joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c49d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040c464
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00408c96
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040c3ea
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040c40a
inc esi
cmp esi, 0xc
jl 0x40c4bc
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x410550]
test byte [eax + 0x28], 2
movzx eax, byte [0x4205bf]
jne 0x40c4f7
movzx eax, byte [0x4205c7]
movzx ecx, cx
cmp ecx, eax
je 0x40c503
or eax, 0xffffffff
jmp 0x40c548
mov ecx, dword [0x420568]
mov eax, ecx
cdq
cmp edx, dword [0x40f924]
push edi
jl 0x40c525
mov edx, dword [0x40f920]
jg 0x40c521
cmp eax, edx
jbe 0x40c525
mov edi, edx
jmp 0x40c527
mov edi, ecx
mov esi, dword [0x420560]
jmp 0x40c541
dec edi
call fcn.0040c3ea
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040c40a
inc esi
test edi, edi
jne 0x40c52f
xor eax, eax
pop edi
pop esi
leave
ret 8
Function at 0xcf5b30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xbfb015
lea edi, [esi - 0x7fa015]
push edi
or ebp, 0xffffffff
jmp 0xcf5b52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xcf5b59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcf5b48
mov eax, 1
add ebx, ebx
jne 0xcf5b6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xcf5b7c
jne 0xcf5b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcf5b9b
dec eax
add ebx, ebx
jne 0xcf5b88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xcf5b60
add ebx, ebx
jne 0xcf5b97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xcf5bed
xor ecx, ecx
sub eax, 3
jb 0xcf5bb3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xcf5c22
sar eax, 1
mov ebp, eax
jmp 0xcf5bbe
add ebx, ebx
jne 0xcf5bbe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcf5b8c
inc ecx
add ebx, ebx
jne 0xcf5bcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xcf5b8c
add ebx, ebx
jne 0xcf5bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xcf5bce
jne 0xcf5bea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xcf5bce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xcf5c0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xcf5bfe
jmp 0xcf5b4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xcf5c0c
add edi, ecx
jmp 0xcf5b4e
pop esi
mov edi, esi
mov ecx, 0x30125
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xcf5c2a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xcf5c2f
lea edi, [esi + 0x8f3000]
mov eax, dword [edi]
or eax, eax
je 0xcf5ca0
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f54b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f54f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xcf5c55
mov ecx, edi
jns 0xcf5c84
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f54f8]
or eax, eax
je 0xcf5c9a
mov dword [ebx], eax
add ebx, 4
jmp 0xcf5c72
call dword [esi + 0x8f54f4]
mov ebp, dword [esi + 0x8f54fc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xcf5cd4
sub esp, 0xffffff80
jmp 0x408e34
Function at 0x40bea7
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040613b
mov dword [ebp - 0x14], eax
cmp dword [0x42f92c], esi
jne 0x40bf9a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40bf27
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c07a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c07a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c07a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x42f92c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x42f930], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x42f934], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42f93c], eax
test eax, eax
je 0x40bf97
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x42f938], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40bfbf
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40bfb2
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40bfd4
push 4
pop eax
jmp 0x40c07c
cmp dword [ebp - 0x14], esi
je 0x40bfd4
push dword [0x42f92c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40bfb9
mov eax, dword [0x42f938]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c032
cmp dword [0x42f93c], edi
je 0x40c032
push eax
call ebx
push dword [0x42f93c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c032
test eax, eax
je 0x40c032
call ecx
test eax, eax
je 0x40c027
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c027
test byte [ebp - 8], 1
jne 0x40c032
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c062
mov eax, dword [0x42f930]
cmp eax, edi
je 0x40c05f
push eax
call ebx
test eax, eax
je 0x40c05f
call eax
mov esi, eax
test esi, esi
je 0x40c05f
mov eax, dword [0x42f934]
cmp eax, edi
je 0x40c05f
push eax
call ebx
test eax, eax
je 0x40c05f
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x42f92c]
call ebx
test eax, eax
je 0x40c07a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c07c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004039ad
mov esp, ebp
pop ebp
ret
Function at 0x404150
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x1000
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [ebp - 4], eax
or eax, eax
je 0x4041f1
push 0x42b128
call sub.KERNEL32.dll_EnterCriticalSection
mov edi, dword [0x4272d4]
jmp 0x4041ba
push 0
push dword [edi + 8]
call sub.KERNEL32.dll_WaitForSingleObject
or eax, eax
jne 0x4041b8
push dword [edi + 8]
call sub.KERNEL32.dll_CloseHandle
mov esi, edi
add esi, 8
mov edi, dword [edi]
push esi
push 0x4272d4
call fcn.00418270
add esp, 8
jmp 0x4041ba
mov edi, dword [edi]
or edi, edi
jne 0x40418b
mov eax, dword [0x4272d8]
mov edx, eax
inc edx
mov dword [0x4272d8], edx
mov ebx, eax
push 0x10
push 0x4272d4
call fcn.00418220
add esp, 8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov dword [esi + 4], ebx
push 0x42b128
call sub.KERNEL32.dll_LeaveCriticalSection
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x404200
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.00404080
push 0
push eax
call sub.KERNEL32.dll_TerminateThread
push 0x42b128
call sub.KERNEL32.dll_EnterCriticalSection
mov edi, dword [0x4272d4]
jmp 0x40424c
cmp dword [edi + 0xc], esi
jne 0x40424a
push dword [edi + 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
add eax, 8
push eax
push 0x4272d4
call fcn.00418270
add esp, 8
jmp 0x404250
mov edi, dword [edi]
or edi, edi
jne 0x404228
push 0x42b128
call sub.KERNEL32.dll_LeaveCriticalSection
pop edi
pop esi
pop ebp
ret 4

Function at 0x4043ee
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp dword [ebp + 8], 0
je 0x404408
push dword [ebp + 8]
push 0x404380
call sub.USER32.dll_EnumWindows
jmp 0x40443f
mov edi, dword [0x4272e0]
jmp 0x40443b
mov esi, dword [edi]
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi + 8], eax
jne 0x404439
push 1
push dword [edi + 0xc]
call sub.USER32.dll_EnableWindow
mov eax, edi
add eax, 8
push eax
push 0x4272e0
call fcn.00418270
add esp, 8
mov edi, esi
or edi, edi
jne 0x404410
pop edi
pop esi
pop ebp
ret 4
Function at 0x404ab0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
push ebx
push esi
push edi
mov edi, 0x64
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.dll_GetVersionExA
or eax, eax
je 0x404bac
mov eax, dword [ebp - 0x84]
cmp eax, 1
je 0x404af4
cmp eax, 2
je 0x404b2f
jmp 0x404bac
mov eax, dword [ebp - 0x8c]
cmp eax, 0xa
je 0x404b1e
jg 0x404b0a
or eax, eax
je 0x404b14
jmp 0x404bac
cmp eax, 0x5a
je 0x404b28
jmp 0x404bac
mov edi, 0xa
jmp 0x404bac
mov edi, 0x1e
jmp 0x404bac
mov edi, 0x28
jmp 0x404bac
mov eax, dword [ebp - 0x90]
cmp eax, 3
jl 0x404bac
cmp eax, 6
jg 0x404bac
jmp dword [eax*4 + 0x427304]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404f90
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
and dword [ebp - 4], 0
push dword [ebp + 8]
push 0x100
call fcn.004184f0
mov ebx, eax
mov edi, ebx
cmp dword [0x427354], 2
jne 0x405101
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
test byte [eax + 0x42b164], 0x80
je 0x404fe2
mov byte [eax + 0x42a810], 1
jmp 0x4050eb
mov eax, dword [ebp - 0x108]
cmp byte [eax + 0x42a810], 0
je 0x4050eb
mov byte [eax + 0x42a810], 0
cmp dword [ebp - 4], 0
jne 0x405020
push 0
call sub.USER32.dll_GetKeyboardLayout
mov esi, eax
lea eax, [ebp - 0x104]
push eax
call sub.USER32.dll_GetKeyboardState
mov dword [ebp - 4], 1
push esi
push 1
push dword [ebp - 0x108]
call sub.USER32.dll_MapVirtualKeyExA
push esi
push 0
push edi
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push eax
call sub.USER32.dll_ToAsciiEx
cmp dword [ebp - 0x108], 0x52
jne 0x405051
mov byte [edi], 0x30
cmp dword [ebp - 0x108], 0x4f
jne 0x40505d
mov byte [edi], 0x31
cmp dword [ebp - 0x108], 0x50
jne 0x405069
mov byte [edi], 0x32
cmp dword [ebp - 0x108], 0x51
jne 0x405075
mov byte [edi], 0x33
cmp dword [ebp - 0x108], 0x4b
jne 0x405081
mov byte [edi], 0x34
cmp dword [ebp - 0x108], 0x4c
jne 0x40508d
mov byte [edi], 0x35
cmp dword [ebp - 0x108], 0x4d
jne 0x405099
mov byte [edi], 0x36
cmp dword [ebp - 0x108], 0x47
jne 0x4050a5
mov byte [edi], 0x37
cmp dword [ebp - 0x108], 0x48
jne 0x4050b1
mov byte [edi], 0x38
cmp dword [ebp - 0x108], 0x49
jne 0x4050bd
mov byte [edi], 0x39
cmp dword [ebp - 0x108], 0xb5
jne 0x4050cc
mov byte [edi], 0x2f
cmp dword [ebp - 0x108], 0x53
jne 0x4050d8
mov byte [edi], 0x2e
mov al, byte [edi]
cmp al, 0xd
je 0x4050e2
cmp al, 8
jne 0x4050e5
mov byte [edi], 0
cmp byte [edi], 0
je 0x4050eb
inc edi
inc dword [ebp - 0x108]
cmp dword [ebp - 0x108], 0xff
jl 0x404fc5
mov byte [edi], 0
mov eax, 0x100
mov edx, edi
sub edx, ebx
sub eax, edx
push eax
call fcn.004185c0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x405340
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
cmp dword [0x42743c], 0
je 0x405360
mov eax, dword [0x42743c]
push eax
mov ebx, dword [eax]
call dword [ebx + 8]
and dword [0x42743c], 0
push dword [0x4273d0]
call fcn.00418190
jmp 0x405375
push dword [ebp - 4]
call fcn.00405458
lea eax, [ebp - 4]
push eax
push dword [0x4273d0]
call fcn.004181b7
or eax, eax
jne 0x40536d
cmp dword [0x427430], eax
je 0x40539f
push 8
push 0
mov eax, dword [0x427430]
push eax
mov ebx, dword [eax]
call dword [ebx + 0x50]
cmp dword [0x4273c8], 0
je 0x4053ba
mov eax, dword [0x4273c8]
push eax
mov ebx, dword [eax]
call dword [ebx + 8]
and dword [0x4273c8], 0
cmp dword [0x4273c4], 0
je 0x4053d5
mov eax, dword [0x4273c4]
push eax
mov ebx, dword [eax]
call dword [ebx + 8]
and dword [0x4273c4], 0
cmp dword [0x427444], 0
je 0x4053ee
cmp dword [0x46b480], 0
jne 0x4053ee
push 1
call sub.USER32.dll_ShowCursor
cmp dword [0x46b484], 0
je 0x405409
mov eax, dword [0x46b484]
push eax
mov ebx, dword [eax]
call dword [ebx + 8]
and dword [0x46b484], 0
cmp dword [0x46b488], 0
je 0x40541d
mov eax, dword [0x46b488]
push eax
mov ebx, dword [eax]
call dword [ebx + 8]
and dword [0x46b488], 0
cmp dword [0x46b480], 0
je 0x405443
and dword [0x46b480], 0
push 1
push 0
push dword [0x427444]
call sub.USER32.dll_InvalidateRect
mov eax, dword [0x46b464]
mov dword [0x427444], eax
push 0
push eax
call sub.USER32.dll_ShowWindow
pop ebx
leave
ret

Function at 0x406b10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xca
jne 0x406b46
push edi
call fcn.00406544
pop ecx
cmp byte [edi + 0x40], 0
je 0x406b3f
mov dword [edi + 0x14], 0xcf
xor eax, eax
inc eax
jmp 0x406bfb
mov dword [edi + 0x14], 0xcb
cmp dword [edi + 0x14], 0xcb
jne 0x406bca
mov eax, dword [edi + 0x190]
cmp byte [eax + 0x10], 0
je 0x406bbf
cmp dword [edi + 8], 0
je 0x406b6d
push edi
mov ebx, dword [edi + 8]
call dword [ebx]
pop ecx
push edi
mov esi, dword [edi + 0x190]
call dword [esi]
pop ecx
mov dword [ebp - 4], eax
or eax, eax
je 0x406bfb
cmp dword [ebp - 4], 2
je 0x406bbf
cmp dword [edi + 8], 0
je 0x406b5b
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x406b9c
cmp eax, 1
jne 0x406b5b
mov eax, dword [edi + 8]
add eax, 4
mov edx, dword [eax]
inc edx
mov dword [eax], edx
mov eax, dword [edi + 8]
cmp edx, dword [eax + 8]
jl 0x406b5b
mov eax, dword [edi + 8]
add eax, 8
mov edx, dword [edi + 0x11c]
add dword [eax], edx
jmp 0x406b5b
mov eax, dword [edi + 0x7c]
mov dword [edi + 0x84], eax
jmp 0x406bef
cmp dword [edi + 0x14], 0xcc
je 0x406bef
mov eax, dword [edi]
mov dword [eax + 0x14], 0x14
mov eax, dword [edi]
mov edx, dword [edi + 0x14]
mov dword [eax + 0x18], edx
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
push edi
call fcn.00406c00
pop ecx
and eax, 0xff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406c00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xcc
je 0x406c42
push edi
mov ebx, dword [edi + 0x180]
call dword [ebx]
pop ecx
and dword [edi + 0x78], 0
mov dword [edi + 0x14], 0xcc
jmp 0x406c42
mov eax, dword [edi]
mov dword [eax + 0x14], 0x30
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
mov eax, dword [edi + 0x180]
cmp byte [eax + 8], 0
jne 0x406c2e
xor eax, eax
cmp byte [edi + 0x41], 0
sete al
dec eax
and eax, 1
add eax, 0xcd
mov dword [edi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40c60a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
and dword [ebx + 4], 0
mov edi, 0x3b9aca00
cmp edi, 0x3b9aca00
je 0x40c63b
mov eax, dword [ebx]
mov dword [eax + 0x14], 3
push ebx
mov eax, dword [ebx]
call dword [eax]
pop ecx
push ebx
call fcn.0040f9cd
mov dword [ebp - 4], eax
push 0x54
push ebx
call fcn.0040f970
add esp, 0xc
mov esi, eax
or esi, esi
jne 0x40c677
push ebx
call fcn.0040f9d0
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x36
mov eax, dword [ebx]
and dword [eax + 0x18], 0
push ebx
mov eax, dword [ebx]
call dword [eax]
add esp, 8
lea eax, [fcn.0040b9e8]
mov dword [esi], eax
lea eax, [fcn.0040bb27]
mov dword [esi + 4], eax
lea eax, [fcn.0040bbd6]
mov dword [esi + 8], eax
lea eax, [fcn.0040bcaa]
mov dword [esi + 0xc], eax
lea eax, [0x40bd8b]
mov dword [esi + 0x10], eax
lea eax, [0x40bdf8]
mov dword [esi + 0x14], eax
lea eax, [0x40be65]
mov dword [esi + 0x18], eax
lea eax, [0x40c203]
mov dword [esi + 0x1c], eax
lea eax, [0x40c353]
mov dword [esi + 0x20], eax
lea eax, [fcn.0040c4aa]
mov dword [esi + 0x24], eax
lea eax, [0x40c5d6]
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [ebp - 4]
mov dword [esi + 0x2c], eax
xor edi, edi
inc edi
and dword [esi + edi*4 + 0x34], 0
and dword [esi + edi*4 + 0x3c], 0
dec edi
jge 0x40c6e9
and dword [esi + 0x44], 0
and dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
mov dword [ebx + 4], esi
push str.JPEGMEM
call sub.MSVCRT.dll_getenv
pop ecx
mov dword [ebp - 8], eax
or eax, eax
je 0x40c759
mov byte [ebp - 9], 0x78
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 4]
push eax
push str._ld_c
push dword [ebp - 8]
call sub.MSVCRT.dll_sscanf
add esp, 0x10
or eax, eax
jle 0x40c759
mov al, byte [ebp - 9]
cmp al, 0x6d
je 0x40c745
cmp al, 0x4d
jne 0x40c74f
imul eax, dword [ebp - 4], 0x3e8
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x413e10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
xor esi, esi
push dword [ebp + 8]
push dword [0x46b4a4]
call fcn.00418082
mov dword [ebp - 0x44], eax
or eax, eax
je 0x414003
cmp dword [ebp + 0xc], esi
je 0x414003
lea eax, [ebp - 0x40]
push eax
push 0x18
mov eax, dword [ebp - 0x44]
push dword [eax]
call sub.GDI32.dll_GetObjectA
mov ebx, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x38]
imul eax, ebx, 3
mov edx, ebx
and edx, 3
add eax, edx
mov dword [ebp - 0x48], eax
mov word [ebp - 0x4a], 0x18
mov dword [ebp - 0x28], 0x28
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], edi
mov ax, word [ebp - 0x30]
mov word [ebp - 0x1c], ax
mov word [ebp - 0x1a], 0x18
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x48]
imul eax, edi
mov dword [ebp - 0x14], eax
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
movzx eax, word [ebp - 0x4a]
cmp eax, 0x18
jge 0x413eab
movzx eax, word [ebp - 0x4a]
xor eax, 2
mov dword [ebp - 8], eax
jmp 0x413eaf
and dword [ebp - 8], 0
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x48]
mov edx, edi
inc edx
imul eax, edx
push eax
push 0
push dword [0x42a774]
call sub.KERNEL32.dll_HeapAlloc
mov dword [ebp - 0x50], eax
or eax, eax
je 0x414003
push 0
call sub.GDI32.dll_CreateCompatibleDC
mov dword [ebp - 0x54], eax
or eax, eax
je 0x413ff3
push 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x50]
mov eax, edi
and eax, 0xffff
push eax
push 0
mov eax, dword [ebp - 0x44]
push dword [eax]
push dword [ebp - 0x54]
call sub.GDI32.dll_GetDIBits
or eax, eax
je 0x413feb
cmp dword [ebp + 0x10], 0
jne 0x413fd3
push 0
push pe_nt_image_headers32
push 2
push 0
push 1
push 0x40000000
push dword [ebp + 0xc]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x58], eax
cmp eax, 0xffffffff
je 0x413feb
mov word [ebp - 0x66], 0x4d42
mov edx, dword [ebp - 0x28]
add edx, 0xe
mov ecx, dword [ebp - 8]
shl ecx, 2
add edx, ecx
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x64], edx
mov word [ebp - 0x60], 0
mov word [ebp - 0x5e], 0
mov edx, dword [ebp - 0x28]
add edx, 0xe
mov ecx, dword [ebp - 8]
shl ecx, 2
add edx, ecx
mov dword [ebp - 0x5c], edx
push 0
lea eax, [ebp - 0x6c]
push eax
push 0xe
lea eax, [ebp - 0x66]
push eax
push dword [ebp - 0x58]
call sub.KERNEL32.dll_WriteFile
or eax, eax
je 0x413fc9
push 0
lea eax, [ebp - 0x6c]
push eax
mov edx, dword [ebp - 8]
shl edx, 2
add edx, 0x28
push edx
lea edx, [ebp - 0x28]
push edx
push dword [ebp - 0x58]
call sub.KERNEL32.dll_WriteFile
or eax, eax
je 0x413fc9
push 0
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x50]
push dword [ebp - 0x58]
call sub.KERNEL32.dll_WriteFile
or eax, eax
je 0x413fc9
xor esi, esi
inc esi
push dword [ebp - 0x58]
call sub.KERNEL32.dll_CloseHandle
jmp 0x413feb
push dword [ebp + 0x14]
push dword [ebp - 0x48]
push edi
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x50]
push dword [ebp + 0xc]
call fcn.00414290
mov esi, eax
push dword [ebp - 0x54]
call sub.GDI32.dll_DeleteDC
push dword [ebp - 0x50]
push 0
push dword [0x42a774]
call sub.KERNEL32.dll_HeapFree
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4149e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
push dword [0x46b664]
call fcn.00418082
mov edi, eax
or eax, eax
je 0x414a29
mov eax, dword [edi + 4]
cmp dword [eax + 0x5c], 0
je 0x414a0f
push dword [ebp + 0xc]
push edi
mov ebx, dword [edi + 4]
call dword [ebx + 0x5c]
jmp 0x414a29
cmp dword [ebp + 0xc], 0
je 0x414a20
push 0
push dword [edi]
call sub.USER32.dll_ShowWindow
jmp 0x414a29
push 5
push dword [edi]
call sub.USER32.dll_ShowWindow
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4156bf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [0x46b668]
call fcn.00417ff0
mov dword [ebp - 4], eax
cmp dword [0x429180], 0
jne 0x415752
push 0x90
push 0x42b080
call fcn.004186ac
mov dword [0x42b080], 0xa
mov dword [0x42b084], 0x90
lea eax, [0x41569a]
mov dword [0x42b088], eax
lea eax, [0x415b50]
mov dword [0x42b0f8], eax
lea eax, [0x415ba8]
mov dword [0x42b0fc], eax
lea eax, [0x415678]
mov dword [0x42b08c], eax
push 0x7f89
push 0
call sub.USER32.dll_LoadCursorA
mov dword [0x429180], eax
or eax, eax
jne 0x415752
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
mov dword [0x429180], eax
push 0
push dword [0x42a778]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push dword [eax]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x40000000
push dword [ebp + 0x1c]
push str.STATIC
push 0
call sub.USER32.dll_CreateWindowExA
mov esi, eax
or eax, eax
je 0x4157f2
push dword [ebp + 8]
push dword [0x46b664]
call fcn.00418020
mov edi, eax
or dword [edi + 0x10], 0xffffffff
and dword [edi + 0x14], 0
push 0x10
push 0
push dword [0x42a774]
call sub.KERNEL32.dll_HeapAlloc
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 0x24]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0xc], eax
mov dword [edi + 0x1c], ebx
push 0x42b080
push esi
push edi
push dword [ebp + 8]
call fcn.00415a59
mov esi, eax
push 0x4152d0
push 0xfffffffffffffffc
push dword [edi]
call sub.USER32.dll_SetWindowLongA
mov dword [ebx + 8], eax
push 1
push dword [edi]
call sub.USER32.dll_ShowWindow
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x20

Function at 0x416440
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
push ebx
push esi
push edi
push dword [ebp + 8]
push dword [0x46b66c]
call fcn.00418082
mov edi, eax
or eax, eax
je 0x4164a7
cmp dword [ebp + 0xc], 0
je 0x416489
push 4
push dword [edi]
call sub.USER32.dll_GetWindow
mov dword [ebp - 8], eax
or eax, eax
je 0x41647e
cmp dword [edi + 0x1c], 0
jne 0x41647e
push eax
call sub.USER32.dll_SetActiveWindow
push 0
push dword [edi]
call sub.USER32.dll_ShowWindow
jmp 0x4164a7
push dword [edi]
call sub.USER32.dll_IsZoomed
xor ebx, ebx
cmp eax, ebx
sete bl
dec ebx
and ebx, 2
inc ebx
mov dword [ebp - 4], ebx
push ebx
push dword [edi]
call sub.USER32.dll_ShowWindow
pop edi
pop esi
pop ebx
leave
ret 8