joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012770
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054048
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x1006c070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x78]
push 0x14
push str.l2chile.ddnsking.com
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x68], 0
mov byte [ebp - 0x78], 0
call fcn.10003100
mov dword [ebp - 4], 0
lea eax, [ebp - 0x78]
cmp dword [ebp - 0x64], 0x10
cmovae eax, dword [ebp - 0x78]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10012814
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x10012814
movzx eax, byte [ecx + 3]
push eax
movzx eax, byte [ecx + 2]
push eax
movzx eax, byte [ecx + 1]
push eax
movzx eax, byte [ecx]
push eax
lea eax, [ebp - 0x60]
push str._u._u._u._u
push eax
call fcn.10012700
add esp, 0x18
lea edx, [ebp - 0x60]
jmp 0x10012819
mov edx, 0x10063d68
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x10012833
xor ecx, ecx
jmp 0x10012841
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012838
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10003100
lea ecx, [ebp - 0x78]
call fcn.10002e80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002cc28
mov esp, ebp
pop ebp
ret 4

Function at 0x100148c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
jmp 0x100148dc
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
push eax
push dword [ebp + 8]
lea ecx, [ebx + 0x100]
mov dword [ebx + 0x110], eax
push ecx
call fcn.1002f9d0
add esp, 0xc
xor eax, eax
nop dword [eax]
mov byte [eax + ebx], al
inc eax
cmp eax, 0x100
jl 0x10014900
xor edi, edi
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
xor esi, esi
mov dword [ebp + 0xc], edi
nop word [eax + eax]
mov dl, byte [esi + ebx]
movzx eax, byte [ebx + edi + 0x100]
add eax, dword [ebp + 0xc]
movzx ecx, dl
add ecx, eax
movzx ecx, cl
mov dword [ebp + 0xc], ecx
mov al, byte [ecx + ebx]
mov byte [esi + ebx], al
lea eax, [edi + 1]
mov byte [ecx + ebx], dl
inc esi
cdq
idiv dword [ebx + 0x110]
mov edi, edx
cmp esi, 0x100
jl 0x10014930
jmp 0x10014979
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x408c50
Capabilities:
Encode data using xor

Disassembly:
jg 0x408be5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c08
mov ecx, dword [eax]
adc al, 0x86
test dword [esi + 0x3d], eax
ja 0x408c5e
inc ebp
push esp
pop eax
sub esp, dword [edx]
pushal
invalid
das
push ecx
fmul st(5), st(0)
fcomi st(6)
dec ecx
je 0x408bd9
jmp word [ecx + edi*2 + 0x1b9c47da]
daa
loope 0x408c76
dec esp
inc byte [0x92794693]
mov esp, 0x9574c7d5
xchg ebp, eax
rol byte [ebp - 0x63], 0x53
in al, dx
nop
cmp al, 0x6e
lodsb al, byte [esi]
sti
xchg ecx, eax
push ss
pop esp
add eax, dword [ebp - 0x338ba8e9]
jno 0x408cb4
push ds
xchg byte [ecx - 0x41fb2c8b], ah
mov eax, dword [0xbe04d375]
je 0x408c37
sub ch, byte [ecx]
mov edx, 0x34aa405a
inc ecx
xor al, 0x41
popal
shl byte [esi], cl
and al, 0x63
and al, byte [edx - 0x2e]
add dword [edi + 0x37], esi
push cs
shl dword [ecx + ebx*4 - 0x4a254a27], 1
cmp edx, edi
lcall 0x516, 0xeba94859
inc ecx
fcomp dword [esi + 0x7c]
push es
xor eax, 0x6509ae56
push es
salc
pop ebx
pushfd
sub dword [edi + eax - 0x77], ebx
enter 0x1925, 0xffffffffffffffba
pushal
je 0x408c83
pop es
mov eax, ecx
and eax, 0x7460ba19
invalid
adc dword [edi + 0x55a42da4], ebx
or al, bh
xchg esi, eax
add eax, 0x379c1624
dec eax
cmpsb byte [esi], byte es:[edi]
adc eax, 0x7f47b907
cmc
invalid
Function at 0x427e94
Capabilities:
Encode data using xor

Disassembly:
jge 0x427e51
mov eax, dword [0x550eb181]
mov ah, byte [esi - 0x34]
push ebp
mov ch, 0xa
push edi
mov ah, 0x2c
sbb al, 0x9c
mov edx, 0xfce39b36
sbb ebp, edi
cld
fstp xword [bp + di - 0x3361]
push ds
mov ebx, 0x70365f52
xchg edi, eax
cdq
or dl, byte [ecx - 0x4659bdd3]
invalid
add al, 0x8c
mov dh, ah
xchg ebx, eax
sbb al, 0x95
jns 0x427e04
mov esi, 0xbcd95d60
jne 0xa50a82b6
movsb byte es:[edi], byte [esi]
xchg ebx, eax
lcall 0x67f8, 0xb1ee0fa0
and ecx, dword [ecx]
mov al, byte [0xf8b1ee0f]
and ecx, dword [bx + di]
mov ch, 0xd4
dec eax
sbb eax, 0x2963765a
adc ebx, dword [ecx + 0x50]
xor byte [ebx - 0x4a], al
daa
xchg byte [ebx + 0x3f5b85fb], al
push ebp
sti
xor eax, 0xcaefa8fe
lcall 0xebd8, 0xaf0d62a2
xchg edx, eax
outsb dx, byte [esi]
xor dword [edx - 0x50], ebp
mov esp, 0x7cc5c82c
ja 0x427e3e
bound eax, qword [eax + esi*4]
popal
popal
mov dh, 0x65
in eax, 0x59
xchg ebp, eax
add dword [eax + 0x5b], ebx
cmp al, 0x98
cmp byte [edi], bl
jl 0x427ea5
xchg ebp, eax
mov cl, 0x70
pushal
push cs
add bl, byte [ebx + 0x7c]
lodsb al, byte [esi]
pop ebx
jl 0x427e54
mov ebp, 0x2bffb546
pop ebx
sti
mov bh, 0xef
invalid

Function at 0x445789
Capabilities:
Encode data using xor

Disassembly:
wait
sahf
invalid
sbb eax, 0xda31667e
push eax
xchg edx, eax
cmp ah, bl
invalid
inc edi
cmp eax, 0x771a01a
push esi
dec ebp
invalid
int 0xf
inc dword [esi + esi*2 + 0x34]
faddp st(5)
add ecx, dword [edx - 0x6363a503]
insb byte es:[edi], dx
ja 0x445726
push es
jno 0x4457f1
jo 0x44574b
jecxz 0x445758
and eax, 0xcd20a303
das
pop ds
scasb al, byte es:[edi]
in eax, dx
fild qword [edi - 0x5e66a482]
scasd eax, dword es:[edi]
jle 0x445852
cdq
mov eax, dword [0xccd5115]
not byte [esp + ebx*4 + 0x4a3387f7]
xor al, 0x88
mov cl, 0x9e
xor dl, ch

Function at 0x46890a
Capabilities:
Encode data using xor

Disassembly:
inc eax
xor cl, byte [ebp - 0x19da20b6]
push ss
mov edx, ebx
sbb dl, ah
or eax, 0xa3bccad7
adc byte [ebx - 0x7e1f554e], dl
inc ebx
jl 0x468928
call 0x4a18760c
dec ecx
mov byte [0xa4cb0cc6], al
enter 0x7df8, 0xffffffffffffffde
push es
cmp dword [0xb8e57206], 0xfffffff7
out dx, eax
xchg esi, eax
xor bl, ch
fisttp dword [edx + 0x16]
das
sub edx, 0x2e94bcd5
cmpsb byte [esi], byte es:[edi]
sub dl, dl
cmp byte [eax + 0x57abbec6], dh
inc eax
jno 0x468929
out 0xaa, al
mov ds, word [esi + 0x32]
rcr byte [eax - 0x7a], 0xe9
xlatb
fsub st(6)
movsd dword es:[edi], dword [esi]
wait
sahf
scasb al, byte es:[edi]
jmp 0x58aad161

Function at 0x47c64c
Capabilities:
Encode data using xor

Disassembly:
psubsb mm4, qword [ebx]
xor byte [esp + 0x399713bb], ch
mov es, edx
push cs
push esp
add eax, 0x638bca41
rcl dword [ebx*2 + 0x6b15571e]
invalid
dec ebx
ffree st(4)
aad 0xd3
bound esp, qword [ecx - 0x23]
cmp cl, byte [eax - 0x3d]
sbb al, 0x13
pop es
lea ebx, [ebx + 0x2a91ef6b]
pop ebp
outsd dx, dword [esi]
jb 0x47c621
sbb al, 0xd2
mov ah, 0x70
inc ecx
xchg ecx, eax
aaa
inc ebp
lodsd eax, dword [esi]
and dword [ebx + 0x63ad6b3b], 0xffffffd8
enter 0xffffffffffffa30e, 0xffffffffffffffff
xor edx, dword [ebx - 0x7e]
idiv dword [ebp - 0x67]
mov eax, dword [0xf2884579]
inc ecx
adc al, 0xe9
or edi, dword [esi - 0x61]
retf 0xd99a
Function at 0x492dd0
Capabilities:
Encode data using xor

Disassembly:
sal al, 0x8d
dec eax
or al, 0x83
retf 0xf0ff
sti
add bl, ch
mov al, 0xda
shr dword [edx - 0x7a703141], cl
mov al, byte [0x3efbef9e]
insd dword es:[edi], dx
insd dword es:[edi], dx
add bl, cl
mov dl, 0x65
adc ebp, dword [ebx + 0x54563b37]
xor byte [ebx], bl
mov byte [edx], cl
jl 0x492d6d
fsubp st(0)
mov ah, 0x51
inc ecx
xlatb
pop ds
mov eax, dword [0x5c37abd4]
and eax, dword [eax]
inc esi
and dh, byte [ebp - 0x68]
xor al, dl
daa
mov dword ds:[0xf03a3b6b], eax
add al, 0x60
adc al, 0x51
and al, 0xb
cmp esi, eax
ja 0x492dc1
adc esp, eax
imul ecx, eax, 0x1b
iretd

Function at 0x496400
Capabilities:
Encode data using xor

Disassembly:
push esi
cli
lodsb al, byte [esi]
cmp dword [ecx - 0x657e2148], ecx
pop ecx
cmp esp, 0xffffffb6
fadd qword [esi + 0x1e]
daa
lea ebx, [edi - 0x64]
jg 0x496463
mov ecx, 0xb26ca67a
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
and esp, dword [esi - 0x49]
mov di, word ds:[eax + 0x10]
inc edx
pop ebp
add eax, 0x4c34c06d
rcr dword [eax - 0x19], cl
mov ch, 0x96
popfd
inc esp
cmp al, 0x82
xor dl, 0x1f
adc byte [ebp + 0x10], al
pop eax
test byte [ebx], bh
in al, 0xee
invalid
add byte [ebx + 0x67], ch
invalid

Function at 0x4a112e
Capabilities:
Encode data using xor

Disassembly:
dec ecx
test eax, 0x7aa3633e
pop ecx
dec edi
inc ecx
imul esp, dword [ebp + 0x202c2d97], 0xfffffff0
inc esi
outsb dx, byte [esi]
mov ebx, 0xb23b85e8
pop eax
add dword [eax + 0x4c4dc94], eax
sub eax, 0x2d115d01
add eax, 0x442a85c6
or bh, byte [edx - 0x55]
mov eax, 0x7b504791
add al, 0xc9
inc ebp
add cl, byte [eax + 0x257d614c]
mov ch, 0x3e
dec edi
invalid
ja 0x4a10a4
daa
int3
mov ax, si
dec ebp
jg 0x4a1160
das
xchg esi, eax
imul ebp, dword [ebx], 0xffffffb8
mov edx, dword [eax]
inc edx
push esi
pop esi
test ch, dl
scasb al, byte es:[edi]
outsb dx, byte [esi]
sbb edx, dword [ebx]
das
push es
pop ds
test eax, 0x7355fc21
out 0x57, eax
bound esp, qword [ebx - 0x4c753f96]
jl 0x4a1118
sahf
jg 0x4a1142
jbe 0x4a1161
and dword [esi], ecx
and al, byte [edx + 0x17]
pop ss
invalid

Function at 0x4aa50d
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x91952b15
salc
jg 0x4aa548
into
int 0x9d
push ecx
or byte [edi - 0x15], ah
ret
xchg ebx, eax
rol byte [ebx - 0x1e], 0xa5
loop 0x4aa4fa
wait
push edi
push es
sub al, 0x35
xchg ebp, eax
xchg byte [edi], ah
xchg ebp, eax
imul ebx
invalid
sub edi, eax
add edi, ecx
push es
aad 0xcb
aad 0x9f
inc esp
cwde
push esp
dec eax
mov esi, 0xb0fb7cd6
or al, 0xaf
adc edx, edx
xor eax, 0x75c9f2f5
test eax, 0xa0c42b56
and eax, dword [ebp + 0x2214da3b]
invalid

Function at 0x4aacda
Capabilities:
Encode data using xor

Disassembly:
xor ah, ah
rol dword [eax], cl
insd dword es:[edi], dx
sbb eax, 0xb3888c05
dec edx
invalid
Function at 0x4ab67d
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
add eax, 0x79482d66
add edi, dword [edi + 0x67]
sbb dword [ecx + 0x64], esp
invalid
mov edi, 0x2eaede60
mov eax, dword [edx - 0x524698e2]
mov al, byte [0xd5af7a65]
adc bh, byte [0x2c8659b7]
mov ecx, 0x7a65a0ad
scasd eax, dword es:[edi]
jp 0x4ab620
aad 0x12
cmp eax, 0x2c8659b7
lea ebx, [edx - 0x199877f5]
lds ebp, [eax + 0x6a]
add eax, 0x1d07f651
sub bl, byte [eax - 0x4006772b]
push edi
push ds
mov ebx, dword [edi - 0x23afbc8e]
out 0x32, al
test dword [esi + eax*4], 0x163b00bf
insd dword es:[edi], dx
out 0xc5, al
push 0xf651056a
pop es
sbb eax, 0x88d5982a
stc
mov edi, 0x9f8b1e57
jb 0x4ab6d5
push eax
fsubr st(6), st(0)
xor dh, bh
add al, 0x86
mov edi, 0x6d163b00
adc ecx, dword [edx]
sbb byte [edi + 0xc], dl
jns 0x4ab6b3
loop 0x4ab705
jo 0x4ab662
inc edx
cmp eax, 0xb92312ae
bound ebx, qword [edx + 0x196a4d57]
dec ebp
push 0x19
insb byte es:[edi], dx
std
ficom word [0xf57eac23]
xor esi, edi
adc bl, byte [0x2f6afa13]
and dword [ebx + 0x6f], ebp
std
jb 0x4ab745
pop edi
xchg esi, eax
pop es
inc ebx
jo 0x4ab66b
stc
pop ebp
aad 8
arpl word [ebx], di
or byte [ebx + 0x3b], ah
pop dword [0x245fcd65]
push edi
rcl dword [edi + 0x5d]
adc bh, byte [edx]
leave
call 0x9baa17cf
ja 0x4ab66e
test byte [0x3cf6d010], bl
invalid
test al, 0x8f
cmp al, 0x64
sahf
add edx, dword [esi]
mov edi, 0x96a6e59e
in al, 0xe3
mov ecx, 0x3ccbdc1f
pop ebp
fst qword [ebx]
xor cl, byte [ebp - 0x5e2b329b]
xor dword [edi + 0x74d60d57], ebp
invalid
adc dh, byte [edi + 0x376d8b3b]
sub dword [edi], eax
xchg dword [esi - 0xcc39874], eax
cmp al, 0xf3
xor ecx, dword [ecx + 0x346da7f5]
and byte [edi + 0x4a], dh
pushal
pushfd
imul esp, dword [esi - 0x2d], 0x60dc084a
cmp ebp, edi
jns 0x4ab750
adc eax, 0x2a6fd419
retf
Function at 0x4ba4c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2378
cmp edx, dword [eax]
je 0x4ba4e3
add eax, 8
inc ecx
cmp eax, 0x4c2408
jl 0x4ba4d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2378]
jne 0x4ba611
mov eax, dword [0x4c6cfc]
cmp eax, 1
je 0x4ba5eb
test eax, eax
jne 0x4ba514
cmp dword [0x4c22a0], 1
je 0x4ba5eb
cmp edx, 0xfc
je 0x4ba611
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba54b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baea0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb330
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba58e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb330
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf95c
push edi
call fcn.004bd200
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baea0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baeb0
lea eax, [ebp - 0xa0]
push 0x4bf93c
push eax
call fcn.004baeb0
push dword [esi + 0x4c237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baeb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd174
add esp, 0x2c
pop edi
jmp 0x4ba611
lea eax, [ebp + 8]
lea esi, [esi + 0x4c237c]
push 0
push eax
push dword [esi]
call fcn.004bb330
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4026c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b5d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x425450]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x40], 0
je 0x4027e5
cmp byte [ebx + 0x45], 0
je 0x4027e5
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x402714
xor al, al
jmp 0x4027e7
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x40]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40277e
dec eax
je 0x402782
sub eax, 2
je 0x4027ce
xor bl, bl
jmp 0x4027d0
mov byte [ebx + 0x45], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x4027b4
push dword [ebx + 0x50]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00406e5a
add esp, 0x10
cmp esi, eax
jne 0x40277a
cmp byte [ebx + 0x45], 0
je 0x4027ce
test esi, esi
jne 0x402744
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00403380
jmp 0x402744
mov bl, 1
cmp dword [ebp - 0x14], 0x10
jb 0x4027e1
push dword [ebp - 0x28]
call fcn.00405bd2
add esp, 4
mov al, bl
jmp 0x4027e7
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407411
mov esp, ebp
pop ebp
ret
Function at 0x404270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b788
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x425450]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 8]
cmp ecx, 0xffffffff
jne 0x4042ac
xor eax, eax
jmp 0x40443c
mov eax, dword [ebx + 0x20]
mov edx, dword [eax]
test edx, edx
je 0x4042da
mov esi, dword [ebx + 0x30]
mov edi, dword [esi]
lea eax, [edi + edx]
cmp edx, eax
jae 0x4042da
lea eax, [edi - 1]
mov dword [esi], eax
mov ecx, dword [ebx + 0x20]
mov edx, dword [ecx]
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov byte [edx], al
jmp 0x40443c
cmp dword [ebx + 0x50], 0
jne 0x4042e8
or eax, 0xffffffff
jmp 0x40443c
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x44]
cmp dword [esi], eax
jne 0x404309
mov ecx, dword [ebx + 0x38]
mov edx, dword [ebx + 0x3c]
mov dword [esi], ecx
sub edx, ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp + 8]
mov dword [eax], edx
cmp dword [ebx + 0x40], 0
jne 0x40432e
push dword [ebx + 0x50]
movsx eax, cl
push eax
call fcn.00406a90
or ecx, 0xffffffff
add esp, 8
cmp eax, ecx
cmovne ecx, dword [ebp + 8]
mov eax, ecx
jmp 0x40443c
mov byte [ebp - 0x2c], cl
lea eax, [ebp - 0x28]
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x30]
mov esi, dword [ebx + 0x40]
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edi, dword [esi]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x34]
mov ecx, esi
push eax
lea eax, [ebp - 0x2b]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebx + 0x48]
push eax
call dword [edi + 0x1c]
test eax, eax
js 0x404426
cmp eax, 1
jg 0x404406
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub esi, eax
je 0x4043d7
push dword [ebx + 0x50]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.00406e5a
add esp, 0x10
cmp esi, eax
jne 0x404426
lea eax, [ebp - 0x2c]
mov byte [ebx + 0x45], 1
cmp dword [ebp - 0x34], eax
jne 0x404401
test esi, esi
jne 0x404361
cmp dword [ebp - 0x18], 0x20
jae 0x404426
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.00403380
jmp 0x404361
mov ebx, dword [ebp + 8]
jmp 0x404429
cmp eax, 3
jne 0x404426
push dword [ebx + 0x50]
push dword [ebp - 0x2c]
call fcn.00401250
or ecx, 0xffffffff
add esp, 8
test al, al
cmovne ecx, dword [ebp + 8]
mov ebx, ecx
jmp 0x404429
or ebx, 0xffffffff
cmp dword [ebp - 0x14], 0x10
jb 0x40443a
push dword [ebp - 0x28]
call fcn.00405bd2
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407411
mov esp, ebp
pop ebp
ret 4
Function at 0x41545f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x425450]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a0bb
mov dword [ebp - 0x14], eax
cmp dword [0x427d20], esi
jne 0x415552
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4154df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x415632
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x415632
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x415632
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x427d20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x427d24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x427d28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x427d30], eax
test eax, eax
je 0x41554f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x427d2c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x415577
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41556a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41558c
push 4
pop eax
jmp 0x415634
cmp dword [ebp - 0x14], esi
je 0x41558c
push dword [0x427d20]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x415571
mov eax, dword [0x427d2c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4155ea
cmp dword [0x427d30], edi
je 0x4155ea
push eax
call ebx
push dword [0x427d30]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4155ea
test eax, eax
je 0x4155ea
call ecx
test eax, eax
je 0x4155df
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4155df
test byte [ebp - 8], 1
jne 0x4155ea
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41561a
mov eax, dword [0x427d24]
cmp eax, edi
je 0x415617
push eax
call ebx
test eax, eax
je 0x415617
call eax
mov esi, eax
test esi, esi
je 0x415617
mov eax, dword [0x427d28]
cmp eax, edi
je 0x415617
push eax
call ebx
test eax, eax
je 0x415617
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x427d20]
call ebx
test eax, eax
je 0x415632
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x415634
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407411
mov esp, ebp
pop ebp
ret