joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5234d0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0xc
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x523515
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [esp + 0x18]
call fcn.004f0df0
add esp, 4
push 0
push eax
push dword [esp + 0x1c]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp], 0x10
jne 0x52356c
push 0
lea eax, [esp + 4]
push eax
push dword [esp + 0x18]
push 2
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 8]
test eax, eax
je 0x52357b
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp + 4]
test eax, eax
je 0x52358c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
add esp, 0xc
ret

Function at 0x5235e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x5df8b0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x523607
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x523652
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x523656
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x5236b6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x523675
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x5236e7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push str.6__I
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x5bf8af
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x5236c0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x52523e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x555a4f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005558ce

Function at 0x55a8b3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0055a573
Function at 0x40ce09
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422234]
jne 0x40ce13
repz ret
jmp fcn.00413639

Function at 0x413b7e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004104e0
and dword [ebp - 4], 0
cmp dword [0x423e1c], 0
mov ebx, eax
jne 0x413c2f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413ce0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413ce0
push eax
call fcn.0041046e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423e1c], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423e20], eax
call esi
push eax
call fcn.0041046e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423e24], eax
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e2c], eax
test eax, eax
je 0x413c2f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041046e
pop ecx
mov dword [0x423e28], eax
mov eax, dword [0x423e28]
cmp eax, ebx
je 0x413c87
cmp dword [0x423e2c], ebx
je 0x413c87
push eax
call fcn.004104e9
push dword [0x423e2c]
mov esi, eax
call fcn.004104e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413c87
test edi, edi
je 0x413c87
call esi
test eax, eax
je 0x413c7e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413c7e
test byte [ebp - 0xc], 1
jne 0x413c87
or dword [ebp + 0x10], 0x200000
jmp 0x413cc0
mov eax, dword [0x423e20]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413cc0
mov eax, dword [0x423e24]
cmp eax, ebx
je 0x413cc0
push eax
call fcn.004104e9
pop ecx
test eax, eax
je 0x413cc0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423e1c]
call fcn.004104e9
pop ecx
test eax, eax
je 0x413ce0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413ce2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401f60
Capabilities:
Authenticate hmac
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub eax, 0x46
or edx, 0x4b
ror esi, 0x24
mov eax, 6
add ebx, 0x96
bswap esi
bswap esi
and esi, 0xc5
not eax
inc esi
imul edx
or ebx, 0x32
imul eax
rcr esi, 3
imul edi
not ebx
rcl eax, 3
sub edi, 0x6f
ror edx, 0xcf
dec eax
and edi, 0x79
sub ebx, 0xb5
dec edx
dec eax
rcr esi, 0xa2
add esi, 0xaa
not ebx
neg edi
rcl esi, 0xa9
rcl edi, 0xab
rcr edi, 0x14
rcl ebx, 0x36
rcl edx, 0x69
bswap edx
bswap eax
rcr ebx, 0x1c
not esi
rcl edi, 0x78
not ebx
neg edi
dec esi
and edx, 0xa1
bswap edi
or esi, 0x69
rcr ebx, 0xf3
rol ebx, 0x7f
rcr edi, 1
rcr edx, 0x92
imul ebx
bswap edx
xor ecx, ecx
xor edi, edi
inc eax
not esi
sub esi, 0x9d
sbb esi, 0x2c
imul edi
bswap ebx
sbb esi, 0x34
dec ebx
sub edx, 0xd8
not eax
dec esi
or ebx, 0xc
dec eax
imul esi
rol edi, 0xde
or eax, 0xad
and ebx, 0x8d
rol edi, 0xff
bswap edi
ror edx, 0x4a
dec eax
neg esi
rol eax, 0xed
dec edi
ror esi, 0x81
inc eax
rcr edx, 0xdc
inc eax
bswap eax
rol ebx, 0x3d
inc esi
sbb esi, 0x46
not eax
and edx, 0x27
neg edi
neg edx
sub ebx, 0x8a
imul esi
rcl eax, 0x16
rol edi, 5
not ebx
add edx, 0x5c
rol ebx, 0x9c
rcl esi, 0xb6
or ebx, 3
dec ebx
or ebx, 0x16
rcr edx, 0x6b
mov edx, 0xe3
bswap esi
mov ecx, dword [ebp + 0xc]
neg edx
neg ebx
and esi, 0x96
rol esi, 0x3f
mov edi, 0xd0
inc edi
not edi
inc ebx
or esi, 0xdb
rcl ebx, 0xb2
inc esi
inc eax
neg eax
sbb ebx, 0xb1
imul esi
or eax, 0xa1
rcr eax, 0xcf
neg edx
imul edi
dec esi
rcr ebx, 0x84
inc eax
rcr ebx, 0xaa
rcr eax, 0x74
sbb edx, 0x53
and edx, 0xbc
not esi
ror edx, 0x1f
not edx
or edx, 3
add edi, 0x69
rcl edi, 0x36
inc ebx
or edi, 0x67
bswap ebx
rcl ebx, 3
or ebx, 0x53
dec ebx
inc edi
neg edi
ror esi, 0xb2
sub edx, 0xc4
imul eax
dec ebx
sub edi, 0x13
sbb edx, 0xc6
neg edx
rcl eax, 0x36
rol edx, 0xd0
neg ebx
mov edi, dword [ebp + 8]
xor eax, eax
xor esi, esi
xor eax, ebx
not byte [edi]
mov eax, esi
xor eax, ebx
mov eax, esi
xor esi, eax
mov esi, esi
mov esi, esi
mov esi, esi
mov ebx, eax
xor eax, eax
add byte [edi], 0x87
mov esi, ebx
mov eax, ebx
mov esi, esi
xor ebx, esi
xor ebx, ebx
mov ebx, eax
xor esi, eax
xor esi, eax
mov eax, esi
sub byte [edi], 0x54
mov eax, eax
xor eax, eax
mov esi, esi
mov esi, ebx
xor eax, ebx
xor eax, ebx
xor esi, ebx
mov esi, ebx
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40210f
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x405084
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44d294]
jne 0x40508e
repz ret
jmp fcn.00409a65
Function at 0x40b26d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040802f
and dword [ebp - 4], 0
cmp dword [0x44e814], 0
mov ebx, eax
jne 0x40b31e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b3cf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b3cf
push eax
call fcn.00407fbd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44e814], eax
call esi
push eax
call fcn.00407fbd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44e818], eax
call esi
push eax
call fcn.00407fbd
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44e81c], eax
call esi
push eax
call fcn.00407fbd
pop ecx
mov dword [0x44e824], eax
test eax, eax
je 0x40b31e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407fbd
pop ecx
mov dword [0x44e820], eax
mov eax, dword [0x44e820]
cmp eax, ebx
je 0x40b376
cmp dword [0x44e824], ebx
je 0x40b376
push eax
call fcn.00408038
push dword [0x44e824]
mov esi, eax
call fcn.00408038
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b376
test edi, edi
je 0x40b376
call esi
test eax, eax
je 0x40b36d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b36d
test byte [ebp - 0xc], 1
jne 0x40b376
or dword [ebp + 0x10], 0x200000
jmp 0x40b3af
mov eax, dword [0x44e818]
cmp eax, ebx
je 0x40b3af
push eax
call fcn.00408038
pop ecx
test eax, eax
je 0x40b3af
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b3af
mov eax, dword [0x44e81c]
cmp eax, ebx
je 0x40b3af
push eax
call fcn.00408038
pop ecx
test eax, eax
je 0x40b3af
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44e814]
call fcn.00408038
pop ecx
test eax, eax
je 0x40b3cf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b3d1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4020b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x28], str.wbwtbudolhkxo
lea ecx, [ebp - 0x5c]
call fcn.00402310
lea ecx, [ebp - 0x44]
call fcn.00402310
lea ecx, [ebp - 0x74]
call fcn.00402310
push 0x2faf080
call fcn.00405920
add esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x402131
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
jmp 0x4022e5
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ebp - 0xc]
add edx, 0x2faf080
mov ecx, dword [ebp - 0xc]
call fcn.00404a80
mov dword [ebp - 8], 0
jmp 0x40215f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x16ff
jae 0x4021b1
mov ecx, dword [ebp - 8]
mov dl, byte [ecx + 0x426800]
mov byte [ebp - 1], dl
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [ebp - 2], cl
movzx edx, byte [ebp - 1]
sar edx, 3
movzx eax, byte [ebp - 1]
shl eax, 5
or edx, eax
movzx ecx, byte [ebp - 2]
xor edx, ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x426800], dl
mov eax, dword [ebp - 0x10]
add eax, 1
cdq
mov ecx, 0xd
idiv ecx
mov dword [ebp - 0x10], edx
jmp 0x402156
push 0x40
push 0x3000
push 0x16ff
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x18], eax
push 0x16ff
push 0x426800
mov edx, dword [ebp - 0x18]
push edx
call fcn.00407440
add esp, 0xc
mov eax, dword [ebp - 0x18]
jmp eax
lea ecx, [ebp - 0x74]
call fcn.00402330
lea ecx, [ebp - 0x44]
call fcn.00402330
lea ecx, [ebp - 0x5c]
call fcn.00402330
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
cmp ecx, 0xffffffff
jne 0x402e11
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x20]
mov edx, dword [eax]
test edx, edx
je 0x402e43
mov esi, dword [ebx + 0x30]
mov edi, dword [esi]
lea eax, [edi + edx]
cmp edx, eax
jae 0x402e43
lea eax, [edi - 1]
mov dword [esi], eax
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x50], 0
jne 0x402e55
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [ebx + 0xc]
lea eax, [ebx + 0x44]
cmp dword [edx], eax
jne 0x402e76
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov dword [edx], eax
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
sub ecx, ecx
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
cmp dword [ebx + 0x40], 0
jne 0x402e9f
push dword [ebx + 0x50]
movsx eax, cl
push eax
call fcn.00405c27
or ecx, 0xffffffff
add esp, 8
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [esp + 0xf], cl
mov ecx, 0xf
mov byte [esp + 0x18], 0
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
lea eax, [esp + 0x18]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], 8
mov byte [eax + 8], 0
cmp dword [esp + 0x2c], 0x10
mov esi, dword [ebx + 0x40]
lea eax, [esp + 0x10]
mov edi, dword [esi]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x1c]
cmovae ecx, dword [esp + 0x1c]
lea edx, [esp + 0x1c]
cmovae edx, dword [esp + 0x1c]
add eax, ecx
push eax
push edx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [ebx + 0x48]
push eax
mov ecx, esi
call dword [edi + 0x1c]
test eax, eax
js 0x402fad
cmp eax, 1
jg 0x402f8a
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
cmp edi, 0x10
lea eax, [esp + 0x18]
cmovae eax, ecx
sub esi, eax
je 0x402f57
push dword [ebx + 0x50]
lea eax, [esp + 0x1c]
push esi
cmp edi, 0x10
cmovae eax, ecx
push 1
push eax
call fcn.004070be
add esp, 0x10
cmp esi, eax
jne 0x402fad
lea eax, [esp + 0xf]
mov byte [ebx + 0x45], 1
cmp dword [esp + 0x14], eax
jne 0x402f85
test esi, esi
jne 0x402ed2
cmp dword [esp + 0x28], 0x20
jae 0x402fad
push esi
push 8
lea ecx, [esp + 0x20]
call fcn.004039d0
jmp 0x402ed2
mov ebx, dword [ebp + 8]
jmp 0x402fb0
cmp eax, 3
jne 0x402fad
movsx eax, byte [esp + 0xf]
push dword [ebx + 0x50]
push eax
call fcn.00405c27
or ecx, 0xffffffff
add esp, 8
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
mov ebx, ecx
jmp 0x402fb0
or ebx, 0xffffffff
cmp dword [esp + 0x2c], 0x10
jb 0x402fc3
push dword [esp + 0x18]
call fcn.00406ee3
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4041c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
cmp dword [ebx + 0x40], 0
push edi
je 0x4042e9
cmp byte [ebx + 0x45], 0
je 0x4042e9
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x4041f7
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [esp + 0x10], 0
xorps xmm0, xmm0
movq qword [esp + 0x10], xmm0
lea eax, [esp + 0x10]
cmp ecx, 0x10
cmovae eax, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], 8
mov byte [eax + 8], 0
jmp 0x404230
cmp dword [esp + 0x24], 0x10
mov ecx, dword [ebx + 0x40]
lea eax, [esp + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x24]
lea edi, [esp + 0x14]
cmovae edi, dword [esp + 0x14]
lea esi, [esp + 0x14]
cmovae esi, dword [esp + 0x14]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x404271
dec eax
je 0x404275
sub eax, 2
je 0x4042cb
xor bl, bl
jmp 0x4042cd
mov byte [ebx + 0x45], 0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
cmp ecx, 0x10
lea eax, [esp + 0x10]
cmovae eax, edx
sub esi, eax
je 0x4042ac
push dword [ebx + 0x50]
cmp ecx, 0x10
push esi
lea eax, [esp + 0x18]
cmovae eax, edx
push 1
push eax
call fcn.004070be
add esp, 0x10
cmp esi, eax
jne 0x40426d
cmp byte [ebx + 0x45], 0
je 0x4042cb
test esi, esi
jne 0x404230
push esi
push 8
lea ecx, [esp + 0x18]
call fcn.004039d0
jmp 0x404230
mov bl, 1
cmp dword [esp + 0x24], 0x10
jb 0x4042e0
push dword [esp + 0x10]
call fcn.00406ee3
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41499e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4256ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00409fca
mov dword [ebp - 0x14], eax
cmp dword [0x4293e8], edi
jne 0x414a8f
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x414a1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x414b6f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x414b6f
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x414b6f
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4293e8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4293ec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4293f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4293f8], eax
test eax, eax
je 0x414a8c
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4293f4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x414ab4
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x414aa7
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x414ac9
push 4
pop eax
jmp 0x414b71
cmp dword [ebp - 0x14], edi
je 0x414ac9
push dword [0x4293e8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x414aae
mov eax, dword [0x4293f4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x414b27
cmp dword [0x4293f8], esi
je 0x414b27
push eax
call ebx
push dword [0x4293f8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x414b27
test eax, eax
je 0x414b27
call ecx
test eax, eax
je 0x414b1c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x414b1c
test byte [ebp - 8], 1
jne 0x414b27
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x414b57
mov eax, dword [0x4293ec]
cmp eax, esi
je 0x414b54
push eax
call ebx
test eax, eax
je 0x414b54
call eax
mov edi, eax
test edi, edi
je 0x414b54
mov eax, dword [0x4293f0]
cmp eax, esi
je 0x414b54
push eax
call ebx
test eax, eax
je 0x414b54
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4293e8]
call ebx
test eax, eax
je 0x414b6f
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x414b71
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407b1b
leave
ret
Function at 0x416f6f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0040e8d0
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x416fa7
xor eax, eax
jmp 0x416fd3
cmp esi, dword [ebp - 4]
je 0x416fd0
cmp dword [ebp + 0xc], 0
je 0x416fd0
push dword [edi + 0x9c]
call fcn.00416b7d
push dword [edi + 0x9c]
mov esi, eax
call fcn.0040a308
pop ecx
pop ecx
cmp esi, eax
je 0x416fa3
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x10001bff
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c5fd
call fcn.1002b257
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
xor ebx, ebx
mov ecx, edi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
call fcn.10002b1a
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x30], 1
mov dword [ebp - 4], ebx
cmp byte [0x1003ce0b], bl
jne 0x10001c54
cmp byte [0x1003ce0a], bl
je 0x10001c90
cmp dword [edi + 0x14], 0x10
jb 0x10001c5c
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__reference_
mov edi, 0x1003c820
push edi
call fcn.10021234
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10001c80
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10001c90
push edi
call fcn.10005ee0
pop ecx
push esi
call fcn.10021234
pop ecx
mov eax, esi
call fcn.1002b220
ret 8

Function at 0x10001ca1
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c5fd
call fcn.1002b257
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.10002814
pop ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], ecx
mov byte [esi + 0x30], cl
mov dword [ebp - 4], ecx
cmp byte [0x1003ce0b], cl
jne 0x10001cec
cmp byte [0x1003ce0a], cl
je 0x10001d29
cmp dword [edi + 0x14], 0x10
jb 0x10001cf4
mov edi, dword [edi]
push eax
push edi
push str.CMemMappedFile__s__ctor__new_with_size_lu_
mov edi, 0x1003c820
push edi
call fcn.10021234
add esp, 0x10
cmp byte [0x1003ce0a], 0
je 0x10001d19
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10001d29
push edi
call fcn.10005ee0
pop ecx
mov ecx, esi
call fcn.100033f0
mov eax, esi
call fcn.1002b220
ret 4

Function at 0x10001d3a
Capabilities:
Print debug messages

Disassembly:
push 4
mov eax, 0x1002c5fd
call fcn.1002b257
mov esi, ecx
mov dword [ebp - 0x10], esi
lea edi, [esi + 4]
mov dword [esi], vtable.CMemMappedFile.0
push edi
call fcn.10002814
pop ecx
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov dword [ebp - 4], eax
cmp byte [0x1003ce0b], al
jne 0x10001d82
cmp byte [0x1003ce0a], al
je 0x10001dbe
cmp dword [edi + 0x14], 0x10
jb 0x10001d8a
mov edi, dword [edi]
push edi
push str.CMemMappedFile__s__ctor__new_
mov edi, 0x1003c820
push edi
call fcn.10021234
add esp, 0xc
cmp byte [0x1003ce0a], 0
je 0x10001dae
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003ce0b], 0
je 0x10001dbe
push edi
call fcn.10005ee0
pop ecx
mov eax, esi
call fcn.1002b220
ret