joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret
Function at 0x45bf00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x40000]
push edi
jmp 0x45bf1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45bf21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45bf10
mov eax, 1
add ebx, ebx
jne 0x45bf33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45bf44
jne 0x45bf63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45bf63
dec eax
add ebx, ebx
jne 0x45bf50
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45bf28
add ebx, ebx
jne 0x45bf5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45bfb5
xor ecx, ecx
sub eax, 3
jb 0x45bf7b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45bfea
sar eax, 1
mov ebp, eax
jmp 0x45bf86
add ebx, ebx
jne 0x45bf86
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45bf54
inc ecx
add ebx, ebx
jne 0x45bf94
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45bf54
add ebx, ebx
jne 0x45bfa1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45bf96
jne 0x45bfb2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45bf96
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45bfd4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45bfc6
jmp 0x45bf16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45bfd4
add edi, ecx
jmp 0x45bf16
pop esi
mov edi, esi
mov ecx, 0x1743
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45bff2
cmp byte [edi], 5
jne 0x45bff2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45bff7
lea edi, [esi + 0x57000]
mov eax, dword [edi]
or eax, eax
je 0x45c06f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x66290]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x66404]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45c024
mov ecx, edi
jns 0x45c053
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6640c]
or eax, eax
je 0x45c069
mov dword [ebx], eax
add ebx, 4
jmp 0x45c041
call dword [esi + 0x66408]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x45c0a0
cmp al, 0xef
ja 0x45c093
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x45c075
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x45c082
mov ebp, dword [esi + 0x66410]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45c0d4
sub esp, 0xffffff80
jmp 0x411e1e
Function at 0x4a3c20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x31000]
push edi
jmp 0x4a3c3a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a3c41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3c30
mov eax, 1
add ebx, ebx
jne 0x4a3c53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a3c64
jne 0x4a3c83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3c83
dec eax
add ebx, ebx
jne 0x4a3c70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a3c48
add ebx, ebx
jne 0x4a3c7f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a3cd5
xor ecx, ecx
sub eax, 3
jb 0x4a3c9b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a3d0a
sar eax, 1
mov ebp, eax
jmp 0x4a3ca6
add ebx, ebx
jne 0x4a3ca6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3c74
inc ecx
add ebx, ebx
jne 0x4a3cb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3c74
add ebx, ebx
jne 0x4a3cc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a3cb6
jne 0x4a3cd2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a3cb6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a3cf4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a3ce6
jmp 0x4a3c36
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a3cf4
add edi, ecx
jmp 0x4a3c36
pop esi
mov edi, esi
mov ecx, 0x6c4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a3d12
cmp byte [edi], 0xa
jne 0x4a3d12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a3d17
lea edi, [esi + 0xa0000]
mov eax, dword [edi]
or eax, eax
je 0x4a3d86
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xae1fc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xae2ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a3d44
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xae2b4]
or eax, eax
je 0x4a3d80
mov dword [ebx], eax
add ebx, 4
jmp 0x4a3d61
call dword [esi + 0xae2b0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4a3db7
cmp al, 0xef
ja 0x4a3daa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4a3d8c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4a3d99
mov ebp, dword [esi + 0xae2b8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4a3deb
sub esp, 0xffffff80
jmp 0x403a27
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000f197
pop dword [ebp - 0x40]
mov eax, 0x6a5ab54a
add eax, 0xa5a63c4d
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x39811
push 0
mov eax, 0x2b945502
sub eax, 0x1b93149e
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x560a6a99
sub ecx, 0x560a20e7
mov edx, eax
mov edi, 0xc227b25f
add edi, 0x4dd9d3a1
add edi, dword [ebp - 0x40]
mov esi, 0xfa923e3a
add dword [ebp - 0xc], 0x95e4412
mov ebx, dword [edi]
add dword [ebp - 0x3c], ecx
add ebx, esi
xor dword [ebp - 0x38], edx
mov dword [edx], ebx
xor dword [ebp - 0x1c], 0xde19f73d
add edx, 0x8a56919c
add edx, 0x75a96e68
add edi, 0x59869ff2
add edi, 0xa6796012
loop 0x1000f1f0
add eax, 0x7fb3f017
add eax, 0x804d2984
mov ebx, eax
add eax, 0x515c5aa9
sub eax, 0x515c5aa4
mov ecx, 0x7240be8a
sub ecx, 0x6240be8a
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x417f85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x417f94
pop dword [ebp - 8]
mov eax, 0x4fd26514
sub eax, 0x4f90e580
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x47963e7e
add dword [ebp - 0x18], 0x6bc06cd
mov dword [ebp - 0x14], 0x684d6a61
sub dword [ebp - 0x14], 0x361a1e1c
mov dword [ebp - 0x10], 0xc98727c8
add dword [ebp - 0x10], 0x82c51c66
mov dword [ebp - 0xc], 0xc37f759b
add dword [ebp - 0xc], 0x3c808a65
lea eax, [ebp - 0x18]
push eax
mov eax, 0xf2ec6640
sub eax, 0xf2aa35cc
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x456953b3
sub dword [ebp - 0x18], 0xd0f6ea5d
mov dword [ebp - 0x14], 0xdd853d83
add dword [ebp - 0x14], 0x63e723f2
mov dword [ebp - 0x10], 0xd0a0b3c6
add dword [ebp - 0x10], 0x92ceb8a6
mov dword [ebp - 0xc], 0x61c8d2f9
sub dword [ebp - 0xc], 0x61c8d2f9
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3a692
push 0
call eax
mov ecx, 0x489e8655
add ecx, 0xb761b416
mov ebx, eax
mov edi, 0x434400
add edi, dword [ebp - 8]
mov edx, 0x799597f6
sub edx, 0x58079516
xor dword [ebp - 4], 0x915fb98a
mov esi, dword [edi]
add dword [ebp - 4], edi
sub esi, edx
add dword [ebp - 4], 0x435bf3d2
mov dword [ebx], esi
add dword [ebp - 4], ebx
add ebx, 4
add edi, 0x5d46d9ab
add edi, 0xa2b92659
loop 0x4180ab
add eax, 0xd278d8be
sub eax, 0xd277fc3f
mov ebx, eax
add eax, 0x4de1579
add eax, 0xfb21ea8c
mov ecx, 0x7a6ea4f8
sub ecx, 0x7a2ea4f8
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x100cd22e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x100cd23d
pop dword [ebp - 0x24]
mov eax, 0x100cd23d
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x55b5c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x327dbd98
add ecx, 0xcd828111
xor edi, edi
add edi, eax
mov ebx, 0xce7d98cf
add ebx, 0x4195df31
add ebx, dword [ebp - 0x24]
mov edx, 0xab760eaa
add edx, 0x6b208728
sub dword [ebp - 0x10], ecx
mov esi, dword [ebx]
sub dword [ebp - 0x14], edi
add esi, edx
mov dword [ebp - 0x10], 0x4daad8d
mov dword [edi], esi
xor dword [ebp - 0x1c], 0x161e425c
add edi, 0x30d1e2ab
add edi, 0xcf2e1d59
add ebx, 0x45fd493a
sub ebx, 0x45fd4936
loop 0x100cd294
add eax, 0x12fc5a05
sub eax, 0x12fb6c8e
xor ebx, ebx
add ebx, eax
add eax, 0x5f128a5f
add eax, 0xa0ed75a6
mov ecx, 0xf230cde8
sub ecx, 0xe230cde8
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x415f63
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x433b84
push 0x433b7c
push 0x433618
push 2
call fcn.00415e68
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x415f94
mov ecx, esi
call fcn.00411065
call esi
jmp 0x415f9a
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x415f9d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x433b8c
push 0x433b84
push 0x433624
push 3
call fcn.00415e68
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x415fd1
mov ecx, esi
call fcn.00411065
call esi
jmp 0x415fd7
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x2a7a75b2
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x3e6a005f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x499f10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x43c015
lea edi, [esi - 0x3b015]
push edi
or ebp, 0xffffffff
jmp 0x499f32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x499f39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x499f28
mov eax, 1
add ebx, ebx
jne 0x499f4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x499f40
jne 0x499f5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x499f40
xor ecx, ecx
sub eax, 3
jb 0x499f70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x499fe2
mov ebp, eax
add ebx, ebx
jne 0x499f7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x499f88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x499fac
inc ecx
add ebx, ebx
jne 0x499f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x499f8d
jne 0x499fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x499f8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x499fcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x499fbd
jmp 0x499f2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x499fcc
add edi, ecx
jmp 0x499f2e
pop esi
mov edi, esi
mov ecx, 0x51
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x499fea
cmp byte [edi], 1
jne 0x499fea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x499fef
lea edi, [esi + 0x95000]
mov eax, dword [edi]
or eax, eax
je 0x49a05e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b484]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b568]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x49a01c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b570]
or eax, eax
je 0x49a058
mov dword [ebx], eax
add ebx, 4
jmp 0x49a039
call dword [esi + 0x9b56c]
mov ebp, dword [esi + 0x9b574]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x49a092
sub esp, 0xffffff80
jmp 0x402d30
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0xbaf235c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x584d6636
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423004]
jne 0x40100a
repz ret
jmp fcn.00401424

Function at 0x406ecc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404a1c
and dword [ebp - 0x14], 0
cmp dword [0x425958], 0
mov dword [ebp - 0x18], eax
jne 0x406f7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407027
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407027
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x425958], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42595c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x425960], eax
call edi
push eax
call esi
mov dword [0x425968], eax
test eax, eax
je 0x406f7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x425964], eax
mov eax, dword [0x425964]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406fd8
cmp dword [0x425968], ecx
je 0x406fd8
push eax
call esi
push dword [0x425968]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406fd8
test ebx, ebx
je 0x406fd8
call edi
test eax, eax
je 0x406fcf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x406fcf
test byte [ebp - 8], 1
jne 0x406fd8
or dword [ebp + 0x10], 0x200000
jmp 0x40700b
mov eax, dword [0x42595c]
cmp eax, dword [ebp - 0x18]
je 0x40700b
push eax
call esi
test eax, eax
je 0x40700b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40700b
mov eax, dword [0x425960]
cmp eax, dword [ebp - 0x18]
je 0x40700b
push eax
call esi
test eax, eax
je 0x40700b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x425958]
call esi
test eax, eax
je 0x407027
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407029
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x60676c39
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7fba7adb
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219