joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420360
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453de7
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4622f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 0x10], 0
mov dword [esi], 0x45c894
mov dword [esi + 4], 0x45c860
mov dword [esi + 8], 0x45c874
mov dword [esi + 0xc], 0x45c84c
mov byte [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
push 8
mov dword [esi + 0x44], 0
call fcn.0043ba56
xor ecx, ecx
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 3
mov word [eax], cx
mov byte [ebp - 4], 3
push 8
mov dword [esi + 0x50], ecx
call fcn.0043ba56
xor ecx, ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], 0
add esp, 8
mov dword [esi + 0x58], 3
mov word [eax], cx
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 4
call fcn.0040bc10
mov dword [esi + 0x98], 0
mov eax, esi
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0xffffffff
mov dword [esi + 0xa8], 0xffffffff
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0x54fffc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422880
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45416e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4622f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 2
push dword [esi + 0xcc]
call fcn.0043bb8e
push dword [esi + 0xc0]
call fcn.0043bb8e
push dword [esi + 0x9c]
call fcn.0043bb8e
push dword [esi + 0x90]
call fcn.0043bb8e
push dword [esi + 0x30]
call fcn.0043bb8e
push dword [esi + 0x24]
call fcn.0043bb8e
push dword [esi + 0x18]
call fcn.0043bb8e
mov ecx, dword [esi + 0xc]
add esp, 0x1c
test ecx, ecx
je 0x422904
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x422915
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov byte [ebp - 4], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x422926
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
test ecx, ecx
je 0x422939
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423880
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454318
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4622f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 0x14]
xor ecx, ecx
mov edx, 2
lea eax, [edi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043ba56
mov ebx, eax
mov dword [ebp - 0x20], edi
mov eax, edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x14]
inc eax
add eax, eax
push eax
push dword [esi + 0x10]
push ebx
call fcn.0043d530
add esp, 0x10
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
cmp dword [eax + 4], ecx
jbe 0x423a1d
mov esi, edi
mov eax, dword [eax]
mov ecx, dword [eax + ecx*4]
mov eax, esi
sub eax, edi
mov dword [ebp - 0x14], ecx
mov edx, dword [ecx + 4]
cmp edx, eax
jbe 0x42398d
lea ecx, [edi + edx]
mov eax, ecx
shr eax, 1
add eax, 0x10
add eax, ecx
and eax, 0xfffffff0
dec eax
cmp eax, edi
jb 0x423931
cmp eax, 0x3ffffffe
jbe 0x423936
mov eax, 0x3ffffffe
cmp eax, edi
jbe 0x423a3a
mov ecx, eax
sub ecx, edi
cmp ecx, edx
jb 0x423a3a
dec eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov edx, 2
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043ba56
lea ecx, [edi*2 + 2]
mov esi, eax
push ecx
push ebx
push esi
call fcn.0043d530
push ebx
call fcn.0043bb8e
mov ecx, dword [ebp - 0x14]
mov ebx, esi
mov esi, dword [ebp - 0x10]
add esp, 0x14
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], esi
mov eax, dword [ecx + 4]
lea eax, [eax*2 + 2]
push eax
push dword [ecx]
lea eax, [ebx + edi*2]
push eax
call fcn.0043d530
mov eax, dword [ebp - 0x14]
add esp, 0xc
add edi, dword [eax + 4]
cmp byte [0x464c01], 0
mov dword [ebp - 0x20], edi
jne 0x4239d9
mov edx, ebx
lea ecx, [ebp - 0x30]
call fcn.00409a80
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x30]
call fcn.0043bb8e
add esp, 4
jmp 0x4239e2
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp esi, edi
jne 0x4239f7
lea ecx, [ebp - 0x24]
call fcn.004092b0
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
mov eax, 0x5c
mov word [ebx + edi*2], ax
inc ecx
inc edi
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x20], edi
mov word [ebx + edi*2], ax
mov eax, dword [ebp + 8]
cmp ecx, dword [eax + 4]
jb 0x423903
push ebx
call fcn.0043bb8e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x460a48
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x13329ac
push eax
call fcn.00440b5d
int3
Function at 0x424160
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4543f9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4622f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi], 0x45c9dc
mov dword [edi + 8], 0
push 8
mov dword [edi + 0xc], 0
call fcn.0043ba56
xor ecx, ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0
add esp, 4
mov dword [edi + 0x14], 3
mov word [eax], cx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x44], ecx
lea ecx, [edi + 0x48]
mov byte [ebp - 4], 2
call fcn.00408980
mov word [edi + 0x60], 0
mov dword [edi + 0x68], 1
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
push 0
push 0
push 1
mov byte [ebp - 4], 3
push 0
mov dword [edi + 0x78], 0xffffffff
mov dword [edi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x44], eax
test eax, eax
jne 0x424252
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 1
cmovne ecx, eax
test ecx, ecx
je 0x424252
push 0x460a48
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x145ecb
push eax
call fcn.00440b5d
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x424e80
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4546dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4622f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi], 0x45ca10
mov dword [esi + 4], 0x45ca30
mov dword [esi + 0xc], 0
mov dword [ebp - 4], 0
push 8
mov dword [esi + 0x10], 0
call fcn.0043ba56
xor ecx, ecx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 3
mov word [eax], cx
mov byte [ebp - 4], 1
push 8
mov dword [esi + 0x1c], ecx
call fcn.0043ba56
xor ecx, ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 3
mov word [eax], cx
mov byte [ebp - 4], 2
push 8
mov dword [esi + 0x28], ecx
call fcn.0043ba56
xor ecx, ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 3
mov word [eax], cx
mov dword [esi + 0x4c], ecx
mov byte [ebp - 4], 4
push 8
mov dword [esi + 0x50], ecx
call fcn.0043ba56
xor ecx, ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], 0
add esp, 0x10
mov dword [esi + 0x58], 3
mov word [eax], cx
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 5
call fcn.00424160
mov byte [ebp - 4], 6
push 8
mov dword [esi + 0xec], 0
call fcn.0043ba56
add esp, 4
mov dword [esi + 0xec], eax
xor ecx, ecx
mov dword [esi + 0xf0], 0
mov dword [esi + 0xf4], 3
mov word [eax], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4259a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x4622f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
mov dword [ebp - 0x84], 0x420041
xor edx, edx
mov dword [ebp - 0x80], 0x440043
mov dword [ebp - 0x7c], 0x460045
mov dword [ebp - 0x78], 0x480047
mov dword [ebp - 0x74], 0x4a0049
mov dword [ebp - 0x70], 0x4c004b
mov dword [ebp - 0x6c], 0x4e004d
mov dword [ebp - 0x68], 0x50004f
mov dword [ebp - 0x64], 0x520051
mov dword [ebp - 0x60], 0x540053
mov dword [ebp - 0x5c], 0x560055
mov dword [ebp - 0x58], 0x580057
mov dword [ebp - 0x54], 0x5a0059
mov dword [ebp - 0x50], 0x620061
mov dword [ebp - 0x4c], 0x640063
mov dword [ebp - 0x48], 0x660065
mov dword [ebp - 0x44], 0x680067
mov dword [ebp - 0x40], 0x6a0069
mov dword [ebp - 0x3c], 0x6c006b
mov dword [ebp - 0x38], 0x6e006d
mov dword [ebp - 0x34], 0x70006f
mov dword [ebp - 0x30], 0x720071
mov dword [ebp - 0x2c], 0x740073
mov dword [ebp - 0x28], 0x760075
mov dword [ebp - 0x24], 0x780077
mov dword [ebp - 0x20], 0x7a0079
mov dword [ebp - 0x1c], 0x310030
mov dword [ebp - 0x18], 0x330032
mov dword [ebp - 0x14], 0x350034
mov dword [ebp - 0x10], 0x370036
mov dword [ebp - 0xc], 0x390038
mov dword [ebp - 8], 0x2f002b
test esi, esi
jle 0x425add
lea esp, [esp]
movzx ecx, word [edi + edx*2]
xor eax, eax
cmp word [ebp + eax*2 - 0x84], cx
je 0x425ad8
inc eax
cmp eax, 0x40
jb 0x425ab6
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043aa28
mov esp, ebp
pop ebp
ret
inc edx
cmp edx, esi
jl 0x425ab0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0043aa28
mov esp, ebp
pop ebp
ret
Function at 0x425bc0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4547b0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x4622f0]
xor eax, esp
mov dword [esp + 0x5c], eax
push esi
push edi
mov eax, dword [0x4622f0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], ecx
lea esi, [ecx + 0x80]
mov dword [esp + 0x18], 0
push esi
push 0x45bba8
mov dword [esp + 0x34], esi
call dword [0x45bba8]
mov edi, eax
mov dword [esp + 0x14], edi
test edi, edi
jne 0x425c4b
push 0x460a48
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
call fcn.00440b5d
mov dword [esp + 0x18], esi
mov dword [esp + 0x78], 0
lea esi, [edi + 0x80]
push dword [esp + 0xc]
push dword [esp + 0x2c]
push esi
call fcn.0043d530
mov eax, dword [0x45bbbc]
add esp, 0xc
mov dword [edi], eax
mov edx, esi
mov dword [edi + 8], 0
mov ecx, edi
mov dword [edi + 0xc], 0
push dword [esp + 0xc]
mov dword [edi + 0x20], 0x6a09e667
mov dword [edi + 0x24], 0xbb67ae85
mov dword [edi + 0x28], 0x3c6ef372
mov dword [edi + 0x2c], 0xa54ff53a
mov dword [edi + 0x30], 0x510e527f
mov dword [edi + 0x34], 0x9b05688c
mov dword [edi + 0x38], 0x1f83d9ab
mov dword [edi + 0x3c], 0x5be0cd19
call fcn.00408770
xorps xmm0, xmm0
mov byte [esp + 0x48], 0
lea edx, [esp + 0x48]
movq qword [esp + 0x59], xmm0
mov ecx, edi
mov dword [esp + 0x61], 0
movdqu xmmword [esp + 0x49], xmm0
mov word [esp + 0x65], 0
mov byte [esp + 0x67], 0
call fcn.00408820
push dword [esp + 0x10]
lea eax, [esp + 0x6c]
mov dword [esp + 0x20], 0
push eax
lea eax, [esp + 0x50]
mov dword [esp + 0x28], 0
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x30], 0
call fcn.00437fb0
push dword [esp + 0x2c]
mov byte [esp + 0x7c], 1
push 0
push edi
call fcn.00444410
add esp, 0xc
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x30]
call fcn.00425b30
cmp dword [eax + 0x14], 0x10
jb 0x425d53
mov eax, dword [eax]
cmp dword [esp + 0x44], 0x10
movdqu xmm0, xmmword [eax]
mov ecx, dword [esp + 0x10]
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [ecx + 0x10], xmm0
movdqu xmm0, xmmword [eax + 0x20]
movdqu xmmword [ecx + 0x20], xmm0
movdqu xmm0, xmmword [eax + 0x30]
movdqu xmmword [ecx + 0x30], xmm0
jb 0x425d90
push dword [esp + 0x30]
call fcn.00439730
add esp, 4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x425da1
push eax
call fcn.00439730
add esp, 4
push edi
push 0x45bba8
mov dword [esp + 0x80], 0xffffffff
call dword [0x45bbac]
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call fcn.0043aa28
mov esp, ebp
pop ebp
ret 8
Function at 0x425de0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4622f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov dword [ebp - 0x214], ecx
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov esi, edx
lea eax, [ebp - 0x20a]
push eax
call fcn.00444410
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x425ec8
push ebx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x425e7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x425e91
mov eax, dword [ebp - 0x210]
xor ecx, ecx
add ecx, ebx
mov dword [esi], ecx
adc eax, 0
mov dword [esi + 4], eax
push dword [esi]
mov dword [ebp - 0x218], 0
call fcn.0043ba56
mov ecx, dword [ebp - 0x214]
add esp, 4
push 0
mov dword [ecx], eax
lea ecx, [ebp - 0x218]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043aa28
mov esp, ebp
pop ebp
ret
Function at 0x438060
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45493a
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4622f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.0044fe3e
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x438106
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.0043cd50
push 0x460b68
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.00440b5d
push edi
push esi
call fcn.0044ed7c
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043aa28
mov esp, ebp
pop ebp
ret 4

Function at 0x438690
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4549c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4622f0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.00437850
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.004385c0
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x438701
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.0043cd50
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x43872a
push dword [esp + 0xc]
call fcn.00439730
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x448cfc
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4622f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004404b8
mov dword [ebp - 0x14], eax
cmp dword [0x46485c], esi
jne 0x448def
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x448d7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x448ecf
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x448ecf
push 0x45a090
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x448ecf
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x46485c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x464860], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x464864], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46486c], eax
test eax, eax
je 0x448dec
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x464868], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x448e14
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x448e07
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x448e29
push 4
pop eax
jmp 0x448ed1
cmp dword [ebp - 0x14], esi
je 0x448e29
push dword [0x46485c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x448e0e
mov eax, dword [0x464868]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x448e87
cmp dword [0x46486c], edi
je 0x448e87
push eax
call ebx
push dword [0x46486c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x448e87
test eax, eax
je 0x448e87
call ecx
test eax, eax
je 0x448e7c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x448e7c
test byte [ebp - 8], 1
jne 0x448e87
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x448eb7
mov eax, dword [0x464860]
cmp eax, edi
je 0x448eb4
push eax
call ebx
test eax, eax
je 0x448eb4
call eax
mov esi, eax
test esi, esi
je 0x448eb4
mov eax, dword [0x464864]
cmp eax, edi
je 0x448eb4
push eax
call ebx
test eax, eax
je 0x448eb4
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46485c]
call ebx
test eax, eax
je 0x448ecf
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x448ed1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043aa28
mov esp, ebp
pop ebp
ret
Function at 0x401510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov edi, ecx
mov esi, esp
mov dword [esp + 8], 0xffffffff
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
add edx, dword [esp + 0x10]
mov dword [esp + 0x14], edx
mov eax, dword [0x40c5d4]
mov dword [esi], eax
jmp fcn.004015a9

Function at 0x401698
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov dword [esp], edx
lea esi, [esp + 8]
lea edi, [esp + 4]
lea ebx, [esp + 0xc]
mov edx, eax
mov ebp, edx
add ebp, 0xfff
and ebp, 0xfffff000
mov dword [esp + 0x10], ebp
add edx, dword [esp]
and edx, 0xfffff000
jmp loc.0041a004

Function at 0x401c84
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ecx, edx
sub ecx, 4
lea ebx, [ecx + eax]
mov dword [esp], ebx
cmp edx, 0x10
jl 0x401ca9
mov edx, dword [esp]
mov dword [edx], 0x80000007
mov edx, ecx
call fcn.00401e80
pop edx
pop ebx
ret
cmp edx, 4
jl 0x401cbd
mov ecx, edx
or ecx, 0x80000002
jmp loc.0041c505
pop edx
pop ebx
ret

Function at 0x40207c
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
jmp loc.0041c5e9

Function at 0x4020b0
Capabilities:
Packed with generic packer

Disassembly:
push ecx
mov edx, esp
xor ecx, ecx
mov dword [edx], ecx
test eax, eax
jns 0x4020be
add eax, 3
sar eax, 2
cmp eax, 0x400
jg 0x4020e1
jmp 0x4142fd
mov eax, dword [edx]
pop edx
ret

Function at 0x402884
Capabilities:
Packed with generic packer

Disassembly:
push ebx
push ecx
mov ebx, eax
test ebx, ebx
jle 0x4028a6
mov eax, ebx
call dword [0x40b030]
mov dword [esp], eax
cmp dword [esp], 0
jne 0x4028ab
mov al, 1
call fcn.0040297c
jmp 0x4028ab
jmp 0x41583d
mov eax, dword [esp]
pop edx
pop ebx
ret

Function at 0x4028b4
Capabilities:
Packed with generic packer

Disassembly:
push ebx
test eax, eax
je 0x4028ce
call dword [0x40b034]
mov ebx, eax
test ebx, ebx
je 0x4028d0
mov al, 2
jmp loc.00419c56
xor ebx, ebx
mov eax, ebx
pop ebx
ret

Function at 0x4029c4
Capabilities:
Packed with generic packer

Disassembly:
push esi
push edi
mov esi, eax
mov edi, edx
mov eax, ecx
cmp edi, esi
ja 0x4029e3
je 0x402a01
sar ecx, 2
js 0x402a01
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
jmp loc.0041a929
pop edi
pop esi
ret

Function at 0x402b68
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004041ec
test esi, esi
jne 0x402b9f
jmp loc.00419ba3
jmp loc.00413b59

Function at 0x402bcc
Capabilities:
Packed with generic packer

Disassembly:
add esp, 0xfffffff8
push esp
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x402be4
mov eax, dword [esp]
mov dword [0x40b008], eax
pop ecx
pop edx
ret
jmp loc.00416dda