joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dbd
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
push esi
lea edx, [ecx + 0x3f]
shr edx, 6
mov esi, ecx
sub esi, edx
mov edx, dword [ebp + 0x14]
push edi
xor edi, edi
xor eax, eax
inc esi
imul esi, esi, 3
shr esi, 2
cmp esi, dword [edx]
mov dword [ebp - 8], edi
jbe 0x407def
or eax, 0xffffffff
jmp 0x407ef7
cmp ecx, 3
push ebx
jbe 0x407eef
mov esi, dword [ebp + 8]
mov cl, byte [eax + esi]
and dword [ebp - 0xc], 0
and dword [ebp - 0x10], 0
inc eax
mov dl, byte [eax + esi]
inc eax
mov bl, byte [eax + esi]
inc eax
mov byte [ebp - 1], dl
mov dl, byte [eax + esi]
inc eax
test cl, cl
mov byte [ebp - 2], dl
je 0x407eef
cmp bl, 0x3d
jne 0x407e2e
mov dword [ebp - 0xc], 1
cmp dl, 0x3d
jne 0x407e3a
mov dword [ebp - 0x10], 1
cmp bl, 0x3d
movzx ecx, cl
mov dl, byte [ecx + 0x42d3ed]
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + 0x42d3ed]
mov byte [ebp - 1], cl
jne 0x407e59
xor cl, cl
jmp 0x407e62
movzx ecx, bl
mov cl, byte [ecx + 0x42d3ed]
cmp byte [ebp - 2], 0x3d
mov byte [ebp - 3], cl
jne 0x407e6f
xor bl, bl
jmp 0x407e79
movzx ebx, byte [ebp - 2]
mov bl, byte [ebx + 0x42d3ed]
shl cl, 6
or cl, bl
mov bl, byte [ebp - 1]
shl dl, 2
shr bl, 4
or bl, dl
mov edx, dword [ebp + 0x10]
mov byte [edi + edx], bl
inc edi
cmp dword [ebp - 0xc], 0
jne 0x407eae
mov dl, byte [ebp - 3]
mov bl, byte [ebp - 1]
shl bl, 4
shr dl, 2
or dl, bl
mov byte [ebp - 3], bl
mov ebx, dword [ebp + 0x10]
mov byte [edi + ebx], dl
inc edi
cmp dword [ebp - 0x10], 0
jne 0x407eef
mov edx, dword [ebp + 0x10]
sub dword [ebp + 0xc], 4
mov byte [edi + edx], cl
inc edi
inc dword [ebp - 8]
test byte [ebp - 8], 0xf
jne 0x407ee5
mov cl, byte [eax + esi]
inc eax
dec dword [ebp + 0xc]
cmp cl, 0x20
je 0x407ec8
cmp cl, 0xd
jne 0x407ee0
mov cl, byte [eax + esi]
inc eax
dec dword [ebp + 0xc]
cmp cl, 0xa
jne 0x407efb
cmp dword [ebp + 0xc], 3
ja 0x407dfc
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
or eax, 0xffffffff
jmp 0x407ef6

Function at 0x407f07
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
ret

Function at 0x4086d7
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax + 0x1c], 0xc3d2e1f0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
ret
Function at 0x408ca2
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 0xac]
mov dword [ebp + 8], eax
push edi
mov eax, esi
lea edi, [esi + 0x6c]
call fcn.00408c6f
mov ebx, dword [ebp + 0x14]
cmp ebx, 0x40
ja 0x408cd8
push ebx
push dword [ebp + 0x10]
push edi
call fcn.004114f0
add esp, 0xc
jmp 0x408d31
mov al, byte [esi + 0x10c]
test al, al
jne 0x408cfa
push ebx
push dword [ebp + 0x10]
push esi
call fcn.00408586
push edi
push esi
call fcn.004085e6
add esp, 0x14
push 0x10
jmp 0x408d30
cmp al, 1
jne 0x408d16
push ebx
push dword [ebp + 0x10]
push esi
call fcn.00408b45
push edi
push esi
call fcn.00408bb2
add esp, 0x14
push 0x14
jmp 0x408d30
cmp al, 2
jne 0x408d31
push ebx
push dword [ebp + 0x10]
push esi
call fcn.0040e6f2
push edi
push esi
call fcn.0040e75f
add esp, 0x14
push 0x20
pop ebx
push 0x40
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx]
push 0
push eax
call fcn.00411990
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x40
sub eax, edi
pop ecx
mov dl, byte [edi]
xor dl, 0x5c
mov byte [eax + edi], dl
xor byte [edi], 0x36
inc edi
dec ecx
jne 0x408d4d
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x408f03
Capabilities:
Generate random numbers via winapi

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x408f23
push 0xffffffffffffff99
pop eax
pop esi
ret
push dword [esp + 0xc]
push dword [esp + 0x14]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x408f3b
push 0xffffffffffffff98
jmp 0x408f20
push 0
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
ret

Function at 0x408fdb
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
or ebx, ecx
or ebx, edx
test bl, 3
push esi
jne 0x408ffc
shr edx, 2
je 0x40900d
sub ecx, eax
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
dec edx
jne 0x408fef
jmp 0x40900d
test edx, edx
jbe 0x40900d
sub ecx, eax
mov esi, edx
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x409004
pop esi
pop ebx
ret
Function at 0x409108
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ecx, ecx
push edi
movzx eax, byte [ecx + 0x42d468]
mov edi, dword [ebp + 8]
dec eax
mov edx, eax
sar edx, 3
mov dl, byte [edx + edi]
and eax, 7
test byte [eax*4 + 0x42d4e0], dl
setne al
mov byte [ebp + ecx - 0x7c], al
inc ecx
cmp ecx, 0x38
jl 0x40911c
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movzx eax, byte [ebx + 0x42d4a0]
xor ecx, ecx
xor edx, edx
cmp ecx, 0x1c
setge dl
mov edi, eax
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x409170
lea edi, [eax - 0x1c]
mov dl, byte [ebp + edi - 0x7c]
mov byte [ebp + ecx - 0x44], dl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x409158
xor ecx, ecx
movzx eax, byte [ecx + 0x42d4b0]
cmp byte [ebp + eax - 0x45], 0
je 0x4091a7
mov eax, ecx
cdq
push 6
pop edi
idiv edi
mov edx, dword [edx*4 + 0x42d4e0]
lea eax, [ebp + eax - 0xc]
sar edx, 2
or byte [eax], dl
inc ecx
cmp ecx, 0x30
jl 0x409181
movzx eax, byte [ebp - 0xc]
movzx ecx, byte [ebp - 0xa]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 8]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 9]
mov dword [esi + ebx*8], eax
movzx eax, byte [ebp - 0xb]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 7]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 5]
shl eax, 8
or eax, ecx
mov dword [esi + ebx*8 + 4], eax
inc ebx
cmp ebx, 0x10
jl 0x409148
cmp dword [ebp + 0xc], 1
jne 0x40922a
xor edi, edi
lea eax, [esi + 0x7c]
mov ebx, dword [eax - 4]
lea edx, [esi + edi*4]
mov ecx, dword [edx]
mov dword [edx], ebx
mov dword [eax - 4], ecx
mov ebx, dword [eax]
lea ecx, [esi + edi*4 + 4]
mov edx, dword [ecx]
inc edi
mov dword [ecx], ebx
mov dword [eax], edx
inc edi
sub eax, 8
cmp edi, 0x10
jl 0x409207
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041070b
leave
ret
Function at 0x4092dc
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push edi
push 0x3f
mov dword [ebp - 4], eax
add edx, 8
mov dword [ebp - 8], 8
pop ecx
ror eax, 4
xor eax, dword [edx - 8]
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x42d500]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x42d700]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x42d900]
and eax, ecx
xor edi, dword [eax*4 + 0x42db00]
mov eax, dword [edx - 4]
xor eax, dword [ebp - 4]
xor esi, edi
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x42d600]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x42d800]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x42da00]
and eax, ecx
xor edi, dword [eax*4 + 0x42dc00]
xor esi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x42d500]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x42d700]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x42d900]
and eax, ecx
xor edi, dword [eax*4 + 0x42db00]
mov eax, dword [edx - 0xc]
xor dword [ebp - 4], edi
xor eax, esi
mov edi, eax
shr edi, 0x18
mov ebx, eax
and edi, ecx
mov edi, dword [edi*4 + 0x42d600]
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x42d800]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x42da00]
and eax, ecx
xor edi, dword [eax*4 + 0x42dc00]
mov eax, dword [ebp - 4]
xor eax, edi
dec dword [ebp - 8]
mov dword [ebp - 4], eax
jne 0x409301
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
leave
ret

Function at 0x4097a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x14], 0
push edi
mov edi, dword [ebp + 8]
movzx eax, byte [edi]
mov dword [ebp + 8], eax
movzx eax, byte [edi + 1]
mov dword [ebp - 4], eax
je 0x4097ed
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea ecx, [edi + 2]
dec dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
lea esi, [ebp + 8]
call fcn.00409768
mov edx, dword [ebp + 0x10]
xor al, byte [edx]
add esp, 4
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
jne 0x4097c8
pop esi
pop ebx
mov al, byte [ebp + 8]
mov byte [edi], al
mov al, byte [ebp - 4]
mov byte [edi + 1], al
pop edi
leave
ret

Function at 0x409861
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
or ebx, ecx
or ebx, edx
test bl, 3
push esi
jne 0x409882
shr edx, 2
je 0x409893
sub ecx, eax
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
dec edx
jne 0x409875
jmp 0x409893
test edx, edx
jbe 0x409893
sub ecx, eax
mov esi, edx
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x40988a
pop esi
pop ebx
ret
Function at 0x40e2b0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0xa54ff53a
mov dword [eax + 0x1c], 0x510e527f
mov dword [eax + 0x20], 0x9b05688c
mov dword [eax + 0x24], 0x1f83d9ab
mov dword [eax + 0x28], 0x5be0cd19
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
ret
Function at 0x41070b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x439164]
jne 0x410715
repz ret
jmp fcn.00418559
Function at 0x4107a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4107e3
cmp dword [ebp + 0x14], edi
je 0x4107e3
cmp ecx, edi
jne 0x4107ea
call fcn.00413220
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004131c1
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4107fe
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x41081f
cmp ebx, 0xffffffff
je 0x41080e
push ebx
push edi
push ecx
call fcn.00411990
add esp, 0xc
cmp esi, edi
je 0x4107cb
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4107cb
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x41083b
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x410842
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x410933
test word [esi + 0xc], 0x10c
je 0x410896
mov eax, dword [esi + 4]
test eax, eax
je 0x410896
jl 0x410994
cmp ebx, eax
mov edi, ebx
jb 0x410867
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x41093b
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00418d1b
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x41092b
cmp ebx, dword [ebp - 0xc]
jb 0x410903
cmp dword [ebp - 0xc], 0
je 0x4108c0
mov ecx, closesocket
xor edx, edx
cmp ebx, ecx
jbe 0x4108b5
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4108bc
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4108cb
mov eax, closesocket
cmp ebx, eax
ja 0x4108cb
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x410967
push eax
push dword [ebp - 8]
push esi
call fcn.0041308e
pop ecx
push eax
call fcn.00418c1e
add esp, 0xc
test eax, eax
je 0x4109a6
cmp eax, 0xffffffff
je 0x410994
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x41092b
push esi
call fcn.004162b2
cmp eax, 0xffffffff
pop ecx
je 0x410998
cmp dword [ebp - 4], 0
je 0x410967
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x41084a
mov eax, dword [ebp + 0x14]
jmp 0x4107e5
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x410952
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00411990
add esp, 0xc
call fcn.00413220
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4107db
cmp dword [ebp + 0xc], 0xffffffff
je 0x41097d
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00411990
add esp, 0xc
call fcn.00413220
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4107db
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4107e5
or dword [esi + 0xc], 0x10
jmp 0x410998
Function at 0x4155f6
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4394e0]
je 0x415611
inc edi
cmp edi, 0x17
jb 0x415602
cmp edi, 0x17
jae 0x415791
push ebp
push 3
call fcn.00419bf5
cmp eax, 1
pop ecx
je 0x41575d
push 3
call fcn.00419bf5
test eax, eax
pop ecx
jne 0x415645
cmp dword [0x439160], 1
je 0x41575d
cmp ebx, 0xfc
je 0x415790
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x43db88
push ebp
call fcn.0041a297
add esp, 0xc
test eax, eax
je 0x41567b
push esi
push esi
push esi
push esi
push esi
call fcn.004130c5
add esp, 0x14
push 0x104
mov esi, 0x43dba1
push esi
push 0
mov byte [0x43dca5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4156bf
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0041a297
add esp, 0xc
test eax, eax
je 0x4156bf
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004130c5
add esp, 0x14
push esi
call fcn.004172f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x415704
push esi
call fcn.004172f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x43de9c
push 0x430934
sub ecx, eax
push ecx
push eax
call fcn.0041d775
add esp, 0x14
test eax, eax
je 0x415704
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004130c5
add esp, 0x14
jmp 0x415706
xor esi, esi
push 0x430fa8
push ebx
push ebp
call fcn.0041a2fc
add esp, 0xc
test eax, eax
je 0x415726
push esi
push esi
push esi
push esi
push esi
call fcn.004130c5
add esp, 0x14
push dword [edi*8 + 0x4394e4]
push ebx
push ebp
call fcn.0041a2fc
add esp, 0xc
test eax, eax
je 0x415748
push esi
push esi
push esi
push esi
push esi
call fcn.004130c5
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0041d5b8
add esp, 0xc
jmp 0x415790
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x415790
cmp ebp, 0xffffffff
je 0x415790
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4394e4]
push dword [esi]
call fcn.004172f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x419679
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00415114
xor ebx, ebx
cmp dword [0x43e3fc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41974f
push 0x431170
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x41982f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x41982f
push eax
call fcn.004150a6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e3fc], eax
call esi
push eax
call fcn.004150a6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e400], eax
call esi
push eax
call fcn.004150a6
mov dword [0x43e404], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040f755
test eax, eax
pop ecx
pop ecx
je 0x41971d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004130c5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41974f
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.004150a6
cmp eax, ebx
pop ecx
mov dword [0x43e40c], eax
je 0x41974f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004150a6
pop ecx
mov dword [0x43e408], eax
mov eax, dword [0x43e408]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4197d4
cmp dword [0x43e40c], ecx
je 0x4197d4
push eax
call fcn.0041511d
push dword [0x43e40c]
mov esi, eax
call fcn.0041511d
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4197d4
cmp edi, ebx
je 0x4197d4
call esi
cmp eax, ebx
je 0x4197a1
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4197a1
test byte [ebp - 0x18], 1
jne 0x4197d4
lea eax, [ebp - 0x10]
push eax
call fcn.0040f78c
test eax, eax
pop ecx
je 0x4197bc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004130c5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4197cb
or dword [ebp + 0x10], 0x200000
jmp 0x41980f
or dword [ebp + 0x10], 0x40000
jmp 0x41980f
mov eax, dword [0x43e400]
cmp eax, dword [ebp - 8]
je 0x41980f
push eax
call fcn.0041511d
cmp eax, ebx
pop ecx
je 0x41980f
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41980f
mov eax, dword [0x43e404]
cmp eax, dword [ebp - 8]
je 0x41980f
push eax
call fcn.0041511d
cmp eax, ebx
pop ecx
je 0x41980f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e3fc]
call fcn.0041511d
cmp eax, ebx
pop ecx
je 0x41982f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x419831
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41d5b8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00415114
xor ebx, ebx
cmp dword [0x43e414], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41d68e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41d76e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4355c8
push edi
call esi
cmp eax, ebx
je 0x41d76e
push eax
call fcn.004150a6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e414], eax
call esi
push eax
call fcn.004150a6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e418], eax
call esi
push eax
call fcn.004150a6
mov dword [0x43e41c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040f755
test eax, eax
pop ecx
pop ecx
je 0x41d65c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004130c5
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41d68e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004150a6
cmp eax, ebx
pop ecx
mov dword [0x43e424], eax
je 0x41d68e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004150a6
pop ecx
mov dword [0x43e420], eax
mov eax, dword [0x43e420]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41d713
cmp dword [0x43e424], ecx
je 0x41d713
push eax
call fcn.0041511d
push dword [0x43e424]
mov esi, eax
call fcn.0041511d
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41d713
cmp edi, ebx
je 0x41d713
call esi
cmp eax, ebx
je 0x41d6e0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d6e0
test byte [ebp - 0x18], 1
jne 0x41d713
lea eax, [ebp - 0x10]
push eax
call fcn.0040f78c
test eax, eax
pop ecx
je 0x41d6fb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004130c5
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x41d70a
or dword [ebp + 0x10], 0x200000
jmp 0x41d74e
or dword [ebp + 0x10], 0x40000
jmp 0x41d74e
mov eax, dword [0x43e418]
cmp eax, dword [ebp - 8]
je 0x41d74e
push eax
call fcn.0041511d
cmp eax, ebx
pop ecx
je 0x41d74e
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41d74e
mov eax, dword [0x43e41c]
cmp eax, dword [ebp - 8]
je 0x41d74e
push eax
call fcn.0041511d
cmp eax, ebx
pop ecx
je 0x41d74e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e414]
call fcn.0041511d
cmp eax, ebx
pop ecx
je 0x41d76e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d770
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42507a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4250a7
call fcn.00413233
mov dword [eax], esi
call fcn.00413220
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004131c1
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x425083
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4250d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00413246
pop ecx
call fcn.00413220
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4250fd
test al, 1
je 0x4250fd
test byte [esp + 0xc], 2
je 0x4250fd
call fcn.00413233
mov dword [eax], 5
call fcn.00413220
mov dword [eax], 0xd
jmp 0x4250cd
xor eax, eax
pop esi
ret

Function at 0x425e30
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x200
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [esi + 0x10]
push eax
call fcn.0040f9d0
add esp, 0xc
cmp dword [ebp - 4], 0xffffffff
mov byte [esi + 0x20f], bl
je 0x425ec3
test byte [ebp - 4], 0x10
je 0x425e7a
xor eax, eax
inc eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi], eax
mov ebx, eax
jmp 0x425ec3
push ebx
push 0x80
push 4
push ebx
push ebx
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x425ec3
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x425eba
mov eax, dword [ebp - 0xc]
mov dword [esi], ebx
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [esi + 0xc], eax
inc ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
leave
ret

Function at 0x42618b
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x439164]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x404]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jle 0x426218
push ebx
xor ebx, ebx
cmp byte [ebp - 0x404], bl
push esi
lea esi, [ebp - 0x404]
je 0x426212
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4261f3
mov ecx, ebx
imul ecx, ecx, 0x58
lea edx, [ecx + 0x43e5b8]
mov edi, edx
mov eax, esi
sub edi, esi
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x4261e4
mov byte [edx + 0x50], 0xff
inc ebx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4261f8
sub eax, edx
cmp ebx, 0x32
lea esi, [esi + eax + 1]
jne 0x42620c
xor esi, esi
cmp byte [esi], 0
jne 0x4261c7
pop edi
pop esi
mov eax, ebx
pop ebx
jmp 0x42621b
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041070b
leave
ret