joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422d90
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e38
call fcn.00437750
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
push 0xa
mov ecx, dword [ebp + 0xc]
add ecx, 0xf
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004360a0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
call fcn.00405550
add esp, 4
cmp eax, 1
jne 0x422f45
lea ecx, [ebp - 0x10]
push ecx
call fcn.00405480
add esp, 4
cmp eax, 1
jne 0x422f45
mov edx, dword [ebp + 0xc]
add edx, 0xf
push edx
mov eax, dword [ebp + 8]
add eax, 0xf030
push eax
push str.SELECT_Name_FROM__s.dbo.OfficialHelper_WHERE_Name___s
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
push ecx
call fcn.00407950
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
movsx edx, ax
cmp edx, 0x64
je 0x422e40
cmp dword [ebp - 0x14], 0
jne 0x422ee6
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov eax, dword [ebp + 0xc]
add eax, 0xf
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xf030
push ecx
push str.INSERT_INTO__s.dbo.OfficialHelper__Name__VALUES___s_
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xf030
push ecx
push str.UPDATE__s.dbo.OfficialHelper_SET_Data__WHERE_Name_s
lea edx, [ebp - 0x2728]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x101
mov eax, dword [ebp + 0xc]
add eax, 0x1c
push eax
lea ecx, [ebp - 0x2728]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.004080c0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
jmp 0x422f37
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, 0xf030
push eax
push str.UPDATE__s.dbo.OfficialHelper_SET_Data__WHERE_Name_s
lea ecx, [ebp - 0x4e38]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x101
mov edx, dword [ebp + 0xc]
add edx, 0x1c
push edx
lea eax, [ebp - 0x4e38]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.004080c0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret

Function at 0x423900
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x423950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4ca0cc], eax
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x423b10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4ca0c8], eax
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4314c0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov word [ebp - 0xb], ax
push 0xa
mov ecx, dword [ebp + 0x10]
add ecx, 0xe
push ecx
lea edx, [ebp - 0x14]
push edx
call fcn.004360a0
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
call fcn.00405550
add esp, 4
cmp eax, 1
jne 0x431654
lea ecx, [ebp - 0x14]
push ecx
call fcn.00405480
add esp, 4
cmp eax, 1
jne 0x431654
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xe
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xf030
push ecx
push str.SELECT_Name_Seconds_FROM__s.dbo.Race_Data_WHERE_Name___s_and_AccountID__s
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0x14
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
cwde
cmp eax, 0x64
je 0x431572
cmp dword [ebp - 0x18], 0
jne 0x4315d3
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xe
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 3
push ecx
mov edx, dword [ebp + 8]
add edx, 0xf030
push edx
push str.INSERT_INTO__s.dbo.Race_Data__AccountID__Name__Seconds__VALUES___s__s__d_
mov eax, dword [ebp + 8]
add eax, 0x7dc0
push eax
call fcn.00407950
add esp, 0x18
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
jmp 0x4315e9
push str.Seconds
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407cf0
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x1c]
jle 0x431654
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 0xe
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xf030
push ecx
push str.UPDATE__s.dbo.Race_Data_SET_Seconds_d_WHERE_Name_s_and_AccountID_s
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0x18
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret
Function at 0x433660
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
push 0xa
mov ecx, dword [ebp + 0x10]
add ecx, 8
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004360a0
add esp, 0xc
mov byte [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
push 0x1c
push 0xab
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00405400
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0x18], edx
push 0xa
mov eax, dword [ebp + 0x10]
add eax, 8
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004360a0
add esp, 0xc
lea edx, [ebp - 0x24]
push edx
call fcn.00405550
add esp, 4
cmp eax, 1
jne 0x4337d4
lea eax, [ebp - 0x24]
push eax
call fcn.00405480
add esp, 4
cmp eax, 1
jne 0x4337d4
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xf030
push edx
push str.SELECT_Name_FROM__s.dbo.BotPet_WHERE_Name_s
mov eax, dword [ebp + 8]
add eax, 0x7dc0
push eax
call fcn.00407950
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
movsx ecx, ax
cmp ecx, 0x64
je 0x43375f
cmp dword [ebp - 0x30], 0
jne 0x4337b4
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
add eax, 0xf030
push eax
push str.SELECT_Name_FROM__s.dbo.Character_WHERE_Name_s
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
push ecx
call fcn.00407950
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
movsx edx, ax
cmp edx, 0x64
je 0x4337b0
cmp dword [ebp - 0x30], 0
jne 0x4337b4
mov byte [ebp - 0x14], 1
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
push 0x1c
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00406820
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret
Function at 0x4337f0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x2c], 0
xor eax, eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
push 0xd
push 0xc3
lea ecx, [ebp - 0x2c]
push ecx
call fcn.00405400
add esp, 0xc
mov byte [ebp - 0x10], 0
xor edx, edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
mov byte [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov word [ebp - 0x13], ax
push 9
mov ecx, dword [ebp + 0x10]
add ecx, 3
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.004360a0
add esp, 0xc
push 9
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
lea ecx, [ebp - 0x29]
push ecx
call fcn.004360a0
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
call fcn.00405550
add esp, 4
cmp eax, 1
jne 0x4339ee
lea eax, [ebp - 0x10]
push eax
call fcn.00405480
add esp, 4
cmp eax, 1
jne 0x4339ee
mov ecx, dword [ebp + 0x10]
add ecx, 3
push ecx
mov edx, dword [ebp + 8]
add edx, 0xf030
push edx
push str.SELECT_SCFG_Gens_G_Master_FROM__s.dbo.Guild_WHERE_G_Name___s
mov eax, dword [ebp + 8]
add eax, 0x7dc0
push eax
call fcn.00407950
add esp, 0x10
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
movsx ecx, ax
cmp ecx, 0x64
je 0x4339ce
push str.SCFG_Gens
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407cf0
mov byte [ebp - 0x20], al
lea edx, [ebp - 0x1c]
push edx
push str.G_Master
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407ca0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xf030
push ecx
push str.SELECT_SCFGensFamily_FROM__s.dbo.Character_WHERE_Name___s
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
cwde
cmp eax, 0x64
je 0x433954
cmp dword [ebp - 0x30], 0
jne 0x433956
jmp 0x4339c0
push str.SCFGensFamily
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407cf0
mov dword [ebp - 0x34], eax
movzx ecx, byte [ebp - 0x20]
cmp dword [ebp - 0x34], ecx
je 0x4339c0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov dl, byte [ebp - 0x34]
mov byte [ebp - 0x20], dl
lea eax, [ebp - 0x1c]
push eax
movzx ecx, byte [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
add edx, 0xf030
push edx
push str.UPDATE__s.dbo.Guild_SET_SCFG_Gens_d_WHERE_G_Master___s
mov eax, dword [ebp + 8]
add eax, 0x7dc0
push eax
call fcn.00407950
add esp, 0x14
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
push 0xd
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.00406820
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret
Function at 0x433cd0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 0x10]
push eax
call fcn.0042b750
add esp, 4
lea ecx, [ebp - 0x10]
push ecx
call fcn.00433dd0
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 1
jne 0x433dc3
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 0
jne 0x433dc3
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
jne 0x433dc3
mov edx, dword [ebp + 8]
add edx, 0xf062
push edx
push str.INSERT__s.dbo.LuckyCoinsRank__Account_LuckyCoins_Date__SELECT_TOP_5_memb___id__SCFLuckyCoins_getdate___FROM_MEMB_INFO_WHERE_SCFLuckyCoins___0_ORDER_BY_SCFLuckyCoins_Desc
mov eax, dword [ebp + 8]
add eax, 0x7dc0
push eax
call fcn.00407950
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov ecx, dword [ebp + 8]
add ecx, 0xf062
push ecx
push str.UPDATE__s.dbo.MEMB_INFO_SET_SCFLuckyCoins0
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
mov byte [ebp - 0x14], 0
xor eax, eax
mov word [ebp - 0x13], ax
mov byte [ebp - 0x11], al
push 4
push 0xd1
lea ecx, [ebp - 0x14]
push ecx
call fcn.00405400
add esp, 0xc
mov byte [ebp - 0x11], 1
push 4
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.004067c0
mov esp, ebp
pop ebp
ret
Function at 0x434560
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x29d4
call fcn.00437750
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x180], 0
push 0x15b
push 0
lea eax, [ebp - 0x17f]
push eax
call fcn.00435470
add esp, 0xc
push 0x15c
push 0xdb
lea ecx, [ebp - 0x180]
push ecx
call fcn.00405450
add esp, 0xc
push 0xa
mov edx, dword [ebp + 0x10]
add edx, 3
push edx
lea eax, [ebp - 0x17c]
push eax
call fcn.004360a0
add esp, 0xc
push 0xa
mov ecx, dword [ebp + 0x10]
add ecx, 0xe
push ecx
lea edx, [ebp - 0x171]
push edx
call fcn.004360a0
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov cx, word [eax + 0x1a]
mov word [ebp - 0x166], cx
mov byte [ebp - 0x10], 0
xor edx, edx
mov dword [ebp - 0xf], edx
mov dword [ebp - 0xb], edx
mov word [ebp - 7], dx
push 0xa
mov eax, dword [ebp + 0x10]
add eax, 0xe
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.004360a0
add esp, 0xc
mov byte [ebp - 0x1c], 0
xor edx, edx
mov dword [ebp - 0x1b], edx
mov dword [ebp - 0x17], edx
mov word [ebp - 0x13], dx
push 0xa
mov eax, dword [ebp + 0x10]
add eax, 3
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.004360a0
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
call fcn.00405550
add esp, 4
cmp eax, 1
jne 0x43478d
lea eax, [ebp - 0x10]
push eax
call fcn.00405480
add esp, 4
cmp eax, 1
jne 0x43478d
mov byte [ebp - 0x2c0], 0
push 0x13f
push 0
lea ecx, [ebp - 0x2bf]
push ecx
call fcn.00435470
add esp, 0xc
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xf030
push ecx
push str.SELECT_Name_FROM__s.dbo.Character_WHERE_Name___s_and_AccountID___s
mov edx, dword [ebp + 8]
add edx, 0x7dc0
push edx
call fcn.00407950
add esp, 0x14
mov dword [ebp - 0x29d4], eax
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407bb0
cwde
cmp eax, 0x64
je 0x4346c8
cmp dword [ebp - 0x29d4], 0
jne 0x4346e0
push 0x140
push 0
lea ecx, [ebp - 0x2c0]
push ecx
call fcn.00435470
add esp, 0xc
jmp 0x43474c
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xf030
push ecx
push str.SELECT_SCFMasterSkills_FROM__s.dbo.Character_where_Name___s_and_AccountID___s
lea edx, [ebp - 0x29d0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x29d0]
push ecx
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407f00
cmp eax, 0xffffffff
jne 0x43474c
push 0x140
push 0
lea edx, [ebp - 0x2c0]
push edx
call fcn.00435470
add esp, 0xc
push 0x140
lea eax, [ebp - 0x2c0]
push eax
lea ecx, [ebp - 0x164]
push ecx
call fcn.004360a0
add esp, 0xc
mov ecx, dword [ebp + 8]
add ecx, 0x7dc0
call fcn.00407b60
push 0x15c
lea edx, [ebp - 0x180]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406820
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00435f91
mov esp, ebp
pop ebp
ret
Function at 0x435f91
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x458330]
jne 0x435f9b
repz ret
jmp fcn.0043bf1f

Function at 0x4412cf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x458330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004390b5
and dword [ebp - 0x14], 0
cmp dword [0x75eb1c], 0
mov dword [ebp - 0x18], eax
jne 0x441382
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44142a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x44142a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x75eb1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x75eb20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x75eb24], eax
call edi
push eax
call esi
mov dword [0x75eb2c], eax
test eax, eax
je 0x441382
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x75eb28], eax
mov eax, dword [0x75eb28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4413db
cmp dword [0x75eb2c], ecx
je 0x4413db
push eax
call esi
push dword [0x75eb2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4413db
test ebx, ebx
je 0x4413db
call edi
test eax, eax
je 0x4413d2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4413d2
test byte [ebp - 8], 1
jne 0x4413db
or dword [ebp + 0x10], 0x200000
jmp 0x44140e
mov eax, dword [0x75eb20]
cmp eax, dword [ebp - 0x18]
je 0x44140e
push eax
call esi
test eax, eax
je 0x44140e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x44140e
mov eax, dword [0x75eb24]
cmp eax, dword [ebp - 0x18]
je 0x44140e
push eax
call esi
test eax, eax
je 0x44140e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x75eb1c]
call esi
test eax, eax
je 0x44142a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44142c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00435f91
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x3b423400
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x78d213b8
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]