joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54b590
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5d3020]
add eax, 0x45
sub eax, dword [0x5d3004]
mov byte [0x5d3008], al
mov ecx, dword [0x5d3024]
add ecx, 0x45
sub ecx, dword [0x5d3020]
mov dword [0x5d3068], ecx
movzx edx, word [0x5d300c]
imul edx, edx, 0x17da4
add edx, dword [0x5d3020]
mov word [0x5d300c], dx
movzx eax, word [0x5d300c]
push eax
call fcn.0054a910
add esp, 4
mov dword [0x5d3004], eax
movzx ecx, byte [0x5d3008]
imul ecx, ecx, 3
add ecx, dword [0x5d3020]
mov word [0x5d300c], cx
push 0x5eb2c0
push 0x537
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [0x5d3024], eax
movzx edx, word [0x5d300c]
mov eax, dword [0x5d3024]
lea ecx, [edx + eax - 0x39]
add ecx, dword [0x5d3020]
mov dword [0x5d3020], ecx
movzx edx, word [0x5d300c]
imul edx, edx, 0x17da4
add edx, dword [0x5d3020]
mov word [0x5d300c], dx
movzx eax, word [0x5d300c]
push eax
call fcn.0054a550
add esp, 4
mov dword [0x5d3004], eax
mov ecx, dword [0x5d3004]
sub ecx, 0xeb7f
sub ecx, dword [0x5d3068]
add ecx, dword [0x5d3024]
add ecx, dword [0x5d3024]
mov dword [0x5d3024], ecx
mov eax, dword [0x5d3068]
pop ebp
ret

Function at 0x552555
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x57772c
call fcn.00554d55
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x552667
cmp byte [esi + 0x42], bl
je 0x552667
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp ax, di
jne 0x552591
xor al, al
jmp 0x552669
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.0055252f
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x552601
dec eax
je 0x552605
dec eax
dec eax
je 0x552663
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0054bd00
mov al, bl
jmp 0x552669
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x552645
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00556e0b
add esp, 0x10
cmp edi, eax
jne 0x5525ef
cmp byte [esi + 0x42], 0
je 0x552663
test edi, edi
jne 0x55259f
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00550680
jmp 0x55259f
mov bl, 1
jmp 0x5525f1
mov al, 1
call fcn.00554dd8
ret
Function at 0x55266f
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x577759
call fcn.00554d55
mov edi, dword [ebp + 8]
cmp di, 0xffff
mov esi, ecx
jne 0x552692
xor ax, ax
call fcn.00554dd8
ret 4
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x5526bd
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x5526bd
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x55268a
mov eax, dword [esi + 0x4c]
cmp eax, ebx
jne 0x5526ca
or ax, 0xffff
jmp 0x55268a
cmp dword [esi + 0x3c], ebx
jne 0x5526e6
push eax
push edi
call fcn.00552103
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x55268a
mov eax, 0xffff
jmp 0x55268a
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.0055252f
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x5527d7
cmp eax, 1
jg 0x552812
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x55277c
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00556e0b
add esp, 0x10
cmp edi, eax
jne 0x5527f9
lea eax, [ebp - 0x30]
cmp dword [ebp - 0x3c], eax
mov byte [esi + 0x42], 1
jne 0x552833
test edi, edi
ja 0x5527a2
cmp dword [ebp - 0x18], 0x20
jae 0x5527f9
push 0
push 8
lea ecx, [ebp - 0x2c]
call fcn.00550680
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00552322
mov ecx, eax
call fcn.00551bf5
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x552733
or si, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0054bd00
mov ax, si
jmp 0x55268a
cmp eax, 3
jne 0x5527f9
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00552103
test al, al
movzx esi, word [ebp + 8]
pop ecx
pop ecx
jne 0x5527fe
mov esi, 0xffff
jmp 0x5527fe
mov si, word [ebp + 8]
jmp 0x5527fe

Function at 0x553edc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5d4020]
jne 0x553ee6
repz ret
jmp fcn.0055a8cc
Function at 0x5717f9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0055a267
xor ebx, ebx
cmp dword [0x5ed858], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x5718ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x571839
xor eax, eax
jmp 0x571992
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x571832
push eax
call fcn.0055a204
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x5ed858], eax
call esi
push eax
call fcn.0055a204
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5ed85c], eax
call esi
push eax
call fcn.0055a204
mov dword [0x5ed860], eax
lea eax, [ebp - 8]
push eax
call fcn.0055e57c
test eax, eax
pop ecx
pop ecx
je 0x57189c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00554320
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x5718ce
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0055a204
cmp eax, ebx
pop ecx
mov dword [0x5ed868], eax
je 0x5718ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0055a204
pop ecx
mov dword [0x5ed864], eax
mov eax, dword [0x5ed864]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x571947
cmp dword [0x5ed868], esi
je 0x571947
push eax
call fcn.0055a270
pop ecx
call eax
cmp eax, ebx
je 0x571914
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x5ed868]
call fcn.0055a270
pop ecx
call eax
test eax, eax
je 0x571914
test byte [ebp - 0x18], 1
jne 0x571947
lea eax, [ebp - 0xc]
push eax
call fcn.0055e62b
test eax, eax
pop ecx
je 0x57192f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00554320
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x57193e
or dword [ebp + 0x10], 0x200000
jmp 0x571978
or dword [ebp + 0x10], 0x40000
jmp 0x571978
mov eax, dword [0x5ed85c]
cmp eax, esi
je 0x571978
push eax
call fcn.0055a270
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x571978
mov eax, dword [0x5ed860]
cmp eax, esi
je 0x571978
push dword [ebp - 4]
push eax
call fcn.0055a270
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x5ed858]
call fcn.0055a270
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c60
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub esp, 0x268
mov eax, dword [0x410040]
xor eax, esp
mov dword [esp + 0x260], eax
push esi
lea eax, [esp + 8]
mov esi, str.http:__
mov ecx, eax
mov edx, 0x7d0
sub esi, ecx
jmp 0x401c90
lea ecx, [edx + 0x7ffff82e]
test ecx, ecx
je 0x401cb0
movzx ecx, word [esi + eax]
test cx, cx
je 0x401cb0
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x401c90
jmp 0x401cb4
test edx, edx
jne 0x401cb7
sub eax, 2
xor edx, edx
mov word [eax], dx
push str.mencapai.com
lea eax, [esp + 0xc]
call fcn.00401000
inc dword [0x411e48]
push 0
push 1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
je 0x401d07
cmp dword [0x411e4c], 2
jne 0x401d01
lea ecx, [esp + 8]
push ecx
call fcn.00401630
add esp, 4
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
inc dword [0x411e4c]
mov ecx, dword [esp + 0x264]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004021fc
add esp, 0x268
ret

Function at 0x4021fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410040]
jne 0x402206
repz ret
jmp fcn.004029f8

Function at 0x406cd6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0040694e
push eax
push esi
push dword [ebp + 8]
call fcn.00406903
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
xchg edi, eax

Function at 0x406d08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg edi, eax
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040694e
push eax
push esi
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00406903
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040694e
push eax
push esi
push dword [ebp + 8]
call fcn.00406903
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040693e
mov bh, 3
sahf
js 0x406d49
popfd
jl 0x406dc3
invalid
invalid
Function at 0x406d4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg edi, eax
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040694e
push eax
push esi
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00406903
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040694e
push eax
push esi
push dword [ebp + 8]
call fcn.00406903
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040693e
mov bh, 3
sahf
js 0x406d49
popfd
jl 0x406dc3
invalid
invalid

Function at 0x406d70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg edi, eax
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040694e
push eax
push esi
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00406903
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040694e
push eax
push esi
push dword [ebp + 8]
call fcn.00406903
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040693e
mov bh, 3
sahf
js 0x406d49
popfd
jl 0x406dc3
invalid
invalid
Function at 0x407d83
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x407d94
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x407d3e
call fcn.0040693e
jo 0x407dec
adc dword [ebx], edi
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
invalid

Function at 0x40a53c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040506b
and dword [ebp - 4], 0
cmp dword [0x411ba0], 0
mov ebx, eax
jne 0x40a5ed
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a69e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a69e
push eax
call fcn.00404ff9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411ba0], eax
call esi
push eax
call fcn.00404ff9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411ba4], eax
call esi
push eax
call fcn.00404ff9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411ba8], eax
call esi
push eax
call fcn.00404ff9
pop ecx
mov dword [0x411bb0], eax
test eax, eax
je 0x40a5ed
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ff9
pop ecx
mov dword [0x411bac], eax
mov eax, dword [0x411bac]
cmp eax, ebx
je 0x40a645
cmp dword [0x411bb0], ebx
je 0x40a645
push eax
call fcn.00405074
push dword [0x411bb0]
mov esi, eax
call fcn.00405074
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a645
test edi, edi
je 0x40a645
call esi
test eax, eax
je 0x40a63c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a63c
test byte [ebp - 0xc], 1
jne 0x40a645
or dword [ebp + 0x10], 0x200000
jmp 0x40a67e
mov eax, dword [0x411ba4]
cmp eax, ebx
je 0x40a67e
push eax
call fcn.00405074
pop ecx
test eax, eax
je 0x40a67e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a67e
mov eax, dword [0x411ba8]
cmp eax, ebx
je 0x40a67e
push eax
call fcn.00405074
pop ecx
test eax, eax
je 0x40a67e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411ba0]
call fcn.00405074
pop ecx
test eax, eax
je 0x40a69e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a6a0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48c004]
jne 0x401010
repz ret
jmp fcn.00401515

Function at 0x4070a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403dfb
and dword [ebp - 4], 0
cmp dword [0x490798], 0
mov ebx, eax
jne 0x407158
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407209
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407209
push eax
call fcn.00403d89
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x490798], eax
call esi
push eax
call fcn.00403d89
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x49079c], eax
call esi
push eax
call fcn.00403d89
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4907a0], eax
call esi
push eax
call fcn.00403d89
pop ecx
mov dword [0x4907a8], eax
test eax, eax
je 0x407158
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403d89
pop ecx
mov dword [0x4907a4], eax
mov eax, dword [0x4907a4]
cmp eax, ebx
je 0x4071b0
cmp dword [0x4907a8], ebx
je 0x4071b0
push eax
call fcn.00403e04
push dword [0x4907a8]
mov esi, eax
call fcn.00403e04
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4071b0
test edi, edi
je 0x4071b0
call esi
test eax, eax
je 0x4071a7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4071a7
test byte [ebp - 0xc], 1
jne 0x4071b0
or dword [ebp + 0x10], 0x200000
jmp 0x4071e9
mov eax, dword [0x49079c]
cmp eax, ebx
je 0x4071e9
push eax
call fcn.00403e04
pop ecx
test eax, eax
je 0x4071e9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4071e9
mov eax, dword [0x4907a0]
cmp eax, ebx
je 0x4071e9
push eax
call fcn.00403e04
pop ecx
test eax, eax
je 0x4071e9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x490798]
call fcn.00403e04
pop ecx
test eax, eax
je 0x407209
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40720b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x484d00
Capabilities:
Get hostname

Disassembly:
sub esp, 0x414
mov eax, dword [0x48c004]
xor eax, esp
mov dword [esp + 0x410], eax
push ebp
mov ebp, dword [esp + 0x41c]
push edi
cmp ebx, 0x182
jne 0x484d3f
push 0
push 0
push 0
push str.sukeje
push str.nakefajijihi
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
jmp 0x484d69
cmp ebx, 0x19f
jne 0x484d69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edi, edi
test ebx, ebx
jle 0x484de4
push esi
lea esi, [esp + 0x14]
mov dword [esp + 0x10], 5
mov dword [esp + 0x14], 0
call fcn.00484cf0
mov eax, dword [esp + 0x14]
add eax, 0x46
mov dword [esp + 0x10], eax
sub dword [esp + 0x10], 0x46
movsx eax, byte [edi + ebp]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0xc], eax
mov cl, byte [esp + 0xc]
mov byte [edi + ebp], cl
cmp ebx, 0xf
jne 0x484dde
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push str.rihuvuvujikokogububeyus
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
inc edi
cmp edi, ebx
jl 0x484d70
pop esi
pop edi
pop ebp
cmp ebx, 0x2d
jne 0x484dff
mov dword [0x2b8e9c0], 0xa62e7790
mov dword [0x2b8e9c4], 0xffffffff
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00401006
add esp, 0x414
ret
Function at 0x426915
Capabilities:
Check for software breakpoints

Disassembly:
js 0x426906
pop ss
fcom st(3)
jno 0x426914
fild dword [edx + 0x6ba472ad]
xchg ebp, eax
pop esi
popal
popal
jp 0x42694a
add dword [ebx], ecx
pushal
std
and byte [eax - 8], 0x5d
jp 0x426926
push cs
adc cl, byte [esi]
pop eax
xchg byte [edx - 0x797dc9], ch
wait
test dword [ebp + 0x4e], ebx
stosb byte es:[edi], al
aaa
add byte [esi + 0x5d859bff], 0x4e
sti
xor byte [0xd5ae4b15], dh
dec eax
xor ebp, ecx
test byte [edx - 0x77e0b6e7], bh
jp 0x42694b
or dword [esi + 0x50c7918b], ebp
iretd
int1
sbb cl, byte [eax + 0x5e6fdad3]
ja 0x426904
and bl, 0x58
jg 0x4269cb
cmp bh, byte [0x21ead8c2]
and eax, 0xa117ef21
sal dword [edx], 1
cmc
jb 0x4269ae
aad 0xb8
dec esi
or byte [ebx + 0x789de3d1], ch
cwde
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
fnstenv [eax + 0x3fd19bee]
adc eax, 0x5359359f
cmp al, 0xcc
add byte [ebx], ah
in al, dx
fldcw word [ebp - 0x5ea18e1a]
out 0x9f, al
push edx
adc bh, byte [eax + 0x7044dfbf]
nop
wait
in eax, dx
inc ebp
sub eax, 0x5c49e611
lea ebp, [esi - 0x2d]
jp 0x426a0c
mov ecx, 0x9d1de1f9
fmul dword [ebp - 0x1cd43abe]
push ss
sub ch, ah
in al, dx
in eax, dx
push ebx
imul ebp, ebp, 0x51
mov bh, 0xa2
ljmp 0x55c8
xchg ecx, eax
dec edi
or ecx, dword [ebx]
rol byte [esp + esi*2 - 0x6c7b761a], 0x7e
aas
adc bl, dl
int1
fsub st(2), st(0)
in eax, dx
mov eax, 0x77369ad4
cdq
mov edx, 0x2642504d
and byte [eax], cl
pop ds
lodsb al, byte [esi]
into
mov ecx, dword [edx - 0x52]
dec edx
ljmp 0x9f1b
fmul dword [ebx - 1]
mov edi, 0xc71f81f0
inc ebp
pushfd
cmp bh, byte [edi + 0x1334a2bf]
cmp dword [edx], ecx
test byte [edi], 0xdb
mov dl, 0x2a
jno 0x426a30
inc ebp
ljmp 0x301e
ljmp 0xf79b:0xc38acfae