joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a6a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0043abc0
push 0x105
lea ecx, [ebp - 0x214]
push 0
push ecx
call fcn.0043abc0
push str.iNodeLicense.ini
push esi
lea edx, [ebp - 0x214]
push 0x466504
push edx
call fcn.0043ac3a
add esp, 0x28
xor eax, eax
pop esi
mov cl, byte [ebp + eax - 0x214]
mov byte [ebp + eax - 0x10c], cl
inc eax
test cl, cl
jne 0x42a701
lea eax, [ebp - 0x10c]
push eax
call fcn.00430650
add esp, 4
test eax, eax
jne 0x42a735
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10c]
push ecx
push 0xffffffffffffffff
push str.IsExtendedLic
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x42ac10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0043abc0
push 0x105
lea ecx, [ebp - 0x214]
push 0
push ecx
call fcn.0043abc0
push str.iNodeLicense.ini
push esi
lea edx, [ebp - 0x214]
push 0x466504
push edx
call fcn.0043ac3a
add esp, 0x28
xor eax, eax
pop esi
mov cl, byte [ebp + eax - 0x214]
mov byte [ebp + eax - 0x10c], cl
inc eax
test cl, cl
jne 0x42ac71
lea eax, [ebp - 0x10c]
push eax
call fcn.00430650
add esp, 4
test eax, eax
jne 0x42aca5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10c]
push ecx
push 0
push str.Is3ComLic
push str.Common
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x42aec0
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x49dee8], 0
jne 0x42af47
push 0x105
push 0x49dee8
push str.CommonProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x42af47
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
cmp eax, 0x103
ja 0x42af5a
mov cl, byte [ebp - 0x10c]
push esi
push edi
mov edi, 0x49dee8
mov byte [0x49dee8], cl
mov byte [0x49dee9], 0
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42af30
mov ecx, 7
mov esi, str.:Program_FilesCommon_Files
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
Function at 0x430650
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x144]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43068d
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
test byte [ebp - 0x144], 0x10
push edi
je 0x4306b7
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
lea edx, [ebp - 0x144]
push edx
push esi
call edi
test eax, eax
je 0x4306d3
test byte [ebp - 0x144], 0x10
jne 0x4306a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x4306f0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 0x144]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43072d
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
test byte [ebp - 0x144], 0x10
push edi
jne 0x430757
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ecx]
lea edx, [ebp - 0x144]
push edx
push esi
call edi
test eax, eax
je 0x430773
test byte [ebp - 0x144], 0x10
je 0x430740
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x430980
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.00430650
add esp, 4
test eax, eax
jne 0x43099c
mov eax, 1
pop esi
pop ebp
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
pop ebp
ret
Function at 0x4309c0
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.0043abc0
push edi
push esi
lea ecx, [ebp - 0x20c]
push 0x466504
push ecx
call fcn.0043ac3a
add esp, 0x1c
lea edx, [ebp - 0x34c]
push edx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x430aa9
push 0x103
lea ecx, [ebp - 0x107]
push ebx
push ecx
mov byte [ebp - 0x108], bl
call fcn.0043abc0
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0xc
lea esp, [esp]
test byte [ebp - 0x34c], 0x10
jne 0x430a90
lea edx, [ebp - 0x320]
push edx
push esi
lea eax, [ebp - 0x108]
push 0x466504
push eax
call fcn.0043ac3a
add esp, 0x10
push 0x80
lea ecx, [ebp - 0x108]
push ecx
call ebx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x34c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x430a50
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x430b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], 0
call fcn.00430b20
mov ecx, dword [ebp + 8]
add esp, 8
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430b80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x430bc3
cmp dword [ebp - 4], esi
jne 0x430bc3
push esi
push edi
call fcn.00430b20
add esp, 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x430c40
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004306f0
add esp, 4
test eax, eax
jne 0x430c5c
mov eax, 1
pop esi
pop ebp
ret
push 0x466600
push esi
call fcn.004309c0
push esi
call fcn.00430c80
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
pop ebp
ret
Function at 0x430c80
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x213]
push 0
push eax
mov byte [ebp - 0x214], 0
call fcn.0043abc0
push 0x466600
push edi
lea ecx, [ebp - 0x214]
push 0x466504
push ecx
call fcn.0043ac3a
add esp, 0x1c
lea edx, [ebp - 0x354]
push edx
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x430dce
push 0x104
lea ecx, [ebp - 0x10b]
push 0
push ecx
mov byte [ebp - 0x10c], 0
call fcn.0043abc0
add esp, 0xc
jmp 0x430d10
test byte [ebp - 0x354], 0x10
je 0x430db1
mov ecx, 0x465f48
lea eax, [ebp - 0x328]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x430d48
test dl, dl
je 0x430d44
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x430d48
add eax, 2
add ecx, 2
test dl, dl
jne 0x430d28
xor eax, eax
jmp 0x430d4d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x430db1
mov ecx, 0x4689f8
lea eax, [ebp - 0x328]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x430d80
test dl, dl
je 0x430d7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x430d80
add eax, 2
add ecx, 2
test dl, dl
jne 0x430d60
xor eax, eax
jmp 0x430d85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x430db1
lea edx, [ebp - 0x328]
push edx
push edi
lea eax, [ebp - 0x10c]
push 0x466504
push eax
call fcn.0043ac3a
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00430c40
add esp, 0x14
lea edx, [ebp - 0x354]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x430d10
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00439bf4
mov esp, ebp
pop ebp
ret

Function at 0x431940
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.004306f0
add esp, 4
test eax, eax
je 0x431969
push 0x466600
push esi
call fcn.004309c0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
pop ebp
ret
Function at 0x432280
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461a2b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4745a8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045ea18
push 4
mov dword [ebp - 4], 0
call fcn.0043a677
mov edi, eax
add esp, 4
test edi, edi
je 0x432300
call fcn.0045e52a
mov dword [edi], eax
call fcn.0045e26b
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0045e0d4
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4322f6
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0045e0fc
jmp 0x432302
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4353e0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461feb
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
push 0x105
lea ecx, [ebp - 0x21c]
push ecx
mov dword [ebp - 0x23c], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec eax
cmp eax, 0x103
ja 0x4354e1
xor ebx, ebx
lea eax, [ebp - 0x21c]
mov byte [ebp - 0x21b], bl
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], ebx
mov byte [ebp - 0x238], bl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x435460
sub eax, edx
push eax
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x238]
call fcn.00407c70
push 5
push str.:_tmp
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], ebx
call fcn.00412810
cmp dword [ebp - 0x224], 0x10
mov eax, dword [ebp - 0x238]
jae 0x4354a6
lea eax, [ebp - 0x238]
push eax
call fcn.004306f0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 4
test eax, eax
jne 0x4354ff
cmp dword [ebp - 0x224], 0x10
mov eax, dword [ebp - 0x238]
jae 0x4354ce
lea eax, [ebp - 0x238]
push ebx
push eax
call esi
test eax, eax
jne 0x4354ff
lea ecx, [ebp - 0x238]
call fcn.00407790
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [ebp + 0x14], ebx
je 0x43550c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ebp - 0x224], 0x10
mov ecx, dword [ebp - 0x238]
jae 0x435521
lea ecx, [ebp - 0x238]
push eax
push edi
push ecx
lea eax, [ebp - 0x114]
push str._s_s_u
push eax
call fcn.0043ac3a
lea eax, [ebp - 0x114]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x435541
sub eax, edx
cmp dword [ebp + 0xc], eax
ja 0x43556c
cmp dword [ebp - 0x224], 0x10
jb 0x4354e1
mov ecx, dword [ebp - 0x238]
push ecx
call fcn.00439f71
add esp, 4
jmp 0x4354e1
lea edx, [ebp - 0x114]
push edx
call fcn.004306f0
add esp, 4
test eax, eax
lea eax, [ebp - 0x114]
jne 0x4355c0
push ebx
push eax
call esi
test eax, eax
je 0x4354d6
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 0x114]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4355a1
lea ecx, [ebp - 0x238]
call fcn.00407790
mov eax, 1
jmp 0x4354e3
mov esi, dword [ebp - 0x23c]
mov edx, esi
lea ecx, [ebp - 0x114]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4355d0
cmp dword [ebp + 0x18], ebx
je 0x4355ed
push 0x466600
push esi
call fcn.004309c0
add esp, 8
lea ecx, [ebp - 0x238]
call fcn.00407790
mov eax, 1
jmp 0x4354e3
Function at 0x4382d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4621eb
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x134]
lea esi, [ebp - 0x114]
push ecx
mov edx, esi
push edx
mov dword [ebp - 0x13c], ebx
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x134], 0x104
call edi
test eax, eax
jne 0x4383a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x138]
mov dword [ecx], eax
cmp eax, 0x6f
jne 0x43839e
mov eax, dword [ebp - 0x134]
inc eax
push eax
mov dword [ebp - 0x134], eax
call fcn.0043c17f
mov esi, eax
add esp, 4
test esi, esi
je 0x43839e
lea edx, [ebp - 0x134]
push edx
push esi
mov dword [ebp - 0x140], 1
call edi
test eax, eax
jne 0x4383a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x138]
push esi
mov dword [ecx], eax
call fcn.0043c174
add esp, 4
xor eax, eax
jmp 0x43849b
mov edx, dword [ebp + 0xc]
push edx
push 0x20
push ebx
call fcn.0043abc0
mov eax, esi
add esp, 0xc
mov byte [ebx], 0x33
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4383c0
