joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b26a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4349a8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b2aa
cmp byte [ebx], 0xa
jne 0x41b2aa
or byte [edi + eax + 0x28], 4
jmp 0x41b2af
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41b3ae
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41b391
inc eax
cmp dl, 0xd
je 0x41b2db
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41b301
cmp eax, ecx
jae 0x41b30f
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41b2c3
jmp 0x41b3ae
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b38c
cmp dword [ebp - 0x10], 0
je 0x41b38c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x4349a8]
test byte [eax + edi + 0x28], 0x48
je 0x41b366
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41b351
mov byte [esi], dl
jmp 0x41b362
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4349a8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41b3ae
cmp byte [ebp - 1], 0xa
jne 0x41b375
cmp esi, ebx
jne 0x41b375
mov byte [esi], 0xa
jmp 0x41b3ad
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041bdf0
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41b3ae
mov byte [esi], 0xd
jmp 0x41b3ad
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x4349a8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41b3ab
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41b3ae
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41b3b7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x4349a8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41b3fd
cmp word [ebx], dx
jne 0x41b3fd
or byte [eax + edi + 0x28], 4
jmp 0x41b402
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41b565
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41b545
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41b443
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41b479
cmp eax, edx
jae 0x41b487
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41b41e
jmp 0x41b565
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41b540
cmp dword [ebp - 0x18], 0
je 0x41b540
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x4349a8]
test byte [eax + edi + 0x28], 0x48
je 0x41b516
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41b4da
mov word [esi], cx
jmp 0x41b511
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x4349a8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x4349a8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x4349a8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41b565
pop eax
cmp word [ebp - 4], ax
jne 0x41b526
cmp esi, ebx
jne 0x41b526
mov word [esi], ax
jmp 0x41b562
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041bdf0
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41b565
push 0xd
pop eax
jmp 0x41b521
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x4349a8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41b55f
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41b565
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41ecaa
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41ed47
push ebx
push esi
call fcn.0041ec73
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00419908
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41ecf4
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ed46
push edi
push eax
call fcn.00416a7c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41ed14
call fcn.00416a42
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41ed45
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00419908
add esp, 0x20
test eax, eax
jne 0x41ed33
push edi
call fcn.00416a42
jmp 0x41ed3b
push ebx
call fcn.00416a42
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x421328
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00417e1d
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x421397
cmp esi, dword [ebp - 4]
je 0x421392
cmp dword [ebp + 0xc], 0
je 0x421392
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x42136f
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.00420e7a
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x421399
xor eax, eax
inc eax
jmp 0x421399
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x4213fe
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x433040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00417e1d
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00417e1d
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x421475
cmp word [ecx], dx
je 0x421475
mov eax, dword [0x42c59c]
push edi
dec eax
push eax
push 0x42c488
call fcn.0042139d
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4214e8
cmp word [eax], dx
je 0x4214e8
mov eax, dword [edi]
test eax, eax
je 0x421499
cmp word [eax], dx
je 0x421499
lea eax, [ebp - 0x10]
push eax
call fcn.00420d80
jmp 0x4214a2
lea eax, [ebp - 0x10]
push eax
call fcn.00420e1b
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x421512
mov eax, dword [0x42c484]
push dword [ebp - 0x14]
dec eax
push eax
push 0x42c178
call fcn.0042139d
add esp, 0xc
test al, al
je 0x421512
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4214dd
cmp word [eax], di
je 0x4214dd
lea eax, [ebp - 0x10]
push eax
call fcn.00420d80
pop ecx
jmp 0x421514
lea eax, [ebp - 0x10]
push eax
call fcn.00420e1b
jmp 0x4214da
mov eax, dword [edi]
test eax, eax
je 0x4214ff
cmp word [eax], dx
je 0x4214ff
lea eax, [ebp - 0x10]
push eax
call fcn.00420d35
pop ecx
jmp 0x421512
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4215dd
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.00421222
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4215dd
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4215dd
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4215dd
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x42156a
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004189da
test ebx, ebx
je 0x4215d8
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004189da
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4215dd
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4215dd
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.00424ea6
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4215df
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409478
leave
ret
Function at 0x426b90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426bbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426bbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x409577
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404ee9
and dword [ebp - 4], 0
cmp dword [0x412990], 0
mov ebx, eax
jne 0x409628
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4096d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4096d9
push eax
call fcn.00404e77
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412990], eax
call esi
push eax
call fcn.00404e77
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412994], eax
call esi
push eax
call fcn.00404e77
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412998], eax
call esi
push eax
call fcn.00404e77
pop ecx
mov dword [0x4129a0], eax
test eax, eax
je 0x409628
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404e77
pop ecx
mov dword [0x41299c], eax
mov eax, dword [0x41299c]
cmp eax, ebx
je 0x409680
cmp dword [0x4129a0], ebx
je 0x409680
push eax
call fcn.00404ef2
push dword [0x4129a0]
mov esi, eax
call fcn.00404ef2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409680
test edi, edi
je 0x409680
call esi
test eax, eax
je 0x409677
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409677
test byte [ebp - 0xc], 1
jne 0x409680
or dword [ebp + 0x10], 0x200000
jmp 0x4096b9
mov eax, dword [0x412994]
cmp eax, ebx
je 0x4096b9
push eax
call fcn.00404ef2
pop ecx
test eax, eax
je 0x4096b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4096b9
mov eax, dword [0x412998]
cmp eax, ebx
je 0x4096b9
push eax
call fcn.00404ef2
pop ecx
test eax, eax
je 0x4096b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412990]
call fcn.00404ef2
pop ecx
test eax, eax
je 0x4096d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4096db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ad6f
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40ad60
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40ad7e
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40addc
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40adc3
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40adcc
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40add6
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40adb8
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40ad42
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40ae29
dec eax
je 0x40ae20
sub eax, 3
je 0x40ae17
mov dword [ebp - 4], 0x40
jmp 0x40ae46
mov dword [ebp - 4], 4
jmp 0x40ae2c
mov dword [ebp - 4], 0x20
jmp 0x40ae2c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40ae78
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40adf8
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040a689
mov edi, 0xff2947ca
jne 0x40ae83
push 1
push esi
call edi
mov eax, esi
jmp 0x40ae84
rcr byte [edi + 0x5e], 0x5b

Function at 0x40d5e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40d614
call fcn.00403737
mov dword [eax], esi
call fcn.00403724
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004036bc
add esp, 0x14
push 0x16
pop eax
jmp 0x40d669
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d5f0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40d641
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040374a
pop ecx
call fcn.00403724
mov eax, dword [eax]
jmp 0x40d669
test al, 0x10
jne 0x40d667
test al, 1
je 0x40d667
test byte [ebp + 0xc], 2
je 0x40d667
call fcn.00403737
mov dword [eax], 5
call fcn.00403724
mov dword [eax], 0xd
jmp 0x40d638
xor eax, eax
pop esi
pop ebp
ret
Function at 0x401570
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20004
call fcn.00402430
mov eax, dword [0x413100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x424200]
test al, 1
jne 0x4015b4
push str.SetDefaultDllDirectories
or eax, 1
push str.kernel32.dll
mov dword [0x424200], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4241fc], eax
call fcn.00401470
test al, al
je 0x4015d6
push 0xc00
call dword [0x4241fc]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402417
mov esp, ebp
pop ebp
ret
push 0xfffe
lea eax, [ebp - 0x20004]
push 0
push eax
call fcn.00402460
push 0xfffe
lea eax, [ebp - 0x10004]
push 0
push eax
call fcn.00402460
add esp, 0x18
lea eax, [ebp - 0x20004]
push 0x7fff
push eax
push 0x40e2a8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0x4141e0
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.00402370
lea eax, [ebp - 0x20004]
push 0x7fff
push eax
call fcn.004023dc
add esp, 0x14
test eax, eax
je 0x401675
push 0x40e2a4
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.00402370
lea eax, [ebp - 0x20004]
push eax
lea eax, [ebp - 0x10004]
push 0x7fff
push eax
call fcn.00402370
add esp, 0x18
lea eax, [ebp - 0x10004]
push eax
push 0x40e2a8
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402417
mov esp, ebp
pop ebp
ret
Function at 0x4087fa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x413100]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [section..data]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040440d
mov dword [ebp - 0x14], eax
cmp dword [0x424f58], esi
jne 0x4088ed
push 0x800
push esi
push 0x40f9c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40887a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4089cd
push esi
push esi
push 0x40f9c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4089cd
push 0x40f9dc
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4089cd
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x424f58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x424f5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x424f60], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x424f68], eax
test eax, eax
je 0x4088ea
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x424f64], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x408912
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x408905
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x408927
push 4
pop eax
jmp 0x4089cf
cmp dword [ebp - 0x14], esi
je 0x408927
push dword [0x424f58]
call dword [0x413004]
push 3
jmp 0x40890c
mov eax, dword [0x424f64]
mov ebx, dword [0x413004]
cmp eax, edi
je 0x408985
cmp dword [0x424f68], edi
je 0x408985
push eax
call ebx
push dword [0x424f68]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x408985
test eax, eax
je 0x408985
call ecx
test eax, eax
je 0x40897a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40897a
test byte [ebp - 8], 1
jne 0x408985
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4089b5
mov eax, dword [0x424f5c]
cmp eax, edi
je 0x4089b2
push eax
call ebx
test eax, eax
je 0x4089b2
call eax
mov esi, eax
test esi, esi
je 0x4089b2
mov eax, dword [0x424f60]
cmp eax, edi
je 0x4089b2
push eax
call ebx
test eax, eax
je 0x4089b2
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x424f58]
call ebx
test eax, eax
je 0x4089cd
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4089cf
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402417
mov esp, ebp
pop ebp
ret
Function at 0xde34b4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xde34be
pushal
call 0xde34c4
pop ebp
sub ebp, 0x10
sub ebp, 0x9e34b4
jmp 0xde34da
mov eax, 0x9e34b4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bf
mov edx, 0x4efd0122
xor byte [eax], dl
inc eax
dec ecx
jne 0xde34f1
jmp 0xde3504
test eax, 0x1eaba9ef
and ah, byte [edx]
and ah, byte [ebx + 0x2222dae3]
and ah, byte [ecx]
out dx, eax
lcall 0xa98, 0x22222227
and ah, byte [edx]
and dl, ch
shl byte [ecx], 0xea
test eax, 0x22222ea3
and ah, byte [ecx]
out 0x72, eax
jb 0xde3577
inc esi
aas
add byte [edx], ah
dec edx
outsd dx, dword [esi]
xor eax, 0xe23225e
push es
dec edx
mov al, 0x4d
loope 0xde355a
retf 0x2227
mov bh, 0x2e
and ah, byte [edx]
and ch, byte [ecx + 0x222232af]
and ah, bl
retf
and ch, byte [ecx + 0x222606ae]
and ah, byte [edx]
dec edx
inc esi
aas
add byte [edx], ah
dec edx
outsd dx, dword [esi]
xor eax, 0xe23225e
push es
scasd eax, dword es:[edi]
inc esi
push es
fisubr word [ebx + 0x27ca062e]
and ah, byte [edx]
and cl, bl
and byte gs:[edx], ah
and ch, byte [edi - 0x5421f9ba]
push cs
push es
scasd eax, dword es:[edi]
dec esi
push es
and bl, ch
push edi
fst qword cs:[edi + 0x2a]
retf 0x2250
Function at 0x40368d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40369c
pop dword [ebp - 0x44]
mov eax, 0x40369c
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xf1ead42a
add dword [ebp - 0x54], 0x5c677121
mov dword [ebp - 0x50], 0x668cb06a
add dword [ebp - 0x50], 0xcba69bdb
mov dword [ebp - 0x4c], 0x67b83e86
sub dword [ebp - 0x4c], 0x1b6bfa58
mov dword [ebp - 0x48], 0xbd90357a
add dword [ebp - 0x48], 0x426fca86
lea eax, [ebp - 0x54]
push eax
mov eax, 0x733ad495
add eax, 0x8d059b87
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x7274c92c
add dword [ebp - 0x54], 0x1fda02a
mov dword [ebp - 0x50], 0xc16f691e
sub dword [ebp - 0x50], 0x800307a9
mov dword [ebp - 0x4c], 0x9c89fcab
sub dword [ebp - 0x4c], 0x391a903f
mov dword [ebp - 0x48], 0xe998e260
add dword [ebp - 0x48], 0x16671da0
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xcad4d978
add eax, 0x356b96a8
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x39f51
push 0
call eax
mov ecx, 0xfdd131a
sub ecx, 0xfdcc21f
xor ebx, ebx
add ebx, eax
mov esi, 0x7d6807a6
sub esi, 0x7d273fa6
add esi, dword [ebp - 0x44]
mov edi, 0x5c39d238
sub edi, 0xb08b8dd8
mov edx, dword [esi]
xor dword [ebp - 0x18], edi
xor edx, edi
xor dword [ebp - 0x20], ebx
mov dword [ebx], edx
add dword [ebp - 4], edx
add ebx, 0x98fd0a74
add ebx, 0x6702f590
add esi, 0x591f68fd
add esi, 0xa6e09707
loop 0x4037bb
add eax, 0x136bf
mov ebx, eax
add eax, 0xc093706e
sub eax, 0xc0937069
mov ecx, 0x458d4388
sub ecx, 0x454d4388
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x404635
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4069e0
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404654
mov al, 1
jmp 0x40471d
test esi, esi
je 0x40471b
xor ebx, ebx
cmp word [esi], bx
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40471b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x40471b
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.0040368d
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x40470f
lea eax, [ebp - 0x28]
push eax
call fcn.0040368d
pop ecx
test al, al
jne 0x40470f
cmp dword [ebp - 0x18], esi
jbe 0x40470f
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40470f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x40470f
push 0x407620
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401788
mov al, bl
jmp 0x40471d
xor al, al
call fcn.004054b6
ret