joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f259
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.0040cc9d
test eax, eax
jne 0x40f26a
leave
ret
push ebx
push 4
pop eax
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push ebx
push eax
mov dword [ebp - 8], ebx
call fcn.0040c7a5
test eax, eax
pop ecx
pop ecx
jne 0x40f28f
inc eax
jmp 0x40f328
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x423420
push dword [ebp - 4]
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
jne 0x40f2d5
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x423430
push dword [ebp - 4]
call edi
mov esi, eax
neg esi
sbb esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x40f2e7
xor eax, eax
inc eax
jmp 0x40f326
cmp dword [0x429854], ebx
jne 0x40f2e2
xor esi, esi
inc esi
cmp dword [ebp + 8], ebx
jne 0x40f318
push 0x429854
push ebx
push ebx
push fcn.0040f06b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x40f324
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40f324
push ebx
mov dword [0x429854], esi
call fcn.0040f06b
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f3ee
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x208
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x42356c
lea eax, [ebp + 0x6c]
push eax
mov dword [ebp + 0x70], 3
call esi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x6c]
push eax
push 0x423570
xor edi, edi
push edi
call fcn.0040c87a
push edi
push str.Country
call fcn.0040d51a
push str.country_code_is_deleted_after_checker_fail_to_download
call fcn.0040c059
add esp, 0x1c
push 0x4235b7
lea eax, [ebp - 0x194]
push eax
mov dword [ebp + 0x70], 0x100
call esi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x194]
push eax
push str.PostStatusUrl
push edi
call fcn.0040c87a
add esp, 0x10
push 0x4235c8
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x14]
push eax
push str.InstalledJREVersion
push edi
mov dword [ebp + 0x70], 0x80
call fcn.0040c87a
add esp, 0x10
push 0x4235e0
lea eax, [ebp - 0x94]
push eax
call esi
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp - 0x94]
push eax
push str.NewJREVersion
push edi
mov dword [ebp + 0x70], 0x80
call fcn.0040c87a
push edi
push edi
push edi
push edi
push edi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x14]
push edi
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp + 0x6c]
push eax
push 0x4235f4
lea eax, [ebp - 0x194]
push edi
push eax
call fcn.0040d683
add esp, 0x44
pop edi
pop esi
add ebp, 0x74
leave
ret
Function at 0x411ee6
Capabilities:
Create process on windows

Disassembly:
cmp word [esp + 8], 0xcc
jne 0x411f08
push 1
xor eax, eax
push eax
push eax
add ecx, 0x520
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
ret 0x10

Function at 0x412101
Capabilities:
Create thread

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
mov esi, ecx
lea edi, [esi + 0x720]
push edi
call ebp
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
jle 0x412128
push edi
push dword [esi + 4]
call ebx
lea edi, [esi + 0x20]
push edi
call ebp
test eax, eax
jne 0x412146
push 0x400
push edi
push 0x7e
push dword [0x4298bc]
call dword [sym.imp.USER32.dll_LoadStringA]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x98
push dword [esi + 4]
call edi
lea ecx, [esi + 0x20]
push ecx
push eax
call ebx
push 0xffffff
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0xcc
push dword [esi + 4]
mov dword [esi + 0x7c0], eax
xor eax, eax
mov dword [esi + 0x7a0], eax
mov dword [esi + 0x7c4], eax
mov dword [esi + 0x7c8], eax
call edi
push 0xfffffffffffffff0
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x100
push eax
push 0xfffffffffffffff0
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0xc9
push dword [esi + 4]
call edi
mov dword [esp + 0x10], eax
lea eax, [esi + 0x420]
push eax
call ebp
test eax, eax
jne 0x4121e0
push 0x100
lea eax, [esi + 0x420]
push eax
push 0x7b
push dword [0x4298bc]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esi + 0x420]
push eax
push dword [esp + 0x14]
call ebx
lea eax, [esi + 0x620]
push eax
call ebp
test eax, eax
jle 0x41220e
push 0xcc
push dword [esi + 4]
call edi
lea ecx, [esi + 0x620]
push ecx
push eax
call ebx
xor ebp, ebp
push ebp
push ebp
push 1
push ebp
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push ebp
push ebp
push 1
push ebp
mov dword [esi + 0x7cc], eax
lea ebx, [esi + 0x7d0]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [esi + 0x7cc]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esp + 0x14]
push eax
push ebp
push esi
push 0x41209f
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebp
je 0x412267
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push dword [esi + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
pop ecx
pop ecx
ret 0x10
Function at 0x412e82
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4298ac], 0
push esi
jne 0x412df5
call fcn.00412d20
test eax, eax
je 0x412e38
mov eax, dword [0x4298ac]
cmp eax, 1
jne 0x412e16
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412e38
pop esi
ret
push eax
call dword [0x4298b4]
test eax, eax
jne 0x412e80
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x412e3c
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4298ac]
call dword [0x4298b4]
mov edi, eax
test edi, edi
je 0x412e63
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x412e7f
lea edi, [esi + 0xff0]
push esi
push dword [0x4298ac]
call dword [0x4298b0]
add esi, 0x10
cmp esi, edi
jb 0x412e69
mov eax, esi
pop edi
pop esi
ret
jmp 0x412de2

Function at 0x4139ad
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00413970
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x413a48
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x429af4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x413a48
cmp eax, 1
je 0x413a69
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x413a48
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x413a15
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x413a44
xor eax, eax
inc eax
jmp 0x413a88
cmp edi, eax
jae 0x413a4c
xor eax, eax
jmp 0x413a88
cmp eax, esi
jae 0x413a53
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x429af4]
jmp 0x413a6c
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415080
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4150ae
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4150b5
cmp ebx, dword [eax + 4]
jae 0x4150b5
xor eax, eax
jmp 0x4152a5
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4150c6
xor eax, eax
inc eax
jmp 0x4152a4
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4150dc
cmp ecx, edx
jae 0x415221
cmp dword [eax + 4], 0
je 0x4150e5
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4150cd
cmp dword [ebp + 8], 0
je 0x415107
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x415221
cmp eax, esi
jae 0x415221
mov eax, dword [0x429950]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x41512c
cmp dword [esi*4 + 0x429958], edi
je 0x415225
inc esi
cmp esi, eax
jl 0x41511a
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4152a1
cmp dword [ebp - 8], 0x1000000
jne 0x4152a1
test byte [ebp - 0xc], 0xcc
je 0x4151aa
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4152a1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4152a1
cmp word [eax + 0x18], 0x10b
jne 0x4152a1
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4152a1
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4151aa
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4151aa
test byte [ecx + 0x27], 0x80
jne 0x415221
push 1
push 0x429998
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4150be
mov ecx, dword [0x429950]
test ecx, ecx
mov edx, ecx
jle 0x4151de
lea eax, [ecx*4 + 0x429954]
cmp dword [eax], edi
je 0x4151de
dec edx
sub eax, 4
test edx, edx
jg 0x4151d2
test edx, edx
jne 0x41520f
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4151eb
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x415203
lea eax, [edx*4 + 0x429958]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4151f1
cmp ecx, 0x10
jge 0x41520f
inc ecx
mov dword [0x429950], ecx
push 0
push 0x429998
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4150be
xor eax, eax
jmp 0x4152a4
test esi, esi
jle 0x4150be
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x429998
call ebx
test eax, eax
jne 0x4150be
cmp dword [esi*4 + 0x429958], edi
je 0x41527b
mov eax, dword [0x429950]
lea esi, [eax - 1]
test esi, esi
jl 0x415269
cmp dword [esi*4 + 0x429958], edi
je 0x415265
dec esi
jns 0x415259
test esi, esi
jge 0x415279
cmp eax, 0x10
jge 0x415274
inc eax
mov dword [0x429950], eax
lea esi, [eax - 1]
jmp 0x41527b
je 0x415293
xor ecx, ecx
test esi, esi
jl 0x415293
lea eax, [ecx*4 + 0x429958]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x415281
push 0
push 0x429998
call ebx
jmp 0x4150be
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4160e1
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4241a8
call fcn.00413000
push 8
call fcn.00415467
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x429b34], esi
jne 0x416115
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x429b30], esi
mov al, byte [ebp + 0x10]
mov byte [0x429b2c], al
cmp dword [ebp + 0xc], edi
jne 0x41615f
cmp dword [0x42b1a8], edi
je 0x41614f
mov eax, dword [0x42b1a4]
sub eax, 4
mov dword [0x42b1a4], eax
cmp eax, dword [0x42b1a8]
jb 0x41614f
mov eax, dword [eax]
cmp eax, edi
je 0x416130
call eax
jmp 0x416130
push 0x42803c
mov eax, 0x428034
call fcn.0041605f
pop ecx
push 0x428048
mov eax, 0x428040
call fcn.0041605f
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x416190
cmp dword [ebp + 0x10], edi
jne 0x41619e
mov dword [0x429b34], esi
push dword [ebp + 8]
call fcn.0041601d
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x41619d
push 8
call fcn.004153b2
pop ecx
ret
call fcn.0041303b
ret

Function at 0x41a266
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x428770]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x428f20]
je 0x41a29b
inc eax
cmp eax, 0x13
jb 0x41a28c
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x428f20]
jne 0x41a3c1
mov eax, dword [0x42994c]
cmp eax, 1
je 0x41a399
cmp eax, edx
jne 0x41a2cb
cmp dword [0x428764], 1
je 0x41a399
cmp ecx, 0xfc
je 0x41a3c1
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41a301
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0041ba00
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00418f80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41a335
mov eax, edi
push eax
call fcn.00418f80
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x424e58
push edi
call fcn.004143c0
add esp, 0x10
push edi
call fcn.00418f80
push dword [esi + 0x428f24]
mov ebx, eax
call fcn.00418f80
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00413970
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0041ba00
push edi
push ebx
call fcn.0041ba10
push 0x424e38
push ebx
call fcn.0041ba10
push dword [esi + 0x428f24]
push ebx
call fcn.0041ba10
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0041cf35
add esp, 0x2c
jmp 0x41a3c1
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x428f24]
push dword [esi]
call fcn.00418f80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0041500e
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x41b164
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x428770]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x41b195
xor eax, eax
jmp 0x41b31e
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x429e40]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x41b1d1
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0041d39b
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x41b2ac
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x41b2ea
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x41b235
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x41b226
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x41b206
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41b275
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x41b27e
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x41b1f7
jmp 0x41b280
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x41b319
cmp dword [ebp - 0x6c], edi
je 0x41b2ea
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x41b2df
call fcn.0041ae9d
mov dword [eax], 9
call fcn.0041aea6
mov dword [eax], esi
jmp 0x41b314
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41b2d4
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x41b280
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x41b280
push dword [ebp - 0x6c]
call fcn.0041aeaf
pop ecx
jmp 0x41b314
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x41b302
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x41b302
xor eax, eax
jmp 0x41b31c
call fcn.0041ae9d
mov dword [eax], 0x1c
call fcn.0041aea6
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x41b31c
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.0041500e
add ebp, 0x3a0
leave
ret
Function at 0x41cf35
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x429dec], ebx
push esi
push edi
jne 0x41cfb5
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41cff0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4252b0
push edi
call esi
test eax, eax
mov dword [0x429dec], eax
je 0x41cff0
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x429df0], eax
call esi
cmp dword [0x429af4], 2
mov dword [0x429df4], eax
jne 0x41cfb5
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x429dfc], eax
je 0x41cfb5
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x429df8], eax
mov eax, dword [0x429df8]
test eax, eax
je 0x41cffa
call eax
test eax, eax
je 0x41cfe1
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x429dfc]
test eax, eax
je 0x41cfe1
test byte [ebp - 8], 1
jne 0x41cffa
cmp dword [0x429b00], 4
jb 0x41cff4
or byte [ebp + 0x12], 0x20
jmp 0x41d019
xor eax, eax
jmp 0x41d029
or byte [ebp + 0x12], 4
jmp 0x41d019
mov eax, dword [0x429df0]
test eax, eax
je 0x41d019
call eax
mov ebx, eax
test ebx, ebx
je 0x41d019
mov eax, dword [0x429df4]
test eax, eax
je 0x41d019
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x429dec]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41dc98
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x41de6c
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x429e40]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x41de6c
test cl, 0x48
je 0x41dd03
cmp byte [eax + 5], 0xa
je 0x41dd03
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41dd55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x41dd3d
call fcn.0041ae9d
mov dword [eax], 9
call fcn.0041aea6
mov dword [eax], esi
jmp 0x41dd4d
cmp eax, 0x6d
je 0x41de6c
push eax
call fcn.0041aeaf
pop ecx
or eax, 0xffffffff
jmp 0x41de6e
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x41de67
test eax, eax
je 0x41dd7c
cmp byte [ebx], 0xa
jne 0x41dd7c
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x41dd85
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x41de61
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x41de51
cmp al, 0xd
je 0x41ddb7
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x41de43
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x41ddd1
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x41ddcc
add dword [ebp + 0x10], 2
jmp 0x41de25
mov dword [ebp + 0x10], eax
jmp 0x41de3f
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41ddf9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41de3f
cmp dword [ebp - 0xc], 0
je 0x41de3f
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x41de1a
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x41de25
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x41de42
cmp ebx, dword [ebp + 0xc]
jne 0x41de2a
cmp byte [ebp - 1], 0xa
jne 0x41de2a
mov byte [ebx], 0xa
jmp 0x41de42
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041b045
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x41de43
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x41dd9b
jmp 0x41de61
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x41de61
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x41de6e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret