joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e550
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x518a08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebx, ecx
mov ecx, dword [esp + 0x1c]
push esi
push edi
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x18], ebx
call fcn.00496790
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
lea eax, [ebx + 0x14]
mov ecx, 8
mov edi, eax
mov dword [ebx], vtable.CWireframeFilter.0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
xor ebp, ebp
mov esi, 1
cmp ecx, 2
mov dword [esp + 0x1c], ebp
mov dword [ebx + 0x34], esi
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x10], 5
mov dword [ebx + 0x3c], ebp
jne 0x49e614
push 0x88
call sub.MFC42.DLL_operatornew
mov edi, eax
mov ecx, 0x22
xor eax, eax
mov dword [ebx + 0x3c], edi
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x3c]
lea edx, [ebx + 0x18]
add esp, 4
mov word [eax], 2
mov ecx, dword [ebx + 0x3c]
mov dword [ecx + 8], esi
mov eax, dword [ebx + 0x3c]
mov ecx, dword [edx]
add eax, 0x48
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov edx, dword [edx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebx + 0x3c]
mov word [eax + 0xc], 0x64
mov ecx, dword [ebx + 0x3c]
add ecx, 0x18
push ecx
call sub.CRLUTL110.dll__UTLGetIdentityMatrix_4
mov eax, dword [ebx + 0x24]
mov dword [ebx + 0x40], ebp
cmp eax, 2
jne 0x49e68f
push 0x684
call sub.MFC42.DLL_operatornew
mov dword [ebx + 0x40], eax
add esp, 4
mov word [eax], si
mov edx, dword [ebx + 0x40]
push edx
call fcn.00439910
mov edi, dword [ebx + 0x40]
mov ecx, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x40]
lea ecx, [ebx + 0x28]
mov word [eax], si
mov edx, dword [ebx + 0x40]
mov eax, dword [ecx]
add edx, 4
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ecx + 8]
mov dword [edx + 8], ecx
mov edx, dword [ebx + 0x40]
mov word [edx + 0x10], bp
mov eax, dword [ebx + 0x40]
mov dword [eax + 0x14], ebp
mov ecx, dword [ebx + 0x40]
mov dword [ecx + 0x18], 0x1c2
mov edx, dword [ebx + 0x40]
mov word [edx + 0x1c], 0x3c
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x4aaa10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
mov edx, dword [eax + 0x14]
mov eax, dword [esp + 0x1c]
mov esi, dword [ecx]
mov dword [esp + 0xc], ecx
mov dl, byte [eax + edx + 1]
and dl, 0xc0
sub dl, 0xc0
neg dl
sbb edx, edx
and edx, 0xfffffffe
add edx, 3
test esi, esi
mov ebp, edx
jle 0x4aaa4a
inc eax
mov ebx, esi
mov dword [esp + 0x1c], eax
jmp 0x4aaa4d
inc ebp
xor ebx, ebx
mov eax, dword [ecx + 0xc]
push edi
lea edi, [ecx + 4]
add esi, ebp
cmp esi, eax
mov dword [esp + 0x14], esi
jle 0x4aaa6e
push 0
push esi
mov ecx, edi
call fcn.004ad110
mov ecx, dword [esp + 0x10]
jmp 0x4aaa71
mov dword [edi + 4], esi
mov eax, dword [ecx + 0x1c]
add ecx, 0x14
cmp esi, eax
jle 0x4aaa85
push 0
push esi
call fcn.004ad000
jmp 0x4aaa88
mov dword [ecx + 4], esi
mov eax, dword [esp + 0x1c]
lea ecx, [ebp*8]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x20]
lea esi, [edx + eax*8]
mov edx, dword [edi]
mov eax, ecx
lea edi, [edx + ebx*8]
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
add edx, 0x14
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov edi, dword [edx]
mov ecx, ebp
mov edx, ecx
add edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
mov ecx, dword [esp + 0x1c]
mov eax, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx + 0x14]
mov ecx, ebx
add eax, edx
mov edx, dword [esp + 0xc]
add edx, 0x14
inc ebx
mov al, byte [eax]
mov edx, dword [edx]
add ecx, edx
mov dl, al
xor dl, byte [ecx]
and dl, 0x3f
xor dl, al
dec ebp
test ebp, ebp
mov byte [ecx], dl
jg 0x4aaace
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
cmp dword [ecx], 0
jne 0x4aab24
mov eax, dword [ecx + 0x14]
mov dl, byte [eax]
and dl, 0x3f
mov byte [eax], dl
mov eax, dword [esp + 4]
mov dword [ecx], eax
add esp, 8
ret 8
mov edx, dword [esp + 4]
mov dword [ecx], edx
add esp, 8
ret 8
Function at 0x4b48e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push ebx
call fcn.004b47d0
xor ebp, ebp
add esp, 4
cmp ax, bp
mov dword [esp + 0x14], eax
je 0x4b4ae9
mov ax, word [ebx + 8]
push esi
mov word [esp + 0x24], ax
mov ax, word [ebx + 4]
mov dword [esp + 0x1c], eax
mov word [esp + 0x26], ax
mov eax, dword [ebx + 0x18]
push edi
mov ecx, eax
mov word [esp + 0x24], bp
shl ecx, 7
sub ecx, eax
mov eax, 0x68db8bad
shl ecx, 1
imul ecx
sar edx, 0xc
mov ecx, edx
mov word [esp + 0x26], bp
shr ecx, 0x1f
lea edi, [edx + ecx + 1]
cmp edi, ebp
mov dword [esp + 0x30], edi
jne 0x4b4953
mov edi, 0x48
mov dword [esp + 0x30], edi
mov eax, dword [ebx + 0x1c]
mov ecx, eax
shl ecx, 7
sub ecx, eax
mov eax, 0x68db8bad
shl ecx, 1
imul ecx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
lea esi, [edx + eax + 1]
cmp esi, ebp
mov dword [esp + 0x10], esi
jne 0x4b4983
mov esi, 0x48
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x1c]
mov dl, cl
and edx, 3
mov eax, edx
cmp ax, bp
je 0x4b4998
sub ecx, eax
add ecx, 4
mov dx, word [ebx + 0xe]
mov dword [esp + 0x14], ebp
cmp dx, 0x18
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], edx
jne 0x4b49da
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 0x10
mov edx, 0x20
mov dword [esp + 0x18], 3
lea ecx, [eax*4]
mov dword [esp + 0x1c], 8
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x24]
or ecx, 0xffff8000
mov dword [eax + 6], ebx
mov ebx, dword [esp + 0x28]
mov dword [eax + 0xa], ebx
xor ebx, ebx
mov bl, ch
mov dword [eax], 0x44000000
shl ecx, 8
add ebx, ecx
mov cx, word [eax + 6]
mov word [eax + 4], bx
xor ebx, ebx
mov bl, ch
mov word [eax + 0xe], bp
shl ecx, 8
add ebx, ecx
mov cx, word [eax + 8]
mov word [eax + 6], bx
xor ebx, ebx
mov bl, ch
mov word [eax + 0x10], bp
shl ecx, 8
add ebx, ecx
mov cx, word [eax + 0xa]
mov word [eax + 8], bx
xor ebx, ebx
mov bl, ch
mov dword [eax + 0x14], ebp
shl ecx, 8
add ebx, ecx
mov cx, word [eax + 0xc]
mov word [eax + 0xa], bx
xor ebx, ebx
mov bl, ch
shl ecx, 8
add ebx, ecx
mov ecx, edi
and ecx, 0xff00
mov word [eax + 0xc], bx
shl edi, 0x10
add ecx, edi
xor ebx, ebx
mov bh, byte [esp + 0x32]
shl ecx, 8
add ecx, ebx
xor ebx, ebx
mov bl, byte [esp + 0x33]
add ecx, ebx
xor ebx, ebx
mov bh, byte [esp + 0x12]
mov dword [eax + 0x18], ecx
mov ecx, esi
and ecx, 0xff00
shl esi, 0x10
add ecx, esi
shl ecx, 8
add ecx, ebx
xor ebx, ebx
mov bl, byte [esp + 0x13]
add ecx, ebx
xor ebx, ebx
mov dword [eax + 0x1c], ecx
mov ecx, dword [esp + 0x14]
mov bl, ch
shl ecx, 8
add ebx, ecx
xor ecx, ecx
mov cl, dh
mov word [eax + 0x20], bx
shl edx, 8
add ecx, edx
xor edx, edx
mov word [eax + 0x22], cx
mov ecx, dword [esp + 0x18]
mov dl, ch
shl ecx, 8
add edx, ecx
mov word [eax + 0x24], dx
xor edx, edx
mov ecx, dword [esp + 0x1c]
pop edi
mov dl, ch
mov dword [eax + 0x28], ebp
shl ecx, 8
add edx, ecx
mov dword [eax + 0x2c], 0x34000000
mov word [eax + 0x26], dx
mov dword [eax + 0x30], ebp
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4b4af0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [ebp]
lea edx, [esi - 1]
mov dword [eax], 0
mov ecx, dword [ebp]
mov word [ecx + 4], 0
mov eax, dword [ebp]
mov word [eax + 6], dx
mov ecx, dword [ebp]
xor edx, edx
mov ax, word [ecx + 6]
mov dl, ah
shl eax, 8
add edx, eax
mov word [ecx + 6], dx
xor ecx, ecx
test si, si
jle 0x4b4baa
mov eax, dword [esp + 0x18]
push ebx
push edi
xor esi, esi
mov edi, 8
inc eax
xor edx, edx
add eax, 4
mov dl, ch
add edx, esi
add esi, 0x100
mov word [esp + 0x10], dx
movzx dx, byte [eax - 3]
mov ebx, edx
shl ebx, 8
add ebx, edx
movzx dx, byte [eax - 4]
mov word [esp + 0x12], bx
mov ebx, edx
shl ebx, 8
add ebx, edx
movzx dx, byte [eax - 5]
mov word [esp + 0x14], bx
mov ebx, edx
shl ebx, 8
add ebx, edx
mov edx, edi
mov word [esp + 0x16], bx
mov ebx, dword [ebp]
add edx, ebx
mov ebx, dword [esp + 0x10]
inc ecx
add edi, 8
cmp cx, word [esp + 0x1c]
mov dword [edx], ebx
mov ebx, dword [esp + 0x14]
mov dword [edx + 4], ebx
jl 0x4b4b42
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x4b53b0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0x34
push esi
push eax
mov edi, 0x15e
call dword [sym.imp.WINMM.dll_mmioRead]
cmp eax, 0xffffffff
je 0x4b553f
mov ax, word [esi + 4]
xor ecx, ecx
mov cl, ah
xor edx, edx
shl eax, 8
add ecx, eax
mov ax, word [esi + 6]
mov dl, ah
mov word [esi + 4], cx
shl eax, 8
add edx, eax
mov ax, word [esi + 8]
xor ecx, ecx
mov word [esi + 6], dx
mov cl, ah
xor edx, edx
shl eax, 8
add ecx, eax
mov ax, word [esi + 0xa]
mov dl, ah
mov word [esi + 8], cx
shl eax, 8
add edx, eax
mov ax, word [esi + 0xc]
xor ecx, ecx
mov word [esi + 0xa], dx
mov cl, ah
xor edx, edx
shl eax, 8
add ecx, eax
mov ax, word [esi + 0xe]
mov dl, ah
mov word [esi + 0xc], cx
shl eax, 8
add edx, eax
mov ax, word [esi + 0x10]
xor ecx, ecx
mov word [esi + 0xe], dx
mov cl, ah
shl eax, 8
lea edi, [ecx + eax]
mov eax, dword [esi + 0x14]
mov edx, eax
mov dword [esp + 0x10], eax
shl edx, 0x10
and eax, 0xff00
xor ecx, ecx
mov ch, byte [esp + 0x12]
add edx, eax
xor eax, eax
mov word [esi + 0x10], di
mov al, byte [esp + 0x13]
shl edx, 8
add edx, eax
mov eax, dword [esi + 0x18]
add edx, ecx
mov dword [esp + 0x10], eax
mov dword [esi + 0x14], edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
xor ecx, ecx
mov ch, byte [esp + 0x12]
add edx, eax
xor eax, eax
mov al, byte [esp + 0x13]
shl edx, 8
add edx, eax
mov eax, dword [esi + 0x1c]
add edx, ecx
mov dword [esp + 0x10], eax
mov dword [esi + 0x18], edx
mov edx, eax
shl edx, 0x10
and eax, 0xff00
add edx, eax
xor eax, eax
mov al, byte [esp + 0x13]
shl edx, 8
add edx, eax
xor ecx, ecx
mov ch, byte [esp + 0x12]
mov ax, word [esi + 0x20]
add edx, ecx
mov dword [esi + 0x1c], edx
xor edx, edx
mov dl, ah
shl eax, 8
lea ecx, [edx + eax]
mov ax, word [esi + 0x22]
xor edx, edx
mov word [esi + 0x20], cx
mov dl, ah
shl eax, 8
add edx, eax
mov ax, word [esi + 0x24]
mov word [esi + 0x22], dx
xor edx, edx
mov dl, ah
shl eax, 8
add edx, eax
mov eax, dword [esi + 0x28]
mov word [esi + 0x24], dx
mov edx, eax
mov dword [esp + 0x10], eax
and eax, 0xff00
shl edx, 0x10
add edx, eax
xor eax, eax
mov al, byte [esp + 0x13]
shl edx, 8
add edx, eax
xor eax, eax
mov ah, byte [esp + 0x12]
add edx, eax
test cx, cx
mov dword [esi + 0x28], edx
je 0x4b552d
cmp cx, 0x10
jne 0x4b5532
test di, di
je 0x4b553a
pop edi
mov eax, 0x103
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x5137f0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
push esi
lea eax, [esp + 4]
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x4dc]
shr ecx, 1
mov dword [esi + 0xc], ecx
mov eax, dword [edx + 0x10c]
neg eax
sbb eax, eax
lea ecx, [esi + 0x35c]
and eax, 0x36b3d972
add eax, 0x18e6fdb
mov dword [esi + 0x380], eax
xor eax, eax
mov word [ecx], ax
inc eax
add ecx, 2
cmp eax, 0x10
jl 0x51383b
mov ecx, dword [esi + 0x4dc]
mov byte [esi + 0x37c], 1
mov word [esi + 0x388], 0xffff
lea eax, [esi + 0x3a0]
mov edx, dword [ecx]
push eax
call dword [edx + 0x38]
mov ecx, dword [esi + 0x4dc]
mov edx, dword [ecx]
lea edi, [ecx + 0x130]
call dword [edx + 8]
mov dword [edi], eax
mov dword [esi + 0x3c8], edi
pop edi
mov eax, 1
pop esi
add esp, 0x20
ret
Function at 0x401dd0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7d8
mov eax, dword [0x4160c0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x680
lea eax, [ebp - 0x784]
push 0
push eax
mov edi, ecx
call fcn.0040b150
add esp, 0xc
lea eax, [ebp - 0x78c]
push eax
push dword [esi + 4]
mov dword [ebp - 0x78c], 0x688
push dword [esi]
push dword [edi]
call dword [sym.imp.dbghelp.dll_SymGetModuleInfo64]
mov eax, dword [ebp - 0x780]
mov ebx, dword [ebp - 0x784]
push 0
push 0x40
mov dword [ebp - 0x7d0], eax
lea eax, [ebp - 0x7cc]
push eax
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, 0x5a4d
cmp word [ebp - 0x7cc], ax
jne 0x401eb2
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x790]
add eax, ebx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x104], 0x4550
jne 0x401eb2
mov ax, word [ebp - 0xec]
mov ecx, 0x10b
cmp ax, cx
je 0x401e99
mov ecx, 0x20b
cmp ax, cx
jne 0x401eb2
mov eax, dword [ebp - 0xa6]
test al, 0x40
je 0x401ea7
or dword [esi + 0x10], 8
test eax, 0x100
je 0x401eb2
or dword [esi + 0x10], 0x10
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402b08
mov esp, ebp
pop ebp
ret 4
Function at 0x402720
Capabilities:
Enumerate process modules
Get process image filename
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x143c
call fcn.0040bf50
mov eax, dword [0x4160c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x417eac]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push edi
push 0
push 0
push 0x184
push dword [ebx]
mov dword [ebp - 0x140c], ebx
call esi
push 0
push 0
push 0xf
push dword [ebx]
call esi
push 0x1000
lea eax, [ebp - 0x1404]
push 0xff
push eax
mov dword [ebx + 8], 0
mov dword [ebp - 0x1414], 0
call fcn.0040b150
add esp, 0xc
lea eax, [ebp - 0x1414]
push eax
push 0x1000
lea eax, [ebp - 0x1404]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
mov eax, dword [ebp - 0x1414]
xor edi, edi
shr eax, 2
mov dword [ebp - 0x1418], eax
mov dword [ebp - 0x1408], edi
mov dword [ebp - 0x1410], edi
xor ebx, ebx
jmp 0x4027d0
mov eax, dword [ebp + ebx*4 - 0x1404]
cmp eax, 0xffffffff
je 0x4028c6
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4028c6
lea eax, [ebp - 0x143c]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x143c], 9
jne 0x40282a
lea eax, [ebp - 0x1410]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [ebp - 0x1410], 0
je 0x4028c6
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.0040b150
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x400
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x404]
push 0x5c
push eax
call fcn.00403910
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x402878
mov ecx, str.System
jmp 0x402879
inc ecx
mov eax, dword [ebp + ebx*4 - 0x1404]
movzx edi, di
imul edi, edi, 0x404
add edi, dword [ebp - 0x140c]
push 0x3ff
push ecx
lea esi, [edi + 0x18]
push esi
mov dword [edi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push esi
push dword [edi + 0x14]
push str.__05d_____s
push dword [ebp - 0x140c]
call fcn.004028f0
mov edi, dword [ebp - 0x1408]
add esp, 0x10
inc edi
mov dword [ebp - 0x1408], edi
inc ebx
cmp ebx, dword [ebp - 0x1418]
jbe 0x4027d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402b08
mov esp, ebp
pop ebp
ret
Function at 0x40ae1b
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4160c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040884c
mov dword [ebp - 0x14], eax
cmp dword [0x417dd0], edi
jne 0x40af0c
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40ae99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40afec
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40afec
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40afec
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x417dd0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x417dd4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x417dd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417de0], eax
test eax, eax
je 0x40af09
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417ddc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40af31
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40af24
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40af46
push 4
pop eax
jmp 0x40afee
cmp dword [ebp - 0x14], edi
je 0x40af46
push dword [0x417dd0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40af2b
mov eax, dword [0x417ddc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40afa4
cmp dword [0x417de0], esi
je 0x40afa4
push eax
call ebx
push dword [0x417de0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40afa4
test eax, eax
je 0x40afa4
call ecx
test eax, eax
je 0x40af99
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40af99
test byte [ebp - 8], 1
jne 0x40afa4
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40afd4
mov eax, dword [0x417dd4]
cmp eax, esi
je 0x40afd1
push eax
call ebx
test eax, eax
je 0x40afd1
call eax
mov edi, eax
test edi, edi
je 0x40afd1
mov eax, dword [0x417dd8]
cmp eax, esi
je 0x40afd1
push eax
call ebx
test eax, eax
je 0x40afd1
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x417dd0]
call ebx
test eax, eax
je 0x40afec
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40afee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402b08
leave
ret
Function at 0x401240
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov ecx, dword [0x409130]
mov eax, 0x409130
push ebx
push ebp
push esi
mov ebx, 0xe3
push edi
mov edi, dword [eax + 4]
mov edx, ecx
xor edx, edi
and edx, 0x7ffffffe
xor edx, ecx
mov ecx, edi
and ecx, 1
shr edx, 1
neg ecx
and ecx, 0x9908b0df
xor edx, ecx
mov ecx, edi
xor edx, dword [eax + 0x634]
mov dword [eax], edx
add eax, 4
sub ebx, 1
jne 0x401254
mov ebp, 0x18c
nop dword [eax + eax]
mov ebx, dword [eax + 4]
lea eax, [eax + 4]
mov edx, edi
mov ecx, ebx
xor edx, ebx
and ecx, 1
and edx, 0x7ffffffe
neg ecx
xor edx, edi
and ecx, 0x9908b0df
shr edx, 1
mov edi, ebx
xor edx, ecx
xor edx, dword [eax - 0x390]
mov dword [eax - 4], edx
sub ebp, 1
jne 0x401290
mov ecx, dword [0x409130]
mov edx, ebx
xor edx, ecx
and ecx, 1
and edx, 0x7ffffffe
neg ecx
xor edx, ebx
and ecx, 0x9908b0df
pop edi
shr edx, 1
pop esi
xor edx, ecx
xor edx, dword [eax - 0x38c]
pop ebp
mov dword [eax], edx
mov dword [0x409af0], 0
pop ebx
ret

Function at 0x4015d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, dword [0x409af0]
push edi
mov edi, ecx
mov esi, edi
shr esi, 1
or esi, edi
mov eax, esi
shr eax, 2
or esi, eax
mov eax, esi
shr eax, 4
or esi, eax
mov eax, esi
shr eax, 8
or esi, eax
mov eax, esi
shr eax, 0x10
or esi, eax
nop dword [eax]
cmp edx, 0x270
jne 0x401613
call fcn.00401240
mov edx, dword [0x409af0]
mov ecx, dword [edx*4 + 0x409130]
mov eax, ecx
shr eax, 0xb
inc edx
xor ecx, eax
mov dword [0x409af0], edx
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
and eax, esi
cmp eax, edi
ja 0x401600
pop edi
pop esi
ret
Function at 0x4039a0
Capabilities:
Query or enumerate registry value

Disassembly:
movups xmm0, xmmword [0x4080f8]
mov eax, dword [0x408108]
sub esp, 0xc
push esi
mov esi, ecx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
lea eax, [esp + 8]
push eax
push str.Control_PanelScreen_Saver.TetrisMatrix
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403aa2
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 4
push eax
push 0
push 0
push str.FrameDelay
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x403a07
mov eax, dword [esp + 8]
mov dword [esi], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push str.MatrixLayout
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x403a2b
mov eax, dword [esp + 8]
mov dword [esi + 4], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push str.Lines
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x403a4f
mov eax, dword [esp + 8]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push str.LinesMax
push dword [esp + 0x20]
call edi
test eax, eax
jne 0x403a73
mov eax, dword [esp + 8]
mov dword [esi + 0xc], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push str.WaitTime
push dword [esp + 0x20]
call edi
pop edi
test eax, eax
jne 0x403a98
mov eax, dword [esp + 4]
mov dword [esi + 0x10], eax
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret