joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c5840
Capabilities:
Create thread
Get disk information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101180c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x214]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x105
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov dword [ebp - 0x224], 0
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
jne 0x100c59b0
push 0x105
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x105
lea eax, [ebp - 0x214]
push eax
push 0x1010ba08
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x100c59b0
mov edx, dword [0x101c3600]
mov ecx, edx
push esi
mov esi, dword [ebp - 0x224]
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x100c5914
nop dword [eax]
cmp dword [eax + 0x10], esi
jae 0x100c590a
mov eax, dword [eax + 8]
jmp 0x100c590e
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x100c5900
cmp byte [ecx + 0xd], 0
jne 0x100c591f
cmp esi, dword [ecx + 0x10]
jae 0x100c5921
mov ecx, edx
cmp ecx, edx
je 0x100c5986
mov eax, dword [edx]
mov dword [ebp - 0x218], eax
cmp byte [eax + 0xd], 0
jne 0x100c5957
cmp dword [eax + 0x10], esi
jne 0x100c5940
mov eax, dword [eax + 0x14]
mov dword [0x1013b66c], eax
lea ecx, [ebp - 0x218]
call fcn.1004be00
mov eax, dword [ebp - 0x218]
cmp byte [eax + 0xd], 0
je 0x100c5933
push 0
push 0
push 0
push 0x1003eae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
test eax, eax
je 0x100c59b0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100f7fb0
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
call fcn.100c56f0
push 0
push str.Error:_Invalid_HWID
mov esi, eax
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.100f84da
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100f7fb0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100c8c80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
and ecx, eax
mov eax, dword [esi + 0xc]
lea edx, [eax + ecx*8]
mov eax, dword [edx + 4]
cmp eax, dword [esi + 4]
je 0x100c8ced
mov ecx, dword [edi]
mov edx, dword [edx]
cmp ecx, dword [eax + 8]
je 0x100c8ce4
cmp eax, edx
je 0x100c8ced
mov eax, dword [eax + 4]
cmp ecx, dword [eax + 8]
jne 0x100c8cd8
pop edi
add eax, 0xc
pop esi
pop ebp
ret 4
push str.invalid_unordered_map_K__T__key
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const__]
int3

Function at 0x100c8d90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 8
movzx eax, byte [edx]
push ebx
push esi
xor eax, 0x811c9dc5
push edi
mov edi, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 8]
imul ebx, ecx, 0x1000193
mov ecx, edi
push ebx
push edx
push eax
call fcn.10045420
mov esi, dword [eax + 4]
test esi, esi
je 0x100c8e45
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0xc]
and ecx, ebx
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x100c8e0c
cmp eax, esi
jne 0x100c8e04
mov eax, dword [edi + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x100c8e14
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x100c8e14
cmp eax, esi
jne 0x100c8e14
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
dec dword [edi + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0x50]
call fcn.10032650
push 0x5c
push esi
call fcn.100f842c
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100c8f10
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov edx, ecx
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
cmp ebx, eax
je 0x100c907f
mov eax, dword [edx + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [ebx + 9]
push esi
push edi
mov edi, dword [edx + 0xc]
mov esi, ebx
xor ecx, eax
mov dword [ebp - 0x1c], edi
movzx eax, byte [ebx + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebx + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edx + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, dword [edi + eax*8]
mov dword [ebp - 4], ecx
lea eax, [edi + eax*8]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
nop word [eax + eax]
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10032650
push 0x5c
push edi
call fcn.100f842c
mov edx, dword [ebp - 0x14]
add esp, 8
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c8fdd
mov eax, dword [ebp + 0xc]
cmp esi, eax
jne 0x100c8f90
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jne 0x100c9075
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [edi], esi
mov dword [ecx], esi
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp + 8]
jne 0x100c8ff1
mov eax, dword [ebp - 0x18]
mov ecx, eax
mov dword [edi], eax
jmp 0x100c8ff4
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 4], ecx
cmp esi, eax
je 0x100c9075
nop
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebp - 0x1c]
and eax, dword [edx + 0x18]
lea eax, [ecx + eax*8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov edi, esi
mov ebx, esi
mov esi, dword [esi]
lea ecx, [edi + 0x50]
call fcn.10032650
push 0x5c
push edi
call fcn.100f842c
mov edx, dword [ebp - 0x14]
add esp, 8
mov eax, dword [ebp + 0xc]
dec dword [edx + 8]
cmp ebx, dword [ebp - 0x10]
je 0x100c9086
cmp esi, eax
jne 0x100c9045
mov ecx, dword [ebp - 4]
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
cmp esi, eax
jne 0x100c9000
mov ecx, dword [ebp - 8]
pop edi
mov dword [ecx], esi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100dfce0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10101e1d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x101180c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x101c3258]
mov edi, dword [esi + 0x174]
test edi, edi
jle 0x100dfd51
mov edx, dword [esi + 0x4cb0]
mov ecx, dword [0x101c31fc]
add edx, dword [esi + 0x4cac]
push edx
push dword [esi + 0x4cb4]
mov eax, dword [ecx]
push 1
push edi
mov eax, dword [eax + 0xc]
call eax
cmp byte [0x101c617c], 0
jne 0x100dfe8f
movaps xmm0, xmmword [0x1010c3f0]
xor eax, eax
movaps xmm2, xmmword [0x1010c6b0]
movups xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x20], 0x6065
movaps xmm0, xmmword [0x1010c270]
movups xmmword [ebp - 0x30], xmm0
mov byte [ebp - 0x1e], 0x23
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x40]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x40], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x100dfd90
cmp eax, 0x23
jae 0x100dfdbb
nop dword [eax]
xor byte [ebp + eax - 0x40], 0x23
inc eax
cmp eax, 0x23
jb 0x100dfdb0
xorps xmm0, xmm0
mov dword [ebp - 0x48], 0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x44], 0
movups xmmword [ebp - 0x58], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100dfdd6
sub ecx, edx
lea eax, [ebp - 0x40]
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.10034070
mov dword [ebp - 4], 0
mov edx, dword [0x101c31b4]
test edx, edx
je 0x100dfe02
mov edx, dword [edx + 0x50]
jmp 0x100dfe04
xor edx, edx
mov eax, dword [0x101c31ac]
test eax, eax
je 0x100dfe12
mov eax, dword [eax + 0x18]
jmp 0x100dfe14
xor eax, eax
lea ecx, [ebp - 0x58]
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.1003e220
mov edi, dword [ebp - 0x1c]
add esp, 8
mov ecx, dword [ebp - 0x44]
inc edi
cmp ecx, 0xf
jbe 0x100dfe5e
mov edx, dword [ebp - 0x58]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100dfe54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100dfe54
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100f842c
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x18]
mov dword [edi], 0x3e
push eax
push dword [ebp - 0x18]
push 4
push edi
call esi
mov byte [0x101c617c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100f7fb0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x100e0210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dl, byte [esi]
xor dl, byte [edi]
and dl, 1
xor dl, byte [edi]
mov byte [edi], dl
mov cl, byte [esi]
xor cl, dl
and cl, 2
xor cl, dl
mov byte [edi], cl
movzx eax, byte [esi]
xor al, cl
and al, 4
xor al, cl
mov byte [edi], al
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
movq xmm0, qword [esi + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
movq xmm0, qword [esi + 0x18]
movq qword [edi + 0x18], xmm0
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x38], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
movq xmm0, qword [esi + 0x40]
movq qword [edi + 0x40], xmm0
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
movq xmm0, qword [esi + 0x4c]
movq qword [edi + 0x4c], xmm0
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
movq xmm0, qword [esi + 0x5c]
movq qword [edi + 0x5c], xmm0
mov eax, dword [esi + 0x64]
mov dword [edi + 0x64], eax
movq xmm0, qword [esi + 0x68]
movq qword [edi + 0x68], xmm0
mov eax, dword [esi + 0x70]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
movq xmm0, qword [esi + 0x78]
movq qword [edi + 0x78], xmm0
mov eax, dword [esi + 0x80]
mov dword [edi + 0x80], eax
movq xmm0, qword [esi + 0x84]
movq qword [edi + 0x84], xmm0
mov eax, dword [esi + 0x8c]
mov dword [edi + 0x8c], eax
movq xmm0, qword [esi + 0x90]
movq qword [edi + 0x90], xmm0
mov eax, dword [esi + 0x98]
mov dword [edi + 0x98], eax
mov eax, dword [esi + 0x9c]
mov dword [edi + 0x9c], eax
mov eax, dword [esi + 0xa0]
mov dword [edi + 0xa0], eax
mov eax, dword [esi + 0xa4]
mov dword [edi + 0xa4], eax
movzx eax, byte [esi + 0xa8]
mov byte [edi + 0xa8], al
movq xmm0, qword [esi + 0xac]
movq qword [edi + 0xac], xmm0
mov eax, dword [esi + 0xb4]
mov dword [edi + 0xb4], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x401580
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x1c
push esi
push edi
push str.ReadTabData
xor edi, edi
push edi
push 1
push edi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
movzx ecx, word [0x40e76c]
mov dword [0x40e80c], eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x10]
push edx
mov edx, dword [0x40e7b4]
lea eax, [esp + 0x10]
push eax
mov eax, dword [0x40e760]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x401623
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3e5
je 0x401601
call esi
mov dword [0x40e80c], edi
pop edi
xor al, al
pop esi
add esp, 0x1c
ret
mov eax, dword [0x40e760]
push 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x401623
cmp dword [esp + 8], edi
je 0x4015f3
mov ecx, dword [0x40e80c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [0x40e764]
mov eax, dword [0x40e7bc]
mov ecx, dword [0x40e7b8]
push edx
push eax
mov eax, dword [0x40e7b4]
xor edx, edx
mov dx, word [0x40e76c]
push ecx
push edi
mov dword [0x40e80c], edi
push edx
push eax
call fcn.00401420
add esp, 0x18
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x4063e1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40e888], esi
push edi
jne 0x406401
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x40e884], esi
mov byte [0x40e880], al
jne 0x406467
mov ecx, dword [0x40efc8]
test ecx, ecx
je 0x406448
mov eax, dword [0x40efc4]
sub eax, 4
cmp eax, ecx
jmp 0x406441
mov eax, dword [eax]
test eax, eax
je 0x406433
call eax
mov eax, dword [0x40efc4]
sub eax, 4
cmp eax, dword [0x40efc8]
mov dword [0x40efc4], eax
jae 0x40642b
mov eax, 0x40e01c
mov esi, 0x40e020
cmp eax, esi
mov edi, eax
jae 0x406467
mov eax, dword [edi]
test eax, eax
je 0x406460
call eax
add edi, 4
cmp edi, esi
jb 0x406458
mov eax, 0x40e024
mov esi, 0x40e028
cmp eax, esi
mov edi, eax
jae 0x406486
mov eax, dword [edi]
test eax, eax
je 0x40647f
call eax
add edi, 4
cmp edi, esi
jb 0x406477
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4064a0
push dword [ebp + 8]
mov dword [0x40e888], 1
call fcn.00406311
pop ebp
ret

Function at 0x4064e2
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x40e330]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x40e1b0]
je 0x406517
inc eax
cmp eax, 0x13
jb 0x406508
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x40e1b0]
jne 0x40663d
mov eax, dword [0x40e820]
cmp eax, 1
je 0x406615
cmp eax, edx
jne 0x406547
cmp dword [0x40e184], 1
je 0x406615
cmp ecx, 0xfc
je 0x40663d
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40657d
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00407a80
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004079f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4065b1
mov eax, edi
push eax
call fcn.004079f0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x40be18
push edi
call fcn.004080d0
add esp, 0x10
push edi
call fcn.004079f0
push dword [esi + 0x40e1b4]
mov ebx, eax
call fcn.004079f0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00407090
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00407a80
push edi
push ebx
call fcn.00407a90
push 0x40bdf8
push ebx
call fcn.00407a90
push dword [esi + 0x40e1b4]
push ebx
call fcn.00407a90
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00407fce
add esp, 0x2c
jmp 0x40663d
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x40e1b4]
push dword [esi]
call fcn.004079f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00408225
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x407fce
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x40e9d0], ebx
push esi
push edi
jne 0x40804e
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x408089
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40c3b4
push edi
call esi
test eax, eax
mov dword [0x40e9d0], eax
je 0x408089
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x40e9d4], eax
call esi
cmp dword [0x40e848], 2
mov dword [0x40e9d8], eax
jne 0x40804e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x40e9e0], eax
je 0x40804e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x40e9dc], eax
mov eax, dword [0x40e9dc]
test eax, eax
je 0x408093
call eax
test eax, eax
je 0x40807a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x40e9e0]
test eax, eax
je 0x40807a
test byte [ebp - 8], 1
jne 0x408093
cmp dword [0x40e854], 4
jb 0x40808d
or byte [ebp + 0x12], 0x20
jmp 0x4080b2
xor eax, eax
jmp 0x4080c2
or byte [ebp + 0x12], 4
jmp 0x4080b2
mov eax, dword [0x40e9d4]
test eax, eax
je 0x4080b2
call eax
mov ebx, eax
test ebx, ebx
je 0x4080b2
mov eax, dword [0x40e9d8]
test eax, eax
je 0x4080b2
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x40e9d0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408c3e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x408c6c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x408c73
cmp ebx, dword [eax + 4]
jae 0x408c73
xor eax, eax
jmp 0x408e63
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x408c84
xor eax, eax
inc eax
jmp 0x408e62
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x408c9a
cmp ecx, edx
jae 0x408ddf
cmp dword [eax + 4], 0
je 0x408ca3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x408c8b
cmp dword [ebp + 8], 0
je 0x408cc5
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x408ddf
cmp eax, esi
jae 0x408ddf
mov eax, dword [0x40e9e8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x408cea
cmp dword [esi*4 + 0x40e9f0], edi
je 0x408de3
inc esi
cmp esi, eax
jl 0x408cd8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x408e5f
cmp dword [ebp - 8], 0x1000000
jne 0x408e5f
test byte [ebp - 0xc], 0xcc
je 0x408d68
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x408e5f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x408e5f
cmp word [eax + 0x18], 0x10b
jne 0x408e5f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x408e5f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x408d68
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x408d68
test byte [ecx + 0x27], 0x80
jne 0x408ddf
push 1
push 0x40ea30
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x408c7c
mov ecx, dword [0x40e9e8]
test ecx, ecx
mov edx, ecx
jle 0x408d9c
lea eax, [ecx*4 + 0x40e9ec]
cmp dword [eax], edi
je 0x408d9c
dec edx
sub eax, 4
test edx, edx
jg 0x408d90
test edx, edx
jne 0x408dcd
push 0xf
pop ebx
cmp ecx, ebx
jg 0x408da9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x408dc1
lea eax, [edx*4 + 0x40e9f0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x408daf
cmp ecx, 0x10
jge 0x408dcd
inc ecx
mov dword [0x40e9e8], ecx
push 0
push 0x40ea30
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x408c7c
xor eax, eax
jmp 0x408e62
test esi, esi
jle 0x408c7c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x40ea30
call ebx
test eax, eax
jne 0x408c7c
cmp dword [esi*4 + 0x40e9f0], edi
je 0x408e39
mov eax, dword [0x40e9e8]
lea esi, [eax - 1]
test esi, esi
jl 0x408e27
cmp dword [esi*4 + 0x40e9f0], edi
je 0x408e23
dec esi
jns 0x408e17
test esi, esi
jge 0x408e37
cmp eax, 0x10
jge 0x408e32
inc eax
mov dword [0x40e9e8], eax
lea esi, [eax - 1]
jmp 0x408e39
je 0x408e51
xor ecx, ecx
test esi, esi
jl 0x408e51
lea eax, [ecx*4 + 0x40e9f0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x408e3f
push 0
push 0x40ea30
call ebx
jmp 0x408c7c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a292
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00407090
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a32d
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x40e848]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x40a32d
cmp eax, 1
je 0x40a34e
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a32d
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x40a2fa
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x40a329
xor eax, eax
inc eax
jmp 0x40a36d
cmp edi, eax
jae 0x40a331
xor eax, eax
jmp 0x40a36d
cmp eax, esi
jae 0x40a338
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40e848]
jmp 0x40a351
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret