joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41800e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edi, dword [esi + 0x2c]
mov eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x74]
sub eax, dword [esi + 0x6c]
mov dword [ebp - 0x10], eax
mov eax, edi
add eax, dword [esi + 0x2c]
sub eax, 0x106
cmp dword [esi + 0x6c], eax
jb 0x41809d
mov edx, dword [esi + 0x38]
lea eax, [edx + edi]
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
sub dword [esi + 0x5c], edi
mov ecx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
lea eax, [eax + ecx*2]
sub eax, 2
movzx edx, word [eax]
mov ebx, 0
cmp edx, edi
jb 0x418073
mov ebx, edx
sub ebx, edi
mov word [eax], bx
dec ecx
jne 0x418060
mov ecx, edi
mov eax, dword [esi + 0x40]
lea eax, [eax + edi*2]
sub eax, 2
movzx edx, word [eax]
mov ebx, 0
cmp edx, edi
jb 0x418094
mov ebx, edx
sub ebx, edi
mov word [eax], bx
dec ecx
jne 0x418081
add dword [ebp - 0x10], edi
mov edx, dword [esi]
cmp dword [edx + 4], 0
je 0x4180fe
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x38]
add eax, dword [esi + 0x6c]
add eax, dword [esi + 0x74]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00417c6d
add dword [esi + 0x74], eax
cmp dword [esi + 0x74], 2
jbe 0x4180e9
mov ebx, dword [esi + 0x38]
mov edx, dword [esi + 0x6c]
movzx eax, byte [ebx + edx]
mov dword [esi + 0x48], eax
mov ecx, dword [esi + 0x58]
shl eax, cl
movzx edx, byte [ebx + edx + 1]
xor eax, edx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp dword [esi + 0x74], 0x105
ja 0x4180fe
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x41801d
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x41e2e0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
mov eax, 1
ret
Function at 0x41e580
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x18
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], 0
push esi
call fcn.004219d0
add esp, 0x10
cmp eax, dword [esp + 0x30]
je 0x41e5d0
sub esp, 0xc
push 0x9a
push str.rsa_sign.c
push 0x77
push 0x77
push 4
call fcn.00425fd0
xor eax, eax
add esp, 0x20
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esi + 0x3c], 0x40
je 0x41e5e4
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x41e740
push eax
push 0xa4
push str.rsa_sign.c
mov eax, dword [esp + 0x3c]
push eax
call fcn.00424120
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x41e7bd
cmp edi, 0x72
je 0x41e670
sub esp, 0xc
push 1
push esi
push ebx
push ebp
mov esi, dword [esp + 0x4c]
push esi
call fcn.00421a90
add esp, 0x20
test eax, eax
jle 0x41e695
cmp edi, 0x72
jne 0x41e6c0
cmp eax, 0x24
jne 0x41e650
cld
mov esi, ebx
mov edi, dword [esp + 0x24]
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41e75c
lea esi, [esi]
lea edi, [edi]
sub esp, 0xc
push 0xb5
push str.rsa_sign.c
push 0x68
jmp 0x41e689
cmp dword [esp + 0x28], 0x24
je 0x41e60b
sub esp, 0xc
push 0xab
push str.rsa_sign.c
push 0x83
push 0x77
push 4
call fcn.00425fd0
add esp, 0x20
test ebx, ebx
je 0x41e6b2
sub esp, 8
mov ebp, dword [esp + 0x38]
push ebp
push ebx
call fcn.004245c0
mov dword [esp], ebx
call fcn.00424430
add esp, 0x10
mov eax, dword [esp + 4]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
push edx
push eax
lea ebp, [esp + 0x10]
push ebp
push 0
call fcn.004225d0
add esp, 0x10
test eax, eax
mov ebp, eax
je 0x41e695
mov eax, dword [eax]
sub esp, 0xc
mov edx, dword [eax]
push edx
call fcn.00423380
add esp, 0x10
cmp eax, edi
je 0x41e789
cmp edi, 4
je 0x41e7b8
cmp edi, 3
je 0x41e769
sub esp, 0xc
push 0xd3
push str.rsa_sign.c
push 0x64
push 0x77
push 4
call fcn.00425fd0
add esp, 0x20
test ebp, ebp
je 0x41e695
sub esp, 0xc
push ebp
call fcn.00422630
add esp, 0x10
jmp 0x41e695
sub esp, 8
push esi
mov ebx, dword [esp + 0x3c]
push ebx
push ebp
mov ecx, dword [esp + 0x3c]
push ecx
mov edx, dword [esp + 0x3c]
push edx
push edi
call eax
jmp 0x41e5c4
mov dword [esp + 4], 1
jmp 0x41e695
cmp eax, 7
jne 0x41e701
mov edi, dword [sym.imp.msvcrt.dll__iob]
add edi, 0x40
push edi
push 0x34
push 1
push str.signature_has_problems__re_make_with_post_SSLeay045_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [ebp + 4]
mov edx, dword [esp + 0x28]
cmp dword [eax], edx
jne 0x41e7a4
mov edi, dword [eax + 8]
cld
cmp edx, edx
mov esi, dword [esp + 0x24]
mov ecx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x41e7e1
sub esp, 0xc
push 0xda
push str.rsa_sign.c
push 0x68
jmp 0x41e710
cmp eax, 8
jmp 0x41e76c
sub esp, 0xc
push 0xa7
push str.rsa_sign.c
push 0x41
push 0x77
push 4
call fcn.00425fd0
add esp, 0x20
mov eax, dword [esp + 4]
jmp 0x41e6b6
mov dword [esp + 4], 1
jmp 0x41e71c
Function at 0x42c810
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x11c
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
add esp, 0xc
test eax, eax
je 0x42c83c
sub esp, 0xc
push eax
call sub.KERNEL32.dll_GetFileType
add esp, 0xc
test eax, eax
jne 0x42c890
lea edx, [ebp + 0xc]
push edx
push ebx
push 0xff
lea esi, [ebp - 0x108]
push esi
call sub.msvcrt.dll__vsnprintf
mov byte [ebp - 9], 0
call sub.KERNEL32.dll_GetVersion
add esp, 0x10
test eax, eax
js 0x42c86b
call fcn.0042c730
test eax, eax
jne 0x42c8b0
push 0x10
push str.OpenSSL:_FATAL
push esi
push 0
call sub.USER32.dll_MessageBoxA
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea ecx, [ebp + 0xc]
push edx
push ecx
push ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_vfprintf
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
sub esp, 8
push str.OPENSSL
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov dword [ebp - 0x10c], esi
push esi
push 0
lea esi, [ebp - 0x10c]
push esi
push 0
push 1
push 0
push 0
push 0
push 1
push eax
mov ebx, eax
call sub.ADVAPI32.DLL_ReportEventA
push ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x44df00
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0044e410
call fcn.0044e100
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x44df38
jmp 0x44dfd4
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x44df37
cmp cl, 0x22
je 0x44df90
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x44dfb0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x44dfb0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x44df70
jmp 0x44dfb0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x44df90
cmp cl, 0x22
je 0x44e010
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x44dfce
inc ebx
movzx eax, byte [ebx]
cmp al, 0x20
sete dl
cmp al, 9
sete al
or eax, edx
test al, 1
jne 0x44dfc0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x44dff2
movzx edx, word [ebp - 0x28]
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00402e49
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x44dfb0
Function at 0x4068c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068e9
xor eax, eax
test eax, eax
je 0x4068fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068fc
xor ecx, ecx
jmp 0x4068ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ac], 0
push esi
jne 0x406a59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a33
mov dword [ecx*4 + 0x4275a8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275a8]
xor eax, esi
inc ecx
dec edx
jne 0x406a6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x847521
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x8472a2
mov edi, ecx
call fcn.0084754b
add edi, 0x20b6a1e9
xor dword [eax], edx
or ecx, edi
inc eax
and edi, edi
add edi, ecx
or edi, ecx
cmp eax, ebx
jne fcn.00847521
and edi, edi
add ecx, edi
and ecx, edi
ret
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov dh, 0xce
js 0x401e9d
mov esi, dword [ebp + 0x36]
insd dword es:[edi], dx
lea eax, [ebp - 0x78]
out 0x78, eax
push eax
outsd dx, dword [esi]
call 0x114086e0
mov ecx, dword [ebp + 8]
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push eax
push ecx
add edx, 0x76
push str._s:__s___d__n
push edx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x964102ac]
add esp, 0x14
test eax, eax
je 0x401e8c
push eax
push str.Total_of__d_requests_completed_n
sub eax, 0x40c12d15
add byte [ebx - 0xa9f73c], al
adc eax, sym.imp.MSVCRT.dll_exit
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
and ebx, dword [edi - 0x45]
nop
pop edi
mov ebx, 0xec8b5590
push ebp
mov ebp, esp

Function at 0x406740
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sti
inc ebp
adc byte [ebx - 0x13a9ebb3], cl
jne 0x406755
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [esi + 0x10]
push 0
push edi
push edx
add byte [edi + 0x52], dl
mov esp, edx
push cs
jl 0x4067ab
or al, 0x9a
insd dword es:[edi], dx
push es
mov eax, dword [0x14468b00]
push 0
push edi
push eax
call sym.imp.WSOCK32.dll_WSAStartup
out 0xd2, al
push cs
pop edi
movsb byte es:[edi], byte [esi]
pop ebp
ret
push ecx
call 0xdd404a60
mov esp, dword [ebx - 0x2874e3cd]
mov ecx, 0xe
in al, 0xab
mov eax, dword [esi]
push 0xffffffffffffff8e
mov dword [eax + 0x10], edx
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
mov dword [edx], ebx
adc byte [esi], al
mov ecx, dword [eax]
push ecx
call fcn.00404a60
cmp dl, al
xor eax, eax
mov edx, edi
mov ecx, 0xe
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push 0
lea ebp, [edx + 1]
scasd eax, dword es:[edi]
push eax
adc al, 0x8b
push cs
mov edx, dword [ecx + 0x14]
mov dword [edx], ebx
mov eax, dword [esi]
mov dword [eax + 0x34], 1
mov ecx, dword [esi]
add ecx, 0x48
add al, ch
or al, bh
invalid

Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
in al, dx
adc byte [ebx - 0x74a9f361], cl
aas
adc byte [edx], ch
lea edx, [ebp - 8]
push 0x47
mov edi, dword [ebx + 0x52]
mov edx, dword [ebp + 0x69]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
mov dword [ebp - 0x36], ecx
push eax
mov ebx, dword [ecx]
add al, 0x8d
xlatb
invalid
Function at 0x403cd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x41b00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 1
push 0xa
call fcn.00408f20
add esp, 8
mov ebx, dword [sym.imp.USER32.dll_CreateWindowExW]
add eax, 8
mov dword [ebp - 8], eax
push 0
push dword [0x423cc8]
push 0x3e9
push dword [0x423cdc]
push 0x12c
push 0x2bc
push 0
push 0
push 0x50000000
push 0
push str.STATIC
push 0
call ebx
push 0
push dword [0x423cc8]
push 0x3e8
push dword [0x423cdc]
push 0x64
push 0x244
push 0xa
push 0xa
push 0x50000007
push 0
push str.STATIC
push 0
call ebx
push 0x23
lea ecx, [ebp - 8]
call fcn.004024a0
mov esi, dword [ebp - 8]
mov eax, dword [esi - 8]
lea edi, [esi - 8]
lea eax, [eax*2 + 2]
push eax
push str.ARE_YOU_SURE_YOU_WANT_TO_UNINSTALL_
push esi
call fcn.00407470
add esp, 0xc
push 0
push dword [0x423cc8]
push 0x3ef
push dword [0x423cdc]
push 0x19
push 0x21c
push 0x1e
push 0x1e
push 0x50000001
push 0
push str.STATIC
push 0
call ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xc
push eax
mov dword [0x423cd8], eax
call esi
push 0
push dword [0x423cc8]
push 0x3f3
push dword [0x423cdc]
push 0x19
push 0x21c
push 0x46
push 0x1e
push 0x50000000
push 0
push str.msctls_progress32
push 0
call ebx
push 0x3e80000
push 0
push 0x401
push eax
mov dword [0x423ccc], eax
call esi
push 0
push dword [0x423cc8]
push 0x3f4
push dword [0x423cdc]
push 0x20
push 0x64
push 0x78
push 0x1ea
push 0x50010000
push str.CANCEL
push str.BUTTON
push 0
call ebx
push 0
push dword [0x423cc8]
mov dword [0x423d04], eax
push 0x3f5
push dword [0x423cdc]
push 0x20
push 0x64
push 0x78
push 0x172
push 0x50010001
push str.UNINSTALL
push str.BUTTON
push 0
call ebx
push 5
push dword [0x423cdc]
mov dword [0x423ce0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call fcn.004091b1
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00405cb7
mov esp, ebp
pop ebp
ret
Function at 0x10014c5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, dword [ebp + 8]
xor esi, esi
cmp ebx, esi
mov dword [ebp - 4], eax
je 0x1001582
cmp word [ebx], si
je 0x1001582
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push dword [ebp - 4]
mov edi, eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test al, 2
je 0x1001530
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1001530
push esi
lea eax, [ebp - 8]
push eax
push edi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
jmp 0x1001581
add edi, edi
lea eax, [edi + 2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x1001581
push esi
push esi
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x100157a
cmp dword [ebp - 4], esi
je 0x100157a
push esi
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x1003206
Capabilities:
Query environment variable
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x10013cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100323d
push 0x10013b8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1003236
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, 0x104
push ebx
push 0x10046f0
push 0x10013a0
mov dword [0x10046e8], eax
call edi
push ebx
push 0x10048f8
push 0x1001384
call edi
cmp dword [ebp + 8], 1
jne 0x100327c
call fcn.010019b5
jmp 0x10033ab
mov edi, dword [sym.imp.ntdll.dll_wcsncmp]
push 2
pop ebx
push ebx
push 0x100137c
push dword [esi + 4]
call edi
add esp, 0xc
test eax, eax
je 0x1003379
push ebx
push 0x1001374
push dword [esi + 4]
call edi
add esp, 0xc
test eax, eax
je 0x1003379
push ebx
push 0x100136c
push dword [esi + 4]
call edi
add esp, 0xc
test eax, eax
je 0x1003379
push ebx
push 0x1001364
push dword [esi + 4]
call edi
add esp, 0xc
test eax, eax
je 0x1003379
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.010017a9
test eax, eax
je 0x1003272
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01001adb
test eax, eax
je 0x10033ab
xor eax, eax
cmp dword [ebp - 8], eax
je 0x1003343
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_AbortSystemShutdownW]
test eax, eax
jne 0x10033ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01001604
jmp 0x10033ab
cmp dword [ebp + 0xc], eax
je 0x100335f
push eax
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1003331
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x1003331
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, esi
mov dword [0x1004b0c], eax
je 0x10033ab
push esi
push 0x10031bd
push esi
push 0x65
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov eax, dword [0x1004b04]
cmp eax, esi
je 0x10033ab
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1003571
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10013e8
call fcn.01003728
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x10035ac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10035ac
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10035c4
cmp eax, 0x20b
je 0x10035b1
mov dword [ebp - 0x1c], edi
jmp 0x10035d8
cmp dword [ecx + 0x84], 0xe
jbe 0x10035ac
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x10035d2
cmp dword [ecx + 0x74], 0xe
jbe 0x10035ac
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004b20], 0xffffffff
or dword [0x1004b24], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004b1c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1004b18]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004b28], eax
call fcn.0100371e
cmp dword [0x100404c], edi
jne 0x1003633
push fcn.0100371e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01003707
push 0x1004010
push 0x100400c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1004b14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1004b10]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x34], eax
push 0x1004008
push section..data
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___winitenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01003206
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x10036aa
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x10036df
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003763
ret
Function at 0x44b9b4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5ea200]
jne 0x44b9be
repz ret
jmp fcn.0044dfe8

Function at 0x455678
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ea200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00450ef2
and dword [ebp - 0x14], 0
cmp dword [0x5ebf74], 0
mov dword [ebp - 0x18], eax
jne 0x45572b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4557d3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4557d3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5ebf74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5ebf78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x5ebf7c], eax
call edi
push eax
call esi
mov dword [0x5ebf84], eax
test eax, eax
je 0x45572b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x5ebf80], eax
mov eax, dword [0x5ebf80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x455784
cmp dword [0x5ebf84], ecx
je 0x455784
push eax
call esi
push dword [0x5ebf84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x455784
test ebx, ebx
je 0x455784
call edi
test eax, eax
je 0x45577b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45577b
test byte [ebp - 8], 1
jne 0x455784
or dword [ebp + 0x10], 0x200000
jmp 0x4557b7
mov eax, dword [0x5ebf78]
cmp eax, dword [ebp - 0x18]
je 0x4557b7
push eax
call esi
test eax, eax
je 0x4557b7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4557b7
mov eax, dword [0x5ebf7c]
cmp eax, dword [ebp - 0x18]
je 0x4557b7
push eax
call esi
test eax, eax
je 0x4557b7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5ebf74]
call esi
test eax, eax
je 0x4557d3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4557d5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044b9b4
leave
ret
Function at 0x1001792
Capabilities:
Terminate process

Disassembly:
call fcn.01001dc0
push 0x10
push 0x1001888
call fcn.01001480
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x102e178
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
jne 0x1004b83
xor esi, esi
inc esi
mov eax, dword [0x102e034]
cmp eax, esi
je 0x1004ba2
mov eax, dword [0x102e034]
test eax, eax
jne 0x100185b
mov dword [0x102e034], esi
push 0x1001880
push 0x1001874
call fcn.0100176b
pop ecx
pop ecx
test eax, eax
jne 0x1004baf
mov eax, dword [0x102e034]
cmp eax, esi
jne 0x1001826
push 0x1001870
push 0x1001864
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x102e034], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1001833
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x102e25c], ebx
jne 0x1004bc0
push dword [0x102e238]
push dword [0x102e23c]
push dword [0x102e234]
call fcn.01001a41
jmp 0x1004be2
mov dword [0x102e2a8], esi
jmp 0x1001802
cmp eax, esi
jne 0x1004b92
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x10017cd
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10017b9
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1001802
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1004c43
push 0x102e25c
call fcn.01007830
pop ecx
test eax, eax
je 0x100183f
push ebx
push 2
push ebx
call dword [0x102e25c]
jmp 0x100183f
add esp, 0xc
mov dword [0x102e2a4], eax
cmp dword [0x102e240], ebx
jne 0x1004c29
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x102e2a8], ebx
jne 0x1004c37
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x102e2a4]
call fcn.0100239c
ret