joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004356a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x10043579
pop dword [ebp - 0x1c]
mov eax, 0x7414894a
add eax, 0x9befac2f
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfd556a32
add dword [ebp - 0x2c], 0x50fcdb19
mov dword [ebp - 0x28], 0xf5979416
sub dword [ebp - 0x28], 0xc36447d1
mov dword [ebp - 0x24], 0x12e1a3dd
add dword [ebp - 0x24], 0x396aa051
mov dword [ebp - 0x20], 0x51bc35b1
sub dword [ebp - 0x20], 0x51bc35b1
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xfe03000f
add eax, 0x1209913d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xfd9b2ec4
add dword [ebp - 0x2c], 0x76d73a92
mov dword [ebp - 0x28], 0xb57fdc8f
add dword [ebp - 0x28], 0x8bec84e6
mov dword [ebp - 0x24], 0x49553d1b
sub dword [ebp - 0x24], 0xe5e5d0af
mov dword [ebp - 0x20], 0x379a2ebe
add dword [ebp - 0x20], 0xc865d142
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x3e158db8
add eax, 0xd1f70278
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x60661
push 0
call eax
mov ecx, 0xb330f02d
add ecx, 0x4ccf5f4c
xor edx, edx
add edx, eax
mov edi, 0x10145600
add edi, dword [ebp - 0x1c]
mov esi, 0x23ddf1e2
xor dword [ebp - 0x18], edi
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0xb44a1e4a
sub ebx, esi
add dword [ebp - 8], ebx
mov dword [edx], ebx
add edx, 0x2ceec162
sub edx, 0x2ceec15e
add edi, 0x9a84b9e1
sub edi, 0x9a84b9dd
loop 0x10043691
add eax, 0xfc40ab75
add eax, 0x3c08542
xor ebx, ebx
add ebx, eax
add eax, 0xa4de953e
sub eax, 0xa4de9539
mov ecx, 0x7a202010
sub ecx, 0x6a202010
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x1008652d
Capabilities:
Get common file path

Disassembly:
xor eax, eax
mov word [ecx], ax
cmp dword [0x10137368], eax
je 0x10086592
push ecx
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
setne al
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov edi, ecx
xor ecx, ecx
push eax
push ecx
push ecx
push 0x100c96f8
mov dword [ebp - 4], ecx
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov esi, eax
test esi, esi
js 0x100865cb
push dword [ebp - 4]
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test esi, esi
mov ecx, dword [ebp - 4]
setns bl
test ecx, ecx
je 0x100865e0
and dword [ebp - 4], 0
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x698011d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._memcpy
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
leave
ret
Function at 0x69801288
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp], 0x7a
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
cwde
and eax, 1
test eax, eax
je 0x6980140c
mov dword [esp], 0x40
call sub.USER32.dll_MessageBeep
sub esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [section..data]
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x6980140c
mov eax, dword [ebp - 0x14]
add eax, 0x82b5f0
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 0x14]
add eax, 0xc2b5f0
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 0x14]
add eax, 0x82b614
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 0x14]
add eax, 0xc2b614
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 0x14]
add eax, 0x801be3
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 0x14]
add eax, 0xc01be3
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 0x14]
add eax, 0x82b5e8
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 0x14]
add eax, 0xc2b5e8
mov dword [ebp - 4], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6980300d
mov eax, dword [ebp - 4]
mov dword [esp], eax
call sym._Dllmu
mov dword [esp], 0x7b
call sub.USER32.dll_GetAsyncKeyState
sub esp, 4
cwde
and eax, 1
test eax, eax
je 0x698014c8
mov dword [esp], 0x40
call sub.USER32.dll_MessageBeep
sub esp, 4
mov dword [ebp - 8], 0
mov eax, dword [section..data]
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x698014c8
mov eax, dword [ebp - 4]
add eax, 0xc0e4e1
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0x6980300f
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 4]
add eax, 0xc141a3
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0x6980300f
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._Dllmu
mov eax, dword [ebp - 4]
add eax, 0xc141a6
mov dword [ebp - 0x14], eax
mov dword [esp + 8], 3
mov dword [esp + 4], 0x6980300f
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._Dllmu
mov dword [esp], 5
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x6980128e
Function at 0x698014dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
cmp dword [ebp + 0xc], 1
jne 0x698015ab
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_DisableThreadLibraryCalls
sub esp, 4
cmp dword [ebp + 0xc], 1
jne 0x698015ab
mov dword [esp + 0xc], 0x41
mov dword [esp + 8], str.Info
mov dword [esp + 4], str.Pesan_Ini_Hanya_Keluar_Jika_Cheat_Aktif
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._JaMeTPlasmoptysis_4
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
lea eax, [ebp - 0x118]
mov dword [esp + 4], str.Project1.dll
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x698015ab
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov eax, 1
leave
ret 0xc

Function at 0x69801bc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x401dd0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.00407220
mov eax, dword [0x4231a4]
xor eax, esp
mov dword [esp + 0x2000], eax
mov eax, dword [esp + 0x2008]
push 0x1000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x401e43
push 0x1000
lea edx, [esp + 0x1004]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x401e43
lea ecx, [esp]
push ecx
call fcn.004078ca
add esp, 4
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.00406bd1
add esp, 0x2004
ret
mov ecx, dword [esp + 0x2000]
xor ecx, esp
xor eax, eax
call fcn.00406bd1
add esp, 0x2004
ret

Function at 0x401e90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4014
call fcn.00407220
mov eax, dword [0x4231a4]
xor eax, esp
mov dword [esp + 0x4010], eax
push ebx
mov ebx, dword [esp + 0x401c]
push esi
push edi
lea eax, [esp + 0x1c]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x1000
lea ecx, [esp + 0x2020]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0x1000
lea eax, [esp + 0x2020]
push eax
push ebx
call fcn.00403390
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
lea ecx, [esp + 0x1c]
push str._MEI_d
push ecx
call fcn.0040747a
add esp, 0x18
xor edi, edi
lea edx, [esp + 0xc]
push edx
push ebx
call fcn.00407951
mov esi, eax
push esi
call fcn.0040791f
add esp, 0xc
test eax, eax
je 0x401f4a
push esi
call fcn.0040724b
inc edi
add esp, 4
cmp edi, 5
jl 0x401f07
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x4010]
xor ecx, esp
call fcn.00406bd1
add esp, 0x4014
ret
mov edx, ebx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401f50
push esi
call fcn.0040724b
mov ecx, dword [esp + 0x4020]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00406bd1
add esp, 0x4014
ret
Function at 0x4023d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.00407220
mov eax, dword [0x4231a4]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
mov ebx, dword [esp + 0x1014]
push esi
push edi
mov edi, dword [esp + 0x1018]
push 0x41c47c
push eax
call fcn.00403b10
push ebx
push edi
mov esi, eax
call fcn.00402270
add esp, 0x10
xor ebx, ebx
mov edi, eax
test esi, esi
je 0x4024c5
test edi, edi
je 0x4024c5
push esi
call fcn.004083a6
add esp, 4
test eax, eax
jne 0x40249c
push esi
push 1
lea eax, [esp + 0x14]
push 0x1000
push eax
call fcn.004086ae
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402462
push esi
call fcn.004083da
add esp, 4
test eax, eax
je 0x402481
push esi
jmp 0x402491
push edi
push 1
lea ecx, [esp + 0x14]
push 0x1000
push ecx
call fcn.00408324
push edi
call fcn.004083da
add esp, 0x14
test eax, eax
jne 0x402490
push esi
call fcn.004083a6
add esp, 4
test eax, eax
je 0x402438
jmp 0x40249c
push edi
call fcn.004081b7
add esp, 4
or ebx, 0xffffffff
push esi
call fcn.0040808e
push edi
call fcn.0040808e
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00406bd1
add esp, 0x1004
ret
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.00406bd1
add esp, 0x1004
ret
Function at 0x402500
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x2068
call fcn.00407220
mov eax, dword [0x4231a4]
xor eax, esp
mov dword [esp + 0x2064], eax
mov eax, dword [esp + 0x206c]
push esi
push 0x1000
push eax
lea eax, [esp + 0x70]
xor esi, esi
push eax
mov dword [esp + 0x10], esi
call fcn.00403190
push 1
push 0x16
call fcn.00408ba7
push 1
push 2
call fcn.00408ba7
push 1
push 0xf
call fcn.00408ba7
push 1
push 0x15
call fcn.00408ba7
add esp, 0x2c
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov edx, 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], dx
call fcn.00407715
push eax
call fcn.004076e3
push eax
call fcn.004087d2
mov dword [esp + 0x64], eax
call fcn.00407715
add eax, 0x20
push eax
call fcn.004076e3
push eax
call fcn.004087d2
mov dword [esp + 0x70], eax
call fcn.00407715
add eax, 0x40
push eax
call fcn.004076e3
push eax
call fcn.004087d2
add esp, 0x18
mov dword [esp + 0x64], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push esi
push esi
push esi
push 1
push esi
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
test eax, eax
je 0x402645
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp]
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.00406bd1
add esp, 0x2068
ret
push str.Error_creating_child_process__n
call fcn.00401000
mov ecx, dword [esp + 0x2068]
add esp, 4
xor ecx, esp
or eax, 0xffffffff
call fcn.00406bd1
add esp, 0x2068
ret
Function at 0x402cf0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push edi
push 0
push eax
call sub.WS2_32.dll_ntohl
mov ebx, dword [esp + 0x14]
add eax, dword [ebx + 4]
mov ecx, dword [ebx]
push eax
push ecx
call fcn.0040901e
mov edx, dword [esi + 8]
add esp, 0xc
push edx
call sub.WS2_32.dll_ntohl
push eax
call fcn.00407328
mov edi, eax
add esp, 4
test edi, edi
jne 0x402d40
push str.Could_not_allocate_read_buffer_n
call fcn.00401070
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
mov ecx, dword [esi + 8]
push eax
push 1
push ecx
call sub.WS2_32.dll_ntohl
push eax
push edi
call fcn.004086ae
add esp, 0x10
cmp eax, 1
jae 0x402d70
push str.Could_not_read_from_file_n
call fcn.00401070
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp byte [esi + 0x10], 1
jne 0x402da4
push edi
call fcn.00402c00
push edi
mov ebx, eax
call fcn.0040724b
add esp, 8
mov edi, ebx
test ebx, ebx
jne 0x402da4
add esi, 0x12
push esi
push str.Error_decompressing__s_n
call fcn.00401070
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x402db0
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push edi
push esi
call fcn.00402cf0
push esi
mov ebp, eax
call fcn.00401f80
add esp, 0xc
cmp eax, 0xffffffff
jne 0x402dd8
pop edi
pop esi
or eax, eax
pop ebp
ret
push ebx
lea ebx, [edi + 0x12]
push ebx
add esi, 0x2068
push esi
call fcn.00402270
mov esi, eax
add esp, 8
test esi, esi
jne 0x402e08
push ebx
push str._s_could_not_be_extracted__n
call fcn.00401000
add esp, 8
pop ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
mov eax, dword [edi + 0xc]
push esi
push 1
push eax
call sub.WS2_32.dll_ntohl
push eax
push ebp
call fcn.00408324
push esi
call fcn.0040808e
push ebp
call fcn.0040724b
add esp, 0x18
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret

Function at 0x402e40
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esi]
push 0
add eax, 0xffffffa8
push eax
push ecx
call fcn.0040901e
add esp, 0xc
test eax, eax
je 0x402e59
or eax, 0xffffffff
ret
mov edx, dword [esi]
push edi
push edx
push 1
lea edi, [esi + 0x10]
push 0x58
push edi
call fcn.004086ae
add esp, 0x10
cmp eax, 1
jae 0x402e77
or eax, 0xffffffff
pop edi
ret
push 8
push str.MEI_f_v_n_v
push edi
call fcn.004090a3
add esp, 0xc
neg eax
sbb eax, eax
pop edi
ret
Function at 0x402e90
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esi]
push 0
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0040901e
mov ecx, dword [esi]
push ecx
push 2
lea edx, [esp + 0x14]
push 1
push edx
call fcn.004086ae
mov ax, word [esp + 0x1c]
add esp, 0x1c
cmp al, 0x4d
jne 0x402f60
cmp ah, 0x5a
jne 0x402f60
mov eax, dword [esi]
push 0
push 0x3c
push eax
call fcn.0040901e
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
call fcn.004086ae
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
push 0
add eax, 0x18
push eax
push ecx
call fcn.0040901e
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x30]
push 2
push eax
call fcn.004086ae
mov ax, word [esp + 0x38]
add esp, 0x38
cmp al, 0xb
jne 0x402f60
cmp ah, 1
jne 0x402f29
mov eax, 0x98
jmp 0x402f33
cmp ah, 2
jne 0x402f60
mov eax, 0xa8
mov ecx, dword [esp + 4]
mov edx, dword [esi]
push 0
add eax, ecx
push eax
push edx
call fcn.0040901e
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.004086ae
mov eax, dword [esp + 0x20]
add esp, 0x1c
test eax, eax
jne 0x402f63
or eax, 0xffffffff
add esp, 8
ret

Function at 0x402f70
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
lea eax, [esi + 0x68]
push 0x41c47c
push eax
call fcn.00403b10
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x402f91
or eax, 0xffffffff
pop esi
ret
push edi
push 2
push 0
push eax
call fcn.0040901e
mov ecx, dword [esi]
push ecx
call fcn.00409300
add esp, 0x10
mov edi, eax
call fcn.00402e40
test eax, eax
jge 0x402fe1
call fcn.00402e90
mov edi, eax
cmp edi, 1
jl 0x40309d
push ebx
xor ebx, ebx
mov eax, edi
call fcn.00402e40
test eax, eax
jge 0x402fd7
inc ebx
dec edi
cmp ebx, 8
jl 0x402fc5
cmp ebx, 8
pop ebx
je 0x40309d
mov edx, dword [esi + 0x18]
push edx
mov dword [esi + 0x406c], 0
call sub.WS2_32.dll_ntohl
sub edi, eax
mov eax, dword [esi + 0x1c]
push 0
push eax
mov dword [esi + 4], edi
call sub.WS2_32.dll_ntohl
add eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.0040901e
mov edx, dword [esi + 0x20]
add esp, 0xc
push edx
call sub.WS2_32.dll_ntohl
push eax
call fcn.00407328
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x40303f
push str.Could_not_allocate_buffer_for_TOC.
call fcn.00401000
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [esi + 0x20]
push eax
push 1
push ecx
call sub.WS2_32.dll_ntohl
mov edx, dword [esi + 8]
push eax
push edx
call fcn.004086ae
add esp, 0x10
cmp eax, 1
jae 0x403072
push str.Could_not_read_from_file.
call fcn.00401000
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x20]
push eax
call sub.WS2_32.dll_ntohl
add eax, dword [esi + 8]
mov ecx, dword [esi]
push ecx
mov dword [esi + 0xc], eax
call fcn.004083da
add esp, 4
test eax, eax
je 0x4030a3
push str.Error_on_file
call fcn.00401000
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x403ff0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4231a4]
xor eax, esp
mov dword [esp + 0x94], eax
push 0x94
lea eax, [esp + 4]
push 0
push eax
call fcn.00407400
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x404053
jne 0x40403c
cmp dword [esp + 8], 1
jae 0x404053
xor eax, eax
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.00406bd1
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
mov eax, 1
call fcn.00406bd1
add esp, 0x98
ret
Function at 0x406bd1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4231a4]
jne 0x406bdb
repz ret
jmp fcn.0040ce6b

Function at 0x40f53f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40f570
call fcn.0040b627
mov dword [eax], esi
call fcn.0040b614
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040b5ac
add esp, 0x14
push 0x16
pop eax
jmp 0x40f5c5
test dword [ebp + 0xc], 0xfffffff9
jne 0x40f54c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40f59d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b63a
pop ecx
call fcn.0040b614
mov eax, dword [eax]
jmp 0x40f5c5
test al, 0x10
jne 0x40f5c3
test al, 1
je 0x40f5c3
test byte [ebp + 0xc], 2
je 0x40f5c3
call fcn.0040b627
mov dword [eax], 5
call fcn.0040b614
mov dword [eax], 0xd
jmp 0x40f594
xor eax, eax
pop esi
pop ebp
ret

Function at 0x415330
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040d60b
and dword [ebp - 4], 0
cmp dword [0x42c4f8], 0
mov ebx, eax
jne 0x4153e1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415492
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4206b0
push edi
call esi
test eax, eax
je 0x415492
push eax
call fcn.0040d599
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42c4f8], eax
call esi
push eax
call fcn.0040d599
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42c4fc], eax
call esi
push eax
call fcn.0040d599
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42c500], eax
call esi
push eax
call fcn.0040d599
pop ecx
mov dword [0x42c508], eax
test eax, eax
je 0x4153e1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d599
pop ecx
mov dword [0x42c504], eax
mov eax, dword [0x42c504]
cmp eax, ebx
je 0x415439
cmp dword [0x42c508], ebx
je 0x415439
push eax
call fcn.0040d614
push dword [0x42c508]
mov esi, eax
call fcn.0040d614
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x415439
test edi, edi
je 0x415439
call esi
test eax, eax
je 0x415430
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x415430
test byte [ebp - 0xc], 1
jne 0x415439
or dword [ebp + 0x10], 0x200000
jmp 0x415472
mov eax, dword [0x42c4fc]
cmp eax, ebx
je 0x415472
push eax
call fcn.0040d614
pop ecx
test eax, eax
je 0x415472
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415472
mov eax, dword [0x42c500]
cmp eax, ebx
je 0x415472
push eax
call fcn.0040d614
pop ecx
test eax, eax
je 0x415472
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42c4f8]
call fcn.0040d614
pop ecx
test eax, eax
je 0x415492
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415494
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret