joyce8/EMBER2024-capa huggingface dataset:
Function at 0x70a2a5
Capabilities:
Encrypt data using aes

Disassembly:
push esi
mov dl, byte [esp]
mov dh, 0xe0
jmp 0x7094af
lea edx, [ecx + 0x83]
jmp 0x709435
lea edx, [ebx + esi]
sub esp, 0x414
lea edx, [eax - 0x61]
not dx
setge dh
jmp 0x70944b
not ch
mov ebp, esp
sub esp, 0
mov ecx, dword [ebp + 0xc]
jmp 0x709462
mov dword [esp + 3], eax
lea esp, [esp + 8]
push ebp
lea edx, [ebx + edi]
bsf bp, ax
jmp 0x70947e
pushal
lea ebp, [ecx + 0x73]
mov dword [esp + 4], eax
pushal
pop word [esp + 0x1b]
jmp 0x7094ce
push dword [esp + 2]
jmp 0x70949d
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
popal
lea edx, [ebp*4]
mov al, 0x6e
mov edx, dword [esp]
jmp 0x70955b
push edx
lea esp, [esp + 1]
mov word [esp], sp
lea esp, [esp + 3]
popal
jmp 0x7095e6
pushal
rdtsc
cpuid
mov cl, 0xca
mov dword [esp + 0x14], esi
jmp 0x709525
push edi
lea eax, [ebp + 0x3f]
mov dx, 0x1fc5
bswap eax
lea edx, [esi - 0xad]
jmp 0x70953b
pop word [esp + 1]
call fcn.0070956d
push dword [ebp + 0x18]
mov al, 0x9c
lea eax, reloc.WINMM.dll_midiStreamOut
mov cx, 0x7c3f
jmp 0x70a25d
lea eax, [eax + edx]
mov eax, dword [esp]
lea eax, reloc.WINMM.dll_midiStreamOut
pushal
lea esp, [esp + 0x19]
jmp 0x709586
lea ecx, [ecx + 0xa3]
call 0x7097e2
btc ebx, ebx
lea esp, [esp + 4]
xor eax, 0x1000000
sub bl, ah
mov edi, 0x557c0696
jmp 0x70a231
mov edi, edx
lea ebp, [eax - 0xd1]
shr edi, 8
xchg bl, bh
jmp 0x70a244
inc ebp
and edi, esi
rol bl, 5
inc bl
jmp 0x70a41e
push edx
lea ecx, [ebx + ebp]
lea esp, [esp + 4]
push dword [ebp + 0xc]
mov cx, 0x7afb
jmp 0x70a1d7
and eax, 0xff000000
neg ebp
lea ebp, [edx*4]
mov ebp, dword [esp]
jmp 0x70a3cd
mov ebx, dword [esi]
pop esi
bswap ebp
inc ebp
inc ebp
jmp 0x70a271
push esi
mov esi, ecx
lea esi, [esi + 4]
jmp 0x70a28e
xor eax, edi
bswap edi
mov edi, dword [esp]
inc edi
jmp 0x70a3a5
lea esp, [esp + 4]
movzx edi, byte [edi*4 + 0x6e7728]
inc bp
jmp 0x70a2ad
mov edi, edx
push edx
shr edi, 0x18
neg ebp
lea ebp, [esi*4]
jmp 0x70a2c4
lea esp, [esp + 0x20]
mov ebp, 0xff00
push edx
pop word [esp]
call fcn.0070a2ec
jae 0x70a382
test dword [edi], esi
lea ebp, [ecx*4]
pushal
xchg word [esp + 4], bp
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
inc bp
jmp 0x70a303
lea esp, [esp + 0x18]
lea edi, [ecx + 0x10]
xor ebx, eax
sub esp, 0x16
jmp 0x70a345
lea esp, [esp + 2]
jmp 0x70a38a
mov di, 0x1adf
lea esp, [esp + 0x2c]
xor eax, dword [ecx]
sub esp, 0x1a
lea esp, [esp + 2]
jmp 0x70a333
add ah, byte [ecx]
out dx, eax
pushal
xor eax, edi
jmp 0x70a35d
mov dword [edi], eax
sets al
push ebx
jmp 0x70a3b4
mov edi, edx
lea ebp, [esp + ebp]
and edi, esi
lea ebp, [eax + 9]
jmp 0x70a31b
mov ebx, ecx
lea ebx, [ebx + 8]
mov eax, dword [ebx]
pop ebx
call fcn.0070a3f2
adc byte [esi + 0x21967b1c], cl
lahf
out 0x11, al
nop
adc ecx, dword [edx + reloc.WINMM.dll_midiStreamOut]
mov ebp, 0xe7d147f9
xor eax, edi
bsr di, cx
inc edi
shl edi, 1
jmp 0x70a2db
mov edi, dword [edi*4 + reloc.WINMM.dll_midiStreamOut]
and edi, 0xff0000
mov bp, word [esp]
mov bp, word [esp]
jmp 0x70a2a5
Function at 0x7117db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x7118a3
arpl word [edx + 0x824648d], bx
lea esp, [esp + 4]
je 0x7110ce
jne 0x7110a9
stosd dword es:[edi], eax
sub byte [esi - 0x3a15d727], bh
je 0x711840
shr al, 0x11
clc
invalid

Function at 0x711aee
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jle 0x7111ed
jmp 0x71111f
jmp 0x711acf
Function at 0x401132
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1038
call fcn.00407110
mov eax, dword [0x412014]
xor eax, esp
mov dword [esp + 0x1034], eax
push ebx
push ebp
xor ebp, ebp
lea ecx, [esp + 0x30]
push esi
push edi
mov ebx, 0x20019
mov dword [esp + 0x38], ebp
push ebx
push 0x40b034
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x48], ebp
mov edi, ebp
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.00402d8d
mov esi, eax
test esi, esi
jne 0x4012ac
push ebx
push 0x409280
push dword [esp + 0x40]
lea ecx, [esp + 0x38]
call fcn.00402d8d
mov esi, eax
test esi, esi
jne 0x4012ac
push ebx
push 0x409294
push dword [esp + 0x34]
lea ecx, [esp + 0x1c]
call fcn.00402d8d
mov esi, eax
test esi, esi
jne 0x4012ac
mov ebx, 0x800
lea eax, [esp + 0x44]
push ebx
push ebp
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x44]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push eax
push ebp
jmp 0x401256
inc edi
lea eax, [esp + 0x44]
mov ecx, str.11.281.2
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401232
test dx, dx
je 0x40122e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401232
add eax, 4
add ecx, 4
test dx, dx
jne 0x40120c
mov eax, ebp
jmp 0x401237
sbb eax, eax
or eax, 1
test eax, eax
lea eax, [esp + 0x44]
je 0x401264
mov esi, 0x800
push esi
push ebp
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x44]
push esi
push eax
push edi
push dword [esp + 0x1c]
call ebx
mov esi, eax
test esi, esi
je 0x401202
jmp 0x4012ac
push 0x2001f
push eax
push dword [esp + 0x18]
lea ecx, [esp + 0x28]
call fcn.00402d8d
mov esi, eax
test esi, esi
jne 0x4012ac
mov eax, dword [esp + 0x104c]
push 4
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push eax
push 4
push ebp
push str.UseNewJavaPlugin
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.00402913
lea ecx, [esp + 0x1c]
call fcn.00402913
lea ecx, [esp + 0x10]
call fcn.00402913
lea ecx, [esp + 0x2c]
call fcn.00402913
lea ecx, [esp + 0x38]
call fcn.00402913
mov ecx, dword [esp + 0x1044]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407028
add esp, 0x1038
ret
Function at 0x403bb3
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x403bcd
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x403bdd
push 0xd
pop eax
jmp 0x403c22
push ebp
push esi
xor eax, eax
push edi
mov dword [esp + 0x18], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x18]
jne 0x403bef
sub ecx, ebp
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x403bea
push esi
push edx
push 7
xor eax, eax
push eax
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x403c26
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push esi
mov esi, ecx
test edx, edx
jne 0x403c36
push 0xd
pop eax
jmp 0x403c6a
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x403c3f
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [esp + 0x20]
push ebx
push dword [esp + 0x20]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
ret 0xc

Function at 0x404588
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x412014]
xor eax, ebp
mov dword [ebp + 0x9c], eax
cmp dword [0x4122c8], 0
je 0x4045b3
mov eax, dword [0x4122cc]
jmp 0x40460e
push esi
push 0x118
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x80], 0x11c
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
inc eax
cmp dword [ebp - 0x70], 2
jne 0x404600
cmp dword [ebp - 0x7c], 6
jne 0x404600
cmp dword [ebp - 0x78], esi
jne 0x404600
cmp byte [ebp + 0x9a], al
jne 0x404600
cmp word [ebp + 0x94], si
jne 0x404600
mov esi, eax
mov dword [0x4122c8], eax
mov eax, esi
mov dword [0x4122cc], esi
pop esi
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.00407028
add ebp, 0xa0
leave
ret

Function at 0x40530a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x412014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov ebx, 0x208
push ebx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x405390
cmp eax, edi
ja 0x405390
push ebx
lea eax, [ebp - 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x40c00c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x405392
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407028
leave
ret
Function at 0x4022b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
lea edi, [ebp - 0x108]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov esi, esp
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp esi, esp
call fcn.00402860
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffff
jne 0x402303
xor eax, eax
jmp 0x4023de
mov esi, esp
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp esi, esp
call fcn.00402860
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x20], 0
je 0x40233d
mov esi, esp
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00402860
xor eax, eax
jmp 0x4023de
mov eax, dword [ebp - 0x14]
push eax
call fcn.00402950
add esp, 4
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x402369
mov esi, esp
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00402860
xor eax, eax
jmp 0x4023de
mov esi, esp
push 0
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.00402860
mov dword [ebp - 8], eax
mov esi, esp
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.00402860
cmp dword [ebp - 8], 0
je 0x4023ae
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
je 0x4023db
mov esi, esp
push 0x10
push 0x411364
push 0x41139c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp esi, esp
call fcn.00402860
mov eax, dword [ebp - 0x44]
push eax
call fcn.004033c0
add esp, 4
xor eax, eax
jmp 0x4023de
mov eax, dword [ebp - 0x44]
push edx
mov ecx, ebp
push eax
lea edx, [0x402403]
call fcn.00402890
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0x108
cmp ebp, esp
call fcn.00402860
mov esp, ebp
pop ebp
ret
Function at 0x405530
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411ff0
push 0x409898
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, 0x94
call fcn.00409760
mov dword [ebp - 0x7c], esp
mov dword [ebp - 0x18], esp
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dword [ecx], 0x94
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 0x10]
mov dword [0x417df4], ecx
mov edx, dword [ebp - 0x70]
mov eax, dword [edx + 4]
mov dword [0x417e00], eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ecx + 8]
mov dword [0x417e04], edx
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 0xc]
and ecx, 0x7fff
mov dword [0x417df8], ecx
cmp dword [0x417df4], 2
je 0x4055cf
mov edx, dword [0x417df8]
or edx, 0x8000
mov dword [0x417df8], edx
mov eax, dword [0x417e00]
shl eax, 8
add eax, dword [0x417e04]
mov dword [0x417dfc], eax
call fcn.004057a0
mov dword [ebp - 0x6c], eax
push 0
call fcn.00406930
add esp, 4
test eax, eax
jne 0x405602
push 0x1c
call fcn.00405770
add esp, 4
call fcn.0040a820
mov dword [ebp - 4], 0
call fcn.0040a4b0
test eax, eax
jge 0x405621
push 0x1b
call fcn.00405740
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x419404], eax
call fcn.0040a290
mov dword [0x417dcc], eax
call fcn.00409e30
test eax, eax
jge 0x405649
push 8
call fcn.00405740
add esp, 4
call fcn.00409cb0
test eax, eax
jge 0x40565c
push 9
call fcn.00405740
add esp, 4
push 1
call fcn.00406a60
add esp, 4
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
je 0x40567b
mov ecx, dword [ebp - 0x64]
push ecx
call fcn.00405740
add esp, 4
mov dword [ebp - 0x34], 0
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00409be0
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x34]
and eax, 1
je 0x4056a5
movzx ecx, word [ebp - 0x30]
mov dword [ebp - 0x80], ecx
jmp 0x4056ac
mov dword [ebp - 0x80], 0xa
mov edx, dword [ebp - 0x80]
push edx
mov eax, dword [ebp - 0x68]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x6c], 0
jne 0x4056d6
mov ecx, dword [ebp - 0x74]
push ecx
call fcn.00406ac0
call fcn.00406b00
mov dword [ebp - 4], 0xffffffff
jmp 0x405723
mov eax, dword [ebp - 0x74]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4057a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x4057c6
xor eax, eax
jmp 0x40584d
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x4057e1
xor eax, eax
jmp 0x40584d
mov edx, dword [ebp - 8]
add edx, 0x18
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x10b
je 0x405807
cmp dword [ebp - 0x14], 0x20b
je 0x405827
jmp 0x40584b
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x5c], 0xe
ja 0x405814
xor eax, eax
jmp 0x40584d
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0xd0], 0
setne cl
mov eax, ecx
jmp 0x40584d
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x6c], 0xe
ja 0x40583a
xor eax, eax
jmp 0x40584d
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ecx + 0xe0], 0
setne al
jmp 0x40584d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x406b40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x417e34], 1
jne 0x406b5d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x417e30], 1
mov cl, byte [ebp + 0x10]
mov byte [0x417e2c], cl
cmp dword [ebp + 0xc], 0
jne 0x406bc2
cmp dword [0x4193e8], 0
je 0x406bb0
mov edx, dword [0x4193e4]
sub edx, 4
mov dword [0x4193e4], edx
mov eax, dword [0x4193e4]
cmp eax, dword [0x4193e8]
jb 0x406bb0
mov ecx, dword [0x4193e4]
cmp dword [ecx], 0
je 0x406bae
mov edx, dword [0x4193e4]
call dword [edx]
jmp 0x406b7f
push 0x414028
push 0x414020
call fcn.00406c70
add esp, 8
push 0x414030
push 0x41402c
call fcn.00406c70
add esp, 8
cmp dword [0x417e38], 0
jne 0x406bfb
push 0xffffffffffffffff
call fcn.00403d60
add esp, 4
and eax, 0x20
je 0x406bfb
mov dword [0x417e38], 1
call fcn.00404640
cmp dword [ebp + 0x10], 0
je 0x406c03
jmp 0x406c19
mov dword [0x417e34], 1
mov eax, dword [ebp + 8]
push eax
call fcn.00406c20
add esp, 4
pop ebp
ret

Function at 0x408b00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4140fc]
jne 0x408b09
ret
jmp fcn.00408b10
Function at 0x40a970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x4140fc]
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 4], 0
jmp 0x40a994
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x13
jae 0x40a9ad
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx*8 + 0x4141b0]
jne 0x40a9ab
jmp 0x40a9ad
jmp 0x40a98b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax*8 + 0x4141b0]
jne 0x40ab6b
cmp dword [ebp + 8], 0xfc
je 0x40a9f3
cmp dword [ebp + 8], 0xff
je 0x40a9f3
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x4141b4]
push eax
push 0
push 0
push 0
push 1
call fcn.00405df0
add esp, 0x14
cmp eax, 1
jne 0x40a9f3
int3
cmp dword [0x417dd4], 1
je 0x40aa0e
cmp dword [0x417dd4], 0
jne 0x40aa47
cmp dword [0x4140a8], 1
jne 0x40aa47
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x4141b4]
push eax
call fcn.00404cb0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*8 + 0x4141b4]
push edx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40ab6b
cmp dword [ebp + 8], 0xfc
je 0x40ab6b
mov byte [ebp - 0x1c], 0
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40aa84
push str._program_name_unknown_
lea ecx, [ebp - 0x120]
push ecx
call fcn.0040afb0
add esp, 8
lea edx, [ebp - 0x120]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.00404cb0
add esp, 4
add eax, 1
cmp eax, 0x3c
jbe 0x40aacd
lea ecx, [ebp - 0x120]
push ecx
call fcn.00404cb0
add esp, 4
mov edx, dword [ebp - 0x10]
lea eax, [edx + eax - 0x3b]
mov dword [ebp - 0x10], eax
push 3
push 0x412374
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040b710
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call fcn.00404cb0
add esp, 4
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x4141b4]
push ecx
call fcn.00404cb0
add esp, 4
lea eax, [esi + eax + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.00409760
mov dword [ebp - 0x124], esp
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0xc], edx
push str.Runtime_Error__n_nProgram:
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040afb0
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0040afc0
add esp, 8
push 0x4122e8
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040afc0
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*8 + 0x4141b4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0040afc0
add esp, 8
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0040b5a0
add esp, 0xc
lea esp, [ebp - 0x128]
mov ecx, dword [ebp - 0x14]
call fcn.00408b00
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40b5a0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
cmp dword [0x417fb4], 0
jne 0x40b65b
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x40b5f2
push 0x412ab4
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x417fb4], eax
cmp dword [0x417fb4], 0
jne 0x40b5f9
xor eax, eax
jmp 0x40b70a
push str.GetActiveWindow
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x417fb8], eax
push str.GetLastActivePopup
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x417fbc], eax
cmp dword [0x417df4], 2
jne 0x40b65b
push str.GetUserObjectInformationA
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x417fc4], eax
cmp dword [0x417fc4], 0
je 0x40b65b
push str.GetProcessWindowStation
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x417fc0], eax
cmp dword [0x417fc0], 0
je 0x40b69c
call dword [0x417fc0]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40b695
lea edx, [ebp - 0x18]
push edx
push 0xc
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x417fc4]
test eax, eax
je 0x40b695
mov edx, dword [ebp - 4]
and edx, 1
jne 0x40b69c
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x40b6c6
cmp dword [0x417e00], 4
jb 0x40b6b8
mov eax, dword [ebp + 0x10]
or eax, 0x200000
mov dword [ebp + 0x10], eax
jmp 0x40b6c4
mov ecx, dword [ebp + 0x10]
or ecx, 0x40000
mov dword [ebp + 0x10], ecx
jmp 0x40b6f4
cmp dword [0x417fb8], 0
je 0x40b6d8
call dword [0x417fb8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40b6f4
cmp dword [0x417fbc], 0
je 0x40b6f4
mov edx, dword [ebp - 0x14]
push edx
call dword [0x417fbc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [0x417fb4]
mov esp, ebp
pop ebp
ret
Function at 0x40ea50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, 4
call fcn.00409760
mov dword [ebp - 0x64], esp
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10], eax
push 0x1c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x40ea84
xor eax, eax
jmp 0x40eb92
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
not eax
and eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x417df4]
sub ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff1
add ecx, 0x11
imul ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x60]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 8]
jae 0x40ead7
xor eax, eax
jmp 0x40eb92
cmp dword [0x417df4], 1
je 0x40eb5d
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
push 0x1c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x40eb01
xor eax, eax
jmp 0x40eb92
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x48]
and ecx, 0x1000
je 0x40eae6
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x44]
and eax, 0x100
je 0x40eb2c
mov eax, 1
jmp 0x40eb92
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x5c]
jae 0x40eb38
xor eax, eax
jmp 0x40eb92
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 8]
jae 0x40eb46
mov eax, dword [ebp - 8]
mov dword [ebp - 0x5c], eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x40eb63
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x417df4]
sub ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0x103
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x64]
mov esp, ebp
pop ebp
ret

Function at 0x40eba0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4140fc]
mov dword [ebp - 8], eax
mov byte [ebp - 0xa], 0
push 6
lea eax, [ebp - 0x10]
push eax
push 0x1004
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x40ebd4
mov dword [ebp - 4], 0xffffffff
jmp 0x40ebe3
lea edx, [ebp - 0x10]
push edx
call fcn.0040fcd0
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00408b00
mov esp, ebp
pop ebp
ret