joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a398
Capabilities:
Encode data using xor

Disassembly:
int1
fidiv dword [ecx - 0x50]
popal
std
mov word [ecx], fs
hlt
test eax, 0x4b8dafe0
sbb ecx, dword [ecx]
dec ecx
adc eax, 0x90259a14
fadd qword [edi - 0x56d9f8a8]
xlatb
inc eax
shl esp, 0x5a
mov dl, byte [ebp + 0x7d39d483]
cmp ecx, 0x3c
dec eax
jg 0x42a379
and dword [ebp + 0x32], edx
aas
adc eax, 0xa894fcbd
mov dh, 0x20
out dx, eax
in eax, 0xe2
cmpsd dword [esi], dword es:[edi]
mov al, 0x4d
add dword [esi + 0x31], ecx
mov ebp, 0xeda81d32
xor dword [ebp - 0x1257e2ce], edi
fbld tbyte [esi - 5]
jno 0x42a3cf
or dword [edx], 0xfc3bef06
or al, byte [esi]
out dx, eax
cmp edi, esp
out dx, eax
sahf
xchg esi, eax
jns 0x42a3db
clc
push 0xffffffffffffffdd
jnp 0x42a379
sub al, 0xbd
jle 0x42a41a
jbe 0x42a461
cmp byte [edi], cl
hlt
push ebx
invalid
dec esi
cmpsb byte [esi], byte es:[edi]
out dx, al
pop ebp
test byte ss:[edx], bl
lahf
adc eax, 0xc2f6e2b5
jb 0x42a478
insd dword es:[edi], dx
adc ch, byte [ebp + 0xa]
mov ah, 0x83
mov esi, 0x5dd7bfe4
or dh, byte [ebx + eax*4 - 0x28401b42]
pop ebp
inc ecx
or al, 0x43
or al, 0x15
dec edi
out 0xdc, al
xor dl, byte [ebx - 0x74]
or byte [edi + ebx*8], ah
adc al, 0x48
dec eax
push es
mov ebx, 0xea38d644
adc byte [0xcbcdc9c0], ch
aam 0x6b
jae 0x42a504
jbe 0x42a44f
ljmp 0x9ff6:0x1706f537
inc esp
pop ebp
hlt
inc esp
mov ebx, 0x4e3a9d55
cdq
daa
enter 0xfffffffffffffad6, 0xfffffffffffffff0
sub eax, 0x3e62bd53
mov eax, dword [0xb1a6b874]
xchg ecx, eax
dec esi
xchg ebp, eax
loopne 0x42a4ae
invalid
mov dl, 0x74
push edx
je 0x42a558
push esp
inc ecx
mov bl, 0x14
in eax, dx
je 0x42a4f2
xchg esp, eax
sbb ecx, dword [esi]
fist dword [ecx]
fsubr st(0)
mov ah, 0x58
rep movsb byte es:[edi], byte [esi]
jno 0x42a4e7
aad 0xe3
dec ebx
xor edx, dword [ebp + 0xc]
fidivr word [esi + 7]
imul edx, dword [edi + 0x57e321ee], 0x1d
lcall 0xfb33, 0xb46eea0d
invalid
cli
arpl word [ecx + edi*2 - 0x434b182e], sp
shr byte [ebp - 0x5cd9b176], cl
fsub dword [ebp - 0x9b624d2]
mov ah, 0x5f
ljmp 0x53b

Function at 0x441d45
Capabilities:
Encode data using xor

Disassembly:
aam 0x8c
sbb al, bl
mov edx, eax
add al, 0xc6
mov al, 9
sub edx, dword [ebx + 0x1f]
or dword [ebx], ebp
push ebx
pop ds
das
nop
inc esp
invalid
sbb al, 0x7b
mov dword [0x3daa741e], eax
mov ebp, 0x75739c1a
push cs
jnp 0x441ceb
push ds
je 0x441cf5
cmp eax, 0x739c1abd
jne 0x441d60
aam 0x79
xor byte [ebp - 0xabc12f6], bl
in eax, dx
inc ebx
cmc
jle 0x441d46
in eax, 0x92
outsd dx, dword [esi]
into
jae 0x441d57
nop
pop esp
dec ebp
adc byte [esi + edx*4 + 0x4ca74a00], cl
enter 0xffffffffffffa762, 0x5c
iretd
Function at 0x4435c7
Capabilities:
Encode data using xor

Disassembly:
xchg edi, ecx
imul esp, dword [ecx + 0x66943658], 0xffffffcb
cmp al, 0x8b
push ds
loope 0x44361d
push ebx
shr ecx, cl
mov ebp, dword [0xaf0750ce]
rol dl, cl
mov cl, byte [esi + 0x31]
jg 0x44363b
sbb al, 0x88
add dh, bl
push esi
mov dword [0x82cccbf9], eax
mul dword [ebx + ebx*8 + 0x47]
daa
push esi
mov ebp, dword [edi - 8]
loop 0x443656
push 0x41c75e03
mov bl, 0x61
retf
pop ss
fldcw word [edx]
or eax, 0xdc91db58
adc ecx, ecx
cmp byte [ebp + 0x42], 0xf5
xor cl, byte [ecx]
xchg ebp, eax
mov bh, byte [edi - 0x4faa4aaa]
aam 0xd0
loope 0x44365e
mov ch, 0x55
mov al, 0xd4
shl cl, 1
inc eax
invalid
sub byte [eax - 0x20], 0xb
loopne 0x44364a
in eax, 0x19
cmp byte [ecx], 0x9e
mov dword [0xbe58fe7e], eax
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
test bl, bl
mov ah, 0x77
movsd dword es:[edi], dword [esi]
ljmp 0x7878
js 0x4436d0
loope 0x443617
xchg esp, eax
imul ebp, dword [esi + 0x5b], 0xd81743f1
or al, 0xa
int1
inc ebx
pop ss
fmul dword [edx + ecx]
pop ebx
out 0x89, eax
int1
mov edx, 0x89e93d0c
jge 0x44363d
jbe 0x443603
invalid
xchg byte [0x580fc4ba], cl
les ecx, [edi]
pop eax
neg dword [ebx]
sahf
cmp eax, 0xe3500372
ror byte [esi + 0x74d6000d], 0xd5
imul esp, dword [edx + 0xa], 0x72
xchg edi, eax
imul edx, dword [esp + esi*8], 0xd333b8aa
mov ch, 0x38
salc
cmp edi, ebx
out 0x68, eax
out 0x65, eax
add dword [eax - 0x78458328], esi
or byte [eax - 0x1fff13bc], cl
xor edx, dword [eax]
mov ebx, dword [ebx - 0x21bf5da5]
wait
push ds
jle 0x4436d3
xor esp, dword [esi + eax*2 + 0x3590c1e]
jmp 0x3f95b0b7

Function at 0x4571fb
Capabilities:
Encode data using xor

Disassembly:
mov bl, 4
aas
sahf
xor dword [eax], edi
out 0x32, al
in al, 7
out dx, al
rol edi, 1
stosd dword es:[edi], eax
pop ss
les esp, [ebx + 2]
div dword [edi - 0x41bf8b30]
jg 0x4571f7
cmc
invalid

Function at 0x46bcf3
Capabilities:
Encode data using xor

Disassembly:
jne 0x46bcf9
inc eax
ret
call 0xd8dca583
popfd
xor dl, dh
add ecx, ebp
add dword [eax], 0xd7c62d10
out 0x2b, al
adc byte [0x37f72e8b], 0xc2
and al, 0x89
mov bl, byte [ebp - 0x52]
adc dword [edx - 0x45d2c4d6], ecx
bound eax, qword [edi + 0x15]
sbb dword [esi], 0xffffffe6
pop eax
sbb eax, 0x5e911790
rol dword [ebp - 0x2a590a26], 0xdd
or al, dl
pop es
loope 0x46bd47
out dx, al
cwde
insd dword es:[edi], dx
mov ch, 0x15
xor byte [ebx + 0x39], cl
test dword [ebx - 0x5519ea85], edx
adc byte [edx - 6], al
invalid
push ds
jge 0x46bd35
mov dh, 0x72
sub eax, 0xb9119c27
cmp cl, byte [edx + ecx]
out dx, eax
invalid
Function at 0x472450
Capabilities:
Encode data using xor

Disassembly:
sub dh, ch
ret
lcall 0x74d9, 0xfa34cf3f
dec ebx
cbw
in al, 0x7b
or eax, 0x1b34544
add bl, byte [esi + 0x1e]
call 0xaf9a9a66
out dx, eax
fidiv dword [edi + 0x1d9038d3]
in eax, dx
jae 0x4723ef
dec esp
inc ecx
jno 0x472435
test byte [edi - 0x275a0d1c], bl
in al, dx
push 0xffffffffffffffa0
sub eax, 0xcaa1308
clc
xor byte [esi - 0x70], dl
or al, dl
cmp ch, ah
adc dl, byte [ebx]
sbb dword [esp + ecx + 0x1726e91d], esi
bound esi, qword [edx + 0x7b]
pushal
mov esp, 0x5c8da641
insd dword es:[edi], dx
outsb dx, byte [esi]
cmp byte [esi], 0xbc
cmpsb byte [esi], byte es:[edi]
mov bh, 0xae
scasb al, byte es:[edi]
cld
das
push ebx
cld
jg 0x47243c
mov eax, 0xbf0db1e8
mov dl, 0x1b
or byte [edx], dh
test byte [esi + 0x136a030b], bh
dec esi
mov ch, 0x44
in al, dx
xor cl, dl
fadd qword [edx + 0x668f0832]
nop
mov al, 0xa9
dec ebp
lcall 0xaaf6, 0x91a73c49
mov eax, dword [0x9276fcac]
cmp edi, dword [ebp + 0x62c41d7]
nop
pop edx
sub al, 0x23
mov bh, 9
movsd dword es:[edi], dword [esi]
mov ebx, 0x7b5ed8fb
mov ch, 0x29
mov edx, 0x1b236fbf
dec ebp
mov byte [0x44a9c102], al
mov bh, byte [ebx]
nop
xchg esi, eax
scasb al, byte es:[edi]
test eax, 0xe680d314
pushal
cmp byte [esi - 0x2c], bh
mov dword [0x42ea8ef0], eax
loope 0x472497
das
add byte [edi - 0x5a68e9c4], bh
mov al, byte [0x50a2d60d]
xchg dword [eax + 0x5b153eaf], edx
or al, 0xb3
insb byte es:[edi], dx
mov ah, 0x90
insd dword es:[edi], dx
invalid

Function at 0x4856ee
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x19
sbb eax, dword [edi + 0x3487cfa0]
xor ecx, eax
and dl, byte [esi + 0x73]
sbb eax, 0xcce24bd1
pop ebx
js 0x4856db
mov ecx, 0xf62241cd
popfd
ja 0x48575e
xchg esp, eax
mov edi, 0x52d061b3
psubq mm2, qword [esi + ecx - 0x79]
sbb eax, 0x2f89f07
iretd
invalid
pop ecx
mov ebx, dword [esi]
popal
mov al, byte [0x1cd25eb5]
pop ds
fist dword [ebx]
add ebx, dword [eax + 0x66]
inc ecx
fisttp dword [ebp + 0x65]
in al, 0x72
pop ebx
fild qword [ebx - 0x71e3d12b]
dec ebp
outsd dx, dword [esi]
xchg eax, esp
fiadd word [eax + 1]
sbb dword [ebx + esi - 0x56], 0xba7d854c
loopne 0x485749
inc eax
add dword [ecx + 0x4caa335c], eax
test dword [ebp - 0x46], edi
sub byte [esi - 0x7356da9b], bh
pushal
test dword [esi - 0x52], esi
jbe 0x485769
and edx, dword [ebp + 0x36]
cmp byte [ebx + 4], al
scasd eax, dword es:[edi]
cdq
jo 0x4857b6
wait
pop edx
test edi, ebx
add eax, 0xfb9e6f4d
imul ecx, dword [ecx - 0x73], 0x4e
lahf
mov bl, 0x9e
jb 0x485720
mov eax, dword [0x119fdbe9]
push eax
sub byte [edi], cl
clc
sbb eax, 0x9a8f2d86
mov dword [0x14f4c472], eax
mov bl, 0x3e
adc eax, dword [edx + 0x38]
push edi
xchg esi, eax
mov bh, bh
pop esp
bound ecx, qword [edx - 0x22]
dec edx
jg 0x4857d8
adc dh, 0x7d
and al, 0x5f
cmp eax, 0x16993b2a
loope 0x4857d8
scasb al, byte es:[edi]
mov cl, 0xc2
mov dword [0xc1c4720c], eax
add bl, byte [edi - 0x72]
mov esp, 0x186ad15b
jl 0x4857a2
inc ebp
aam 0x81
das
and ecx, dword [ecx]
wait
push ebx
invalid
Function at 0x496071
Capabilities:
Encode data using xor

Disassembly:
sub cl, byte [esi - 0x393ff01d]
das
push ebp
sbb word [ebx - 0x6cbc98bb], bp
out dx, eax
bound eax, qword [ebx + 0x263eae5]
xchg dword [ebp + 0x4363c7fa], eax
not byte [eax - 0x30]
fstp qword [edi]
pop ds
std
sahf
xchg dword [eax - 0x2a], edi
adc eax, 0xf342e3a2
inc edi
push ds
push es
xor ebx, dword [ebx]
loope 0x496091
fisubr dword [eax + 0x23]
rcl dword [edx]
movsb byte es:[edi], byte [esi]
push 0xa412d123
popfd
enter 0x6140, 0xffffffffffffffb4
int 0x8d
shl dword [esi - 2], 0x87
sub byte [ecx], dh
cmpsb byte [esi], byte es:[edi]
loop 0x4960a4
push 0x8e44ad07
inc esp
int 0xc2
jb 0x496094
lahf
retf 0xa0eb

Function at 0x4967c3
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
sub cl, dl
hlt
cdq
pop esi
mov ebp, 0x568744a0
inc esp
xchg dword [esi + 0x29], edx
out 8, al
push edx
test byte [edi + 0x66eee6be], dl
add al, 0x26
xor eax, 0x4d5d2335
inc esp
xchg dword [esi + 0x29], edx
out 8, al
push edx
test byte [edi + 0x66eee6be], dl
add al, 0x26
xor eax, 0x4d5d2335
imul ecx, edi, 0x74
xor esi, esp
push edi
out 0x57, al
mov esp, 0xd4503880
fidivr word [edx - 0x10]
das
shr al, 1
jo 0x4967bf
add edi, dword [esi + eax - 0x78589c76]
mov bl, 0x5b
jp 0x4967db
and dl, byte [edi]
cmp eax, dword [ecx + 0x2c6670f2]
sbb dword [ebp + 0x16033376], ebp
js 0x4967ba
xchg ecx, eax
cwde
rcl byte [esi - 0x463b2f25]
mov esp, 0x87806338
sar byte [ecx - 0x778c882b], 0xb9
add byte [ebp - 0x62], dl
int3

Function at 0x49f9aa
Capabilities:
Encode data using xor

Disassembly:
pushal
sub al, 0x24
mov byte [0x472c4ba6], ah
imul dword [edx]
fdivr st(1), st(0)
mov eax, 0xb6d149ea
mov dh, 0x9c
xor eax, 0x6403832f
popal
ror byte [eax], cl
arpl word [esi - 0x65652618], si
xor eax, 0xe5eb8bce
popfd
adc eax, 0x8e7d94af
ja 0x49f9b9
ljmp 0x359c:0xb6b6d149
xchg ebx, ebp
and byte [ebx + 1], ch
popal
fisttp dword es:[ecx + 0x38883a5]
int 0xdd
into
scasd eax, dword es:[edi]
and byte [edx - 0xbde01d2], 0x8a
mov dword [0xb4fbf0df], eax
xlatb
cmc
out dx, eax
adc eax, 0xa9e22654
sbb ah, byte [0x34ad2566]
or ah, ch
cld
cmpsb byte [esi], byte es:[edi]
leave
cmp eax, 0x8208cf3
pop ebx
out dx, al
invalid

Function at 0x4bbdbd
Capabilities:
Terminate process

Disassembly:
add byte [ebx - 0x75], dl
pop esp
and al, 0x14
mov dword [0x4c9d3c], edi
mov byte [0x4c9d38], bl
jne 0x4bbe0d
mov eax, dword [0x4ca3d0]
test eax, eax
je 0x4bbdfc
mov ecx, dword [0x4ca3cc]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4bbdfb
mov eax, dword [esi]
test eax, eax
je 0x4bbdf0
call eax
sub esi, 4
cmp esi, dword [0x4ca3d0]
jae 0x4bbde8
pop esi
push 0x4c5018
push 0x4c5014
call fcn.004bbe4e
pop ecx
pop ecx
push 0x4c5020
push 0x4c501c
call fcn.004bbe4e
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4bbe2a
call fcn.004bbe45
pop edi
ret
push dword [esp + 8]
mov dword [0x4c9d40], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4bc6b7
Capabilities:
Set thread local storage value

Disassembly:
add byte [ebx - 0x97aa610], cl
pop ecx
je 0x4bc6e6
push esi
push dword [0x4c535c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4bc6e6
push esi
call fcn.004bc680
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
or dword [esi + 4], 0xffffffff
mov dword [esi], eax
jmp 0x4bc6ee
push 0x10
call fcn.004bb860
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop edi
pop esi
ret

Function at 0x4bc905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c5368
cmp edx, dword [eax]
je 0x4bc927
add eax, 8
inc ecx
cmp eax, 0x4c53f8
jl 0x4bc918
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c5368]
jne 0x4bca55
mov eax, dword [0x4c9cfc]
cmp eax, 1
je 0x4bca2f
test eax, eax
jne 0x4bc958
cmp dword [0x4c5290], 1
je 0x4bca2f
cmp edx, 0xfc
je 0x4bca55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc98f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd2f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd780
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc9d2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd780
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1b3c
push edi
call fcn.004bf650
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd2f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd300
lea eax, [ebp - 0xa0]
push 0x4c1b1c
push eax
call fcn.004bd300
push dword [esi + 0x4c536c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf5c4
add esp, 0x2c
pop edi
jmp 0x4bca55
lea eax, [ebp + 8]
lea esi, [esi + 0x4c536c]
push 0
push eax
push dword [esi]
call fcn.004bd780
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401390
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a538
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x421474]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, 8
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
cmp dword [edi + 0x14], esi
jb 0x4013d1
mov eax, dword [edi]
jmp 0x4013d3
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4013e8
mov eax, 3
jmp 0x4014ba
xor ebx, ebx
push 0x2c
lea edx, [ebp - 0x40]
push ebx
push edx
mov dword [ebp - 0x44], ebx
call fcn.0040d4e0
add esp, 0xc
cmp dword [edi + 0x14], esi
jb 0x401405
mov eax, dword [edi]
jmp 0x401407
mov eax, edi
lea ecx, [ebp - 0x44]
push ecx
push eax
call fcn.004080b9
mov eax, dword [ebp - 0x30]
add esp, 8
cmp eax, 0x500000
ja 0x4014b5
cmp eax, ebx
je 0x4014b5
mov dword [ebp - 0x48], ebx
xor edx, edx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], dx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x4c]
push eax
push ecx
push edx
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x30]
mov ecx, edi
mov dword [ebp - 0x4c], ebx
call fcn.00402ce0
add esp, 0xc
cmp al, bl
jne 0x40149d
mov eax, dword [ebp - 0x4c]
add eax, 0xfffffe70
mov ecx, 0x63
cmp ecx, eax
sbb esi, esi
neg esi
inc esi
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 8
jb 0x40148d
mov edx, dword [ebp - 0x30]
push edx
call fcn.00407a3d
add esp, 4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp eax, 3
jne 0x40142d
mov eax, esi
jmp 0x4014ba
xor esi, esi
cmp dword [ebp - 0x1c], 8
jb 0x4014b1
mov eax, dword [ebp - 0x30]
push eax
call fcn.00407a3d
add esp, 4
mov eax, esi
jmp 0x4014ba
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004078b8
mov esp, ebp
pop ebp
ret
Function at 0x405c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a238
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x421474]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x405dd1
cmp byte [ebx + 0x49], 0
je 0x405dd1
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x405dc5
lea esi, [ebp - 0x2c]
call fcn.004055d0
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x405cb3
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x405cec
dec eax
je 0x405cf0
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x405dcc
call fcn.00404190
xor al, al
jmp 0x405dd3
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x405d00
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x405d2d
cmp edi, 0x10
jae 0x405d0f
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00408e34
add esp, 0x10
cmp esi, eax
jne 0x405dbd
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x405dc9
test esi, esi
jne 0x405ca7
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x405dee
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x405dee
cmp edi, esi
jae 0x405da6
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00406070
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x405ca7
mov ecx, eax
cmp edi, 0x10
jae 0x405d82
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x405d9d
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x405ca1
test esi, esi
jne 0x405d78
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x405db5
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x405ca1
lea ecx, [ebp - 0x2c]
call fcn.00404190
xor al, al
jmp 0x405dd3
lea ecx, [ebp - 0x2c]
call fcn.00404190
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004078b8
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.00406e2b
int3
Function at 0x4061e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419f4b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x421474]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00407706
push 4
mov dword [ebp - 4], 0
call fcn.00407e02
mov edi, eax
add esp, 4
test edi, edi
je 0x40625c
call fcn.0040724c
mov dword [edi], eax
call fcn.0040700b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00406f40
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406252
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.00406f68
jmp 0x40625e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4078b8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421474]
jne 0x4078c2
repz ret
jmp fcn.0040b725
Function at 0x4180db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421474]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040def0
and dword [ebp - 0x14], 0
cmp dword [0x42354c], 0
mov dword [ebp - 0x18], eax
jne 0x41818e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x418236
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x418236
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42354c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x423550], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x423554], eax
call edi
push eax
call esi
mov dword [0x42355c], eax
test eax, eax
je 0x41818e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x423558], eax
mov eax, dword [0x423558]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4181e7
cmp dword [0x42355c], ecx
je 0x4181e7
push eax
call esi
push dword [0x42355c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4181e7
test ebx, ebx
je 0x4181e7
call edi
test eax, eax
je 0x4181de
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4181de
test byte [ebp - 8], 1
jne 0x4181e7
or dword [ebp + 0x10], 0x200000
jmp 0x41821a
mov eax, dword [0x423550]
cmp eax, dword [ebp - 0x18]
je 0x41821a
push eax
call esi
test eax, eax
je 0x41821a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41821a
mov eax, dword [0x423554]
cmp eax, dword [ebp - 0x18]
je 0x41821a
push eax
call esi
test eax, eax
je 0x41821a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42354c]
call esi
test eax, eax
je 0x418236
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x418238
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004078b8
leave
ret