joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414230
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
lea esi, [esp + 4]
mov eax, ebx
call fcn.00403734
push esp
push 0x20019
push 0
push 0x414318
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4142aa
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x414268
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x414340
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4142aa
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403998
jmp 0x41430d
push esp
push 0x20019
push 0
push 0x414318
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41430d
xor eax, eax
mov dword [esi], eax
lea eax, [esp + 8]
mov byte [eax], 0
inc dword [esi]
inc eax
cmp dword [esi], 0x100
jne 0x4142cd
mov dword [esi], 0xff
push esi
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0x414340
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41430d
mov eax, ebx
lea edx, [esp + 8]
mov ecx, pe_nt_image_headers32
call fcn.00403998
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x401090
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
push 0xa
push dword [ebp + 8]
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4010b0
jmp 0x4010d0
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
mov dword [0x4054a0], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4010cd
jmp 0x4010d0
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x4010e0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
pushal
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x400]
push esi
push ebx
call sub.kernel32.dll_lstrcpyA
xor ecx, ecx
jmp 0x4010ff
inc ecx
cmp byte [ecx + ebx], 0x5c
jne 0x4010fe
mov byte [ecx + ebx], 0
lea esi, [ecx + esi + 1]
mov edi, 0x402cca
push str.HKEY_CLASSES_ROOT
push ebx
call edi
or eax, eax
jne 0x401125
mov eax, 0x80000000
jmp 0x401186
push str.HKEY_CURRENT_CONFIG
push ebx
call edi
or eax, eax
jne 0x401138
mov eax, 0x80000005
jmp 0x401186
push str.HKEY_CURRENT_USER
push ebx
call edi
or eax, eax
jne 0x40114b
mov eax, 0x80000001
jmp 0x401186
push str.HKEY_LOCAL_MACHINE
push ebx
call edi
or eax, eax
jne 0x40115e
mov eax, 0x80000002
jmp 0x401186
push str.HKEY_USERS
push ebx
call edi
or eax, eax
jne 0x401171
mov eax, 0x80000003
jmp 0x401186
push str.HKEY_DYN_DATA
push ebx
call edi
or eax, eax
jne 0x401184
mov eax, 0x80000006
jmp 0x401186
jmp 0x4011a2
mov byte [ebx], 0
push dword [ebp + 0x10]
push esi
push eax
push ebx
call fcn.00402e60
cmp byte [ebx], 0
je 0x4011a2
push ebx
push dword [ebp + 8]
call sub.kernel32.dll_SetEnvironmentVariableA
popal
leave
ret 0xc

Function at 0x4013b0
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x405725
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcpyA
push str..BAK
push esi
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4013e7
push 0
push esi
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
mov al, 0
jmp 0x4013e9
mov al, 1
mov byte [0x40593d], al
popal
leave
ret 4

Function at 0x401400
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x405725
cmp dword [ebp + 8], 0
jne 0x401436
cmp byte [0x40593d], 0
jne 0x401425
push 0
push 0x405525
push esi
call sub.kernel32.dll_CopyFileA
cmp byte [0x40593d], 0
jne 0x401486
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x401486
push 0x6b
push dword [0x4054c4]
call sub.user32.dll_IsDlgButtonChecked
cmp byte [0x4059e3], 1
jne 0x401461
cmp byte [0x4059e4], 1
jne 0x40145c
mov eax, 1
jmp 0x401461
mov eax, 0
cmp eax, 1
jne 0x401484
push 0x405316
call fcn.00401360
push esi
call fcn.00401360
push dword [0x405925]
push esi
call sub.kernel32.dll_SetFileAttributesA
jmp 0x401486
jmp 0x401425
popal
leave
ret 4
Function at 0x401490
Capabilities:
Check if file exists
Get file attributes
Get file size
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov dword [ebp - 0x404], 0
push 0x200
push 0x405525
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x405525
call sub.kernel32.dll_GetFileAttributesA
mov dword [0x405925], eax
test eax, 1
je 0x4014da
xor eax, 1
push eax
push 0x405525
call sub.kernel32.dll_SetFileAttributesA
push 0x405525
call fcn.004013b0
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x405525
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x401603
cmp byte [0x4059e3], 0
jne 0x4015fe
push 0x405525
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4015dd
push 0x405525
call fcn.00402e00
cmp word [eax], 0x2e2a
je 0x401560
cmp word [eax], 0
je 0x401560
push 0x34
push 0x405525
push 0x4050c7
push dword [0x4054c4]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x4015fe
lea esi, [ebp - 0x200]
mov edi, 0x405525
cmp byte [edi + 1], 0x3a
jne 0x401579
push edi
call fcn.00402e00
mov edi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, 0
jbe 0x40158c
inc eax
push esi
push eax
add esi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
pop eax
add esi, eax
push 0x2e
push str.Exe
push esi
call sub.kernel32.dll_RtlMoveMemory
pop esi
lea ebx, [ebp - 0x400]
push 0x405525
push ebx
call sub.kernel32.dll_lstrcpyA
push ebx
call fcn.00401300
push dword [0x4054c4]
push ebx
push esi
push 0x405525
call fcn.00402d80
cmp eax, 1
jne 0x4015db
jmp 0x4014b6
jmp 0x4015fe
push 0x34
push 0x405525
push 0x40529b
push dword [0x4054c4]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x4015fe
jmp 0x4014b6
jmp 0x4016a7
push 0x405351
call fcn.00401360
push 0x405525
call fcn.00401360
mov dword [0x405929], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x40592d], eax
cmp dword [ebp + 0xc], 0
jne 0x401632
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 1
jne 0x401651
add eax, 0x23b
add eax, dword [0x4054a0]
push 0x100
push eax
call fcn.00402e40
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
pop dword [0x405939]
push 0
push dword [0x405939]
push 0
push 4
push 0
push dword [0x405929]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x401683
push 0x4050ef
call fcn.00401360
jmp 0x4016a7
mov dword [0x405935], eax
push 0
push 0
push 0
push 2
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x40169c
jmp 0x401677
mov dword [0x405931], eax
mov dword [ebp - 0x404], eax
popal
mov eax, dword [ebp - 0x404]
leave
ret 0xc
Function at 0x4016c0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [0x405929]
or esi, esi
je 0x401718
push dword [0x405931]
call sub.kernel32.dll_UnmapViewOfFile
push dword [0x405935]
call sub.kernel32.dll_CloseHandle
push 0
push 0
push dword [0x405939]
push esi
call sub.kernel32.dll_SetFilePointer
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
push dword [ebp + 8]
call fcn.00401400
push dword [0x405925]
push 0x405525
call sub.kernel32.dll_SetFileAttributesA
popal
leave
ret 4

Function at 0x401750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
pushal
mov byte [ebp - 0x201], 0
push 1
push 8
call fcn.00401050
or eax, eax
je 0x4017ad
mov esi, eax
push 0x200
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push str.BASSMOD.dll
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_lstrcatA
mov ecx, dword [esi + 1]
lea eax, [esi + 5]
push ecx
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.00402d24
mov byte [ebp - 0x201], 1
popal
movzx eax, byte [ebp - 0x201]
leave
ret
Function at 0x4027f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x40281d
inc ecx
cmp ecx, dword [0x40592d]
jne 0x40281d
push 0x405460
call fcn.00401360
xor eax, eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10
cmp dword [ecx + esi], 0x4550
jne 0x4027ff
add esi, ecx
mov eax, dword [ebp + 8]
add eax, dword [0x40592d]
cmp dword [eax - 4], 0x32505564
jne 0x402846
push 0x405477
call fcn.00401360
jmp 0x402812
push esi
movzx eax, word [esi + 6]
dec eax
imul eax, eax, 0x28
movzx ecx, word [esi + 0x14]
add esi, 0x18
add esi, ecx
mov edi, esi
or dword [edi + 0x24], 0x80000000
add edi, eax
pop esi
cmp dword [ebp + 0xc], 4
jne 0x40286f
mov ecx, dword [esi + 0x34]
jmp 0x402871
xor ecx, ecx
mov dword [0x402b4d], ecx
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x34]
mov dword [0x402b45], ebx
add dword [0x402b45], ecx
mov eax, dword [edi + 0xc]
add eax, dword [edi + 0x10]
mov dword [esi + 0x28], eax
cmp dword [ebp + 0xc], 4
jne 0x4028a2
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 0x10]
add eax, ebx
jmp 0x4028a4
xor eax, eax
mov dword [0x402b51], eax
mov eax, dword [ebp + 8]
add eax, dword [edi + 0x14]
add eax, dword [edi + 0x10]
mov ecx, 0x40292d
mov ebx, 0x23b
mov edx, eax
add edx, ebx
push edx
push ebx
push ecx
push eax
call sub.kernel32.dll_RtlMoveMemory
pop edx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 0x16]
lea ecx, [eax + ecx]
mov ebx, dword [0x4054a0]
sub ebx, eax
push ebx
push ecx
push edx
call sub.kernel32.dll_RtlMoveMemory
mov eax, dword [ebp + 0x10]
push 0x100
push eax
call fcn.00402e40
add dword [edi + 8], eax
add dword [edi + 0x10], eax
or dword [edi + 0x24], 0xe0000000
mov eax, dword [edi + 0xc]
add eax, dword [edi + 8]
mov ebx, dword [esi + 0x38]
push ebx
push eax
call fcn.00402e40
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [0x405939]
mov dword [eax - 4], 0x32505564
xor eax, eax
inc eax
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10

Function at 0x402d24
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402d4f
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x402e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.advapi32.dll_RegQueryValueExA
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegCreateKeyExA
or eax, eax
jne 0x402ee2
mov eax, 4
mov dword [ebp - 4], eax
inc dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp - 8]
call sub.advapi32.dll_RegQueryValueExA
push eax
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
pop eax
leave
ret 0x10

Function at 0x402f60
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
pushal
cmp dword [ebp + 8], 0
jne 0x402fa0
push 0
call sub.kernel32.dll_GetModuleHandleA
lea esi, [ebp - 0x200]
push 0x200
push esi
push eax
call sub.kernel32.dll_GetModuleFileNameA
push esi
call sub.kernel32.dll_lstrlenA
push esi
add esi, eax
jmp 0x402f95
dec esi
cmp byte [esi], 0x5c
jne 0x402f94
mov byte [esi], 0
pop esi
jmp 0x402fa3
mov esi, dword [ebp + 8]
push esi
call sub.kernel32.dll_SetCurrentDirectoryA
popal
leave
ret 4

Function at 0x402fb0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 1], 0
mov esi, dword [ebp + 8]
or esi, esi
je 0x402fff
cmp byte [esi], 0
je 0x402fff
lea edi, [ebp - 0x401]
jmp 0x402fd4
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp byte [esi], 0x5c
je 0x402fde
cmp byte [esi], 0
jne 0x402fd2
cmp al, 0x3a
je 0x402fd2
lodsb al, byte [esi]
stosb byte es:[edi], al
mov byte [edi], 0
push 0
lea eax, [ebp - 0x401]
push eax
call sub.kernel32.dll_CreateDirectoryA
cmp byte [esi - 1], 0
jne 0x402fd0
mov byte [ebp - 1], 1
popal
movzx eax, byte [ebp - 1]
leave
ret 4
Function at 0xfb219c
Capabilities:
Hash data with md5

Disassembly:
call fcn.00fb212e
adc eax, 0xc2c76660
aas
cmp dh, dh
salc
popal
pushal
lea esp, [esp + 0x14]
jmp 0xfd5ccb
pushal
mov bx, word [esp]
popal
pushal
mov byte [esp + 0xf], al
push word [esp + 0xe]
push dword [esp + 0xa]
mov dword [esp + 0x1f], ebx
pushfd
jmp 0xfc98e1
lea esp, [esp + 0x22]
pushal
push di
push edi
pop dword [esp + 0x19]
lea esp, [esp + 2]
lea esp, [esp + 0x28]
pushal
xchg cx, dx
popal
pushal
pop word [esp + 3]
mov dword [esp + 0x13], ecx
pop dword [esp + 0xf]
jmp 0xfc9990
pop dword [esp + 0xb]
pop dword [esp + 6]
lea esp, [esp + 0xe]
lea esp, [esp + 4]
jmp 0xfb2196
mov word [esp + 7], dx
pop dword [esp + 3]
pop word [esp + 3]
mov word [esp + 1], di
push eax
push word [esp + 1]
mov byte [esp + 4], bh
jmp 0xfd5dc9
lea esp, [esp + 0xc]
lea esp, [esp + 4]
jmp 0xfd5dea
pushal
mov ecx, 0x78b409d5
bswap ebx
popal
pushal
push dword [esp + 0x1d]
pop dword [esp + 0x1a]
push esi
push word [esp + 0x20]
push si
mov word [esp + 1], ax
push word [esp + 0x17]
mov dword [esp + 2], edx
jmp 0xfd5ef5
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
jmp 0xfd5fa4
pop word [esp + 0x14]
lea esp, [esp + 0x28]
and dword [eax + 4], 0
and dword [eax], 0
jmp 0xfd5ecf
mov dword [eax + 0x14], 0x10325476
ret

Function at 0xfc9890
Capabilities:
Hash data with md5

Disassembly:
call fcn.00fb212e
adc eax, 0xc2c76660
aas
cmp dh, dh
salc
popal
pushal
lea esp, [esp + 0x14]
jmp 0xfd5ccb
pushal
mov bx, word [esp]
popal
pushal
mov byte [esp + 0xf], al
push word [esp + 0xe]
push dword [esp + 0xa]
mov dword [esp + 0x1f], ebx
pushfd
jmp 0xfc98e1
lea esp, [esp + 0x22]
pushal
push di
push edi
pop dword [esp + 0x19]
lea esp, [esp + 2]
lea esp, [esp + 0x28]
pushal
xchg cx, dx
popal
pushal
pop word [esp + 3]
mov dword [esp + 0x13], ecx
pop dword [esp + 0xf]
jmp 0xfc9990
pop dword [esp + 0xb]
pop dword [esp + 6]
lea esp, [esp + 0xe]
lea esp, [esp + 4]
jmp 0xfb2196
mov word [esp + 7], dx
pop dword [esp + 3]
pop word [esp + 3]
mov word [esp + 1], di
push eax
push word [esp + 1]
mov byte [esp + 4], bh
jmp 0xfd5dc9
lea esp, [esp + 0xc]
lea esp, [esp + 4]
jmp 0xfd5dea
pushal
mov ecx, 0x78b409d5
bswap ebx
popal
pushal
push dword [esp + 0x1d]
pop dword [esp + 0x1a]
push esi
push word [esp + 0x20]
push si
mov word [esp + 1], ax
push word [esp + 0x17]
mov dword [esp + 2], edx
jmp 0xfd5ef5
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
jmp 0xfd5fa4
pop word [esp + 0x14]
lea esp, [esp + 0x28]
and dword [eax + 4], 0
and dword [eax], 0
jmp 0xfd5ecf
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x4e5ee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa3000]
push edi
jmp 0x4e5efa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e5f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5ef0
mov eax, 1
add ebx, ebx
jne 0x4e5f13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e5f24
jne 0x4e5f43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5f43
dec eax
add ebx, ebx
jne 0x4e5f30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e5f08
add ebx, ebx
jne 0x4e5f3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e5f95
xor ecx, ecx
sub eax, 3
jb 0x4e5f5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e5fca
sar eax, 1
mov ebp, eax
jmp 0x4e5f66
add ebx, ebx
jne 0x4e5f66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5f34
inc ecx
add ebx, ebx
jne 0x4e5f74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e5f34
add ebx, ebx
jne 0x4e5f81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e5f76
jne 0x4e5f92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e5f76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e5fb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e5fa6
jmp 0x4e5ef6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e5fb4
add edi, ecx
jmp 0x4e5ef6
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e5fd2
cmp byte [edi], 0x13
jne 0x4e5fd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e5fd7
lea edi, [esi + 0xe1000]
mov eax, dword [edi]
or eax, eax
je 0x4e604f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11a6b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x11a80c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e6004
mov ecx, edi
jns 0x4e6033
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x11a810]
or eax, eax
je 0x4e6049
mov dword [ebx], eax
add ebx, 4
jmp 0x4e6021
call dword [esi + 0x11a820]
mov ebp, dword [esi + 0x11a814]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e6083
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x636a48ff
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x534075c8
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401114
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x4012ce
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x1e
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 8], str.DLGCLASS
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push 0x4012ce
push 0
push 0x3e8
push dword [section..data]
call sub.user32.dll_CreateDialogParamA
push 1
push dword [0x403008]
call sub.user32.dll_ShowWindow
push dword [0x403008]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4011d3
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4011ac
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x438860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x438882
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x438889
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x438878
mov eax, 1
add ebx, ebx
jne 0x43889b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x438890
jne 0x4388ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x438890
xor ecx, ecx
sub eax, 3
jb 0x4388c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x438932
mov ebp, eax
add ebx, ebx
jne 0x4388cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4388d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4388fc
inc ecx
add ebx, ebx
jne 0x4388e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4388dd
jne 0x4388f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4388dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x43891c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x43890d
jmp 0x43887e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x43891c
add edi, ecx
jmp 0x43887e
pop esi
mov edi, esi
mov ecx, 0xe0e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x43893a
cmp byte [edi], 0xa
jne 0x43893a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x43893f
lea edi, [esi + 0x36000]
mov eax, dword [edi]
or eax, eax
je 0x4389b7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3820c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x382ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x43896c
mov ecx, edi
jns 0x43899b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x382b0]
or eax, eax
je 0x4389b1
mov dword [ebx], eax
add ebx, 4
jmp 0x438989
call dword [esi + 0x382b4]
popal
jmp 0x41be59