joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a7e1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x42a80f
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x42a816
cmp ebx, dword [eax + 4]
jae 0x42a816
xor eax, eax
jmp 0x42aa06
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x42a827
xor eax, eax
inc eax
jmp 0x42aa05
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x42a83d
cmp ecx, edx
jae 0x42a982
cmp dword [eax + 4], 0
je 0x42a846
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x42a82e
cmp dword [ebp + 8], 0
je 0x42a868
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x42a982
cmp eax, esi
jae 0x42a982
mov eax, dword [0x434fe0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x42a88d
cmp dword [esi*4 + 0x434fe8], edi
je 0x42a986
inc esi
cmp esi, eax
jl 0x42a87b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42aa02
cmp dword [ebp - 8], 0x1000000
jne 0x42aa02
test byte [ebp - 0xc], 0xcc
je 0x42a90b
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x42aa02
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x42aa02
cmp word [eax + 0x18], 0x10b
jne 0x42aa02
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x42aa02
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x42a90b
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x42a90b
test byte [ecx + 0x27], 0x80
jne 0x42a982
push 1
push 0x435028
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x42a81f
mov ecx, dword [0x434fe0]
test ecx, ecx
mov edx, ecx
jle 0x42a93f
lea eax, [ecx*4 + 0x434fe4]
cmp dword [eax], edi
je 0x42a93f
dec edx
sub eax, 4
test edx, edx
jg 0x42a933
test edx, edx
jne 0x42a970
push 0xf
pop ebx
cmp ecx, ebx
jg 0x42a94c
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x42a964
lea eax, [edx*4 + 0x434fe8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x42a952
cmp ecx, 0x10
jge 0x42a970
inc ecx
mov dword [0x434fe0], ecx
push 0
push 0x435028
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x42a81f
xor eax, eax
jmp 0x42aa05
test esi, esi
jle 0x42a81f
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x435028
call ebx
test eax, eax
jne 0x42a81f
cmp dword [esi*4 + 0x434fe8], edi
je 0x42a9dc
mov eax, dword [0x434fe0]
lea esi, [eax - 1]
test esi, esi
jl 0x42a9ca
cmp dword [esi*4 + 0x434fe8], edi
je 0x42a9c6
dec esi
jns 0x42a9ba
test esi, esi
jge 0x42a9da
cmp eax, 0x10
jge 0x42a9d5
inc eax
mov dword [0x434fe0], eax
lea esi, [eax - 1]
jmp 0x42a9dc
je 0x42a9f4
xor ecx, ecx
test esi, esi
jl 0x42a9f4
lea eax, [ecx*4 + 0x434fe8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x42a9e2
push 0
push 0x435028
call ebx
jmp 0x42a81f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42aa0a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x43502c], ebx
push esi
push edi
jne 0x42aa8a
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42aac5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x431364
push edi
call esi
test eax, eax
mov dword [0x43502c], eax
je 0x42aac5
push 0x431354
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x435030], eax
call esi
cmp dword [0x434dc8], 2
mov dword [0x435034], eax
jne 0x42aa8a
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x43503c], eax
je 0x42aa8a
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x435038], eax
mov eax, dword [0x435038]
test eax, eax
je 0x42aacf
call eax
test eax, eax
je 0x42aab6
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x43503c]
test eax, eax
je 0x42aab6
test byte [ebp - 8], 1
jne 0x42aacf
cmp dword [0x434dd4], 4
jb 0x42aac9
or byte [ebp + 0x12], 0x20
jmp 0x42aaee
xor eax, eax
jmp 0x42aafe
or byte [ebp + 0x12], 4
jmp 0x42aaee
mov eax, dword [0x435030]
test eax, eax
je 0x42aaee
call eax
mov ebx, eax
test ebx, ebx
je 0x42aaee
mov eax, dword [0x435034]
test eax, eax
je 0x42aaee
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x43502c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ab9f
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00421590
mov eax, dword [0x43355c]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
xor esi, esi
cmp ebx, dword [0x4362a8]
mov dword [ebp - 4], eax
jae 0x42acea
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x4362c0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x42acea
push 1
push esi
push ebx
call fcn.00421c25
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x42acf4
push 2
push esi
push ebx
call fcn.00421c25
add esp, 0xc
cmp eax, 0xffffffff
je 0x42acf4
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x42ac94
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00427810
push 0x8000
push ebx
call fcn.0042bb0c
add esp, 0x14
mov dword [ebp - 0x100c], eax
mov eax, 0x1000
cmp edi, eax
jge 0x42ac50
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00424191
add esp, 0xc
cmp eax, 0xffffffff
je 0x42ac6e
sub edi, eax
test edi, edi
jg 0x42ac45
jmp 0x42ac84
cmp dword [0x434dc0], 5
jne 0x42ac81
mov dword [0x434dbc], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push ebx
call fcn.0042bb0c
pop ecx
pop ecx
jmp 0x42acd4
jge 0x42acd4
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00421c25
push ebx
call fcn.00428ac1
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x42acd4
mov dword [0x434dbc], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x434dc0], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00421c25
add esp, 0xc
mov eax, esi
pop edi
jmp 0x42acf7
mov dword [0x434dbc], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00427999
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x6b2220
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword [0x6c681c]
test eax, eax
jne 0x6b225f
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [eax + 0xc]
add edi, 0xc
mov esi, dword [edi]
jmp 0x6b2252
movzx eax, word [esi + 0x2c]
mov edx, dword [esi + 0x30]
push eax
call fcn.006b2991
pop ecx
cmp eax, 0x4b1ffe8e
je 0x6b2260
mov esi, dword [esi]
cmp esi, edi
jne 0x6b223b
xor eax, eax
pop edi
mov dword [0x6c681c], eax
pop esi
ret
mov eax, dword [esi + 0x18]
jmp 0x6b2258

Function at 0x6b2991
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x6b299d
or eax, 0xffffffff
pop ebp
ret
movzx ecx, word [edx]
push edi
xor eax, eax
xor edi, edi
test cx, cx
je 0x6b29e1
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x6b29b7
cmp edi, dword [ebp + 8]
jae 0x6b29df
movzx ecx, cx
lea ebx, [ecx - 0x41]
mov esi, ecx
cmp bx, 0x19
ja 0x6b29cb
add ecx, 0x20
movzx esi, cx
movzx ecx, si
rol eax, 7
add edx, 2
xor eax, ecx
movzx ecx, word [edx]
inc edi
test cx, cx
jne 0x6b29ac
pop esi
pop ebx
pop edi
pop ebp
ret

Function at 0x6b2ea4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0xc], ecx
jbe 0x6b2ef1
mov al, byte [esi]
and dword [ebp - 8], 0
test al, al
je 0x6b2ee5
mov byte [ebp - 1], al
mov eax, dword [ebp + 8]
add ecx, eax
mov dl, byte [ecx]
mov al, byte [ebp - 0xc]
imul byte [ebp - 8]
add al, byte [ebp - 1]
xor dl, al
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
mov byte [ecx], dl
mov al, byte [eax + esi]
mov byte [ebp - 1], al
test al, al
jne 0x6b2ec8
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp + 0xc]
jb 0x6b2eb4
mov eax, ecx
leave
ret
Function at 0x403880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403897
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4038c8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4038c4
cmp esi, eax
jae 0x4038c8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4038b4
cmp esi, eax
jb 0x4038ce
pop esi
pop edi
xor eax, eax
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x405c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x405c57
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x405d34
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x438248]
inc ecx
sub edx, 8
sub esi, 1
jne 0x405c70
pop edi
test edx, edx
je 0x405d5b
jmp 0x405d40
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x438248]
inc ecx
sub edx, 1
jne 0x405d40
not eax
pop esi
ret

Function at 0x405d60
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x438248]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x438248]
mov dword [edx + 8], ecx
ret

Function at 0x405db0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x438248]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x438248]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x406560
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x406592
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406588
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x4065a5
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0040c240
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x4065c0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x4065f3
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4065ed
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x40661f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x406605
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0040c240
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x406636
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x406630
cmp byte [esi + 8], 0
je 0x406630
or eax, 0xffffffff
add esp, 8
ret
Function at 0x4066d0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x406715
cmp byte [esi + 1], 0
je 0x40671d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x406732
cmp byte [esi + 1], 0
je 0x406724
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x40673b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x4066ee
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40673b
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x40674f
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.00409322
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40676d
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x406881
jmp 0x406790
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x4067a1
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x4067ba
mov ebp, 0x404
cmp byte [esi], 0
je 0x4067df
cmp byte [esi + 1], 0
je 0x406881
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4067e2
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x40680a
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406804
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x406830
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x40681b
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.0040c240
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x406881
lea eax, [ebp - 3]
test eax, eax
jl 0x40686c
dec eax
cmp byte [eax + ebx], 0x50
jne 0x40685c
cmp byte [eax + ebx + 1], 0x4b
jne 0x40685c
cmp byte [eax + ebx + 2], 5
jne 0x40685c
cmp byte [eax + ebx + 3], 6
je 0x406862
test eax, eax
jge 0x406840
jmp 0x40686c
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x406881
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x406784
push ebx
call fcn.00409176
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x407270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0x40728e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0x407282
cmp dword [edi + 0x7c], ebx
je 0x40729d
call fcn.00407650
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00406fe0
add esp, 0xc
test eax, eax
je 0x4072c4
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.00409322
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x407305
push 0x4000
call fcn.00409322
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0x407312
push esi
call fcn.00409176
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0x40735a
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00406070
test eax, eax
jne 0x40735a
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0x407384
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0x40738d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x70]
mov dword [esi + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmp ebp, ebx
je 0x4073c7
mov cl, byte [ebp]
cmp cl, bl
je 0x4073c7
call fcn.00405d60
add ebp, 1
jne 0x4073b6
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4077b0
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
jne 0x40784e
cmp dword [esi + 4], 0xffffffff
jne 0x40784e
push edi
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
jmp 0x4077e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4077e0
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
je 0x407819
cmp ax, 0x2f
je 0x407819
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x407806
mov eax, dword [0x438840]
mov dword [edi], eax
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
call fcn.004064c0
add esp, 4
pop edi
test eax, eax
jne 0x407836
mov eax, dword [esp + 4]
ret 4
call fcn.004068a0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
ret 4
mov eax, 0x1000000
ret 4

Function at 0x40892b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43a05c]
jne 0x408935
repz ret
jmp fcn.0040ac7c

Function at 0x41059d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a68b
and dword [ebp - 4], 0
cmp dword [0x445308], 0
mov ebx, eax
jne 0x41064e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4106ff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42db24
push edi
call esi
test eax, eax
je 0x4106ff
push eax
call fcn.0040a619
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x445308], eax
call esi
push eax
call fcn.0040a619
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44530c], eax
call esi
push eax
call fcn.0040a619
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x445310], eax
call esi
push eax
call fcn.0040a619
pop ecx
mov dword [0x445318], eax
test eax, eax
je 0x41064e
push 0x42dacc
push edi
call esi
push eax
call fcn.0040a619
pop ecx
mov dword [0x445314], eax
mov eax, dword [0x445314]
cmp eax, ebx
je 0x4106a6
cmp dword [0x445318], ebx
je 0x4106a6
push eax
call fcn.0040a694
push dword [0x445318]
mov esi, eax
call fcn.0040a694
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4106a6
test edi, edi
je 0x4106a6
call esi
test eax, eax
je 0x41069d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41069d
test byte [ebp - 0xc], 1
jne 0x4106a6
or dword [ebp + 0x10], 0x200000
jmp 0x4106df
mov eax, dword [0x44530c]
cmp eax, ebx
je 0x4106df
push eax
call fcn.0040a694
pop ecx
test eax, eax
je 0x4106df
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4106df
mov eax, dword [0x445310]
cmp eax, ebx
je 0x4106df
push eax
call fcn.0040a694
pop ecx
test eax, eax
je 0x4106df
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445308]
call fcn.0040a694
pop ecx
test eax, eax
je 0x4106ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410701
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414e10
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.00409410
mov eax, dword [0x43a05c]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x414e75
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x414e75
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.0041232b
add eax, 0x40
push eax
call fcn.00424ca9
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040892b
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.00424b71
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x414f04
call fcn.00414d30
test eax, eax
jle 0x414f04
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040892b
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040892b
add esp, 0x108
ret