joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a531
Capabilities:
Create process on windows

Disassembly:
push 0x2c
mov eax, 0x44137d
call fcn.0042cf82
cmp dword [0x45ddec], 1
mov ebx, ecx
jg 0x40a58c
lea eax, [ebp - 0x30]
push str.Executor.exec__:
lea edi, [ebx + 0x38]
push eax
call fcn.004037a6
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.Executor::startExecution
push 0x93
push str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u74_6087_install_src_windows_common_Executor.cpp
push 1
mov edx, eax
mov ecx, 0x45ddec
call fcn.0040997c
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00402978
push 0x44
pop esi
push esi
lea edi, [ebx + 0x7c]
push 0
push edi
call fcn.004285e0
add esp, 0xc
push 0x10
lea eax, [ebx + 0x6c]
push 0
push eax
mov dword [edi], esi
call fcn.004285e0
add esp, 0xc
cmp dword [ebx + 0xc0], 1
jne 0x40a5d0
or dword [ebx + 0xa8], 1
xor eax, eax
mov word [ebx + 0xac], ax
mov dword [ebx + 0x60], 0x8000000
cmp byte [ebx + 0xcd], 0
je 0x40a5e0
mov esi, ebx
call fcn.0040aa71
lea eax, [ebx + 0x38]
mov edx, dword [eax + 0x14]
cmp edx, 0x10
jb 0x40a5ef
mov esi, dword [eax]
jmp 0x40a5f1
mov esi, eax
mov ecx, dword [eax + 0x10]
add ecx, esi
cmp edx, 0x10
jb 0x40a5fd
mov eax, dword [eax]
push dword [ebp - 0x35]
xor edx, edx
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
call fcn.0040acda
mov dword [ebp - 4], 1
lea eax, [ebp - 0x31]
lea esi, [ebp - 0x24]
mov byte [ebp - 0x31], 0
call fcn.004093ad
cmp dword [ebx + 0x14], 0x10
jb 0x40a636
mov ecx, dword [ebx]
jmp 0x40a638
mov ecx, ebx
lea eax, [ebx + 0x6c]
push eax
push edi
push dword [ebx + 0x68]
push dword [ebx + 0x64]
push dword [ebx + 0x60]
push dword [ebx + 0x5c]
push dword [ebx + 0x58]
push dword [ebx + 0x54]
push dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
cmp dword [ebp - 0x24], 0
je 0x40a66d
push dword [ebp - 0x24]
call fcn.0042654b
pop ecx
mov al, bl
call fcn.0042d005
ret
Function at 0x40ae3f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44095c
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x45a630]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x45a630]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov edi, ecx
cmp dword [ebp + 8], ebx
jne 0x40aee3
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], str.Destination_buffer_cant_be_NULL
call fcn.004269ac
mov dword [esp + 0x20], vtable.std::invalid_argument.0
mov dword [esp + 0x80], ebx
lea eax, [esp + 0x48]
push eax
lea esi, [esp + 0x18]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u74_6087_install_src_common_share_tstrings.cpp
mov dword [esp + 0x1c], str.tstrings::format
mov dword [esp + 0x20], 0x1b
call fcn.0040b797
lea eax, [esp + 0x4c]
mov dword [esp], 0x451a00
push eax
call fcn.0042cae9
push 0xf
pop esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x80], 1
mov eax, dword [esp + 0x3c]
add eax, 0x100
lea ecx, [esp + 0x2c]
call fcn.004056dc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
jae 0x40af1e
lea eax, [esp + 0x2c]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 8]
push 0xffffffffffffffff
push dword [esp + 0x48]
push eax
call fcn.00429e5b
add esp, 0x14
cmp eax, 0xffffffff
je 0x40aefd
lea ecx, [esp + 0x2c]
call fcn.004056dc
mov dword [edi + 0x14], esi
mov dword [edi + 0x10], ebx
lea esi, [esp + 0x2c]
mov byte [edi], bl
call fcn.00402853
push ebx
push 1
mov ecx, esi
call fcn.00402978
mov eax, edi
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00426556
mov esp, ebp
pop ebp
ret
Function at 0x4137d8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x120
mov eax, 0x4425d9
call fcn.0042cf82
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x78], eax
mov eax, esi
call fcn.004137ba
mov edi, eax
test edi, edi
jne 0x413890
push str.cannot_find_resource
lea ecx, [ebp - 0x30]
call fcn.00401dac
and dword [ebp - 4], edi
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.00413705
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.004077bb
push str.System_error
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
mov eax, esi
push eax
lea edi, [ebp - 0x90]
call fcn.0041312a
mov byte [ebp - 4], 3
mov dword [ebp - 0x84], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u74_6087_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x41
lea ecx, [ebp - 0x58]
push ecx
lea esi, [ebp - 0x84]
mov ecx, eax
call fcn.0040558f
lea eax, [ebp - 0x58]
mov dword [esp], 0x451878
push eax
call fcn.0042cae9
mov ebx, dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push dword [esi + 0x40]
call ebx
test eax, eax
jne 0x413914
push str.cannot_load_resource
lea ecx, [ebp - 0x30]
call fcn.00401dac
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x30]
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.00413705
mov edi, eax
lea esi, [ebp - 0x12c]
mov byte [ebp - 4], 5
call fcn.004077bb
push str.System_error
mov byte [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, esi
push eax
mov ecx, ebx
lea edi, [ebp - 0x90]
call fcn.0041312a
mov byte [ebp - 4], 7
mov dword [ebp - 0x84], str.c:_re_workspace_8_2_build_windows_i586_cygwin_jdk8u74_6087_install_src_windows_common_Resources.cpp
mov dword [ebp - 0x80], str.Resource::getPtr
mov dword [ebp - 0x7c], 0x46
jmp 0x41386f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esi + 0x3c], 6
mov ebx, eax
jne 0x413944
mov esi, dword [esi + 0x1c]
and esi, 0xf
jbe 0x413935
dec esi
movzx ecx, word [eax]
lea eax, [eax + ecx*2 + 2]
jne 0x41392b
movzx ecx, word [eax]
mov edx, dword [ebp - 0x78]
add ecx, ecx
mov dword [edx], ecx
lea ebx, [eax + 2]
jmp 0x413953
push edi
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, ebx
call fcn.0042d005
ret 4
Function at 0x41a94c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x441521
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x45a630]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x45a630]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], esi
cmp byte [ecx + 0x38], bl
je 0x41a9ac
push esi
mov ebx, ecx
call fcn.0041a641
mov eax, esi
jmp 0x41ab97
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x14]
mov dword [esp + 0xc0], ebx
call fcn.0041a778
test al, al
jne 0x41aa7b
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
lea ebx, [esp + 0x58]
mov byte [esp + 0xc0], 1
call fcn.0041dfbe
push 0xc8
lea edx, [esp + 0x28]
mov ecx, eax
mov byte [esp + 0xc4], 2
call fcn.0041a778
movzx eax, al
push eax
mov al, 1
call fcn.0041ae52
pop ecx
pop ecx
push 0
push 1
mov ecx, ebx
mov byte [esp + 0xc8], 1
call fcn.00402978
push dword [esp + 0x34]
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push esi
push ebx
push dword [esp + 0x34]
lea ecx, [esp + 0x34]
call fcn.0041aec4
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], esi
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0xc0], 0
call fcn.00402d6d
xor ebx, ebx
mov edi, dword [esp + 0x14]
mov esi, edi
cmp edi, dword [esp + 0x18]
je 0x41aae1
push 0x449378
call fcn.0040382f
pop ecx
test al, al
jne 0x41aa9f
add esi, 0x1c
cmp esi, dword [esp + 0x18]
jne 0x41aa87
cmp dword [esp + 0x18], esi
je 0x41aadd
cmp edi, esi
je 0x41aac2
lea eax, [esi + 0x1c]
push eax
add esi, 0xffffffe4
push esi
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00412960
jmp 0x41aa7b
push 0x137
lea esi, [esp + 0x28]
call fcn.00415630
push 0x451ad4
mov eax, esi
push eax
call fcn.0042cae9
cmp edi, dword [esp + 0x18]
sete al
movzx eax, al
push eax
call fcn.0041ae2a
pop ecx
push dword [esp + 0x14]
lea esi, [esp + 0x40]
add edi, 0x1c
call fcn.00401d8b
mov byte [esp + 0xc0], 4
jmp 0x41ab46
lea eax, [esp + 0x58]
push 0x44dea8
push eax
call fcn.004037a6
pop ecx
pop ecx
push ebx
push eax
or eax, 0xffffffff
lea esi, [esp + 0x44]
mov byte [esp + 0xc8], 5
call fcn.00403afe
push ebx
push 1
lea ecx, [esp + 0x60]
mov byte [esp + 0xc8], 4
call fcn.00402978
add edi, 0x1c
cmp edi, dword [esp + 0x18]
jne 0x41ab08
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x78]
push eax
call fcn.0041a5f8
push dword [esp + 0x38]
mov byte [esp + 0xc4], 6
lea ebx, [esp + 0x78]
mov byte [esp + 0xb0], 1
call fcn.0041a641
call fcn.00416f2d
push 0
push 1
lea ecx, [esp + 0x44]
call fcn.00402978
lea esi, [esp + 0x14]
call fcn.00402d6d
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00426556
mov esp, ebp
pop ebp
ret
Function at 0x41b2fc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43effb
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x45a630]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push esi
push edi
mov eax, dword [0x45a630]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
push ecx
lea esi, [esp + 0x24]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
call fcn.00401d8b
mov byte [esp + 0x3c], bl
mov dword [esp + 0x70], ebx
jmp 0x41b3a9
lea edx, [esp + 0x20]
add edi, 0xfffffffc
mov ecx, dword [edi]
mov eax, dword [ecx]
push edx
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x20], edi
call dword [eax + 4]
mov esi, eax
lea edi, [esp + 0x20]
mov byte [esp + 0x70], 1
call fcn.00402853
mov al, byte [esi + 0x1c]
push ebx
push 1
lea ecx, [esp + 0x48]
mov byte [esp + 0x44], al
mov byte [esp + 0x78], bl
call fcn.00402978
cmp byte [esp + 0x3c], bl
jne 0x41b3af
mov edi, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jne 0x41b360
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
call fcn.00401d8b
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.00402978
mov eax, esi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00426556
mov esp, ebp
pop ebp
ret 8
Function at 0x41fccc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x440bfa
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x45a630]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ebx
call fcn.0041abfe
mov cl, byte [eax + 4]
mov edi, dword [eax]
mov byte [esp + 0x10], cl
mov dword [esp + 0x1c], edi
mov byte [eax + 4], bl
mov dword [esp + 0x2c], edi
mov byte [esp + 0x30], cl
mov dword [esp + 0x50], ebx
cmp byte [esp + 0x18], bl
je 0x41fd37
push dword [esp + 0x14]
mov byte [esp + 0x1c], bl
call fcn.004250e3
pop ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov esi, 0x100001
lea eax, [esp + 0x34]
mov byte [esp + 0x50], 1
call fcn.004075d9
push edi
mov edi, dword [esp + 0x38]
dec esi
push esi
push 1
push edi
call fcn.0042c21b
add esp, 0x10
mov dword [esp + 0x14], eax
cmp eax, esi
jbe 0x41fd8b
push 0xc8
lea esi, [esp + 0x20]
call fcn.00415630
push 0x451ad4
mov eax, esi
push eax
call fcn.0042cae9
push dword [esp + 0x1c]
call fcn.0042bfa9
pop ecx
test eax, eax
je 0x41fdb0
push 0x133
lea esi, [esp + 0x20]
call fcn.00415630
push 0x451ad4
mov eax, esi
jmp 0x41fd85
push dword [esp + 0x1c]
call fcn.0042bf81
pop ecx
test eax, eax
jne 0x41fdd5
push 0x13b
lea esi, [esp + 0x20]
call fcn.00415630
push 0x451ad4
mov eax, esi
jmp 0x41fd85
mov esi, dword [esp + 0x14]
mov ecx, esi
mov eax, edi
call fcn.0041fc98
lea eax, [edi + esi]
mov esi, dword [ebp + 8]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
cmp edi, eax
je 0x41fe03
sub eax, edi
push eax
push edi
mov ecx, esi
call fcn.00402e52
cmp edi, ebx
je 0x41fe0e
push edi
call fcn.0042654b
pop ecx
cmp byte [esp + 0x10], bl
je 0x41fe1e
push dword [esp + 0x1c]
call fcn.004250e3
pop ecx
mov eax, esi
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420065
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x45a630]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4404b6
call fcn.0042cf19
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x23
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x4200bb
push 0xc8
lea esi, [ebp - 0x20]
call fcn.00415630
push 0x451ad4
mov eax, esi
push eax
call fcn.0042cae9
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00406b16
push 0x44e1a8
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.0040f928
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0041d8cf
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.00406cbb
push 1
lea esi, [ebp]
call fcn.00406cbb
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.00426556
add ebp, 0x244
leave
ret
Function at 0x4213e3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, eax
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jl 0x421463
jg 0x42140f
cmp esi, ecx
jbe 0x421463
cmp dword [ebp + 0x14], ecx
jg 0x42140f
jl 0x42140b
cmp esi, 0x7fffffff
jae 0x42140f
mov eax, esi
jmp 0x421414
mov eax, 0x7fffffff
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 4], ecx
je 0x421454
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42143e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x42145e
jmp 0x421454
mov eax, dword [ebp - 4]
test eax, eax
jle 0x42144f
add ebx, eax
cdq
sub esi, eax
sbb dword [ebp + 0x14], edx
jmp 0x4213ef
cmp eax, 0xffffffff
jne 0x42145e
call fcn.0042b14a
cmp dword [eax], 4
je 0x4213ef
or eax, 0xffffffff
jmp 0x421465
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x426556
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45a630]
jne 0x426560
repz ret
jmp fcn.0042f380

Function at 0x439c8b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45a630]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00430b78
and dword [ebp - 0x14], 0
cmp dword [0x45dbe0], 0
mov dword [ebp - 0x18], eax
jne 0x439d3e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x439de6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x439de6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x45dbe0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x45dbe4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x45dbe8], eax
call edi
push eax
call esi
mov dword [0x45dbf0], eax
test eax, eax
je 0x439d3e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x45dbec], eax
mov eax, dword [0x45dbec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x439d97
cmp dword [0x45dbf0], ecx
je 0x439d97
push eax
call esi
push dword [0x45dbf0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x439d97
test ebx, ebx
je 0x439d97
call edi
test eax, eax
je 0x439d8e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x439d8e
test byte [ebp - 8], 1
jne 0x439d97
or dword [ebp + 0x10], 0x200000
jmp 0x439dca
mov eax, dword [0x45dbe4]
cmp eax, dword [ebp - 0x18]
je 0x439dca
push eax
call esi
test eax, eax
je 0x439dca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x439dca
mov eax, dword [0x45dbe8]
cmp eax, dword [ebp - 0x18]
je 0x439dca
push eax
call esi
test eax, eax
je 0x439dca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x45dbe0]
call esi
test eax, eax
je 0x439de6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x439de8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426556
leave
ret
Function at 0x40107e
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x42c5d8]
mov edx, dword [ebp + 8]
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [str.2_x]
push edi
mov edi, dword [edx]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], edi
call fcn.00401077
mov eax, dword [0x42c5e0]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42c5e4]
add ebx, 0x23f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x2d2b014], 0xc
mov dword [ebp - 4], eax
jne 0x401106
xor eax, eax
push eax
lea ecx, [ebp - 0x30]
push ecx
push eax
lea ecx, [ebp - 0x430]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2d2b014]
cmp eax, 0xfa9
jne 0x401122
mov dword [0x2d2b010], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40113b
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
and dword [0x2d2af68], 0
mov edx, dword [ebp + 8]
lea eax, [ebx + edi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x10], 0
mov dword [0x2d2b00c], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
lea eax, [ebx + esi]
mov dword [ebp - 0x14], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
add ebx, 0x61c88647
sub edi, eax
dec dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edi
jne 0x4010d1
mov dword [edx], edi
pop edi
mov dword [edx + 4], esi
pop esi
pop ebx
leave
ret 4
Function at 0x406535
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b764]
jne 0x40653f
repz ret
jmp fcn.0040aea6

Function at 0x409d27
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404b2e
and dword [ebp - 4], 0
cmp dword [0x43081c], 0
mov ebx, eax
jne 0x409dd8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409e89
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409e89
push eax
call fcn.00404abc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43081c], eax
call esi
push eax
call fcn.00404abc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x430820], eax
call esi
push eax
call fcn.00404abc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x430824], eax
call esi
push eax
call fcn.00404abc
pop ecx
mov dword [0x43082c], eax
test eax, eax
je 0x409dd8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404abc
pop ecx
mov dword [0x430828], eax
mov eax, dword [0x430828]
cmp eax, ebx
je 0x409e30
cmp dword [0x43082c], ebx
je 0x409e30
push eax
call fcn.00404b37
push dword [0x43082c]
mov esi, eax
call fcn.00404b37
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409e30
test edi, edi
je 0x409e30
call esi
test eax, eax
je 0x409e27
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409e27
test byte [ebp - 0xc], 1
jne 0x409e30
or dword [ebp + 0x10], 0x200000
jmp 0x409e69
mov eax, dword [0x430820]
cmp eax, ebx
je 0x409e69
push eax
call fcn.00404b37
pop ecx
test eax, eax
je 0x409e69
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409e69
mov eax, dword [0x430824]
cmp eax, ebx
je 0x409e69
push eax
call fcn.00404b37
pop ecx
test eax, eax
je 0x409e69
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43081c]
call fcn.00404b37
pop ecx
test eax, eax
je 0x409e89
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e8b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404a4e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x404a5d
pop dword [ebp - 0x50]
mov eax, 0xd7d89c1c
add eax, 0x2867ae41
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x404ad
push 0
mov eax, 0x17d2fd8d
add eax, 0xe86f548b
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0xc5055e29
add ecx, 0x3afaf3c5
mov esi, eax
mov edx, 0xe413ce14
sub edx, 0xe3d07a14
add edx, dword [ebp - 0x50]
mov edi, 0x7709dd47
sub edi, 0x829e920f
mov ebx, dword [edx]
xor dword [ebp - 0x28], ecx
sub ebx, edi
sub dword [ebp - 0x18], 0x983c6fd4
mov dword [esi], ebx
add esi, 0xb819fcd
add esi, 0xf47e6037
add edx, 0xbcc5b4ee
sub edx, 0xbcc5b4ea
loop 0x404abc
add eax, 0x90ff77eb
sub eax, 0x90fe3d60
mov ebx, eax
add eax, 0x7aecd59d
add eax, 0x85132a68
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x407875
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f180]
jne 0x40787f
repz ret
jmp fcn.0040bbd7