joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4352f0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x45190c]
test eax, eax
je 0x4352fd
or eax, 0xffffffff
ret
push esi
push edi
mov dword [0x45190c], 1
call fcn.00435360
mov esi, dword [sym.imp.MSVCRT.dll_getenv]
push str.XML_MEM_BREAKPOINT
mov dword [0x45191c], eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 4
test eax, eax
je 0x43533d
push 0x451924
push 0x44e308
push eax
call edi
add esp, 0xc
push str.XML_MEM_TRACE
call esi
add esp, 4
test eax, eax
je 0x43535b
push 0x451928
push 0x44e2f4
push eax
call edi
add esp, 0xc
pop edi
xor eax, eax
pop esi
ret

Function at 0x43be8c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], 0x1a
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xc], 0x10000000
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
mov eax, dword [0x44fae8]
mov dword [ebp - 8], eax
mov ecx, dword [0x44faec]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 0
jmp 0x43beda
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x1f
jge 0x43bf1c
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
test eax, eax
je 0x43bf06
lea ecx, [ebp - 8]
push ecx
call dword [0x4500f0]
cmp eax, 3
je 0x43bf06
mov edx, dword [ebp - 0x1c]
not edx
mov eax, dword [ebp - 0x18]
and eax, edx
mov dword [ebp - 0x18], eax
mov cx, word [ebp - 8]
add cx, 1
mov word [ebp - 8], cx
mov edx, dword [ebp - 0x1c]
shl edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x43bed1
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x402a50
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402a83
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402a83
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x402a83
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x402a83
mov al, 1
ret
xor al, al
ret

Function at 0x41c870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x41c87f
pop dword [ebp - 0x40]
mov eax, 0x868c2fa6
add eax, 0x79b598d9
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0xb4f2b
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xdec91da3
add ecx, 0x21372fa7
mov esi, eax
mov edi, 0xed748150
add edi, 0x12fd18b0
add edi, dword [ebp - 0x40]
mov edx, 0x8fed4d41
mov ebx, dword [edi]
add dword [ebp - 0x24], edx
sub ebx, edx
xor dword [ebp - 0x30], edx
mov dword [esi], ebx
sub dword [ebp - 0x18], edi
add esi, 0x187d3668
add esi, 0xe782c99c
add edi, 0x2072fde3
add edi, 0xdf8d0221
loop 0x41c8d3
add eax, 0xbfa22a89
add eax, 0x405efd72
xor ebx, ebx
add ebx, eax
add eax, 0xc7033e99
sub eax, 0xc7033e94
mov ecx, 0xb7dcf4c8
sub ecx, 0xb79cf4c8
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x472e70
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
jne 0x472f0a
push str.dwmapi.dll
call main
add esp, 4
mov dword [esi + 0x20], eax
test eax, eax
je 0x472f06
push str.DwmInvalidateIconicBitmaps
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.DwmSetIconicThumbnail
push dword [esi + 0x20]
mov dword [esi + 4], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.DwmSetIconicLivePreviewBitmap
push dword [esi + 0x20]
mov dword [esi + 8], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.DwmSetWindowAttribute
push dword [esi + 0x20]
mov dword [esi + 0xc], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.DwmGetWindowAttribute
push dword [esi + 0x20]
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.DwmExtendFrameIntoClientArea
push dword [esi + 0x20]
mov dword [esi + 0x14], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push str.DwmDefWindowProc
push dword [esi + 0x20]
mov dword [esi + 0x18], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x1c], eax
mov byte [esi + 0x24], 1
pop esi
ret
Function at 0x495200
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6401e8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x20019
push 0
push 0x5cc840
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49524f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 2
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x495289
push str.Application
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004017bd
mov esp, ebp
pop ebp
ret
Function at 0x4c8c60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b81d0
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x6401e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
call fcn.00401af0
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x5c689c]
mov ecx, edi
call esi
mov ecx, eax
call fcn.00401d80
test al, al
je 0x4c8e87
call main
mov esi, eax
test esi, esi
je 0x4c8e87
test ebx, ebx
je 0x4c8e87
cmp word [ebx], 0
je 0x4c8e87
push ebx
lea ecx, [ebp - 0x240]
call main
push ebx
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x4c8d52
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x4c8d52
push ebx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4c8d52
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c8d30
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x240]
call main
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x224]
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
push esi
movq qword [ebp - 0x224], xmm0
call main
push 0x34
lea eax, [ebp - 0x274]
push 0
push eax
call fcn.0057c040
add esp, 0xc
lea edi, [ebp - 0x240]
cmp dword [ebp - 0x22c], 8
lea ecx, [ebp - 0x224]
cmovae edi, dword [ebp - 0x240]
call fcn.004d1be0
mov esi, eax
test esi, esi
je 0x4c8e7c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x228]
push 4
push 0
push 4
mov dword [esi], 0x110
mov dword [esi + 4], 0
mov dword [esi + 0x3c], 3
mov dword [esi + 0x44], 0x70
push eax
mov dword [ebp - 0x228], ecx
mov ecx, esi
push 0
call main
test al, al
je 0x4c8e7c
push 1
push 0
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x278], edi
call main
push eax
push edi
push 1
mov ecx, esi
call main
test al, al
je 0x4c8e7c
push 6
push 1
push 0x208
push ebx
push 2
mov ecx, esi
mov dword [ebp - 0x27c], 0x208
mov dword [ebp - 0x278], ebx
call main
test al, al
je 0x4c8e7c
lea eax, [ebp - 0x274]
push eax
push esi
lea ecx, [ebp - 0x224]
call main
mov edi, eax
cmp edi, 0xa
je 0x4c8e7c
mov ecx, dword [esi + 0x5c]
add ecx, esi
push ecx
lea ecx, [ebp - 0x27c]
call main
lea ecx, [ebp - 0x224]
push esi
test al, al
jne 0x4c8ea7
call main
lea ecx, [ebp - 0x240]
call main
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004017bd
mov esp, ebp
pop ebp
ret 0xc
call main
test edi, edi
jne 0x4c8e7c
lea ecx, [ebp - 0x240]
call main
lea eax, [edi + 1]
jmp 0x4c8e89
Function at 0x4cc450
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4cc46b
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x4cc480
push eax
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
mov dword [esi + 8], 0
cmp dword [esi + 0x1c], 0
je 0x4cc4b7
cmp dword [esi + 0x20], 8
push edi
lea edi, [esi + 0xc]
mov eax, edi
jb 0x4cc494
mov eax, dword [edi]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov dword [edi + 0x10], 0
cmp dword [edi + 0x14], 8
jb 0x4cc4aa
mov edi, dword [edi]
xor eax, eax
mov word [edi], ax
pop edi
mov dword [esi + 0x24], eax
mov dword [esi], eax
pop esi
ret
mov dword [esi + 0x24], 0
mov dword [esi], 0
pop esi
ret

Function at 0x4f46c0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 4]
mov dword [eax], 0
push eax
push 0
push esi
push 0x4f4770
push 0
push 0
mov dword [esi], 0
call dword [sym.imp.kernel32.dll_CreateThread]
push 0
push 0
push 1
push 0
mov dword [esi], eax
call dword [sym.imp.kernel32.dll_CreateEventW]
mov dword [0x64887c], eax
mov eax, esi
pop esi
ret

Function at 0x519c20
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x78], 0
je 0x519c4b
cmp dword [esi + 0x7c], 0
je 0x519c4b
cmp dword [esi + 0x80], 0
je 0x519c4b
cmp dword [esi + 0x84], 0
je 0x519c4b
cmp dword [esi + 0x88], 0
jne 0x519cc6
push str.prntvpt.dll
call main
mov edi, eax
add esp, 4
test edi, edi
je 0x519ccb
push str.PTOpenProvider
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x78], eax
test eax, eax
je 0x519ccb
push str.PTConvertDevModeToPrintTicket
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x7c], eax
test eax, eax
je 0x519ccb
push str.PTCloseProvider
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x80], eax
test eax, eax
je 0x519ccb
push str.PTConvertPrintTicketToDevMode
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x84], eax
test eax, eax
je 0x519ccb
push str.PTReleaseMemory
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esi + 0x88], eax
test eax, eax
je 0x519ccb
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x5476e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6401e8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
push 5
push dword [edi + 0xe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0xe8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 5
push dword [edi + 0xe8]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 7
push dword [edi + 0xe8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp byte [ebp + 8], 0
je 0x547743
push dword [edi + 0xe8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x645050]
test eax, eax
jne 0x54775f
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004017bd
mov esp, ebp
pop ebp
ret 4
cmp byte [edi + 0xde], 0
mov dword [ebp - 0x24], eax
je 0x547832
push esi
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x24]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, 1
ja 0x547831
test eax, eax
je 0x547827
cmp eax, 1
jne 0x547818
push 3
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x547818
mov esi, dword [edi + 8]
test esi, esi
je 0x5477ee
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x24]
cmp ecx, eax
je 0x5477d5
push eax
push ecx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x5477ee
lea eax, [ebp - 0x20]
push eax
push 0
push 0x37f
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
je 0x547802
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 3
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x5477b5
cmp byte [edi + 0xde], 0
jne 0x547770
jmp 0x547831
mov dword [edi + 0xc0], 2
pop esi
cmp dword [edi + 0xc0], 1
mov ecx, dword [ebp - 4]
sete al
xor ecx, ebp
pop edi
call fcn.004017bd
mov esp, ebp
pop ebp
ret 4
Function at 0x54abc0
Capabilities:
Check for time delay via gettickcount
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6401e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x24], eax
push edi
cmp byte [esi + 0x140], al
je 0x54ac14
push 0x7f02
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov ebx, eax
test ebx, ebx
je 0x54abff
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x54ac01
xor eax, eax
push 0
push dword [esi + 0xe8]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x54ac48
mov edi, dword [esi + 0xe8]
test edi, edi
je 0x54ac48
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 5
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 7
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
call dword [sym.imp.kernel32.dll_GetTickCount]
cmp byte [esi + 0xde], 0
mov edi, eax
je 0x54acb6
nop dword [eax]
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x54acb6
call dword [sym.imp.kernel32.dll_GetTickCount]
call dword [sym.imp.kernel32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x493e0
ja 0x54acb6
cmp byte [esi + 0x140], 0
je 0x54ac99
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [esi + 0xde], 0
jne 0x54ac60
cmp byte [esi + 0x140], 0
je 0x54accd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x54accd
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [esi + 0xc0], 1
mov ecx, dword [ebp - 4]
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.004017bd
mov esp, ebp
pop ebp
ret
Function at 0x551b20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x811c9dc5
push edi
mov edi, dword [ebp + 8]
mov ecx, 0
sub esi, edi
je 0x551b51
lfence
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x551b40
pop edi
mov eax, edx
pop esi
pop ebp
ret 8
Function at 0x5602f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x560321
lfence
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x560310
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
bswap ebx
rol esi, 0xbf
bswap edi
add edx, 0x15
sbb esi, 0x56
dec edi
rol edi, 0x87
rol esi, 0x82
and eax, 0x46
neg eax
ror edi, 0x66
imul eax
not eax
neg edi
dec eax
ror eax, 0x90
dec eax
bswap eax
rcr eax, 0x5a
imul ebx
inc ebx
rcl edi, 0x49
inc edi
or ebx, 0xc1
rcl edi, 0xd9
inc ebx
dec eax
dec edx
ror edi, 0x39
or edx, 0x85
dec ebx
add edi, 0xc1
and ebx, 0x97
or eax, 0xc9
imul eax
add edi, 0x73
inc edx
inc esi
and eax, 0xcb
not ebx
or edx, 0xe9
rol esi, 0x38
dec ebx
rcr edi, 0xd1
rcr esi, 4
rcl ebx, 0x1d
rcl edx, 0x84
not eax
dec edi
sbb edi, 0xbb
xor ecx, ecx
xor edi, edi
inc eax
ror ebx, 0x75
not esi
neg eax
or edx, 0x88
ror esi, 0x8c
imul edx
rcl edx, 0x54
neg eax
bswap eax
sub edi, 0x8d
inc esi
dec edi
imul ebx
rol edx, 0xe7
or ebx, 0x75
neg edi
rcr edi, 0x1c
rcl edx, 7
ror ebx, 0x77
rcr ebx, 0xeb
not edi
and edi, 0x9f
neg eax
inc esi
bswap esi
mov eax, 0x49
sbb edi, 0x63
neg edx
rcr edi, 0x5f
imul eax
rcl edi, 0xb8
inc esi
imul esi
neg edi
or eax, 0x38
sub ebx, 0xb9
dec edi
neg eax
neg edx
sub edx, 0x60
dec esi
not edx
neg edx
not edi
sub edx, 0xd2
or edx, 0x20
and ebx, 0x48
bswap esi
inc edi
mov ecx, dword [ebp + 0xc]
rol ebx, 0x4e
bswap ebx
dec eax
bswap edi
sub eax, 0x6d
rcr eax, 0x6e
rcr eax, 0x69
rcl edx, 0x97
sbb edi, 0x90
not esi
rol edi, 0x16
dec edi
ror ebx, 0x75
mov ebx, 0x3e
sub ebx, 0xbd
rcl edi, 0x51
sub esi, 0x6a
neg esi
or edx, 0x5e
rcl esi, 0x70
sub edx, 0xbd
and edi, 0xd1
inc eax
rcr esi, 0xe3
inc edx
bswap esi
and eax, 0x18
not esi
rol edi, 0xc7
not edi
sbb edx, 0xd7
imul ebx
neg esi
rcr edx, 0x8f
dec eax
and edx, 0xf9
dec eax
imul edx
rcr eax, 0xfa
or edi, 0x20
bswap esi
inc ebx
sbb eax, 0x2f
mov ebx, 5
neg edx
neg eax
inc ebx
rcr ebx, 0x7f
rcl edx, 0xc
neg edi
mov edi, dword [ebp + 8]
xor esi, ebx
xor esi, ebx
mov eax, ebx
xor esi, esi
mov eax, ebx
xor esi, esi
xor esi, eax
xor esi, eax
mov ebx, esi
xor eax, eax
xor esi, eax
mov esi, eax
not byte [edi]
xor ebx, esi
mov esi, esi
mov ebx, esi
mov esi, ebx
xor ebx, esi
xor esi, esi
mov esi, ebx
xor ebx, eax
mov esi, esi
add byte [edi], 0x67
xor ebx, ebx
mov ebx, esi
xor esi, eax
xor esi, ebx
xor esi, esi
xor eax, eax
mov eax, eax
mov eax, esi
mov ebx, eax
sub byte [edi], 0x88
xor eax, esi
mov ebx, ebx
xor esi, esi
mov esi, ebx
mov ebx, esi
xor ebx, ebx
mov eax, esi
xor ebx, eax
xor eax, ebx
imul byte [edi]
inc edi
loop 0x4011ae
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404c24
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45daf0]
jne 0x404c2e
repz ret
jmp fcn.00409125
Function at 0x405593
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402ec1
and dword [ebp - 4], 0
cmp dword [0x45e7f4], 0
mov ebx, eax
jne 0x405644
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4056f5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40eb90
push edi
call esi
test eax, eax
je 0x4056f5
push eax
call fcn.00402e4f
mov dword [esp], 0x40eb80
push edi
mov dword [0x45e7f4], eax
call esi
push eax
call fcn.00402e4f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45e7f8], eax
call esi
push eax
call fcn.00402e4f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45e7fc], eax
call esi
push eax
call fcn.00402e4f
pop ecx
mov dword [0x45e804], eax
test eax, eax
je 0x405644
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402e4f
pop ecx
mov dword [0x45e800], eax
mov eax, dword [0x45e800]
cmp eax, ebx
je 0x40569c
cmp dword [0x45e804], ebx
je 0x40569c
push eax
call fcn.00402eca
push dword [0x45e804]
mov esi, eax
call fcn.00402eca
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40569c
test edi, edi
je 0x40569c
call esi
test eax, eax
je 0x405693
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405693
test byte [ebp - 0xc], 1
jne 0x40569c
or dword [ebp + 0x10], 0x200000
jmp 0x4056d5
mov eax, dword [0x45e7f8]
cmp eax, ebx
je 0x4056d5
push eax
call fcn.00402eca
pop ecx
test eax, eax
je 0x4056d5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4056d5
mov eax, dword [0x45e7fc]
cmp eax, ebx
je 0x4056d5
push eax
call fcn.00402eca
pop ecx
test eax, eax
je 0x4056d5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45e7f4]
call fcn.00402eca
pop ecx
test eax, eax
je 0x4056f5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4056f7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xf62000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0xf6200a
jmp 0xf6400f
jmp fcn.00b101b8

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x404ff0
Capabilities:
Set current directory

Disassembly:
push ecx
cmp byte [esp + 8], 0
mov eax, ecx
push ebx
mov ebx, dword [0x4f90f4]
mov ecx, 0x42
push esi
push edi
mov byte [esp + 0xf], dl
mov esi, 0x4fb8b0
je 0x405038
inc dword [0x4fb9d0]
add ebx, 0x108
mov edi, ebx
mov dword [0x4f90f4], ebx
rep movsd dword es:[edi], dword [esi]
push 0
mov ecx, 0x4fdb78
mov dword [ebx + 0x2c], eax
call fcn.0042ecb0
jmp 0x40503f
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x2c], eax
cmp dword [0x4fb9e4], 0
xorps xmm0, xmm0
movlpd qword [0x4fe680], xmm0
je 0x40506f
mov eax, dword [0x4fab50]
mov ecx, 0x4cfc40
test eax, eax
je 0x405068
mov eax, dword [eax]
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp byte [esp + 0xf], 0
jne 0x4050f4
mov cl, byte [ebx + 0xee]
test cl, cl
jne 0x4050a4
cmp byte [esp + 0x18], 0x65
sete cl
mov byte [ebx + 0xee], cl
jne 0x4050a4
mov dword [ebx], 0xffffffff
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x24], 0xffffffff
cmp dword [0x4fe68c], 0
je 0x4050b6
cmp dword [0x4fe688], 0
jne 0x4050ba
test cl, cl
je 0x4050f4
mov byte [ebx + 0xec], 0
test cl, cl
jne 0x4050f4
cmp dword [0x4fe68c], 0
jge 0x4050dd
pop edi
pop esi
mov dword [ebx + 0xe0], 0xffffffff
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xdc], eax
mov eax, dword [0x4fe68c]
mov dword [ebx + 0xe0], eax
pop edi
pop esi
pop ebx
pop ecx
ret