joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f996
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x46f9db
call fcn.0047a33b
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46f9db
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x46f9f7
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0047a4d4
mov ebx, eax
test edi, edi
je 0x46f9f5
test esi, esi
je 0x46f9f5
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x475d88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0047a33b
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x475dbf
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00475de0
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4f0b2b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00479775
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4f0b67
call fcn.004f0d4a
mov dword [esi + 0xc], 1
jmp 0x4f0b6c
call fcn.004f0d4a
cmp dword [esi], 0
je 0x4f0bb5
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4f0b8f
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0046fa6b
jmp 0x4f0ba0
push 0xff
mov ecx, esi
call fcn.00413bf0
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.0046d8b1
jmp 0x4f0bd9
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4f0bd9
push dword [esi]
push dword [ebp - 4]
call fcn.0047ce96
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4f0c9f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004f0d4a
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4f0ce7
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0046fa6b
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.0046d8b1
jmp 0x4f0cf2
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0047ce96
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x5533aa
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.005841f8
call fcn.0047a38f
cmp dword [eax + 0x14], 0
jne 0x5533c5
mov ecx, esi
pop esi
jmp fcn.005527ab
pop esi
ret

Function at 0x55fbe7
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.0046a15d
call fcn.0047a38f
cmp dword [eax + 0x14], 0
jne 0x55fc02
mov ecx, esi
pop esi
jmp fcn.0055f4d0
pop esi
ret
Function at 0x5a0645
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x641490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00592c3e
mov dword [ebp - 0x14], eax
cmp dword [0x64e8c8], esi
jne 0x5a0738
push 0x800
push esi
push 0x60a1b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x5a06c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x5a0818
push esi
push esi
push 0x60a1b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x5a0818
push 0x60a1c8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x5a0818
push eax
call ebx
push 0x60a1d4
push edi
mov dword [0x64e8c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x60a1e4
push edi
mov dword [0x64e8cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x64e8d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x64e8d8], eax
test eax, eax
je 0x5a0735
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x64e8d4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x5a075d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5a0750
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x5a0772
push 4
pop eax
jmp 0x5a081a
cmp dword [ebp - 0x14], esi
je 0x5a0772
push dword [0x64e8c8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x5a0757
mov eax, dword [0x64e8d4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x5a07d0
cmp dword [0x64e8d8], edi
je 0x5a07d0
push eax
call ebx
push dword [0x64e8d8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x5a07d0
test eax, eax
je 0x5a07d0
call ecx
test eax, eax
je 0x5a07c5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x5a07c5
test byte [ebp - 8], 1
jne 0x5a07d0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x5a0800
mov eax, dword [0x64e8cc]
cmp eax, edi
je 0x5a07fd
push eax
call ebx
test eax, eax
je 0x5a07fd
call eax
mov esi, eax
test esi, esi
je 0x5a07fd
mov eax, dword [0x64e8d0]
cmp eax, edi
je 0x5a07fd
push eax
call ebx
test eax, eax
je 0x5a07fd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x64e8c8]
call ebx
test eax, eax
je 0x5a0818
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x5a081a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005884ab
mov esp, ebp
pop ebp
ret
Function at 0x5b04f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x56666847
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x56670224
call fcn.566541a0
sub esp, 0xa8
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], ebx
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.oleaut32.dll_SetErrorInfo]
mov esi, dword [ebp + 8]
call fcn.5666be85
lea eax, [ebp - 0xb4]
push eax
mov byte [ebp - 0x14], bl
mov dword [ebp - 0xb4], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xa4], 2
jne 0x566668af
cmp dword [ebp - 0xb0], 4
jb 0x566668af
mov byte [ebp - 0x14], 1
push ebx
push ebx
push 0x5663742c
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x566668c3
mov byte [ebp - 0x14], bl
mov esi, dword [ebp - 0x14]
push esi
call fcn.566686f2
pop ecx
push esi
call fcn.56668446
pop ecx
push esi
call fcn.5666803a
pop ecx
push esi
call fcn.56667fae
pop ecx
push esi
call fcn.5666798f
pop ecx
push esi
call fcn.5666790f
pop ecx
push esi
call fcn.5666788f
pop ecx
push esi
call fcn.566677b6
pop ecx
push esi
call fcn.566672ab
pop ecx
push esi
call fcn.56666967
pop ecx
push dword [ebp - 0x18]
push ebx
call dword [sym.imp.oleaut32.dll_CreateErrorInfo]
lea ecx, [ebp - 0x18]
call fcn.5665f161
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x5666be85
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x5666be94
pop dword [ebp - 0x48]
mov eax, 0x5666be94
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xd91219c3
add dword [ebp - 0x58], 0x75402b88
mov dword [ebp - 0x54], 0x4516005b
add dword [ebp - 0x54], 0xed1d4bea
mov dword [ebp - 0x50], 0xdc3ed46
add dword [ebp - 0x50], 0x3e8856e8
mov dword [ebp - 0x4c], 0x48e20d84
add dword [ebp - 0x4c], 0xb71df27c
lea eax, [ebp - 0x58]
push eax
mov eax, 0x94f3340d
add eax, 0xc16fdd37
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x6dfa3abe
sub dword [ebp - 0x58], 0xf987d168
mov dword [ebp - 0x54], 0x64df705c
sub dword [ebp - 0x54], 0x23730ee7
mov dword [ebp - 0x50], 0xe9f2e131
add dword [ebp - 0x50], 0x797c8b3b
mov dword [ebp - 0x4c], 0xcb3ec5b5
sub dword [ebp - 0x4c], 0xcb3ec5b5
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x313fefbe
sub eax, 0xdadcde7e
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3e1f4
push 0
call eax
mov ecx, 0x5316
mov edi, eax
mov ebx, 0x56688000
add ebx, dword [ebp - 0x48]
mov esi, 0x42636734
sub esi, 0xac6f112b
sub dword [ebp - 4], 0xd41c1b63
mov edx, dword [ebx]
xor dword [ebp - 0x38], eax
sub edx, esi
sub dword [ebp - 0x38], 0xf3e0b7fa
mov dword [edi], edx
add edi, 0x10a56c37
sub edi, 0x10a56c33
add ebx, 0xdffab93
add ebx, 0xf2005471
loop 0x5666bfa5
add eax, 0x1bdfdd8f
add eax, 0xe421619c
mov ebx, eax
add eax, 0xf856a9a1
add eax, 0x7a95664
mov ecx, 0x5672b49d
add ecx, 0xfff04b63
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x401c66
pop dword [ebp - 0x44]
mov eax, 0x401c66
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x622644c3
sub dword [ebp - 0x54], 0x13d3ff78
mov dword [ebp - 0x50], 0x16db6995
sub dword [ebp - 0x50], 0xe4a81d50
mov dword [ebp - 0x4c], 0x15ed2822
sub dword [ebp - 0x4c], 0xc9a0e3f4
mov dword [ebp - 0x48], 0xf250bc84
add dword [ebp - 0x48], 0xdaf437c
lea eax, [ebp - 0x54]
push eax
mov eax, 0x19e734e1
sub eax, 0x19a7048d
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x8e73c2b5
sub dword [ebp - 0x54], 0x1a01595f
mov dword [ebp - 0x50], 0x82622277
add dword [ebp - 0x50], 0xbf0a3efe
mov dword [ebp - 0x4c], 0x5c7e1a10
sub dword [ebp - 0x4c], 0xf90eada4
mov dword [ebp - 0x48], 0xca2b8474
add dword [ebp - 0x48], 0x35d47b8c
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x6adf187b
add eax, 0x956117b1
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3855e
push 0
call eax
mov ecx, 0x4f6b
mov edi, eax
mov esi, 0xb2f527ad
sub esi, 0xb2b4b7ad
add esi, dword [ebp - 0x44]
mov ebx, 0xf941ef2e
sub ebx, 0xb5176984
add dword [ebp - 0x20], 0x60ce756e
mov edx, dword [esi]
xor edx, ebx
xor dword [ebp - 0x38], 0x9998ee6f
mov dword [edi], edx
add edi, 0x10a80048
sub edi, 0x10a80044
add esi, 0x1a536e37
sub esi, 0x1a536e33
loop 0x401d7d
add eax, 0x2cee512b
sub eax, 0x2ced20ac
xor ebx, ebx
add ebx, eax
add eax, 0x4056eb7a
add eax, 0xbfa9148b
mov ecx, 0xb0faff7f
sub ecx, 0xb0baff7f
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1007c4fb
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.1007c57a
jae 0x1007c507
xor ecx, ecx
call fcn.1007c57a
jae 0x1007c531
xor eax, eax
call fcn.1007c57a
jae 0x1007c542
mov al, 0x10
call fcn.1007c57a
adc al, al
jae 0x1007c523
jne 0x1007c56f
stosb byte es:[edi], al
jmp 0x1007c508
call fcn.1007c586
dec ecx
loop 0x1007c54e
mov eax, ebp
call fcn.1007c584
jmp 0x1007c570
lodsb al, byte [esi]
shr eax, 1
je 0x1007c596
adc ecx, 2
mov ebp, eax
jmp 0x1007c570
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.1007c584
cmp eax, 0x7d00
jae 0x1007c56e
cmp eax, 0x500
jae 0x1007c56f
cmp eax, 0x7f
ja 0x1007c570
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1007c508
pop ebp
ret 8
Function at 0x4012f0
Capabilities:
Schedule task via itaskservice

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push ebx
lea eax, [ebp - 0x4c]
sub esp, 0x8c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x405470
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x405320
call dword [sym.imp.ole32.dll_CoCreateInstance]
sub esp, 0x14
test eax, eax
js 0x401429
xor ecx, ecx
xor edi, edi
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov word [ebp - 0x38], cx
xor ebx, ebx
mov word [ebp - 0x18], di
mov ecx, dword [ebp - 0x18]
mov word [ebp - 0x48], dx
mov edx, dword [eax]
mov dword [esp + 0x34], ecx
mov ecx, dword [ebp - 0x14]
mov word [ebp - 0x28], bx
mov dword [esp + 0x38], ecx
mov ecx, dword [ebp - 0x10]
mov dword [esp + 0x3c], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esp + 0x40], ecx
mov ecx, dword [ebp - 0x28]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 0x20]
mov dword [esp + 0x2c], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 0x30], ecx
mov ecx, dword [ebp - 0x38]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 0x20], ecx
mov ecx, dword [ebp - 0x48]
mov dword [esp + 4], ecx
mov ecx, dword [ebp - 0x44]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov ecx, dword [ebp - 0x40]
mov dword [esp + 0xc], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 0x10], ecx
call dword [edx + 0x28]
sub esp, 0x44
test eax, eax
js 0x401420
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x18]
mov edx, dword [eax]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [edx + 0x1c]
mov ebx, eax
mov eax, dword [ebp - 0x4c]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov eax, dword [ebp - 0x18]
sub esp, 4
test ebx, ebx
js 0x401440
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test byte [section..data], 1
jne 0x401460
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test byte [section..data], 1
je 0x401429
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.GetFolder_failed:__08lx_n
jmp 0x40146c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Connect_failed:__08lx_n
mov dword [esp + 8], str.get_tasks_root_folder
mov dword [esp + 4], 0x404000
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
xor eax, eax
jmp 0x40142b
Function at 0x402900
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x402958
cmp byte [esi + ebx - 1], 0xa
je 0x40292c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4080a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x4033d0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x442c90
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, 4
imul ecx, eax, 0x19cf
mov edx, dword [ecx + 0x48fe00]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, 4
imul ecx, eax, 0x19cf
mov edx, dword [ebp - 8]
mov dword [ecx + 0x48fe00], edx
mov eax, dword [ebp - 8]
sub eax, 0x482dac50
mov ecx, 4
imul edx, ecx, 0x26b4
mov ecx, dword [edx + 0x48fe00]
or ecx, eax
mov edx, 4
imul eax, edx, 0x26b4
mov dword [eax + 0x48fe00], ecx
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0
mov ecx, 4
imul edx, ecx, 0x6ca
mov eax, 4
imul ecx, eax, 0x1828
mov eax, dword [ecx + 0x48fe00]
sar eax, 2
xor eax, 0x7ccd5505
xor eax, 0x2edfff96
mov ecx, dword [edx + 0x48fe00]
xor ecx, eax
mov edx, 4
imul eax, edx, 0x6ca
mov dword [eax + 0x48fe00], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0
mov eax, 2
imul ecx, eax, 0x4c3
movsx edx, word [ecx + 0x49db20]
and edx, 0x37a53d70
mov eax, 2
imul ecx, eax, 0x4c3
mov word [ecx + 0x49db20], dx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 8], 0x67452301
mov edx, 4
imul eax, edx, 0x2a3b
mov ecx, dword [eax + 0x48fe00]
sub ecx, 0x35ee3a4b
mov edx, 4
imul eax, edx, 0x2a3b
mov dword [eax + 0x48fe00], ecx
mov ecx, 4
shl ecx, 0
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 8], 0xefcdab89
mov eax, 4
imul ecx, eax, 0xfd6
mov edx, dword [ecx + 0x48fe00]
sub edx, 0x67bea766
mov eax, 4
imul ecx, eax, 0xfd6
mov dword [ecx + 0x48fe00], edx
mov edx, 4
shl edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + edx + 8], 0x98badcfe
mov ecx, 2
imul edx, ecx, 0x262f
movsx eax, word [edx + 0x49db20]
sub eax, 0x135e6838
mov ecx, 2
imul edx, ecx, 0x262f
mov word [edx + 0x49db20], ax
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx + 8], 0x10325476
mov eax, 4
imul ecx, eax, 0x3448
mov edx, 2
imul eax, edx, 0x2c24
movsx edx, word [eax + 0x49db20]
not edx
imul eax, edx, 0x6a4d3129
add eax, 0x64f6ec31
mov ecx, dword [ecx + 0x48fe00]
sub ecx, eax
mov edx, 4
imul eax, edx, 0x3448
mov dword [eax + 0x48fe00], ecx
mov esp, ebp
pop ebp
ret
Function at 0x454a10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 4
imul ecx, eax, 0x27ae
mov edx, dword [ecx + 0x48fe00]
not edx
cmp edx, 0xd7900ec9
jge 0x454a57
mov eax, 4
imul ecx, eax, 0x29ac
mov edx, dword [ecx + 0x48fe00]
sub edx, 0x21fb0167
mov eax, 4
imul ecx, eax, 0x29ac
mov dword [ecx + 0x48fe00], edx
mov edx, dword [0x48f568]
push edx
call fcn.00424180
add esp, 4
mov eax, 4
imul ecx, eax, 0x3246
mov edx, 4
imul eax, edx, 0x2d83
mov edx, dword [eax + 0x48fe00]
shl edx, 7
mov eax, dword [ecx + 0x48fe00]
imul eax, edx
mov ecx, 4
imul edx, ecx, 0x3246
mov dword [edx + 0x48fe00], eax
push 1
call fcn.00465a50
mov eax, 4
imul ecx, eax, 0x1b89
mov edx, dword [ecx + 0x48fe00]
or edx, 0x560d2151
mov dword [ebp - 4], edx
mov eax, 4
imul ecx, eax, 0x1b89
mov edx, dword [ecx + 0x48fe00]
add edx, 1
mov eax, 4
imul ecx, eax, 0x1b89
mov dword [ecx + 0x48fe00], edx
cmp dword [ebp - 4], 0x18980a67
jg 0x454b30
mov edx, 4
imul eax, edx, 0x1578
mov ecx, dword [eax + 0x48fe00]
sar ecx, 3
cmp ecx, 0x83040010
jl 0x454b30
mov edx, 4
imul eax, edx, 0x28a5
imul ecx, dword [eax + 0x48fe00], 0xafe5854f
mov edx, 4
imul eax, edx, 0x28a5
mov dword [eax + 0x48fe00], ecx
mov esp, ebp
pop ebp
ret
Function at 0x46d0f5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48eb40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004671cc
mov dword [ebp - 0x14], eax
cmp dword [0x4a555c], esi
jne 0x46d1e8
push 0x800
push esi
push 0x484260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46d175
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46d2c8
push esi
push esi
push 0x484260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46d2c8
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46d2c8
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4a555c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4a5560], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4a5564], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a556c], eax
test eax, eax
je 0x46d1e5
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a5568], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46d20d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46d200
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46d222
push 4
pop eax
jmp 0x46d2ca
cmp dword [ebp - 0x14], esi
je 0x46d222
push dword [0x4a555c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46d207
mov eax, dword [0x4a5568]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46d280
cmp dword [0x4a556c], edi
je 0x46d280
push eax
call ebx
push dword [0x4a556c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46d280
test eax, eax
je 0x46d280
call ecx
test eax, eax
je 0x46d275
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46d275
test byte [ebp - 8], 1
jne 0x46d280
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46d2b0
mov eax, dword [0x4a5560]
cmp eax, edi
je 0x46d2ad
push eax
call ebx
test eax, eax
je 0x46d2ad
call eax
mov esi, eax
test esi, esi
je 0x46d2ad
mov eax, dword [0x4a5564]
cmp eax, edi
je 0x46d2ad
push eax
call ebx
test eax, eax
je 0x46d2ad
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4a555c]
call ebx
test eax, eax
je 0x46d2c8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46d2ca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046cf47
mov esp, ebp
pop ebp
ret