joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ce400
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xc0
mov esi, esp
mov dword [esi + 0xa8], ebp
lea ecx, [esi + 0xb0]
mov dword [ecx - 4], esp
xor edi, edi
dec edi
mov dword [ecx + 8], edi
mov dword [ecx + 4], 0x41f580
mov eax, dword fs:[0]
mov dword [ecx], eax
mov dword fs:[0], ecx
xor edx, edx
lea eax, [esi + 0x19]
mov dword [eax + 3], edx
mov dword [eax - 1], 0x25
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
push dword [ebx + 4]
push edx
push ecx
push eax
call fcn.004d87f0
add esp, 0x10
mov dword [esi + 8], esp
lea eax, [esi + 0x20]
mov dword [eax + 0x14], edi
mov dword [eax + 0x10], edi
pcmpeqd xmm0, xmm0
movdqa xmmword [eax], xmm0
mov ebx, eax
sub esp, 0x20
mov edi, esp
lea eax, [edi + 8]
push eax
call fcn.00462320
add esp, 4
mov dword [edi], ebx
mov dword [edi + 4], 0x18
lea eax, [esi + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x18], eax
call fcn.00421650
add esp, 0x20
mov esp, dword [esi + 8]
lea ebx, [esi + eax]
add ebx, 0x20
push dword [ebp + 0x10]
push ebx
lea eax, [esi + 0x20]
push eax
call fcn.004cdba0
add esp, 0xc
mov dword [esi + 8], eax
lea edi, [esi + 0x40]
pcmpeqd xmm0, xmm0
movdqu xmmword [edi + 0x4a], xmm0
movdqa xmmword [edi + 0x40], xmm0
movdqa xmmword [edi + 0x30], xmm0
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea ecx, [esi + 0x14]
xor eax, eax
dec eax
mov dword [ecx], eax
lea ecx, [esi + 0x10]
mov dword [ecx], eax
lea eax, [esi + 0xc]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00461c00
lea eax, [esi + 0xb0]
xor ecx, ecx
mov dword [eax + 8], ecx
lea eax, [esi + 0xc]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push edi
push ebx
push dword [esi + 8]
lea eax, [esi + 0x20]
push eax
call fcn.004cedf0
add esp, 0x1c
mov ebx, dword [esi + 0xc]
xor eax, eax
dec eax
lock xadd dword [ebx + 4], eax
mov edi, dword [ebp + 8]
movzx edx, word [ebp + 0x14]
test eax, eax
jne 0x4ce562
mov eax, dword [ebx]
mov edi, dword [eax + 4]
mov dword [esi + 0xb8], 0xffffffff
mov ecx, edi
call dword [section..00cfg]
mov ecx, ebx
call edi
movzx edx, word [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xb8], 0xffffffff
movzx edx, dx
push edx
push dword [ebp + 0x10]
push eax
push ecx
lea eax, [esi + 0x40]
push eax
push dword [ebp + 0xc]
push edi
call fcn.004cec70
add esp, 0x1c
mov eax, dword [esi + 0xb0]
mov dword fs:[0], eax
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x4db740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push 8
call fcn.0049a541
add esp, 4
mov dword [eax], ebx
mov dword [eax + 4], edi
xor ecx, ecx
push ecx
push ecx
push eax
push 0x4db790
push ecx
push ecx
call fcn.004a709a
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x4db77f
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
pop esi
pop edi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x4dc020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [0x5558d4], 0
je 0x4dc058
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x5558c0]
test esi, esi
je 0x4dc0f2
test byte [0x551b20], 1
je 0x4dc041
cmp byte [esi + 0xb], 0
jns 0x4dc077
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x53a870]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5558d4], eax
inc eax
cmp eax, 1
ja 0x4dc041
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.0049dcc0
add esp, 0xc
mov word [esi - 2], 0
lea edi, [ebp - 0x218]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x4dc197
xor ebx, ebx
jmp 0x4dc041
push 0xc
call fcn.0049a541
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.0049dcc0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.004c4c10
movzx eax, byte [esi + 0xb]
test al, al
jns 0x4dc147
mov eax, dword [esi + 4]
mov ecx, dword [esi]
jmp 0x4dc14c
and eax, 0x7f
mov ecx, esi
test eax, eax
jne 0x4dc169
mov ecx, esi
push 9
push 0x53a8d8
call fcn.00420db0
mov dword [0x5558c0], esi
jmp 0x4dc066
lea edi, [eax + eax]
test edi, edi
je 0x4dc150
lea edx, [edi - 2]
cmp word [ecx + edi - 2], 0x5c
mov edi, edx
jne 0x4dc16c
cmp edx, 0xfffffffe
je 0x4dc150
sar edx, 1
inc edx
cmp eax, edx
jb 0x4dc237
mov ecx, esi
push edx
call fcn.004dbe10
jmp 0x4dc150
mov esi, dword [0x5558c0]
push edi
call fcn.004b2e99
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00420ab0
mov ecx, dword [0x5558c0]
call fcn.0041eda0
cmp word [eax], 0x5c
je 0x4dc1d2
mov ecx, dword [0x5558c0]
push 1
push 0x53a8d4
call fcn.00420db0
mov ecx, dword [0x5558c0]
push 9
push 0x53a8d8
call fcn.00420db0
mov eax, dword [0x5558c0]
cmp byte [eax + 0xb], 0
jns 0x4dc1f1
mov eax, dword [eax]
sub esp, 0x1c
movaps xmm0, xmmword [0x53a870]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x5558d4], eax
inc eax
cmp eax, 1
ja 0x4dc041
mov dword [0x5558d4], 0
jmp 0x4dc0eb
call fcn.004ac810
int3
Function at 0x4dd390
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov edi, dword [ebp + 8]
mov eax, dword [0x550014]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x18a
push str....._base_files_file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.004651d0
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.0046afb0
mov al, byte [edi + 0xb]
test al, al
jns 0x4dd3fd
cmp dword [edi + 4], 0x103
jbe 0x4dd3fd
xor ebx, ebx
jmp 0x4dd413
test al, al
jns 0x4dd403
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.0046b030
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0049b033
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ddb10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x4ddb82
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4ddb86
cmp byte [ebp + 0xc], 0
je 0x4ddb62
cmp byte [esi + 4], 0
je 0x4ddbd7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.00428800
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x4ddb34
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x4ddbac
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ddbb0
xor ebx, ebx
jmp 0x4ddb6c
mov eax, dword [esi]
jmp 0x4ddb98
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x4ddbde
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4ddb62
mov edi, dword [ebp - 0x14]
jmp 0x4ddb62
mov eax, dword [esi]
jmp 0x4ddb56
mov eax, dword [esi]
jmp 0x4ddbc3
Function at 0x4ef6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
mov esi, dword [eax + 4]
xor edx, edx
cmp edi, esi
jge 0x4ef6d9
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
xor edx, edx
mov ebx, edi
or edx, dword [eax + ebx*4]
inc ebx
cmp esi, ebx
jne 0x4ef6d1
cmp esi, edi
jge 0x4ef6e9
mov eax, dword [ecx]
mov ebx, esi
or edx, dword [eax + ebx*4]
inc ebx
cmp edi, ebx
jne 0x4ef6e1
cmp edi, esi
cmovl esi, edi
test esi, esi
jle 0x4ef708
mov edi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
xor eax, eax
mov ecx, dword [ebx + eax*4]
xor ecx, dword [edi + eax*4]
or edx, ecx
inc eax
cmp esi, eax
jne 0x4ef6fb
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f9280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edx, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x550014]
xor ecx, ebp
mov dword [esp + 0x58], ecx
lea ecx, [eax + 4]
mov ebx, ecx
shr ebx, 5
mov dword [esp + 4], edx
mov esi, dword [edx + 0xc]
mov edi, 0
cmp ebx, esi
jae 0x4f92c7
mov edx, dword [ebp + 0xc]
mov edi, dword [edx + ebx*4]
shr edi, cl
shl edi, 5
and edi, 0x20
lea ecx, [eax + 3]
mov edx, ecx
shr edx, 5
mov dword [esp], esi
cmp edx, esi
mov esi, 0
jae 0x4f92e9
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + edx*4]
shr esi, cl
shl esi, 4
and esi, 0x10
or esi, edi
lea edx, [eax + 2]
mov ecx, edx
shr ecx, 5
xor edi, edi
mov ebx, 0
cmp ecx, dword [esp]
jae 0x4f930f
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx + ecx*4]
mov ecx, edx
shr ebx, cl
shl ebx, 3
and ebx, 8
or esi, ebx
mov ebx, esi
lea ecx, [eax + 1]
mov edx, ecx
shr edx, 5
mov esi, dword [esp]
cmp edx, esi
jae 0x4f9333
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + edx*4]
mov esi, dword [esp]
shr edi, cl
shl edi, 2
and edi, 4
or ebx, edi
mov ecx, eax
shr ecx, 5
xor edi, edi
cmp ecx, esi
jae 0x4f934f
mov edx, dword [ebp + 0xc]
mov edi, dword [edx + ecx*4]
mov ecx, eax
shr edi, cl
add edi, edi
and edi, 2
or ebx, edi
test eax, eax
je 0x4f9374
dec eax
mov edx, eax
shr edx, 5
xor ecx, ecx
cmp edx, esi
jae 0x4f936f
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
bt edx, eax
setb cl
and ebx, 0xfffffffe
or ebx, ecx
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 5
lea eax, [ecx - 1]
neg ecx
and eax, ebx
xor ebx, 0x3f
mov dword [esp + 8], ecx
and ebx, ecx
or ebx, eax
mov eax, ebx
shr eax, 1
and ebx, 1
add ebx, eax
mov dword [esp], ebx
push 0xcc
push 0
mov esi, dword [esp + 0x14]
push esi
call fcn.0049dcc0
add esp, 0xc
xor ebx, ebx
mov eax, ebx
xor eax, dword [esp]
dec eax
sar eax, 0x1f
push esi
push edi
push eax
push esi
push dword [esp + 0x14]
call fcn.004f6800
add esp, 0x14
inc ebx
add edi, 0xcc
cmp ebx, 0x11
jne 0x4f93b0
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x10]
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
mov dword [eax + 0x40], 0xffffffff
add esi, 0x44
push esi
push eax
mov edi, dword [esp + 0xc]
push edi
call fcn.004f8540
add esp, 0xc
mov edi, dword [edi + 0x28]
test edi, edi
mov ecx, dword [esp + 8]
je 0x4f9439
mov eax, ecx
mov dword [esp + 4], eax
not ecx
xor edx, edx
mov eax, edi
mov edi, dword [esp + edx*4 + 0x10]
and edi, dword [esp + 4]
mov ebx, dword [esi + edx*4]
and ebx, ecx
or ebx, edi
mov edi, eax
mov dword [esi + edx*4], ebx
inc edx
cmp eax, edx
jne 0x4f941e
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.0049b033
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x504490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
add eax, 0x20
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], eax
xor esi, esi
mov edi, esi
xor edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov edx, edi
push ecx
push ebx
call fcn.005043d0
add esp, 8
lea eax, [ebx + 0x20]
mov ecx, dword [ebp - 0x18]
mov edx, edi
push ecx
push eax
call fcn.005043d0
add esp, 8
inc esi
add ebx, 0x40
cmp esi, 0xf
jne 0x5044c9
mov ecx, dword [ebp + 8]
add ecx, 0x40
mov edx, dword [ebp - 0x10]
push 0x542f8c
push ecx
call fcn.005043d0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x519d90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x550014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x18], eax
add esi, edi
cmp edi, esi
jae 0x519dea
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, esi
sub eax, edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
sete dl
mov ecx, dword [ebp - 0x14]
test ecx, ecx
sete al
or al, dl
jne 0x519de4
mov ebx, ecx
add edi, ebx
cmp al, 1
jne 0x519db4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b033
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x51c710
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xf0
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x550014]
xor eax, ebp
mov dword [esp + 0xe8], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0xa0]
movdqa xmmword [esi + 0x30], xmm0
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
push esi
push 0x20
push dword [ebp + 0x10]
call fcn.004f50a0
add esp, 0xc
and byte [esi], 0xf8
mov al, byte [esi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
mov edi, esp
push 0xa0
push 0xff
push edi
call fcn.0049dcc0
add esp, 0xc
push 0x5470bc
push esi
push edi
call fcn.0048b5a0
add esp, 0xc
mov esi, dword [ebp + 8]
mov ecx, esi
mov edx, edi
call fcn.0051ff70
mov eax, dword [ebp + 0x10]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [ebx + 0x10], xmm1
movups xmmword [ebx], xmm0
movups xmm0, xmmword [esi]
movups xmm1, xmmword [esi + 0x10]
movups xmmword [ebx + 0x20], xmm0
movups xmmword [ebx + 0x30], xmm1
mov ecx, dword [esp + 0xe8]
xor ecx, ebp
call fcn.0049b033
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0xf14714
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf1471e
pushal
call 0xf14724
pop ebp
sub ebp, 0x10
sub ebp, 0xb14714
jmp 0xf1473a
mov eax, 0xb14714
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c1
mov edx, 0x117fabcb
xor byte [eax], dl
inc eax
dec ecx
jne 0xf14751
jmp 0xf14764
inc eax
push es
inc eax
inc edx
test ebx, 0xa4acbcb
xor ecx, ebx
retf
Function at 0x4017a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4017b9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4017f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4017f0
lea ebx, [ebx]
cmp esi, eax
jae 0x4017f4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4017e0
cmp esi, eax
jb 0x4017fa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404bf0
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x428006
mov eax, dword fs:[0]
push eax
sub esp, 0x174
mov eax, dword [0x433ae0]
xor eax, esp
mov dword [esp + 0x16c], eax
mov eax, dword [0x433ae0]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
cmp byte [esi + 0xa6], 0
jne 0x404dd7
mov ecx, dword [esi + 0x20]
push 0
push 0x26
lea eax, [esp + 0x6c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0xc]
call fcn.00401530
push 0xc
push str.Eden_Flirt_
lea ecx, [esp + 0x10]
mov dword [esp + 0x188], 0
call fcn.00405570
mov eax, dword [esi + 0x9c]
push str._EdenFlirtUpdate__CEdenFLirtUpdateDlg::launchEdenFlirtThread_launched
push 2
push eax
call fcn.00406520
add esp, 0xc
lea ecx, [esi + 0xf8]
push ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.00405190
add esp, 0xc
push 0x44
lea ecx, [esp + 0x20]
push 0
push ecx
mov byte [esp + 0x18c], 1
call fcn.004170d0
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
add esp, 0xc
mov dword [esp + 0x1c], 0x44
cmp dword [eax - 4], 1
jle 0x404cf3
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 8]
call fcn.00401370
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0x9c]
push str.launching_edenflash_:__s
push 2
push eax
call fcn.00406520
mov eax, dword [esp + 0x14]
add esp, 0x10
cmp dword [eax - 4], 1
jle 0x404d25
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 8]
call fcn.00401370
mov eax, dword [esp + 4]
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
push 0
jne 0x404d52
push eax
push str.Un_probl
jmp 0x404d59
push 0x40
push str.Linstallation_de_la_mise
call fcn.0040af45
mov edx, dword [esi + 0x9c]
push str._EdenFlirtUpdate__CEdenFLirtUpdateDlg::launchEdenFlirtThread_exiting
push 2
push edx
call fcn.00406520
mov eax, dword [esi + 0x20]
add esp, 0xc
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esp + 0x180], 0
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404dac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x180], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404dd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x16c]
xor ecx, esp
call fcn.0041531b
mov esp, ebp
pop ebp
ret
Function at 0x406400
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x427f18
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x433ae0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [esp + 8]
call fcn.00401530
mov dword [esp + 0x20], 0
mov ecx, dword [esp + 4]
mov eax, dword [ecx - 0xc]
test eax, eax
jl 0x406467
push str._dreamdebug
push ecx
call fcn.00415970
add esp, 8
test eax, eax
je 0x406467
sub eax, dword [esp + 4]
cmp eax, 0xffffffff
je 0x406467
mov byte [esi], 1
push str.TraceSemaphore
push 1
push 1
push 0
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0x200
mov dword [esi + 8], eax
call fcn.00407021
mov dword [esi + 4], eax
add esp, 4
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x12]
movzx edx, word [esp + 0x10]
movzx eax, word [esp + 0xe]
push ecx
movzx ecx, word [esp + 0xe]
push edx
movzx edx, word [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push str.debugLog__u__u__u__u_u_.dat
push 0x200
push eax
call fcn.004161aa
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x20
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406500
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
add esp, 0x20
ret