joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007481
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x100a11c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], ebx
call fcn.01005736
mov dword [ebp - 0x318], 0x10027b4
test eax, eax
jne 0x10074c5
mov dword [ebp - 0x318], 0x1002804
lea eax, [ebp - 0x31c]
push eax
push 0xf003f
push ebx
push dword [ebp - 0x318]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100768f
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x314], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x338]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1007682
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll__strlwr]
mov eax, dword [ebp - 0x318]
pop ecx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1007553
sub eax, edi
mov edi, eax
lea eax, [ebp - 0x108]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1007567
sub eax, ecx
add eax, edi
cmp eax, esi
jae 0x1007632
push esi
lea eax, [ebp - 0x310]
push ebx
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x318]
lea eax, [ebp - 0x20c]
push 0x10027ac
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x1c
lea eax, [ebp - 0x324]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007632
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x330]
push eax
push ebx
push 0x10027fc
push dword [ebp - 0x324]
mov dword [ebp - 0x314], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x32c]
call fcn.01006535
add esp, 0x18
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
inc dword [ebp - 0x320]
lea eax, [ebp - 0x338]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x320]
mov dword [ebp - 0x314], esi
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x100753c
pop edi
push dword [ebp - 0x31c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop ebx
call fcn.010081b4
leave
ret
Function at 0x406688
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00406b30
mov byte [esp], al
cmp byte [esp], 0
jne 0x406811
test edi, edi
je 0x406811
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40672c
cmp edi, 0xffffffff
je 0x4066ed
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4066ed
mov byte [esp], 0
jmp 0x406811
cmp dword [esi], 1
jg 0x40672c
cmp dword [esi], 0
jne 0x40671e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40671e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406811
lea eax, [esp + 0xc]
call fcn.00406368
dec ebp
test ebp, ebp
jg 0x4066d2
cmp edi, 0xffffffff
je 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40674f
mov byte [esp], 0
jmp 0x406811
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x406696
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406751
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.0040688c
mov edx, eax
mov ebx, dword [0x4bb8f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4067b5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4067b3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4067b5
xor edi, edi
cmp byte [esp], 0
je 0x4067db
mov ebx, dword [esi]
test bl, 1
jne 0x4067f1
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4067bb
mov byte [esp + 1], 1
jmp 0x4067f1
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4067db
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406768
cmp byte [esp], 0
je 0x406811
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4076b8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bb058], 0
je 0x40771f
cmp word [0x4bb344], 0xd7b2
jne 0x4076e1
cmp dword [0x4bb34c], 0
jbe 0x4076e1
mov eax, 0x4bb340
call dword [0x4bb35c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push 0x4b79d1
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x40774c
call fcn.00408240
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b7032], 0
jne 0x40773b
push 0
push 0x4b79cb
push 0x4b79d1
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x467434
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46743c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4790bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x4790d0
xor eax, eax
jmp 0x479169
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
and dword [ebp - 4], 0
jmp 0x479108
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x479167
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x14], edx
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call fcn.00479074
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x479165
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x1c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov eax, edx
jmp 0x479169
jmp 0x479101
xor eax, eax
leave
ret
Function at 0x49794c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x49799a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00497410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4979b3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4aefdc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4aefe4
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4af0d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00422d70
mov edx, dword [ebp - 8]
mov ecx, 0x4af0ec
xor eax, eax
call fcn.004aeec0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4af09f
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x4aeffe
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x3b
call fcn.00426f08
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00419e18
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.004232ec
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x70
call fcn.00426ed8
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x414db8]
call fcn.0041f264
call fcn.0040711c
jmp 0x4aeffe
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00407e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af0d8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00407a80
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00407a80
ret

Function at 0x4af100
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
call fcn.0041ff2c
cmp eax, 2
jne 0x4af168
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4af123
xor eax, eax
jmp 0x4af177
lea eax, [esp + 8]
push eax
push 0x4af17c
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4af168
xor eax, eax
jmp 0x4af177
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x3fac058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x3fac1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x3fac07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3fac06a
add dl, dl
jne 0x3fac089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3fac0dc
xor eax, eax
add dl, dl
jne 0x3fac096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x3fac17d
add dl, dl
jne 0x3fac0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3fac0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3fac0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3fac0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x3fac0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x3fac075
mov eax, 1
add dl, dl
jne 0x3fac0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x3fac0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3fac0e1
sub eax, ebx
mov ebx, 1
jne 0x3fac128
mov ecx, 1
add dl, dl
jne 0x3fac10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3fac119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3fac105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3fac075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x3fac13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x3fac14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x3fac136
cmp eax, 0x7d00
jae 0x3fac16d
cmp eax, 0x500
jb 0x3fac168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3fac075
cmp eax, 0x7f
ja 0x3fac170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3fac075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x3fac19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x3fac075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402880
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4110d8
push 0x408574
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x4171cc], eax
mov eax, dword [0x4171cc]
shr eax, 8
and eax, 0xff
mov dword [0x4171d8], eax
mov ecx, dword [0x4171cc]
and ecx, 0xff
mov dword [0x4171d4], ecx
mov edx, dword [0x4171d4]
shl edx, 8
add edx, dword [0x4171d8]
mov dword [0x4171d0], edx
mov eax, dword [0x4171cc]
shr eax, 0x10
and eax, 0xffff
mov dword [0x4171cc], eax
call fcn.004083e0
test eax, eax
jne 0x40290f
push 0x1c
call fcn.004029f0
add esp, 4
mov dword [ebp - 4], 0
call fcn.004060f0
call fcn.004083d0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x417658], eax
call fcn.00407d70
mov dword [0x417214], eax
cmp dword [0x417214], 0
je 0x402947
cmp dword [0x417658], 0
jne 0x402951
push 0xffffffffffffffff
call fcn.00401960
add esp, 4
call fcn.004075f0
call fcn.004074b0
call fcn.00401920
mov ecx, dword [0x4171e8]
mov dword [0x4171ec], ecx
mov edx, dword [0x4171e8]
push edx
mov eax, dword [0x4171e0]
push eax
mov ecx, dword [0x4171dc]
push ecx
call fcn.00401005
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401960
add esp, 4
mov dword [ebp - 4], 0xffffffff
jmp 0x4029d1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4086a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
push ebx
push esi
push edi
mov dword [ebp - 8], 0
jmp 0x4086be
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jae 0x4086d7
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx*8 + 0x414590]
jne 0x4086d5
jmp 0x4086d7
jmp 0x4086b5
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax*8 + 0x414590]
jne 0x40888a
cmp dword [ebp + 8], 0xfc
je 0x408714
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x414594]
push eax
push 0
push 0
push 0
push 1
call fcn.00405a50
add esp, 0x14
cmp eax, 1
jne 0x408714
int3
cmp dword [0x41721c], 1
je 0x40872f
cmp dword [0x41721c], 0
jne 0x40879a
cmp dword [0x414164], 1
jne 0x40879a
cmp dword [0x417500], 0
je 0x408755
mov ecx, dword [0x417500]
cmp dword [ecx + 0x10], 0xffffffff
je 0x408755
mov edx, dword [0x417500]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1b4], eax
jmp 0x408763
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x1b4], eax
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x414594]
push eax
call fcn.00409df0
add esp, 4
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx*8 + 0x414594]
push edx
mov eax, dword [ebp - 0x1b4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40888a
cmp dword [ebp + 8], 0xfc
je 0x40888a
push 0x104
lea ecx, [ebp - 0x110]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087d3
push str._program_name_unknown_
lea edx, [ebp - 0x110]
push edx
call fcn.00401cf0
add esp, 8
lea eax, [ebp - 0x110]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00409df0
add esp, 4
add eax, 1
cmp eax, 0x3c
jbe 0x40881c
lea edx, [ebp - 0x110]
push edx
call fcn.00409df0
add esp, 4
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax - 0x3b]
mov dword [ebp - 0xc], edx
push 3
push 0x411ac0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040ac40
add esp, 0xc
push str.Runtime_Error__n_nProgram:
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00401cf0
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
lea eax, [ebp - 0x1b0]
push eax
call fcn.00401d00
add esp, 8
push 0x411a34
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00401d00
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [edx*8 + 0x414594]
push eax
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.00401d00
add esp, 8
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
lea edx, [ebp - 0x1b0]
push edx
call fcn.0040ab80
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d15a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407e6b
mov dword [ebp - 0x14], eax
cmp dword [0x813cfc], esi
jne 0x40d24d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d1da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d32d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d32d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d32d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x813cfc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x813d00], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x813d04], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813d0c], eax
test eax, eax
je 0x40d24a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x813d08], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d272
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d265
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d287
push 4
pop eax
jmp 0x40d32f
cmp dword [ebp - 0x14], esi
je 0x40d287
push dword [0x813cfc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d26c
mov eax, dword [0x813d08]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d2e5
cmp dword [0x813d0c], edi
je 0x40d2e5
push eax
call ebx
push dword [0x813d0c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d2e5
test eax, eax
je 0x40d2e5
call ecx
test eax, eax
je 0x40d2da
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d2da
test byte [ebp - 8], 1
jne 0x40d2e5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d315
mov eax, dword [0x813d00]
cmp eax, edi
je 0x40d312
push eax
call ebx
test eax, eax
je 0x40d312
call eax
mov esi, eax
test esi, esi
je 0x40d312
mov eax, dword [0x813d04]
cmp eax, edi
je 0x40d312
push eax
call ebx
test eax, eax
je 0x40d312
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x813cfc]
call ebx
test eax, eax
je 0x40d32d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d32f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043b8
mov esp, ebp
pop ebp
ret
Function at 0x834ec5b8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push eax
push dword [ebp + 8]
call fcn.834ebdba
mov esi, eax
cmp esi, edi
jl 0x834ec706
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.834eb228
mov esi, eax
cmp esi, edi
jl 0x834ec706
mov eax, dword [ebp + 0x24]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 8], cl
mov ecx, eax
shr ecx, 0x10
push edi
mov byte [ebp - 7], cl
mov ecx, eax
mov byte [ebp - 5], al
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
shr ecx, 8
mov byte [ebp - 6], cl
call fcn.834eb228
mov esi, eax
cmp esi, edi
jl 0x834ec706
push ebx
mov ebx, dword [ebp + 0x38]
push edi
push ebx
push dword [ebp + 0x30]
push dword [ebp - 4]
call fcn.834eb268
mov esi, eax
cmp esi, edi
jl 0x834ec705
push ebx
push dword [ebp + 0x30]
push dword [ebp + 0x34]
call fcn.834ef428
xor ecx, ecx
xor eax, eax
inc ecx
add esp, 0xc
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp + 0x20]
ja 0x834ec703
jb 0x834ec683
cmp ecx, dword [ebp + 0x1c]
jae 0x834ec703
push dword [ebp - 4]
call fcn.834ec0d0
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push eax
push dword [ebp + 8]
call fcn.834ebdba
mov esi, eax
cmp esi, edi
jl 0x834ec705
push edi
push ebx
push dword [ebp + 0x30]
push dword [ebp - 4]
call fcn.834eb228
mov esi, eax
cmp esi, edi
jl 0x834ec705
push edi
push ebx
push dword [ebp + 0x30]
push dword [ebp - 4]
call fcn.834eb268
mov esi, eax
cmp esi, edi
jl 0x834ec705
cmp ebx, edi
jbe 0x834ec6ea
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x30]
sub ecx, eax
mov esi, ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x834ec6e1
add dword [ebp - 0x10], 1
adc dword [ebp - 0xc], edi
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x20]
jb 0x834ec683
ja 0x834ec703
mov eax, dword [ebp + 0x1c]
cmp dword [ebp - 0x10], eax
jb 0x834ec683
xor esi, esi
pop ebx
cmp dword [ebp - 4], edi
je 0x834ec713
push dword [ebp - 4]
call fcn.834ec0d0
pop edi
mov eax, esi
pop esi
leave
ret 0x34