joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411864
Capabilities:
Encode data using xor

Disassembly:
cmp esi, 0xfdea
je 0x4117ea
or ah, 0xde
movsx ecx, ah
push 0xa58f97
push 0x5a4412
jmp 0x4117f9
jmp 0x4117fe
test edx, 0x99103d0d
mov eax, 0x17dba345
mov bl, al
xor ecx, esi
lea edx, [0x8a4531eb]
imul eax, edx, 0xc18e12b7
mov eax, 0x2d181e09
mov edi, ebx
imul edi, esi
test ebp, 0x25a6efd3
add ebx, 0xcb6e1da
mov eax, 0x4d07d667
call 0x411864
movzx ebx, ah
mov eax, edi
test ah, ch
movzx esi, dh
imul ecx, edi, 0x25b2528d
adc dl, ah
inc edx
lea esi, [eax]
inc ebx
sbb edx, edx
xor edx, 0x50d81271
test ch, cl
add edi, esi
and ebx, edi
pop esi
dec edx
imul ecx, ebp
adc ebx, eax
mov ebp, 0x99389108
movsx eax, ax
test eax, 0xf554f092
mov bl, 0x9c
js 0x411887
mov edx, 0x9c31f30e
cmp esi, 0x8f72
jne 0x411895
lea eax, [0x4bf4174a]
imul eax, edx, 0x3cb918a
mov ebx, 0x3a6
test ecx, edi
jbe 0x4118a6
mov eax, eax
xor ebx, 0x15b3
test ecx, 0x873d7be6
add ebx, 0x7c
sbb eax, edi
xor ecx, ebx
test ch, bh
imul edi, ecx
lea edx, [0xbde3a7bd]
or al, 0x1c
push eax
push ebx
imul ecx, ebp, 0xa47e9dc1
imul ecx, ebx
lea eax, [0xcaa6e42a]
movzx ecx, ax
mov edi, eax
imul ebx, edx
imul edi, ebx, 0xcd2ef59b
dec ecx
inc edx
mov edx, 0x49551045
sbb dl, bl
mov eax, 0x11bcf
mov ebp, 0xbc3a5340
xor eax, 0xacf1
mov cl, al
xor eax, 0xf01b
test dl, bh
mov cl, 0x70
lea ebx, [eax]
test bh, dl
add ebx, 0xd36
imul edi, eax, 0xad3e0ac9
add esi, ebx
jmp 0x41192e
add esi, 0x619
xor al, bl
test cl, 0x2b
imul edx, eax, 0x13d695af
lea eax, [0xdefebd92]
test edx, 0x716548bb
cmp ebp, edi
jmp 0x411953
xor ecx, 0xd964
dec ebx
mov ah, ch
sbb eax, 0x97dff198
xor cl, 0xef
mov edi, eax
mov ecx, 0xa1f9d345
movzx ecx, cx
inc ebx
lea ebx, [0xaca848c5]
xchg ch, dl
and bl, 0x54
sub ecx, 0x80d2a0d9
mov edi, ebp
push esi
sub edi, edi
or ebx, 0x16ac3fc0
lea edx, [0x4fbf68a8]
and ecx, ebp
add edi, 0x727
movsx eax, ch
test ebx, edx
sub edi, 0x726
adc dl, 0xfe
or al, 0x73
sbb ah, bh
mov ebp, 0x65341fc9
and al, 0xde
xor ah, 0xc7
cmp edi, 0x84
jb 0x411986
inc bh
xchg ecx, edi
mov edi, 0x4793cdd1
ret
Function at 0x413ea0
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x401100
call fcn.004140ac
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x413ef3
mov eax, dword [0x40003c]
lea eax, [eax + 0x400000]
cmp dword [eax], 0x4550
jne 0x413ef3
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
je 0x413f0b
cmp ecx, 0x20b
je 0x413ef8
mov dword [ebp - 0x1c], ebx
jmp 0x413f1f
cmp dword [eax + 0x84], 0xe
jbe 0x413ef3
xor ecx, ecx
cmp dword [eax + 0xf8], ebx
jmp 0x413f19
cmp dword [eax + 0x74], 0xe
jbe 0x413ef3
xor ecx, ecx
cmp dword [eax + 0xe8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x41bb88], edi
mov dword [0x41bb8c], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x41bb84]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x41bb80]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x41bb90], eax
call fcn.004140a8
cmp dword [0x417770], ebx
jne 0x413f7c
push fcn.004140a8
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00414096
push 0x4010f8
push 0x4010f4
call sub.msvcrt.dll__initterm
mov eax, dword [0x41bb7c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x41bb78]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x4010f0
push 0x4010ec
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x414007
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x413fe7
cmp cl, 0x22
jne 0x413fd8
cmp byte [eax], 0x22
jne 0x413ff0
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x413ffb
cmp cl, 0x20
jbe 0x413fec
test byte [ebp - 0x54], 1
je 0x414012
movzx ecx, word [ebp - 0x50]
jmp 0x414015
cmp byte [eax], 0x20
jbe 0x413ff0
inc eax
mov dword [ebp - 0x20], eax
jmp 0x414007
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.00413211
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x414033
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x41406f
mov eax, esi
jmp 0x414083
call fcn.004140e7
ret
Function at 0x408fbc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408f70
test al, al
jne 0x408fdd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x409029
xor eax, eax
push ebp
push 0x409019
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409020
lea eax, [ebp - 0xc]
call fcn.00408fac
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40941f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406cf4
mov edx, dword [ebp - 8]
mov ecx, 0x409438
xor eax, eax
call fcn.00409224
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4093ed
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409350
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x35
call fcn.00408dd8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404c94
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407284
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x67
call fcn.00408da8
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404660
call fcn.00405890
call fcn.00402eb4
jmp 0x409350
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409426
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409448
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40b07c], 2
jne 0x4094af
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40946a
xor eax, eax
jmp 0x4094be
lea eax, [esp + 8]
push eax
push 0x4094c4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x4094af
xor eax, eax
jmp 0x4094be
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x409040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
mov dword [ebp - 0x14], 0x9cd4e8b6
jmp 0x409060
mov dword [ebp - 0x14], 0x9a111298
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
cmp eax, 0x2757e40d
jg 0x4090b0
cmp eax, 0x1ebb8ba3
jg 0x4090c0
cmp eax, 0x901a98
jg 0x4090e4
cmp eax, 0xcdb872d0
jg 0x409114
cmp eax, 0x9143243e
jg 0x40912b
cmp eax, 0x8c768fdf
jne 0x409060
mov al, byte [ebp - 9]
test al, al
mov eax, 0xabe525a7
jne 0x4090a6
mov eax, 0x901a99
mov dword [ebp - 0x14], eax
jmp 0x409060
cmp eax, 0x2757e40e
jne 0x409060
jmp 0x409054
cmp eax, 0x1ebb8ba4
jne 0x409060
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0xbc03aa0b
jmp 0x409060
cmp eax, 0x901a99
jne 0x409060
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], 0x9485fa76
jmp 0x409060
cmp eax, 0xcdb872d1
jne 0x409060
mov dword [ebp - 0x14], 0x2757e40e
jmp 0x409060
cmp eax, 0x9485fa75
jg 0x4091a2
cmp eax, 0x9143243f
jne 0x409060
mov eax, 4
call fcn.00412f90
mov ecx, esp
mov eax, 4
call fcn.00412f90
mov edi, esp
mov dword [ecx], esi
mov dword [edi], 0
mov eax, dword [ecx]
lea ecx, [eax + 0x2c]
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x408c20
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00413e43
add esp, 0x18
mov dword [edi], eax
mov dword [ebp - 0x14], 0xbc6ab7ef
jmp 0x409060
cmp eax, 0x9a111297
jg 0x4091ce
cmp eax, 0x9485fa76
jne 0x409060
mov ecx, dword [ebp - 0x10]
mov eax, 0x1ebb8ba4
cmp dword [ecx], 0
jne 0x4091c6
mov eax, 0xbc03aa0b
mov dword [ebp - 0x14], eax
jmp 0x409060
cmp eax, 0x9cd4e8b5
jg 0x4091e5
cmp eax, 0x9a111298
jne 0x409060
jmp 0x4092aa
cmp eax, 0xabe525a6
jg 0x409203
cmp eax, 0x9cd4e8b6
jne 0x409060
mov dword [ebp - 0x14], 0xbc6ab7ef
jmp 0x409060
cmp eax, 0xabe525a7
je 0x40921d
cmp eax, 0xbc03aa0b
jne 0x409229
mov dword [ebp - 0x14], 0x2757e40e
jmp 0x409060
mov dword [ebp - 0x14], 0x9485fa76
jmp 0x409060
cmp eax, 0xbc6ab7ef
jne 0x409060
mov eax, 4
call fcn.00412f90
mov ecx, esp
mov eax, 4
call fcn.00412f90
mov dword [ebp - 0x10], esp
mov dword [ecx], esi
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
mov eax, dword [ecx]
lea ecx, [eax + 0x2c]
sub esp, 0x18
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x408c20
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00413e43
add esp, 0x18
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
sete byte [ebp - 9]
mov dword [ebp - 0x14], 0x8c768fdf
jmp 0x409060
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x40d360
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [0x40e058]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0xe439f76e
jmp 0x40d3b0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x47e11c], eax
call fcn.004138af
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xd245a030
nop
nop
nop
mov eax, dword [ebp - 0x24]
cmp eax, 0x6648fd0d
jg 0x40d410
cmp eax, 0x19418bd8
jg 0x40d420
cmp eax, 0xe7dbb235
jg 0x40d474
cmp eax, 0xe439f76d
jg 0x40d498
cmp eax, 0xdac3052d
jg 0x40d4bb
cmp eax, 0xd245a02f
jg 0x40d51a
cmp eax, 0x9ea331c3
je 0x40d3ff
cmp eax, 0xa198f7bd
jne 0x40d527
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0xd245a030
jmp 0x40d3b0
cmp eax, 0x6648fd0e
jne 0x40d3b0
jmp 0x40d393
cmp eax, 0x19418bd9
jne 0x40d3b0
mov dword [esp], 0
call fcn.0040d550
mov esi, eax
call fcn.00402140
imul eax, esi
mov dword [esp], eax
call fcn.004138d2
mov eax, dword [ebp - 0x18]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.004047b0
mov ecx, dword [ebp - 0x18]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add eax, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0xdac3052e
jmp 0x40d3b0
cmp eax, 0xe7dbb236
jne 0x40d3b0
mov al, byte [ebp - 9]
test al, al
mov eax, 0x6648fd0e
jne 0x40d490
mov eax, 0xa198f7bd
mov dword [ebp - 0x24], eax
jmp 0x40d3b0
cmp eax, 0xe439f76e
jne 0x40d3b0
mov eax, 0x9ea331c3
cmp dword [ebp - 0x10], 0
je 0x40d4b3
mov eax, 0xa682420c
mov dword [ebp - 0x24], eax
jmp 0x40d3b0
cmp eax, 0xdac3052e
jne 0x40d3b0
mov dword [esp], 0
call fcn.0040d550
mov esi, eax
call fcn.00402140
imul eax, esi
mov dword [esp], eax
call fcn.004138d2
mov eax, dword [ebp - 0x18]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.004047b0
mov ecx, dword [ebp - 0x18]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add eax, edi
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
sete byte [ebp - 9]
mov dword [ebp - 0x24], 0xe7dbb236
jmp 0x40d3b0
cmp eax, 0xd245a030
jne 0x40d3b0
jmp 0x40d53e
cmp eax, 0xa682420c
jne 0x40d3b0
mov dword [ebp - 0x24], 0xdac3052e
jmp 0x40d3b0
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop esi
pop edi
pop ebp
ret
Function at 0x41b8fa
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47e690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00418753
mov dword [ebp - 0x14], eax
cmp dword [0x4c8a6c], edi
jne 0x41b9eb
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41b978
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41bacb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41bacb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41bacb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4c8a6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4c8a70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4c8a74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c8a7c], eax
test eax, eax
je 0x41b9e8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c8a78], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41ba10
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41ba03
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41ba25
push 4
pop eax
jmp 0x41bacd
cmp dword [ebp - 0x14], edi
je 0x41ba25
push dword [0x4c8a6c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41ba0a
mov eax, dword [0x4c8a78]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41ba83
cmp dword [0x4c8a7c], esi
je 0x41ba83
push eax
call ebx
push dword [0x4c8a7c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41ba83
test eax, eax
je 0x41ba83
call ecx
test eax, eax
je 0x41ba78
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41ba78
test byte [ebp - 8], 1
jne 0x41ba83
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41bab3
mov eax, dword [0x4c8a70]
cmp eax, esi
je 0x41bab0
push eax
call ebx
test eax, eax
je 0x41bab0
call eax
mov edi, eax
test edi, edi
je 0x41bab0
mov eax, dword [0x4c8a74]
cmp eax, esi
je 0x41bab0
push eax
call ebx
test eax, eax
je 0x41bab0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4c8a6c]
call ebx
test eax, eax
je 0x41bacb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41bacd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415859
leave
ret
Function at 0x7f2d40d8
Capabilities:
Get file size

Disassembly:
push esi
push edi
xor edi, edi
push edi
mov eax, 0x80
push eax
push 3
push edi
push 1
push eax
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x7f2d410b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x7f2d4112
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0x7f
mov eax, dword [0x7f307090]
mov dword [ebp - 4], eax
jne 0x7f2d412d
mov dword [ebp + 8], 0x409
push 6
lea eax, [ebp - 0xc]
push eax
push 0x1004
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x7f2d4150
lea eax, [ebp - 0xc]
push eax
call fcn.7f2d3f11
jmp 0x7f2d4155
mov eax, dword [0x7f307ac8]
mov ecx, dword [ebp - 4]
call fcn.7f2fd123
leave
ret 4

Function at 0x7f2d4161
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0x7f
mov eax, dword [0x7f307090]
mov dword [ebp - 4], eax
jne 0x7f2d417c
mov dword [ebp + 8], 0x409
push 6
lea eax, [ebp - 0xc]
push eax
push 0xb
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x7f2d419c
lea eax, [ebp - 0xc]
push eax
call fcn.7f2d3f11
jmp 0x7f2d41a1
mov eax, dword [0x7f307084]
mov ecx, dword [ebp - 4]
call fcn.7f2fd123
leave
ret 4
Function at 0x7f2dadd0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.7f2fd060
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x7f2dae2d
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x7f307acc]
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jae 0x7f2dae31
xor eax, eax
jmp 0x7f2dae79
test eax, eax
je 0x7f2dae60
cmp esi, edi
jbe 0x7f2dae4a
push 0x4000
mov eax, esi
sub eax, edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 4
push 0x1000
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x7f307acc]
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7f2de579
Capabilities:
Check if file exists
Enumerate gui resources
Get file attributes

Disassembly:
cmp dword [0x7f307acc], 0
je 0x7f2de5ad
mov eax, dword [0x7f30799c]
test eax, eax
jne 0x7f2de59e
push 0x7f2d2c10
call fcn.7f2d3fba
test eax, eax
mov dword [0x7f30799c], eax
je 0x7f2de5a0
jmp eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
ret 8
jmp fcn.7f2dd907

Function at 0x7f2de6e4
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x7f307acc], 0
push ebx
push esi
push edi
je 0x7f2de710
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
jmp 0x7f2de78e
mov ebx, dword [ebp + 8]
cmp ebx, 0xffff
jbe 0x7f2de775
push ebx
call fcn.7f2da99a
mov edi, eax
mov eax, dword [0x7f307088]
inc edi
imul eax, edi
pop ecx
push eax
call fcn.7f2d53a1
test eax, eax
mov esi, dword [0x7f307088]
je 0x7f2de755
mov eax, esi
imul eax, edi
test eax, eax
je 0x7f2de755
add eax, 3
and eax, 0xfffffffc
call fcn.7f2fd060
mov ebx, esp
jmp 0x7f2de757
xor ebx, ebx
xor eax, eax
cmp ebx, eax
je 0x7f2de775
imul esi, edi
push eax
push eax
push esi
push ebx
push edi
push dword [ebp + 8]
push eax
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c