joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x44e018]
xor eax, ebp
mov dword [ebp - 4], eax
fld qword [ebp + 0xc]
mov eax, dword [ebp + 8]
fld st(0)
push ebx
fld st(1)
mov dword [ebp - 0x2c], eax
fldz
push esi
fld st(0)
push edi
fucomp st(2)
lea esi, [ebp - 0x20]
fnstsw ax
fstp st(1)
test ah, 0x44
jp 0x43239b
fstp st(2)
mov al, 0x30
fstp st(0)
lea ecx, [ebp - 0x1d]
fstp st(0)
mov word [ebp - 0x20], 0x2e30
mov byte [ebp - 0x1e], al
mov dword [ebp - 0x24], ecx
jmp 0x4323d9
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x4323b1
fstp st(0)
mov byte [ebp - 0x20], 0x2d
lea esi, [ebp - 0x1f]
fchs
jmp 0x4323b3
fstp st(1)
sub esp, 8
lea edx, [ebp - 0x28]
fstp qword [esp]
push edx
push esi
lea eax, [ebp - 0x24]
call fcn.00421a20
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
add esp, 0x10
mov ecx, esi
call fcn.00421b80
mov dword [ebp - 0x24], eax
lea edi, [ebp - 0x20]
mov eax, edi
cmp eax, dword [ebp - 0x24]
je 0x432458
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov esi, dword [eax]
movsx cx, byte [edi]
mov eax, dword [esi + 0xc]
movzx ebx, cx
cmp eax, dword [esi + 8]
jb 0x432418
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x432418
mov edx, dword [esi]
push edx
sub eax, ecx
push eax
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
mov eax, dword [esi + 4]
add esp, 0x10
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0xc]
mov byte [ecx], bl
inc dword [esi + 0xc]
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
jb 0x432447
mov ecx, dword [esi + 4]
cmp eax, ecx
je 0x432447
mov edx, dword [esi]
push edx
sub eax, ecx
push eax
push 1
push ecx
call dword [sym.imp.MSVCR100.dll_fwrite]
mov eax, dword [esi + 4]
add esp, 0x10
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0xc]
shr ebx, 8
mov byte [ecx], bl
inc dword [esi + 0xc]
inc edi
cmp edi, dword [ebp - 0x24]
jne 0x4323e3
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00438de6
mov esp, ebp
pop ebp
ret 0xc
Function at 0x438de6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44e018]
jne 0x438df0
repz ret
jmp fcn.00439313
Function at 0x401490
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x40307c
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov dword [0x4060f0], eax
xor eax, eax
mov al, byte [0x4060f1]
mov dword [0x4060fc], eax
mov eax, dword [0x4060f0]
shr dword [0x4060f0], 0x10
and eax, 0xff
mov dword [0x4060f8], eax
shl eax, 8
add eax, dword [0x4060fc]
mov dword [0x4060f4], eax
call fcn.00401650
mov dword [ebp - 4], 0
call fcn.00402ea0
call fcn.00402e90
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x408080], eax
call fcn.00402a30
mov dword [0x4060a8], eax
test eax, eax
je 0x401529
cmp dword [0x408080], 0
jne 0x401533
push 0xffffffffffffffff
call fcn.00402310
add esp, 4
call fcn.004027b0
call fcn.004026d0
call fcn.004022e0
mov esi, dword [0x408080]
mov al, byte [esi]
cmp al, 0x22
je 0x40155a
cmp al, 0x20
jbe 0x401587
inc esi
cmp byte [esi], 0x20
ja 0x401552
jmp 0x401587
inc esi
cmp byte [esi], 0x22
je 0x401586
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x401581
xor eax, eax
mov al, bl
push eax
call fcn.00402670
add esp, 4
test eax, eax
je 0x40157b
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x401563
cmp byte [esi], 0x22
jne 0x401587
inc esi
cmp byte [esi], 0
je 0x401597
cmp byte [esi], 0x20
ja 0x401597
inc esi
cmp byte [esi], 0
jne 0x40158c
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x4015bb
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
push eax
call fcn.00402310
jmp 0x4015fc
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402350
Capabilities:
Terminate process

Disassembly:
mov dword [0x406128], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x406124], bl
jne 0x4023ac
cmp dword [0x408078], 0
je 0x40239a
mov esi, dword [0x408070]
sub esi, 4
cmp esi, dword [0x408078]
jb 0x40239a
mov eax, dword [esi]
test eax, eax
je 0x40238f
call eax
sub esi, 4
cmp esi, dword [0x408078]
jae 0x402387
push 0x40601c
push 0x406014
call fcn.004023d0
add esp, 8
push 0x406024
push 0x406020
call fcn.004023d0
add esp, 8
test ebx, ebx
jne 0x4023cd
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
pop esi
pop ebx
ret
Function at 0x402a30
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
cmp dword [0x4061d0], 0
push ebx
push esi
push edi
push ebp
jne 0x402a80
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
call esi
mov edi, eax
test edi, edi
je 0x402a5e
mov dword [0x4061d0], 1
mov ebx, dword [esp + 0x10]
jmp 0x402a8e
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x402a76
mov dword [0x4061d0], 2
jmp 0x402a8e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsW]
cmp dword [0x4061d0], 1
jne 0x402b3d
test edi, edi
jne 0x402ab1
call esi
mov edi, eax
test edi, edi
jne 0x402ab1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x402acb
add esi, 2
cmp word [esi], 0
jne 0x402ab9
add esi, 2
cmp word [esi], 0
jne 0x402ab9
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x402b2c
push ebp
call fcn.00401410
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x402b2c
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test eax, eax
jne 0x402b1b
push ebx
call fcn.00401360
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x4061d0], 2
jne 0x402bc1
test ebx, ebx
jne 0x402b60
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x402b60
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x402b75
inc ebp
cmp byte [ebp], 0
jne 0x402b67
inc ebp
cmp byte [ebp], 0
jne 0x402b67
sub ebp, ebx
inc ebp
push ebp
call fcn.00401410
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x402b9a
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.DLL_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x4031a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor eax, eax
mov ecx, 0x406660
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [ecx], edx
je 0x4031c8
add ecx, 8
inc eax
cmp ecx, 0x4066e8
jb 0x4031b8
cmp dword [eax*8 + 0x406660], edx
lea ebx, [eax*8]
jne 0x403383
cmp dword [0x4060b4], 1
je 0x403348
cmp dword [0x4060b4], 0
jne 0x4031ff
cmp dword [0x4060b8], 1
je 0x403348
cmp edx, 0xfc
je 0x403383
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x40323c
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x403280
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x406734
push ebp
call fcn.00403a20
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x406714
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x406664]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00403980
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x407f70]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x40335f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x406664]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x403390
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x407f60], edx
push ebx
push esi
push edi
push ebp
jbe 0x403597
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x407f70
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x403597
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x4033f9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x40340a
push 2
push 0
push edx
call fcn.004035c0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x4034a6
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x430]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x4034df
lea ebx, [esp + 0x24]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x40346d
mov al, byte [edi]
inc edi
cmp al, 0xa
jne 0x40345b
mov byte [ebx], 0xd
inc esi
inc ebx
mov byte [ebx], al
inc ebx
mov eax, ebx
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x403442
lea eax, [esp + 0x24]
push 0
sub ebx, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push ebx
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4034d5
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, ebx
jge 0x40342d
jmp 0x4034df
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x4034d5
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x4034df
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x403586
cmp dword [esp + 0x10], 0
je 0x403538
cmp dword [esp + 0x10], 5
jne 0x40351b
mov dword [0x4060e4], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x4060e8], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00403a50
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x403562
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x403562
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4060e4], 0x1c
mov dword [0x4060e8], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4060e4], 9
mov dword [0x4060e8], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x407e10
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x154
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp + 0x5c], eax
mov bl, 0x65
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
sub eax, dword [esp + 0x5c]
cmp eax, 0x1f4
jbe 0x407e34
call ebp
sub eax, dword [esp + 0x5c]
cmp eax, 0x28a
jae 0x407e34
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x14]
push ecx
mov byte [esp + 0x18], 0x6b
mov byte [esp + 0x19], bl
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x6c
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x22], 0x6c
mov byte [esp + 0x23], 0x6c
mov byte [esp + 0x24], 0
mov byte [esp + 0x4c], 0x47
mov byte [esp + 0x4d], bl
mov byte [esp + 0x4e], 0x74
mov byte [esp + 0x4f], 0x4d
mov byte [esp + 0x50], 0x6f
mov byte [esp + 0x51], 0x64
mov byte [esp + 0x52], 0x75
mov byte [esp + 0x53], 0x6c
mov byte [esp + 0x54], bl
mov byte [esp + 0x55], 0x46
mov byte [esp + 0x56], 0x69
mov byte [esp + 0x57], 0x6c
mov byte [esp + 0x58], bl
mov byte [esp + 0x59], 0x4e
mov byte [esp + 0x5a], 0x61
mov byte [esp + 0x5b], 0x6d
mov byte [esp + 0x5c], bl
mov byte [esp + 0x5d], 0x41
mov byte [esp + 0x5e], 0
mov byte [esp + 0x30], 0x4d
mov byte [esp + 0x31], 0x6f
mov byte [esp + 0x32], 0x76
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], 0x46
mov byte [esp + 0x35], 0x69
mov byte [esp + 0x36], 0x6c
mov byte [esp + 0x37], bl
mov byte [esp + 0x38], 0x45
mov byte [esp + 0x39], 0x78
mov byte [esp + 0x3a], 0x41
mov byte [esp + 0x3b], 0
call edi
push eax
call esi
lea edx, [esp + 0x28]
mov ebp, eax
push edx
lea eax, [esp + 0x14]
push eax
call edi
push eax
call esi
push 0x103
lea ecx, [esp + 0x65]
push 0
push ecx
mov dword [esp + 0x64], eax
mov byte [esp + 0x6c], 0
call fcn.0040c420
add esp, 0xc
push 0x104
lea edx, [esp + 0x64]
push edx
push 0
call ebp
push 2
push 0
lea eax, [esp + 0x68]
push eax
call dword [esp + 0x64]
test eax, eax
jne 0x408040
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x3c], 0x43
mov byte [esp + 0x3d], 0x72
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], 0x61
mov byte [esp + 0x40], 0x74
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x54
mov byte [esp + 0x43], 0x68
mov byte [esp + 0x44], 0x72
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x61
mov byte [esp + 0x47], 0x64
mov byte [esp + 0x48], al
mov byte [esp + 0x28], 0x53
mov byte [esp + 0x29], 0x6c
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], bl
mov byte [esp + 0x2c], 0x70
mov byte [esp + 0x2d], al
call edi
push eax
call esi
mov dword [esp + 0x58], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
call edi
push eax
call esi
push 0
push 0
push 0
push 0x407dd0
push 0
push 0
mov ebp, eax
call dword [esp + 0x70]
push 0x1388
call ebp
push 0x1388
mov byte [0x411c5a], 0x55
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x407e34
jmp 0x408040
Function at 0x408050
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x412898
push 0x67
push esi
call edi
push 0x64
push 0x4127d0
push 0x6d
push esi
call edi
mov eax, esi
call fcn.00408150
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x412898
push 0x4127d0
push 0
mov dword [0x4127cc], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x408142
mov eax, dword [esp + 0x34]
push eax
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
call edi
test eax, eax
je 0x408136
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ecx]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push esi
push eax
call ebx
test eax, eax
jne 0x408123
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
jne 0x408100
pop ebp
pop ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
Function at 0x40a303
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004091eb
and dword [ebp - 4], 0
cmp dword [0x412380], 0
mov ebx, eax
jne 0x40a3b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a465
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a465
push eax
call fcn.00409179
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412380], eax
call esi
push eax
call fcn.00409179
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412384], eax
call esi
push eax
call fcn.00409179
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412388], eax
call esi
push eax
call fcn.00409179
pop ecx
mov dword [0x412390], eax
test eax, eax
je 0x40a3b4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409179
pop ecx
mov dword [0x41238c], eax
mov eax, dword [0x41238c]
cmp eax, ebx
je 0x40a40c
cmp dword [0x412390], ebx
je 0x40a40c
push eax
call fcn.004091f4
push dword [0x412390]
mov esi, eax
call fcn.004091f4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a40c
test edi, edi
je 0x40a40c
call esi
test eax, eax
je 0x40a403
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a403
test byte [ebp - 0xc], 1
jne 0x40a40c
or dword [ebp + 0x10], 0x200000
jmp 0x40a445
mov eax, dword [0x412384]
cmp eax, ebx
je 0x40a445
push eax
call fcn.004091f4
pop ecx
test eax, eax
je 0x40a445
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a445
mov eax, dword [0x412388]
cmp eax, ebx
je 0x40a445
push eax
call fcn.004091f4
pop ecx
test eax, eax
je 0x40a445
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412380]
call fcn.004091f4
pop ecx
test eax, eax
je 0x40a465
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a467
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40c198
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4119f8]
jne 0x40c1a2
repz ret
jmp fcn.0040d8c5
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub esp, 0x1c0
mov eax, dword [0x41b010]
xor eax, esp
mov dword [esp + 0x1bc], eax
push esi
mov esi, dword [esp + 0x1cc]
push 0x94
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004061d0
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x28]
cmp eax, 5
ja 0x401070
jne 0x401055
cmp dword [esp + 0x2c], 1
jae 0x401070
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.004061bd
add esp, 0x1c0
ret
mov eax, dword [esp + 0x1c8]
lea edx, [esp + 0xb8]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401080
push 0x5c
push esi
call fcn.00406190
add esp, 8
test eax, eax
jne 0x4010a8
push 0x2f
push esi
call fcn.00406190
add esp, 8
test eax, eax
je 0x4010ab
inc eax
jmp 0x4010ad
mov eax, esi
mov edx, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4010b0
push edi
lea edi, [esp + 0xbc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4010c2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0xbc]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4010e2
mov edx, dword [str..manifest]
mov ecx, dword [0x414200]
mov dword [eax], edx
mov dx, word [0x414204]
push ebx
mov dword [eax + 4], ecx
push str.kernel32
mov word [eax + 8], dx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.CreateActCtxA
push esi
call ebx
push str.ActivateActCtx
push esi
mov edi, eax
call ebx
mov esi, eax
pop ebx
test edi, edi
je 0x4011af
test esi, esi
je 0x4011af
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 8]
lea eax, [esp + 0xbc]
push ecx
mov dword [esp + 0xc], 0x20
mov dword [esp + 0x14], eax
call edi
mov dword [section..data], eax
cmp eax, 0xffffffff
je 0x4011a5
push 0x41c020
push eax
call esi
test eax, eax
je 0x4011a5
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x1bc]
xor ecx, esp
call fcn.004061bd
add esp, 0x1c0
ret
mov dword [section..data], 0xffffffff
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.004061bd
add esp, 0x1c0
ret