]
xor ecx, ecx
test edx, edx
xor dword [edx], edi
invalid

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [eax + ecx - 0x7aebbfc4]
sal byte [ebx + esi - 0x75], 0xb9
or byte [ecx + 0x50], dl
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
adc ebx, dword [esi]
mov dword [0xc098358b], eax
inc eax
add byte [ebx - 0x2a], cl
test eax, eax
jne 0x40a3fe
pop esi
pop ebp
ret 0x7d
call esi
add eax, 0xafc80
pop esi
pop ebp
ret 8
Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x17b67404
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x55535d2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219