joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51786c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x51789d
dec al
je 0x5178d8
dec al
je 0x51791d
dec al
je 0x517986
jmp 0x517a10
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x517a10
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5178ad
jmp 0x517a10
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x517a10
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5178e8
jmp 0x517a10
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x517a10
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x51794c
xor ebp, ebp
jmp 0x51795c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x517965
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x51792d
jmp 0x517a10
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x517a10
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5179df
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00515244
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x51799a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x546860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x5468ba
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.00546850
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.005444a8
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00543fc0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5468c1
lea eax, [ebp - 4]
call fcn.0040519c
ret
Function at 0x552a00
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
and edx, edx
je 0x552a1d
jcxz 0x552a1d
push ebx
movzx ebx, al
xor bl, byte [edx]
shr eax, 8
xor eax, dword cs:[ebx*4 + 0x552a1e]
inc edx
dec ecx
jne 0x552a08
pop ebx
ret

Function at 0x555934
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
mov ebx, eax
xor ecx, ecx
cmp dword [0x5732ac], 4
jge 0x55595a
mov eax, dword [edx + ecx*4]
xchg ah, al
rol eax, 0x10
xchg ah, al
mov dword [ebx], eax
add ebx, 4
inc ecx
cmp ecx, 0x10
jne 0x555943
jmp 0x55596a
mov eax, dword [edx + ecx*4]
bswap eax
mov dword [ebx], eax
add ebx, 4
inc ecx
cmp ecx, 0x10
jne 0x55595a
mov ecx, 0x40
pop edx
cmp dl, 0
je 0x55598d
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
rol eax, 1
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x555975
pop ebx
ret
mov eax, dword [ebx - 0xc]
xor eax, dword [ebx - 0x20]
xor eax, dword [ebx - 0x38]
xor eax, dword [ebx - 0x40]
mov dword [ebx], eax
add ebx, 4
dec ecx
jne 0x55598d
pop ebx
ret
Function at 0x55c5e0
Capabilities:
Log keystrokes

Disassembly:
push 0x55c6f0
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x55c600
push 0
push 0xd
push pe_nt_image_headers32
push eax
call sub.user32.dll_PostMessageA
ret
push 0x55c704
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x55c678
push 2
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call sub.user32.dll_SetWindowPos
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x43
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x43
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
jmp 0x55c6ee
push 0x55c710
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x55c6ee
push 2
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
call sub.user32.dll_SetWindowPos
push 0
push 0
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x49
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x49
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x49
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x49
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x12
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x12
call sub.user32.dll_keybd_event
ret
Function at 0x55dc40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040561c
xor eax, eax
push ebp
push 0x55ddc1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00557f00
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00557f20
mov ebx, eax
jmp 0x55dd8d
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.0040540c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a268
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409590
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409590
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004055c4
je 0x55dd64
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.0040540c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409590
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409590
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004055c4
jne 0x55dd7e
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00557f40
mov ebx, eax
test ebx, ebx
jne 0x55dcbf
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55ddc8
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004051c0
lea eax, [ebp - 4]
call fcn.0040519c
ret
Function at 0x55f040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040561c
xor eax, eax
push ebp
push 0x55f1c1
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.00557f00
mov esi, eax
mov dword [ebp - 0x12c], 0x128
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00557f20
mov ebx, eax
jmp 0x55f18d
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.0040540c
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.0040a268
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00409590
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00409590
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004055c4
je 0x55f164
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x108]
mov ecx, 0x104
call fcn.0040540c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00409590
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00409590
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004055c4
jne 0x55f17e
push 0
mov eax, dword [ebp - 0x124]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x12c]
mov eax, esi
call fcn.00557f40
mov ebx, eax
test ebx, ebx
jne 0x55f0bf
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f1c8
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004051c0
lea eax, [ebp - 4]
call fcn.0040519c
ret

Function at 0x55f1d4
Capabilities:
Acquire debug privileges

Disassembly:
add esp, 0xffffffcc
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x55f1f6
mov eax, 0xfffffffe
jmp 0x55f26d
lea eax, [esp + 8]
push eax
push 0x55f274
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x55f218
mov eax, 0xfffffffd
jmp 0x55f26d
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 1
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 2
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 0x10
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x55f26b
mov eax, 0xfffffffc
jmp 0x55f26d
xor eax, eax
add esp, 0x34
ret
Function at 0x561578
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe8
call fcn.0055f1d4
push esp
push 0xf00ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x561599
xor eax, eax
jmp 0x5615fa
lea eax, [esp + 0xc]
push eax
push 0x561600
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
xor eax, eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x5615e7
xor eax, eax
jmp 0x5615fa
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x5615f8
xor eax, eax
jmp 0x5615fa
mov al, 1
add esp, 0x18
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4027e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40401d], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Marmimo
push str.Mimoclass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402828
xor eax, eax
jmp 0x402843
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x480a1512
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..reloc
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x777b4332
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401f2e
Capabilities:
Get common file path

Disassembly:
sub esp, 0x550
and dword [esp + 0xc], 0
push ebx
mov ebx, ecx
lea ecx, [esp + 0x10]
push ebp
push esi
mov esi, edx
mov dword [esp + 0x2c], ebx
mov eax, dword [ebx]
mov dword [esp + 0x20], eax
push edi
mov eax, dword [esi]
mov edi, dword [ebx + 4]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x38], eax
call fcn.00401dd4
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi + 0xc]
add ebp, 0x23f
mov ebx, dword [esi + 8]
push 0x20
mov dword [esp + 0x20], ebp
mov dword [esp + 0x30], eax
pop esi
mov dword [esp + 0x28], 2
add dword [esp + 0x28], 3
mov edx, dword [esp + 0x24]
mov eax, edx
shl eax, 4
add eax, ebx
mov dword [esp + 0x18], 0xedeb2e40
cmp dword [0x2c896c4], 0xfa9
mov dword [esp + 0x10], eax
mov eax, dword [0x2c89708]
cmove eax, dword [esp + 0x18]
and dword [esp + 0x18], 0
cmp dword [0x2c896c4], 0x3eb
mov dword [0x2c89708], eax
mov eax, dword [0x2c89710]
cmove eax, dword [esp + 0x18]
mov dword [0x2c89710], eax
lea eax, [edx + ebp]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
shr eax, 5
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
xor ebp, ebp
mov eax, dword [esp + 0x14]
xor ecx, dword [esp + 0x18]
add eax, dword [esp + 0x2c]
xor eax, ecx
mov dword [0x2c8970c], 0xf4ea3dee
cmp dword [0x2c896c4], 0x213
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jne 0x402061
push ebp
push ebp
push ebp
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
push ebp
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea eax, [esp + 0x160]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.gixecig_powobiwuvagexagecuwodinupuyugu
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
mov eax, dword [esp + 0x14]
sub edi, eax
mov eax, edi
mov dword [esp + 0x3c], edi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
add dword [esp + 0x10], eax
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x1c]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
nop
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x28]
mov eax, edi
shr eax, cl
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
add dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x18]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x24], eax
mov edx, 0x9e3779b9
lea ecx, [esp + 0x1c]
call fcn.00401f25
dec esi
je 0x4020d7
mov ebp, dword [esp + 0x1c]
jmp 0x401f7f
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov dword [ebx + 4], edi
pop edi
pop esi
pop ebp
mov dword [ebx], eax
pop ebx
add esp, 0x550
ret
Function at 0x40c154
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42dcc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409076
mov dword [ebp - 0x14], eax
cmp dword [0x2c8a5f8], esi
jne 0x40c247
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c1d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c327
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c327
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c327
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x2c8a5f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x2c8a5fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x2c8a600], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2c8a608], eax
test eax, eax
je 0x40c244
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2c8a604], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c26c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c25f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c281
push 4
pop eax
jmp 0x40c329
cmp dword [ebp - 0x14], esi
je 0x40c281
push dword [0x2c8a5f8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c266
mov eax, dword [0x2c8a604]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c2df
cmp dword [0x2c8a608], edi
je 0x40c2df
push eax
call ebx
push dword [0x2c8a608]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c2df
test eax, eax
je 0x40c2df
call ecx
test eax, eax
je 0x40c2d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c2d4
test byte [ebp - 8], 1
jne 0x40c2df
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c30f
mov eax, dword [0x2c8a5fc]
cmp eax, edi
je 0x40c30c
push eax
call ebx
test eax, eax
je 0x40c30c
call eax
mov esi, eax
test esi, esi
je 0x40c30c
mov eax, dword [0x2c8a600]
cmp eax, edi
je 0x40c30c
push eax
call ebx
test eax, eax
je 0x40c30c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x2c8a5f8]
call ebx
test eax, eax
je 0x40c327
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c329
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040451e
mov esp, ebp
pop ebp
ret
Function at 0x407008
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffbe4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x40704a
movzx eax, bl
add ax, 0x41
dec eax
mov word [esp], ax
mov word [esp + 2], 0x3a
mov word [esp + 4], 0
lea eax, [esp + 0x212]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
push esp
call sub.kernel32.dll_SetCurrentDirectoryW
lea eax, [esp + 8]
push eax
push 0x105
call sub.kernel32.dll_GetCurrentDirectoryW
test bl, bl
je 0x40706a
lea eax, [esp + 0x212]
push eax
call sub.kernel32.dll_SetCurrentDirectoryW
mov eax, esi
lea edx, [esp + 8]
mov ecx, 0x105
call fcn.0040a880
add esp, 0x41c
pop esi
pop ebx
ret

Function at 0x4072c0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00409d60
test esi, esi
jne 0x4072f6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00409ee8
jmp 0x407314
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004071a4
mov edi, eax
test esi, esi
je 0x407314
cmp dword [ebx], 0
je 0x407314
dec esi
jmp 0x4072fd
add esp, 0x20c
pop edi
pop esi
pop ebx
ret
Function at 0x408974
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00408e34
mov byte [esp], al
cmp byte [esp], 0
jne 0x408afd
test edi, edi
je 0x408afd
mov byte [esp + 1], 0
test ebp, ebp
jle 0x408a3d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x408a18
cmp edi, 0xffffffff
je 0x4089d9
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x4089d9
mov byte [esp], 0
jmp 0x408afd
cmp dword [esi], 1
jg 0x408a18
cmp dword [esi], 0
jne 0x408a0a
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x408a0a
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x408afd
lea eax, [esp + 0xc]
call fcn.00408630
dec ebp
test ebp, ebp
jg 0x4089be
cmp edi, 0xffffffff
je 0x408a3d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x408a3b
mov byte [esp], 0
jmp 0x408afd
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x408982
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408a3d
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.00408b78
mov edx, eax
mov ebx, dword [0x5208f8]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x408aa1
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x408a9f
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x408aa1
xor edi, edi
cmp byte [esp], 0
je 0x408ac7
mov ebx, dword [esi]
test bl, 1
jne 0x408add
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408aa7
mov byte [esp + 1], 1
jmp 0x408add
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x408ac7
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x408a54
cmp byte [esp], 0
je 0x408afd
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4099bc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x520058], 0
je 0x409a23
cmp word [0x520344], 0xd7b2
jne 0x4099e5
cmp dword [0x52034c], 0
jbe 0x4099e5
mov eax, 0x520340
call dword [0x52035c]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x409a50
call fcn.0040a534
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x51c032], 0
jne 0x409a3f
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret