joyce8/EMBER2024-capa huggingface dataset:
Function at 0x437cb1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44bfcc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004276e5
mov dword [ebp - 0x14], eax
cmp dword [0x44eed0], edi
jne 0x437da2
push 0x800
push edi
push 0x4451b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x437d2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x437e82
push 0x4451b4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x437e82
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x437e82
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x44eed0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x44eed4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x44eed8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44eee0], eax
test eax, eax
je 0x437d9f
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44eedc], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x437dc7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x437dba
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x437ddc
push 4
pop eax
jmp 0x437e84
cmp dword [ebp - 0x14], edi
je 0x437ddc
push dword [0x44eed0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x437dc1
mov eax, dword [0x44eedc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x437e3a
cmp dword [0x44eee0], esi
je 0x437e3a
push eax
call ebx
push dword [0x44eee0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x437e3a
test eax, eax
je 0x437e3a
call ecx
test eax, eax
je 0x437e2f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x437e2f
test byte [ebp - 8], 1
jne 0x437e3a
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x437e6a
mov eax, dword [0x44eed4]
cmp eax, esi
je 0x437e67
push eax
call ebx
test eax, eax
je 0x437e67
call eax
mov edi, eax
test edi, edi
je 0x437e67
mov eax, dword [0x44eed8]
cmp eax, esi
je 0x437e67
push eax
call ebx
test eax, eax
je 0x437e67
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x44eed0]
call ebx
test eax, eax
je 0x437e82
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x437e84
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042128d
leave
ret
Function at 0x401f09
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x20
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x401f20
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
push 0x1f4
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push edi
call sub.MSVCRT.dll_strcpy
cmp byte [edi], 0x22
pop ecx
pop ecx
jne 0x401f44
inc edi
xor eax, eax
cmp byte [eax + edi], 0x22
jne 0x401f50
and byte [eax + edi], 0
inc eax
cmp eax, 0x1f3
jl 0x401f46
xor esi, esi
push edi
call sub.MSVCRT.dll_strlen
sub eax, 4
test eax, eax
pop ecx
jle 0x401fe4
mov cl, byte [esi + edi]
cmp cl, 0x2e
jne 0x401fd5
mov al, byte [esi + edi + 1]
cmp al, 0x65
je 0x401f7c
cmp al, 0x45
jne 0x401fa0
mov al, byte [esi + edi + 2]
cmp al, 0x78
je 0x401f88
cmp al, 0x58
jne 0x401fa0
mov al, byte [esi + edi + 3]
cmp al, 0x65
je 0x401f94
cmp al, 0x45
jne 0x401fa0
mov al, byte [esi + edi + 4]
cmp al, 0x20
je 0x401fe4
test al, al
je 0x401fe4
cmp cl, 0x2e
jne 0x401fd5
mov al, byte [esi + edi + 1]
cmp al, 0x73
je 0x401fb1
cmp al, 0x53
jne 0x401fd5
mov al, byte [esi + edi + 2]
cmp al, 0x63
je 0x401fbd
cmp al, 0x43
jne 0x401fd5
mov al, byte [esi + edi + 3]
cmp al, 0x72
je 0x401fc9
cmp al, 0x52
jne 0x401fd5
mov al, byte [esi + edi + 4]
cmp al, 0x20
je 0x401fe4
test al, al
je 0x401fe4
inc esi
push edi
call sub.MSVCRT.dll_strlen
pop ecx
sub eax, 4
cmp esi, eax
jl 0x401f68
push edi
call sub.MSVCRT.dll_strlen
sub eax, 4
pop ecx
cmp esi, eax
jl 0x40200b
push edi
push dword [esp + 0x10]
call sub.MSVCRT.dll_strcpy
push edi
push dword [esp + 0x1c]
call sub.MSVCRT.dll_strcpy
add esp, 0x10
jmp 0x402042
push ebx
mov ebx, dword [esp + 0x10]
push edi
push ebx
call sub.MSVCRT.dll_strcpy
add esi, 3
pop ecx
pop ecx
lea eax, [esi + ebx]
mov byte [eax + 1], 0
js 0x402035
lea ecx, [esi + 1]
mov edx, edi
sub edx, ebx
mov bl, byte [edx + eax]
mov byte [eax], bl
dec eax
dec ecx
jne 0x40202c
push edi
push dword [esp + 0x18]
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
pop ebx
dec edi
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
ret

Function at 0x41e504
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x41e519
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
and dword [esi], 0
pop esi
ret

Function at 0x41e51b
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 4]
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
push eax
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test eax, eax
jne 0x41e54b
mov ecx, esi
call fcn.0041e504
mov edx, dword [ebp - 4]
mov dword [esi], edx
pop esi
leave
ret 0xc
Function at 0x41e69b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
push ebx
push esi
push edi
mov edi, 0x20019
push edi
xor esi, esi
push 0x403204
push 0x80000002
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call fcn.0041e51b
mov ebx, eax
cmp ebx, esi
jne 0x41e6ed
push edi
push 0x403210
push dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
call fcn.0041e51b
mov ebx, eax
cmp ebx, esi
je 0x41e714
lea ecx, [ebp - 8]
call fcn.0041e504
lea ecx, [ebp - 4]
call fcn.0041e504
lea ecx, [ebp - 0xc]
call fcn.0041e504
lea ecx, [ebp - 0x10]
call fcn.0041e504
mov eax, ebx
jmp 0x41e82b
push edi
push 0x40321c
push dword [ebp - 0xc]
lea ecx, [ebp - 4]
call fcn.0041e51b
mov edi, eax
cmp edi, esi
jne 0x41e809
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov ecx, 0x200
lea edi, [ebp - 0x814]
push 0x800
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x814]
push eax
push esi
push dword [ebp - 4]
call ebx
mov edi, eax
cmp edi, esi
jne 0x41e809
inc dword [ebp - 0x14]
push 9
mov edi, 0x40322c
lea esi, [ebp - 0x814]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41e7a0
mov ecx, 0x200
lea edi, [ebp - 0x814]
push 0x800
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x14]
push dword [ebp - 4]
call ebx
mov edi, eax
or edi, edi
je 0x41e760
jmp 0x41e809
push 0x2001f
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 4]
lea ecx, [ebp - 8]
call fcn.0041e51b
mov esi, eax
test esi, esi
je 0x41e7e1
lea ecx, [ebp - 8]
call fcn.0041e504
lea ecx, [ebp - 4]
call fcn.0041e504
lea ecx, [ebp - 0xc]
call fcn.0041e504
lea ecx, [ebp - 0x10]
call fcn.0041e504
mov eax, esi
jmp 0x41e82b
mov ebx, dword [ebp + 8]
push 4
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push 0x403238
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 8]
mov edi, eax
call fcn.0041e504
lea ecx, [ebp - 8]
call fcn.0041e504
lea ecx, [ebp - 4]
call fcn.0041e504
lea ecx, [ebp - 0xc]
call fcn.0041e504
lea ecx, [ebp - 0x10]
call fcn.0041e504
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41edda
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041f2e0
xor eax, eax
push ebx
xor ebx, ebx
mov edx, 0xff
push esi
push edi
mov byte [ebp - 0x800], bl
mov ecx, edx
lea edi, [ebp - 0x7ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x400], bl
mov ecx, edx
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x1000], bl
mov ecx, edx
lea edi, [ebp - 0xfff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0xc00], bl
mov ecx, edx
lea edi, [ebp - 0xbff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor esi, esi
cmp dword [ebp + 8], ebx
stosb byte es:[edi], al
je 0x41ee5b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov esi, eax
cmp esi, ebx
je 0x41ee89
push dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or eax, eax
je 0x41ee89
cmp dword [ebp + 0xc], ebx
push dword [ebp + 0x14]
push edi
push edi
je 0x41ee7f
call dword [0x40304c]
jmp 0x41ee85
call dword [sym.imp.MSVCIRT.dll_public_virtual:_void___thiscall_fstream::destructor_void_]
test eax, eax
jne 0x41ee90
xor eax, eax
jmp 0x41ef25
lea esi, [ebp - 0xc00]
push esi
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
push edi
call dword [sym.imp.MSVCRT.dll___CxxFrameHandler]
lea edx, [ebp - 0x400]
add esp, 0x14
lea eax, [edx + 1]
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x41eebf
sub edx, eax
cmp edx, 1
jle 0x41eee2
lea edx, [ebp + edx - 0x401]
mov cl, byte [edx]
cmp cl, 0x5c
je 0x41eee0
cmp cl, 0x2f
jne 0x41eee2
mov byte [edx], bl
lea esi, [ebp - 0x800]
mov edx, edi
mov ecx, esi
sub edx, ecx
mov cl, byte [esi]
mov byte [edx + esi], cl
inc esi
cmp cl, bl
jne 0x41eeee
lea edx, [ebp - 0x400]
mov eax, edx
mov cl, byte [edx]
inc edx
cmp cl, bl
jne 0x41ef00
sub edx, eax
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x41ef0a
mov ecx, edx
shr ecx, 2
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4019a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movsx eax, word [0x46d2d2]
movsx ecx, word [0x4696b4]
imul eax, eax, 0x1a0b96f5
not ecx
push esi
push edi
mov edi, dword [ebp + 8]
sub ecx, eax
xor dword [0x45f318], ecx
mov ecx, edi
call fcn.00412150
mov ecx, edi
mov esi, eax
call fcn.00428e40
cmp esi, eax
je 0x401a11
lea ebx, [ebx]
mov eax, dword [0x462d50]
mov ecx, edi
not eax
or dword [0x45d5d0], eax
mov byte [esi], 0
inc esi
mov eax, dword [0x4663a4]
xor eax, dword [0x463fa4]
xor eax, 0x835f5c4a
mov dword [0x463fa4], eax
call fcn.00428e40
cmp esi, eax
jne 0x4019e0
and dword [0x45f570], 0xc00230
pop edi
pop esi
pop ebp
ret

Function at 0x409a30
Capabilities:
Hash data with md5

Disassembly:
dec dword [0x457e3c]
mov edx, ecx
mov eax, dword [0x457e3c]
add eax, 0xaec5dd14
cmp eax, 0x83b1f680
jle 0x409a60
mov eax, dword [0x461a24]
and eax, dword [0x45dcfc]
and eax, 0xe75b2d7a
mov dword [0x461a24], eax
jmp 0x409a76
mov eax, dword [0x45e680]
and eax, dword [0x457f34]
mov dword [0x457f34], eax
dec dword [0x45e680]
mov dword [edx], 0
mov eax, dword [0x45f490]
sub eax, 0x1588b343
cmp eax, 0xff7bff75
jl 0x409a97
and dword [0x45c0dc], 0xae480e64
mov dword [edx + 4], 0
and dword [0x45a55c], 0xa822b250
mov dword [edx + 8], 0x67452301
mov eax, dword [0x4596f4]
mov ecx, dword [0x458970]
dec dword [0x4596f4]
sub ecx, eax
cmp ecx, 0xfffbfcff
jne 0x409b08
mov ecx, dword [0x45aee4]
mov eax, dword [0x459100]
and ecx, 0x28cf86dd
dec dword [0x459100]
xor eax, ecx
cmp eax, 0x8802a210
jge 0x409b08
inc word [0x4691c8]
mov ax, word [0x4691c8]
cwde
or eax, 0xc707acc8
add eax, dword [0x463850]
mov dword [0x463850], eax
mov dword [edx + 0xc], 0xefcdab89
inc word [0x46ceb8]
movzx eax, word [0x46ceb8]
movzx ecx, word [0x46ba1a]
imul ecx, eax
imul eax, ecx, 0xe247cd87
mov word [0x46ba1a], ax
mov dword [edx + 0x10], 0x98badcfe
inc dword [0x45d858]
mov eax, dword [0x45d858]
xor eax, 0xf4c48d4a
sub dword [0x457f7c], eax
mov dword [edx + 0x14], 0x10325476
cmp dword [0x45cef0], 0x44100
jne 0x409b6d
add dword [0x4640c0], 0x2a2cb952
ret
Function at 0x413cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45fa90]
mov ecx, 0x84093256
and eax, 0x76ba0919
sub dword [0x4620b4], eax
dec dword [0x45fa90]
mov dword [0x462abc], 0xcf2d44f1
movsx eax, word [0x46aa2c]
sub ecx, eax
mov eax, dword [0x45c1bc]
imul eax, ecx
push esi
mov dword [0x45c1bc], eax
dec word [0x46aa2c]
movzx ecx, word [0x468f78]
mov eax, dword [ebp + 8]
sub ecx, 0x56c12980
mov word [0x468f78], cx
mov ecx, dword [ebp + 0xc]
lea esi, [eax + ecx*4]
movzx ecx, word [0x46daa8]
and ecx, 0xa057b653
mov word [0x46daa8], cx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
dec dword [0x45d258]
mov ecx, dword [0x45d258]
mov edx, dword [0x4667e4]
imul edx, ecx
mov dword [0x4667e4], edx
cmp eax, esi
je 0x413e21
inc dword [0x459b8c]
mov ecx, dword [0x459b8c]
or dword [0x4604fc], ecx
mov ecx, dword [ebp - 4]
xor dword [eax], ecx
mov edx, dword [0x4596a0]
mov ecx, dword [0x458730]
not edx
dec dword [0x458730]
and edx, 0x79a19078
or ecx, edx
cmp ecx, 0x9e800528
jg 0x413da5
movsx ecx, word [0x46c07e]
and ecx, 0x30581703
or ecx, 0x8ba72884
mov dword [0x463f10], ecx
ror dword [ebp - 4], 1
or dword [0x466310], 0x86c9284
or dword [0x4671c8], 0x3abdfc88
mov ecx, dword [ebp - 4]
shr ecx, 8
add cl, byte [ebp - 4]
mov byte [ebp - 3], cl
mov ecx, dword [0x45fc38]
sar ecx, 0xa
imul ecx, ecx, 0x192a60b8
cmp ecx, 0xdb93307c
je 0x413de9
or dword [0x45aa24], 0x6f7f3649
mov cl, byte [ebp - 3]
add eax, 4
add byte [ebp - 4], cl
movzx ecx, word [0x46ba26]
movsx edx, cx
movzx ecx, word [0x46ed16]
add ecx, 0x2e5649d
add ecx, edx
mov word [0x46ba26], cx
dec word [0x46ed16]
cmp eax, esi
jne 0x413d51
xor dword [0x462a10], 0xa057430b
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
movsx edx, word [0x46c71c]
mov ecx, 0xfc43769f
mov eax, dword [0x45b6d0]
add edx, 0xec626be1
sub ecx, eax
cmp ecx, edx
jne 0x414c3c
and dword [0x466a50], 0x40e22015
jmp 0x414c51
imul eax, dword [0x45a2bc], 0x689b3987
xor eax, 0x88619512
or dword [0x466ad4], eax
imul eax, dword [0x465cec], 0x50d852a4
cmp dword [0x46f1d4], 0
mov dword [0x465cec], eax
jne 0x414c8f
movzx eax, word [0x4677d8]
sub eax, 0x7b70ce74
mov word [0x4677d8], ax
call fcn.0041f740
mov dword [0x46f1d4], eax
xor dword [0x462684], 0x5c7d3c68
or dword [0x45abfc], 0xb339641c
push esi
push edi
push 3
push 0x2c0d
call fcn.0041d3e0
add dword [0x463360], 0x525c0813
mov esi, eax
push esi
push dword [ebp + 8]
call fcn.0042e1d1
add dword [0x45f1c0], 0x51b4f1a9
mov edi, eax
push esi
push 3
call fcn.0040b0b0
add dword [0x45d370], 0xf26d0719
add esp, 0x18
test edi, edi
jne 0x414d69
dec dword [0x464c7c]
mov eax, dword [0x464c7c]
movzx ecx, word [0x46be40]
sub ecx, eax
mov word [0x46be40], cx
push 0x3e8
call dword [0x4577bc]
or dword [0x457a98], 0x5a651e3f
push 3
push 0x2c0d
call fcn.0041d3e0
mov ecx, dword [0x45eed4]
mov esi, eax
mov edx, 0x68b11be0
push esi
push dword [ebp + 8]
sub edx, ecx
xor dword [0x458acc], edx
call fcn.0042e1d1
xor dword [0x4658d8], 0x945582fa
mov edi, eax
push esi
push 3
call fcn.0040b0b0
movsx eax, word [0x46c150]
add esp, 0x18
imul eax, eax, 0x29ef5b88
and dword [0x462b0c], eax
mov ecx, dword [0x45d128]
mov eax, dword [0x45f94c]
sar ecx, 4
and ecx, 0x420004d
or eax, ecx
or eax, 0xdbd3f732
mov dword [0x45f94c], eax
test edi, edi
je 0x414e44
movsx eax, word [0x46c098]
mov ecx, 0x1f8cddb6
sub ecx, eax
movsx eax, word [0x46ed64]
inc word [0x46c098]
sar eax, 7
or eax, ecx
cmp eax, 0xf0e742a7
jg 0x414dc7
mov ax, word [0x4697f2]
mov word [0x4697f2], ax
jmp 0x414dd1
mov dword [0x45a34c], 0xf7ba2a98
push edi
push 1
push 4
push 0x46f1d4
call fcn.0042e384
dec word [0x467a82]
mov ecx, 0x5b02b823
mov ax, word [0x467a82]
add esp, 0x10
cwde
sub ecx, eax
or ecx, dword [0x45b520]
cmp ecx, 0x68a4e610
jle 0x414e26
mov eax, dword [0x4607a8]
shl eax, 8
cmp eax, 0xc01a00
jg 0x414e1c
mov eax, dword [0x45cd48]
jmp 0x414e26
mov eax, dword [0x4579b0]
mov eax, dword [0x462e2c]
push edi
call fcn.0042e096
mov eax, dword [0x45b960]
add esp, 4
and eax, dword [0x45a6ac]
and eax, 0x80b0ea5a
mov dword [0x45b960], eax
pop edi
mov dword [0x46049c], 0x22be53a6
pop esi
pop ebp
ret
Function at 0x421350
Capabilities:
Terminate process

Disassembly:
movzx eax, word [0x46dbc0]
push dword [0x456fb0]
imul eax, eax, 0xcd105680
mov word [0x46dbc0], ax
call fcn.00409d00
mov eax, dword [0x45f014]
add esp, 4
not eax
add eax, 0x7f68a2b3
and eax, 0xad922dd3
xor dword [0x457f68], eax
push 1
call fcn.0042dda0
int3
Function at 0x4352a5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456580]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0042f27f
mov dword [ebp - 0x14], eax
cmp dword [0x46fc1c], esi
jne 0x435398
push 0x800
push esi
push 0x44c248
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x435325
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x435478
push esi
push esi
push 0x44c248
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x435478
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x435478
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x46fc1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x46fc20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x46fc24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46fc2c], eax
test eax, eax
je 0x435395
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46fc28], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4353bd
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4353b0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4353d2
push 4
pop eax
jmp 0x43547a
cmp dword [ebp - 0x14], esi
je 0x4353d2
push dword [0x46fc1c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4353b7
mov eax, dword [0x46fc28]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x435430
cmp dword [0x46fc2c], edi
je 0x435430
push eax
call ebx
push dword [0x46fc2c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x435430
test eax, eax
je 0x435430
call ecx
test eax, eax
je 0x435425
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x435425
test byte [ebp - 8], 1
jne 0x435430
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x435460
mov eax, dword [0x46fc20]
cmp eax, edi
je 0x43545d
push eax
call ebx
test eax, eax
je 0x43545d
call eax
mov esi, eax
test esi, esi
je 0x43545d
mov eax, dword [0x46fc24]
cmp eax, edi
je 0x43545d
push eax
call ebx
test eax, eax
je 0x43545d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x46fc1c]
call ebx
test eax, eax
je 0x435478
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43547a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004350f7
mov esp, ebp
pop ebp
ret
Function at 0x100057d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10234570]
jne 0x100057da
repz ret
jmp fcn.10008bdc

Function at 0x1000b67b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10003a10
and dword [ebp - 4], 0
cmp dword [0x10235fb0], 0
mov ebx, eax
jne 0x1000b72c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000b7dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000b7dd
push eax
call fcn.1000399e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10235fb0], eax
call esi
push eax
call fcn.1000399e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10235fb4], eax
call esi
push eax
call fcn.1000399e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10235fb8], eax
call esi
push eax
call fcn.1000399e
pop ecx
mov dword [0x10235fc0], eax
test eax, eax
je 0x1000b72c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000399e
pop ecx
mov dword [0x10235fbc], eax
mov eax, dword [0x10235fbc]
cmp eax, ebx
je 0x1000b784
cmp dword [0x10235fc0], ebx
je 0x1000b784
push eax
call fcn.10003a19
push dword [0x10235fc0]
mov esi, eax
call fcn.10003a19
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000b784
test edi, edi
je 0x1000b784
call esi
test eax, eax
je 0x1000b77b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000b77b
test byte [ebp - 0xc], 1
jne 0x1000b784
or dword [ebp + 0x10], 0x200000
jmp 0x1000b7bd
mov eax, dword [0x10235fb4]
cmp eax, ebx
je 0x1000b7bd
push eax
call fcn.10003a19
pop ecx
test eax, eax
je 0x1000b7bd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000b7bd
mov eax, dword [0x10235fb8]
cmp eax, ebx
je 0x1000b7bd
push eax
call fcn.10003a19
pop ecx
test eax, eax
je 0x1000b7bd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10235fb0]
call fcn.10003a19
pop ecx
test eax, eax
je 0x1000b7dd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000b7df
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret