joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418d80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x968]
push esi
push eax
mov dword [ebp - 0x14], 0x70747448
mov dword [ebp - 0x10], 0x646e6553
mov dword [ebp - 0xc], 0x75716552
mov dword [ebp - 8], 0x41747365
mov byte [ebp - 4], 0
call fcn.004192a0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418de3
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418df0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x96c]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x64616552
mov dword [ebp - 8], 0x656c6946
mov byte [ebp - 4], 0
call fcn.004192a0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418e4f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x418e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x14]
push esi
lea ecx, [ebp - 0x14]
push ecx
push edx
lea esi, [eax + 0x970]
push esi
push eax
mov dword [ebp - 0x14], 0x65746e49
mov dword [ebp - 0x10], 0x74656e72
mov dword [ebp - 0xc], 0x736f6c43
mov dword [ebp - 8], 0x6e614865
mov dword [ebp - 4], 0x656c64
call fcn.004192a0
mov esi, dword [esi]
add esp, 0x10
test esi, esi
je 0x418eb6
mov eax, dword [ebp + 0xc]
push eax
call esi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4196a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x419706
cmp dword [esi + 0x18], 0
je 0x419721
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b050
add esp, 8
test eax, eax
jne 0x4196fe
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4196e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x419721
mov eax, dword [esi + 0x18]
test eax, eax
je 0x419721
cmp eax, ecx
je 0x4196fe
mov esi, dword [esi]
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x419714
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x419788
cmp dword [esi + 0x18], 0
je 0x419788
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b050
add esp, 8
test eax, eax
jne 0x419790
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419770
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4197a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
test edi, edi
je 0x4197f8
cmp dword [esi + 0x18], 0
je 0x4197f8
lea ecx, [ecx]
mov edx, dword [esi + 0x30]
push edi
push edx
call fcn.0041b050
add esp, 8
test eax, eax
jne 0x419800
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x4197e0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x30]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4198b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
je 0x4198f4
cmp dword [eax + 0x18], 0
je 0x4198f4
mov eax, dword [eax]
inc ecx
cmp ecx, edx
jb 0x4198e7
mov esp, ebp
pop ebp
ret

Function at 0x419900
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0041a150
add esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
cmp dword [esi + 0x18], 0
je 0x41998b
mov edi, dword [ebp + 8]
lea esp, [esp]
mov eax, dword [esi + 0x30]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.0041a770
lea edx, [ebp - 0x10c]
push edx
push edi
call fcn.00413e00
add esp, 0x10
test eax, eax
jne 0x419993
mov esi, dword [esi]
cmp dword [esi + 0x18], eax
jne 0x419960
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x18]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419e00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x419e0e
xor eax, eax
pop ebp
ret
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x419e0a
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x419e0a
mov edx, dword [ebp + 8]
push esi
mov dword [edx], eax
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [edx + 4], esi
mov ecx, dword [ecx + eax + 0x78]
add ecx, eax
mov dword [edx + 8], ecx
mov eax, 1
pop esi
pop ebp
ret

Function at 0x419e80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x419ea4
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x419ea4
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x419eac
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebp + 8]
push esi
inc edx
push edx
push eax
call fcn.0041a280
mov ecx, dword [ebx + 0x50]
mov esi, eax
push ecx
push esi
call fcn.0041a100
mov edx, dword [ebx + 0x54]
push edx
push edi
push esi
call fcn.0041a0d0
xor edx, edx
xor eax, eax
add esp, 0x1c
mov dword [ebp - 4], edx
cmp ax, word [ebx + 6]
jae 0x419f3e
mov dword [ebp + 0xc], edx
jmp 0x419ee9
xor edx, edx
mov ecx, dword [edi + 0x3c]
add ecx, dword [ebp + 0xc]
lea eax, [ecx + esi + 0xf8]
mov ecx, dword [eax + 0x10]
cmp ecx, edx
jne 0x419f00
mov dword [eax + 0x14], edx
mov edx, dword [eax + 8]
cmp ecx, edx
jbe 0x419f16
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add edx, edi
push edx
add eax, esi
push eax
jmp 0x419f23
mov edx, dword [eax + 0xc]
push ecx
mov ecx, dword [eax + 0x14]
add ecx, edi
push ecx
add edx, esi
push edx
call fcn.0041a0d0
mov eax, dword [ebp - 4]
movzx ecx, word [ebx + 6]
add dword [ebp + 0xc], 0x28
inc eax
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x419ee7
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x419f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x419f70
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x419f70
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
je 0x419f74
xor eax, eax
pop ebp
ret
mov eax, dword [eax + ecx + 0x2c]
add eax, ecx
pop ebp
ret

Function at 0x419ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x41a010
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41a010
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x41a014
xor eax, eax
pop ebp
ret
mov eax, dword [eax + edx + 0x28]
test eax, eax
je 0x41a010
add eax, dword [ebp + 0xc]
pop ebp
ret
Function at 0x41ad30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, 0x5d
jae 0x41af6c
push ebx
push edi
push 0x773
push eax
mov byte [ebp - 0x1c], al
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
lea eax, [ebp - 0x793]
mov cl, 0xe7
push eax
mov dword [ebp - 0x20], 0x6c6c642e
mov dword [ebp - 0x820], 0xbee14005
mov dword [ebp - 0x81c], 0xc8066c2a
mov dword [ebp - 0x818], 0xccdfc1a9
mov dword [ebp - 0x814], 0xe245063a
mov dword [ebp - 0x810], 0x3ad226d0
mov dword [ebp - 0x80c], 0x8450707
mov dword [ebp - 0x808], 0xe0c8cb23
mov dword [ebp - 0x804], 0x4337a708
mov dword [ebp - 0x800], 0x57e44962
mov dword [ebp - 0x7fc], 0xa6aa08e7
mov dword [ebp - 0x7f8], 0x6525dcb0
mov dword [ebp - 0x7f4], 0x7b08e760
mov dword [ebp - 0x7f0], 0x1eb386be
mov dword [ebp - 0x7ec], 0x8e7a01f
mov dword [ebp - 0x7e8], 0xefa2d823
mov dword [ebp - 0x7e4], 0xe7a01f26
mov dword [ebp - 0x7e0], 0xa8fc2209
mov dword [ebp - 0x7dc], 0x4f1cc7ee
mov dword [ebp - 0x7d8], 0xef094116
mov dword [ebp - 0x7d4], 0x8ca89392
mov dword [ebp - 0x7d0], 0x4157a323
mov dword [ebp - 0x7cc], 0x9f8f1d09
mov dword [ebp - 0x7c8], 0xa3269dc3
mov dword [ebp - 0x7c4], 0x74094157
mov dword [ebp - 0x7c0], 0x507d60c3
mov dword [ebp - 0x7bc], 0x41107c91
mov dword [ebp - 0x7b8], 0x6357590b
mov dword [ebp - 0x7b4], 0x1deab58a
mov dword [ebp - 0x7b0], 0xf708ac79
mov dword [ebp - 0x7ac], 0x73ade308
mov dword [ebp - 0x7a8], 0xa1651ec6
mov dword [ebp - 0x7a4], 0xca3d06e7
mov dword [ebp - 0x7a0], 0x3ad226c4
mov dword [ebp - 0x79c], 0xb2fc3308
mov dword [ebp - 0x798], 0x615506cf
mov byte [ebp - 0x794], cl
call fcn.0041a150
add esp, 0xc
lea eax, [ebp - 0x820]
test esi, esi
je 0x41aefc
dec esi
movzx ecx, byte [eax]
lea eax, [eax + ecx + 1]
jne 0x41aef2
lea esi, [eax + 1]
movzx eax, byte [eax]
lea edx, [ebp - 0x20]
push edx
push eax
push esi
call fcn.00409a50
xor eax, eax
add esp, 0xc
cmp byte [esi], al
je 0x41af1d
inc eax
cmp byte [esi + eax], 0
jne 0x41af16
mov ebx, dword [ebp + 8]
inc eax
push eax
push esi
push ebx
call fcn.0041a0d0
add esp, 0xc
xor edi, edi
cmp byte [ebx], 0
je 0x41af3a
inc edi
cmp byte [edi + ebx], 0
jne 0x41af33
xor esi, esi
cmp byte [ebp - 0x20], 0
je 0x41af4a
inc esi
cmp byte [ebp + esi - 0x20], 0
jne 0x41af42
test esi, esi
je 0x41af5f
push esi
lea ecx, [ebp - 0x20]
lea eax, [edi + ebx]
push ecx
push eax
call fcn.0041a120
add esp, 0xc
add esi, edi
pop edi
mov byte [esi + ebx], 0
mov eax, 1
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x407015
lea edi, [esi - 0x6015]
push edi
or ebp, 0xffffffff
jmp 0x408732
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x408739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x408728
mov eax, 1
add ebx, ebx
jne 0x40874b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x408740
jne 0x40875c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x408740
xor ecx, ecx
sub eax, 3
jb 0x408770
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4087e2
mov ebp, eax
add ebx, ebx
jne 0x40877b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x408788
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4087ac
inc ecx
add ebx, ebx
jne 0x408798
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40878d
jne 0x4087a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40878d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4087cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4087bd
jmp 0x40872e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4087cc
add edi, ecx
jmp 0x40872e
pop esi
mov edi, esi
mov ecx, 0x5a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4087ea
cmp byte [edi], 0
jne 0x4087ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4087ef
lea edi, [esi + 0x6000]
mov eax, dword [edi]
or eax, eax
je 0x40885e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x82c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x834c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40881c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8350]
or eax, eax
je 0x408858
mov dword [ebx], eax
add ebx, 4
jmp 0x408839
call dword [esi + 0x8360]
mov ebp, dword [esi + 0x8354]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x408892
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x100011a3
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push 0x200
push eax
call fcn.10001c1b
add esp, 0x10
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
leave
ret

Function at 0x100011d6
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x200]
push 0x200
push eax
call fcn.10004f15
add esp, 0x10
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret

Function at 0x10001376
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x858
push ebx
push esi
push edi
push 0x44
pop esi
xor ebx, ebx
push esi
lea eax, [ebp - 0x58]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.10001ad0
add esp, 0xc
call fcn.100012bc
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
inc edi
xor eax, eax
mov dword [ebp - 0x58], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x2c], edi
mov word [ebp - 0x28], ax
cmp dword [ebp + 8], ebx
je 0x100013e5
cmp esi, ebx
je 0x100013e5
push dword [ebp + 8]
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea esi, [ebp - 0x858]
call fcn.100012bc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 8]
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1000141d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateP_failed__0x_X_n
call fcn.100011d6
pop ecx
pop ecx
jmp 0x10001420
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100087b9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10015cd0]
jne 0x100087c3
repz ret
jmp fcn.1000c4e1

Function at 0x1000ba97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10015cd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000370d
and dword [ebp - 0x14], 0
cmp dword [0x10016a3c], 0
mov dword [ebp - 0x18], eax
jne 0x1000bb4a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1000bbf2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1000bbf2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10016a3c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10016a40], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10016a44], eax
call edi
push eax
call esi
mov dword [0x10016a4c], eax
test eax, eax
je 0x1000bb4a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10016a48], eax
mov eax, dword [0x10016a48]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1000bba3
cmp dword [0x10016a4c], ecx
je 0x1000bba3
push eax
call esi
push dword [0x10016a4c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1000bba3
test ebx, ebx
je 0x1000bba3
call edi
test eax, eax
je 0x1000bb9a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1000bb9a
test byte [ebp - 8], 1
jne 0x1000bba3
or dword [ebp + 0x10], 0x200000
jmp 0x1000bbd6
mov eax, dword [0x10016a40]
cmp eax, dword [ebp - 0x18]
je 0x1000bbd6
push eax
call esi
test eax, eax
je 0x1000bbd6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000bbd6
mov eax, dword [0x10016a44]
cmp eax, dword [ebp - 0x18]
je 0x1000bbd6
push eax
call esi
test eax, eax
je 0x1000bbd6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10016a3c]
call esi
test eax, eax
je 0x1000bbf2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1000bbf4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100087b9
leave
ret
Function at 0x401f80
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x201c
call fcn.0041e450
mov eax, dword [0x44e06c]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x201c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x200e]
push eax
movzx eax, word [ebp - 0x2010]
push eax
movzx eax, word [ebp - 0x2012]
push eax
movzx eax, word [ebp - 0x2014]
push eax
push str.__02d:_02d:_02d._03d_
lea eax, [ebp - 0x200c]
push 0x1000
push eax
call fcn.00401200
add esp, 0x1c
lea ecx, [ebp + 0xc]
mov edx, 0x1000
sub edx, eax
push ecx
push ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x200c]
lea ecx, [ecx + eax*2]
call fcn.004011d0
lea eax, [ebp - 0x200c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402006
sub eax, edx
sar eax, 1
je 0x40203b
cmp word [ebp + eax*2 - 0x200e], 0xa
je 0x40203b
push 0x449a50
lea eax, [ebp - 0x200c]
push 0x1000
push eax
call fcn.004251e0
add esp, 0xc
lea eax, [ebp - 0x200c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041d30f
mov esp, ebp
pop ebp
ret

Function at 0x4029e0
Capabilities:
64-bit execution via heavens gate

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
lea edx, [ebp + 0x14]
sub esp, 0x40
push ebx
push esi
push edi
test ecx, ecx
jle 0x402a08
mov eax, dword [ebp + 0x14]
lea edx, [ebp + 0x1c]
dec ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 0xc], eax
jmp 0x402a10
xorps xmm0, xmm0
movlpd qword [ebp - 0x10], xmm0
test ecx, ecx
jle 0x402a29
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x14], eax
jmp 0x402a31
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
test ecx, ecx
jle 0x402a4a
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x1c], eax
jmp 0x402a52
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
test ecx, ecx
jle 0x402a6b
dec ecx
add edx, 8
mov dword [ebp + 0x10], ecx
mov eax, dword [edx - 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx - 4]
mov dword [ebp - 0x24], eax
jmp 0x402a73
xorps xmm0, xmm0
movlpd qword [ebp - 0x28], xmm0
mov eax, edx
mov dword [ebp - 4], 0
cdq
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
movlpd qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 8], 0
mov word [ebp - 8], fs
mov eax, 0x2b
mov fs, ax
mov dword [ebp - 4], esp
and esp, 0xfffffff0
push 0x33
call fcn.00402ab4
Function at 0x42f1a5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042f01b
Function at 0x402e64
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x402ebd
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.KERNEL32.DLL_GetCommandLineA
lea edx, [ebp - 8]
call fcn.00402d00
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00402d00
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x402ea7
inc ebx
jmp 0x402e90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ec4
lea eax, [ebp - 8]
call fcn.004045d8
ret

Function at 0x402ecc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004045d8
test esi, esi
jne 0x402f03
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004046c8
jmp 0x402f24
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402d00
mov dword [esp], eax
test esi, esi
je 0x402f24
cmp dword [ebx], 0
je 0x402f24
dec esi
jmp 0x402f0b
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4031e4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x46d008], 0x8088405
inc edx
mov dword [ebx + 0x46d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40363c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x46d024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4036d4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4036b4
xor eax, eax
push ebp
push 0x4036ad
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4036f0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4036b4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x46d024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x46d024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4043d0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x47e048], 0
je 0x404431
cmp word [0x47e21c], 0xd7b2
jne 0x4043f9
cmp dword [0x47e224], 0
jbe 0x4043f9
mov eax, 0x47e218
call dword [0x47e234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x46d070
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404458
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle_1
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x46d034], 0
jne 0x40444d
push 0
push 0x46d068
push 0x46d070
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret