joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f2088
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x7f2052
pushal
rcl ax, 0xb
jae 0x7f2030
sub esp, 0x12
jmp 0x7f206c
lea esp, [esp + 0x34]
inc dl
lea eax, [esp + eax]
inc ax
jle 0x7f2072
xor al, 0xcd
not eax
jmp 0x7f20be
lea esp, [esp + 2]
jmp 0x7f2052
jmp 0x7f229a
jmp 0x7f2046
lea eax, [esp + eax]
jmp 0x7f2207
add dl, 0xa9
ror ah, cl
jbe 0x7f208a
lea eax, [esp + eax]
mov al, 0x69
rcl ax, 3
lea eax, [ecx - 0x5b]
jmp 0x7f211c
mov eax, 0x8341542a
lea eax, [eax*4]
mov al, byte [esp]
jmp 0x7f22ad
mov al, byte [esp]
add ax, dx
mov eax, dword [esp]
rdtsc
bswap edx
mov edx, ecx
jmp 0x7f2105
inc ebp
lea eax, [ebx + ebx]
not dl
xchg dh, dl
clc
jmp 0x7f20fb
ja 0x7f20d2
mov al, byte [esp]
add ax, dx
jmp 0x7f213a
ror cl, 0
mov eax, edx
ror dh, cl
jle 0x7f2124
jg 0x7f217d
lea eax, reloc.WINMM.dll_midiStreamStop
jmp 0x7f215a
mov dh, 0xae
bswap eax
mov dh, bl
rdtsc
rcl dh, cl
jmp 0x7f21b4
mov eax, dword [esp]
rdtsc
bswap edx
jmp 0x7f20df
lea eax, reloc.WINMM.dll_midiStreamStop
sub bl, dl
setbe dl
mov ax, word [esp]
xchg dh, al
jmp 0x7f20ec
rdtsc
rcl dh, cl
jmp 0x7f21b4
mov dh, 0xae
bswap eax
mov dh, bl
jmp 0x7f2167
ror cl, 0
mov dl, byte [esp]
xchg ah, dl
call fcn.007f219b
mov al, 0x69
rcl ax, 3
lea eax, [ecx - 0x5b]
jmp 0x7f2154
xor al, 0xcd
not eax
mov eax, 0x8341542a
lea eax, [eax*4]
mov al, byte [esp]
mov eax, dword [esp]
jmp 0x7f20a0

Function at 0x8e3066
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
sub esp, 0x1f
btc esi, edx
mov esi, 0x25e5de9b
mov si, 0x6fcc
jmp 0x8ddc63
mov dword [esp + 0x1b], ebx
sub esp, 4
mov dword [esp + 0x19], esi
cmc
lea esi, [esi + ebp]
sub esp, 3
jmp 0x8ddc20
mov dword [esp], esp
pushal
mov word [esp + 0xe], ax
mov dword [esp + 1], ecx
inc si
jmp 0x8ddcb5
push word [esp + 0x1b]
mov dword [esp + 0x34], eax
sub esp, 4
bsf eax, edi
mov ah, bl
xchg esi, eax
jmp 0x8ddc4d
mov byte [esp], dh
lea esp, [esp + 3]
mov byte [esp], cl
lea esp, [esp + 1]
cld
pushal
jmp 0x8ddc39
or cx, 0x8c6b
bsf eax, ecx
mov ch, 0x42
not cx
setp ch
call fcn.008ddc9f
outsb dx, byte [esi]
jmp 0x8ddd48
inc dword [eax + 0x7d400c]
pushfd
push ebp
jmp 0x8ddc8d
stosd dword es:[edi], eax
into
cmp eax, 0xb21c95ef
aad 0x24
retf
push eax
jmp 0x8de0bf
call 0x8de0c4
jmp 0x8decf4
je 0x8ddcd5
lea esp, [esp + 8]
popal
jmp 0x438d1f
pop eax
sub eax, 0x8de0c4
cmp dword [eax + reloc.WINMM.dll_midiStreamStop], 0
jmp 0x8deca3
call 0x8e2019
jmp 0x8e30d5
movzx ebx, word [eax + 0x3c]
jmp 0x8e3104
mov byte [esp + 4], dh
mov byte [esp + 2], ah
jmp 0x8e309c
mov eax, dword fs:[0x30]
jmp 0x8e30c5
lea esp, [esp + 2]
mov dword [esp], esi
push sp
mov byte [esp], ch
lea esp, [esp + 2]
push edi
jmp 0x8e3086
mov eax, dword [eax + 8]
jmp 0x8e30cf
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
jmp 0x8e30af
push eax
jmp 0x8e2014
pop eax
xor ax, ax
cmp word [eax], 0x5a4d
jmp 0x8e3111
add ebx, eax
cmp word [ebx], 0x4550
jmp 0x8e3167
je 0x8e208c
sub eax, 0x10000
jmp 0x8e30d9
je 0x8ddd53
jne 0x8e3117
ror byte [esi - 0x24], 1
mov ebx, 0xe35fd156
jae 0x8e318f
in eax, 0x37
cmpsd dword [esi], dword es:[edi]
and al, 0xba
invalid
invalid
Function at 0x414470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [0x445080]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0x19104d0b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
sub eax, 0xc93dc786
je 0x4145e3
jmp 0x4144a8
mov eax, dword [ebp - 0x1c]
sub eax, 0xf7bad593
je 0x41450b
jmp 0x4144bb
mov eax, dword [ebp - 0x1c]
sub eax, 0x19104d0b
je 0x4144f9
jmp 0x4144ce
mov eax, dword [ebp - 0x1c]
sub eax, 0x28653d5d
je 0x414559
jmp 0x4144e1
mov eax, dword [ebp - 0x1c]
sub eax, 0x78aa4675
je 0x4145d2
jmp 0x4144f4
jmp 0x414615
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0xf7bad593
jmp 0x414615
mov eax, dword [0x44658c]
mov ecx, dword [0x446588]
mov edx, eax
sub edx, 0x7879b222
sub edx, 1
add edx, 0x7879b222
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc93dc786
mov ecx, 0x28653d5d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x414615
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
not byte [edi]
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
add byte [edi], 0x86
sub byte [edi], 0x37
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
imul byte [edi]
inc edi
loop 0x414567
mov eax, dword [0x44658c]
mov ecx, dword [0x446588]
mov edx, eax
add edx, 0x5aa7a7bb
sub edx, 1
sub edx, 0x5aa7a7bb
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xc93dc786
mov ecx, 0x78aa4675
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x14], eax
jmp 0x414615
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0042d620
add esp, 0x14
pop edi
pop ebx
pop ebp
ret
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
not byte [edi]
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
add byte [edi], 0x86
sub byte [edi], 0x37
push ebx
pop ebx
nop
mov ebx, eax
xor ebx, 0x39
imul byte [edi]
inc edi
loop 0x4145f1
mov dword [ebp - 0x14], 0x28653d5d
jmp 0x414492
Function at 0x414620
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0xed4e96f5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
sub eax, 0xba978428
je 0x414761
jmp 0x41464f
mov eax, dword [ebp - 0x24]
sub eax, 0xc75f7a06
je 0x414783
jmp 0x414662
mov eax, dword [ebp - 0x24]
sub eax, 0xe9f833e9
je 0x4146ed
jmp 0x414675
mov eax, dword [ebp - 0x24]
sub eax, 0xed4e96f5
je 0x4146b3
jmp 0x414688
mov eax, dword [ebp - 0x24]
sub eax, 0x1b33c60d
je 0x414708
jmp 0x41469b
mov eax, dword [ebp - 0x24]
sub eax, 0x540f6ab6
je 0x41478f
jmp 0x4146ae
jmp 0x414797
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov edx, 0xffffffff
xor edx, 2
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0
sete al
and al, 1
mov byte [ebp - 0x11], al
mov dword [ebp - 0x20], 0xe9f833e9
jmp 0x414797
mov dl, byte [ebp - 0x11]
mov eax, 0x540f6ab6
mov ecx, 0x1b33c60d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x20], eax
jmp 0x414797
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
xor eax, 0xffffffff
mov dword [ebp - 0x28], eax
mov esi, 0xffffffff
xor esi, 2
mov edx, 0xffffffff
xor edx, 0x768eff6f
and eax, 0x768eff6f
and ecx, edx
mov edi, esi
and edi, 0x768eff6f
mov ebx, edx
and ebx, 2
or eax, ecx
mov ecx, dword [ebp - 0x28]
or edi, ebx
xor eax, edi
or ecx, esi
xor ecx, 0xffffffff
or edx, 0x768eff6f
and ecx, edx
or eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xba978428
jmp 0x414797
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
sub esp, 8
mov dword [ebp - 0x20], 0xc75f7a06
jmp 0x414797
mov dword [ebp - 0x20], 0x540f6ab6
jmp 0x414797
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x414639
Function at 0x42df18
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42df57
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42df57
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42df57
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42df57
cmp dword [ecx + 0x74], 0xe
jbe 0x42df57
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4356bb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x435758
push ebx
push esi
call fcn.00435684
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00435618
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x435705
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x435757
push edi
push eax
call fcn.00434150
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x435725
call fcn.0043419e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x435756
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00435618
add esp, 0x20
test eax, eax
jne 0x435744
push edi
call fcn.0043419e
jmp 0x43574c
push ebx
call fcn.0043419e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x436967
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x43fff0
push 0x43ffe8
push str.FlsAlloc
push 0x1f
call fcn.00436826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43699b
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d144]
call esi
jmp 0x4369a1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4369e5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x440000
push 0x43fff8
push str.FlsGetValue
push 0x21
call fcn.00436826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436a1c
push dword [ebp + 8]
mov ecx, esi
call dword [0x43d144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x436a24
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x440008
push 0x440000
push str.FlsSetValue
push 0x22
call fcn.00436826
mov esi, eax
add esp, 0x10
test esi, esi
je 0x436a5e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x43d144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x43bd30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43bd5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43bd5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100b691a
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x100b6931
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]

Function at 0x100d69e9
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x100b83ed
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x100b8407
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x100b83f6
pop esi
jmp 0x100b8412
ret 4
setbe bl
mov bh, 0xc4
mov si, 0xad42
not bx
bswap ebx
push ecx
jmp 0x100d69f3
push esi
mov esi, ebx
bswap esi
mov esi, edi
push ebx
jmp 0x100d69d3
xchg cx, bx
mov ebx, dword [esp]
lea esi, [esi*4]
push bx
lea ecx, [ecx*4]
jmp 0x100d6a2a
mov ebx, dword [esp]
mov ebx, 0xc326db9a
not bh
mov ebx, dword [esp]
jmp 0x100d6d3f
mov cl, 0x83
lea esp, [esp + 1]
mov cl, byte [esp]
lea ebx, [eax*4]
lea esp, [esp + 1]
pop ecx
jmp 0x100d6a14
not esi
mov si, 0xb0b8
not si
pop esi
push ebx
lea esp, [esp + 4]
jmp 0x100b83e0
mov si, word [esp]
bswap ebx
mov si, word [esp]
pop ebx
bswap esi
mov si, 0xe46a
jmp 0x100d6bc1

Function at 0x1010549c
Capabilities:
Encrypt data using aes

Disassembly:
inc dx
inc edi
jmp 0x101054cf
mov edx, dword [eax + 0xc]
cmp edi, esi
mov di, bx
jmp 0x101054b9

Function at 0x101055c3
Capabilities:
Encrypt data using aes

Disassembly:
shr edi, 0x18
jmp 0x101055eb
sub esp, 6
mov byte [esp + 6], ah
mov word [esp + 4], ax
lea esp, [esp + 2]
jmp 0x101055ad
xor ecx, edi
neg di
jmp 0x10105626
movzx edi, byte [edi*4 + 0x100c0f44]
jmp 0x101055d5
lea edx, [edx*4]
jmp 0x10105647
and edx, ebp
xor ecx, edx
mov edx, dword [esp]
mov edx, ebx
jmp 0x10105610
xor ecx, dword [eax]
setb dl
jmp 0x10105656
lea esp, [esp + 8]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
mov dx, word [esp]
jmp 0x10105631
add ebx, 4
setp dl
sub esp, 1
lea esp, [esp + 1]
jmp 0x101056c5
mov ch, cl
jmp 0x101056ab
mov edx, dword [eax + 4]
xor edx, ecx
sub cl, ah
lea ecx, reloc.MSVCRT.dll___dllonexit
inc cx
jmp 0x10105684
mov dword [eax + 0x14], edx
pushal
lea ecx, [edi - 0x49]
mov word [esp + 0x1b], cx
jmp 0x101056f6
mov dword [edi], ecx
lea edx, [edx*4]
inc dh
mov dx, word [esp]
jmp 0x1010569a
mov ecx, dword [esi]
pop esi
xor ecx, edx
xchg dl, dh
lea edx, [edi*4]
jmp 0x10105773
push esi
mov esi, eax
add esi, 8
jmp 0x101056d6
pushal
push dword [esp + 0x1d]
jmp 0x1010575c
lea esp, [esp]
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x2c]
cmp ebx, 0x100c276c
jmp 0x101056fe
lea edx, [edi*4]
mov edx, dword [eax + 0xc]
xor edx, ecx
sub esp, 0xc
jmp 0x10105714
lea esp, [esp + 0x24]
jne 0x10104f20
call fcn.10105746
movsd dword es:[edi], dword [esi]
and al, 0xba
invalid
mov dx, word [esp]
mov dword [eax + 0x18], ecx
mov dl, ah
mov dh, byte [esp]
mov dh, 0xe4
jmp 0x10105735
Function at 0x10107c95
Capabilities:
Hash data with md5

Disassembly:
push esi
jmp 0x10107cc9
mov dword [eax + 0x10], reloc.MSVCRT.dll___dllonexit
jmp 0x10107cf3
lea esp, [esp + 8]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
jmp 0x10107cb3
mov dword [eax + 0x14], reloc.MSVCRT.dll___dllonexit
ret

Function at 0x101d56d9
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp + 7]
mov bp, 0x910e
jmp 0x101d60d6
xchg bp, dx
push ebp
not esi
btc ebx, esi
mov word [esp + 0x17], bx
jmp 0x101d5792
stc
cpuid
mov dl, 0x5c
lea edx, reloc.MSVCRT.dll___dllonexit
cld
xchg word [esp + 0x1b], bp
jmp 0x101d5724
mov byte [esp + 0x23], al
stc
lea esp, [esp + 0x1e]
sub bp, dx
rol eax, 8
jmp 0x101d577b
mov bx, 0xb3c0
mov word [esp + 0x23], sp
sub esp, 7
bts eax, ebp
pop word [esp + 0xb]
cpuid
jmp 0x101d574d
pop word [esp + 9]
mov bh, cl
mov al, cl
btr ebp, edx
jmp 0x101d57a6
xchg dword [esp + 4], ebp
cmp bp, bp
push ecx
pop eax
mov ecx, dword [esp + 0x1b]
mov word [esp + 0x11], sp
jmp 0x101d5763
sub ebp, 0x6003aa19
mov ah, 0x2d
bswap edi
not eax
cpuid
cpuid
jmp 0x101d57ed
xchg byte [esp + 2], dl
xchg ch, bl
sub esp, 0x1a
mov eax, ebx
pop dword [esp + 0x11]
inc eax
jmp 0x101d573a
push word [esp + 8]
mov bl, 0x80
mov bx, 0x90b2
pop ax
xchg ebx, edi
jmp 0x101d581c
lea edx, [esi - 9]
mov dword [esp + 2], esp
mov ebp, 0x402152de
xchg byte [esp + 1], dh
push dword [esp + 8]
mov bx, dx
jmp 0x101d57d7
mov al, byte [esp + 4]
push word [esp + 0xe]
pop di
cld
call fcn.101d5873
inc edx
std
int3
not edx
lea ecx, reloc.MSVCRT.dll___dllonexit
push word [esp + 0xa]
xchg si, dx
cmc
bswap ebp
jmp 0x101d5806
xchg si, bp
sub esp, 4
sbb dh, cl
push dword [esp + 1]
mov cl, byte [esp + 4]
ror dh, 3
jmp 0x101d57c2
xchg ebx, ecx
rdtsc
stc
not dh
lea ebx, [edx*4]
mov ebp, edx
jmp 0x101d5838
lea ebp, [esi*4]
cpuid
shr esi, 0x12
cpuid
lea ebx, reloc.MSVCRT.dll___dllonexit
lea eax, [ebx + esi]
jmp 0x101d591b
bsf ax, cx
sub esp, 2
lea eax, [esp + edi]
push word [esp + 2]
mov ax, bp
mov ebp, ecx
jmp 0x101d5a76
neg bp
add esp, 0xb
mov edx, esp
bswap esi
lea esp, [esp + 9]
dec dh
jmp 0x101d5b5b
xchg word [esp + 0x10], di
rdtsc
ror edx, cl
pop edx
xchg word [esp + 0xd], ax
mov ah, 0x27
jmp 0x101d5e83
Function at 0x405650
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422402
mov eax, dword fs:[0]
push eax
mov eax, 0x145c
call fcn.0040c300
mov eax, dword [0x478184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1468], ecx
lea eax, [ebp - 0x1464]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
setne cl
mov byte [ebp - 0x1425], cl
lea edx, [ebp - 0x144c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 0x3ec
mov eax, dword [ebp - 0x1468]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x4056cd
mov ecx, 0x10
call fcn.00401130
jmp 0x4056d7
mov ecx, 0xa
call fcn.00401130
push 0x13a0
lea ecx, [ebp - 0x141c]
push ecx
push 0x3eb
mov edx, dword [ebp - 0x1468]
push edx
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea eax, [ebp - 0x141c]
push eax
lea ecx, [ebp - 0x1440]
call fcn.00401470
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1440]
call fcn.00403fe0
movzx ecx, al
test ecx, ecx
je 0x405739
push 0x425a58
push 0x3ee
mov edx, dword [ebp - 0x1468]
push edx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x405750
push 0x425a5c
push 0x3ee
mov eax, dword [ebp - 0x1468]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0x1424]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0x1424]
sub edx, dword [ebp - 0x144c]
mov eax, dword [ebp - 0x1420]
sbb eax, dword [ebp - 0x1448]
mov dword [ebp - 0x145c], edx
mov dword [ebp - 0x1458], eax
fild qword [ebp - 0x145c]
fmul qword [0x425a70]
fild qword [ebp - 0x1464]
fdivp st(1)
fstp qword [ebp - 0x1454]
sub esp, 8
fld qword [ebp - 0x1454]
fstp qword [esp]
push 0x425a60
lea ecx, [ebp - 0x7c]
push ecx
call fcn.0040db89
add esp, 0x10
mov dword [ebp - 0x1444], eax
lea edx, [ebp - 0x7c]
push edx
push 0x3f2
mov eax, dword [ebp - 0x1468]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1440]
call fcn.00401320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040c2ea
mov esp, ebp
pop ebp
ret
Function at 0x405800
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422432
mov eax, dword fs:[0]
push eax
mov eax, 0x1464
call fcn.0040c300
mov eax, dword [0x478184]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1470], ecx
push 0x425a64
push 0x3f2
mov eax, dword [ebp - 0x1470]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0
lea ecx, [ebp - 0x144c]
push ecx
push 0x3f0
mov edx, dword [ebp - 0x1470]
push edx
call dword [sym.imp.USER32.dll_GetDlgItemInt]
mov dword [ebp - 0x1448], eax
xor eax, eax
cmp dword [ebp - 0x144c], 0
sete al
xor ecx, ecx
cmp dword [ebp - 0x1448], 0
sete cl
or eax, ecx
je 0x405893
mov dword [ebp - 0x1448], 0x800
lea ecx, [ebp - 0x24]
call fcn.004012c0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x146c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
setne al
mov byte [ebp - 0x143d], al
lea ecx, [ebp - 0x1454]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0x1448]
lea ecx, [ebp - 0x24]
call fcn.00404140
push 0x3f3
mov edx, dword [ebp - 0x1470]
push edx
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
jne 0x4058f9
mov edx, dword [ebp - 0x1448]
lea ecx, [ebp - 0x24]
call fcn.004010d0
push 0x3ef
mov eax, dword [ebp - 0x1470]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x405931
mov edx, 5
lea ecx, [ebp - 0x24]
call fcn.00403f70
push 0x14
lea ecx, [ebp - 0x24]
push ecx
call fcn.00403dc0
add esp, 8
test eax, eax
je 0x405931
jmp 0x405910
push 0x3ec
mov edx, dword [ebp - 0x1470]
push edx
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x405954
mov ecx, 0x10
call fcn.00401130
jmp 0x40595e
mov ecx, 0xa
call fcn.00401130
lea edx, [ebp - 0x1434]
lea ecx, [ebp - 0x24]
call fcn.004026e0
lea eax, [ebp - 0x1434]
push eax
push 0x3eb
mov ecx, dword [ebp - 0x1470]
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea edx, [ebp - 0x143c]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x143c]
sub eax, dword [ebp - 0x1454]
mov ecx, dword [ebp - 0x1438]
sbb ecx, dword [ebp - 0x1450]
mov dword [ebp - 0x1464], eax
mov dword [ebp - 0x1460], ecx
fild qword [ebp - 0x1464]
fmul qword [0x425a70]
fild qword [ebp - 0x146c]
fdivp st(1)
fstp qword [ebp - 0x145c]
fld qword [ebp - 0x145c]
call fcn.0040dc90
push eax
push 0x425a68
lea edx, [ebp - 0x94]
push edx
call fcn.0040db89
add esp, 0xc
mov dword [ebp - 0x1444], eax
lea eax, [ebp - 0x94]
push eax
push 0x3f2
mov ecx, dword [ebp - 0x1470]
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0040c2ea
mov esp, ebp
pop ebp
ret
Function at 0x405dd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0
push 0x405ca0
push 0
push 0x66
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x405e48
cmp dword [ebp - 0x20], 0xffffffff
jne 0x405e20
or eax, 0xffffffff
jmp 0x405e4a
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x405e46
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x405dfc
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40c2ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x478184]
jne 0x40c2f4
repz ret
jmp fcn.004100c7

Function at 0x417e73
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040f18f
and dword [ebp - 4], 0
cmp dword [0x4e816c], 0
mov ebx, eax
jne 0x417f24
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x417fd5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x473088
push edi
call esi
test eax, eax
je 0x417fd5
push eax
call fcn.0040f11d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4e816c], eax
call esi
push eax
call fcn.0040f11d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4e8170], eax
call esi
push eax
call fcn.0040f11d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4e8174], eax
call esi
push eax
call fcn.0040f11d
pop ecx
mov dword [0x4e817c], eax
test eax, eax
je 0x417f24
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f11d
pop ecx
mov dword [0x4e8178], eax
mov eax, dword [0x4e8178]
cmp eax, ebx
je 0x417f7c
cmp dword [0x4e817c], ebx
je 0x417f7c
push eax
call fcn.0040f198
push dword [0x4e817c]
mov esi, eax
call fcn.0040f198
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x417f7c
test edi, edi
je 0x417f7c
call esi
test eax, eax
je 0x417f73
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x417f73
test byte [ebp - 0xc], 1
jne 0x417f7c
or dword [ebp + 0x10], 0x200000
jmp 0x417fb5
mov eax, dword [0x4e8170]
cmp eax, ebx
je 0x417fb5
push eax
call fcn.0040f198
pop ecx
test eax, eax
je 0x417fb5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x417fb5
mov eax, dword [0x4e8174]
cmp eax, ebx
je 0x417fb5
push eax
call fcn.0040f198
pop ecx
test eax, eax
je 0x417fb5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4e816c]
call fcn.0040f198
pop ecx
test eax, eax
je 0x417fd5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417fd7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret