joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016ba3f
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.1014f4d5
mov dword [esp + 0x38], ecx
push dword [esp]
push 0xe66418c9
push dword [esp]
pushfd
lea esp, [esp + 0x48]
call fcn.1005c280
or eax, ebp
cwde
sal ah, 2
mov edx, dword [ebp - 0x10]
ror ch, cl
mov eax, dword [ebp - 0x14]
call fcn.101476bc
mov word [esp], di
pushal
lea esp, [esp + 0x44]
call fcn.100a2a10
ror si, 0xd
movzx esi, cl
add esi, ebx
bt ecx, esp
mov esi, eax
call fcn.10127bd5
test eax, eax
mov byte [esp], bh
lea esp, [esp + 4]
ja 0x10145b10
pushfd
pushal
lea esp, [esp + 0x24]
jne 0x10161163
lea eax, [ecx + 0x1829bfa3]
pushal
mov eax, dword [ebp + 8]
setae cl
pushal
mov dword [esp + 0x3c], 0xffffffff
mov ch, dl
movsx cx, al
mov ecx, dword [eax + 0x20]
mov word [esp + 4], bx
jmp 0x101642d0

Function at 0x10173f87
Capabilities:
Packed with generic packer

Disassembly:
xadd edx, ebx
mov byte [ebp - 0x204], 1
call fcn.10149006
dec eax
jne 0x10173fe9
invalid
stosb byte es:[edi], al
xor cl, byte [eax - 0x573d27cb]
xchg esp, eax
mov eax, esi
mov edx, 0xf9f0dfc3
adc dword [eax - 0x3d5c0041], edi
dec edx
push di
cmp eax, 0xfcd36a5a
mov esp, 0xd0eff5da
mov eax, 0x315cbb23
dec edx
push edx
push 0x59603e45
rcl byte [ebx + eax*8 + 0x19], cl
xchg esp, eax
push 0x12
stosb byte es:[edi], al
mov al, 0x82
inc edi
cmp al, 5
or dl, dh
mov ebp, 0x7272a6b5
xchg dword [ebx + 0x2c], ebp
ror byte [esi - 0x6f0d0cde], cl
in al, 0xd0
cmp eax, 0x61bd8214
add bl, byte [ebx + edi - 0x4dd8d2f]
cmp byte [ebp + 0x3b9c0261], 0xd1
jb 0x10174065
sti
add al, 0xfc
popal
mov ebp, 0xd246527f
or ebx, edx
mov ah, 0x53
scasb al, byte es:[edi]
movsd dword es:[edi], dword [esi]
pop esp
push esi
inc esi
scasb al, byte es:[edi]
inc esp
push ecx
popfd
inc ebx
xchg esi, eax
adc byte [edx], 0xea
imul ecx, edx, 0xe406b266
cmp byte [ebx + 0x44870e24], bh
mov al, byte [0x5c6a546f]
pop eax
popfd
push cs
push ebx
aad 0xa0
cwde
mov al, 0x9b
das
or byte [edi + 0x71], ch
xor bl, byte [0x7af497ac]
mov byte [edx - 0x5d], cl
popal
xchg byte [edx - 0x24], dl
add esi, dword [eax - 0x2da9554f]
push ds
lodsb al, byte [esi]
xchg ebp, eax
jg 0x101740dc
dec edx
xor esi, dword [0xe6c3e725]
fld qword [esi + edi*4 + 0x51]
mov ah, 0xf3
xchg ecx, eax
in al, 0x85
push cs
or eax, 0xc80261bd
or dh, byte [bx + si - 0x2d]
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
xchg esp, eax
pop ebp
push edi
jo 0x1017403a
call 0xbaa933af
xchg esi, eax
push ds
add eax, 0x261bd70
mov cl, ch
push es
insd dword es:[edi], dx
not esi
movsd dword es:[edi], dword [esi]
popal
mov ebx, 0x144a858f
scasd eax, dword es:[edi]
fidiv word [ebx]
cli
push ebp
mov ebx, 0x83f83fff
je 0x101740b7
push ebp
xchg esi, eax
or al, 0x9a
jnp 0x1017415f
in al, 0x82
xchg edi, eax
or eax, 0xdd727c9b
jbe 0x10174157
push eax
adc bh, al
cmp dword [ebp + 0x70794], 0xf6fc6e67
mov edx, esi
sbb byte [eax + 0x364a4883], al
sub eax, 0xb8c2f604
test al, 0x93
dec esi
inc eax
cmp bh, al
add al, 0x24
ja 0x101740dd
push esp
sub ecx, 0xffffffa8
dec ebp
invalid
and al, 0x50
and ebp, edi
dec dword [ebp + 0xf302464]
lea esp, [esp + 0x30]
invalid
test byte [ecx], dh
jecxz 0x10174167
jmp dword [esi - 0x7f]
Function at 0x10176a2e
Capabilities:
Packed with generic packer

