joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007230
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x100588c0]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x58]
xor ebx, ebx
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
cmp esi, ebx
je 0x1000736f
mov ecx, dword [edi + 0x1c]
lea eax, [esp + 0x10]
push eax
push 0x400
push ecx
call fcn.100091f0
mov ebp, eax
add esp, 0xc
cmp ebp, ebx
jne 0x10007353
lea edx, [esp + 0x20]
push edx
push esi
call fcn.10033364
mov ebx, eax
push 0x30
lea eax, [esp + 0x2c]
push eax
push edi
call fcn.1000c1b0
mov ebp, eax
add esp, 0x14
test ebp, ebp
jne 0x10007353
mov dword [esp + 0x14], 0x30
test ebx, ebx
jns 0x100072bd
mov ebp, 0x2711
jmp 0x10007353
mov ebx, dword [esp + 0x60]
test ebx, ebx
jle 0x10007353
push 0x100467e8
push esi
call fcn.10033bbf
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x10007353
jmp 0x100072e5
mov eax, dword [esp + 0x18]
mov esi, ebx
cmp ebx, 0x400
jl 0x100072f4
mov esi, 0x400
mov ecx, dword [esp + 0x10]
push eax
push esi
push 1
push ecx
call fcn.10033ae6
mov edi, eax
add esp, 0x10
test edi, edi
jle 0x1000732e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
push esi
push edx
push eax
call fcn.1000c1b0
mov ebp, eax
add esp, 0xc
test ebp, ebp
jne 0x10007342
add dword [esp + 0x14], edi
sub ebx, esi
test ebx, ebx
jg 0x100072e1
mov ecx, dword [esp + 0x10]
push 0x400
push 0
push ecx
call fcn.10033210
add esp, 0xc
mov edx, dword [esp + 0x18]
push edx
call fcn.10033828
mov edi, dword [esp + 0x20]
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10007368
push eax
mov eax, dword [edi + 0x1c]
push eax
call fcn.10009250
add esp, 8
cmp dword [esp + 0x14], 0
jne 0x10007387
pop edi
pop esi
pop ebp
mov eax, 0x2711
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.100330f2
add esp, 0x44
ret
mov ecx, dword [esp + 0x50]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.100330f2
add esp, 0x44
ret

Function at 0x1000f0c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x100588c0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [eax + 8]
cmp dword [esi + 0x84], 3
push edi
mov edi, dword [eax + 0xc]
je 0x1000f0ff
pop edi
pop esi
mov eax, 0x2732
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100330f2
add esp, 0x14
ret
mov eax, dword [esp + 0x2c]
cmp eax, dword [edi + 8]
jae 0x1000f11f
pop edi
pop esi
mov eax, 0x271b
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.100330f2
add esp, 0x14
ret
mov edx, dword [esi + 0x38]
lea ecx, [esp + 0xc]
push ecx
push edx
call fcn.1000c650
xor eax, eax
add esp, 8
cmp dword [edi + 8], eax
jbe 0x1000f153
push ebp
lea ebp, [esp + 0x10]
sub ebp, ebx
mov edi, edi
lea ecx, [ebx + eax]
mov dl, byte [ecx + ebp]
xor dl, byte [esi + eax + 0x40]
inc eax
mov byte [ecx], dl
cmp eax, dword [edi + 8]
jb 0x1000f140
pop ebp
mov ecx, dword [esp + 0x1c]
pop edi
mov dword [esi + 0x84], 0
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100330f2
add esp, 0x14
ret
Function at 0x10027b80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
mov ecx, dword [edx + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
shr ebx, 3
test ebx, ebx
je 0x10027be8
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x1c]
sub edi, esi
lea esp, [esp]
xor ecx, dword [edi + esi + 4]
xor eax, dword [edi + esi]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], eax
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [esi], eax
mov dword [esi + 4], ecx
add esp, 8
add esi, 8
dec ebx
jne 0x10027bb0
mov edx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
mov dword [edx], eax
mov dword [edx + 4], ecx
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x1002fd80
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
cdq
push ebp
and edx, 3
push esi
mov esi, dword [esp + 0x14]
push edi
lea edi, [edx + eax]
sar edi, 2
mov dword [esi + 4], edi
lea eax, [edi + 6]
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
lea ebp, [esi + 0x10]
mov dword [ebp], ecx
mov edx, dword [eax + 4]
mov dword [ebp + 4], edx
mov ecx, dword [eax + 8]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp + 0xc], edx
cmp edi, 6
jl 0x1002fde0
mov ecx, dword [eax + 0x10]
mov dword [ebp + 0x10], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp + 0x14], edx
cmp edi, 8
jne 0x1002fde0
mov ecx, dword [eax + 0x18]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x1c]
mov dword [ebp + 0x1c], edx
push ebx
mov ebx, dword [esi]
lea edx, [edi*4]
mov ecx, dword [edx + ebp - 4]
lea ebx, [ebx*4 + 4]
mov eax, ebp
sub eax, edx
mov dword [esp + 0x20], 0x1004c0e8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], edi
cmp edi, ebx
jge 0x1002ff22
lea esi, [eax + edi*4 + 0x10]
sub eax, ebp
lea edx, [edx + ebp + 4]
mov dword [esp + 0x10], eax
nop
movzx eax, cl
movzx ebx, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx eax, byte [eax + str.cw]
shr ecx, 8
movzx ecx, cl
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + str.cw]
shl ebx, 8
or ebx, eax
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax]
xor ecx, ebx
xor ecx, dword [esi - 0x10]
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov dword [edx - 4], ecx
xor ecx, dword [eax + edx]
mov dword [edx], ecx
xor ecx, dword [esi - 8]
mov dword [edx + 4], ecx
xor ecx, dword [esi - 4]
mov dword [edx + 8], ecx
cmp edi, 6
jl 0x1002feff
jne 0x1002fe9e
xor ecx, dword [esi]
mov dword [edx + 0xc], ecx
xor ecx, dword [esi + 4]
mov dword [edx + 0x10], ecx
jmp 0x1002feff
cmp dword [esp + 0x24], 0x38
je 0x1002ff1e
mov ebx, ecx
mov eax, ecx
shr ebx, 0x10
shr eax, 0x18
movzx eax, byte [eax + str.cw]
movzx ebx, bl
movzx ebx, byte [ebx + str.cw]
shl eax, 8
or eax, ebx
mov ebx, ecx
shr ebx, 8
movzx ecx, cl
movzx ecx, byte [ecx + str.cw]
movzx ebx, bl
movzx ebx, byte [ebx + str.cw]
shl eax, 8
or eax, ebx
shl eax, 8
or ecx, eax
xor ecx, dword [esi]
mov dword [edx + 0xc], ecx
xor ecx, dword [esi + 4]
mov dword [edx + 0x10], ecx
xor ecx, dword [esi + 8]
mov dword [edx + 0x14], ecx
xor ecx, dword [esi + 0xc]
mov dword [edx + 0x18], ecx
mov ebx, dword [esp + 0x24]
lea eax, [edi*4]
add ebx, edi
add edx, eax
add esi, eax
mov dword [esp + 0x24], ebx
cmp ebx, dword [esp + 0x14]
jl 0x1002fe20
mov esi, dword [esp + 0x1c]
mov esi, dword [esi]
pop ebx
cmp esi, 0xe
je 0x1002ff59
lea eax, [esi*4]
mov edx, dword [ebp + eax*4]
mov dword [ebp + 0xe0], edx
mov ecx, dword [ebp + eax*4 + 4]
mov dword [ebp + 0xe4], ecx
mov edx, dword [ebp + eax*4 + 8]
mov dword [ebp + 0xe8], edx
mov eax, dword [ebp + eax*4 + 0xc]
mov dword [ebp + 0xec], eax
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret
Function at 0x10030750
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x100588c0]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x44]
mov ebx, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x40]
shr edi, 4
mov dword [esp + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 8]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 4]
mov dword [esp + 0x18], esi
mov dword [esp + 0x40], edi
test edi, edi
je 0x1003080f
mov edi, dword [esp + 0x14]
add edi, 4
lea esi, [ebp + 4]
lea ebx, [ebx]
mov ebp, dword [esi - 4]
xor ebp, eax
mov eax, dword [esi + 4]
xor eax, ecx
mov ecx, dword [esi]
xor ecx, edx
mov edx, dword [esi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
push eax
lea ecx, [esp + 0x24]
xor edx, ebx
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], edx
add esi, 0x10
call dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
mov dword [edi - 4], eax
mov dword [edi + 4], ecx
mov dword [edi], edx
mov dword [edi + 8], ebx
add esp, 8
add edi, 0x10
dec dword [esp + 0x40]
jne 0x100307b0
mov esi, dword [esp + 0x18]
pop edi
mov dword [esi + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 4], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100330f2
add esp, 0x24
ret
Function at 0x10030830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x100588c0]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov edx, dword [eax + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 0xc]
push ebx
mov ebx, dword [eax]
push ebp
mov ebp, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x4c]
push esi
mov esi, dword [esp + 0x48]
shr ecx, 4
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x54], ecx
test ecx, ecx
je 0x1003091f
add edi, 8
add esi, 8
mov edi, edi
mov eax, dword [esi - 8]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi - 4]
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], eax
mov eax, dword [esi]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x40], eax
mov dword [esp + 0x24], eax
push edx
lea eax, [esp + 0x38]
push eax
add esi, 0x10
call dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x44]
xor eax, dword [esp + 0x18]
mov edx, dword [esp + 0x40]
xor ecx, ebx
mov ebx, dword [esp + 0x20]
mov dword [edi - 8], ecx
mov ecx, dword [esp + 0x48]
xor ecx, dword [esp + 0x1c]
xor edx, ebp
mov ebp, dword [esp + 0x30]
mov dword [edi - 4], edx
mov edx, dword [esp + 0x24]
mov dword [edi], eax
mov eax, dword [esp + 0x2c]
mov dword [edi + 4], ecx
add esp, 8
add edi, 0x10
dec dword [esp + 0x54]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jne 0x10030890
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
pop edi
pop esi
mov dword [eax + 4], ebp
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [eax], ebx
pop ebp
pop ebx
mov dword [eax + 0xc], edx
xor ecx, esp
xor eax, eax
call fcn.100330f2
add esp, 0x38
ret
Function at 0x100309d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, esp
and esp, 0xfffffff0
sub esp, 0x20
mov dword [esp + 0x10], edx
mov dword [esp], 0xc0d0e0f
mov dword [esp + 4], 0x8090a0b
mov dword [esp + 8], 0x4050607
mov dword [esp + 0xc], 0x10203
movdqu xmm0, xmmword [esi]
movdqu xmm1, xmmword [ecx]
pshufb xmm0, xmmword [esp]
movdqu xmm4, xmmword [edi]
pshufb xmm4, xmmword [esp]
pxor xmm0, xmm4
add edi, 0x10
pshufd xmm7, xmm0, 0x4e
pxor xmm7, xmm0
movdqa xmm2, xmm0
pshufd xmm6, xmm1, 0x4e
pxor xmm6, xmm1
movdqa xmm3, xmm0
pclmulqdq xmm2, xmm1, 0
pclmulqdq xmm3, xmm1, 0x11
pclmulqdq xmm7, xmm6, 0
pxor xmm7, xmm2
pxor xmm7, xmm3
movdqa xmm6, xmm7
psrldq xmm7, 8
pxor xmm3, xmm7
pslldq xmm6, 8
pxor xmm2, xmm6
movdqa xmm6, xmm2
psrld xmm6, 0x1f
movdqa xmm7, xmm3
psrld xmm7, 0x1f
pslld xmm2, 1
pslld xmm3, 1
movdqa xmm5, xmm6
psrldq xmm5, 0xc
pslldq xmm6, 4
pslldq xmm7, 4
por xmm2, xmm6
por xmm3, xmm7
por xmm3, xmm5
movdqa xmm5, xmm2
pslld xmm5, 0x1f
movdqa xmm7, xmm2
pslld xmm7, 0x1e
pxor xmm5, xmm7
movdqa xmm7, xmm2
pslld xmm7, 0x19
pxor xmm5, xmm7
movdqa xmm7, xmm5
psrldq xmm7, 4
pslldq xmm5, 0xc
pxor xmm2, xmm5
pxor xmm3, xmm2
movdqa xmm0, xmm2
psrld xmm0, 1
pxor xmm0, xmm3
movdqa xmm5, xmm2
psrld xmm5, 2
pxor xmm0, xmm5
psrld xmm2, 7
pxor xmm0, xmm2
pxor xmm0, xmm7
sub eax, 0x10
jg 0x10030a1c
pshufb xmm0, xmmword [esp]
movdqu xmmword [esi], xmm0
mov esp, dword [esp + 0x10]
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 8
ret
Function at 0x100330f2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100588c0]
jne 0x100330fc
repz ret
jmp fcn.10035b4a

Function at 0x1003e644
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100588c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10034752
and dword [ebp - 0x14], 0
cmp dword [0x1005a78c], 0
mov dword [ebp - 0x18], eax
jne 0x1003e6f7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1003e79f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1003e79f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x10056d84
push ebx
mov dword [0x1005a78c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1005a790], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1005a794], eax
call edi
push eax
call esi
mov dword [0x1005a79c], eax
test eax, eax
je 0x1003e6f7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1005a798], eax
mov eax, dword [0x1005a798]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1003e750
cmp dword [0x1005a79c], ecx
je 0x1003e750
push eax
call esi
push dword [0x1005a79c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1003e750
test ebx, ebx
je 0x1003e750
call edi
test eax, eax
je 0x1003e747
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1003e747
test byte [ebp - 8], 1
jne 0x1003e750
or dword [ebp + 0x10], 0x200000
jmp 0x1003e783
mov eax, dword [0x1005a790]
cmp eax, dword [ebp - 0x18]
je 0x1003e783
push eax
call esi
test eax, eax
je 0x1003e783
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1003e783
mov eax, dword [0x1005a794]
cmp eax, dword [ebp - 0x18]
je 0x1003e783
push eax
call esi
test eax, eax
je 0x1003e783
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1005a78c]
call esi
test eax, eax
je 0x1003e79f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1003e7a1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100330f2
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x40114e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401165
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x401177
xor eax, eax
jmp 0x4011a8
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40119a
cmp edi, eax
jae 0x401173
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x40118c
cmp edi, eax
jae 0x401173
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x401282
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
shl eax, 1
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4012db
cmp dword [ebp + 0xc], 1
je 0x4012b9
cmp dword [ebp + 0xc], 2
jne 0x4012d0
test edi, edi
mov eax, dword [ebp - 4]
je 0x4012d5
test al, 1
jne 0x4012d0
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4012d5
push 0xd
pop eax
jmp 0x4012db
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x403ece
Capabilities:
Get system information on windows

Disassembly:
push 0x3c
push 0x505330
call fcn.004ec188
mov ebx, ecx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
mov edi, eax
mov dword [ebp - 0x20], edi
and dword [ebx], 0
push 4
push 0x2000
shl eax, 0xa
push eax
push 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call esi
test eax, eax
je 0x403f70
mov dword [ebp - 0x24], edi
push 4
push 0x1000
push edi
push eax
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x403f70
and dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.MSVCRT.dll_vswprintf]
add esp, 0xc
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx], esi
jmp 0x403f72
xor eax, eax
call fcn.004ec1c3
ret

Function at 0x403fa2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
mov edi, eax
test edi, edi
je 0x403fdf
cmp word [edi], 0
je 0x403fdf
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
mov edi, eax
call esi
cmp edi, 0xffffffff
pop esi
pop ebx
je 0x403fdf
mov eax, edi
and al, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
pop edi
mov eax, ecx
ret
xor eax, eax
pop edi
ret

Function at 0x4040a5
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 4], edi
jne 0x4040d4
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0xc]
push eax
push edi
push esi
push fcn.0040405c
push edi
push edi
mov dword [eax], edi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
xor eax, eax
pop edi
inc eax
pop esi
ret
Function at 0x4040fe
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
sub esp, 0x28
push ebx
push esi
mov ebx, ecx
push edi
lea esi, [ebx + 4]
xor edi, edi
cmp dword [esi], edi
mov dword [esp + 0x10], ebx
je 0x40421f
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push dword [ebx + 8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esp + 0x3c]
push 0x14
push edi
push esi
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, edi
je 0x40421e
cmp eax, 1
jne 0x4041ef
push edi
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4041ef
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_IsWindowUnicode]
push edi
push edi
mov ebx, eax
cmp ebx, edi
lea eax, [esp + 0x24]
push edi
push eax
je 0x404189
call dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x40418f
call dword [sym.imp.USER32.dll_GetMessageA]
cmp eax, edi
jle 0x4041b5
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
cmp ebx, edi
lea eax, [esp + 0x1c]
push eax
je 0x4041af
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4041b5
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4041e3
call ebp
sub eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x40]
jae 0x4041e3
push edi
push edi
push edi
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x404169
jmp 0x4041eb
mov dword [esp + 0x10], 1
mov ebx, dword [esp + 0x14]
call ebp
sub eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x40]
jb 0x404203
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], edi
je 0x404131
mov eax, dword [esi]
cmp eax, edi
je 0x40421e
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi], edi
pop ebp
mov dword [ebx + 0xc], edi
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
add esp, 0x28
ret 8

Function at 0x404424
Capabilities:
Suspend thread

Disassembly:
cmp dword [esi + 0x2c], 0
jne 0x40443e
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi + 0x2c], ecx
mov eax, dword [esi + 0x2c]
ret

Function at 0x404442
Capabilities:
Resume thread

Disassembly:
cmp dword [esi + 0x2c], 0
je 0x40445a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x2c], eax
xor eax, eax
cmp dword [esi + 0x2c], eax
sete al
ret
Function at 0x406141
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
neg esi
sbb esi, esi
lea ecx, [eax - 0x20]
and esi, ecx
cmp byte [eax + 0x1c], 0
je 0x406184
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 8], 2
jne 0x406175
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40618a
cmp dword [ebp + 8], 0
jne 0x406184
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 1
je 0x4061a2
mov eax, dword [ebp + 0xc]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0xc]
push eax
add esi, 0x20
push esi
call fcn.004794cf
xor eax, eax
pop esi
pop ebp
ret 8

Function at 0x40f0b5
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x517ad4]
push edi
xor eax, ebp
push 0x44
mov dword [ebp + 0x94], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
pop edi
je 0x40f107
cmp dword [ebp - 0x7c], 5
jae 0x40f103
cmp dword [ebp - 0x7c], 4
jne 0x40f107
cmp dword [ebp - 0x78], 0x5a
jb 0x40f107
xor eax, eax
jmp 0x40f10a
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.004ebd70
add ebp, 0x98
leave
ret

Function at 0x40f15a
Capabilities:
Get system information on windows

Disassembly:
push 0x3c
push 0x505300
call fcn.004ec188
mov ebx, ecx
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
mov edi, eax
mov dword [ebp - 0x20], edi
and dword [ebx], 0
push 4
push 0x2000
shl eax, 0xa
push eax
push 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call esi
test eax, eax
je 0x40f1fc
mov dword [ebp - 0x24], edi
push 4
push 0x1000
push edi
push eax
call esi
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x40f1fc
and dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.MSVCRT.dll_vsprintf]
add esp, 0xc
mov dword [ebp - 0x28], eax
or dword [ebp - 4], 0xffffffff
mov dword [ebx], esi
jmp 0x40f1fe
xor eax, eax
call fcn.004ec1c3
ret