joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ce450
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, ecx
lea ecx, [esp + 0x28]
push dword [ebp + 8]
call dbg.inner
add esp, 4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
cmp edx, 0x80000000
je 0x100ce4ae
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 8]
call dbg.get_long_path
mov edi, dword [esp + 0x18]
cmp edi, 0x80000000
jne 0x100ce4c2
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push dword [ebp + 0x10]
call dbg.inner
add esp, 4
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
cmp edx, 0x80000000
je 0x100ce521
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x18]
lea edx, [esp + 8]
call dbg.get_long_path
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x18]
cmp ebx, 0x80000000
jne 0x100ce542
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi], 1
test edi, edi
je 0x100ce4ba
mov ecx, ebx
mov edx, 2
call sym.___rust_dealloc
jmp 0x100ce4ba
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
push 0
push 0
lea ecx, [esp + 0x10]
push ecx
push dbg.callback
mov dword [esp + 0x34], eax
push eax
push dword [esp + 0x18]
call sub.kernel32.dll_CopyFileExW
test eax, eax
je 0x100ce5aa
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi], 0
je 0x100ce59c
mov ecx, dword [esp + 0x24]
mov edx, 2
call sym.___rust_dealloc
mov ecx, dword [esp + 4]
test edi, edi
je 0x100ce4ba
jmp 0x100ce533
call sub.kernel32.dll_GetLastError
test ebx, ebx
mov ebx, dword [esp + 4]
mov byte [esi + 4], 0
mov dword [esi + 8], eax
mov dword [esi], 1
je 0x100ce52d
mov ecx, dword [esp + 0x24]
mov edx, 2
call sym.___rust_dealloc
jmp 0x100ce52d
Function at 0x100ce830
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x20
mov eax, dword [0x101631f4]
test eax, eax
je 0x100ce8f6
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 2
jb 0x100ce85e
mov ecx, dword [eax]
or ecx, dword [eax + 4]
jne 0x100ce8e9
mov eax, dword [0x101631f4]
test eax, eax
je 0x100ce905
dec eax
push eax
call sub.kernel32.dll_TlsGetValue
cmp eax, 1
je 0x100ce8ee
mov esi, eax
test eax, eax
jne 0x100ce8c0
movzx eax, byte [0x10226114]
xor ecx, ecx
mov edx, 0x20
call dbg.process_heap_alloc
test eax, eax
je 0x100ce926
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x18], 0x101631f4
mov ecx, dword [0x101631f4]
test ecx, ecx
je 0x100ce914
dec ecx
mov esi, eax
push eax
push ecx
call sub.kernel32.dll_TlsSetValue
xorps xmm0, xmm0
mov eax, esp
movaps xmmword [esp], xmm0
push 0x10
push eax
call dword [sym.imp.bcryptprimitives.dll_ProcessPrng]
movaps xmm0, xmmword [esp]
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi], 1
movups xmmword [esi + 8], xmm0
add eax, 8
jmp 0x100ce8f0
xor eax, eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov ecx, 0x101631f4
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h79f830d24f8bdf80
jmp 0x100ce848
mov ecx, 0x101631f4
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h79f830d24f8bdf80
jmp 0x100ce86c
mov ecx, 0x101631f4
mov esi, eax
call sym.std::sys::pal::windows::thread_local_key::StaticKey::init::h79f830d24f8bdf80
mov ecx, eax
mov eax, esi
jmp 0x100ce8b7
mov ecx, 8
mov edx, 0x20
call dbg.handle_alloc_error
nop word cs:[eax + eax]
nop
Function at 0x100d6c76
Capabilities:
Reference wmi statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
and dword [ebp - 0x10], 0
cmp dword [edx + 8], 0
mov esi, edx
mov ebx, ecx
je 0x100d6d13
push 0x101bfd4e
call sub.oleaut32.dll_SysAllocString
mov dword [ebp - 0x18], ebx
mov ebx, eax
push str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov edi, eax
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x10]
mov ecx, dword [eax]
push edx
push 0
push 0x30
push edi
push ebx
push eax
call dword [ecx + 0x50]
mov dword [ebp - 0x14], eax
push ebx
mov ebx, dword [ebp - 0x18]
call sub.oleaut32.dll_SysFreeString
push edi
call sub.oleaut32.dll_SysFreeString
cmp dword [ebp - 0x14], 0
js 0x100d6d13
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov edi, dword [ebp - 0x10]
call sym.core::ptr::drop_in_place_LT_core..option..Option_LT_sysinfo..windows..component..Instance_GT__GT_::he3bf2606ade8fdf4
mov dword [esi + 0x10], 1
mov dword [esi + 0x14], edi
movsd xmm1, qword [esi + 8]
mov eax, dword [esi + 0x18]
movsd xmm0, qword [esi]
movsd qword [ebx + 8], xmm1
movsd xmm1, qword [esi + 0x10]
mov dword [ebx + 0x18], eax
movsd qword [ebx], xmm0
movsd qword [ebx + 0x10], xmm1
jmp 0x100d6d20
mov ecx, esi
mov dword [ebx], 2
call sym.core::ptr::drop_in_place_LT_sysinfo..windows..component..Connection_GT_::h357a86d1713b315d
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100d750b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push eax
lea edi, [ebp - 0xc]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [edi], 0
push esi
push eax
push edi
push 0
push edx
push ecx
call sub.advapi32.dll_RegQueryValueExW
add esp, 4
pop esi
pop edi
pop ebp
ret
Function at 0x100d7530
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x10], ecx
and dword [ebx], 0
push 5
pop esi
push ebx
push 0
push esi
call sub.kernel32.dll_GetComputerNameExW
mov edx, dword [ebx]
lea edi, [ebp - 0x1c]
mov ecx, edi
call sym.alloc::vec::from_elem::ha06a10d95c109ee6
mov edi, dword [edi + 4]
push ebx
push edi
push esi
call sub.kernel32.dll_GetComputerNameExW
cmp eax, 1
jne 0x100d7586
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
xor ecx, ecx
lea edx, [eax + eax]
test edx, edx
je 0x100d759d
cmp word [edi + ecx*2], 0
je 0x100d759b
inc ecx
add edx, 0xfffffffe
jmp 0x100d7575
mov ecx, dword [ebp - 0x1c]
mov edx, edi
call sym.__LT_alloc..raw_vec..RawVec_LT_T_C_A_GT__u20_as_u20_core..ops..drop..Drop_GT_::drop::h7a806ae938e9df1e
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x80000000
jmp 0x100d75e1
mov eax, ecx
lea ebx, [ebp - 0x28]
mov edx, edi
mov ecx, ebx
push eax
call dbg.from_utf16
pop eax
cmp dword [ebx], 0x80000000
jne 0x100d75c8
mov edx, dword [ebp - 0x24]
mov ecx, 0x80000000
mov dword [esi], 0x80000000
call sym.__ZN4core3ptr102drop_in_place_LT_core..result..Result_LT_alloc..string..String_C_alloc..string..FromUtf16Error_GT__GT_17h7a858
jmp 0x100d75d7
mov eax, dword [ebp - 0x20]
movsd xmm0, qword [ebp - 0x28]
mov dword [esi + 8], eax
movsd qword [esi], xmm0
mov ecx, dword [ebp - 0x1c]
mov edx, edi
call sym.__LT_alloc..raw_vec..RawVec_LT_T_C_A_GT__u20_as_u20_core..ops..drop..Drop_GT_::drop::h7a806ae938e9df1e
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100dcd28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx]
mov edx, eax
xor edx, 3
lock cmpxchg dword [ecx], edx
jne 0x100dcd2d
test al, 1
je 0x100dcd45
test al, 2
jne 0x100dcd57
xor eax, 3
pop ebp
ret
push 0x23
pop edx
mov ecx, 0x101c1690
push 0x101c16b4
call dbg.panic
push 0x25
pop edx
mov ecx, str.assertion_failed:__prev.is_complete__
push 0x101c16ec
call dbg.panic

Function at 0x100de17e
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push eax
mov bl, byte [ebp + 8]
mov esi, ecx
mov ecx, edx
call sym.tokio::io::poll_evented::PollEvented_LT_E_GT_::get_ref::hdc658bb155c9d898
mov eax, dword [eax]
movzx ecx, bl
lea edx, [ebp - 0xc]
mov eax, dword [eax]
mov dword [edx], ecx
push 4
push edx
push 1
push 6
push eax
call sub.ws2_32.dll_setsockopt
mov cl, 4
cmp eax, 0xffffffff
jne 0x100de1c3
call sub.ws2_32.dll_WSAGetLastError
and word [esi + 1], 0
xor ecx, ecx
mov byte [esi + 3], 0
mov dword [esi + 4], eax
mov byte [esi], cl
add esp, 4
pop esi
pop ebx
pop ebp
ret
Function at 0x100ec450
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x100ec4b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x10226164]
test esi, esi
jle 0x100ec5d0
mov eax, dword [0x10226168]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x100ec4e4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x100ec567
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x100ec4d0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x100ec5f7
mov eax, dword [0x10226168]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x10226168]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x100ec5d7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x100ec560
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x100ec570
add dword [0x10226164], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x10226168]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x100ec560
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x100ec4ee
mov eax, dword [0x10226168]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x100ec910
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x10226174
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ebx, dword [0x1022616c]
sub esp, 4
test ebx, ebx
je 0x100ec965
mov ebp, dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x100ec95e
test esi, esi
je 0x100ec95e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x100ec940
mov dword [esp], 0x10226174
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x100ecca0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x10000000], 0x5a4d
jne 0x100eccc5
mov ecx, dword [0x1000003c]
cmp dword [ecx + 0x10000000], 0x4550
lea edx, [ecx + 0x10000000]
je 0x100eccd0
ret
cmp word [ecx + 0x10000018], 0x10b
jne 0x100eccc5
push esi
movzx eax, word [ecx + 0x10000014]
push ebx
movzx esi, word [ecx + 0x10000006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x10000000
test si, si
je 0x100ecd18
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x100ecd0e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x100ecd1a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x100ecd00
xor eax, eax
pop ebx
pop esi
ret
Function at 0x1010b1e8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov byte [eax + 0x10], 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], esi
mov dword [ebp - 0x20], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [ebp - 0x1c], edx
mov dword [esp + 4], str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov dword [esp], eax
call sym._sqlite3NestedParse
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1010b24d
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov dword [esp], ebx
call sym._sqlite3NestedParse
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1014ed1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
mov ecx, 6
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
pop ebp
jmp sym._openDatabase

Function at 0x1014edcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], edx
mov edx, dword [ebp + 0xc]
pop ebp
jmp sym._openDatabase

Function at 0x1015776c
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov byte [eax + 0x38], 1
movzx edi, byte [eax + 0x3b]
mov dword [ebp - 0x1c], ecx
dec edi
cmp esi, edi
jge 0x10157845
movzx eax, byte [ebx + 0x3a]
lea eax, [esi + eax + 1]
cdq
idiv edi
imul eax, edx, 0x48
lea ecx, [ebx + eax + 0x40]
cmp dword [ebx + eax + 0x44], 0
mov dword [ebp - 0x1c], ecx
jne 0x101577b8
imul edx, edx, 0x48
cmp dword [ebx + edx + 0x40], 0
je 0x101577cf
inc esi
jmp 0x10157787
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
call sym._vdbeSorterJoinThread
mov edx, dword [ebp - 0x20]
test eax, eax
je 0x101577ab
jmp 0x1015785d
mov edx, dword [ebp - 0x1c]
lea ecx, [ebx + 0x40]
mov eax, dword [ebp - 0x1c]
lea esi, [ebx + 0x24]
sub edx, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x1c]
sar edx, 3
imul edx, edx, 0x38e38e39
lea edi, [ecx + 0x10]
mov ecx, 3
mov byte [ebx + 0x3a], dl
xor edx, edx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x2c], edx
test eax, eax
je 0x10157812
mov dword [ebx + 0x28], eax
call sym._sqlite3MallocSize
mov dword [ebx + 0x34], eax
jmp 0x10157828
cmp dword [ebx + 0x28], 0
je 0x10157828
mov eax, dword [ebx + 0x34]
cdq
call sym._sqlite3Malloc
mov dword [ebx + 0x28], eax
test eax, eax
je 0x1015783e
mov ecx, dword [ebp - 0x1c]
add esp, 0x1c
mov edx, sym._vdbeSorterFlushThread
pop ebx
pop esi
mov eax, ecx
pop edi
pop ebp
jmp sym._sqlite3ThreadCreate
mov eax, 7
jmp 0x1015785d
jne 0x101577cf
imul esi, esi, 0x48
add esp, 0x1c
lea edx, [ebx + 0x24]
lea eax, [ebx + esi + 0x40]
pop ebx
pop esi
pop edi
pop ebp
jmp sym._vdbeSorterListToPMA
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x101619c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 8
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp - 0x10]
mov ecx, esi
mov edx, dword [eax + 8]
lea ebx, [esi + edi]
xor edi, edi
mov dword [ebp - 0x14], ebx
lea esi, [edx + 1]
add edx, dword [eax]
mov bl, byte [ecx]
xor byte [edx], bl
cmp dword [eax + 4], esi
cmovle esi, edi
inc ecx
mov edx, esi
cmp dword [ebp - 0x14], ecx
jne 0x101619e2
mov dword [eax + 8], esi
mov edi, dword [ebp - 0x10]
add dword [eax + 0xc], edi
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401393
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x34], edi
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a308]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41a30c]
mov dword [ebp - 0x2c], eax
call fcn.0040138c
mov esi, dword [ebp - 0x10]
mov ecx, dword [0x41a310]
add esi, 0x23f
mov eax, dword [0x41a314]
push 0x20
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
pop edi
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov edx, dword [ebp - 0x14]
mov eax, edx
shl eax, 4
add eax, ecx
mov dword [ebp - 0x1c], 0xedeb2e40
cmp dword [0x859628], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x859624]
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp dword [0x859628], 0x3eb
mov dword [0x859624], eax
mov eax, dword [0x8590b0]
cmove eax, dword [ebp - 0x1c]
mov dword [0x8590b0], eax
lea eax, [esi + edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [0x859620], 0xf4ea3dee
shl eax, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x1c]
cmp dword [0x859628], 0xb03
mov dword [ebp - 4], eax
jne 0x4014c0
push str.Poh_pabatosipixalilasexamupopajohija_xopitotazucepewifodufalejilemi_karemabuzaniyuzavegusaribufate
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
add esi, 0x61c88647
mov dword [ebp - 0x10], esi
dec edi
jne 0x4013e5
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], ebx
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d5d3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040804b
mov dword [ebp - 0x14], eax
cmp dword [0x813dbc], esi
jne 0x40d6c6
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d653
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d7a6
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d7a6
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d7a6
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813dbc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813dc0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813dc4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813dcc], eax
test eax, eax
je 0x40d6c3
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813dc8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d6eb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d6de
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d700
push 4
pop eax
jmp 0x40d7a8
cmp dword [ebp - 0x14], esi
je 0x40d700
push dword [0x813dbc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d6e5
mov eax, dword [0x813dc8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d75e
cmp dword [0x813dcc], edi
je 0x40d75e
push eax
call ebx
push dword [0x813dcc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d75e
test eax, eax
je 0x40d75e
call ecx
test eax, eax
je 0x40d753
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d753
test byte [ebp - 8], 1
jne 0x40d75e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d78e
mov eax, dword [0x813dc0]
cmp eax, edi
je 0x40d78b
push eax
call ebx
test eax, eax
je 0x40d78b
call eax
mov esi, eax
test esi, esi
je 0x40d78b
mov eax, dword [0x813dc4]
cmp eax, edi
je 0x40d78b
push eax
call ebx
test eax, eax
je 0x40d78b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813dbc]
call ebx
test eax, eax
je 0x40d7a6
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d7a8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040400d
mov esp, ebp
pop ebp
ret
Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
pop ebp
ret 0x10
add bh, bh
push ebp
or al, 0x8b
push ebp
adc byte [edx + 0x336d104e], cl
ror byte [eax - 0x3da2a1f6], 0x10
add byte [ebx + 0xf2dd68f], al
test dl, bh
xor al, 0xff
dec dword [ebx + 0x3a802056]
add byte [ebp + 3], dh
inc dword [esi - 0x3c]
mov eax, dword [esi + 4]
aam 0xc0
clc
and al, 0x80
aas
cmp al, byte [ebp - 0x71]
mov eax, ecx
sbb al, 0x8b
inc esi
adc byte [eax - 0x75], dl
adc dword [edx - 0x18], edx
xchg ecx, eax
dec eax
loop 0x405cce
push eax
mov esp, 0xcc680846
jg 0x405c96
add byte [eax + 0x4a], dl
cmp byte [ebx + eax*4], al
les edx, [eax]
mov ebp, dword [edx]
jae 0x405cab
lodsd eax, dword [esi]
adc byte [edi - 0x48], bl
jl 0x405d1a
add dword [eax], eax
mov byte [eax + 0x67], bh
pop ebp
adc byte ds:[eax], al
mov esi, 0x48909090
nop
nop
nop
nop
nop
cmp al, 0x90
nop
nop
jo 0x405cad
in al, dx
push ecx
push esi
push edi
call fcn.00405f20
test eax, eax
test al, 0x24
std
add byte [eax], al
add byte [ebx + 0x4108dc3d], al
add byte [esp + ecx*2], dl
mov esi, gs
inc byte [eax]
add byte [ebx], ah
test byte [ebx], al
inc ecx
scasb al, byte es:[edi]
test eax, eax
jne 0xd6405e1e
mov dword [0xc3f84], 0xca000001
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x405cfa
mov eax, dword [0x41cf58]
test eax, eax
inc ecx
sbb eax, 0xf42f6894
inc eax
add byte [edx + 4], ch
call fcn.0040a940
add esp, 0xc
mov dword [0x7c410358], eax
rol al, 1
je 0x515e38
imul ecx, dword [ebp - 4], 0xd0f85651
mov esp, dword [eax + 0x1d74ebd9]
mov ecx, dword [eax - 4]
mov ecx, esi
or al, 0x52
mov eax, dword [0x482ce850]
add byte [eax], al
mov ecx, dword [ebp + 8]
add ah, al
or al, 0x56
mov dword [ecx], eax
invalid