Disassembly:
fstp xword [edx + 0x27533334]
test al, 0xe1
push eax
mov ch, byte [eax - 0x7a4953e2]
test dword [ebp + 0x38245489], ebx
mov dword [esp + 0x38], edx
pushfd
lea ecx, [ecx - 0x52a88e21]
mov edx, dword [ebp + 8]
pushfd
mov dword [esp + 0x3c], edi
movsx ecx, bl
mov dword [esp + 0x38], eax
push dword [esp]
lea ecx, [ebp + 0xc]
call fcn.1017912d
jae 0x10130590
xchg byte [esi + 5], ah
insb byte es:[edi], dx
adc dword [eax + 0x39], ebp
or dword [edx - 0x775a3205], ebp
mov byte [ebp*4 - 0x177af0f1], bl
sub dword [ebp + 0x5d6fdcf5], edx
out dx, eax
jo 0x10130616
push ebp
retf
xchg esi, eax
ja fcn.10130678
popal
invalid
mov byte [esp], 0x72
mov byte [esp + 4], 0xfd
mov dword [esp + 0x1c], ecx
push edi
lea esp, [esp + 0x20]
call fcn.1005c280
clc
aas
inc cl
push ebp
mov edx, dword [ebp - 0x10]
cmc
mov eax, dword [ebp - 0x14]
push dword [esp]
mov dword [ebp - 4], 0xffffffff
or ch, dh
btr cx, dx
and cx, bx
add esp, 0x10
or cl, cl
movzx cx, cl
btc ecx, 0x1b
mov dword [edx + 4], eax
btr cx, 1
dec cl
xor ch, ah
cmc
xor eax, eax
pushfd
jmp fcn.10154e42
pushal
mov edx, dword [ebp + 0x18]
pop ecx
pushal
not cl
seto ah
lea eax, [ebp - 4]
not ch
jmp 0x101305a1
movsx cx, bl
mov ecx, dword [eax + 0x20]
pushal
jmp 0x1013cc35
jne 0x101728e0
push edi
pop ecx
mov eax, dword [ebp + 8]
jmp 0x10172289
not cl
push 0xffffffffffffffff
movsx cx, cl
movzx cx, al
jmp 0x1015a61a
push ecx
mov word [esp], sp
call fcn.10075b5c
lea edx, [eax*4 + 0xe904229]
cwde
jmp 0x1014b886
lea esp, [esp + 8]
jns 0x10183aaa
jne 0x101728e0
call fcn.1017b22e
jmp 0x10164545

Function at 0x10178249
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea eax, [ebp - 4]
movzx cx, cl
lea ecx, [ebx + 0x4b840fb7]
movzx cx, al
mov dword [esp + 0x28], 0
push 0xf0d1a96d
pushfd
push 0xd7d969be
mov dword [esp + 0x30], eax
call fcn.10145e2c
push 0xf7219c8b
call fcn.1000b085
mov dl, 0x68
popal
pushfd
and dword [ecx - 0x15482c18], edx
call dword [esi]
lodsd eax, dword [esi]
aaa
xchg esi, eax
mov dword [ebp - 0x1fb], eax
rcr al, 3
dec ecx
btc cx, si
shr ah, cl
test edx, edx
stc
aaa
aad 0x65
btc cx, 0xa
mov ecx, dword [ebp + 0x14]
ror dh, 6
sal al, cl
sbb al, ah
mov dword [ebp - 0x1f7], ecx
lahf
xadd dh, al
mov bh, bh
rol dh, cl
daa
pop edx
mov edx, dword [ebp + 0x18]
adc ah, 0x7f
lahf
bswap ecx
sub ax, 0x9cf5
mov dword [ebp - 0x1f3], edx
bts ax, si
rol ecx, 0x14
bsf ax, bp
test esi, esi
jmp 0x1016613e
Function at 0x1017864c
Capabilities:
Encode data using xor

Disassembly:
and al, 0x60
push dword [esp + 4]
ret 0x1c
push ebp
lea esp, [esp + 0x34]
call fcn.1005c280
xchg edx, eax
pushal
mov edx, dword [ebp - 0x10]
and cl, 0xca
mov eax, dword [ebp - 0x14]
sar cl, 7
add esp, 0x20
jb 0x1014a85e
sbb dword ds:[ecx], eax
add dl, dl
invalid
rol ch, cl
mov dword [ebp - 4], 0xffffffff
sbb cl, 0x96
pushfd
add esp, 0xc
pushfd
stc
mov dword [edx + 4], eax
movzx ecx, cl
xor eax, eax
not ch
invalid
sal dh, 0xd5
mov ecx, dword [ebp - 0xc]
call fcn.10184539
call 0xdc13d198
xchg edi, eax
ja 0x10138f9a
sbb eax, eax
adc al, byte [eax]
shr byte [edx + 0x12], 1
dec edx
test dword [ebx], esi
cmpsb byte [esi], byte es:[edi]
add al, 0xf7
in eax, dx
or byte [edx - 0x80], dh
jl 0x10138ef1
xchg cl, ah
je 0x10138f3f
dec edi
jne 0x10138f39
salc
lcall 0x6d7f, 0x61618c8f
jo 0x10138f27
sbb dl, byte [edx + 0x10]
jnp 0x10138f99
push es
mov byte [eax], bl
sub dword [ecx], 0x38
loopne 0x10138f1c
stosd dword es:[edi], eax
aas
test eax, 0x40403fe1
retf 0xbfcf
jno 0x10138fd6
cmp ecx, dword [ebx]
add esp, ebx
lodsd eax, dword [esi]
or eax, dword [ebx]
jecxz 0x10138f4c
pushal
adc eax, 0x80f2af8
sbb eax, 0xa4d915c3
invalid
pop edx
into
das
xor byte [esi - 0x48405f20], 0xdd
aad 0x8e
aad 0x18
cmp al, 0xa6
dec eax
dec eax
popfd
sub eax, 0x65f80c2b
jg 0x10139053
ret
leave
fbld tbyte [ebp + 0xefeffa1]
sub byte [ebp + 0xe6cd85f], al
or ecx, dword [esi - 0x78]
wait
add byte [edi + ebx*8 - 0x14], dl
push esp
fucompi st(4)
aam 0xc6
mov edx, 0xcec6b038
aaa
add byte [eax + 0x66], cl
push 0x6d
cmp al, 7
mov dword [0xb3e76497], eax
test byte [edx + 0x4f], dh
insd dword es:[edi], dx
fmul dword [eax]
std
xchg edi, esp
push edx
mov ebx, 0xf0599a90
push cs
jg 0x10139065
cmp al, 0xb0
mov eax, dword [ebx - 0x2c667790]
not edi
xor dword [eax - 0x78], 0xffffff99
sal edi, cl
xlatb
pop es
movsb byte es:[edi], byte [esi]
in al, dx
in al, 0x11
sar dword [edx + 0x6724f8ae], cl
cmp esp, dword [ebp - 0x2e4cda91]
fcompp
jno 0x10139092
cmp bh, byte [ebp - 0x76]
cmc
test dword [esi - 0x2d07c8bc], eax
in eax, dx
stosb byte es:[edi], al
cdq
mov bl, byte [esi - 0x7d]
add ch, bl
add ch, 0x33
sar cl, cl
shld cx, bx, 0xc
mov dword [ebp - 4], 0xffffffff
sar ch, 6
test eax, 0xd3f0ccf9
movzx cx, bl
shl cl, cl
add esp, 8
xor ch, dl
rcr cx, 0xb
mov dword [edx + 4], eax
lea ecx, [esi - 0x285e6f3a]
movzx ecx, cl
cmp ah, ch
xor eax, eax
lea ecx, [esi + 0x3dc2b7a7]
jmp 0x101874c6
call 0x10171b1e
lea eax, [ebp - 0x104]
pushal
pushfd
push esp
mov byte [esp], ah
mov dword [esp + 0x2c], eax
jmp loc.10086575
test eax, eax
pushal
pushal
push dword [esp + 8]
lea esp, [esp + 0x48]
jne 0x10151d26
lea eax, [ebx*4 + 0x5cc9f160]
pushfd
mov eax, dword [ebp + 8]
movzx cx, dl
pushfd
setl cl
mov dword [esp + 4], 0xffffffff
lea ecx, [esp + 0x415facc0]
pushal
mov ecx, dword [eax + 0x20]
pushfd
pushfd
pushfd
pushfd
mov dword [esp + 0x30], ecx
mov byte [esp], dh
jmp 0x10138eff
mov ecx, dword [ebp - 0xc]
call fcn.101858c2
Function at 0x1017a596
Capabilities:
Packed with generic packer

Disassembly:
lea ecx, [ebp - 0x204]
jmp 0x1016073b
jmp 0x10152967
not cl
jmp 0x10131506
pushfd
pushal
mov dword [esp + 0x20], 0x200
pushal
mov dword [esp + 0x3c], ecx
jmp 0x1014e8d7
jmp 0x1015d051
lea esp, [esp + 0x24]
jne 0x1013df84
mov cl, cl
jmp 0x10150e73

Function at 0x1017a8f6
Capabilities:
Packed with generic packer

Disassembly:
cwde
movsx eax, bl
lea eax, [ebp + 8]
call int.1016a03f
test al, al
pushfd
lea esp, [esp + 4]
je 0x1014249d
xadd di, si
and di, 0xc344
inc si
movsx esi, al
mov edi, dword [sym.imp.MSVCRT.dll_toupper]
inc si
neg si
neg si
adc si, 0x9571
lea esi, [ebp - 0xc4]
call fcn.1013e4c8
test al, 1
push esi
lea esp, [esp + 4]
je 0x1007da8e
call fcn.10164191
cmp si, 0x8351
test dh, cl
bt cx, sp
cmp word [esi + 6], 0x54
pushal
lea esp, [esp + 0x24]
je 0x1017f3b6
jne 0x1007da8e
not ah
aam 0x43
bsf ax, bp
lea eax, [ebp*4 + 0x2f82b972]
mov eax, dword [esi + 8]
pushal
push ecx
stc
test al, 1
mov word [esp], 0x62dd
call fcn.101510e2
lea esp, [esp + 0x14]
jl 0x1017d47b
pushal
movsx ax, dl
mov eax, 1
pop esi
pushal
movsx si, bl
mov esi, dword [esp + 0x3c]
push edx
push dword [esp + 4]
push eax
pushfd
mov esp, ebp
lea ebp, [edi + 0x1859c725]
mov ebp, ecx
lea ebp, [esi*4 + 0x62ad57ee]
pushal
mov ebp, dword [esp + 0x20]
mov byte [esp], ah
push dword [esp + 0x24]
ret 0x3c
push eax
lea esp, [esp + 4]
jne 0x1007da8e
add ah, dh
mov eax, dword [esi + 8]
bt si, cx
jmp 0x10146e8c

Function at 0x1017ae07
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x50]
call fcn.10013090
stc
call fcn.1016ba3f

Function at 0x1017ae16
Capabilities:
Packed with generic packer

Disassembly:
invalid
fucomi st(0)
pop esp
pop ds
invalid
call fcn.1005ca42
in eax, 0x3b
sub ebp, ebp
mov esp, 0xcc50297f
stosd dword es:[edi], eax
imul ecx, dword [ecx + 0x1e], 0x9e96dce8
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
jo 0x1017adc2
sub dl, bh
sahf
or byte [edi], dl
jge 0x1017adf3
push ds
scasb al, byte es:[edi]
lcall 0x1148, 0xe7de6fff
dec eax
inc eax
cli
add ebx, edi
rcpps xmm0, xmm7
test eax, 0x5d3ed2c3
sahf
push es
nop
outsd dx, dword [esi]
and al, dh
leave
jle 0x1017aeaa
xchg esp, eax
push 0x72
sbb dl, byte [edx]
sub dword [ecx], ebp
jmp 0xb790dcca
mov bl, byte [ebx + 0x15]
invalid

Function at 0x1017af3c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edi - 0x1b96169b]
xchg dword [esp + 0x30], eax
rdtsc
cdq
mov eax, dword [esp + 0x30]
movzx cx, dl
lea ecx, [ebp - 4]
movzx edx, dl
mov dword [esp + 0x30], edi
pop edx
pop edx
pop edx
pop edx
mov dword [esp + 0x1c], ecx
not dl
mov byte [ebp - 0x18], 0xb
pushal
mov dword [ebp - 0x17], eax
rol ah, cl
push 0xda14ce97
clc
test ch, ch
stc
mov ecx, dword [ebp + 0xc]
inc ah
lea eax, [edi*8 - 0x3da78b00]
pushfd
mov dword [ebp - 0x13], ecx
neg ch
jmp 0x1017dcb1
mov dl, dl
ror eax, 0x1a
rcl dh, cl
stc
btr dx, bp
mov edx, dword [ebp + 0x10]
bt ax, bp
sbb ch, ch
setae cl
mov dword [ebp - 0xf], edx
aas
neg cl
btc cx, 1
rcr ecx, 0xb
test dl, dl
lahf
push dword [esp]
mov byte [esp + 4], ah
mov eax, dword [ebp + 0x14]
movzx edx, al
mov dword [ebp - 0xb], eax
seta dh
jmp 0x1017937e
Function at 0x1017be4d
Capabilities:
Encode data using xor

Disassembly:
pushfd
lea esp, [esp + 0x28]
jne fcn.1014ecd2
movsx ecx, bl
movsx cx, al
mov ecx, dword [ebp + 0x18]
push 0xf0086897
push 0x721cd284
pushal
lea esp, [esp + 0x28]
jmp 0x10126df1
sub edx, 0x739db7d1
sbb dh, byte [eax + 0x71488f19]
fadd st(1)
dec esi
push ecx
pop ebx
xor byte [0x97f40530], dh
and byte [ecx - 0x482e6fd8], cl
popfd
lodsd eax, dword [esi]
push esp
mov bl, 0xd0
invalid
pop ebx
jns 0x1017bdfb
in al, dx
rcl dword [ebp - 0x7b71748e]
dec edx
and al, 0x15
add eax, 0x77be68f2
push 0x8c3b77be
call 0x10178016
push 0x8c3b77be
call 0x10178016
pushal
mov byte [esp], ah
lea esp, [esp + 0x28]
jne 0x10172c29
push esp
mov word [esp], 0xa7bc
pushfd
mov dword [esp + 4], ebx
mov word [esp], dx
call fcn.10154654
adc byte [ebx + eax*2 - 0x30], 0x21
mov esp, 0x8bbce91d
jle 0x1017befe
pop ecx
add esi, dword [ecx + 0x1f898422]
sbb edi, edi
adc al, dh
xchg edi, eax
les edi, [ebx - 0x26]
mov eax, 0xfe87c3e2
fstp xword [0x344f0281]
cmp eax, 0x344f0281
aam 0x83
jl 0x1017be3e
nop
xor dword [eax + 0x59], 0xa9cd0918
cmp al, 0xd2
fistp qword [edi]
mov bl, 8
cmp eax, 0x4fbc5318
add al, 0x35
out dx, al
cmp al, 0xf1
jl 0x1017be9b
sbb al, byte [esi - 0x5e]
jge 0x1017be65
xchg ebp, eax
sub byte [eax - 0x27], 0x9c
and esp, esp
call fcn.10011c80
mov esp, 0x6600a8c6
cmp edx, 0xed8a775f
aad 0xed
mov eax, dword [ebp - 4]
cmc
stc
push 0xcf7fdee3
nop
pushal
cmp eax, 0x22b
jmp 0x1015c8f6
std
jmp [eax - 6]

Function at 0x1017cd39
Capabilities:
Packed with generic packer

Disassembly:
cmc
mov eax, eax
sub esp, 0xffffffc0
mov dword [0x10116118], 1
pushfd
jmp 0x101370c7

Function at 0x1017f3ab
Capabilities:
Packed with generic packer

Disassembly:
lea edx, [ebp - 0x118]
call fcn.1014d7db

Function at 0x10182a8a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x44]
jne 0x1016b95b
sar si, 1
lea esi, [esi + 0x4608a981]
xor si, dx
or eax, 0xffffffff
lea esi, [ebx*4 + 0x22eaefa7]
bswap si
pop esi
pushal
call fcn.1014b53e

Function at 0x10183a88
Capabilities:
Packed with generic packer

Disassembly:
sub edx, esi
sub esi, esp
add ecx, edx
add si, 0xff13
cmp bl, 0xb
mov dword [0x10106e50], ecx
sar ch, 4
sub si, di
clc
mov al, al
call fcn.1015f684
Function at 0x40f8da
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42cae4]
jne 0x40f8e4
repz ret
jmp fcn.0041398f

Function at 0x4109a6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4109d7
call fcn.00411a11
mov dword [eax], esi
call fcn.004119fe
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00413f3c
add esp, 0x14
push 0x16
pop eax
jmp 0x410a2c
test dword [ebp + 0xc], 0xfffffff9
jne 0x4109b3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410a04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411a24
pop ecx
call fcn.004119fe
mov eax, dword [eax]
jmp 0x410a2c
test al, 0x10
jne 0x410a2a
test al, 1
je 0x410a2a
test byte [ebp + 0xc], 2
je 0x410a2a
call fcn.00411a11
mov dword [eax], 5
call fcn.004119fe
mov dword [eax], 0xd
jmp 0x4109fb
xor eax, eax
pop esi
pop ebp
ret

Function at 0x41c302
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413fd4
and dword [ebp - 4], 0
cmp dword [0x430804], 0
mov ebx, eax
jne 0x41c3b3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c464
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x426150
push edi
call esi
test eax, eax
je 0x41c464
push eax
call fcn.00413f62
mov dword [esp], 0x426140
push edi
mov dword [0x430804], eax
call esi
push eax
call fcn.00413f62
mov dword [esp], 0x42612c
push edi
mov dword [0x430808], eax
call esi
push eax
call fcn.00413f62
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43080c], eax
call esi
push eax
call fcn.00413f62
pop ecx
mov dword [0x430814], eax
test eax, eax
je 0x41c3b3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413f62
pop ecx
mov dword [0x430810], eax
mov eax, dword [0x430810]
cmp eax, ebx
je 0x41c40b
cmp dword [0x430814], ebx
je 0x41c40b
push eax
call fcn.00413fdd
push dword [0x430814]
mov esi, eax
call fcn.00413fdd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c40b
test edi, edi
je 0x41c40b
call esi
test eax, eax
je 0x41c402
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c402
test byte [ebp - 0xc], 1
jne 0x41c40b
or dword [ebp + 0x10], 0x200000
jmp 0x41c444
mov eax, dword [0x430808]
cmp eax, ebx
je 0x41c444
push eax
call fcn.00413fdd
pop ecx
test eax, eax
je 0x41c444
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41c444
mov eax, dword [0x43080c]
cmp eax, ebx
je 0x41c444
push eax
call fcn.00413fdd
pop ecx
test eax, eax
je 0x41c444
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x430804]
call fcn.00413fdd
pop ecx
test eax, eax
je 0x41c464
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41c466
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x440130
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.tJrdyPER
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x440152
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440159
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440148
nop
push 1
nop
pop eax
add ebx, ebx
jne 0x44016b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440160
jne 0x44017c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440160
xor ecx, ecx
sub eax, 3
jb 0x440190
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440202
mov ebp, eax
add ebx, ebx
jne 0x44019b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4401a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4401cc
inc ecx
add ebx, ebx
jne 0x4401b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4401ad
jne 0x4401c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4401ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4401ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4401dd
jmp 0x44014e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4401ec
add edi, ecx
jmp 0x44014e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x440254
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4020c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x402b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440209
push edi
pop ecx
jns 0x440238
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x402bc]
or eax, eax
je 0x44024e
mov dword [ebx], eax
add ebx, 4
jmp 0x440226
call dword [esi + 0x402b8]
mov ebp, dword [esi + 0x402c0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x440288
sub esp, 0xffffff80
jmp section.NDltoTPW
Function at 0x4017f9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e090]
jne 0x401803
repz ret
jmp fcn.0040228a

Function at 0x402fff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x403030
call fcn.004028a7
mov dword [eax], esi
call fcn.00402894
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040282c
add esp, 0x14
push 0x16
pop eax
jmp 0x403085
test dword [ebp + 0xc], 0xfffffff9
jne 0x40300c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40305d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004028ba
pop ecx
call fcn.00402894
mov eax, dword [eax]
jmp 0x403085
test al, 0x10
jne 0x403083
test al, 1
je 0x403083
test byte [ebp + 0xc], 2
je 0x403083
call fcn.004028a7
mov dword [eax], 5
call fcn.00402894
mov dword [eax], 0xd
jmp 0x403054
xor eax, eax
pop esi
pop ebp
ret

Function at 0x407ddc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004046a8
and dword [ebp - 4], 0
cmp dword [0x40f6e8], 0
mov ebx, eax
jne 0x407e8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407f3e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407f3e
push eax
call fcn.00404636
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f6e8], eax
call esi
push eax
call fcn.00404636
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f6ec], eax
call esi
push eax
call fcn.00404636
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f6f0], eax
call esi
push eax
call fcn.00404636
pop ecx
mov dword [0x40f6f8], eax
test eax, eax
je 0x407e8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404636
pop ecx
mov dword [0x40f6f4], eax
mov eax, dword [0x40f6f4]
cmp eax, ebx
je 0x407ee5
cmp dword [0x40f6f8], ebx
je 0x407ee5
push eax
call fcn.004046b1
push dword [0x40f6f8]
mov esi, eax
call fcn.004046b1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407ee5
test edi, edi
je 0x407ee5
call esi
test eax, eax
je 0x407edc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407edc
test byte [ebp - 0xc], 1
jne 0x407ee5
or dword [ebp + 0x10], 0x200000
jmp 0x407f1e
mov eax, dword [0x40f6ec]
cmp eax, ebx
je 0x407f1e
push eax
call fcn.004046b1
pop ecx
test eax, eax
je 0x407f1e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407f1e
mov eax, dword [0x40f6f0]
cmp eax, ebx
je 0x407f1e
push eax
call fcn.004046b1
pop ecx
test eax, eax
je 0x407f1e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f6e8]
call fcn.004046b1
pop ecx
test eax, eax
je 0x407f3e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407f40
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret