joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45babc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45bc70
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x45bb2f
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.0042c9dc
mov eax, dword [ebp - 0x154]
push eax
lea edx, [ebp - 0x158]
mov eax, edi
call fcn.0042c5e0
mov eax, dword [ebp - 0x158]
pop edx
call fcn.0042c6d8
test eax, eax
jne 0x45bb2f
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042c9b4
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45bc3b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
push eax
lea edx, [ebp - 0x154]
mov eax, edi
call fcn.0042c5e0
lea eax, [ebp - 0x154]
mov edx, 0x45bc88
call fcn.004036c4
mov eax, dword [ebp - 0x154]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x45bc24
xor eax, eax
push ebp
push 0x45bc1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x150]
call fcn.0045a5d0
test al, al
je 0x45bbf2
lea eax, [ebp - 0x10]
lea edx, [ebp - 0x124]
mov ecx, 0x104
call fcn.004036a4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0042c6d8
test eax, eax
je 0x45bbf2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0045b328
test eax, eax
jne 0x45bbf2
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [ebp - 0x10]
mov edx, esi
call fcn.0045b230
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45bb97
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc24
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc42
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x45e954
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ead9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2dc]
mov edx, 0x20
call fcn.00414800
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2dc]
mov edx, 0x20
call fcn.00414820
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.00414800
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x2e0]
mov edx, 0x20
call fcn.00414820
xor eax, eax
push ebp
push 0x45eab9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x1010
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0x10
push 0x45eae8
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45ea2d
cmp byte [ebp - 0x158], 0
je 0x45ea2d
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x489014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2dc]
call fcn.0045e894
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
xor eax, eax
call fcn.0046f7ec
cmp dword [ebp - 4], 0
jne 0x45ea51
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov dl, 2
mov al, 1
call fcn.0046f7ec
cmp dword [ebp - 4], 0
je 0x45eaaf
push 0x1000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45eaaf
cmp byte [ebp - 0x158], 0
je 0x45eaaf
mov eax, dword [ebp - 0x160]
push eax
lea eax, [ebp - 0x158]
push eax
mov eax, dword [0x489014]
push eax
call sub.shell32.dll_ExtractIconA
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x2e0]
call fcn.0045e894
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45eac3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45eae0
lea eax, [ebp - 4]
call fcn.00403548
ret
Function at 0x464804
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00403880
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jle 0x4648a6
mov eax, ebx
call fcn.00402650
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x46489f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
push edi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x464889
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x464924
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x464889
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464919
mov eax, dword [ebp - 0x10]
call fcn.00402668
ret
cmp dword [0x4880e0], 1
je 0x464919
mov eax, esi
call fcn.0046464c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x464919
xor eax, eax
push ebp
push 0x464912
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x464924
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x4648fc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464919
mov eax, dword [ebp - 0x10]
call fcn.00402668
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x464f20
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, edx
mov edi, eax
test esi, esi
je 0x464f51
mov eax, edi
call fcn.00403880
mov ebp, eax
push ebp
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x464f51
and ebx, 0xffffff7f
or ebx, esi
push ebx
push ebp
call sub.kernel32.dll_SetFileAttributesA
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x465e60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403870
xor eax, eax
push ebp
push 0x46604e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0042c88c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0042cc34
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004035dc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c9b4
cmp dword [ebp - 0xc], 0
je 0x46601e
mov eax, dword [ebp - 4]
call fcn.0042cdc4
test al, al
je 0x465ee6
test byte [ebp - 5], 2
je 0x46601e
jmp 0x465fd4
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c92c
mov eax, dword [ebp - 0xc]
push eax
mov dl, byte [0x466060]
not edx
and dl, byte [ebp - 5]
pop eax
call fcn.00465e60
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x46606c
call fcn.00454fa4
push 0
mov eax, dword [ebp - 4]
call fcn.00403880
mov esi, eax
push esi
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x465f9b
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.0045096c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.00406dd0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0042e684
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x24]
mov ecx, 2
mov al, 0x60
call fcn.0045093c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, 0x406430
call fcn.00408dbc
call fcn.00403264
mov bl, 1
test byte [ebp - 5], 8
je 0x465fd4
push 0
push esi
push 1
push 8
call sub.shell32.dll_SHChangeNotify
push 0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042c92c
mov eax, dword [ebp - 0xc]
call fcn.00403880
push eax
push 0x1001
push 0x1000
call sub.shell32.dll_SHChangeNotify
test byte [ebp - 5], 4
je 0x465fe9
mov edx, dword [ebp - 4]
mov eax, dword [0x48a214]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
jmp 0x46601e
test byte [ebp - 5], 1
jne 0x46601e
push 0
test byte [ebp - 5], 8
setne al
and eax, 0x7f
mov eax, dword [eax*4 + 0x488a48]
or eax, 2
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x30]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dx, 0x81
call fcn.004555c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466055
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00403568
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403568
lea eax, [ebp - 4]
call fcn.00403548
ret
Function at 0x46a1b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x46a302
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x144]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0042c5e0
lea eax, [ebp - 0x148]
mov edx, 0x46a318
call fcn.004036c4
mov eax, dword [ebp - 0x148]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46a2e1
lea eax, [ebp - 4]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.004036a4
mov eax, dword [ebp - 4]
call fcn.004036bc
cmp eax, 9
jl 0x46a2c6
lea eax, [ebp - 0x148]
push eax
mov ecx, 5
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004038c0
mov eax, dword [ebp - 0x148]
mov edx, 0x46a32c
call fcn.00406af4
test eax, eax
jne 0x46a2c6
mov eax, dword [ebp - 4]
mov al, byte [eax + 5]
add al, 0xd0
sub al, 0xa
jae 0x46a2c6
mov eax, dword [ebp - 4]
mov al, byte [eax + 6]
add al, 0xd0
sub al, 0xa
jae 0x46a2c6
mov eax, dword [ebp - 4]
mov al, byte [eax + 7]
add al, 0xd0
sub al, 0xa
jae 0x46a2c6
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0x2e
jne 0x46a2c6
lea eax, [ebp - 0x148]
push eax
mov ecx, 3
mov edx, 6
mov eax, dword [ebp - 4]
call fcn.004038c0
mov eax, dword [ebp - 0x148]
call fcn.00406e00
mov edx, dword [ebp + 8]
mov byte [edx + eax - 0x3ec], 1
lea eax, [ebp - 0x144]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x46a219
push ebx
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a309
lea eax, [ebp - 0x148]
call fcn.00403548
lea eax, [ebp - 4]
call fcn.00403548
ret

Function at 0x46a734
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, 0x489ff0
mov esi, dword [ebp + 8]
add esi, 0xfffffff8
cmp dword [esi], 0
je 0x46a7a2
jmp 0x46a760
mov edx, 0x46a7b0
mov al, 0x41
call fcn.0046a5e4
test al, al
jne 0x46a760
call fcn.00408d90
mov eax, dword [ebx]
call fcn.00407030
test al, al
je 0x46a74b
jmp 0x46a782
mov edx, 0x46a7c4
mov al, 0x40
call fcn.0046a5e4
test al, al
jne 0x46a782
call fcn.00408d90
mov eax, dword [ebx]
call fcn.00403880
push eax
mov eax, dword [esi]
call fcn.00403880
push eax
call sub.kernel32.dll_MoveFileA
test eax, eax
je 0x46a76d
mov eax, esi
call fcn.00403548
pop esi
pop ebx
pop ebp
ret
Function at 0x470560
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, 0x48a168
cmp byte [0x48a11f], 0
sete byte [0x48a1f0]
cmp dword [0x489f58], 0
je 0x4705bf
mov eax, dword [ebp]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x4705bf
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp]
call fcn.0040b620
mov edx, dword [eax]
mov eax, dword [0x489f58]
call fcn.00406af4
test eax, eax
jne 0x4705bb
mov eax, ebx
call fcn.004703a8
mov byte [0x48a1f0], 0
jmp 0x470666
inc ebx
dec esi
jne 0x47058e
mov al, byte [0x48a120]
sub al, 1
jb 0x4705cc
je 0x4705d5
jmp 0x4705de
call fcn.0042e28c
mov edi, eax
jmp 0x4705e0
call sub.kernel32.dll_GetUserDefaultLangID
mov edi, eax
jmp 0x4705e0
xor edi, edi
test di, di
je 0x47064f
mov eax, dword [ebp]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x470614
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp]
call fcn.0040b620
mov eax, dword [eax + 0x28]
movzx edx, di
cmp eax, edx
jne 0x470610
mov eax, ebx
call fcn.004703a8
jmp 0x470666
inc ebx
dec esi
jne 0x4705f3
mov eax, dword [ebp]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x47064f
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp]
call fcn.0040b620
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, edi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x47064b
mov eax, ebx
call fcn.004703a8
jmp 0x470666
inc ebx
dec esi
jne 0x470622
xor eax, eax
call fcn.004703a8
cmp byte [0x48a11f], 2
jne 0x470666
mov byte [0x48a1f0], 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x486054
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x486223
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0042d8a8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00451128
test al, al
jne 0x4860b9
xor eax, eax
push ebp
push 0x4860af
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0045139c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4860b9
push 0
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
mov eax, dword [0x48a2c4]
call fcn.00403880
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x4860e2
mov eax, dword [0x489cf0]
call fcn.004858cc
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
mov eax, dword [0x489014]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x486234
push 0x486238
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 8], eax
push 0x485a7c
push 0xfffffffffffffffc
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetWindowLongA
mov dword [0x48a2ec], eax
xor eax, eax
push ebp
push 0x4861f6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x97
push 0
push 0
push 0
push 0
push 0
mov eax, dword [0x489628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_SetWindowPos
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.0042d404
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x486248
call fcn.00407ad4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
call fcn.0042d274
mov edx, dword [ebp - 0x24]
pop eax
call fcn.004036c4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00485974
mov dword [ebp - 0xc], eax
call fcn.00485a40
test al, al
jne 0x4861d6
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x4861b6
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4861fd
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_DestroyWindow
ret
Function at 0x486fa4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4871ca
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x4871e0
mov eax, dword [0x489628]
call fcn.004244a8
push 5
mov eax, dword [0x489628]
mov eax, dword [eax + 0x20]
push eax
call sub.user32.dll_ShowWindow
xor eax, eax
push ebp
push 0x48719b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00470f54
lea eax, [ebp - 0x10]
call fcn.0042d87c
mov eax, dword [ebp - 0x10]
call fcn.00407454
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0042d404
mov edx, dword [ebp - 0x10]
mov eax, 0x48a2c4
call fcn.00403598
call fcn.00485c44
push 2
push 0
push 1
mov ecx, dword [0x48a2c4]
mov dl, 1
mov eax, 0x44fb58
call fcn.0044fc34
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4870c9
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0044fd2c
mov edx, dword [ebp - 0x18]
sub edx, 8
mov eax, dword [ebp - 4]
call fcn.0044fea4
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.0044fe7c
cmp dword [ebp - 0xc], 0x67734d49
je 0x4870a6
lea ecx, [ebp - 0x10]
mov edx, 0x4871f4
mov eax, dword [0x48a2c4]
call fcn.0042c654
mov edx, dword [ebp - 0x10]
mov eax, 0x48a2cc
call fcn.00403598
xor edx, edx
mov eax, dword [0x48a2cc]
call fcn.00450ac0
jmp 0x4870b3
mov edx, dword [ebp - 8]
mov eax, dword [0x48a2c4]
call fcn.00450ac0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4870d0
mov eax, dword [ebp - 4]
call fcn.00402ca0
ret
Function at 0x10003a00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10025f70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0xc], ebx
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov edx, dword [edi]
mov dword [edi + 4], ebx
mov esi, dword [edx + 4]
add esi, edi
call fcn.10001ce0
mov eax, dword [esp + 0x24]
push esi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
call fcn.10003fa0
mov byte [esi + 0x30], al
cmp dword [esi + 0x28], ebx
jne 0x10003a6e
mov eax, dword [esi + 8]
or eax, 4
and eax, 0x17
mov dword [esi + 8], eax
test dword [esi + 0xc], eax
je 0x10003a6e
mov ecx, esi
call fcn.10001ac0
mov ecx, dword [esp + 0x10]
mov dword [esi + 4], ebx
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 8

Function at 0x10003a90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x10025b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10006207
push 4
mov dword [esp + 0x18], 0
call fcn.1000714d
mov edi, eax
add esp, 4
test edi, edi
je 0x10003b04
push ebx
call fcn.10005d9e
mov dword [edi], eax
call fcn.10005b97
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.10005fc8
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x10003af8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.10005ff0
pop ebx
jmp 0x10003b06
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x10007cc6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002fa18]
jne 0x10007cd0
repz ret
jmp fcn.1001101c
Function at 0x1001fbfd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000c7c9
and dword [ebp - 4], 0
cmp dword [0x10031b8c], 0
mov ebx, eax
jne 0x1001fcae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001fd5f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001fd5f
push eax
call fcn.1000c757
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10031b8c], eax
call esi
push eax
call fcn.1000c757
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10031b90], eax
call esi
push eax
call fcn.1000c757
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10031b94], eax
call esi
push eax
call fcn.1000c757
pop ecx
mov dword [0x10031b9c], eax
test eax, eax
je 0x1001fcae
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000c757
pop ecx
mov dword [0x10031b98], eax
mov eax, dword [0x10031b98]
cmp eax, ebx
je 0x1001fd06
cmp dword [0x10031b9c], ebx
je 0x1001fd06
push eax
call fcn.1000c7d2
push dword [0x10031b9c]
mov esi, eax
call fcn.1000c7d2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001fd06
test edi, edi
je 0x1001fd06
call esi
test eax, eax
je 0x1001fcfd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001fcfd
test byte [ebp - 0xc], 1
jne 0x1001fd06
or dword [ebp + 0x10], 0x200000
jmp 0x1001fd3f
mov eax, dword [0x10031b90]
cmp eax, ebx
je 0x1001fd3f
push eax
call fcn.1000c7d2
pop ecx
test eax, eax
je 0x1001fd3f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001fd3f
mov eax, dword [0x10031b94]
cmp eax, ebx
je 0x1001fd3f
push eax
call fcn.1000c7d2
pop ecx
test eax, eax
je 0x1001fd3f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10031b8c]
call fcn.1000c7d2
pop ecx
test eax, eax
je 0x1001fd5f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001fd61
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10023c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
xor edi, edi
call fcn.10026040
mov esi, eax
test esi, esi
je 0x10023ca7
mov al, 0x65
mov byte [esp + 0x12], al
mov byte [esp + 9], al
mov byte [esp + 0xd], al
lea eax, [esp + 8]
push eax
push esi
mov byte [esp + 0x18], 0x61
mov byte [esp + 0x17], 0x4e
mov byte [esp + 0x1c], 0
mov byte [esp + 0x19], 0x6d
mov byte [esp + 0x14], 0x73
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x16], 0x72
mov byte [esp + 0x10], 0x47
mov byte [esp + 0x1b], 0x41
mov byte [esp + 0x13], 0x55
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10023ca0
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push ecx
push edx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
pop edi
pop esi
add esp, 0x10
ret