sub eax, edx
mov edi, eax
cmp edi, dword [ebp + 0xc]
jb 0x438462
xor ebx, ebx
push 0xc
push str.getHostId3:
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], ebx
mov byte [ebp - 0x130], bl
call fcn.00407c70
mov eax, esi
mov dword [ebp - 4], ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x438406
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x130]
call fcn.00412810
mov eax, dword [ebp - 0x130]
mov ebx, 0x10
cmp dword [ebp - 0x11c], ebx
jae 0x438435
lea eax, [ebp - 0x130]
push 0
push eax
push str.UtlHost
call fcn.00424e80
add esp, 0xc
cmp dword [ebp - 0x11c], ebx
jb 0x43845c
mov eax, dword [ebp - 0x130]
push eax
call fcn.00439f71
add esp, 4
mov ebx, dword [ebp - 0x13c]
mov eax, dword [ebp + 0xc]
dec eax
cmp edi, eax
jae 0x43846c
mov eax, edi
push eax
push esi
inc ebx
push ebx
call fcn.00439f80
add esp, 0xc
cmp dword [ebp - 0x140], 0
je 0x43848a
push esi
call fcn.0043c174
add esp, 4
mov ecx, dword [ebp - 0x138]
mov dword [ecx], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00439bf4
mov esp, ebp
pop ebp
ret
Function at 0x439bf4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4745a8]
jne 0x439bfe
repz ret
jmp fcn.0043db98

Function at 0x459387
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4745a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043f746
and dword [ebp - 0x14], 0
cmp dword [0x49effc], 0
mov dword [ebp - 0x18], eax
jne 0x45943a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4594e2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4594e2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49effc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49f000], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49f004], eax
call edi
push eax
call esi
mov dword [0x49f00c], eax
test eax, eax
je 0x45943a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49f008], eax
mov eax, dword [0x49f008]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x459493
cmp dword [0x49f00c], ecx
je 0x459493
push eax
call esi
push dword [0x49f00c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x459493
test ebx, ebx
je 0x459493
call edi
test eax, eax
je 0x45948a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x45948a
test byte [ebp - 8], 1
jne 0x459493
or dword [ebp + 0x10], 0x200000
jmp 0x4594c6
mov eax, dword [0x49f000]
cmp eax, dword [ebp - 0x18]
je 0x4594c6
push eax
call esi
test eax, eax
je 0x4594c6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4594c6
mov eax, dword [0x49f004]
cmp eax, dword [ebp - 0x18]
je 0x4594c6
push eax
call esi
test eax, eax
je 0x4594c6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49effc]
call esi
test eax, eax
je 0x4594e2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4594e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439bf4
leave
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426004]
jne 0x401010
repz ret
jmp fcn.004016df

Function at 0x406568
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004023d2
and dword [ebp - 4], 0
cmp dword [0x4280bc], 0
mov ebx, eax
jne 0x406619
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4066ca
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4066ca
push eax
call fcn.00402360
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4280bc], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4280c0], eax
call esi
push eax
call fcn.00402360
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4280c4], eax
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4280cc], eax
test eax, eax
je 0x406619
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402360
pop ecx
mov dword [0x4280c8], eax
mov eax, dword [0x4280c8]
cmp eax, ebx
je 0x406671
cmp dword [0x4280cc], ebx
je 0x406671
push eax
call fcn.004023db
push dword [0x4280cc]
mov esi, eax
call fcn.004023db
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406671
test edi, edi
je 0x406671
call esi
test eax, eax
je 0x406668
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406668
test byte [ebp - 0xc], 1
jne 0x406671
or dword [ebp + 0x10], 0x200000
jmp 0x4066aa
mov eax, dword [0x4280c0]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4066aa
mov eax, dword [0x4280c4]
cmp eax, ebx
je 0x4066aa
push eax
call fcn.004023db
pop ecx
test eax, eax
je 0x4066aa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4280bc]
call fcn.004023db
pop ecx
test eax, eax
je 0x4066ca
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4066cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4208ef
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x436024]
push dword [0x435d40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x42097e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp ebx, 0x19f
jne 0x420992
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x4209b6
push esi
and dword [ebp - 4], 0
lea esi, [ebp - 4]
call fcn.00420973
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x42099a
pop esi
pop edi
cmp ebx, 0x2d
jne 0x4209cd
or dword [0x436034], 0xffffffff
mov dword [0x436030], 0xa62e7790
leave
ret