joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ea5
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x320]
push dword [ebp + 8]
push eax
call fcn.0043ee44
lea eax, [ebp - 0x320]
push 0x5c
push eax
call fcn.0043d2a0
add esp, 0x14
jmp 0x417efa
inc esi
cmp byte [esi], 0x5c
jne 0x417ef0
push esi
call fcn.0043f520
inc eax
push eax
lea eax, [esi - 1]
push esi
push eax
call fcn.0043f120
add esp, 0x10
push 0x5c
push esi
call fcn.0043d2a0
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x417ed5
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.0043f7c0
lea eax, [ebp - 0x190]
push 0x3f
push eax
call fcn.0043d2a0
add esp, 0x10
test eax, eax
je 0x417f2b
mov byte [eax], 0
lea eax, [ebp - 0x190]
push 0x2a
push eax
call fcn.0043d2a0
pop ecx
pop ecx
test eax, eax
je 0x417f42
mov byte [eax], 0
lea eax, [ebp - 0x190]
push 0x5c
push eax
call fcn.0043d360
pop ecx
pop ecx
test eax, eax
je 0x417ffb
lea ecx, [ebp - 0x190]
cmp eax, ecx
je 0x417ffb
cmp byte [eax - 1], 0x3a
jne 0x417f7e
movsx eax, byte [eax - 2]
push eax
call fcn.004406b0
pop ecx
cmp eax, 0x42
jg 0x417ffb
mov esi, dword [ebp + 0x10]
push esi
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, dword [ebp + 0x14]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x417fe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4c9b8c], eax
cmp eax, 3
jg 0x417faf
xor eax, eax
pop edi
pop esi
leave
ret
lea ecx, [ebp - 0x320]
push ecx
push eax
lea eax, [ebp - 0x190]
push str.Error__d_Searching_for___s_
push eax
call fcn.0043ee44
lea eax, [ebp - 0x190]
push eax
call fcn.004017a0
add esp, 0x14
jmp 0x417fa9
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x417ff1
cmp byte [esi + 0x2c], 0x2e
je 0x417fd9
xor eax, eax
inc eax
jmp 0x417fab
push dword [edi]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x417fa9
lea eax, [ebp - 0x320]
push eax
push str.Tried_to_Search_a_Fixed_Disks_Root:___s_
mov esi, 0x4c7050
push esi
call fcn.0043ee44
add esp, 0xc
push esi
call fcn.00415b7b
int3

Function at 0x4181b5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041801c
mov eax, dword [0x48bb40]
cmp esi, dword [eax*4 + 0x4c3658]
pop esi
jne 0x4181e7
push 0
push 0
push 4
call fcn.00401adf
add esp, 0xc
pop ebp
ret
Function at 0x418263
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
push ebx
push esi
push edi
push dword [0x4cdd88]
mov edi, dword [sym.imp.USER32.dll_SetCursor]
call edi
call fcn.0041801c
push dword [0x4e33c0]
call fcn.004181b5
pop ecx
call fcn.0041801c
lea eax, [ebp - 0x190]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor ebx, ebx
lea eax, [ebp - 0x190]
push ebx
push eax
call fcn.0043d2a0
pop ecx
pop ecx
cmp eax, ebx
je 0x4182c0
cmp byte [eax - 1], 0x5c
jne 0x4182c0
mov byte [eax - 1], bl
lea eax, [ebp - 0x190]
push 0x452468
push eax
call fcn.0043f7d0
pop ecx
pop ecx
xor esi, esi
mov eax, str.EXE_
cmp esi, ebx
jne 0x4182e3
mov eax, 0x4522b3
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x320]
push 0x452474
push eax
call fcn.0043ee44
add esp, 0x14
push 0x4e42ac
push 0x4e4268
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x320]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [0x4c9b8c], eax
cmp eax, ebx
jne 0x41836c
inc esi
cmp esi, 2
jl 0x4182d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
mov eax, str.Executable_Not_Found
ja 0x418344
mov eax, str.File_is_NOT_an_Executable
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x4b0]
push str.Launch:___s__Failed:__s
push eax
call fcn.0043ee44
lea eax, [ebp - 0x4b0]
push eax
call fcn.004017a0
add esp, 0x14
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [0x4e42ac]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [0x4e42ac]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x4e42b0]
call esi
push dword [0x4e33c0]
call fcn.004011d2
pop ecx
push dword [0x4815d4]
call edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4187df
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ax, word [0x4c3cb8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov word [0x4b5c40], ax
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [0x46a2a8], eax
mov word [0x4c3cb8], bx
mov eax, 0x4525e0
cmp dword [0x48e098], edi
jne 0x418817
mov eax, 0x4525e4
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00418660
mov esi, dword [0x4c3654]
add esp, 0xc
cmp esi, edi
jne 0x418852
cmp dword [0x48e098], edi
jne 0x418840
cmp dword [0x4b389c], edi
je 0x418852
push ebx
push edi
push dword [ebp + 0x14]
call fcn.0043ecf0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
fldz
fcomp dword [ebp + 0x10]
fnstsw ax
test ah, 0x41
jne 0x41886d
movzx eax, word [0x4b5c40]
add dword [0x4a29b8], eax
jmp 0x418880
fld dword [ebp + 0x10]
fmul qword [0x45d248]
call fcn.0043f5e6
mov dword [0x4a29b8], eax
push edi
push dword [0x4a29b8]
push esi
call fcn.004404fd
push 0x4525e8
push dword [ebp + 0xc]
call fcn.00450634
add esp, 0x14
push dword [0x4c3654]
push ebx
push 1
push dword [ebp + 0x14]
test eax, eax
jne 0x4188dc
call fcn.0043e562
add esp, 0x10
mov dword [0x4c9b8c], eax
cmp eax, edi
jle 0x4188d2
push dword [0x4c3654]
call fcn.0043e5ec
pop ecx
test eax, eax
je 0x41884d
push str.Read_at
call fcn.00418627
call fcn.0043ffdf
add esp, 0x10
mov dword [0x4c9b8c], eax
cmp eax, edi
jle 0x418901
push dword [0x4c3654]
call fcn.0043e5ec
pop ecx
test eax, eax
je 0x41884d
push str.Write_at
jmp 0x4188d7
Function at 0x423e6e
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4b3838], 0
mov eax, str.Copying_Community___From___Diskette
jne 0x423e87
mov eax, str.Copying_Community___To___Diskette
push esi
push edi
push eax
call fcn.00418050
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
pop ecx
test eax, eax
jle 0x423ed6
xor esi, esi
inc esi
mov edi, eax
push esi
lea eax, [ebp - 0x10]
push str.BK0_d
push eax
call fcn.0043ee44
lea eax, [ebp - 0x10]
push eax
call fcn.00423d6a
push esi
lea eax, [ebp - 0x10]
push str.LN0_d
push eax
call fcn.0043ee44
lea eax, [ebp - 0x10]
push eax
call fcn.00423d6a
add esp, 0x20
inc esi
dec edi
jne 0x423e9f
push 0x45775c
call fcn.00423d6a
mov dword [esp], 0x457760
call fcn.00423d6a
mov eax, dword [0x4b3838]
pop ecx
test eax, eax
je 0x423efb
mov dword [0x48e094], eax
push 0x457764
push 0x457768
push 0x45776c
call fcn.00418660
push dword [0x4c3654]
call fcn.00445ee4
push eax
call fcn.00451000
mov edi, eax
push edi
call fcn.0043f481
push dword [0x4c3654]
mov esi, eax
push edi
push 1
push esi
call fcn.0043e562
push dword [0x4c3654]
mov edi, eax
call fcn.0043e5ec
mov eax, dword [0x4a2b7c]
and dword [0x48e094], 0
add esp, 0x2c
test eax, eax
je 0x423f5e
mov dword [0x48e094], eax
push 0x457770
push 0x457774
push 0x457778
call fcn.00418660
push dword [0x4c3654]
push edi
push 1
push esi
call fcn.0043ffdf
push dword [0x4c3654]
call fcn.0043e5ec
and dword [0x48e094], 0
push esi
call fcn.0043f0db
add esp, 0x24
call fcn.00401a33
pop edi
pop esi
leave
ret
Function at 0x424a68
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x4cc544]
push ebx
push esi
add eax, 0xc8
push edi
push eax
call fcn.0043f481
pop ecx
mov ebx, eax
push ebx
sub esp, 0x194
push 0x65
pop ecx
mov esi, 0x4a32c0
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00410080
add esp, 0x198
push eax
sub esp, 0x194
push 0x65
pop ecx
mov esi, 0x4813d8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00410080
add esp, 0x198
push eax
sub esp, 0x194
push 0x65
pop ecx
mov esi, 0x46a0c8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00410080
mov esi, eax
mov al, byte [0x4cdd8c]
add al, 0x30
mov byte [esi], al
push 0x457a40
inc esi
push 0x457a44
mov byte [esi], 0xa
call fcn.0043ea47
add esp, 0x1a0
mov dword [0x4c3654], eax
test eax, eax
jne 0x424b09
push str.Cant_write_BMSim.TXT.
call fcn.00415b7b
push eax
sub esi, ebx
inc esi
push esi
push 1
push ebx
call fcn.0043ffdf
push dword [0x4c3654]
call fcn.0043e5ec
push ebx
call fcn.0043f0db
add esp, 0x18
pop edi
pop esi
pop ebx
ret

Function at 0x425740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0x457dbc
push 0x457dc0
push 0x457dc4
call fcn.00418660
push dword [0x4c3654]
call fcn.00445ee4
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.0043d91a
mov eax, dword [ebp - 0x34]
mov esi, dword [0x46606c]
cdq
idiv esi
mov ebx, eax
lea eax, [ebx + 1]
imul eax, esi
push eax
call fcn.0043f481
push dword [0x4c3654]
mov edi, eax
push ebx
push esi
push edi
call fcn.0043e562
push dword [0x4c3654]
mov dword [0x4c9b8c], eax
call fcn.0043e5ec
mov eax, dword [section..data]
imul eax, eax, 0x330
push 0x40
add eax, 0x48bb48
push 0
push eax
call fcn.0043ecf0
xor eax, eax
add esp, 0x3c
lea esi, [edi - 0x48]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp ebx, eax
jle 0x42583d
add esi, 0x48
fld dword [esi]
mov dword [ebp - 0xc], esi
fsub qword [0x45ceb8]
call fcn.0043f5e6
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
je 0x425835
jb 0x425824
cmp eax, 0x10
jae 0x425824
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
call fcn.004100d1
add esp, 0x18
jmp 0x425835
push dword [0x46606c]
push 0
push esi
call fcn.0043ecf0
add esp, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x4257e1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
call fcn.004100d1
push edi
call fcn.0043f0db
add esp, 0x1c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x425867
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [section..data]
imul esi, esi, 0x330
push edi
push 0x457dcc
push 0x457dd0
push 0x457dd4
add esi, 0x48bb48
call fcn.00418660
add esp, 0xc
and dword [ebp - 4], 0
mov ecx, dword [section..data]
mov eax, dword [ebp - 4]
fld dword [esi + eax*4]
and dword [ebp - 8], 0
shl ecx, 4
add ecx, eax
mov edi, dword [ecx*4 + 0x4ded90]
lea ebx, [edi - 0x48]
call fcn.0043f5b0
test eax, eax
jle 0x4258f7
mov dword [ebp - 0xc], eax
add ebx, 0x48
fld dword [ebx]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4258f2
push dword [0x4c3654]
inc dword [ebp - 8]
push 1
push dword [0x46606c]
push ebx
call fcn.0043ffdf
add esp, 0x10
dec dword [ebp - 0xc]
jne 0x4258c8
fild dword [ebp - 8]
mov eax, dword [ebp - 4]
fstp dword [esi + eax*4]
test edi, edi
je 0x42590b
push edi
call fcn.0043f0db
pop ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jl 0x42589d
push dword [0x4c3654]
call fcn.0043e5ec
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43a0e5
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00439e55
pop ecx
cmp eax, 1
jne 0x43a348
push ebx
push esi
xor ebx, ebx
push edi
mov byte [0x4c7050], bl
mov esi, 0x4c7050
mov edi, 0x48e09c
cmp dword [0x47cf74], ebx
je 0x43a140
cmp dword [0x4b7228], ebx
je 0x43a140
mov ecx, dword [0x4a2b7c]
cmp ecx, ebx
jne 0x43a136
mov eax, dword [0x4b3838]
cmp eax, ebx
je 0x43a269
push str.Invalid_command_line.
jmp 0x43a33f
mov ecx, dword [0x4a2b7c]
cmp ecx, ebx
je 0x43a1a9
push ecx
push str._c:HELLO.TXT
push esi
call fcn.0043ee44
push 0x459190
push esi
call fcn.0043ea47
add esp, 0x14
mov dword [0x4c3654], eax
cmp eax, ebx
jne 0x43a177
push str.Cant_write_to_Diskette
jmp 0x43a33f
push eax
call fcn.0043e5ec
mov eax, dword [0x4e33b8]
push edi
push dword [0x4a2b7c]
add eax, 0xfffff830
push eax
mov eax, dword [0x4815e8]
inc eax
push eax
push str.Save_Q_d__02d_decisions_to__c:___In_Community___s__
push esi
call fcn.0043ee44
add esp, 0x1c
jmp 0x43a247
mov eax, dword [0x4b3838]
cmp eax, ebx
je 0x43a269
push edi
push eax
push str._c:_sqtr.txt
push esi
call fcn.0043ee44
push 0x4591f0
push esi
call fcn.0043ea47
add esp, 0x18
mov dword [0x4c3654], eax
cmp eax, ebx
jne 0x43a1e4
push str.Cant_find_the_Community_on_the_Diskette
jmp 0x43a33f
push eax
push 0x50
push 1
push esi
call fcn.0043e562
movzx eax, ax
push 4
add eax, esi
push ebx
push eax
call fcn.0043ecf0
push dword [0x4c3654]
call fcn.0043e5ec
push esi
call fcn.00418908
push eax
call fcn.0044058f
mov ecx, eax
cdq
and edx, 3
add eax, edx
push edi
push dword [0x4b3838]
sar eax, 2
add eax, 0x14
and ecx, 0x80000003
push eax
jns 0x43a237
dec ecx
or ecx, 0xfffffffc
inc ecx
inc ecx
push ecx
push str.Restore_Q_d__02d_decisions_from__c:___In_Community___s__
push esi
call fcn.0043ee44
add esp, 0x40
cmp byte [0x4c7050], bl
je 0x43a25e
push esi
call fcn.004020e3
pop ecx
test eax, eax
je 0x43a345
mov ecx, dword [0x4a2b7c]
mov eax, dword [0x4b3838]
cmp byte [0x46a28b], bl
jne 0x43a27d
cmp eax, ebx
jne 0x43a27d
cmp ecx, ebx
je 0x43a31d
mov edx, dword [0x466004]
shl edx, 8
add edx, 0x48e0a8
cmp eax, ebx
je 0x43a2b3
push edx
call fcn.00423e6e
push ebx
call fcn.00424713
push dword [0x4b3838]
push edi
push str.Community___s___Has_Been_Restored_From_Drive__c:
push esi
call fcn.0043ee44
add esp, 0x18
jmp 0x43a312
cmp ecx, ebx
je 0x43a2cb
push edx
call fcn.00423e6e
push dword [0x4a2b7c]
push edi
push str.Community___s___Has_Been_Backed_Up_To_Drive__c:
jmp 0x43a309
call fcn.0042421e
test eax, eax
jne 0x43a2e3
push str.No_Community_Created
push esi
call fcn.0043ee44
pop ecx
pop ecx
jmp 0x43a312
cmp dword [0x4b7228], ebx
je 0x43a2f4
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00425ce3
push 1
call fcn.00424713
movsx eax, byte [0x46a28b]
push eax
push edi
push str.Community___s__has_been_created.___From___c__
push esi
call fcn.0043ee44
add esp, 0x14
cmp dword [0x4b7228], ebx
jne 0x43a31d
push esi
jmp 0x43a33f
cmp byte [0x48e09c], bl
je 0x43a332
cmp dword [0x4b7228], ebx
jne 0x43a2eb
call fcn.00428076
cmp dword [0x4b7228], ebx
jne 0x43a2eb
push str.Invalid_Command_Line
call fcn.004017a0
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44568e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x468ec0]
jne 0x445698
repz ret
jmp fcn.0044d6f0

Function at 0x44da1a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x468ec0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00446830
and dword [ebp - 0x14], 0
cmp dword [0x4e8fec], 0
mov dword [ebp - 0x18], eax
jne 0x44dacd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44db75
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x44db75
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4e8fec], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4e8ff0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4e8ff4], eax
call edi
push eax
call esi
mov dword [0x4e8ffc], eax
test eax, eax
je 0x44dacd
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4e8ff8], eax
mov eax, dword [0x4e8ff8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44db26
cmp dword [0x4e8ffc], ecx
je 0x44db26
push eax
call esi
push dword [0x4e8ffc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44db26
test ebx, ebx
je 0x44db26
call edi
test eax, eax
je 0x44db1d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x44db1d
test byte [ebp - 8], 1
jne 0x44db26
or dword [ebp + 0x10], 0x200000
jmp 0x44db59
mov eax, dword [0x4e8ff0]
cmp eax, dword [ebp - 0x18]
je 0x44db59
push eax
call esi
test eax, eax
je 0x44db59
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44db59
mov eax, dword [0x4e8ff4]
cmp eax, dword [ebp - 0x18]
je 0x44db59
push eax
call esi
test eax, eax
je 0x44db59
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4e8fec]
call esi
test eax, eax
je 0x44db75
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44db77
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044568e
leave
ret
Function at 0x401a50
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44014c]
jne 0x401a5a
repz ret
jmp fcn.0040285c

Function at 0x4078dc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44014c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405ad2
and dword [ebp - 0x14], 0
cmp dword [0x442e60], 0
mov dword [ebp - 0x18], eax
jne 0x40798f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407a37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407a37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x442e60], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x442e64], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x442e68], eax
call edi
push eax
call esi
mov dword [0x442e70], eax
test eax, eax
je 0x40798f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x442e6c], eax
mov eax, dword [0x442e6c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4079e8
cmp dword [0x442e70], ecx
je 0x4079e8
push eax
call esi
push dword [0x442e70]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4079e8
test ebx, ebx
je 0x4079e8
call edi
test eax, eax
je 0x4079df
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4079df
test byte [ebp - 8], 1
jne 0x4079e8
or dword [ebp + 0x10], 0x200000
jmp 0x407a1b
mov eax, dword [0x442e64]
cmp eax, dword [ebp - 0x18]
je 0x407a1b
push eax
call esi
test eax, eax
je 0x407a1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407a1b
mov eax, dword [0x442e68]
cmp eax, dword [ebp - 0x18]
je 0x407a1b
push eax
call esi
test eax, eax
je 0x407a1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x442e60]
call esi
test eax, eax
je 0x407a37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407a39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a50
leave
ret
Function at 0x438a60
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
test ebx, ebx
jle 0x438a74
call fcn.004389e0
xor byte [esi + edi], al
inc esi
cmp esi, ebx
jl 0x438a67
pop esi
cmp ebx, 0x2d
jne 0x438a8e
mov dword [0x2be8930], 0xa62e7790
mov dword [0x2be8934], 0xffffffff
ret

Function at 0x438a90
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x44014c]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x441380]
push ebx
mov ebx, dword [0x2be8924]
push edi
mov edi, dword [0x2be64a4]
call fcn.00438a30
cmp dword [0x2be8924], 0x2f
jne 0x438afd
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00438a60
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401a50
add esp, 0x24
ret
Function at 0x402660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a9c0
call fcn.00404010
mov eax, dword [0x407004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x3a9a0], 0
push eax
push eax
push eax
mov word [ebp - 0x3a98c], ax
lea eax, [ebp - 0x3a99c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3a9a0]
mov dword [ebp - 0x3a99c], 0x10001
push eax
mov dword [ebp - 0x3a998], 0x1f40
mov dword [ebp - 0x3a994], 0x1f40
mov dword [ebp - 0x3a990], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3a980
lea eax, [ebp - 0x3a988]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov edx, eax
mov ecx, eax
xor edx, 0x400
shr ecx, 0xe
shr edx, 0xa
and ecx, 3
and edx, 5
add ecx, 5
add edx, 3
imul edx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 3
imul edx, eax
shr edx, cl
mov byte [ebp + eax - 0x3a988], dl
inc eax
cmp eax, 0x3a980
jb 0x4026e3
lea eax, [ebp - 0x3a988]
mov dword [ebp - 0x3a9bc], 0x3a980
mov dword [ebp - 0x3a9c0], eax
lea eax, [ebp - 0x3a9c0]
push 0x20
push eax
push dword [ebp - 0x3a9a0]
mov dword [ebp - 0x3a9b8], 0
mov dword [ebp - 0x3a9b4], 0
mov dword [ebp - 0x3a9b0], 0
mov dword [ebp - 0x3a9ac], 0
mov dword [ebp - 0x3a9a8], 0
mov dword [ebp - 0x3a9a4], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3a9c0]
push eax
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3a9a0]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403319
mov esp, ebp
pop ebp
ret
Function at 0x403b4f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x403b8e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x403b8e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x403b8e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x403b8e
cmp dword [ecx + 0x74], 0xe
jbe 0x403b8e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1001f870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1001f87f
pop dword [ebp - 0x50]
mov eax, 0x1001f87f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x426a9
push 0
mov eax, 0x766257cf
sub eax, 0x665ef6f3
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x2707eac6
sub ecx, 0x27079ad3
xor edi, edi
add edi, eax
mov edx, 0x436afc0
add edx, 0xbcd0e40
add edx, dword [ebp - 0x50]
mov esi, 0xbd2d7b9c
sub esi, 0xd0b4d356
xor dword [ebp - 0x3c], 0xe3f1852d
mov ebx, dword [edx]
mov dword [ebp - 4], 0xb913bcc5
add ebx, esi
xor dword [ebp - 0x48], edi
mov dword [edi], ebx
sub dword [ebp - 0x10], esi
add edi, 4
add edx, 0xaae9ba89
add edx, 0x5516457b
loop 0x1001f8db
add eax, 0xf81d5857
add eax, 0x7e3da48
xor ebx, ebx
add ebx, eax
add eax, 0x4056c1f4
add eax, 0xbfa93e11
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001f870
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001f870
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret