joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410c10
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x40
mov eax, dword [0x4dea20]
cmp eax, 2
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
sete byte [esp + 0xf]
jne 0x410c5b
movzx edx, bx
mov ecx, edx
and ecx, 0xffffff80
je 0x410c3d
mov eax, 0x30
mov word [esp + 0x2c], ax
test ecx, ecx
lea eax, [esp + 0x2c]
lea edi, [esp + 0x2e]
push 0xa
cmovne eax, edi
push eax
push edx
call fcn.0049956a
mov eax, dword [0x4dea20]
add esp, 0xc
test esi, esi
jle 0x410d0d
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebp
mov ebp, dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x410cc5
call edi
mov ecx, dword [0x4d98d8]
sub eax, dword [0x4de79c]
cmp eax, dword [ecx + 0xd8]
jbe 0x410cc5
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
call ebp
test eax, eax
je 0x410cbe
mov edx, 1
mov dword [0x4d98d0], 0
or ecx, 0xffffffff
call fcn.004015d0
mov dword [0x4d98d0], 1
call edi
mov dword [0x4de79c], eax
cmp byte [esp + 0x13], 0
je 0x410cd7
lea ecx, [esp + 0x30]
call fcn.00410d20
jmp 0x410ce2
mov dl, byte [esp + 0x54]
mov ecx, ebx
call fcn.0040f740
cmp dword [0x4dea20], 2
mov eax, dword [0x4d98d8]
jne 0x410cf5
mov ecx, dword [eax + 0x60]
jmp 0x410cf8
mov ecx, dword [eax + 0x5c]
call fcn.00412d20
sub esi, 1
je 0x410d0c
mov eax, dword [0x4dea20]
jmp 0x410c70
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x40
ret
Function at 0x412ee0
Capabilities:
Get graphical window text

Disassembly:
push edi
mov edi, dword [0x4dc438]
test edi, edi
je 0x412fea
mov ax, word [esp + 8]
push esi
imul esi, dword [0x4dc470], 0xd4
mov byte [esi + edi + 6], cl
mov byte [esi + edi], dl
mov word [esi + edi + 2], ax
mov eax, 0x69
mov word [esi + edi + 4], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
mov eax, dword [0x4dc438]
mov ecx, edx
mov dword [0x4dc46c], edx
sub ecx, dword [0x4de7fc]
mov dword [0x4de7fc], edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x4d4800]
imul ecx, dword [0x4dc470], 0xd4
cvtpd2ps xmm0, xmm0
divss xmm0, dword [0x4d4734]
movss dword [ecx + eax + 8], xmm0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4dc438]
test esi, esi
je 0x412fb5
cmp esi, dword [0x4dc468]
je 0x412fa0
imul edx, dword [0x4dc470], 0xd4
push 0x64
add edx, 0xc
add eax, edx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [0x4dc470]
jmp 0x412fd1
mov edx, dword [0x4dc470]
imul ecx, edx, 0xd4
xor edi, edi
mov word [ecx + eax + 0xc], di
jmp 0x412fd1
mov edx, dword [0x4dc470]
imul ecx, edx, 0xd4
mov dword [ecx + eax + 0xc], 0x2f004e
mov dword [ecx + eax + 0x10], 0x41
inc edx
mov dword [0x4dc468], esi
xor eax, eax
cmp edx, dword [0x4d98dc]
pop esi
cmovge edx, eax
mov dword [0x4dc470], edx
pop edi
ret

Function at 0x412ff0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push ebp
push esi
mov bl, cl
push edi
movzx ebp, bl
mov edi, edx
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
xor esi, 0xffffffff
and esi, 1
inc esi
cmp edi, 1
je 0x413020
cmp edi, 2
jne 0x4130f7
cmp esi, edi
je 0x4130f7
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x413053
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 1
call fcn.00411080
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 2
call fcn.00411080
add esp, 0x10
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4ddc88]
sete bh
jne 0x4130a8
mov edx, 1
mov dword [0x4d98d0], 0
or ecx, 0xffffffff
call fcn.004015d0
mov dword [0x4d98d0], 1
cmp bl, 0x14
jne 0x4130f7
cmp edi, 2
jne 0x4130f7
push ebp
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x4130f7
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov ecx, edi
call fcn.00411080
add esp, 0x10
test bh, bh
je 0x4130f7
lea edx, [edi - 1]
mov dword [0x4d98d0], 0
or ecx, 0xffffffff
call fcn.004015d0
mov dword [0x4d98d0], 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413820
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x4dc440], 0
je 0x413835
test cl, cl
jne 0x413835
mov al, byte [0x4dcdc5]
pop ecx
ret
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0xa0
call esi
mov bx, ax
shr bx, 0xb
push 0xa1
and bl, 0x10
call esi
mov cl, bl
mov edi, 0x8000
or cl, 0x20
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0xa2
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 1
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0xa3
cmove ebx, ecx
call esi
mov cl, bl
or cl, 2
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0xa4
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 4
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0xa5
cmove ebx, ecx
call esi
mov cl, bl
or cl, 8
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
push 0x5b
mov dword [esp + 0x10], edx
call esi
mov edx, dword [esp + 0xc]
mov cl, dl
or cl, 0x40
and ax, di
movzx ebx, cl
movzx ecx, dl
push 0x5c
cmove ebx, ecx
call esi
mov cl, bl
or cl, 0x80
and ax, di
movzx edx, cl
movzx ecx, bl
cmove edx, ecx
cmp dword [0x4dc440], 0
mov dword [esp + 0xc], edx
je 0x413972
mov cl, byte [0x4dcdc5]
mov bl, dl
not bl
and bl, cl
je 0x413972
mov dl, byte [0x4dcdc3]
mov al, bl
not al
and byte [0x4dcdc4], al
and cl, al
and dl, al
mov byte [0x4dcdc5], cl
mov ecx, 0x4dcdc8
mov byte [0x4dcdc3], dl
call fcn.00413980
mov ecx, dword [0x4dcee0]
mov edx, dword [esp + 0xc]
test ecx, ecx
je 0x413972
test byte [ecx + 8], bl
mov eax, 0
cmovne ecx, eax
mov dword [0x4dcee0], ecx
pop edi
pop esi
mov al, dl
pop ebx
pop ecx
ret
Function at 0x413d60
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x288
xor eax, eax
push ebp
push esi
mov ebp, ecx
nop dword [eax]
mov esi, dword [eax*8 + 0x4de9b0]
test esi, esi
je 0x413d85
cmp esi, ebp
je 0x413db1
inc eax
cmp eax, 0xa
jl 0x413d70
cmp eax, 0xa
mov ecx, 9
cmovl ecx, eax
mov dword [esp + 0xc], ecx
test edx, edx
je 0x413dd6
pop esi
mov dword [ecx*8 + 0x4de9b0], ebp
mov eax, edx
mov dword [ecx*8 + 0x4de9b4], edx
pop ebp
add esp, 0x288
ret
test edx, edx
je 0x413dc6
cmp dword [eax*8 + 0x4de9b4], 0
jne 0x413dc6
mov dword [eax*8 + 0x4de9b4], edx
mov eax, dword [eax*8 + 0x4de9b4]
pop esi
pop ebp
add esp, 0x288
ret
push ebx
xor ebx, ebx
push ebx
push ebp
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
mov dword [esp + 0xc], eax
test eax, eax
je 0x413ea9
push edi
mov ecx, 0x19
lea edi, [esp + 0x18]
mov esi, str.SYSTEMCurrentControlSetControlKeyboard_Layouts_
lea eax, [esp + 0x7c]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
pop edi
test eax, eax
je 0x413e41
push ebx
push ecx
lea eax, [esp + 0x94]
push eax
push str.Layout_File
lea edx, [esp + 0x24]
call fcn.0047def0
add esp, 0x10
test eax, eax
je 0x413e41
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
jmp 0x413e43
xor esi, esi
mov eax, dword [esp + 0xc]
cmp ebp, eax
je 0x413e54
push 0
push eax
call dword [sym.imp.USER32.dll_ActivateKeyboardLayout]
test esi, esi
je 0x413ea9
push str.KbdLayerDescriptor
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x413ea2
call eax
cmp dword [0x4de980], 0
mov ebx, eax
je 0x413e97
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x4de980]
test eax, eax
je 0x413e97
cmp dword [esp + 0xc], 0
je 0x413e97
mov ebx, dword [ebx + 0x50]
jmp 0x413e9a
mov ebx, dword [ebx + 0x28]
not ebx
and ebx, 1
add ebx, 3
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x10]
mov dword [eax*8 + 0x4de9b4], ebx
mov dword [eax*8 + 0x4de9b0], ebp
mov eax, ebx
pop ebx
pop esi
pop ebp
add esp, 0x288
ret
Function at 0x413ed0
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x118
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov bl, cl
xor edi, edi
cmp byte [edi*8 + 0x4d9954], bl
je 0x41404f
inc edi
cmp edi, 0x6d
jl 0x413ee0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
lea ecx, [ebx - 0x41]
mov esi, eax
cmp cl, 0x19
ja 0x413fdf
push pe_nt_image_headers32
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.004971b0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x14], eax
push esi
push eax
push 2
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 2
jne 0x413f49
movzx eax, word [esp + 0x18]
mov dword [esp + 0x14], eax
push esi
push 0
push 2
lea eax, [esp + 0x24]
movzx edi, bl
push eax
lea eax, [esp + 0x38]
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [esp + 0x24], eax
test eax, eax
jns 0x413f85
push esi
push 0
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0x6e
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov eax, dword [esp + 0x14]
test ax, ax
je 0x413fcd
push 1
push esi
lea edx, [esp + 0x1b]
mov ecx, eax
call fcn.00414270
mov bh, al
add esp, 8
test bh, bh
je 0x413fcd
mov dl, byte [esp + 0x13]
lea ecx, [esp + 0x28]
call fcn.00413980
push esi
push 0
push 2
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x38]
push eax
push 0
movzx eax, bh
push eax
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp dword [esp + 0x24], 0
je 0x413fdb
movzx eax, word [esp + 0x18]
jmp 0x413fef
xor eax, eax
jmp 0x413fef
push esi
push 2
movzx edi, bl
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
movzx eax, ax
mov word [ebp], ax
test ax, ax
je 0x41400b
pop edi
xor eax, eax
mov word [ebp + 2], ax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
cmp byte [esp + 0x130], 0
je 0x41403c
test bl, bl
je 0x41403c
push edi
push str.vk_02X
push dword [esp + 0x134]
push ebp
call fcn.0047c9c0
add esp, 0x10
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
pop edi
xor eax, eax
mov word [ebp], ax
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
mov esi, dword [esp + 0x12c]
dec esi
push esi
push dword [edi*8 + 0x4d9950]
push ebp
call fcn.004a1eb4
add esp, 0xc
xor eax, eax
mov word [ebp + esi*2], ax
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x414160
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
movzx eax, word [edi]
mov esi, eax
test ax, ax
je 0x414265
cmp word [edi + 2], 0
jne 0x41418e
push 1
push dword [esp + 0x1c]
mov ecx, eax
call fcn.00414270
add esp, 8
pop edi
pop esi
pop ecx
ret
test eax, 0xffffff80
je 0x414199
xor eax, eax
jmp 0x4141a4
push 2
push eax
call fcn.0049bd84
add esp, 8
mov ecx, esi
and ecx, 0xffdf
test eax, eax
movzx edx, cx
mov ecx, esi
cmove edx, ecx
cmp dx, 0x56
jne 0x41421a
movzx eax, word [edi + 2]
mov esi, eax
test eax, 0xffffff80
je 0x4141cd
xor eax, eax
jmp 0x4141d8
push 2
push eax
call fcn.0049bd84
add esp, 8
mov ecx, esi
and ecx, 0xffdf
test eax, eax
movzx edx, cx
mov ecx, esi
cmove edx, ecx
cmp dx, 0x4b
jne 0x41421a
push ebx
push 0x10
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 4]
push eax
call fcn.0049d195
mov ecx, dword [esp + 0x18]
add esp, 0xc
xor ebx, ebx
movzx edx, al
cmp word [ecx], bx
cmove ebx, edx
mov al, bl
pop ebx
pop edi
pop esi
pop ecx
ret
xor esi, esi
nop dword [eax]
push edi
push dword [esi*8 + 0x4d9950]
call fcn.00499643
add esp, 8
test eax, eax
je 0x41425a
inc esi
cmp esi, 0x6d
jl 0x414220
cmp byte [esp + 0x10], 0
jne 0x414265
mov ecx, edi
call fcn.00414080
movzx ecx, ax
test cx, cx
je 0x414265
pop edi
pop esi
add esp, 4
jmp fcn.00414b50
mov al, byte [esi*8 + 0x4d9954]
pop edi
pop esi
pop ecx
ret
pop edi
xor al, al
pop esi
pop ecx
ret

Function at 0x414270
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, ecx
push edi
mov edi, edx
cmp bx, 0xa
jne 0x414283
pop edi
mov al, 0xd
pop ebx
pop ecx
ret
push ebp
push dword [esp + 0x14]
push ebx
call dword [sym.imp.USER32.dll_VkKeyScanExW]
movzx eax, ax
mov edx, eax
mov dword [esp + 0xc], eax
shr edx, 8
cmp dl, 0xff
jne 0x4142f7
cmp al, 0xff
jne 0x4142f7
cmp byte [esp + 0x18], 0
je 0x414300
movzx ebp, bx
test ebp, 0xffffff80
jne 0x414300
push 0x103
push ebp
call fcn.0049bd84
add esp, 8
test eax, eax
je 0x414300
push esi
push 2
push ebp
call fcn.0049bd84
push 1
push ebp
mov esi, eax
call fcn.0049bd84
add esp, 0x10
test eax, eax
mov al, bl
setne dl
and al, 0xdf
movzx ecx, al
test esi, esi
movzx eax, bl
cmove ecx, eax
mov bl, cl
pop esi
jmp 0x4142fb
mov ebx, dword [esp + 0xc]
test dl, 0x38
je 0x414307
pop ebp
pop edi
xor al, al
pop ebx
pop ecx
ret
test edi, edi
je 0x414347
mov al, dl
and al, 6
cmp al, 6
jne 0x414318
or byte [edi], 8
jmp 0x414336
test dl, 2
je 0x414327
mov al, byte [edi]
test al, 3
jne 0x414327
or al, 1
mov byte [edi], al
test dl, 4
je 0x414336
mov al, byte [edi]
test al, 0xc
jne 0x414336
or al, 4
mov byte [edi], al
test dl, 1
je 0x414347
mov cl, byte [edi]
test cl, 0x30
jne 0x414347
or cl, 0x10
mov byte [edi], cl
pop ebp
pop edi
mov al, bl
pop ebx
pop ecx
ret
Function at 0x414b50
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, ecx
movzx edx, bx
mov eax, edx
cmp edx, 0x11c
ja 0x414bc8
je 0x414bc4
sub eax, 0x1d
cmp eax, 0x36
ja case.0x414bd9.286
movzx eax, byte [eax + 0x414c7c]
jmp dword [eax*4 + 0x414c30]
mov al, 0xa0
pop ebx
ret
mov al, 0xa2
pop ebx
ret
mov al, 0xa4
pop ebx
ret
mov al, 0x6a
pop ebx
ret
mov al, 0x6d
pop ebx
ret
mov al, 0x6b
pop ebx
ret
mov al, 0x2e
pop ebx
ret
mov al, 0xc
pop ebx
ret
mov al, 0x2d
pop ebx
ret
mov al, 0x26
pop ebx
ret
mov al, 0x28
pop ebx
ret
mov al, 0x25
pop ebx
ret
mov al, 0x27
pop ebx
ret
mov al, 0x24
pop ebx
ret
mov al, 0x23
pop ebx
ret
mov al, 0x21
pop ebx
ret
mov al, 0x22
pop ebx
ret
mov al, 0x13
pop ebx
ret
mov al, 0xd
pop ebx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x414bd9.286
movzx eax, byte [eax + 0x414cdc]
jmp dword [eax*4 + 0x414cb4]
mov al, 0xa1
pop ebx
ret
mov al, 0xa3
pop ebx
ret
mov al, 0xa5
pop ebx
ret
mov al, 0x5b
pop ebx
ret
mov al, 0x5c
pop ebx
ret
mov al, 0x90
pop ebx
ret
mov al, 0x6f
pop ebx
ret
mov al, 0x5d
pop ebx
ret
mov al, 0x2c
pop ebx
ret
test ebx, 0x100
je 0x414c21
movzx eax, dl
push 1
or eax, 0xe000
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x414c2d
push 1
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
pop ebx
ret

Function at 0x414d20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x4dea30], ecx
mov eax, 1
nop dword [eax + eax]
mov ecx, dword [eax*4 + 0x4dea2c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul ecx, edx, 0x6c078965
add ecx, eax
mov dword [eax*4 + 0x4dea30], ecx
inc eax
cmp eax, 0x270
jl 0x414d30
mov dword [0x4db010], 1
mov dword [0x4dea2c], 1
ret

Function at 0x414d70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4dea2c], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x4dea30
jne 0x414d8f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.00414d20
mov eax, dword [0x4dea30]
mov ebx, 0xe3
mov dword [0x4db010], 0x270
mov dword [0x4df3f0], 0x4dea30
nop dword [eax]
mov edi, dword [esi + 4]
mov ecx, edi
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edi
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edi
xor ecx, dword [esi + 0x634]
mov dword [esi], ecx
add esi, 4
sub ebx, 1
jne 0x414db0
mov ebp, 0x18c
nop word [eax + eax]
mov ebx, dword [esi + 4]
lea esi, [esi + 4]
mov ecx, ebx
mov eax, ebx
xor ecx, edi
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, edi
mov edi, ebx
shr ecx, 1
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x390]
mov dword [esi - 4], ecx
sub ebp, 1
jne 0x414df0
mov eax, dword [0x4dea30]
mov ecx, ebx
xor ecx, eax
and al, 1
and ecx, 0x7ffffffe
movzx eax, al
xor ecx, ebx
shr ecx, 1
neg eax
pop edi
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
xor ecx, dword [esi - 0x38c]
mov dword [esi], ecx
pop esi
pop ebp
pop ebx
ret
Function at 0x414e60
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4db010], 1
jne 0x414e6e
call fcn.00414d70
mov eax, dword [0x4df3f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4df3f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret

Function at 0x414eb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub dword [0x4db010], 1
jne 0x414ebe
call fcn.00414d70
mov eax, dword [0x4df3f0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4df3f0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4d4800]
mulsd xmm0, qword [0x4d4670]
ret

Function at 0x4157f0
Capabilities:
Write clipboard data

Disassembly:
cmp byte [ecx + 0x17], 0
jne 0x4157f9
mov ecx, dword [ecx + 0xc]
cmp byte [ecx + 0x17], 2
jne 0x415812
cmp dword [0x4de7ec], 0
je 0x415812
mov ecx, 0x4de7e0
jmp fcn.00405590
mov al, byte [ecx + 0x15]
and al, 0x86
cmp byte [esp + 4], 0
mov byte [ecx + 0x15], al
je 0x415826
or al, 1
mov byte [ecx + 0x15], al
mov eax, 1
ret 4
Function at 0x4177e0
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
cmp byte [0x4df413], 0
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0xa9c], eax
jne 0x41797f
cmp byte [esi + 0xae0], 0
je 0x41797f
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x4dc408]
push 0
push 1
mov dword [0x4dfc80], eax
call fcn.004014c0
push 0x7f
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004a1eb4
inc dword [0x4dc40c]
xor eax, eax
mov word [esp + 0x13a], ax
add esp, 0xc
mov eax, dword [0x4d98d8]
mov ecx, 0x42
add eax, 0x108
mov esi, 0x4dc2f0
mov edi, eax
mov dword [0x4d98d8], eax
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x4ddca0
mov dword [eax + 0x2c], 0
call fcn.004174d0
cmp dword [0x4dc420], 0
xorps xmm0, xmm0
movlpd qword [0x4de788], xmm0
je 0x4178af
mov eax, dword [0x4db004]
mov ecx, 0x4b70dc
test eax, eax
je 0x4178a8
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov esi, dword [esp + 0xc]
mov bl, 1
mov edi, dword [0x4d98d0]
mov dword [0x4d98d0], 0
mov byte [0x4df413], 1
mov ecx, dword [esi + 0xa90]
mov byte [0x4db2dc], 0
test ecx, ecx
je 0x4178f4
call fcn.00401580
test eax, eax
je 0x4178f4
xor eax, eax
movzx ebx, bl
cmp byte [0x4db2dc], al
cmove ebx, eax
mov byte [0x4db2dc], 1
test bl, bl
je 0x41794f
mov dword [esp + 0x18], 0
call fcn.00446b40
mov dword [esp + 0x10], eax
lea ecx, [esi + 0xa5c]
mov eax, dword [0x4dfc80]
cdq
mov dword [esp + 0x20], eax
xor eax, eax
cmp dword [esi + 0xa90], eax
mov dword [esp + 0x28], 1
sete al
mov dword [esp + 0x24], edx
push eax
push 2
lea eax, [esp + 0x18]
push eax
call fcn.00477530
xor edx, edx
movzx ebx, bl
cmp eax, 3
cmove ebx, edx
mov eax, dword [ebp + 8]
mov byte [0x4df413], 0
test bl, bl
jne 0x4179bb
cmp eax, 2
je 0x4179bb
lea ecx, [esp + 0x30]
call fcn.00404810
mov dword [0x4d98d0], edi
mov eax, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [0x4db2dc], 0
jne 0x4179bb
cmp eax, 7
jne 0x4179bb
mov eax, dword [0x4ddc08]
mov ecx, dword [0x4dfc80]
pop edi
pop esi
cmp word [eax], 0
mov eax, 8
mov byte [0x4db2dc], 1
cmovne ecx, dword [ebp + 0xc]
mov dword [0x4dfc80], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
push dword [ebp + 0xc]
mov ecx, esi
push eax
call fcn.004179d0
int3
Function at 0x41dd10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x40]
mov eax, 0x20
mov word [esp + 0xc], ax
mov ebx, ebp
mov ax, word [0x4daadc]
mov word [esp + 0xe], ax
mov dword [esp + 0x10], 0x90028
mov dword [esp + 0x14], 0x3e003c
mov dword [esp + 0x18], 0x3d003a
mov dword [esp + 0x1c], 0x2d002b
mov dword [esp + 0x20], 0x2f002a
mov dword [esp + 0x24], 0x7e0021
mov dword [esp + 0x28], 0x7c0026
mov dword [esp + 0x2c], 0x5b005e
mov dword [esp + 0x30], 0x3f002e
mov dword [esp + 0x34], 0x7b
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
push edi
test ebp, ebp
je 0x41ddd5
movzx eax, word [ebp]
test ax, ax
je 0x41ddeb
mov esi, eax
nop word [eax + eax]
lea eax, [esp + 0x14]
mov edx, 0x20
nop dword [eax]
cmp si, dx
je 0x41dde5
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x41ddb0
movzx eax, word [ebx + 2]
add ebx, 2
mov esi, eax
test ax, ax
jne 0x41dda0
mov esi, dword [esp + 0x10]
xor ebx, ebx
test ebx, ebx
je 0x41ddeb
cmp ebx, ebp
lea edi, [ebx - 2]
cmovbe edi, ebx
jmp 0x41de05
mov esi, dword [esp + 0x10]
jmp 0x41ddd7
mov ecx, ebp
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ddf0
sub ecx, edx
lea edi, [ebp - 2]
sar ecx, 1
lea edi, [edi + ecx*2]
cmp edi, ebp
jbe 0x41de24
nop dword [eax]
movzx eax, word [edi]
cmp eax, 0x20
je 0x41de1d
cmp eax, 9
jne 0x41de24
sub edi, 2
cmp edi, ebp
ja 0x41de10
mov ebx, edi
sub ebx, ebp
sar ebx, 1
inc ebx
cmp ebx, 0xfd
jbe 0x41de53
cmp byte [esp + 0x4c], 0
je 0x41de47
push ebp
push str.This_line_does_not_contain_a_recognized_action.
mov ecx, esi
call fcn.004302e0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc
mov esi, dword [esp + 0x44]
push ebx
push ebp
push esi
call fcn.004a1eb4
add esp, 0xc
xor eax, eax
mov word [esi + ebx*2], ax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc
Function at 0x42fbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
lea eax, [esp + 0x2c]
mov dword [esp + 0x34], 0
mov dword [esp + 4], eax
mov edx, ecx
lea eax, [esp + 0x3c]
mov dword [esp + 0x2c], str.What
mov dword [esp + 8], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x24], eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x44], 0
push esi
mov esi, 8
test eax, eax
jne 0x42fc60
movzx ecx, byte [edx]
lea eax, [ecx*8]
sub eax, ecx
mov eax, dword [eax*2 + 0x4d9d80]
mov dword [esp + 0x40], eax
movzx eax, word [edx + 2]
mov dword [esp + 0x58], 0
mov dword [esp + 0x50], 0x4cf3d0
mov dword [esp + 0x68], 0
mov eax, dword [eax*4 + 0x4ddc04]
mov dword [esp + 0x60], eax
mov eax, dword [edx + 4]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x78], 0
mov dword [esp + 0x70], str.Line
mov dword [esp + 0x88], 1
mov dword [esp + 0x84], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x90], str.Message
mov dword [esp + 0xa8], 0
test eax, eax
je 0x42fd28
cmp word [eax], 0
je 0x42fd28
mov esi, 0xa
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb0], str.Extra
mov dword [esp + 0xc8], 0
mov dword [esp + 0xc0], eax
mov edx, esi
lea ecx, [esp + 8]
call fcn.00473f50
pop esi
add esp, 0xcc
ret 0xc