joyce8/EMBER2024-capa huggingface dataset:
Function at 0x581b6d
Capabilities:
Encode data using xor

Disassembly:
stc
push eax
jmp 0x581aa8
dec esi
fdiv dword [ebx + 1]
jae 0x581aad
mov cl, 0xe4
ja 0x581aaa
in al, 0x77
cli
movsb byte es:[edi], byte [esi]
nop
jmp 0x581ad8
mov dword [0x579b98c5], eax
out dx, eax
in eax, 0x4d
fist word [ebx + edi]
retf
mov edi, 0x2304c527
out dx, eax
pop es
dec edx
in eax, dx
outsb dx, byte [esi]
adc al, 0x8e
xor edi, dword [ebx + 0x24513dce]
pop eax
and eax, 0xba8fd027
pushal
sub eax, 0xb5ab3288
cmp bh, 0xf0
into
cmp eax, 0x25582451
daa
ror byte [edi - 0x77d29f46], 1
xor ch, byte [ebx - 0xf007d4b]
mov ch, 0x27
je 0x581b08
jge 0x581aa2
jecxz 0x581b83
xor ch, byte [ecx]
movsd dword es:[edi], dword [esi]
call 0x966e0fef
cmc
pop ebx
jmp dword [esi + 0xe]
pop edi
loope 0x581b74
xchg byte [edi + esi], dh
jl 0x581afa
test edx, ebx
das
fisubr dword [edi]
lds esi, [edx - 0x79]
clc
xchg ebp, eax
fyl2x
aas
in eax, 0xba
adc al, 0xe9
test byte [ecx], cl
mov ah, 0x69
adc eax, 0xdaf110be
pop ds
and eax, 0xd58fd57e
bound ebx, qword [ebx - 0x127a5110]
pop ebx
loope 0x581c03
inc esp
push ss
sbb dl, byte [ecx + 0x77652fb4]
mov esp, 0x6751088b
adc ch, byte [esi + 0x55]
invalid
insd dword es:[edi], dx
mov byte [0x26b907a9], al
rcr dword [ebp + 0x2b1ab6ed], 1
dec edi
imul byte [eax*4 + 0x1a39814d]
fiadd word [edi - 0x3a27c10f]
stosd dword es:[edi], eax
pop bx
xchg edi, eax
das
cmp ebp, dword [edx]
int 0x68
or esi, esp
sbb eax, 0x31f5c257
mov es, word [0xe18375b1]
adc eax, 0x2efd834f
mov gs, word [edi + 0x41]
adc dl, byte [eax - 0x6f]
mov ch, 8
and byte [esi], cl
aad 0x10
jae 0x581c44
adc byte [ebx - 3], dh
or byte [ebx + 0x45], ah
daa
cmpsd dword [esi], dword es:[edi]
pop ds
xor al, 0xfe
mov al, 0xf7
lcall 0xcc06, 0x8e0d653f
cwde
push edx
test dword [ecx - 0x5c], esp
imul esp
jo 0x581c0f
push es
int3
test eax, 0xc8e02ac6
and al, 2
or byte [ebp - 0x4e], bl
cmp al, 5
cwde
aas
push eax
dec eax
inc esi
push 0x5d
adc eax, 0xf1b22355
mov dword [0x8af50699], eax
pop ebp
xchg esp, eax
pushal
and eax, 0xf3663e8f
daa
dec esi
push eax
sub al, 0xb8
and dl, ch
xchg dword [edx - 0x6b], ebx
loope 0x581caa
sbb al, 0xaa
sbb eax, edi
rcl dword [eax], 0x97
aaa
daa
cmc
retf
mov byte [0x243b8734], al
mov al, byte [0x60e6147c]
and eax, 0x8a8f2562
outsd dx, dword [esi]
mov ch, 0x92
in eax, 0x43
jmp 0x581c57
Function at 0x5c7517
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov dword [0x3a2d4684], eax
jns 0x5c755a
cmpsd dword fs:[esi], dword es:[edi]
sal byte [edx - 0x30], 1
sbb dword [edi], edx
popfd
mov ah, 0xcb
jbe 0x5c755f
out 0x18, eax
and al, 0x3a
sbb byte [edx + edi], ah
push esi
jb 0x5c7591
xchg ebx, eax
xlatb
das
xchg ebx, eax
in al, dx
pop eax
push ecx
loopne 0x5c75bf
and al, 0x83
mov ch, 0xb
mov ch, 0x55
push es
push dword [0x7bd67bc3]
adc dl, byte [edi]
jnp 0x5c7551
jnp 0x5c758f
pop ss
cli
movhps qword [edx + 0x1b], xmm2
cdq
add cl, byte [ebp + edi*4 + 0x545b7693]
mov edi, 0xb650926
xor dword [ecx + 0x63], 0x15
cmp esp, dword [eax + 0x3f]
or eax, dword [ebx + 0x3b156371]
pushal
aas
jno 0x5c75f6
adc eax, 0x603f603b
pushal
mul byte [ecx]
xchg esp, eax
scasb al, byte es:[edi]
xchg byte [ebx - 0x7be9ea69], dl
wait
loopne 0x5c7550
shl dword [esi], 0xf3
inc ebp
adc dword [edi + 0x7478c699], 0xffffffc1
cmpsd dword [esi], dword es:[edi]
mov ah, 0xc
inc eax
and bh, dl
js 0x5c7579
invalid
hlt
sahf
pop edx
add al, 0xd2
rol edi, 1
push ss
std
push ds
mov ah, 0x9f
out 0xb7, al
adc al, 0xdd
cmpsb byte [esi], byte es:[edi]
add dl, byte [eax + 0x22706f75]
jo 0x5c765d
retf
shl byte [ecx], cl
stc
xchg ebp, eax
cmp ah, dl
loop 0x5c7622
aaa
dec ebp
je 0x5c7617
and eax, esi
lodsd eax, dword [esi]
int 0x2f
js 0x5c75f7
mov al, 0x1a
xchg esi, eax
sub cl, byte [ebx]
mov ch, 0xf1
xor esp, dword cs:[eax + ecx]
aam 0xc0
inc esi
xchg edx, eax
xchg al, cl
inc esp
xchg esi, eax
sbb edx, esi
sub word [ecx + 0x6cce2be6], 0x8b3b
cli
mov dh, 0x50
stosd dword es:[edi], eax
pop ebp
cmpsd dword [esi], dword es:[edi]
nop
xchg esi, eax
mov al, byte [0xab462e6]
xchg dword [esi + edx*8 - 0x1b], esp
xor al, 0xa1
inc edi
push cs
jecxz 0x5c7632
outsd dx, dword [esi]
cmc
loopne 0x5c75f5
inc eax
cmpsb byte [esi], byte es:[edi]
rol dword [edx + 0x45], 1
out 0xa5, eax
inc esp
popfd
jns 0x5c7620
mov edx, 0x5808e2be
push eax
xchg esp, eax
or dh, ah
cmp edx, edi
push 0xffffffffffffffd4
push esp
fst dword [ebp - 0x15bddefb]
add eax, dword [esp + edi*2 - 0x5305ed6c]
mov dl, 0x35
sar dword [edx + 0x66], 1
xchg ebx, eax
and al, 0x83
sub bh, dl
cmp esi, esi
push ss
add esp, eax
retf 0xa455

Function at 0x6133cd
Capabilities:
Encode data using xor

Disassembly:
repne insb byte es:[edi], dx
xchg esi, eax
rcr dword [edx - 0x6ea856eb], 0x6a
sub eax, 0x715df401
insb byte es:[edi], dx
daa
add dh, ch
xor eax, 0x45211e34
nop
xchg edi, eax
or byte [esi + 0x7c], cl
xlatb
xadd byte [ebx + 0xb], ch
fstp qword [ebp + 0xb7a135c]
invalid
Function at 0x4011dc
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x41c014]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401207
xor al, al
jmp 0x40125e
push esi
lea eax, [ebp - 0xc]
xor esi, esi
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40124e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
push esi
push esi
push 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40125b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x40125d
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402065
leave
ret

Function at 0x40130d
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x230
mov eax, dword [0x41c014]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
push 0x228
xor esi, esi
lea eax, [esp + 0x18]
push esi
push eax
mov ebx, ecx
call fcn.00403490
add esp, 0xc
mov dword [esp + 0x10], 0x22c
xor edi, edi
inc edi
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebp, eax
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4013b3
push 0x419e88
call fcn.00401006
push ebx
push 0x419e84
call fcn.0040516b
add esp, 0xc
jmp 0x4013a2
inc edi
cmp edi, 0x7d0
jg 0x4013ce
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.0040516b
pop ecx
pop ecx
test eax, eax
jne 0x40137c
push esi
push str.___Got_target_proc_PID:__d_n
call fcn.00401006
pop ecx
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402065
add esp, 0x230
ret
xor eax, eax
jmp 0x4013b5
Function at 0x405d20
Capabilities:
Query environment variable

Disassembly:
inc esi
or al, 0x8b
inc esi
add al, 0x85
pop edx
je 0x405cff
cmp byte [edi], 0x98
je 0x405cff
ror byte [esi + 4], cl
mov eax, dword [esi + 0x10]
push eax
xchg esi, eax
push edx
call 0xf340d423
sal byte [ecx + 0x46], 0x7c
push str._s:_illegal_option_____c_n
push eax
call dword [esi + 4]
add esp, 0x10
mov edx, dword [ebp + 0x10]
mov cl, byte [esi + 0x43]
pop edi
mov eax, 0x1111e
add dword [eax], eax
mov cl, bh
pop esi
jbe 0x405cd2
adc byte [eax], al
nop
sub dl, byte [eax - 0x6f6f6fd7]
nop
nop
nop
nop
xchg ecx, eax
nop
push ebp
mov ebp, esp
push ecx
push esi
push edi
call 0x4f40c1ae
test dword [edi + 0xfd690f], ecx
add byte [eax], al
cmp dword [0x635208dc], 0x14
jl 0x405e2e
mov eax, dword [0x410384]
test eax, eax
jne 0xed405e2e
mov dword [0x1a0384], 0x2801
dec esi
adc eax, 0x2e21c05c
mov ebp, dword [edi]
cmp dh, dh
je 0x405db3
mov eax, dword [0x5a0358]
test eax, eax
jne 0x405d09
fisubr word [eax + 0x10]
hlt
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, eax
jecxz 0x405dbd
call dword [ebx - 1]
adc eax, sym.imp.MSVCRT.dll___p__environ
push ebx
call dword [sym.imp.MSVCRT.dll___p__environ]
push eax
call 0x545e9c
mov edi, dword [ebp + 0x1c]
add esp, 0xc
test dword [edi - 0x2872d28c], esp
test ecx, esi
mov byte [0xc656001f], al
adc eax, 0x84c15c
add esp, 4
mov dword [edi], eax
call dword [sym.imp.MSVCRT.dll___p__environ]
mov edi, dword [edi]
cmp eax, 0x308bce
rol ecx, 1
jmp 0x8be650fe
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
add eax, 0x16a000c
sub dl, byte [0x98fc44c]
jmp 0x405db3

Function at 0x406810
Capabilities:
Get socket status

Disassembly:
mov ecx, 0x8b56458b
jne 0x406864
push 0xa24066e0
fcomp dword [edx + 0x1be850a8]
out dx, al
invalid
add byte [eax], al
Function at 0x409120
Capabilities:
Encode data using xor

Disassembly:
push ebp
in al, dx
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push esi
push edi
push eax
lea edx, [ebp - 0x2c]
invalid

Function at 0x409250
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
xchg esp, eax
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
inc ecx
jne 0x40926b
repne scasb al, byte es:[edi]
mul edx
dec edi
stc
invalid
add byte [eax], al
sti
dec ebp
pushal
jbe 0x4092dd
mov dl, byte [ebx + 1]
cmp dl, 0xef
xchg ecx, eax
and eax, 0xd502438a
xor eax, 0x5c3c0474
jne 0x40929f
push str.__
push esi
call dword [0x21e210]
adc al, byte [ebp + 0xc]
jmp 0xe8c39b5d
dec esp
pop ebp
cmp al, 0x2f
je 0x4092a9
xchg ebp, eax
pop esp
jne 0x4092dd
cmp dl, 0x2f
je 0x4092b3
cmp dl, 0x5c
jne 0x40932a
jae 0x409330
add ah, byte [eax]
pop ebp
and al, 0x83
jmp 0x10cbca0
lea eax, [ebp + 0xc]
lea ecx, [ebp + 0x10]
push eax
push esi
dec ebp
fucompi st(0)
mov ah, 0x16
jae 0x4092ec
test ecx, esp
ror byte [edi + 0x3d], cl
js 0x409304
add dword [eax], eax
jne 0x4092f5
pop edi
lahf
mov eax, 0x580016
daa
pop ebp
ret
test eax, eax
je 0x409312
rcr byte [esi - 0x48], 1
add byte es:[eax], al
add ch, bh
pop ebp
ret
mov ax, word [esi]
test ax, ax
je 0x409331
cmp ax, 0xcc
jne 0x409325
or al, 6
pop esp
jmp 0x40938c
mov ax, word [esi + 2]
push es
or eax, 0xc0856667
jne 0x40931a
jmp 0x5ea05368
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
cmp eax, 0x90909090
mov ecx, 0xd909090
in al, dx
push esi
invalid
add byte [edi + esi*8], cl
add al, 0x75
push 1
call dword [fcn.00408208]
add esp, 4
push 0xffffffffffffffff
daa
cmc
sbb esp, eax
movsb byte es:[edi], byte [esi]
rol byte [eax], 0xeb
sub byte [0x2000000], bh
jne 0x4093d1
push 0
push 0x7e
or cl, al
imul eax, dword [eax], 0xffffffa5
les eax, [edx + ebp*2]
jmp [edx - 0xa]
mov dword [esi - 0x60], 0xffffffff
mov esi, dword [esp + ecx - 0x7b]
cmp esi, dword [ebp + edx - 0x75]
inc eax
adc byte [ebp - 0x3cd02c40], al
call dword [0x40c092]
mov dword [esi + 0xc], 0x28000000
mov eax, edi
pop edi
pop esi
pop ebp
sub dword [eax - 0x166f6f70], edx
nop

Function at 0x409e5a
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x409e5c
ret
Function at 0x40add0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040add0
add esp, 0xc
pop ebp
retf
push ebp
aas
or byte [ebx + 0x4d8b8045], 0xc
cmp eax, 0x10
jae 0x40adee
call dword [sym.imp.MSVCRT.dll__errno]
mov dword [eax], 0x1b001c
xor eax, eax
jecxz 0x40adb1
adc byte [esi - 0x75], 0x87
popal
adc dword [edi + 4], edi
fdivr qword [ebx]
inc esi
cmp al, 0x63
xchg edx, eax
inc ebp
adc byte [esi + 0x1a], dh
mov eax, dword [ebp + 0x10]
mov ebx, 0x860064
and eax, 0xff
sal bh, cl
sti
add al, 0x30
mov byte [ecx], cl
daa
mov byte [ecx], al
inc ecx
jmp 0x40ae21
pop esi
dec esi
adc byte [ebx + 0xa], bh
stosd dword es:[edi], eax
inc dword [eax]
add byte [eax], al
cdq
idiv ebx
sbb byte [eax], dh
mov byte [ecx], al
inc ecx
mov al, byte [edx]
add al, 0x30
rol dword [ecx], 1
inc ecx
mov byte [ecx], 6
inc ecx
dec edi
movsd dword es:[edi], dword [esi]
mov ch, 0x70
inc ebp
jl 0x40aea7
pop esi
invalid
jg 0x40aebe
mov al, byte [0x8b0040c0]
push ebx
or al, 0x89
inc edx
adc byte [ebx + 0x488bd443], cl
and dword [eax - 0x74da8a37], ebp
xor eax, 0x4740cb98
call esi
test eax, eax
jne 0x40aed2
pop edi
inc esp
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call esi
pop edi
pop esi
add eax, 0xac904
pop ebx
mul ebp
pop ebp
ret 0xc
Function at 0x4022f0
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, 0xa5
and eax, 0xc3
dec edx
ror esi, 0xc7
not edi
sub edx, 0x2e
not esi
and esi, 0x8c
imul edx
sbb esi, 0xdc
sub edi, 0xca
ror eax, 0x3f
inc eax
imul edi
neg edi
sub esi, 0x9f
or esi, 0xe8
add eax, 0x96
dec eax
ror edx, 0x19
imul edx
rcl edx, 0x5a
or esi, 8
mov esi, 0x44
not edi
rcr esi, 0xb5
imul esi
or edi, 0xed
imul edi
inc eax
neg eax
mov ebx, 0x23
mov edi, 0x38
bswap esi
neg eax
neg esi
bswap esi
mov eax, 0xe4
mov edx, 0x98
rcr eax, 0x4d
imul esi
bswap edx
bswap esi
imul ebx
ror ebx, 0x38
or ebx, 0x9d
dec edx
sub eax, 0x2a
or edi, 0xc7
not ebx
xor ecx, ecx
xor edi, edi
neg esi
dec esi
not edi
neg ebx
rcr ebx, 0xf5
sbb edi, 0xdb
sub eax, 0x82
rcr edx, 0xdf
or eax, 0xde
dec esi
ror ebx, 0x6c
bswap edx
rol eax, 0x22
mov eax, 0x77
ror eax, 0xb1
neg edi
not edi
neg edi
rcr eax, 0xc6
or edx, 0x37
ror esi, 0xdc
not esi
or edi, 0xa6
add esi, 0xa3
or ebx, 0xae
imul esi
inc ebx
sbb edx, 0xd7
bswap edi
rcr ebx, 0xb8
bswap edx
rcr eax, 0x69
rcr edx, 0xa1
imul eax
rcl eax, 0x2a
dec ebx
rcl esi, 0xc1
add edi, 0xf2
or ebx, 0x22
mov ebx, 0x36
add eax, 0xa4
inc eax
sub eax, 0x35
not ebx
not eax
inc edi
bswap ebx
bswap eax
and esi, 0x7c
imul edi
mov ecx, dword [ebp + 0xc]
and edx, 0x4d
neg edx
bswap ebx
ror esi, 0x21
bswap edi
or eax, 0x40
imul edx
rcl ebx, 0xb5
imul ebx
sub ebx, 0xa5
rcl ebx, 9
neg ebx
mov ebx, 0xcb
neg ebx
not edi
ror esi, 0x79
sub ebx, 0xcd
add esi, 0x4d
sbb edx, 0x72
not ebx
neg edx
add ebx, 0x9c
ror eax, 0xbd
neg ebx
or edi, 0xaa
not esi
not ebx
imul edx
not edi
imul eax
or edi, 0x23
sbb ebx, 0xda
bswap edi
bswap esi
inc ebx
rol esi, 0x84
add eax, 3
dec ebx
and esi, 0x68
add eax, 0x5c
neg eax
bswap esi
and ebx, 0xc8
sbb esi, 0x98
inc edx
rol edx, 0x71
sbb ebx, 0xcd
imul edi
sbb edi, 0x57
imul eax
mov edi, dword [ebp + 8]
mov ebx, ebx
mov esi, esi
xor esi, eax
not byte [edi]
xor ebx, ebx
mov ebx, eax
mov eax, esi
xor esi, esi
xor eax, ebx
mov ebx, ebx
xor esi, ebx
xor eax, esi
mov esi, ebx
add byte [edi], 0x79
xor esi, esi
xor ebx, eax
xor esi, ebx
xor esi, esi
mov esi, ebx
xor ebx, esi
mov esi, eax
xor eax, eax
mov esi, ebx
sub byte [edi], 0x30
mov eax, ebx
mov esi, eax
mov esi, esi
xor esi, ebx
mov eax, esi
xor ebx, ebx
mov eax, eax
mov eax, esi
mov eax, ebx
imul byte [edi]
inc edi
loop 0x4024d0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40543a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46c894]
jne 0x405444
repz ret
jmp fcn.00409e16
Function at 0x40b61d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004083df
and dword [ebp - 4], 0
cmp dword [0x46de14], 0
mov ebx, eax
jne 0x40b6ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b77f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b77f
push eax
call fcn.0040836d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46de14], eax
call esi
push eax
call fcn.0040836d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46de18], eax
call esi
push eax
call fcn.0040836d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46de1c], eax
call esi
push eax
call fcn.0040836d
pop ecx
mov dword [0x46de24], eax
test eax, eax
je 0x40b6ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040836d
pop ecx
mov dword [0x46de20], eax
mov eax, dword [0x46de20]
cmp eax, ebx
je 0x40b726
cmp dword [0x46de24], ebx
je 0x40b726
push eax
call fcn.004083e8
push dword [0x46de24]
mov esi, eax
call fcn.004083e8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b726
test edi, edi
je 0x40b726
call esi
test eax, eax
je 0x40b71d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b71d
test byte [ebp - 0xc], 1
jne 0x40b726
or dword [ebp + 0x10], 0x200000
jmp 0x40b75f
mov eax, dword [0x46de18]
cmp eax, ebx
je 0x40b75f
push eax
call fcn.004083e8
pop ecx
test eax, eax
je 0x40b75f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b75f
mov eax, dword [0x46de1c]
cmp eax, ebx
je 0x40b75f
push eax
call fcn.004083e8
pop ecx
test eax, eax
je 0x40b75f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46de14]
call fcn.004083e8
pop ecx
test eax, eax
je 0x40b77f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b781
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46bf60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x34000]
push edi
or ebp, 0xffffffff
jmp 0x46bf82
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46bf89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46bf78
mov eax, 1
add ebx, ebx
jne 0x46bf9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46bf90
jne 0x46bfac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46bf90
xor ecx, ecx
sub eax, 3
jb 0x46bfc0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46c032
mov ebp, eax
add ebx, ebx
jne 0x46bfcb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x46bfd8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46bffc
inc ecx
add ebx, ebx
jne 0x46bfe8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46bfdd
jne 0x46bff9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46bfdd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46c01c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46c00d
jmp 0x46bf7e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46c01c
add edi, ecx
jmp 0x46bf7e
pop esi
mov edi, esi
mov ecx, 0xe71
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46c03a
cmp byte [edi], 0xe
jne 0x46c03a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46c03f
lea edi, [esi + 0x68000]
mov eax, dword [edi]
or eax, eax
je 0x46c0b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6c3b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6c4bc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46c06c
mov ecx, edi
jns 0x46c09b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6c4c4]
or eax, eax
je 0x46c0b1
mov dword [ebx], eax
add ebx, 4
jmp 0x46c089
call dword [esi + 0x6c4c0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x46c0e8
cmp al, 0xef
ja 0x46c0db
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x46c0bd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x46c0ca
mov ebp, dword [esi + 0x6c4c8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46c11c
sub esp, 0xffffff80
jmp 0x41903f
Function at 0x401ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor esi, esi
xor ebx, ebx
lea ebp, [edi + 0x158]
cmp ebx, 0x16
jge 0x401d1c
lea eax, [ebx + 0x65f]
lea ecx, [edi + 0xa4]
push eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
push ecx
lea edx, [esp + 0x18]
jmp 0x401d3e
lea eax, [ebx + 0x65f]
lea ecx, [edi + 0xe0]
push eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
push ecx
lea edx, [esp + 0x28]
push edx
push 0x40200003
mov ecx, ebp
call fcn.00460afe
inc ebx
add ebp, 0x3c
cmp ebx, 0x25
jl 0x401cf3
lea ebx, [edi + 0xe0]
push 0x65e
lea eax, [esp + 0x24]
push ebx
push eax
push 0x40000001
lea ecx, [edi + 0x11c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
call fcn.00460c09
mov ecx, dword [edi + 0x138]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push 6
push 0xc5
push ecx
call ebp
push 0x65d
lea edx, [esp + 0x24]
push ebx
push edx
push 0x40000001
lea ecx, [edi + 0x5c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
call fcn.00460c09
mov eax, dword [edi + 0x78]
push esi
push 0x14
push 0xc5
push eax
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x407d00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46ed55
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 2
push 1
mov dword [esp + 0xc], esi
call fcn.004359cf
push 2
push 0
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], 0
call fcn.004359cf
push 0xa
push 0x80020004
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 1
call fcn.00435a05
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 2
call fcn.0046a0ed
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 3
call fcn.0046a0ed
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 4
call fcn.0046a0ed
lea ecx, [esi + 0x48]
mov byte [esp + 0x10], 5
call fcn.0046a0ed
lea ecx, [esi + 0x50]
mov byte [esp + 0x10], 6
call fcn.0046a0ed
lea ecx, [esi + 0x58]
mov byte [esp + 0x10], 7
call fcn.0046a0ed
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret