joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f7f0
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
cmp dword [esi], 0x56ce68
je 0x46f80c
call dword [sym.imp.MSVBVM60.DLL___vbaFailedFriend]
cmp dword [esi + 0x3c], ebx
je 0x46f86f
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push edi
push edx
push esi
call dword [eax + 0xbb0]
cmp word [esp + 0xc], bx
je 0x46f85f
mov eax, dword [edi]
mov ecx, dword [esi + 0x3c]
push 0xfffff000
push eax
push 0x102c
push ecx
call dword [sym.imp.USER32.DLL_SendMessageA]
shr eax, 0xd
mov edx, dword [esp + 0x20]
and eax, 1
neg eax
pop edi
mov word [edx], ax
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
pop edi
pop esi
mov word [eax], bx
xor eax, eax
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor eax, eax
mov word [ecx], bx
pop ebx
pop ecx
ret 0x10

Function at 0x491760
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
xor eax, eax
push ebx
mov dword [esp + 0x3c], eax
push esi
mov dword [esp + 0x44], eax
push edi
mov dword [esp + 0x4c], eax
mov ecx, 7
lea edi, [esp + 0x54]
mov dword [esp + 0x50], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], edx
cmp eax, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], edx
jne 0x4917e0
xor eax, eax
mov edx, dword [0x561574]
add eax, 1
mov dword [edx + eax*4 - 4], ecx
mov edx, dword [0x561574]
mov dword [edx + eax*4 + 4], ecx
jo 0x491a62
cmp eax, 1
jle 0x4917b5
pop edi
pop esi
pop ebx
add esp, 0x64
ret 0x10
mov edi, dword [esp + 0x74]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x14], eax
test edi, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x54], 0x1c
mov dword [esp + 0x58], 7
je 0x491a59
lea edx, [esp + 0x44]
push edx
push edi
call dword [sym.imp.USER32.DLL_GetClientRect]
lea edx, [esp + 0x44]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
push edx
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.DLL_GetWindowRect]
mov esi, dword [sym.imp.USER32.DLL_GetSystemMetrics]
push 3
call esi
push 2
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x48]
sub ecx, edx
jo 0x491a62
sub ecx, eax
jo 0x491a62
mov dword [esp + 0x28], ecx
call esi
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x48]
sub edx, esi
jo 0x491a62
sub edx, eax
jo 0x491a62
mov dword [esp + 0x28], edx
xor eax, eax
mov ecx, dword [esp + eax*4 + 0x14]
jmp 0x581738
pop edi
pop esi
pop ebx
add esp, 0x64
ret 0x10
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp dword [0x2b02ed4], 0x594
mov dword [ebp - 8], eax
jne 0x40103b
push esi
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x42d318]
mov ebx, dword [0x42d31c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
call fcn.00401000
mov eax, dword [0x42d320]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42d324]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x2b02ed4], 0xc
mov dword [ebp - 4], eax
jne 0x4010b7
push esi
lea eax, [ebp - 0x830]
push eax
push str.limuwafozufoderahiz_wulesuferore
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2b02ed4]
cmp eax, 0xfa9
jne 0x4010d3
mov dword [0x2b02ed0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ee
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2b02888], esi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov edx, edi
shr edx, cl
add eax, edi
mov dword [ebp - 0x14], eax
mov dword [0x2b02ecc], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shr edx, cl
add edx, ebx
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
add dword [ebp - 0x18], 0x61c88647
dec dword [ebp - 0x1c]
jne 0x401072
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x405349
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42cb58]
jne 0x405353
repz ret
jmp fcn.004080ac

Function at 0x4078e7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004027ef
and dword [ebp - 4], 0
cmp dword [0x42f34c], 0
mov ebx, eax
jne 0x407998
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407a49
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407a49
push eax
call fcn.0040277d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42f34c], eax
call esi
push eax
call fcn.0040277d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42f350], eax
call esi
push eax
call fcn.0040277d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42f354], eax
call esi
push eax
call fcn.0040277d
pop ecx
mov dword [0x42f35c], eax
test eax, eax
je 0x407998
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040277d
pop ecx
mov dword [0x42f358], eax
mov eax, dword [0x42f358]
cmp eax, ebx
je 0x4079f0
cmp dword [0x42f35c], ebx
je 0x4079f0
push eax
call fcn.004027f8
push dword [0x42f35c]
mov esi, eax
call fcn.004027f8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4079f0
test edi, edi
je 0x4079f0
call esi
test eax, eax
je 0x4079e7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4079e7
test byte [ebp - 0xc], 1
jne 0x4079f0
or dword [ebp + 0x10], 0x200000
jmp 0x407a29
mov eax, dword [0x42f350]
cmp eax, ebx
je 0x407a29
push eax
call fcn.004027f8
pop ecx
test eax, eax
je 0x407a29
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407a29
mov eax, dword [0x42f354]
cmp eax, ebx
je 0x407a29
push eax
call fcn.004027f8
pop ecx
test eax, eax
je 0x407a29
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42f34c]
call fcn.004027f8
pop ecx
test eax, eax
je 0x407a49
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407a4b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408acd
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov dword [ebp - 8], ecx
mov ebx, edi
xor dword [edx], ebp
pushal
push es
push 0
lea edx, [ebp - 4]
mov dword [ebp - 0xc], eax
push 0
cmp al, 0x8b
push ecx
add al, 0x8d
fxtract
push 1
push eax
push edx
mov dword [ebp - 4], 0
call dword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x408b56
push edi
mov edi, dword [0xd240c1d8]
retf
push edx
mov esi, ebx
or byte [ecx - 0x4f72aebb], cl
cld
mov dword [ebp - 0xc], ecx
mov ebx, 0x8d04426e
dec ebp
invalid

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
rcl byte [eax + 0x4c20a33], cl
add byte [eax - 0x4d6f6f70], dl
mov dl, 0x90
nop
nop
nop
not byte [eax - 0x741374ab]
int1
or byte [ebx - 0x3f7aebc0], cl
wait
xor ecx, dword [ebx + 0x50510c84]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jne 0x40a3f6
sal byte [ebp - 3], 0x5e
pop esi
pop ebp
ret 8
out dx, eax
rcr byte [ebp - 0x3e], 8
add byte [eax + 0x4e65], bh
pop ebp
ret 0xe308

Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and byte [ebp + 8], al
mov ecx, dword [0x4084c8]
push eax
add ecx, 0x40
and eax, 0x6b40d274
push ecx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x4102bf]
in eax, dx
les ecx, [eax*4 + 0x500f74c0]
push str.Total_of__d_requests_completed_n
call dword [0xfec164]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
fisubr word [eax - 0x137e1375]
mov eax, 0xa1000000
js 0x4017f5
inc ecx
add byte [ebp - 0x40], dl
mov eax, dword [0x41402b]
je 0x4017bb
push eax
inc eax
cmp al, 0x41
add byte [eax - 0x18], dl
sahf
inc eax
add byte [eax], al
push sp
or eax, 0x410274
jmp 0x4017cf
mov edx, dword [0x4118ff]
push edx
push eax
call fcn.00405850
mov ah, 0x8b
or eax, 0xdc17f4
mov dword [0x411808], eax
mov eax, dword [0xa0270288]
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
mov word [0x350b17], cx
test eax, eax
push edi
cmp bl, byte [ebp - 0x75]
adc eax, 0x431800
push edx
push str.Benchmarking__s
call esi
cwde
aam 0x40
add bh, bh
salc
mov eax, dword [0x15416078]
add esp, 8
insb byte es:[edi], dx
sal byte [edx + edi*4 - 0x5f], 0x74
inc ebx
inc ecx
add byte [eax - 6], dl
inc eax
cmp al, 0x41
add byte [eax - 0x7c], ch
mov byte [ecx - 0x7c2900a9], ch
les edx, [ecx]
mov eax, dword [0x40d014]
test dword [ebx - 0x48], ebp
add cl, 0x40
cmp al, 0x75
inc ebx
mov eax, 0x40d47c
xor al, 0x88
insb byte es:[edi], dx
aam 0x74
mov cl, 0xff
salc
mov esi, dword [edx - 0x77]
rol byte [eax], 0x83
shl dword [eax], 0x51
jmp [edx + 0x5ec154]
Function at 0x405b5d
Capabilities:
Encode data using xor

Disassembly:
call 0x405a3a
xor ecx, ecx
sub cx, 0xff7d
call 0x405b5d
rcr byte [esi - 0x7f], 0x76
push cs
fidivr word [ebx - 0x117c8f92]
cld
invalid
xor dword [esi + 0xe], 0x706ebbde
sub esi, 0xfffffffc
loop 0x405b60
in eax, dx
jb 0x405b5c
cdq
pop ebp
push ebx
xchg ecx, eax
invalid

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret

Function at 0x40197d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401990
push esp
mov dword [ebp - 0x24], 0x4016f4
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a2f
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a10
pop ebp
ret 0x10
Function at 0x406ced
Capabilities:
Parse pe header

Disassembly:
push 0x74
push 0x40af98
call fcn.00406fd4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x406d2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406d2d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x406d45
cmp eax, 0x20b
je 0x406d32
mov dword [ebp - 0x1c], ebx
jmp 0x406d59
cmp dword [ecx + 0x84], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x406d53
cmp dword [ecx + 0x74], 0xe
jbe 0x406d2d
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x40ea78], 0xffffffff
or dword [0x40ea7c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x40d464]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x40d460]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x40ea74], eax
call fcn.00406f30
call fcn.0053e000
cmp dword [0x40d320], ebx
jne 0x406db9
push 0x406fd0
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.00406fbe
push 0x40c00c
push 0x40c008
call sub.MSVCR71.dll__initterm
push 0x406f74
call fcn.00406f1e
mov eax, dword [0x40d45c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40d458]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x406e0d
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x40c004
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x406e8b
cmp al, bl
je 0x406e37
cmp dword [ebp - 0x20], ebx
jne 0x406e8b
mov al, byte [esi]
cmp al, bl
je 0x406e47
cmp al, 0x20
ja 0x406e47
inc esi
mov dword [ebp - 0x24], esi
jmp 0x406e37
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x406e63
movzx eax, word [ebp - 0x54]
jmp 0x406e66
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00404254
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x406e83
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x406ee0
cmp al, 0x22
jne 0x406e9a
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x406ead
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x406e25
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040700f
ret
Function at 0x401fc5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d110]
jne 0x401fcf
repz ret
jmp fcn.00402e66

Function at 0x40ff8c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004039ea
and dword [ebp - 4], 0
cmp dword [0x42e920], 0
mov ebx, eax
jne 0x41003d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4100ee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4100ee
push eax
call fcn.00403978
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42e920], eax
call esi
push eax
call fcn.00403978
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42e924], eax
call esi
push eax
call fcn.00403978
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42e928], eax
call esi
push eax
call fcn.00403978
pop ecx
mov dword [0x42e930], eax
test eax, eax
je 0x41003d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403978
pop ecx
mov dword [0x42e92c], eax
mov eax, dword [0x42e92c]
cmp eax, ebx
je 0x410095
cmp dword [0x42e930], ebx
je 0x410095
push eax
call fcn.004039f3
push dword [0x42e930]
mov esi, eax
call fcn.004039f3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410095
test edi, edi
je 0x410095
call esi
test eax, eax
je 0x41008c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41008c
test byte [ebp - 0xc], 1
jne 0x410095
or dword [ebp + 0x10], 0x200000
jmp 0x4100ce
mov eax, dword [0x42e924]
cmp eax, ebx
je 0x4100ce
push eax
call fcn.004039f3
pop ecx
test eax, eax
je 0x4100ce
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4100ce
mov eax, dword [0x42e928]
cmp eax, ebx
je 0x4100ce
push eax
call fcn.004039f3
pop ecx
test eax, eax
je 0x4100ce
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e920]
call fcn.004039f3
pop ecx
test eax, eax
je 0x4100ee
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4100f0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x805eb4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x805eba
pop ebp
sub ebp, 6
sub ebp, 0x405eb4
jmp 0x805f18
jmp 0x805f21
mov eax, 0x405eb4
add eax, ebp
add eax, 0x93
mov ecx, 0x629
mov edx, 0xbd03c266
xor byte [eax], dl
inc eax
dec ecx
jne 0x805f38
jmp 0x805f4b
or al, 0x26
push cs
jbe 0x805fb7
push cs
stosb byte es:[edi], al
dec edx
push bp
cmpsb byte [esi], byte es:[edi]
cdq
mov bh, 0x50
in ax, dx
stosd dword es:[edi], eax
in eax, dx
out dx, eax
pop edx
out 0xa7, ax
sahf
stosw word es:[edi], ax
fisub word [eax + 0x66]
fmul qword [esi + 0x66]
xchg cx, ax
test byte [ebp - 0x52], ah
in eax, dx
out 0x6a, eax
mov word gs:[0x516f0e36], ax
outsd dx, dword [esi]
push cs
int3
cmpsw word [esi], word es:[edi]
invalid
Function at 0x401b00
Capabilities:
Hide graphical window

Disassembly:
push ebp
xor ecx, ecx
xor edx, edx
mov ebp, esp
push esi
push ebx
sub esp, 0x24c
mov dword [ebp + edx - 0x220], ecx
mov dword [ebp + edx - 0x21c], ecx
add edx, 8
cmp edx, 0x18
jb 0x401b0f
lea esi, [ebp - 0x208]
mov ebx, dword [sym.imp.user32.dll_CreateWindowExW]
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x214], 0x100
mov dword [esp + 0x2c], 0
mov edx, dword [0x41903c]
mov dword [esp + 0x24], 0x7d2
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50000000
mov dword [esp + 8], 0
mov dword [esp + 4], str.SysTabControl32
mov dword [esp], 0
call ebx
sub esp, 0x30
mov dword [0x419004], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 0xc], 0x100
mov dword [esp + 4], 0xfa
mov eax, dword [0x41903c]
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadStringW]
lea eax, [ebp - 0x224]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x133e
mov eax, dword [0x419004]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
mov dword [esp + 0x2c], 0
mov eax, dword [0x41903c]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov eax, dword [0x419004]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x50000002
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40f020
mov dword [esp], 0x200
call ebx
mov dword [0x419008], eax
sub esp, 0x30
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret