joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438e90
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.00438ef0

Function at 0x438ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x3c
mov eax, dword [0x448640]
test eax, eax
jle 0x438ff3
mov edx, dword [0x448644]
xor ebx, ebx
mov ecx, dword [edx + 4]
cmp ecx, esi
ja 0x438f21
mov edi, dword [edx + 8]
add ecx, dword [edi + 8]
cmp esi, ecx
jb 0x438f96
add ebx, 1
add edx, 0xc
cmp ebx, eax
jne 0x438f10
mov dword [esp], esi
call fcn.004397d0
test eax, eax
mov edi, eax
je 0x43901a
lea esi, [ebx + ebx*2]
mov ebx, dword [0x448644]
shl esi, 2
add ebx, esi
mov dword [ebx + 8], eax
mov dword [ebx], 0
call fcn.004398c0
add eax, dword [edi + 0xc]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [0x448644]
mov dword [esp + 8], 0x1c
mov eax, dword [eax + esi + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x438ffa
mov eax, dword [ebp - 0x20]
cmp eax, 0x40
jne 0x438fa0
add dword [0x448640], 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
je 0x438f8f
cmp eax, 0x80
je 0x438f8f
cmp eax, 8
je 0x438f8f
mov eax, dword [ebp - 0x28]
add esi, dword [0x448644]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0xc], esi
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x438f8f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00438e90
xor ebx, ebx
jmp 0x438f2b
mov eax, dword [0x448644]
mov eax, dword [eax + esi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00438e90
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00438e90
lea esi, [esi]

Function at 0x4396f0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x439728
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x43971e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x43972a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x439710
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10067340
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1006752d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3a000]
push edi
jmp 0x1006736a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10067371
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10067360
mov eax, 1
add ebx, ebx
jne 0x10067383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10067394
jne 0x100673b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100673b3
dec eax
add ebx, ebx
jne 0x100673a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10067378
add ebx, ebx
jne 0x100673af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10067405
xor ecx, ecx
sub eax, 3
jb 0x100673cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1006743a
sar eax, 1
mov ebp, eax
jmp 0x100673d6
add ebx, ebx
jne 0x100673d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100673a4
inc ecx
add ebx, ebx
jne 0x100673e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100673a4
add ebx, ebx
jne 0x100673f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100673e6
jne 0x10067402
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100673e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10067424
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10067416
jmp 0x10067366
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10067424
add edi, ecx
jmp 0x10067366
pop esi
mov edi, esi
mov ecx, 0x1cb9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10067442
cmp byte [edi], 9
jne 0x10067442
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10067447
lea edi, [esi + 0x62000]
mov eax, dword [edi]
or eax, eax
je 0x100674bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x671dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x672cc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10067474
mov ecx, edi
jns 0x100674a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x672d0]
or eax, eax
je 0x100674b9
mov dword [ebx], eax
add ebx, 4
jmp 0x10067491
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100674f0
cmp al, 0xef
ja 0x100674e3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100674c5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100674d2
mov ebp, dword [esi + 0x672d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10067524
sub esp, 0xffffff80
jmp 0x1002a201
Function at 0x4035b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [ebx + 0x3c]
mov eax, dword [eax + ebx + 0x80]
sub esp, 0x1c
push ebp
push esi
add eax, ebx
cmp dword [eax + 0xc], 0
push edi
lea edi, [eax + 0xc]
je 0x403608
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [edi]
add ecx, ebx
push ecx
push str.kernel32.dll
call ebp
test eax, eax
jne 0x403600
mov esi, dword [edi + 4]
add esi, ebx
cmp dword [esi], eax
je 0x403600
lea ebx, [ebx]
mov edx, dword [esp + 0x2c]
cmp dword [esi], edx
je 0x403611
add esi, 4
cmp dword [esi], 0
jne 0x4035f0
add edi, 0x14
cmp dword [edi], 0
jne 0x4035d1
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
push 0x1c
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x20]
push ecx
push 0x40
push edx
push eax
call edi
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x40364b
mov dword [esi], 0x403670
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push eax
push ecx
call edi
mov eax, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
add esp, 0x1c
ret

Function at 0x403c00
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov eax, dword [edi]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push ebx
push ebp
mov ebp, dword [edi + 4]
push esi
lea esi, [ecx + eax + 0x18]
mov dword [esp + 0xc], 0
jbe 0x403cce
add esi, 0x10
mov eax, dword [esi]
test eax, eax
jne 0x403c6d
mov edx, dword [esp + 0x1c]
mov ebx, dword [edx + 0x38]
test ebx, ebx
jle 0x403cb2
mov eax, dword [edi + 0x34]
mov ecx, dword [esi - 4]
mov edx, dword [edi + 0x1c]
push eax
push 4
push 0x1000
add ecx, ebp
push ebx
push ecx
call edx
add esp, 0x14
test eax, eax
je 0x403ce0
mov eax, dword [esi - 4]
push ebx
add eax, ebp
push 0
push eax
mov dword [esi - 8], eax
call fcn.00408580
jmp 0x403caf
mov ecx, dword [esi + 4]
add ecx, eax
cmp dword [esp + 0x18], ecx
jb 0x403cd8
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x1c]
push edx
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ebp
push eax
call ecx
add esp, 0x14
test eax, eax
je 0x403ce0
mov eax, dword [esi + 4]
mov edx, dword [esi]
add eax, dword [esp + 0x14]
mov ebx, dword [esi - 4]
push edx
add ebx, ebp
push eax
push ebx
call fcn.00408db0
mov dword [esi - 8], ebx
add esp, 0xc
mov ecx, dword [edi]
mov eax, dword [esp + 0xc]
movzx edx, word [ecx + 6]
add eax, 1
add esi, 0x28
cmp eax, edx
mov dword [esp + 0xc], eax
jl 0x403c27
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x403da0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
sub edx, 1
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
test esi, esi
mov dword [esp + 0x18], edx
jne 0x403de6
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x403ddf
mov esi, dword [eax + 0x20]
jmp 0x403de6
test bl, bl
jns 0x403de6
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
cmp word [eax + 6], si
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], esi
jbe 0x403ec6
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x3c]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
sub esi, 1
not esi
and esi, ebp
test edi, edi
jne 0x403e39
mov ecx, dword [ebx]
test cl, 0x40
je 0x403e32
mov edi, dword [eax + 0x20]
jmp 0x403e39
test cl, cl
jns 0x403e39
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x403e72
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x403e72
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.00403cf0
test eax, eax
je 0x403ee7
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x403e9e
mov eax, dword [ebx]
test eax, 0x2000000
je 0x403e8b
test dword [esp + 0x20], 0x2000000
je 0x403e8b
or dword [esp + 0x20], eax
jmp 0x403e98
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
add ecx, 1
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x403e12
lea ecx, [esp + 0x14]
mov eax, edi
mov dword [esp + 0x24], 1
call fcn.00403cf0
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x405dda
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x41b068]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00405d6f
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00408580
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x405e29
cmp dword [ebp - 0x1c], 5
jb 0x405e41
jmp 0x405e3d
cmp dword [ebp - 0x10], 1
jne 0x405e41
cmp dword [ebp - 0x1c], 4
ja 0x405e3d
jne 0x405e41
cmp dword [ebp - 0x18], 0
jbe 0x405e41
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x41728c
call fcn.00405c43
test eax, eax
jge 0x405e62
mov byte [0x4f8b10], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00406974
add ebp, 0x78
leave
ret
Function at 0x40653e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x40657b
cmp dword [ebp + 0x14], edi
je 0x40657b
cmp ecx, edi
jne 0x406582
call fcn.00409150
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004068fb
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x406596
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4065b7
cmp ebx, 0xffffffff
je 0x4065a6
push ebx
push edi
push ecx
call fcn.00408580
add esp, 0xc
cmp esi, edi
je 0x406563
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x406563
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4065d3
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4065da
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4066cb
test word [esi + 0xc], 0x10c
je 0x40662e
mov eax, dword [esi + 4]
test eax, eax
je 0x40662e
jl 0x40672c
cmp ebx, eax
mov edi, ebx
jb 0x4065ff
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4066d3
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00406061
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4066c3
cmp ebx, dword [ebp - 0xc]
jb 0x40669b
cmp dword [ebp - 0xc], 0
je 0x406658
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x40664d
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x406654
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x406663
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406663
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4066ff
push eax
push dword [ebp - 8]
push esi
call fcn.00409701
pop ecx
push eax
call fcn.0040a638
add esp, 0xc
test eax, eax
je 0x40673e
cmp eax, 0xffffffff
je 0x40672c
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4066c3
push esi
call fcn.0040972e
cmp eax, 0xffffffff
pop ecx
je 0x406730
cmp dword [ebp - 4], 0
je 0x4066ff
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4065e2
mov eax, dword [ebp + 0x14]
jmp 0x40657d
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4066ea
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00408580
add esp, 0xc
call fcn.00409150
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x406573
cmp dword [ebp + 0xc], 0xffffffff
je 0x406715
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00408580
add esp, 0xc
call fcn.00409150
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x406573
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x40657d
or dword [esi + 0xc], 0x10
jmp 0x406730
Function at 0x406974
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b068]
jne 0x40697e
repz ret
jmp fcn.0040ae98

Function at 0x40d557
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x41b770]
je 0x40d572
inc edi
cmp edi, 0x17
jb 0x40d563
cmp edi, 0x17
jae 0x40d6f2
push ebp
push 3
call fcn.00411893
cmp eax, 1
pop ecx
je 0x40d6be
push 3
call fcn.00411893
test eax, eax
pop ecx
jne 0x40d5a6
cmp dword [0x41b064], 1
je 0x40d6be
cmp ebx, 0xfc
je 0x40d6f1
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4f8388
push ebp
call fcn.00406c51
add esp, 0xc
test eax, eax
je 0x40d5dc
push esi
push esi
push esi
push esi
push esi
call fcn.004067ff
add esp, 0x14
push 0x104
mov esi, 0x4f83a1
push esi
push 0
mov byte [0x4f84a5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40d620
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00406c51
add esp, 0xc
test eax, eax
je 0x40d620
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004067ff
add esp, 0x14
push esi
call fcn.004088f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40d665
push esi
call fcn.004088f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4f869c
push 0x417974
sub ecx, eax
push ecx
push eax
call fcn.004117e0
add esp, 0x14
test eax, eax
je 0x40d665
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004067ff
add esp, 0x14
jmp 0x40d667
xor esi, esi
push 0x417970
push ebx
push ebp
call fcn.0041176f
add esp, 0xc
test eax, eax
je 0x40d687
push esi
push esi
push esi
push esi
push esi
call fcn.004067ff
add esp, 0x14
push dword [edi*8 + 0x41b774]
push ebx
push ebp
call fcn.0041176f
add esp, 0xc
test eax, eax
je 0x40d6a9
push esi
push esi
push esi
push esi
push esi
call fcn.004067ff
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004115b2
add esp, 0xc
jmp 0x40d6f1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40d6f1
cmp ebp, 0xffffffff
je 0x40d6f1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41b774]
push dword [esi]
call fcn.004088f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4115b2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040a817
xor ebx, ebx
cmp dword [0x4f896c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x411688
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x411768
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x411768
push eax
call fcn.0040a7a9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4f896c], eax
call esi
push eax
call fcn.0040a7a9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4f8970], eax
call esi
push eax
call fcn.0040a7a9
mov dword [0x4f8974], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00407e9b
test eax, eax
pop ecx
pop ecx
je 0x411656
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004067ff
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x411688
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040a7a9
cmp eax, ebx
pop ecx
mov dword [0x4f897c], eax
je 0x411688
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040a7a9
pop ecx
mov dword [0x4f8978], eax
mov eax, dword [0x4f8978]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41170d
cmp dword [0x4f897c], ecx
je 0x41170d
push eax
call fcn.0040a820
push dword [0x4f897c]
mov esi, eax
call fcn.0040a820
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41170d
cmp edi, ebx
je 0x41170d
call esi
cmp eax, ebx
je 0x4116da
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4116da
test byte [ebp - 0x18], 1
jne 0x41170d
lea eax, [ebp - 0x10]
push eax
call fcn.00407ed2
test eax, eax
pop ecx
je 0x4116f5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004067ff
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x411704
or dword [ebp + 0x10], 0x200000
jmp 0x411748
or dword [ebp + 0x10], 0x40000
jmp 0x411748
mov eax, dword [0x4f8970]
cmp eax, dword [ebp - 8]
je 0x411748
push eax
call fcn.0040a820
cmp eax, ebx
pop ecx
je 0x411748
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x411748
mov eax, dword [0x4f8974]
cmp eax, dword [ebp - 8]
je 0x411748
push eax
call fcn.0040a820
cmp eax, ebx
pop ecx
je 0x411748
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4f896c]
call fcn.0040a820
cmp eax, ebx
pop ecx
je 0x411768
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41176a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402274
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ce99d
jg 0x402298
inc edi
cmp edi, 0x1f6502b0
jl 0x402280
cmp dword [0x2be860c], 0x400
jne 0x4022e5
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push str.teyikekosigokifaruwoxuhaked
push esi
call fcn.004026f8
push esi
push esi
push esi
call fcn.004026c8
push esi
push esi
call fcn.004024e5
push esi
call fcn.0040284e
push esi
call fcn.0040285d
add esp, 0x24
xor edi, edi
cmp edi, 0xd0fe
jge 0x4022f6
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
cmp edi, 0x3a37ee
jg 0x40231d
inc edi
cmp edi, 0xe52f
jl 0x4022e7
mov eax, dword [0x429eb4]
mov dword [0x2be860c], eax
call fcn.00402026
mov edi, 0x3078f
cmp dword [0x2be860c], 0x51f
jne 0x402349
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x402331
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x40734e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429b80]
jne 0x407358
repz ret
jmp fcn.0040958c
Function at 0x408fcd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429b80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403714
and dword [ebp - 0x14], 0
cmp dword [0x4349dc], 0
mov dword [ebp - 0x18], eax
jne 0x409080
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409128
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409128
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4349dc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4349e0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4349e4], eax
call edi
push eax
call esi
mov dword [0x4349ec], eax
test eax, eax
je 0x409080
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4349e8], eax
mov eax, dword [0x4349e8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4090d9
cmp dword [0x4349ec], ecx
je 0x4090d9
push eax
call esi
push dword [0x4349ec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4090d9
test ebx, ebx
je 0x4090d9
call edi
test eax, eax
je 0x4090d0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4090d0
test byte [ebp - 8], 1
jne 0x4090d9
or dword [ebp + 0x10], 0x200000
jmp 0x40910c
mov eax, dword [0x4349e0]
cmp eax, dword [ebp - 0x18]
je 0x40910c
push eax
call esi
test eax, eax
je 0x40910c
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40910c
mov eax, dword [0x4349e4]
cmp eax, dword [ebp - 0x18]
je 0x40910c
push eax
call esi
test eax, eax
je 0x40910c
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4349dc]
call esi
test eax, eax
je 0x409128
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40912a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040734e
leave
ret