joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca114
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ca2e4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x4ca2a0
mov eax, dword [ebp - 4]
call fcn.004cb848
cmp ebx, eax
jge 0x4ca2a0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf8]
mov edx, ebx
call fcn.004c2000
mov edx, dword [0x4c2bdc]
call fcn.0040362c
mov esi, eax
mov eax, esi
call fcn.004c35d0
test al, al
je 0x4ca296
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x4ca28a
xor eax, eax
push ebp
push 0x4ca283
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004ca68c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
call fcn.0042076c
mov dword [ebp - 0x10], eax
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x3e]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx edx, word [ebp - 0x22]
movzx eax, word [ebp - 0x20]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0x14]
movzx esi, word [ebp - 0x1e]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.0040499c
mov eax, dword [ebp - 8]
call fcn.00404868
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004ca474
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x138]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca2ce
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x110]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x4ca282
mov eax, dword [ebp - 4]
call fcn.004ca710
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040a01c
jmp 0x4ca2ce
mov eax, dword [ebp - 8]
call fcn.00404350
jmp 0x4ca2ce
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x48]
push eax
push 0
lea edx, [ebp - 0x4c]
mov eax, 0xb3
call fcn.004095a4
mov ecx, dword [ebp - 0x4c]
mov dl, 1
mov eax, dword [0x41b72c]
call fcn.0040d4d0
call fcn.00403ccc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca2eb
lea eax, [ebp - 0x4c]
call fcn.00404350
ret
Function at 0x4cc234
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xd0], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4cc2b4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xc8
lea eax, [ebp - 0xc9]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov ebx, eax
test ebx, ebx
je 0x4cc294
push esi
lea eax, [ebp - 0xd0]
lea edx, [ebp - 0xc9]
call fcn.00404548
mov eax, dword [ebp - 0xd0]
mov ecx, ebx
mov edx, 1
call fcn.00404870
jmp 0x4cc29b
mov eax, esi
call fcn.00404350
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cc2bb
lea eax, [ebp - 0xd0]
call fcn.00404350
ret

Function at 0x4ccfa4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, eax
mov ebx, esp
push 0x80
push ebx
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, esi
mov edx, ebx
call fcn.00404548
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x4cd06c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404800
mov eax, dword [ebp - 8]
call fcn.00404800
xor eax, eax
push ebp
push 0x4cd0f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040973c
test al, al
je 0x4cd0b2
mov edx, 0x20
mov eax, dword [ebp - 8]
call fcn.00409914
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404810
push eax
mov eax, dword [ebp - 4]
call fcn.00404810
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd0fa
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404374
ret

Function at 0x4cd264
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4cd2d8
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4cd2bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4dfdc4]
cmp dword [eax], 1
je 0x4cd2aa
push 0
push 1
push 0x4cd2e8
call sub.wininet.dll_InternetCheckConnectionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
jmp 0x4cd2b2
call fcn.004cd1cc
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cd2ca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd2df
ret
Function at 0x4ce158
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404800
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x4ce2e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
call fcn.00408d4c
cmp dword [ebp - 0x130], 0
je 0x4ce2bb
xor edx, edx
mov eax, 2
call fcn.00498d0c
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00498d2c
jmp 0x4ce2b3
lea eax, [ebp - 0x13c]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004045c0
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00409c78
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00408afc
mov eax, dword [ebp - 0x134]
push eax
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 4]
call fcn.00408afc
mov edx, dword [ebp - 0x140]
pop eax
call fcn.0040475c
je 0x4ce293
lea eax, [ebp - 0x148]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004045c0
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00408afc
mov eax, dword [ebp - 0x144]
push eax
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 4]
call fcn.00408afc
mov edx, dword [ebp - 0x14c]
pop eax
call fcn.0040475c
jne 0x4ce2aa
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov bl, 1
mov edx, edi
mov eax, esi
call fcn.00498d4c
test eax, eax
jne 0x4ce1f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ce2e8
lea eax, [ebp - 0x14c]
mov edx, 8
call fcn.00404374
lea eax, [ebp - 4]
call fcn.00404350
ret

Function at 0x4d018c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00428f54
cmp ebx, dword [ebp - 8]
jge 0x4d01ef
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00429264
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00429264
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00429290
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4d01b5
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d01f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00428f54
cmp ebx, dword [ebp - 8]
jge 0x4d025b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00429264
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00429264
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00429290
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4d0221
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4012b0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push 0x104
push 0x104
mov ecx, esi
call fcn.00403740
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4012e0
mov eax, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push 0xffffffffffffffff
mov ecx, esi
call fcn.00403300
mov ecx, esi
call fcn.004032e0
push 0x41d224
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00403c90
push 0
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.004034f0
lea ecx, [esp + 0xc]
mov edi, eax
call fcn.004031d0
cmp edi, 0xffffffff
je 0x401329
sub ebx, edi
push ebx
push edi
mov ecx, esi
call fcn.00403bf0
mov esi, dword [esp + 0x18]
push 0x41d25c
mov ecx, esi
call fcn.00403ce0
push 0x104
mov ecx, esi
call fcn.00403740
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00403300
cmp dword [0x4235e0], 0
je 0x40138e
push ecx
mov ecx, esp
push str.ADL_ODT_TMP
call fcn.00403c90
lea ecx, [esp + 0x10]
push ecx
call fcn.00403e50
add esp, 8
push eax
mov ecx, esi
call fcn.004031f0
lea ecx, [esp + 0xc]
call fcn.004031d0
push 0x41d224
lea ecx, [esp + 0x10]
call fcn.00403c90
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.004032e0
dec eax
push eax
mov ecx, esi
call fcn.00403370
test al, al
lea ecx, [esp + 0xc]
sete bl
call fcn.004031d0
test bl, bl
je 0x4013e6
push 0x41d224
lea ecx, [esp + 0x10]
call fcn.00403c90
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00403790
lea ecx, [esp + 0xc]
call fcn.004031d0
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.004031f0
push 0x41d228
lea ecx, [esp + 0x10]
call fcn.00403c90
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00403790
lea ecx, [esp + 0xc]
call fcn.004031d0
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x401420
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push esi
push 0xffffffffffffffff
lea ecx, [esp + 0x64]
xor esi, esi
call fcn.00403740
cmp eax, esi
jne 0x40143d
or esi, 0xffffffff
jmp 0x4014db
xor ecx, ecx
mov edx, 5
mov dword [esp + 4], esi
mov dword [esp + 0x18], 0x44
mov dword [esp + 0x1c], esi
mov dword [esp + 0x4c], esi
mov word [esp + 0x4a], cx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x40], esi
mov word [esp + 0x48], dx
cmp dword [esp + 0x68], esi
je 0x401485
mov ecx, 0x8000000
lea edx, [esp + 8]
push edx
lea edx, [esp + 0x1c]
push edx
push esi
push esi
push ecx
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4014ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x4014db
cmp dword [esp + 0x64], esi
je 0x4014db
mov eax, dword [esp + 8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, 0xfffffffe
test eax, eax
je 0x4014db
mov esi, dword [esp + 4]
push 0xffffffffffffffff
lea ecx, [esp + 0x64]
call fcn.00403300
lea ecx, [esp + 0x60]
call fcn.004031d0
mov eax, esi
pop esi
add esp, 0x58
ret
Function at 0x401620
Capabilities:
Copy file
Enumerate files on windows
Set file attributes

Disassembly:
sub esp, 0x268
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00403190
lea ecx, [esp + 0x10]
call fcn.00403190
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x280]
call fcn.004032f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401759
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea ecx, [esp + 0x280]
push ecx
lea ecx, [esp + 0x18]
call fcn.004031f0
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0x20]
call fcn.00403c90
push 0x41d224
lea ecx, [esp + 0x24]
call fcn.00403c90
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00403810
lea ecx, [esp + 0x20]
call fcn.004031d0
lea ecx, [esp + 0x1c]
call fcn.004031d0
lea edx, [esp + 0x284]
push edx
lea ecx, [esp + 0x14]
call fcn.004031f0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x1c]
call fcn.00403c90
push 0x41d224
lea ecx, [esp + 0x28]
call fcn.00403c90
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
call fcn.00403810
lea ecx, [esp + 0x24]
call fcn.004031d0
lea ecx, [esp + 0x18]
call fcn.004031d0
push 1
lea ecx, [esp + 0x14]
call fcn.004032f0
push eax
lea ecx, [esp + 0x1c]
call fcn.004032f0
push eax
call ebp
test eax, eax
je 0x40179c
push 0x80
lea ecx, [esp + 0x14]
call fcn.004032f0
push eax
call esi
lea eax, [esp + 0x28]
push eax
push ebx
call edi
test eax, eax
jne 0x401671
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x10]
call fcn.004031d0
lea ecx, [esp + 0x14]
call fcn.004031d0
lea ecx, [esp + 0x27c]
call fcn.004031d0
lea ecx, [esp + 0x280]
call fcn.004031d0
lea ecx, [esp + 0x284]
call fcn.004031d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x268
ret
mov esi, dword [esp + 0x288]
push str.Cannot_copy_file
mov ecx, esi
call fcn.00403ce0
push str._in
lea ecx, [esp + 0x1c]
call fcn.00403c90
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.004038d0
lea ecx, [esp + 0x18]
call fcn.004031d0
lea ecx, [esp + 0x10]
call fcn.004031d0
lea ecx, [esp + 0x14]
call fcn.004031d0
lea ecx, [esp + 0x27c]
call fcn.004031d0
lea ecx, [esp + 0x280]
call fcn.004031d0
lea ecx, [esp + 0x284]
call fcn.004031d0
pop edi
pop esi
pop ebp
mov eax, 0x10
pop ebx
add esp, 0x268
ret
Function at 0x404410
Capabilities:
Get geographical location

Disassembly:
mov ecx, dword [0x4235f4]
sub esp, 0x104
test ecx, ecx
je 0x404436
mov eax, dword [ecx]
mov edx, dword [esp + 0x108]
mov eax, dword [eax + 8]
push edx
call eax
add esp, 0x104
ret
push ebx
push ebp
push esi
mov dword [esp + 0xc], 0x80004005
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0x1e
lea ecx, [esp + 0x20]
push ecx
mov ebx, eax
push 0x1001
push ebx
call ebp
push 0x1e
lea edx, [esp + 0x5c]
push edx
push 0x1002
push ebx
mov esi, eax
call ebp
test esi, esi
je 0x404566
test eax, eax
je 0x404566
xor eax, eax
jmp 0x404490
movzx ecx, word [esp + eax + 0x1c]
mov word [esp + eax + 0x94], cx
add eax, 2
test cx, cx
jne 0x404490
push edi
lea edi, [esp + 0x98]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4044b0
mov eax, dword [0x41de48]
mov dword [edi], eax
lea eax, [esp + 0x5c]
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4044d0
lea edi, [esp + 0x98]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4044f0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4044f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x98]
push ecx
push 0
call fcn.00406fc4
add esp, 8
pop edi
test eax, eax
je 0x404566
push 6
lea edx, [esp + 0x14]
push edx
push 0x1004
push ebx
call ebp
test eax, eax
je 0x404566
lea eax, [esp + 0x10]
push eax
call fcn.00406fb9
add esp, 4
test eax, eax
je 0x404566
mov ecx, dword [esp + 0x114]
pop esi
mov dword [esp + 8], 0
pop ebp
mov dword [ecx], eax
mov eax, dword [esp + 4]
pop ebx
add esp, 0x104
ret
push 0x41de44
push 0
call fcn.00406e33
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetACP]
mov ecx, dword [esp + 0x114]
pop esi
pop ebp
mov dword [ecx], eax
mov eax, dword [esp + 4]
pop ebx
add esp, 0x104
ret

Function at 0x4049ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4049dd
call fcn.00408700
mov dword [eax], esi
call fcn.004086ed
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00408685
add esp, 0x14
push 0x16
pop eax
jmp 0x404a32
test dword [ebp + 0xc], 0xfffffff9
jne 0x4049b9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x404a0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00408713
pop ecx
call fcn.004086ed
mov eax, dword [eax]
jmp 0x404a32
test al, 0x10
jne 0x404a30
test al, 1
je 0x404a30
test byte [ebp + 0xc], 2
je 0x404a30
call fcn.00408700
mov dword [eax], 5
call fcn.004086ed
mov dword [eax], 0xd
jmp 0x404a01
xor eax, eax
pop esi
pop ebp
ret

Function at 0x411ce4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4227c8]
jne 0x411cee
repz ret
jmp fcn.00417d8f
Function at 0x413e62
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407ba1
and dword [ebp - 4], 0
cmp dword [0x423d6c], 0
mov ebx, eax
jne 0x413f13
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413fc4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413fc4
push eax
call fcn.00407b2f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423d6c], eax
call esi
push eax
call fcn.00407b2f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423d70], eax
call esi
push eax
call fcn.00407b2f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423d74], eax
call esi
push eax
call fcn.00407b2f
pop ecx
mov dword [0x423d7c], eax
test eax, eax
je 0x413f13
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407b2f
pop ecx
mov dword [0x423d78], eax
mov eax, dword [0x423d78]
cmp eax, ebx
je 0x413f6b
cmp dword [0x423d7c], ebx
je 0x413f6b
push eax
call fcn.00407baa
push dword [0x423d7c]
mov esi, eax
call fcn.00407baa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413f6b
test edi, edi
je 0x413f6b
call esi
test eax, eax
je 0x413f62
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413f62
test byte [ebp - 0xc], 1
jne 0x413f6b
or dword [ebp + 0x10], 0x200000
jmp 0x413fa4
mov eax, dword [0x423d70]
cmp eax, ebx
je 0x413fa4
push eax
call fcn.00407baa
pop ecx
test eax, eax
je 0x413fa4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413fa4
mov eax, dword [0x423d74]
cmp eax, ebx
je 0x413fa4
push eax
call fcn.00407baa
pop ecx
test eax, eax
je 0x413fa4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423d6c]
call fcn.00407baa
pop ecx
test eax, eax
je 0x413fc4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413fc6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4044ab
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec dword [ebx - 0xe0807bb]
test edx, edx
je 0x4044bb
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004041cd
xor esp, ebp
pop esi
lea eax, [ebp - 0x40]
push eax
call fcn.004041dd
push eax
push esi
push dword [ebp + 8]
call fcn.00404192
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004041cd
xchg byte [edi], cl
push ebx
xchg edi, eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004041dd
push eax
push esi
push dword [ebp + 8]
call fcn.00404192
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004041dd
push eax
push esi
push dword [ebp + 8]
call fcn.00404192
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004041dd
push eax
push esi
push dword [ebp + 8]
call fcn.00404192
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004041cd
fild qword [0x9d887fe0]
jl 0x404652
invalid
invalid