joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c540
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49cd9d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x230]
test ecx, ecx
jne 0x40c57e
xor al, al
jmp 0x40c733
mov eax, dword [esi + 0x248]
shr eax, 2
test al, 1
jne 0x40c5a4
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40c5a4
push 0
push dword [esi + 0x230]
call dword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x14], 1
mov dword [ebp - 4], 0
push 0x20a
mov dword [ebp - 0x18], 0
call fcn.0048a2cb
add esp, 4
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x1c], ebx
push 0x104
mov word [ebx + 0x208], ax
push ebx
mov word [ebx], ax
push dword [esi + 0x230]
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esi + 0x3c], 0
je 0x40c63b
mov edi, dword [esi + 0x40]
test edi, edi
je 0x40c63b
cmp edi, 1
jl 0x40c63b
lea ebx, [edi + edi*8]
shl ebx, 3
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x40c62f
cmp edi, dword [esi + 0x40]
jg 0x40c62f
cmp dword [ebx + eax + 0xc], 0
je 0x40c62f
push edi
mov ecx, esi
call fcn.00412900
dec edi
sub ebx, 0x48
cmp edi, 1
jge 0x40c614
mov ebx, dword [ebp - 0x1c]
mov eax, dword [esi + 0x238]
mov ecx, dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
je 0x40c654
push eax
call ecx
mov ecx, dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x23c]
test eax, eax
je 0x40c661
push eax
call ecx
mov eax, dword [esi + 0x1fc]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x40c67d
cmp dword [esi + 0x204], 4
je 0x40c67d
push eax
call edi
mov eax, dword [esi + 0x200]
test eax, eax
je 0x40c68a
push eax
call edi
mov eax, dword [esi + 0x1e0]
test eax, eax
je 0x40c697
push eax
call edi
mov eax, dword [esi + 0x1e8]
test eax, eax
je 0x40c6a8
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 0x260]
test eax, eax
je 0x40c6b9
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov eax, dword [esi + 0x244]
test eax, eax
je 0x40c6ca
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov eax, dword [esi + 0x248]
mov ecx, dword [esi + 0x230]
shr eax, 2
test al, 1
jne 0x40c712
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x248]
shr eax, 1
test al, 1
jne 0x40c71f
xor eax, eax
cmp word [ebx], ax
je 0x40c71f
inc eax
cmp word [ebx + eax*2], 0
jne 0x40c6f7
test eax, eax
je 0x40c71f
push dword [esi + 0x11c]
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassW]
jmp 0x40c71f
push esi
push 0x40b680
push ecx
call dword [sym.imp.COMCTL32.dll_RemoveWindowSubclass]
push 0
mov ecx, esi
call fcn.00417000
push ebx
call fcn.00489f13
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489f05
mov esp, ebp
pop ebp
ret
Function at 0x415120
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3fc
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
lea eax, [edi + 0x40]
cmp esi, 0xffffffff
jne 0x415148
mov esi, dword [eax]
mov ecx, dword [edi + 0x3c]
test ecx, ecx
je 0x415367
cmp esi, 1
jl 0x415367
cmp esi, dword [eax]
jg 0x415367
lea eax, [esi + esi*8]
shl eax, 3
mov dword [ebp - 0x3fc], eax
cmp dword [eax + ecx + 0xc], 0
je 0x415367
cmp dword [eax + ecx], 0x26
jne 0x415229
push 0x3ac
lea eax, [ebp - 0x3e8]
push 0
push eax
call fcn.0048ba10
mov eax, dword [edi + 0x230]
add esp, 0xc
mov dword [ebp - 0x3f4], eax
xor eax, eax
mov dword [ebp - 0x3f8], 0x3bc
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0x3ec], 4
test ebx, ebx
je 0x4151e2
cmp word [ebx], ax
je 0x4151d8
nop dword [eax]
inc eax
cmp word [ebx + eax*2], 0
jne 0x4151d0
mov ecx, 0x7f
cmp eax, ecx
cmovg eax, ecx
push eax
push ebx
lea eax, [ebp - 0x3e0]
push 0x80
push eax
call fcn.0048d1b3
add esp, 0x10
mov dword [ebp - 0xd8], 3
lea eax, [ebp - 0x3f8]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
setne al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f05
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 0x238], 0
jne 0x41528b
push 0
push dword [edi + 0x11c]
push 0
push dword [edi + 0x230]
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SHDefExtractIconW
push 0
push 0x4bff5c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 0x238], eax
test eax, eax
je 0x415367
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x3fc]
xorps xmm0, xmm0
add ecx, dword [edi + 0x3c]
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 0x34], 0x30
mov eax, dword [ecx + 4]
mov dword [ebp - 0x2c], eax
cmp dword [ecx], 0x1c
jne 0x415308
push 0
push esi
push 0x419
mov dword [ebp - 0x30], 0x10
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x415367
lea ecx, [ebp - 0x24]
push ecx
push eax
mov eax, dword [edi + 0x3c]
lea ecx, [esi + esi*8]
push 0x41d
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x415367
mov dword [ebp - 0x28], esi
jmp 0x415315
mov dword [ebp - 0x30], 0x11
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x186a0
push 0
push 0x418
push dword [edi + 0x238]
call esi
mov eax, dword [edi + 0x11c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x432
push dword [edi + 0x238]
mov dword [ebp - 0x10], ebx
call esi
cmp eax, 1
sete al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00489f05
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00489f05
mov esp, ebp
pop ebp
ret 0x10
Function at 0x415490
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0xffffffff
jne 0x4154a3
mov eax, dword [edi + 0x40]
mov esi, dword [edi + 0x3c]
test esi, esi
je 0x415548
cmp eax, 1
jl 0x415548
cmp eax, dword [edi + 0x40]
jg 0x415548
lea ebx, [eax + eax*8]
cmp dword [esi + ebx*8 + 0xc], 0
je 0x415548
cmp dword [esi + ebx*8], 0x1c
mov ecx, dword [esi + ebx*8 + 4]
jne 0x415508
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push eax
push 0x419
push ecx
call esi
cmp eax, 0xffffffff
je 0x415548
push dword [ebp + 0xc]
push eax
mov eax, dword [edi + 0x3c]
push 0x433
push dword [eax + ebx*8 + 4]
call esi
pop edi
test eax, eax
pop esi
setne al
pop ebx
pop ebp
ret 8
mov esi, dword [ebp + 0xc]
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x415548
mov eax, dword [edi + 0x3c]
push dword [eax + ebx*8 + 4]
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x415548
push 2
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi]
sub dword [esi + 8], eax
mov eax, dword [esi + 4]
sub dword [esi + 0xc], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
Function at 0x416520
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
cmp eax, 0xffffffff
jne 0x416531
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4165bf
cmp eax, 1
jl 0x4165bf
cmp eax, dword [ebx + 0x40]
jg 0x4165bf
lea eax, [eax + eax*8]
shl eax, 3
mov dword [ebp + 8], eax
cmp dword [eax + ecx + 0xc], 0
je 0x4165bf
cmp dword [eax + ecx], 0xf
push esi
push edi
jne 0x4165ac
push 0
push 0
push 0x1004
push dword [eax + ecx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
test edi, edi
je 0x4165ac
lea ecx, [edi - 1]
cmp ecx, 0xffffffff
jl 0x4165ac
xor esi, esi
test edi, edi
jle 0x4165ac
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp + 8]
push 0xf000
push esi
push 0x102c
push dword [ecx + eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
test al, 1
jne 0x4165b6
inc esi
cmp esi, edi
jl 0x416585
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret 8
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
xor eax, eax
pop ebx
pop ebp
ret 8
Function at 0x418b50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d1ad
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4d7200]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x1c], 0
mov eax, dword [ebp + 8]
je 0x418d04
cmp dword [ebx], 1
jl 0x418d04
cmp eax, 0xfffffffe
jg 0x418d04
cmp dword [ebx + 4], 2
jne 0x418ba8
cmp eax, dword [ebx + 8]
je 0x418d04
mov ecx, 0xffffff9c
cmp eax, ecx
cmovge ecx, eax
mov eax, dword [ebx + 0x38]
mov dword [ebp + 8], ecx
cmp eax, 0xffffffff
je 0x418bf2
test eax, eax
je 0x418bf2
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebx + 0x34], 1
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x418bf2
cmp eax, 0xffffffff
je 0x418bf2
push 0
push eax
call edi
cmp eax, 0x102
jne 0x418bf2
push 0x1e
call esi
jmp 0x418bd4
mov ecx, dword [ebx + 0xc]
mov edx, ecx
push dword [ebx + 0x18]
call fcn.00405060
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x1c]
push eax
push eax
push esi
push 0
push dword [ebx]
call fcn.00413d30
mov eax, dword [ebx]
mov edx, dword [ebx + 0x1c]
test eax, eax
jne 0x418c2e
mov eax, dword [edx + 0x230]
jmp 0x418c5a
lea ecx, [edx + 0x40]
cmp eax, 0xffffffff
jne 0x418c38
mov eax, dword [ecx]
mov edx, dword [edx + 0x3c]
test edx, edx
je 0x418c58
cmp eax, 1
jl 0x418c58
cmp eax, dword [ecx]
jg 0x418c58
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x418c58
mov eax, dword [edx + eax*8 + 4]
jmp 0x418c5a
xor eax, eax
mov edx, dword [ebx + 0x18]
lea edi, [ebx + 0x20]
mov dword [edi], eax
mov eax, dword [ebx + 0x14]
mov dword [ebx + 0x24], eax
mov eax, edx
shr eax, 0x10
movzx ecx, al
push 0
movzx eax, dl
and edx, 0xff00
shl eax, 0x10
push 0
or ecx, eax
mov dword [ebx + 0x34], 0
mov eax, dword [ebx + 0xc]
or ecx, edx
push edi
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 8]
push 0x40bb70
push 0
neg eax
mov dword [ebx + 0x28], ecx
push 0
mov dword [ebx + 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebx + 0x38]
mov edi, eax
cmp ecx, 0xffffffff
je 0x418cc1
test ecx, ecx
je 0x418cc1
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x38], edi
test edi, edi
jne 0x418ccf
mov dword [ebx + 0x38], 0xffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [ebx + 0x3c]
mov dword [ebx + 8], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 4], 2
mov edx, dword [eax + 0x230]
test ecx, ecx
je 0x418cf9
test edx, edx
je 0x418cf9
mov eax, dword [ecx]
push 1
push edx
push ecx
call dword [eax + 0x28]
test esi, esi
je 0x418d04
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41a580
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d30d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x4ba0b8
push 1
push 0
push 0x4ba0a8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41a69e
cmp dword [ebp - 0x14], 0
je 0x41a69e
push 0x4bfb80
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0
call fcn.00401420
mov dword [ebp - 4], 0
mov edx, dword [eax]
test edx, edx
je 0x41a5ff
mov edx, dword [edx]
jmp 0x41a601
xor edx, edx
mov eax, dword [ebp - 0x14]
lea esi, [ebp - 0x18]
push esi
push 0
push 0
mov ecx, dword [eax]
push 0
push 0
push 0
push 0
push edx
push eax
call dword [ecx + 0xc]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x41a674
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x41a66d
test esi, esi
je 0x41a66d
mov eax, dword [esi]
test eax, eax
je 0x41a64b
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x41a662
push eax
call fcn.00489f13
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.0048a2bd
add esp, 8
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41a6a0
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov eax, dword [ebp - 0x18]
jmp 0x41a6a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00489f05
mov esp, ebp
pop ebp
ret
Function at 0x41ccd0
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x230]
cmp eax, 0xffffffff
je 0x41cdd1
test eax, eax
je 0x41cdd1
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + 4]
cmp edi, 0xc
jae 0x41cd99
mov eax, dword [esi]
test eax, eax
je 0x41cd0d
push eax
call fcn.00489f13
add esp, 4
push 0xc
call fcn.0048a2cb
add esp, 4
mov dword [esi + 4], 0xc
mov edi, eax
lea ecx, [ebx + 4]
mov eax, dword [ebp + 8]
mov dword [esi], edi
push 0
push ecx
push 8
push edi
push 0xc
push edi
mov dword [edi], eax
mov dword [edi + 4], 0
push 0x2d1400
push dword [ebx + 0x230]
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41cdd1
mov eax, dword [edi + 4]
test eax, eax
je 0x41cdd1
mov edi, 0xc
cmp eax, edi
jbe 0x41cd99
mov ecx, dword [esi]
mov edi, eax
add eax, 0xa
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x41cd7f
push ecx
call fcn.00489f13
mov eax, dword [ebp + 0xc]
add esp, 4
push eax
call fcn.0048a2cb
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push eax
mov dword [esi], eax
mov dword [esi + 4], ecx
call fcn.0048ba10
add esp, 0x10
mov eax, dword [esi]
mov ecx, dword [ebp + 8]
push 0
mov dword [eax], ecx
mov dword [eax + 4], 0
lea eax, [ebx + 4]
push eax
push edi
mov dword [eax], 0
mov ecx, dword [esi]
push ecx
push edi
push ecx
push 0x2d1400
push dword [ebx + 0x230]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x41e1f0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
movups xmm0, xmmword [0x4c0508]
mov ecx, dword [0x4c0538]
mov ebx, eax
mov dword [ebp - 8], ecx
mov cx, word [0x4c053c]
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 4], cx
mov ecx, edi
movups xmm0, xmmword [0x4c0518]
push 0x4c0540
movups xmmword [ebp - 0x28], xmm0
movups xmm0, xmmword [0x4c0528]
movups xmmword [ebp - 0x18], xmm0
call fcn.00401860
mov esi, 3
mov eax, 8
nop
test ebx, eax
je 0x41e265
inc esi
add eax, eax
cmp esi, 0x1a
jb 0x41e250
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [edi], 0
jne 0x41e27e
push 2
call fcn.0048a2cb
add esp, 4
mov dword [edi], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 4], ecx
mov ecx, dword [edi]
mov ax, word [ebp + esi*2 - 0x38]
pop edi
pop esi
mov word [ecx], ax
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ac36
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48ac75
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48ac75
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48ac75
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x48ac75
cmp dword [ecx + 0x74], 0xe
jbe 0x48ac75
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x49a940
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49a96d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49a96d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422004]
jne 0x40100a
repz ret
jmp fcn.004011ef

Function at 0x4030bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040206e
and dword [ebp - 0x14], 0
cmp dword [0x424aac], 0
mov dword [ebp - 0x18], eax
jne 0x40316e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x403216
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x403216
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x424aac], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x424ab0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x424ab4], eax
call edi
push eax
call esi
mov dword [0x424abc], eax
test eax, eax
je 0x40316e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x424ab8], eax
mov eax, dword [0x424ab8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4031c7
cmp dword [0x424abc], ecx
je 0x4031c7
push eax
call esi
push dword [0x424abc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4031c7
test ebx, ebx
je 0x4031c7
call edi
test eax, eax
je 0x4031be
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4031be
test byte [ebp - 8], 1
jne 0x4031c7
or dword [ebp + 0x10], 0x200000
jmp 0x4031fa
mov eax, dword [0x424ab0]
cmp eax, dword [ebp - 0x18]
je 0x4031fa
push eax
call esi
test eax, eax
je 0x4031fa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4031fa
mov eax, dword [0x424ab4]
cmp eax, dword [ebp - 0x18]
je 0x4031fa
push eax
call esi
test eax, eax
je 0x4031fa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x424aac]
call esi
test eax, eax
je 0x403216
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x403218
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x4054c0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x422b10]
sub esp, 0x10
push esi
mov esi, dword [0x469e70]
push edi
mov edi, dword [0x46a14c]
push eax
call fcn.004053c0
add esp, 4
cmp dword [0x46a14c], 0x2f
jne 0x405520
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Bihux_nivew_zuziduzaz_winojego_roli
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push esi
call fcn.00405410
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4057d0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x46a14c]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
nop
cmp eax, 0x8cf
jne 0x4057f2
push 0
push 0
call edi
mov eax, dword [0x46a14c]
cmp esi, 0x845013
jne 0x405809
mov eax, dword [0x423930]
add eax, 0xa231
mov dword [0x46a14c], eax
cmp eax, 0x141
jne 0x405824
mov dword [0x424fe8], 0xec58acac
mov dword [0x424fec], 0xffffffff
inc esi
cmp esi, 0xbbe2a98
jl 0x4057e0
call fcn.00405530
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x40c530
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c552
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c548
mov eax, 1
add ebx, ebx
jne 0x40c56b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c560
jne 0x40c57c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c560
xor ecx, ecx
sub eax, 3
jb 0x40c590
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c602
mov ebp, eax
add ebx, ebx
jne 0x40c59b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c5a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c5cc
inc ecx
add ebx, ebx
jne 0x40c5b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c5ad
jne 0x40c5c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c5ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c5ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c5dd
jmp 0x40c54e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c5ec
add edi, ecx
jmp 0x40c54e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c654
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c609
mov ecx, edi
jns 0x40c638
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc054]
or eax, eax
je 0x40c64e
mov dword [ebx], eax
add ebx, 4
jmp 0x40c626
call dword [esi + 0xc064]
mov ebp, dword [esi + 0xc058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c688
sub esp, 0xffffff80
jmp 0x40a3cc