joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4656e0
Capabilities:
Connect pipe
Contain obfuscated stackstrings
Create pipe

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov ecx, eax
lea eax, [eax + 0x1f]
and eax, 0xfffffff0
call fcn.0046d550
mov edx, dword [ebx + 0xc]
sub esp, eax
mov eax, 0x5041
add ecx, 1
mov word [esp + 0x2c], ax
lea eax, [esp + 0x2f]
lea esi, [esp + 0x20]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 0x20], 0x5c2e5c5c
mov dword [esp + 0x24], 0x65706970
mov dword [esp + 0x28], 0x6c72425c
mov byte [esp + 0x2e], 0x49
call sub.msvcrt.dll_memcpy
mov dword [esp], esi
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000003
call sub.kernel32.dll_CreateNamedPipeA
sub esp, 0x20
cmp eax, 0xffffffff
mov esi, eax
je 0x465870
mov dword [esp + 8], eax
mov dword [esp + 4], str.CreateFile_____p
mov dword [esp], 0x8a
call sym.brltty.exe_logMessage
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4658a0
mov dword [esp], eax
call sub.kernel32.dll_ResetEvent
sub esp, 4
test eax, eax
jne 0x4657f0
mov dword [esp], str.ResetEvent
call sym.brltty.exe_logWindowsSystemError
mov dword [esp], esi
call sub.kernel32.dll_CloseHandle
mov eax, 0xffffffff
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebx + 0x10]
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.kernel32.dll_ConnectNamedPipe
sub esp, 8
test eax, eax
jne 0x465852
call sub.kernel32.dll_GetLastError
cmp eax, 0x217
mov edx, eax
je 0x465840
cmp edx, 0x3e5
mov eax, esi
je 0x4657e5
mov dword [esp], str.ConnectNamedPipe
call sym.brltty.exe_logWindowsSystemError
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
sub esp, 4
jmp 0x4657d5
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.kernel32.dll_SetEvent
mov eax, esi
sub esp, 4
jmp 0x4657e5
mov dword [esp + 4], str.already_connected__
mov dword [esp], 0x8a
call sym.brltty.exe_logMessage
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret
call sub.kernel32.dll_GetLastError
mov edx, eax
mov eax, 0xffffffff
cmp edx, 0x78
je 0x4657e5
mov dword [esp], str.CreateNamedPipe
mov dword [ebp - 0xc], eax
call sym.brltty.exe_logWindowsSystemError
mov eax, dword [ebp - 0xc]
jmp 0x4657e5
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.kernel32.dll_CreateEventA
sub esp, 0x10
test eax, eax
mov dword [ebx + 0x20], eax
je 0x4658f0
mov dword [esp + 8], eax
mov dword [esp + 4], str.event_____p
mov dword [esp], 0x8a
call sym.brltty.exe_logMessage
mov eax, dword [ebx + 0x20]
jmp 0x4657ba
mov dword [esp], str.CreateEvent
call sym.brltty.exe_logWindowsSystemError
jmp 0x4657d5
Function at 0x465960
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.ws2_32.dll_socket
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x465a86
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x49c000
mov dword [esp + 8], 4
mov dword [esp + 4], 0xffff
mov dword [esp], eax
call sub.ws2_32.dll_setsockopt
sub esp, 0x14
cmp eax, 0xffffffff
je 0x465af7
lea esi, [ebp - 0x118]
mov ecx, 0x40
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, 1
jmp 0x465a1c
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], esi
mov dword [esp + 4], str.bind_waiting:__s:__s
mov dword [esp], 0x8a
mov dword [esp + 0xc], eax
call sym.brltty.exe_logMessage
imul eax, edi, 0x3e8
add edi, edi
mov dword [esp], eax
call sym.brltty.exe_approximateDelay
cmp edi, 0x64
mov eax, 0x64
cmovge edi, eax
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call sub.ws2_32.dll_bind
sub esp, 0xc
cmp eax, 0xffffffff
jne 0x465b08
mov edx, dword [0x4c0354]
test edx, edx
je 0x465ad3
call sub.msvcrt.dll__errno
cmp dword [eax], 0x1e
jne 0x465ad3
cmp byte [ebp - 0x118], 0
jne 0x4659d6
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], 0x100
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
call sym.brltty.exe_formatAddress
jmp 0x4659d6
call sub.msvcrt.dll__errno
mov ebx, eax
lea esi, [esi]
call sub.ws2_32.dll_WSAGetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [ebx], eax
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 4], str.socket_allocation_error:__s
mov dword [esp], 4
mov dword [esp + 8], eax
call sym.brltty.exe_logMessage
mov eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.bind
call sym.brltty.exe_logWindowsSocketError
mov dword [esp], ebx
call sub.ws2_32.dll_closesocket
mov eax, 0xffffffff
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], str.setsockopt_SOCKET_REUSEADDR_
call sym.brltty.exe_logWindowsSocketError
jmp 0x4659be
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.ws2_32.dll_listen
mov edx, eax
sub esp, 8
cmp edx, 0xffffffff
mov eax, ebx
jne 0x465acb
mov dword [esp], str.listen
call sym.brltty.exe_logWindowsSocketError
jmp 0x465adf
Function at 0x465ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x4c
test ecx, ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x30], 0
je 0x46602a
mov edi, eax
xor ebx, ebx
jmp 0x465f36
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x30]
sub esp, 4
test eax, eax
je 0x466020
add ebx, eax
cmp esi, ebx
jbe 0x466020
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call sub.kernel32.dll_CreateEventA
sub esp, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x30]
mov dword [esp + 0xc], eax
mov eax, esi
sub eax, ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], edi
add eax, ebx
mov dword [esp + 4], eax
call sub.kernel32.dll_ReadFile
sub esp, 0x14
test eax, eax
jne 0x465fb6
call sub.kernel32.dll_GetLastError
cmp eax, 0x3e5
jne 0x465fdf
lea eax, [ebp - 0x30]
mov dword [esp + 8], eax
lea eax, [ebp - 0x2c]
mov dword [esp + 0xc], 1
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.kernel32.dll_GetOverlappedResult
sub esp, 0x10
test eax, eax
jne 0x465f13
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.kernel32.dll_CloseHandle
sub esp, 4
cmp dword [ebp - 0x30], 0x26
je 0x466020
call sub.msvcrt.dll__errno
mov ebx, eax
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [ebx], eax
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x466022
Function at 0x46bd20
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
xor ebx, ebx
sub esp, 0x10
mov eax, dword [0x4c0368]
mov dword [esp + 4], 0
mov dword [0x4c0354], 0
mov dword [esp], eax
call sub.kernel32.dll_TerminateThread
sub esp, 8
test eax, eax
jne 0x46bd6d
call sub.msvcrt.dll__errno
mov ebx, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [ebx], eax
call sub.msvcrt.dll__errno
mov ebx, dword [eax]
mov esi, dword [0x4c0368]
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call sub.kernel32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x80
je 0x46bdb3
cmp eax, 0x102
je 0x46bd73
test eax, eax
je 0x46bdb3
call sub.msvcrt.dll__errno
mov esi, eax
call sub.kernel32.dll_GetLastError
mov dword [esp], eax
call sym.brltty.exe_win_toErrno
mov dword [esi], eax
call sub.msvcrt.dll__errno
test ebx, ebx
jne 0x46be17
mov edx, 0x4c02ac
mov eax, 0x4c029c
call fcn.004667c0
mov eax, 0x4c0280
mov edx, 0x4c0290
call fcn.004667c0
mov eax, dword [0x4c01f0]
test eax, eax
je 0x46bdf0
mov dword [esp], eax
call sym.brltty.exe_authEnd
mov dword [0x4c01f0], 0
call sub.ws2_32.dll_WSACleanup
mov eax, dword [0x4c0350]
test eax, eax
je 0x46be10
mov dword [esp], eax
call sym.brltty.exe_deallocateStrings
mov dword [0x4c0350], 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], ebx
call sub.msvcrt.dll_strerror
mov dword [esp + 4], str.pthread_cancel:__s
mov dword [esp], 4
mov dword [esp + 8], eax
call sym.brltty.exe_logMessage
jmp 0x46bdb7

Function at 0x46cf50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x46cfa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
push ebx
mov ebx, eax
sub esp, 0x4c
lea eax, [ebp - 0x34]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.kernel32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x46d06b
mov eax, dword [ebp - 0x20]
cmp eax, 4
jne 0x46cff1
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x40
je 0x46cfd9
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [ebp - 0x3c], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x40], ecx
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0x40]
cmp ecx, 4
je 0x46cfe9
cmp ecx, 0x40
je 0x46cfe9
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call sub.kernel32.dll_VirtualProtect
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.0046cf50
lea esi, [esi]
lea edi, [edi]
Function at 0x10004491
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
aam 0x88
pop ebp
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
invalid
inc ebp
invalid

Function at 0x10004d43
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0x1fffffa
cmp dword [ebp - 0x398], 0
je 0x10004d68
cmp dword [ebp - 0x398], 0
je 0x10004f32
cmp dword [ebp + 0xc], 1
je 0x10004f32
test dl, cl
add dword [eax], eax
invalid
cmp dword [ebp + 0xc], 8
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax

Function at 0x10005a36
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ch, 1
add byte [eax], al
mov eax, dword [ebp - 0x6fc]
inc eax
mov dword [ebp - 0x6fc], eax
and dword [ebp - 0x37c], 0
call fcn.10004074
jecxz 0x10006060
popfd
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x10006057
lea eax, [ebp - 0x714]
push eax
call fcn.10004084
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10004039
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x10006057
jmp 0x10005a16
cmp dword [ebp - 0x37c], 0
je 0x10006065
jmp 0x1000611a
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x100060be
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x100060c3
jmp 0x10005a16
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x1000610a
lea eax, [ebp - 0x714]
push eax
call fcn.10004084
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.10004039
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x10006115
jmp 0x1000611a
jmp 0x10005a16
cmp dword [ebp - 0x37c], 0
jne 0x100061c4
mov eax, dword [ebp - 0x748]
invalid
test dword [eax + edi*8], edx

Function at 0x1000c79d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10027b40]
jne 0x1000c7a7
repz ret
jmp fcn.1000fd78
Function at 0x1001e69e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10027b40]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1001e633
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1000e400
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x1001e6ed
cmp dword [ebp - 0x1c], 5
jb 0x1001e705
jmp 0x1001e701
cmp dword [ebp - 0x10], 1
jne 0x1001e705
cmp dword [ebp - 0x1c], 4
ja 0x1001e701
jne 0x1001e705
cmp dword [ebp - 0x18], 0
jbe 0x1001e705
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100235b0
call fcn.1001e524
test eax, eax
jge 0x1001e726
mov byte [0x1002ba8c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000c79d
add ebp, 0x78
leave
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x41cbd3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0041420e
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x41cc0b
xor eax, eax
jmp 0x41cc37
cmp esi, dword [ebp - 4]
je 0x41cc34
cmp dword [ebp + 0xc], 0
je 0x41cc34
push dword [edi + 0x9c]
call fcn.0041c7e1
push dword [edi + 0x9c]
mov esi, eax
call fcn.0040f117
pop ecx
pop ecx
cmp esi, eax
je 0x41cc07
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x40d578
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408d2c
mov dword [ebp - 0x14], eax
cmp dword [0x4b2fd8], esi
jne 0x40d66b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d5f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d74b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d74b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d74b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4b2fd8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4b2fdc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4b2fe0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b2fe8], eax
test eax, eax
je 0x40d668
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4b2fe4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d690
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d683
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push 4
pop eax
jmp 0x40d74d
cmp dword [ebp - 0x14], esi
je 0x40d6a5
push dword [0x4b2fd8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d68a
mov eax, dword [0x4b2fe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d703
cmp dword [0x4b2fe8], edi
je 0x40d703
push eax
call ebx
push dword [0x4b2fe8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d703
test eax, eax
je 0x40d703
call ecx
test eax, eax
je 0x40d6f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d6f8
test byte [ebp - 8], 1
jne 0x40d703
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d733
mov eax, dword [0x4b2fdc]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
call eax
mov esi, eax
test esi, esi
je 0x40d730
mov eax, dword [0x4b2fe0]
cmp eax, edi
je 0x40d730
push eax
call ebx
test eax, eax
je 0x40d730
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4b2fd8]
call ebx
test eax, eax
je 0x40d74b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d74d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040e0
mov esp, ebp
pop ebp
ret
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6976596c
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..text
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2ddb12f3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219