joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403004
Capabilities:
Get disk information

Disassembly:
add esp, 0xfffffc00
mov edx, esp
call fcn.00402108
cmp byte [esp], 0
je 0x40301b
mov eax, esp
jmp 0x40301d
xor eax, eax
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x403031
cmp eax, 5
je 0x403031
xor edx, edx
jmp 0x403036
mov edx, 1
mov eax, edx
add esp, 0x400
ret

Function at 0x403040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00405604
test eax, eax
je 0x40306b
test ebx, ebx
je 0x40306b
cmp word [ebx], 0
je 0x40306b
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne al
and eax, 1
pop esi
pop ebx
ret

Function at 0x4030a0
Capabilities:
Get file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
call fcn.00405604
test eax, eax
je 0x4030c2
test ebx, ebx
je 0x4030c2
cmp word [ebx], 0
je 0x4030c2
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
pop esi
pop ebx
ret
push esi
call sub.KERNEL32.DLL_GetFileAttributesA
pop esi
pop ebx
ret

Function at 0x4030cc
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
call fcn.00405604
test eax, eax
je 0x4030f9
test ebx, ebx
je 0x4030f9
cmp word [ebx], 0
je 0x4030f9
push esi
push ebx
call sub.KERNEL32.DLL_SetFileAttributesW
test eax, eax
setne al
and eax, 1
jmp 0x403108
push esi
push edi
call sub.KERNEL32.DLL_SetFileAttributesA
test eax, eax
setne al
and eax, 1
pop edi
pop esi
pop ebx
ret
Function at 0x40338c
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x403395
mov eax, dword [esp + 0x2000]
add esp, 0xfffffb30
mov ebx, edx
mov esi, eax
lea edi, [esp + 0x10b4]
lea eax, [esp + 0xc14]
call fcn.004071e8
lea eax, [esp + 0xc40]
call fcn.004071e8
lea eax, [esp + 0xc6c]
call fcn.004071e8
push 0
lea ecx, [esp + 4]
mov edx, ebx
mov eax, esi
call fcn.00406dd8
test al, al
jne 0x4033f5
xor eax, eax
jmp 0x403542
cmp byte [esp], 0
je 0x403405
cmp byte [esp + 0xc98], 0
jne 0x40340c
xor eax, eax
jmp 0x403542
mov eax, esp
call fcn.00401a94
lea edx, [esp + 0xc98]
call fcn.004019cc
test eax, eax
je 0x40343a
mov eax, esi
call fcn.00401a94
lea edx, [esp + 0xc98]
call fcn.004019cc
test eax, eax
je 0x403441
xor eax, eax
jmp 0x403542
xor ebx, ebx
mov eax, edi
mov ecx, 0x400
mov edx, esi
call fcn.00401458
push ebx
push str.rtmp_d
mov eax, edi
call fcn.00401a94
push eax
call fcn.004014f4
add esp, 0xc
mov eax, edi
xor edx, edx
call fcn.00403040
test al, al
je 0x40347f
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x403443
mov eax, edi
xor edx, edx
call fcn.00403040
test al, al
je 0x403493
xor eax, eax
jmp 0x403542
lea eax, [esp + 0x14b4]
mov ecx, 0x400
mov edx, esi
call fcn.00401458
mov eax, esp
call fcn.00401a94
push eax
lea eax, [esp + 0x14b8]
call fcn.00401a94
pop edx
call fcn.00401448
push edi
lea ecx, [esp + 0x14b8]
push ecx
call sub.KERNEL32.DLL_MoveFileA
test eax, eax
jne 0x4034d6
xor eax, eax
jmp 0x403542
lea eax, [esp + 0x18b4]
call fcn.00402324
xor ebx, ebx
xor edx, edx
mov eax, esi
call fcn.00403040
test al, al
jne 0x403503
lea eax, [esp + 0x18b4]
xor ecx, ecx
mov edx, esi
call fcn.00402510
mov ebx, eax
lea eax, [esp + 0x14b4]
push eax
push edi
call sub.KERNEL32.DLL_MoveFileA
test bl, bl
je 0x40352d
lea eax, [esp + 0x18b4]
call fcn.00402614
lea eax, [esp + 0x18b4]
call fcn.0040269c
mov al, 1
push eax
lea eax, [esp + 0x18b8]
mov edx, 2
call fcn.00402378
pop eax
add esp, 0x24d4
pop edi
pop esi
pop ebx
ret
Function at 0x403a20
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x405684
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, 0x4123d0
push ebp
mov ebp, edx
cmp dword [edi + 4], 0
mov esi, ecx
mov ebx, eax
jne 0x40569e
call fcn.0040564c
mov eax, ebp
jmp 0x4056b6
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x4056be
test al, 7
jne 0x4056a2
cmp esi, 8
jb 0x405747
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x4056c7
xor edx, edx
jmp 0x405761
mov ecx, ebx
xor cl, byte [eax + edx]
and ecx, 0xff
shr ebx, 8
mov ecx, dword [edi + ecx*4]
xor ecx, ebx
mov ebx, ecx
inc edx
cmp esi, edx
ja 0x40574b
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x405af4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x405b0b
test esi, esi
jg 0x405b12
xor eax, eax
jmp 0x405bc4
mov edx, dword [ebp - 4]
add edx, 4
lea eax, [ebp - 0x2c]
mov ecx, 0x10
call fcn.00401340
test esi, esi
jns 0x405b2c
add esi, 0xf
sar esi, 4
mov dword [ebp - 8], esi
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x405bab
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00405e80
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [eax]
xor dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 4]
xor dword [ebp - 0x18], ecx
mov ecx, dword [eax + 8]
xor dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
xor dword [ebp - 0x10], eax
mov eax, edx
mov edx, ebx
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebp - 0x18]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0xc], ecx
add ebx, 0x10
add dword [ebp + 8], 0x10
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jg 0x405b3e
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
add eax, 4
mov ecx, 0x10
call fcn.00401340
mov eax, dword [ebp - 8]
shl eax, 4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405de8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp], eax
mov esi, 1
xor eax, eax
xor ecx, ecx
mov edx, esi
mov ebx, ecx
shl edx, 4
add edx, dword [esp]
shl ebx, 2
add edx, ebx
xor ebx, ebx
add edx, 0x14
movzx edi, byte [edx + 1]
mov bl, byte [edx]
lea edi, [edi*4 + 0x415092]
lea ebx, [ebx*4 + 0x414c92]
mov bl, byte [ebx + eax]
xor bl, byte [edi + eax]
movzx edi, byte [edx + 2]
movzx edx, byte [edx + 3]
lea edi, [edi*4 + 0x415492]
lea edx, [edx*4 + 0x415892]
xor bl, byte [edi + eax]
xor bl, byte [edx + eax]
lea edx, [esp + ecx*4 + 4]
mov byte [edx + eax], bl
inc ecx
cmp ecx, 4
jl 0x405dfa
inc eax
cmp eax, 4
jl 0x405df8
mov eax, esi
lea edx, [esp + 4]
shl eax, 4
mov ecx, 0x10
add eax, dword [esp]
add eax, 0x14
call fcn.00401340
inc esi
cmp esi, 0xa
jl 0x405df6
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x410c3c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x410c45
add esp, 0xfffff92c
mov eax, dword [ebp - 4]
mov eax, 0x411860
mov dl, 1
push ebx
push esi
call fcn.0040d3ac
call fcn.00410c2c
push 0x400
lea ecx, [ebp - 0x400]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x8001
call sub.KERNEL32.DLL_SetErrorMode
lea edx, [ebp - 0x400]
mov eax, 0x41186c
call fcn.0040a248
lea eax, [ebp - 0x46d8]
call fcn.00409b80
mov edx, 0x411458
lea eax, [ebp - 0x1c44]
call fcn.00401448
xor esi, esi
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
test ebx, ebx
je 0x410cd8
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x22
jne 0x410cd8
lea eax, [ebx + 1]
mov edx, 0x22
call fcn.004013d8
mov ebx, eax
test ebx, ebx
je 0x410d0e
mov edx, 0x41145a
mov eax, ebx
call fcn.0040141c
mov ebx, eax
test eax, eax
je 0x410d0e
jmp 0x410cf1
inc ebx
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x20
je 0x410d03
cmp eax, 9
je 0x410d03
xor edx, edx
jmp 0x410d08
mov edx, 1
test dl, dl
jne 0x410cf0
mov esi, ebx
test esi, esi
je 0x410d55
xor edx, edx
lea eax, [ebp - 0x46d8]
mov dl, byte [esi]
call fcn.0040a0f8
test al, al
je 0x410d55
xor eax, eax
mov al, byte [esi + 1]
call fcn.004012f0
mov edx, eax
sub edx, 0x3f
je 0x410d4a
sub edx, 0x15
je 0x410d42
sub edx, 2
je 0x410d42
jmp 0x410d55
mov byte [ebp - 0x1c44], al
jmp 0x410d55
lea eax, [ebp - 0x46d8]
call fcn.00409e7c
lea edx, [ebp - 0x400]
lea eax, [ebp - 0x46d8]
xor ecx, ecx
call fcn.0040a0b8
lea eax, [ebp - 0x46d8]
call fcn.00409d68
mov dl, byte [ebp - 0x2640]
mov eax, dword [ebp - 0x2644]
call fcn.00409638
lea eax, [ebp - 0x2a47]
call fcn.00409604
cmp byte [ebp - 0x25f8], 0
jne 0x410da5
cmp dword [ebp - 0x2644], 3
je 0x410da5
xor eax, eax
jmp 0x410daa
mov eax, 1
mov byte [0x411869], al
mov al, byte [ebp - 0x205a]
mov byte [0x41186a], al
lea eax, [ebp - 0x46d8]
call fcn.00409df0
lea eax, [ebp - 0x46d8]
call fcn.0040a020
lea eax, [ebp - 0x46d8]
mov edx, 2
call fcn.00409bb8
call fcn.00402c48
mov eax, dword [0x411860]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x576c6f42
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1c6e4982
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x40b210
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40a015
lea edi, [esi - 0x9015]
push edi
or ebp, 0xffffffff
jmp 0x40b232
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40b239
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40b228
mov eax, 1
add ebx, ebx
jne 0x40b24b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40b240
jne 0x40b25c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b240
xor ecx, ecx
sub eax, 3
jb 0x40b270
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40b2e2
mov ebp, eax
add ebx, ebx
jne 0x40b27b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40b288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40b2ac
inc ecx
add ebx, ebx
jne 0x40b298
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40b28d
jne 0x40b2a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b28d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40b2cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40b2bd
jmp 0x40b22e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40b2cc
add edi, ecx
jmp 0x40b22e
pop esi
mov edi, esi
mov ecx, 0x2400
jmp 0x40b30f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40b30f
cmp ecx, 4
jb 0x40b314
mov eax, dword [edi]
sub al, 0
jne 0x40b30f
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
sub ecx, 4
stosd dword es:[edi], eax
sub ecx, 1
jae 0x40b2ec
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40b35c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40b31a
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb058]
or eax, eax
je 0x40b356
mov dword [ebx], eax
add ebx, 4
jmp 0x40b337
call dword [esi + 0xb054]
mov ebp, dword [esi + 0xb05c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40b390
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4064f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [0x456d5c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0xbc75ca47
mov eax, dword [ebp - 0x10]
mov ecx, eax
sub ecx, 0x5ab3f44f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jg 0x40656a
jmp 0x406528
mov eax, dword [ebp - 0x14]
sub eax, 0x87b2551b
mov dword [ebp - 0x1c], eax
je 0x4065e3
jmp 0x40653e
mov eax, dword [ebp - 0x14]
sub eax, 0xbc75ca47
mov dword [ebp - 0x20], eax
je 0x406585
jmp 0x406554
mov eax, dword [ebp - 0x14]
sub eax, 0xdd347698
mov dword [ebp - 0x24], eax
je 0x4065b7
jmp 0x406580
mov eax, dword [ebp - 0x14]
sub eax, 0x5ab3f450
mov dword [ebp - 0x28], eax
je 0x4065a3
jmp 0x406580
jmp 0x4065eb
mov eax, 0xdd347698
mov ecx, 0x5ab3f450
mov edx, dword [ebp - 4]
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x10], eax
jmp 0x4065eb
mov eax, dword [0x456d5c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x87b2551b
jmp 0x4065eb
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [0x456d5c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x87b2551b
jmp 0x4065eb
mov eax, dword [ebp - 8]
add esp, 0x28
pop ebp
ret
jmp 0x40650c
Function at 0x421c0a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4566a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00420088
mov dword [ebp - 0x14], eax
cmp dword [0x457d7c], edi
jne 0x421cfb
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x421c88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x421ddb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x421ddb
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421ddb
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x457d7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x457d80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x457d84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457d8c], eax
test eax, eax
je 0x421cf8
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x457d88], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x421d20
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x421d13
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x421d35
push 4
pop eax
jmp 0x421ddd
cmp dword [ebp - 0x14], edi
je 0x421d35
push dword [0x457d7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x421d1a
mov eax, dword [0x457d88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x421d93
cmp dword [0x457d8c], esi
je 0x421d93
push eax
call ebx
push dword [0x457d8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x421d93
test eax, eax
je 0x421d93
call ecx
test eax, eax
je 0x421d88
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x421d88
test byte [ebp - 8], 1
jne 0x421d93
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x421dc3
mov eax, dword [0x457d80]
cmp eax, esi
je 0x421dc0
push eax
call ebx
test eax, eax
je 0x421dc0
call eax
mov edi, eax
test edi, edi
je 0x421dc0
mov eax, dword [0x457d84]
cmp eax, esi
je 0x421dc0
push eax
call ebx
test eax, eax
je 0x421dc0
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x457d7c]
call ebx
test eax, eax
je 0x421ddb
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x421ddd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421dec
leave
ret
Function at 0x10003cd9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x10003d26
cmp byte [esi + 0x3d], bl
je 0x10003d26
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003d55
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, ebx
je 0x10003d2d
sub eax, 1
je 0x10003d30
dec eax
sub eax, 1
jne 0x10003d55
mov byte [esi + 0x3d], bl
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003d4d
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.10057947
add esp, 0x10
cmp edi, eax
jne 0x10003d55
cmp byte [esi + 0x3d], bl
sete al
jmp 0x10003d28
xor al, al
jmp 0x10003d28

Function at 0x10006575
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x1000658f
xor eax, eax
jmp 0x1000665f
mov eax, dword [esi + 0x20]
push ebp
mov ecx, dword [eax]
test ecx, ecx
je 0x100065bd
mov edx, dword [esi + 0x30]
mov ebp, dword [edx]
lea eax, [ecx + ebp]
cmp ecx, eax
jae 0x100065bd
lea ecx, [ebp - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x1000665e
cmp dword [esi + 0x4c], 0
je 0x1000665c
mov ecx, esi
call fcn.100044c5
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100065e9
push dword [esi + 0x4c]
push eax
call fcn.10001e88
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x1000665c
mov byte [esp + 0x10], al
lea eax, [esp + 0x3c]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x21]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x1000662d
sub eax, 1
je 0x1000662d
dec eax
sub eax, 1
jne 0x1000665c
push dword [esi + 0x4c]
push dword [esp + 0x14]
jmp 0x100065db
mov ebp, dword [esp + 0x3c]
lea eax, [esp + 0x18]
sub ebp, eax
je 0x1000664c
push dword [esi + 0x4c]
push ebp
push 1
push eax
call fcn.10057947
add esp, 0x10
cmp ebp, eax
jne 0x1000665c
lea eax, [esp + 0x10]
mov byte [esi + 0x3d], 1
cmp dword [esp + 0x14], eax
mov eax, ebx
jne 0x1000665e
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x28
ret 4