joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4118d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431d44
mov eax, dword fs:[0]
push eax
sub esp, 0x8d8
mov eax, dword [0x43d76c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8c4], ecx
push 1
push 0x19
lea eax, [ebp - 0x82c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x41191f
xor eax, eax
jmp 0x411b0b
lea ecx, [ebp - 0x82c]
push ecx
lea ecx, [ebp - 0x848]
call fcn.00403990
mov dword [ebp - 4], 0
push 0x4348b4
lea ecx, [ebp - 0x848]
call fcn.00403a80
lea edx, [ebp - 0x848]
push edx
call fcn.004033d0
add esp, 4
lea ecx, [ebp - 0x848]
call fcn.00404b90
push eax
call fcn.00401e30
add esp, 4
test eax, eax
jne 0x411996
mov dword [ebp - 0x84c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x848]
call fcn.00403a00
mov eax, dword [ebp - 0x84c]
jmp 0x411b0b
push 0x8c
lea eax, [ebp - 0x868]
push eax
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x8c8], eax
mov ecx, dword [ebp - 0x8c8]
mov dword [ebp - 0x8cc], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x8cc]
call fcn.00404b90
push eax
mov edx, dword [ebp - 0x8c4]
add edx, 0x20
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00413250
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x868]
call fcn.00403a00
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004033d0
add esp, 4
push 0x8f
lea edx, [ebp - 0x888]
push edx
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x8d4], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x8d4]
push ecx
lea edx, [ebp - 0x848]
push edx
lea eax, [ebp - 0x8a4]
push eax
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x8d8], eax
mov ecx, dword [ebp - 0x8d8]
mov dword [ebp - 0x8dc], ecx
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x8dc]
call fcn.00404b90
push eax
push 0x8e
lea edx, [ebp - 0x8c0]
push edx
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x8e4], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x8e4]
call fcn.00404b90
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404b90
push eax
call fcn.00411750
add esp, 0xc
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 0x86c], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8c0]
call fcn.00403a00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8a4]
call fcn.00403a00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x888]
call fcn.00403a00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00403a00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x848]
call fcn.00403a00
mov eax, dword [ebp - 0x86c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421275
mov esp, ebp
pop ebp
ret
Function at 0x411c60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431de9
mov eax, dword fs:[0]
push eax
sub esp, 0x900
mov eax, dword [0x43d76c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8e4], ecx
push 0x98
lea eax, [ebp - 0x868]
push eax
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x8e8], eax
mov ecx, dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x8ec]
call fcn.00403bc0
mov byte [ebp - 0x849], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x868]
call fcn.00403a00
movzx edx, byte [ebp - 0x849]
test edx, edx
je 0x411cf6
mov eax, 1
jmp 0x411f00
push 1
push 0x19
lea eax, [ebp - 0x82c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x411d14
xor eax, eax
jmp 0x411f00
lea ecx, [ebp - 0x82c]
push ecx
lea ecx, [ebp - 0x848]
call fcn.00403990
mov dword [ebp - 4], 1
push 0x4348b8
lea ecx, [ebp - 0x848]
call fcn.00403a80
lea edx, [ebp - 0x848]
push edx
call fcn.004033d0
add esp, 4
lea ecx, [ebp - 0x848]
call fcn.00404b90
push eax
call fcn.00401e30
add esp, 4
test eax, eax
jne 0x411d8b
mov dword [ebp - 0x86c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x848]
call fcn.00403a00
mov eax, dword [ebp - 0x86c]
jmp 0x411f00
push 0x98
lea eax, [ebp - 0x888]
push eax
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x8f0], eax
mov ecx, dword [ebp - 0x8f0]
mov dword [ebp - 0x8f4], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x8f4]
call fcn.00404b90
push eax
mov edx, dword [ebp - 0x8e4]
add edx, 0x20
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00413250
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x888]
call fcn.00403a00
lea ecx, [ebp - 0x2c]
push ecx
call fcn.004033d0
add esp, 4
push 0x9b
lea edx, [ebp - 0x8a8]
push edx
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0x8fc], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x8fc]
push ecx
lea edx, [ebp - 0x848]
push edx
lea eax, [ebp - 0x8c4]
push eax
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x900], eax
mov ecx, dword [ebp - 0x900]
mov dword [ebp - 0x904], ecx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x904]
call fcn.00404b90
push eax
push 0x9a
lea edx, [ebp - 0x8e0]
push edx
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x90c], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x90c]
call fcn.00404b90
push eax
lea ecx, [ebp - 0x2c]
call fcn.00404b90
push eax
call fcn.00411750
add esp, 0xc
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 0x88c], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x8e0]
call fcn.00403a00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8c4]
call fcn.00403a00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8a8]
call fcn.00403a00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.00403a00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x848]
call fcn.00403a00
mov eax, dword [ebp - 0x88c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421275
mov esp, ebp
pop ebp
ret
Function at 0x413940
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4320f3
mov eax, dword fs:[0]
push eax
mov eax, 0x106c
call fcn.00422200
mov eax, dword [0x43d76c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1068], ecx
mov eax, dword [ebp - 0x1068]
mov ecx, dword [eax + 0x28]
fild qword [ecx + 0x60]
fdiv qword [0x434a58]
fstp dword [ebp - 0x820]
push 0x800
push 0
lea edx, [ebp - 0x81c]
push edx
call fcn.004212e0
add esp, 0xc
push 0x3ec
lea eax, [ebp - 0x1060]
push eax
mov ecx, dword [ebp - 0x1068]
add ecx, 4
call fcn.0040c0c0
mov ecx, eax
call fcn.0040c070
push eax
lea ecx, [ebp - 0x14]
call fcn.0040e430
push 0x3fe
lea ecx, [ebp - 0x81c]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00414130
lea edx, [ebp - 0x81c]
push edx
mov eax, dword [ebp - 0x1068]
mov ecx, dword [eax + 0x28]
add ecx, 0x40
call fcn.00403a50
push 0x800
push 0
lea ecx, [ebp - 0x1054]
push ecx
call fcn.004212e0
add esp, 0xc
fldz
fstp dword [ebp - 0x18]
mov edx, dword [ebp - 0x1068]
mov eax, dword [edx + 0x28]
add eax, 0x40
push eax
lea ecx, [ebp - 0x848]
call fcn.004039d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x848]
call fcn.00403bb0
cmp eax, 2
jbe 0x413a50
push 2
lea ecx, [ebp - 0x848]
call fcn.00413f60
lea ecx, [ebp - 0x105c]
push ecx
lea edx, [ebp - 0x854]
push edx
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0x848]
call fcn.00404b90
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, 1
jne 0x413ad7
mov ecx, dword [ebp - 0x82c]
mov edx, dword [ebp - 0x828]
mov dword [ebp - 0x1070], ecx
mov dword [ebp - 0x106c], edx
mov eax, dword [ebp - 0x106c]
mov dword [ebp - 0x1074], eax
and dword [ebp - 0x106c], 0x7fffffff
fild qword [ebp - 0x1070]
and dword [ebp - 0x1074], 0x80000000
mov dword [ebp - 0x1078], 0
fild qword [ebp - 0x1078]
fchs
faddp st(1)
fdiv qword [0x434a58]
fstp dword [ebp - 0x18]
fld dword [ebp - 0x18]
fld dword [ebp - 0x820]
fcompp
fnstsw ax
test ah, 0x41
jne 0x413b14
fld dword [ebp - 0x18]
sub esp, 8
fstp qword [esp]
fld dword [ebp - 0x820]
sub esp, 8
fstp qword [esp]
push 0x4349d0
lea ecx, [ebp - 0x1054]
push ecx
call fcn.00414100
add esp, 0x18
jmp 0x413b3d
fld dword [ebp - 0x18]
sub esp, 8
fstp qword [esp]
fld dword [ebp - 0x820]
sub esp, 8
fstp qword [esp]
push 0x434a1c
lea edx, [ebp - 0x1054]
push edx
call fcn.00414100
add esp, 0x18
push 0x3fa
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1068]
add ecx, 4
call fcn.0040c0c0
lea ecx, [ebp - 0x1054]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040c080
mov dword [ebp - 0x1064], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x848]
call fcn.00403a00
mov eax, dword [ebp - 0x1064]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00421275
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413ba0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432139
mov eax, dword fs:[0]
push eax
sub esp, 0x870
mov eax, dword [0x43d76c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x874], ecx
push 0x800
push 0
lea eax, [ebp - 0x82c]
push eax
call fcn.004212e0
add esp, 0xc
push 1
push 0x26
lea ecx, [ebp - 0x82c]
push ecx
mov edx, dword [ebp - 0x874]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x413c1a
push 0x434a4c
lea ecx, [ebp - 0x82c]
push ecx
call fcn.0040fe40
add esp, 8
lea edx, [ebp - 0x82c]
push edx
lea ecx, [ebp - 0x84c]
call fcn.00403990
mov dword [ebp - 4], 0
lea eax, [ebp - 0x84c]
push eax
mov ecx, dword [ebp - 0x874]
mov edx, dword [ecx + 4]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00413640
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84c]
call fcn.00403a00
lea ecx, [ebp - 0x2c]
call fcn.00403bc0
movzx ecx, al
test ecx, ecx
jne 0x413d37
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x874]
mov ecx, dword [eax + 0x28]
add ecx, 0x40
call fcn.00403a30
push 0x99
lea ecx, [ebp - 0x868]
push ecx
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x878], eax
mov edx, dword [ebp - 0x878]
mov dword [ebp - 0x87c], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x87c]
push eax
mov ecx, dword [ebp - 0x874]
mov ecx, dword [ecx + 0x28]
add ecx, 0x40
call fcn.0040c030
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x868]
call fcn.00403a00
mov edx, dword [ebp - 0x874]
mov eax, dword [edx + 0x28]
add eax, 0x40
push eax
call fcn.004033d0
add esp, 4
push 0x3ec
lea ecx, [ebp - 0x86c]
push ecx
mov ecx, dword [ebp - 0x874]
add ecx, 4
call fcn.0040c0c0
mov ecx, eax
call fcn.0040c070
push eax
lea ecx, [ebp - 0x830]
call fcn.0040e430
mov edx, dword [ebp - 0x874]
mov ecx, dword [edx + 0x28]
add ecx, 0x40
call fcn.00404b90
push eax
lea ecx, [ebp - 0x830]
call fcn.0040c080
mov dword [ebp - 0x870], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403a00
mov eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00421275
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417a30
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x43d76c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0
mov eax, dword [str.C:_]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x434f7c]
mov dword [ebp - 0xc], ecx
mov dx, word [0x434f80]
mov word [ebp - 8], dx
xor eax, eax
mov word [ebp - 0x118], ax
push 0xfe
push 0
lea ecx, [ebp - 0x116]
push ecx
call fcn.004212e0
add esp, 0xc
mov dword [ebp - 0x11c], 0
jmp 0x417aa3
mov edx, dword [ebp - 0x11c]
add edx, 1
mov dword [ebp - 0x11c], edx
cmp dword [ebp - 0x11c], 0x18
jge 0x417b14
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x417b06
mov edx, dword [ebp - 0x14]
push edx
push 0x434f84
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403990
mov edx, dword [ebp - 0x120]
or edx, 1
mov dword [ebp - 0x120], edx
mov eax, dword [ebp + 8]
jmp 0x417b35
mov ax, word [ebp - 0x10]
add ax, 1
mov word [ebp - 0x10], ax
jmp 0x417a94
lea ecx, [ebp - 0x118]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00403990
mov edx, dword [ebp - 0x120]
or edx, 1
mov dword [ebp - 0x120], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00421275
mov esp, ebp
pop ebp
ret
Function at 0x41ef20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x43d76c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00413480
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041eec0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41ef8b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.004134b0
mov eax, dword [ebp - 0x224]
jmp 0x41f01c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41eff1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0041ef20
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41efe8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.004134b0
mov eax, dword [ebp - 0x228]
jmp 0x41f01c
mov dword [ebp - 4], 0x100
jmp 0x41ef92
lea ecx, [ebp - 0x14]
call fcn.004134d0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.0041ee60
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.004134b0
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00421275
mov esp, ebp
pop ebp
ret 4
Function at 0x41f5b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x41f5b9
xor ecx, ecx
jne 0x41f5b9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x41f5da
mov eax, 0xd
jmp 0x41f635
xor eax, eax
jne 0x41f5c1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x41f5eb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x420982
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x43ed08], 0
push esi
jne 0x4208f5
call fcn.0042081b
test eax, eax
je 0x420938
mov eax, dword [0x43ed08]
cmp eax, 1
jne 0x420916
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x420938
pop esi
ret
push eax
call dword [0x43ed10]
test eax, eax
jne 0x420980
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x42093c
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x43ed08]
call dword [0x43ed10]
mov edi, eax
test edi, edi
je 0x420961
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x42097d
mov edi, esi
add esi, 0xff0
push edi
push dword [0x43ed08]
call dword [0x43ed0c]
add edi, 0x10
cmp edi, esi
jb 0x420969
mov eax, edi
pop edi
pop esi
ret
jmp 0x4208e2

Function at 0x421275
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43d76c]
jne 0x42127f
repz ret
jmp fcn.0042598c
Function at 0x42c905
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00424126
and dword [ebp - 4], 0
cmp dword [0x43f8d8], 0
mov ebx, eax
jne 0x42c9b6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42ca67
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42ca67
push eax
call fcn.004240b4
mov dword [esp], 0x436f70
push edi
mov dword [0x43f8d8], eax
call esi
push eax
call fcn.004240b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43f8dc], eax
call esi
push eax
call fcn.004240b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43f8e0], eax
call esi
push eax
call fcn.004240b4
pop ecx
mov dword [0x43f8e8], eax
test eax, eax
je 0x42c9b6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004240b4
pop ecx
mov dword [0x43f8e4], eax
mov eax, dword [0x43f8e4]
cmp eax, ebx
je 0x42ca0e
cmp dword [0x43f8e8], ebx
je 0x42ca0e
push eax
call fcn.0042412f
push dword [0x43f8e8]
mov esi, eax
call fcn.0042412f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42ca0e
test edi, edi
je 0x42ca0e
call esi
test eax, eax
je 0x42ca05
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42ca05
test byte [ebp - 0xc], 1
jne 0x42ca0e
or dword [ebp + 0x10], 0x200000
jmp 0x42ca47
mov eax, dword [0x43f8dc]
cmp eax, ebx
je 0x42ca47
push eax
call fcn.0042412f
pop ecx
test eax, eax
je 0x42ca47
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42ca47
mov eax, dword [0x43f8e0]
cmp eax, ebx
je 0x42ca47
push eax
call fcn.0042412f
pop ecx
test eax, eax
je 0x42ca47
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43f8d8]
call fcn.0042412f
pop ecx
test eax, eax
je 0x42ca67
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42ca69
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401313
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4013c7
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004012a3
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x4013a0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4013d3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x4013ee
test ebp, ebp
je 0x4013ee
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x4013f6
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x401436
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x401492
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x40148d
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401478
test dl, dl
je 0x401474
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401478
add ecx, 2
add eax, 2
test dl, dl
jne 0x401458
xor eax, eax
jmp 0x40147d
sbb eax, eax
or eax, 1
test eax, eax
je 0x40149c
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x401445
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
Function at 0x4014b3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push edi
mov edi, edx
mov ebx, ecx
call fcn.00401313
test eax, eax
jne 0x4014cb
pop edi
pop ebx
add esp, 0x10
ret
push esi
lea edx, [esp + 0xc]
mov ecx, eax
mov dword [esp + 0xc], 0x74726956
mov dword [esp + 0x10], 0x416c6175
mov dword [esp + 0x14], 0x636f6c6c
mov byte [esp + 0x18], 0
call fcn.004013d3
mov esi, eax
test esi, esi
jne 0x401501
pop esi
pop edi
pop ebx
add esp, 0x10
ret
push 0x40
push 0x3000
push edi
push ebx
call esi
test eax, eax
jne 0x40151b
push 0x40
push 0x3000
push edi
push eax
call esi
pop esi
pop edi
pop ebx
add esp, 0x10
ret