joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408dc8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push esi
mov esi, dword [ebp + 8]
xor eax, eax
cmp word [esi], ax
je 0x408f55
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call edi
push 0xffffffffffffffff
push esi
push 0x105
lea ebx, [ebp - 0x220]
mov dword [ebp - 8], eax
call fcn.0040b640
mov esi, ebx
call fcn.00409003
mov esi, dword [sym.imp.MSVCRT.dll_wcschr]
lea eax, [ebp - 0x21e]
push 0x5c
push eax
call esi
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x408ecc
lea eax, [ebp - 0x220]
cmp ebx, eax
jbe 0x408e4b
cmp word [ebx - 2], 0x3a
je 0x408ebc
lea eax, [ebp - 0x21e]
cmp ebx, eax
jne 0x408ec8
cmp word [ebp - 0x220], 0x5c
jne 0x408ec8
push 0x5c
add ebx, 2
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x408f01
push 0x5c
add eax, 2
push eax
jmp 0x408ec2
and word [ebx], 0
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.00408d89
test eax, eax
pop ecx
pop ecx
jne 0x408eb7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408eb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408f58
mov word [ebx], 0x5c
add ebx, 2
push 0x5c
push ebx
call esi
pop ecx
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x408e79
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x408efa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x408f01
push 0
push dword [ebp + 8]
call fcn.004091a5
test eax, eax
pop ecx
pop ecx
je 0x408f01
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0xc]
push dword [ebp - 4]
mov eax, ebx
call fcn.004089b4
test eax, eax
pop ecx
je 0x408f50
push 1
mov edi, 0x41c568
mov esi, ebx
call fcn.0040d03d
push dword [ebp + 8]
push 0x6dde
push edi
call fcn.0040d176
add esp, 0xc
push dword [ebp + 8]
push 1
call fcn.0040d3cb
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret
lea eax, [ebp - 0x220]
mov dword [ebp + 8], eax
jmp 0x408f01

Function at 0x408f63
Capabilities:
Delete directory

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov ebx, eax
call edi
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [esp + 0x18], eax
call edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 0x10]
mov eax, ebx
call fcn.004089b4
test eax, eax
pop ecx
je 0x408fd5
push 1
mov edi, 0x41c568
mov esi, ebx
call fcn.0040d03d
push ebp
push 0x6ddf
push edi
call fcn.0040d176
add esp, 0xc
push ebp
push 1
call fcn.0040d3cb
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4091ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
call esi
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
call esi
push dword [ebp - 4]
mov esi, eax
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [ebp + 0x14]
xor eax, eax
cmp dword [ebx], 0xffffffff
setne al
push eax
mov eax, esi
call fcn.004089b4
test eax, eax
pop ecx
je 0x409277
push 1
mov edi, 0x41c568
call fcn.0040d03d
push dword [ebp + 8]
push dword [ebx]
mov ebx, esi
push 0x6de2
push edi
call fcn.0040d176
add esp, 0x10
push dword [ebp + 8]
push 1
call fcn.0040d3cb
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebx], 0xffffffff
pop edi
pop esi
setne al
pop ebx
leave
ret

Function at 0x409284
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov ebx, eax
call edi
push dword [ebp + 0xc]
mov esi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov dword [ebp - 8], eax
call edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 4]
mov eax, ebx
call fcn.004089b4
test eax, eax
pop ecx
je 0x4092fc
push 1
mov edi, 0x41c568
mov esi, ebx
call fcn.0040d03d
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x6de2
push edi
call fcn.0040d176
add esp, 0x10
push dword [ebp + 8]
push 1
call fcn.0040d3cb
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409304
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
push 0x8001
mov dword [esi + 8], eax
call edi
mov dword [ebp + 0xc], eax
call fcn.00416062
test eax, eax
je 0x40934d
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x254]
push eax
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
jmp 0x40935d
lea eax, [ebp - 0x254]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
call ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esi], 0xffffffff
jne 0x4093c1
call ebx
cmp eax, 2
je 0x40938f
call ebx
cmp eax, 0x12
je 0x40938f
xor eax, eax
jmp 0x409392
xor eax, eax
inc eax
mov ebx, dword [ebp + 0x10]
push eax
mov eax, ebx
call fcn.004089b4
test eax, eax
pop ecx
je 0x4093bd
push 1
mov edi, 0x41c568
mov esi, ebx
call fcn.0040d03d
push 0x6de7
push edi
call fcn.0040d176
pop ecx
pop ecx
xor eax, eax
jmp 0x4093ed
lea edi, [ebp - 0x254]
call fcn.00409559
test eax, eax
jne 0x4093dd
push dword [ebp + 0x10]
push esi
call fcn.004093f2
pop ecx
pop ecx
jmp 0x4093ed
lea eax, [ebp - 0x254]
mov ecx, esi
call fcn.00409b52
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4096ad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 0x8001
call esi
push dword [ebp + 8]
mov edi, eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [ebp - 4], eax
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test ebx, ebx
mov ebx, dword [ebp + 0x14]
setne al
mov dword [ebp - 4], eax
push eax
mov eax, ebx
call fcn.004089b4
test eax, eax
pop ecx
je 0x409727
push 1
mov edi, 0x41c568
mov esi, ebx
call fcn.0040d03d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x6de6
push edi
call fcn.0040d176
add esp, 0x10
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409b9f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
lea ebx, [ebp - 0x210]
push 0x105
call fcn.0040b640
add esp, 0xc
mov edi, ebx
call fcn.0040b5e7
mov esi, ebx
call fcn.00408fe0
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call esi
mov edi, eax
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov dword [ebp - 4], eax
call esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x409c49
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
mov ebx, edx
call fcn.00409e7b
test eax, eax
je 0x409d0b
xor eax, eax
mov ax, word [esi]
push eax
call dword [sym.imp.MSVCRT.dll_towupper]
and word [ebp - 4], 0
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
mov word [ebp - 6], 0x3a
call fcn.00409b9f
cmp eax, 3
pop ecx
pop ecx
je 0x409d0b
cmp eax, 2
je 0x409d0b
push 0x104
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x409ce4
push 0x1a
lea eax, [ebp - 0x214]
push 0x41c84c
push eax
call dword [sym.imp.MSVCRT.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x409ce4
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x420]
call fcn.00409c07
test eax, eax
pop ecx
jne 0x409ce8
xor eax, eax
jmp 0x409d1a
push 0xffffffffffffffff
lea eax, [ebp - 0x420]
push eax
push edi
call fcn.0040b640
push 0xffffffffffffffff
add esi, 4
mov eax, edi
push esi
mov edi, ebx
call fcn.0040b696
add esp, 0x14
jmp 0x409d17
push 0xffffffffffffffff
push esi
push edi
call fcn.0040b640
add esp, 0xc
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409d1f
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, edi
call fcn.00409e7b
test eax, eax
jne 0x409d3f
mov eax, 0x4b0
jmp 0x409e51
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x409e51
mov eax, 0x640
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
test esi, esi
pop ecx
jne 0x409d76
push 8
pop eax
jmp 0x409e51
xor eax, eax
mov ax, word [edi]
push eax
call dword [sym.imp.MSVCRT.dll_towupper]
pop ecx
push ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
call sub.MPR.dll_WNetEnumResourceW
cmp eax, 0xea
mov dword [ebp - 0x18], eax
jne 0x409dca
mov eax, dword [ebp - 8]
push eax
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.MSVCRT.dll_realloc]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x409d87
push 8
pop eax
jmp 0x409e50
xor edi, edi
cmp eax, edi
jne 0x409e3d
cmp dword [ebp - 4], edi
jle 0x409d87
lea ebx, [esi + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x409def
movzx eax, word [eax]
push eax
call dword [sym.imp.MSVCRT.dll_towupper]
cmp word [ebp - 0x14], ax
pop ecx
je 0x409dfa
inc edi
add ebx, 0x20
cmp edi, dword [ebp - 4]
jl 0x409dd8
jmp 0x409d87
push 0xffffffffffffffff
shl edi, 5
push dword [edi + esi + 0x14]
mov edi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ebx, edi
call fcn.0040b640
mov ebx, dword [ebp + 0x10]
add ebx, 4
add esp, 0xc
cmp word [ebx], 0x5c
je 0x409e30
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
push 0x41c8c0
call fcn.0040b696
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
push 0xffffffffffffffff
push ebx
call fcn.0040b696
pop ecx
pop ecx
push dword [ebp - 0x10]
call sub.MPR.dll_WNetCloseEnum
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 0x18]
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40bef8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.004163a0
push ebx
push esi
push 0xc
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
xor ebx, ebx
cmp eax, ebx
pop ecx
je 0x40bf20
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [ebp - 4], eax
jmp 0x40bf23
mov dword [ebp - 4], ebx
push dword [edi + 0xc]
lea esi, [ebp - 8]
push str.R_03d
call fcn.0040bffa
pop ecx
pop ecx
lea eax, [edi + 0x24]
call fcn.0040c22e
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jne 0x40bf49
mov ecx, 0x41730c
push eax
push 0x1000
lea eax, [ebp - 0x2008]
push eax
mov esi, 0x41cba0
push esi
push ecx
lea eax, [edi + 0x20]
call fcn.0040c22e
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2008]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x40bf96
push dword [ebp + 8]
mov eax, dword [ebp - 4]
push dword [0x41f0ec]
add eax, 8
call fcn.0040c8fe
jmp 0x40bfc1
lea eax, [ebp - 0x2008]
push eax
mov eax, dword [ebp - 4]
add eax, 8
push eax
call fcn.0040c452
mov eax, dword [ebp - 4]
push ebx
push ebx
push 0x41cb98
push 0x41cb94
add eax, 8
push eax
call fcn.0040c617
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
push esi
add eax, 4
push 0x41cb8c
push eax
call fcn.0040c8eb
mov eax, dword [ebp - 4]
mov dword [eax], esi
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea esi, [edi + 4]
call fcn.0040c100
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
pop esi
pop ebx
leave
ret 4

Function at 0x40dd90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push 0x11c
lea eax, [ebp - 0x11c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x11c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x118], 6
sbb eax, eax
inc eax
leave
ret

Function at 0x40ddd2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x1c], edi
mov esi, ecx
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x440
jne 0x40ddf7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
movzx eax, word [eax + 0x30]
neg esi
sbb esi, esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
and esi, str.runas
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
pop edi
pop esi
je 0x40de50
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x18]
mov dword [edx], ecx
leave
ret
Function at 0x40de52
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push 0x44
pop edi
push edi
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [ebp - 0x58], edi
mov word [ebp - 0x28], 1
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 0x14], ebx
call fcn.0040dd90
test eax, eax
je 0x40deb6
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040ddd2
add esp, 0x18
jmp 0x40df68
push dword [ebp + 8]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
call edi
push dword [ebp + 0xc]
mov ebx, eax
call edi
add ebx, eax
lea eax, [ebx + ebx + 4]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004163a0
mov dword [ebp - 4], esp
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov ebx, dword [sym.imp.MSVCRT.dll_wcscat]
push 0x41cbd8
push dword [ebp - 4]
call ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call ebx
xor ebx, ebx
add esp, 0x18
cmp esi, ebx
je 0x40df17
cmp word [esi], bx
je 0x40df17
push esi
call edi
pop ecx
inc eax
jmp 0x40df1a
xor eax, eax
inc eax
add eax, eax
add eax, 3
and eax, 0xfffffffc
call fcn.004163a0
cmp esi, ebx
mov edi, esp
je 0x40df39
push esi
push edi
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
jmp 0x40df3c
mov word [edi], bx
lea eax, [ebp - 0x14]
push eax
neg esi
lea eax, [ebp - 0x58]
push eax
sbb esi, esi
and esi, edi
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x10], ebx
je 0x40df68
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0x64]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411809
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], ecx
mov dword [eax], 0x41d040
mov dword [eax + 8], 0x41d038
mov dword [eax + 0x10], 0x67452301
mov dword [eax + 0x14], 0xefcdab89
mov dword [eax + 0x18], 0x98badcfe
mov dword [eax + 0x1c], 0x10325476
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
ret

Function at 0x414fe5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp - 0x148]
push 0x40
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
pop ecx
mov edx, dword [eax + 0x2c]
xor edx, dword [eax + 0x18]
xor edx, dword [eax - 8]
xor edx, dword [eax]
add eax, 4
dec ecx
mov dword [eax + 0x34], edx
jne 0x415006
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [ebp + 0x14]
mov ecx, eax
shl eax, 5
shr ecx, 0x1b
or ecx, eax
mov eax, dword [ebp - 4]
add ecx, dword [ebp + eax*4 - 0x148]
push 0x14
add ecx, dword [edx]
cdq
pop edi
idiv edi
sub eax, 0
je 0x41509a
dec eax
je 0x415085
dec eax
je 0x415065
dec eax
jne 0x4150b5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
xor eax, dword [edx]
xor eax, dword [ebx]
lea ecx, [ecx + eax - 0x359d3e2a]
jmp 0x4150b5
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
mov edi, eax
or edi, edx
and edi, dword [ebx]
and eax, edx
or edi, eax
mov dword [ebp - 8], edx
lea ecx, [ecx + edi - 0x70e44324]
jmp 0x4150b5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
xor eax, dword [edx]
xor eax, dword [ebx]
lea ecx, [ecx + eax + 0x6ed9eba1]
jmp 0x4150b5
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov edi, dword [edi]
mov edx, eax
not edx
and edx, dword [ebx]
and edi, eax
or edx, edi
lea ecx, [ecx + edx + 0x5a827999]
mov eax, dword [ebx]
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edi, eax
shr eax, 2
shl edi, 0x1e
or edi, eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x50
mov dword [edx], edi
mov eax, dword [esi]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov dword [esi], ecx
jl 0x41501e
pop edi
pop esi
leave
ret
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 1
jne 0x401015
mov eax, 1
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi]
test edi, edi
je 0x40102a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4020b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [esi + 8]
test edi, 0x10000
je 0x401050
push 0
push 0
push 0xc0000025
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
test edi, 0x20000
je 0x401071
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 1
push 0xc0000025
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401080
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 2
jne 0x401095
mov eax, 2
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi]
test edi, edi
je 0x4010aa
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4020b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [esi + 8]
test edi, 0x10000
je 0x4010d0
push 0
push 0
push 0xc0000025
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
test edi, 0x20000
je 0x4010f1
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 1
push 0xc0000025
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401100
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 3
jne 0x401115
mov eax, 3
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi]
test edi, edi
je 0x40112a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4020b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [esi + 8]
test edi, 0x10000
je 0x401150
push 0
push 0
push 0xc0000025
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
test edi, 0x20000
je 0x401171
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 1
push 0xc0000025
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401180
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x401192
xor eax, eax
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [esi]
test edi, edi
je 0x4011a7
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x4020b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [esi + 8]
test edi, 0x10000
je 0x4011cd
push 0
push 0
push 0xc0000025
push ebx
call dword [sym.imp.KERNEL32.dll_RaiseException]
test edi, 0x20000
je 0x4011ee
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 1
push 0xc0000025
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [esi + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xed32bd5
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
xor ecx, ecx
push esi
push edi
cmp dword [ebp + 0xc], ecx
jne 0xed32d02
mov edi, dword [ebp + 0x14]
cmp edi, ecx
je 0xed32d02
cmp dword [ebp + 0x10], 1
jne 0xed32d02
mov eax, dword [edi + 4]
mov esi, dword [ebp + 8]
cmp eax, dword [esi + 0x90]
jne 0xed32c66
mov edi, dword [edi + 0x10]
cmp dword [0xed3ff1c], edi
je 0xed32d02
mov eax, dword [esi + 0x110]
mov dword [0xed3ff1c], edi
cmp eax, ecx
je 0xed32c44
cmp dword [eax + 0x28], ecx
je 0xed32c44
push 1
push ecx
mov ecx, esi
call fcn.0ed31fdc
push 0
mov ecx, esi
call fcn.0ed329ee
mov esi, dword [esi + 0x110]
test esi, esi
je 0xed32d02
cmp dword [esi + 0x24], 0
je 0xed32d02
call fcn.0ed33d3a
jmp 0xed32d02
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
cmp eax, 0x201
je 0xed32c7b
cmp eax, 0x203
jne 0xed32ca9
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call ebx
movsx eax, word [edi + 0xc]
add eax, dword [ebp - 0x10]
mov dword [esi + 0xe4], eax
movsx eax, word [edi + 0xe]
add eax, dword [ebp - 0xc]
mov dword [esi + 0xe8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xf4], eax
mov eax, dword [edi + 4]
cmp eax, 0x202
je 0xed32cba
cmp eax, 0xa2
jne 0xed32d01
lea eax, [ebp - 0x10]
push eax
push dword [edi]
call ebx
movsx eax, word [edi + 0xc]
add eax, dword [ebp - 0x10]
mov dword [esi + 0xec], eax
movsx eax, word [edi + 0xe]
add eax, dword [ebp - 0xc]
mov dword [esi + 0xf0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xf8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0xed3ff18], eax
je 0xed32d01
push 1
push 0
mov ecx, esi
call fcn.0ed31fdc
pop ebx
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0xde9c98
Capabilities:
Encode data using xor

Disassembly:
jmp 0xde9ca2
pushal
call 0xde9ca8
pop ebp
sub ebp, 0x10
sub ebp, 0x9e9c98
mov al, byte [esp + 0x28]
cmp al, 1
je 0xde9ccc
popal
xor eax, eax
inc eax
ret 0xc
jmp 0xde9cd5
mov eax, 0x9e9c98
add eax, ebp
add eax, 0x63
mov ecx, 0x5ad
mov edx, 0xbe222408
xor byte [eax], dl
inc eax
dec ecx
jne 0xde9cec
jmp 0xde9cff
add ebp, 0xffffff83
xor dword [eax + ecx], 0xc9890808
lock or byte [eax], cl
or byte [ebx], cl
lds esi, [eax + 0x808080f]
mov dl, 0x20
or byte [eax], cl
or bh, bh
ljmp 0x804