joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a495b
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push ecx
push ebx
push ebp
xor ebp, ebp
push edi
mov edi, 0x3e8
mov dword [esi], ebp
mov eax, edi
xor bl, bl
mov dword [esp + 0xc], ebp
mov ecx, dword [esp + 0x14]
movzx ecx, word [ecx]
add dword [esp + 0x14], 2
lea edx, [ecx - 0x30]
cmp dx, 9
ja 0x4a49a6
movzx edx, dx
imul edx, eax
cmp eax, edi
jl 0x4a499c
mov ecx, ebp
imul ecx, ecx, 9
add ecx, edx
add dword [esi], ecx
add ebp, ecx
jmp 0x4a4970
add dword [esi], edx
push 0xa
cdq
pop ecx
idiv ecx
jmp 0x4a4970
cmp cx, 0x3a
jne 0x4a49c7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jne 0x4a49bc
push 0x64
pop eax
jmp 0x4a49c3
mov ecx, dword [esi]
imul ecx, ecx, 0x3c
mov dword [esi], ecx
xor ebp, ebp
jmp 0x4a4970
test cx, cx
je 0x4a49e5
cmp cx, 0x2e
jne 0x4a49db
cmp eax, edi
jl 0x4a4970
push 0x64
pop eax
jmp 0x4a4970
cmp cx, 0x2d
jne 0x4a4970
mov bl, 1
jmp 0x4a4970
pop edi
pop ebp
test bl, bl
pop ebx
je 0x4a49ee
neg dword [esi]
pop ecx
ret 4

Function at 0x4a7728
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push 0
push 0
call fcn.00401a5b
or dword [ebp - 0x1c], 0xffffffff
cmp esi, 0xffffffff
mov dword [ebp - 0x20], 0x46464952
mov dword [ebp - 0x18], 0x45564157
mov dword [ebp - 0x14], 0x20746d66
mov dword [ebp - 0x10], 0x12
je 0x4a7770
movzx eax, word [edi + 0x10]
lea ecx, [eax + esi + 0x26]
add eax, 0x12
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
push 0x14
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.00401eb7
movzx eax, word [edi + 0x10]
add eax, 0x12
push eax
push edi
push dword [ebp + 8]
call fcn.00401eb7
push 8
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], 0x61746164
mov dword [ebp - 8], esi
call fcn.00401eb7
leave
ret 4

Function at 0x4a9eaa
Capabilities:
Clear file content

Disassembly:
mov cl, byte [esp + 8]
push ebx
push esi
mov esi, eax
mov eax, edi
call fcn.004a467e
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 3
push 0xc0000000
push dword [esp + 0x24]
mov dword [edi], 0x5979e8
lea esi, [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4a9ee9
or byte [edi + 0xd], 1
mov eax, dword [esp + 0x14]
movzx ecx, byte [esp + 0x10]
imul ecx, eax
mov dword [edi + 0x14], eax
push ebx
mov eax, edi
mov dword [edi + 0x18], ecx
mov dword [edi + 4], ebx
call fcn.004a9fc4
cmp dword [edi + 4], ebx
jle 0x4a9f32
push esi
call fcn.0042408e
mov ebx, eax
mov eax, dword [edi + 0x18]
imul eax, dword [edi + 4]
push esi
add ebx, eax
call fcn.00401a72
cmp ebx, eax
jbe 0x4a9f28
mov ebx, eax
push 0
push ebx
mov eax, esi
call fcn.00401a5b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp dword [esi], 0xffffffff
jne 0x4a9f43
or byte [edi + 0xd], 1
pop esi
mov eax, edi
pop ebx
ret 0xc

Function at 0x4aaf6d
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 4], 0
je 0x4aaf9c
push ebx
movzx ebx, byte [ecx]
dec dword [esp + 8]
mov edx, eax
shr edx, 0x18
xor edx, ebx
and edx, 0xff
shl eax, 8
xor eax, dword [edx*4 + 0x544358]
inc ecx
cmp dword [esp + 8], 0
jne 0x4aaf75
pop ebx
ret 4
Function at 0x4b5a48
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 8], 0x1c
push ebx
mov ebx, dword [esp + 8]
je 0x4b5a5b
cmp dword [esp + 0xc], 0xd
jne 0x4b5a7a
cmp byte [ebx + 0xe2], 0
je 0x4b5a7a
push 0x6a
push ebx
xor al, al
call fcn.00402b8f
push 0x6b
push ebx
xor al, al
call fcn.00402b8f
jmp 0x4b5aa2
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 0x6a
push dword [ebx + 4]
call esi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
push 0
push 0x6b
push dword [ebx + 4]
call esi
push eax
call edi
pop edi
pop esi
pop ebx
ret 8
Function at 0x4c5f54
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
mov ebx, dword [ebp + 0xc]
push esi
jmp 0x4c60bc
mov eax, dword [edi + 0x1308]
mov esi, 0x3ffff800
cmp eax, esi
jae 0x4c5fb1
sub esi, eax
cmp esi, ebx
jbe 0x4c5f7e
mov esi, ebx
cmp word [edi + 0xfdc], 0
je 0x4c5fa1
lea eax, [edi + 0x152f]
cmp dword [eax], 0xffffffff
je 0x4c60c4
push esi
push dword [ebp + 8]
push eax
call fcn.00401eb7
add dword [ebp + 8], esi
sub ebx, esi
add dword [edi + 0x1308], esi
jmp 0x4c60bc
mov eax, dword [edi + 0x152f]
cmp eax, 0xffffffff
je 0x4c5fca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x152f], 0xffffffff
cmp word [edi + 0xfdc], 0
je 0x4c60a8
and word [ebp - 0x208], 0
cmp byte [edi + 0x1764], 0
je 0x4c6007
movzx eax, byte [edi + 0x155b]
push eax
lea eax, [edi + 0x155c]
push eax
lea eax, [ebp - 0x208]
call fcn.004e2be7
pop ecx
pop ecx
jmp 0x4c6055
lea esi, [edi + 0x155c]
push 0x58f090
push esi
call fcn.00520981
test eax, eax
pop ecx
pop ecx
je 0x4c6043
lea eax, [edi + 0x152e]
inc byte [eax]
movzx eax, byte [eax]
push eax
movzx eax, byte [edi + 0x155b]
push eax
push esi
lea eax, [ebp - 0x208]
call fcn.004e2be7
add esp, 0xc
jmp 0x4c6055
mov edx, esi
push 0x104
lea esi, [ebp - 0x208]
call fcn.0044b0f6
and word [ebp - 0x410], 0
lea eax, [ebp - 0x208]
push eax
lea eax, [edi + 0x1326]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00401dde
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [edi + 0x152f]
cmp eax, 0xffffffff
je 0x4c6096
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x410]
push eax
call fcn.0042404a
mov dword [edi + 0x152f], eax
and dword [edi + 0x1308], 0
and dword [edi + 0x1304], 0
mov dword [edi + 0x1300], ebx
test ebx, ebx
ja 0x4c5f67
pop esi
pop ebx
leave
ret 8
Function at 0x4df513
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
mov eax, edi
call fcn.004283d8
test al, al
jne 0x4df549
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ecx
mov ecx, dword [edi]
mov eax, esp
push dword [ebp + 0xc]
mov dword [eax], ecx
push dword [ebp + 8]
call fcn.00489906
mov eax, dword [ebp + 8]
jmp 0x4df639
mov ebx, dword [edi + 0xc]
add ebx, dword [edi + 0x10]
add ebx, dword [edi + 0x14]
cmp dword [edi + 0x24], ebx
jae 0x4df563
push ebx
lea esi, [edi + 0x20]
call fcn.004e34b2
mov dword [edi + 0x24], ebx
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0xc]
add esi, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [ebp + 0x10], eax
jbe 0x4df633
mov ebx, dword [edi + 0x14]
cmp dword [ebp + 0x10], ebx
jae 0x4df58d
mov ebx, dword [ebp + 0x10]
push ebx
push dword [ebp - 8]
push esi
call fcn.00526ea0
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x30], eax
add esp, 0xc
lea eax, [ebx + esi]
mov dword [ebp - 0x28], eax
xor eax, eax
lea ecx, [ebp - 0x48]
push eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [edi + 4]
push eax
mov dword [ebp - 0x44], 7
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x14], 4
call sub.Secur32.dll_EncryptMessage
test eax, eax
jne 0x4df63f
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
push dword [ebp + 0x18]
add eax, ecx
add eax, dword [ebp - 0x48]
push eax
push dword [ebp - 0xc]
push ecx
mov ecx, dword [edi]
mov eax, esp
push dword [ebp + 0xc]
mov dword [eax], ecx
lea eax, [ebp + 0x14]
push eax
call fcn.00489906
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x4df64a
add dword [ebp - 8], ebx
sub dword [ebp + 0x10], ebx
jne 0x4df582
mov eax, dword [ebp + 8]
and dword [eax], 0
pop esi
pop ebx
leave
ret 0x14
mov eax, dword [ebp + 8]
mov dword [eax], 2
jmp 0x4df639
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x4df639
Function at 0x4dfa22
Capabilities:
Get client handle via schannel
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 0x38
mov edi, eax
xor esi, esi
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.005251f0
lea eax, [edi + 0x230]
add esp, 0xc
cmp dword [eax], esi
mov dword [ebp - 0x38], 4
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x18], 0xaa0
je 0x4dfa66
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], eax
push esi
add edi, 0x234
push edi
push esi
push esi
lea eax, [ebp - 0x38]
push eax
push esi
push 2
push str.Microsoft_Unified_Security_Protocol_Provider
push esi
call dword [sym.imp.Secur32.dll_AcquireCredentialsHandleW]
neg eax
sbb al, al
pop edi
inc al
pop esi
leave
ret
Function at 0x4e3585
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [esi + 0x26]
mov dword [ebp - 0x2c], eax
mov al, byte [ecx + 2]
movzx dx, al
push edi
movzx edi, word [ecx + 0xe]
movzx eax, al
imul eax, edi
mov word [ebp - 0x1a], dx
mov edx, dword [ecx + 4]
imul eax, edx
and word [ebp - 0xc], 0
shr eax, 3
mov dword [ebp - 0x14], eax
movzx eax, word [ecx + 0xe]
movzx cx, byte [ecx + 2]
mov dword [ebp - 0x18], edx
mov dx, ax
shr dx, 3
imul dx, cx
mov word [ebp - 0xe], ax
push 0x2e
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
mov dword [ebp - 0x30], 0x46464952
mov dword [ebp - 0x28], 0x45564157
mov dword [ebp - 0x24], 0x20746d66
mov dword [ebp - 0x20], 0x12
mov word [ebp - 0x1c], 1
mov word [ebp - 0x10], dx
mov dword [ebp - 0xa], 0x61746164
mov dword [ebp - 6], esi
call fcn.00401eb7
pop edi
leave
ret 4

Function at 0x4e6124
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 0x50000000
mov esi, eax
mov edi, dword [esi + 0x15]
push 0x548ddc
mov ebx, 0x257f
mov ebp, 0x53ec98
push ebx
mov edx, ebp
call fcn.0047dfa7
push ebx
push dword [esi + 0x15]
mov ecx, esi
call fcn.0041e7aa
mov eax, dword [esi + 0x15]
push 0
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
push ebx
lea eax, [esi + 0x19]
push eax
mov eax, dword [esi + 0x15]
call fcn.0047c9f6
push esi
mov esi, dword [esi + 0x15]
push 0x4fad53
push 0x112
add esi, 0x28
call fcn.0047e405
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4e68a3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, eax
mov eax, dword [esi]
lea ecx, [eax + 1]
push 0x104
mov dword [esi], ecx
lea ecx, [ebp - 0x208]
push ecx
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4e68da
and word [esi + 0x628], 0
jmp 0x4e68f0
lea ecx, [ebp - 0x208]
lea eax, [esi + 0x41c]
push ecx
add esi, 8
push esi
call fcn.004249dd
pop esi
leave
ret
Function at 0x5004da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x14]
sub esp, 0x14
cmp eax, dword [esi]
push ebx
jae 0x500625
mov eax, dword [edi + 0x14]
cmp eax, dword [edi]
jae 0x500625
call fcn.004562aa
mov ebx, dword [ebp + 0x10]
test ebx, ebx
mov dword [ebp - 0x14], eax
jle 0x500551
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov edx, eax
shr edx, 8
push edx
mov ecx, eax
lea edx, [ebp - 4]
shr ecx, 0x10
push edx
mov dword [ebp - 0x10], eax
call fcn.0042503b
xor eax, eax
mov ah, byte [ebp - 0xd]
xor ecx, ecx
mov ch, byte [ebp - 0xd]
xor eax, dword [ebp - 4]
and eax, 0xffff7fff
xor eax, ecx
mov ecx, dword [edi + 0x18]
mov word [ecx], ax
mov word [ebp - 4], ax
mov eax, esi
call fcn.0045f94a
mov eax, edi
call fcn.0045f94a
dec ebx
jne 0x500506
call fcn.004562aa
xor ebx, ebx
mov ecx, eax
inc ebx
sub ecx, dword [ebp - 0x14]
je 0x500577
xor edx, edx
mov eax, 0x186a0
div ecx
cmp eax, ebx
jle 0x500572
mov dword [ebp - 8], eax
jmp 0x50057e
mov dword [ebp - 8], ebx
jmp 0x50057e
mov dword [ebp - 8], 0x186a0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp - 0xc], eax
mov eax, dword [ecx]
call dword [eax]
test al, al
je 0x50059a
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x50062e
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 0x10], ebx
jle 0x50061d
cmp dword [ebp + 0x10], 0
jle 0x5005f7
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov edx, eax
shr edx, 8
push edx
mov ecx, eax
lea edx, [ebp - 4]
shr ecx, 0x10
push edx
mov dword [ebp - 0x14], eax
call fcn.0042503b
xor eax, eax
mov ah, byte [ebp - 0x11]
xor ecx, ecx
mov ch, byte [ebp - 0x11]
xor eax, dword [ebp - 4]
and eax, 0xffff7fff
xor eax, ecx
mov ecx, dword [edi + 0x18]
mov word [ecx], ax
mov word [ebp - 4], ax
mov eax, esi
call fcn.0045f94a
mov eax, edi
call fcn.0045f94a
dec ebx
jne 0x5005ab
inc ebx
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
jne 0x500612
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x500590
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x14]
jl 0x5005a2
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x50062e
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ebx
leave
ret 0x10
Function at 0x500da1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x14]
sub esp, 0x14
cmp eax, dword [esi]
push ebx
jae 0x500eec
mov eax, dword [edi + 0x14]
cmp eax, dword [edi]
jae 0x500eec
call fcn.004562aa
mov ebx, dword [ebp + 0x10]
test ebx, ebx
mov dword [ebp - 0x14], eax
jle 0x500e18
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
mov eax, ecx
shr eax, 8
push eax
mov eax, ecx
lea edx, [ebp - 4]
shr eax, 0x10
push edx
mov dword [ebp - 0x10], ecx
call fcn.0042503b
xor eax, eax
mov ah, byte [ebp - 0xd]
xor ecx, ecx
mov ch, byte [ebp - 0xd]
xor eax, dword [ebp - 4]
and eax, 0xffff7fff
xor eax, ecx
mov ecx, dword [edi + 0x18]
mov word [ecx], ax
mov word [ebp - 4], ax
mov eax, esi
call fcn.0045f94a
mov eax, edi
call fcn.0045f94a
dec ebx
jne 0x500dcd
call fcn.004562aa
xor ebx, ebx
mov ecx, eax
inc ebx
sub ecx, dword [ebp - 0x14]
je 0x500e3e
xor edx, edx
mov eax, 0x186a0
div ecx
cmp eax, ebx
jle 0x500e39
mov dword [ebp - 8], eax
jmp 0x500e45
mov dword [ebp - 8], ebx
jmp 0x500e45
mov dword [ebp - 8], 0x186a0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp - 0xc], eax
mov eax, dword [ecx]
call dword [eax]
test al, al
je 0x500e61
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x500ef5
cmp dword [ebp + 0x14], ebx
mov dword [ebp - 0x10], ebx
jle 0x500ee4
cmp dword [ebp + 0x10], 0
jle 0x500ebe
mov ebx, dword [ebp + 0x10]
mov eax, dword [esi + 0x18]
mov ecx, dword [eax]
mov eax, ecx
shr eax, 8
push eax
mov eax, ecx
lea edx, [ebp - 4]
shr eax, 0x10
push edx
mov dword [ebp - 0x14], ecx
call fcn.0042503b
xor eax, eax
mov ah, byte [ebp - 0x11]
xor ecx, ecx
mov ch, byte [ebp - 0x11]
xor eax, dword [ebp - 4]
and eax, 0xffff7fff
xor eax, ecx
mov ecx, dword [edi + 0x18]
mov word [ecx], ax
mov word [ebp - 4], ax
mov eax, esi
call fcn.0045f94a
mov eax, edi
call fcn.0045f94a
dec ebx
jne 0x500e72
inc ebx
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
jne 0x500ed9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x500e57
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x14]
jl 0x500e69
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x500ef5
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ebx
leave
ret 0x10
Function at 0x503ae8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x14]
sub esp, 0x14
cmp eax, dword [esi]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
jae 0x503cb5
mov eax, dword [ebx + 0x14]
cmp eax, dword [ebx]
jae 0x503cb5
call fcn.004562aa
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x503b9c
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x18]
mov di, word [eax]
mov word [ebp - 0xc], di
mov ecx, dword [ebp - 0xc]
mov dx, di
shr dx, 7
shr ecx, 0xc
and cl, 7
or cl, dl
and dl, 7
mov ax, di
shr ax, 2
or dl, al
and al, 7
push edx
mov dl, byte [ebp - 0xc]
shl dl, 3
or al, dl
lea edx, [ebp + 0x10]
push edx
call fcn.0042503b
xor ecx, ecx
mov ax, di
sar ax, 0xf
mov ch, al
mov ax, di
sar ax, 0xf
xor edx, edx
mov dh, al
xor ecx, dword [ebp + 0x10]
and ecx, 0xffff7fff
xor ecx, edx
mov ax, cx
mov ecx, dword [ebx + 0x18]
mov word [ecx], ax
mov word [ebp + 0x10], ax
mov eax, esi
call fcn.0045f94a
mov eax, ebx
call fcn.0045f94a
dec dword [ebp - 8]
jne 0x503b1f
call fcn.004562aa
xor edi, edi
mov ecx, eax
inc edi
sub ecx, dword [ebp - 0x14]
je 0x503bc2
xor edx, edx
mov eax, 0x186a0
div ecx
cmp eax, edi
jle 0x503bbd
mov dword [ebp - 4], eax
jmp 0x503bc9
mov dword [ebp - 4], edi
jmp 0x503bc9
mov dword [ebp - 4], 0x186a0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
dec eax
mov dword [ebp - 8], eax
mov eax, dword [ecx]
call dword [eax]
test al, al
je 0x503be5
mov eax, dword [ebp + 8]
mov dword [eax], edi
jmp 0x503cbe
cmp dword [ebp + 0x18], edi
mov dword [ebp - 0xc], edi
jle 0x503cad
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x503c7f
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
mov di, word [eax]
mov word [ebp - 0x10], di
mov ecx, dword [ebp - 0x10]
mov dx, di
shr dx, 7
shr ecx, 0xc
and cl, 7
or cl, dl
and dl, 7
mov ax, di
shr ax, 2
or dl, al
and al, 7
push edx
mov dl, byte [ebp - 0x10]
shl dl, 3
or al, dl
lea edx, [ebp + 0x10]
push edx
call fcn.0042503b
xor ecx, ecx
mov ax, di
sar ax, 0xf
mov ch, al
mov ax, di
sar ax, 0xf
xor edx, edx
mov dh, al
xor ecx, dword [ebp + 0x10]
and ecx, 0xffff7fff
xor ecx, edx
mov ax, cx
mov ecx, dword [ebx + 0x18]
mov word [ecx], ax
mov word [ebp + 0x10], ax
mov eax, esi
call fcn.0045f94a
mov eax, ebx
call fcn.0045f94a
dec dword [ebp - 0x14]
jne 0x503bff
xor edi, edi
inc edi
mov eax, dword [ebp - 8]
dec dword [ebp - 8]
test eax, eax
jne 0x503c9e
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax]
test al, al
jne 0x503bdb
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x18]
jl 0x503bf1
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x503cbe
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop edi
pop ebx
leave
ret 0x14
Function at 0x50879c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
invalid
Function at 0x523c89
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5a27f0]
jne 0x523c93
repz ret
jmp fcn.0052cf41

Function at 0x523ccc
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5a2800]
je 0x523ce7
inc edi
cmp edi, 0x17
jb 0x523cd8
cmp edi, 0x17
jae 0x523e67
push ebp
push 3
call fcn.0052d238
cmp eax, 1
pop ecx
je 0x523e33
push 3
call fcn.0052d238
test eax, eax
pop ecx
jne 0x523d1b
cmp dword [0x5a205c], 1
je 0x523e33
cmp ebx, 0xfc
je 0x523e66
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x5a84b0
push ebp
call fcn.00526da9
add esp, 0xc
test eax, eax
je 0x523d51
push esi
push esi
push esi
push esi
push esi
call fcn.00521140
add esp, 0x14
push 0x104
mov esi, 0x5a84c9
push esi
push 0
mov byte [0x5a85cd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x523d95
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00526da9
add esp, 0xc
test eax, eax
je 0x523d95
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00521140
add esp, 0x14
push esi
call fcn.00527210
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x523dda
push esi
call fcn.00527210
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x5a87c4
push 0x53b344
sub ecx, eax
push ecx
push eax
call fcn.00526cf6
add esp, 0x14
test eax, eax
je 0x523dda
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00521140
add esp, 0x14
jmp 0x523ddc
xor esi, esi
push 0x53b340
push ebx
push ebp
call fcn.00526c34
add esp, 0xc
test eax, eax
je 0x523dfc
push esi
push esi
push esi
push esi
push esi
call fcn.00521140
add esp, 0x14
push dword [edi*8 + 0x5a2804]
push ebx
push ebp
call fcn.00526c34
add esp, 0xc
test eax, eax
je 0x523e1e
push esi
push esi
push esi
push esi
push esi
call fcn.00521140
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0052d07b
add esp, 0xc
jmp 0x523e66
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x523e66
cmp ebp, 0xffffffff
je 0x523e66
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5a2804]
push dword [esi]
call fcn.00527210
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x52d07b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.005233ff
xor ebx, ebx
cmp dword [0x5a8ea4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x52d151
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x52d231
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x52d231
push eax
call fcn.00523391
mov dword [esp], 0x53bf38
push edi
mov dword [0x5a8ea4], eax
call esi
push eax
call fcn.00523391
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5a8ea8], eax
call esi
push eax
call fcn.00523391
mov dword [0x5a8eac], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00526397
test eax, eax
pop ecx
pop ecx
je 0x52d11f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00521140
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x52d151
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00523391
cmp eax, ebx
pop ecx
mov dword [0x5a8eb4], eax
je 0x52d151
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00523391
pop ecx
mov dword [0x5a8eb0], eax
mov eax, dword [0x5a8eb0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x52d1d6
cmp dword [0x5a8eb4], ecx
je 0x52d1d6
push eax
call fcn.00523408
push dword [0x5a8eb4]
mov esi, eax
call fcn.00523408
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x52d1d6
cmp edi, ebx
je 0x52d1d6
call esi
cmp eax, ebx
je 0x52d1a3
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x52d1a3
test byte [ebp - 0x18], 1
jne 0x52d1d6
lea eax, [ebp - 0x10]
push eax
call fcn.005263ce
test eax, eax
pop ecx
je 0x52d1be
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00521140
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x52d1cd
or dword [ebp + 0x10], 0x200000
jmp 0x52d211
or dword [ebp + 0x10], 0x40000
jmp 0x52d211
mov eax, dword [0x5a8ea8]
cmp eax, dword [ebp - 8]
je 0x52d211
push eax
call fcn.00523408
cmp eax, ebx
pop ecx
je 0x52d211
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x52d211
mov eax, dword [0x5a8eac]
cmp eax, dword [ebp - 8]
je 0x52d211
push eax
call fcn.00523408
cmp eax, ebx
pop ecx
je 0x52d211
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5a8ea4]
call fcn.00523408
cmp eax, ebx
pop ecx
je 0x52d231
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x52d233
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret