joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0x8c]
mov ebp, dword [esp + 0x90]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x7c]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x80]
add eax, 0x6c
mov dword [esp], eax
call method.std::ctype_wchar_t__const_std::use_facet_std.ctype_wchar_t____std::locale_const_
mov ecx, eax
mov eax, dword [esp + 0x84]
mov dword [eax], 0
mov eax, dword [ecx]
mov dword [esp], 0x25
call dword [eax + 0x28]
sub esp, 4
mov word [esp + 0x48], ax
mov eax, esi
mov edx, dword [esp + 0x34]
movsx si, al
mov eax, ebp
test al, al
jne 0x432ea0
xor ecx, ecx
mov word [esp + 0x4a], si
mov word [esp + 0x4c], cx
lea eax, [esp + 0x48]
mov dword [esp + 4], ebx
mov ecx, edx
xor bx, bx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 8], edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sym.__ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE21_M_extract_via_formatES4_S4_RSt8ios_baseRSt12_Ios_Ios
sub esp, 0x20
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x3c], edx
mov edx, ebx
mov ebp, ecx
or edx, esi
cmp ax, 0xffff
mov dword [esp + 0x38], ecx
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x432ed8
cmp word [esp + 0x2c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x432e7d
test al, al
jne 0x432ec0
cmp bl, cl
jne 0x432e8b
mov eax, dword [esp + 0x84]
or dword [eax], 2
add esp, 0x5c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x24
movsx bp, al
xor eax, eax
mov word [esp + 0x4c], si
mov word [esp + 0x4a], bp
mov word [esp + 0x4e], ax
jmp 0x432df6
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x432f00
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x432e7d
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x432f18
movzx eax, word [eax]
cmp ax, 0xffff
mov ebx, 0
mov ebp, 0
cmove ebx, esi
cmovne ebp, ecx
jmp 0x432e6a
mov eax, dword [edi]
mov dword [esp + 0x2c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x2c]
jmp 0x432ecb
mov eax, dword [ecx]
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
jmp 0x432ee3
Function at 0x44f3a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x70]
mov ecx, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov edx, dword [esp + 0x6c]
mov edi, dword [esi + 0xc]
mov eax, edi
and eax, 0xffffffb5
or eax, 8
mov dword [esi + 0xc], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x68]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call method.std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t____std::num_get_wchar_t__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____._M_extract_int_unsigned_long__std::istreambuf_iterator_wchar_t__std::char_traits_wchar_t_____std::is
sub esp, 0x1c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov ecx, edx
mov dword [esp + 0x2c], eax
movzx edx, word [esp + 0x2c]
mov eax, dword [esp + 0x78]
mov dword [esi + 0xc], edi
or edx, ebx
mov ebx, dword [esp + 0x3c]
mov dword [eax], ebx
add esp, 0x4c
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
Function at 0x4540a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call method.std::time_get_char__std::istreambuf_iterator_char__std::char_traits_char_____._M_extract_num_std::istreambuf_iterator_char__std::char_traits_char_____std::istreambuf_iterator_char__std::char_traits_char_____int__int__int__unsigned_int__std::ios_ba
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x454180
mov ecx, dword [esp + 0x48]
lea esi, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, esi
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov esi, eax
setne al
mov ecx, esi
and cl, al
mov byte [esp + 0x38], cl
jne 0x4541b8
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x454158
test al, al
jne 0x454190
mov ebx, esi
cmp bl, al
jne 0x454168
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x454133
mov ebx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ebx
jb 0x454158
mov eax, dword [edi]
mov dword [esp + 0x38], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x454158
mov eax, dword [ebx + 0xc]
xor esi, esi
cmp dword [ebx + 8], eax
jb 0x45414a
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x38]
cmove esi, eax
mov eax, 0
cmovne eax, ebx
mov dword [esp + 0x34], eax
jmp 0x45414a
Function at 0x4544e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
add eax, 0x6c
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0xac]
mov dword [esp], eax
call method.std::__timepunct_char__const_std::use_facet_std.__timepunct_char____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call sym.__ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE24_M_extract_wday_or_monthES3_S3_RiPPKcjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
mov ebp, eax
mov ebx, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x454630
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp ebx, 0xffffffff
sete dl
test ecx, ecx
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x454668
cmp esi, 0xffffffff
sete al
test edi, edi
je 0x454610
test al, al
jne 0x454640
cmp dl, al
jne 0x45461e
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x4545ef
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], esi
jb 0x454610
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x454610
mov eax, dword [ecx + 0xc]
xor edx, edx
cmp dword [ecx + 8], eax
jb 0x454602
mov eax, dword [ecx]
mov byte [esp + 0x3f], dl
mov ebp, 0
mov dword [esp + 0x38], ecx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x3f]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x34]
cmovne ebp, ecx
cmove edx, eax
jmp 0x454602
Function at 0x457330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
lea eax, [edx + 0x6c]
mov edi, dword [esp + 0xb8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov edx, dword [esp + 0xc0]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x84], ecx
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x88], ecx
mov ecx, ebp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES3_S3_RiPPKwjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x4c], edx
mov edx, ebx
mov ebx, dword [esp + 0x54]
mov ebp, ecx
mov dword [esp + 0x48], ecx
or edx, esi
test ebx, ebx
jne 0x4574a0
mov ebx, dword [esp + 0xc8]
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x18], esi
cmp ax, 0xffff
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x4574c8
cmp word [esp + 0x3c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x457482
test al, al
jne 0x4574b0
cmp bl, cl
jne 0x457490
mov eax, dword [esp + 0xc4]
or dword [eax], 2
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0xc4]
or dword [esi], 4
jmp 0x45745d
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x4574f0
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x457482
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x457508
movzx eax, word [eax]
cmp ax, 0xffff
mov ebx, 0
mov ebp, 0
cmove ebx, esi
cmovne ebp, ecx
jmp 0x45746f
mov eax, dword [edi]
mov dword [esp + 0x3c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
jmp 0x4574bb
mov eax, dword [ecx]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
jmp 0x4574d3
Function at 0x46f240
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x46f263
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x46f281
mov ecx, ebx
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x46f258
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x40225f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021cb
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
jmp loc.0040a448

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret
Function at 0x40a0c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40a0d7
pop dword [ebp - 0x4c]
mov eax, 0x40a0d7
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x40db7
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x1d032e98
sub ecx, 0x1d02da35
xor edi, edi
add edi, eax
mov ebx, 0xda4f8fcb
add ebx, 0x25f3c435
add ebx, dword [ebp - 0x4c]
mov esi, 0x6778e72e
sub esi, 0xaa42c7c7
sub dword [ebp - 0x3c], 0x42852a65
mov edx, dword [ebx]
sub dword [ebp - 0x2c], 0x4ea2fd4
sub edx, esi
xor dword [ebp - 0x44], 0x3fb53a87
mov dword [edi], edx
sub dword [ebp - 0x20], eax
add edi, 4
add ebx, 0xedf386d4
add ebx, 0x120c7930
loop 0x40a12e
add eax, 0xadae62a
add eax, 0xf5265e35
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xc54ed967
sub ecx, 0xc50ed967
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x41030c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41c090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ca22
and dword [ebp - 0x14], 0
cmp dword [0x41dd94], 0
mov dword [ebp - 0x18], eax
jne 0x4103bf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x410467
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x410467
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41dd94], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41dd98], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41dd9c], eax
call edi
push eax
call esi
mov dword [0x41dda4], eax
test eax, eax
je 0x4103bf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41dda0], eax
mov eax, dword [0x41dda0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x410418
cmp dword [0x41dda4], ecx
je 0x410418
push eax
call esi
push dword [0x41dda4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x410418
test ebx, ebx
je 0x410418
call edi
test eax, eax
je 0x41040f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41040f
test byte [ebp - 8], 1
jne 0x410418
or dword [ebp + 0x10], 0x200000
jmp 0x41044b
mov eax, dword [0x41dd98]
cmp eax, dword [ebp - 0x18]
je 0x41044b
push eax
call esi
test eax, eax
je 0x41044b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41044b
mov eax, dword [0x41dd9c]
cmp eax, dword [ebp - 0x18]
je 0x41044b
push eax
call esi
test eax, eax
je 0x41044b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41dd94]
call esi
test eax, eax
je 0x410467
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x410469
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a138
leave
ret
Function at 0x408fab
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x408fcc
jl 0x408fc3
test edi, edi
jne 0x408fcc
xor eax, eax
xor edx, edx
jmp 0x40908d
cmp dword [ebx + 0x38], 0
je 0x408fe1
push eax
push edi
push dword [ebp + 8]
call fcn.00409093
jmp 0x40908d
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x409028
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x409028
cmp eax, edi
jb 0x409002
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00409ff0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40902e
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x409082
mov ecx, ebx
call fcn.00408721
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40906d
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.004130b2
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x409082
jmp 0x409040
test edx, edx
je 0x409082
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004130b2
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x415c8c
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4762c0
push 0x4762b8
push str.FlsAlloc
push 0x1f
call fcn.00415af7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415cc0
push dword [ebp + 8]
mov ecx, esi
call dword [0x426164]
call esi
jmp 0x415cc6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x415d0a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4762d0
push 0x4762c8
push str.FlsGetValue
push 0x21
call fcn.00415af7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415d41
push dword [ebp + 8]
mov ecx, esi
call dword [0x426164]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x415d49
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4762d8
push 0x4762d0
push str.FlsSetValue
push 0x22
call fcn.00415af7
mov esi, eax
add esp, 0x10
test esi, esi
je 0x415d83
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x426164]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]