joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009fce
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x1017484]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
mov dword [ebp - 4], eax
je 0x100a020
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x804]
push eax
push 0x400
push 0xd
push ebx
call esi
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x100a01f
push edi
push 0
push 0xc
push ebx
call esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01012bde
leave
ret 8

Function at 0x100ab41
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [0x1002370]
mov eax, dword [0x1017484]
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x1002374]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov cx, word [eax]
cmp cx, 0x5c
mov word [ebp - 0xc], cx
jne 0x100ab79
cmp word [eax + 2], cx
je 0x100ab8c
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 4
je 0x100ab8c
xor eax, eax
jmp 0x100ab8f
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
call fcn.01012bde
leave
ret 4
Function at 0x100c55c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x1017484]
and word [ebp - 0x804], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov ecx, 0x1ff
lea edi, [ebp - 0x802]
rep stosd dword es:[edi], eax
push 0x400
lea ecx, [ebp - 0x804]
stosw word es:[edi], ax
mov eax, dword [0x101e854]
mov eax, dword [eax + 0xc]
push ecx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100c5de
push 0
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
inc eax
jmp 0x100c5e0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01012bde
leave
ret 8
Function at 0x100dfc1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1017484]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
inc ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x12], 0
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x11]
push eax
push edi
call esi
test eax, eax
je 0x100e013
cmp dword [ebp - 0x18], ebx
jne 0x100e013
cmp byte [ebp - 0x11], 0x15
je 0x100e020
lea eax, [ebp - 0x24]
push eax
call fcn.0100c047
test eax, eax
je 0x100dff6
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x24]
push eax
call fcn.0100c047
test eax, eax
jne 0x100e0ec
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x20], 0
jne 0x100e080
inc byte [ebp - 0x12]
jne 0x100e049
mov dword [ebp - 0x28], ebx
mov al, byte [ebp - 0x12]
or cl, 0xff
sub cl, al
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x30]
mov byte [ebp - 0xe], cl
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 9], eax
mov dword [ebp - 0xd], ecx
xor al, al
mov byte [ebp - 0x10], bl
mov byte [ebp - 5], 0
xor ecx, ecx
add al, byte [ebp + ecx - 0x10]
inc ecx
cmp ecx, 0xb
jb 0x100e070
mov byte [ebp - 0x11], al
mov byte [ebp - 5], al
push 0
lea eax, [ebp - 0x2c]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x1c]
call edi
test eax, eax
je 0x100e0a1
cmp dword [ebp - 0x2c], 0xc
jne 0x100e0a1
and dword [ebp - 0x20], 0
jmp 0x100e0a4
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x24]
push eax
call fcn.0100c047
test eax, eax
jne 0x100e0ec
cmp dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x11]
push eax
push dword [ebp - 0x1c]
je 0x100e0c7
call esi
jmp 0x100e0db
call esi
test eax, eax
je 0x100e0d8
cmp dword [ebp - 0x18], ebx
jne 0x100e0d8
cmp byte [ebp - 0x11], 0x16
je 0x100e0fd
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x24]
push eax
call fcn.0100c047
test eax, eax
je 0x100e03b
and dword [ebp - 0x28], 0
jmp 0x100e125
cmp dword [ebp - 0x18], ebx
jne 0x100e125
cmp byte [ebp - 0x11], 0x15
jne 0x100e111
push 0
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x11]
push eax
push dword [ebp - 0x1c]
mov byte [ebp - 0x11], 4
call edi
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x11]
push eax
push dword [ebp - 0x1c]
call esi
test eax, eax
jne 0x100e0f2
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
pop edi
pop esi
pop ebx
call fcn.01012bde
leave
ret 0xc
Function at 0x100e13c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1017484]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x28], edi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], ebx
call fcn.0100c047
test eax, eax
jne 0x100e21e
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
cmp dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x12]
push eax
push esi
mov byte [ebp - 0x12], 0x15
jne 0x100e19f
mov byte [ebp - 0x12], 0x16
call edi
lea eax, [ebp - 0x1c]
push eax
call fcn.0100c047
test eax, eax
jne 0x100e21e
push eax
lea eax, [ebp - 0x20]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100e20d
cmp dword [ebp - 0x20], ebx
jne 0x100e1d2
cmp byte [ebp - 0x10], 4
je 0x100e222
cmp dword [ebp - 0x20], 0xc
jne 0x100e20d
xor al, al
xor ecx, ecx
add al, byte [ebp + ecx - 0x10]
inc ecx
cmp ecx, 0xb
jb 0x100e1dc
cmp byte [ebp - 5], al
mov byte [ebp - 0x12], al
jne 0x100e20d
mov al, byte [ebp - 0xf]
and dword [ebp - 0x18], 0
cmp byte [ebp - 0x11], al
jb 0x100e21e
jne 0x100e20d
mov ecx, dword [ebp - 0xd]
mov eax, dword [ebp - 0x28]
inc byte [ebp - 0x11]
mov dword [eax], ecx
mov ecx, dword [ebp - 9]
mov dword [eax + 4], ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.0100c047
test eax, eax
je 0x100e185
xor eax, eax
jmp 0x100e225
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01012bde
leave
ret 0xc
Function at 0x1012110
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x1017484]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x80c]
push eax
push 2
lea eax, [ebp - 0x804]
push eax
push ebx
mov dword [ebp - 0x808], ebx
mov byte [ebp - 0x804], 0xff
mov byte [ebp - 0x803], 0xfe
call esi
push 0x123
push ebx
call fcn.0100c55c
lea eax, [ebp - 0x804]
push 0x1002ae4
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push ebx
call esi
mov ebx, dword [0x101a3b4]
jmp 0x1012207
cmp dword [ebx], 0
je 0x1012204
lea eax, [ebp - 0x804]
push 0x1002ad8
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call esi
push 0
lea eax, [ebp - 0x80c]
push eax
push dword [ebx]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebx]
push dword [ebp - 0x808]
call esi
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x10121a7
lea eax, [ebp - 0x804]
push 0x1002ac8
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call esi
push 0x124
push dword [ebp - 0x808]
call fcn.0100c55c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01012bde
leave
ret 4
Function at 0x1012cf6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1002c08
call fcn.01012f9c
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1012d33
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1012d33
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1012d4b
cmp eax, 0x20b
je 0x1012d38
mov dword [ebp - 0x1c], ebx
jmp 0x1012d5f
cmp dword [ecx + 0x84], 0xe
jbe 0x1012d33
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1012d59
cmp dword [ecx + 0x74], 0xe
jbe 0x1012d33
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x101e934], 0xffffffff
or dword [0x101e938], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x101e8e8]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x101e8e4]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x101e93c], eax
call fcn.01013074
cmp dword [0x1017490], ebx
jne 0x1012dba
push fcn.01013074
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0101305d
push 0x1017014
push 0x101700c
call sub.msvcrt.dll__initterm
mov eax, dword [0x101e8e0]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x101e8dc]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1017008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1012e50
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1012e24
cmp al, 0x22
jne 0x1012e16
cmp byte [esi], 0x22
jne 0x1012e2d
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1012e37
cmp al, 0x20
jbe 0x1012e29
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1012e5b
movzx eax, word [ebp - 0x50]
jmp 0x1012e5e
cmp byte [esi], 0x20
jbe 0x1012e2d
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1012e50
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1012e7b
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1012eb0
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01012fd7
ret
Function at 0x1014db7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1017484]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
mov dword [ebp - 4], eax
jne 0x1014df1
test esi, esi
jne 0x1014dde
xor eax, eax
jmp 0x1014e4a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x1014e4a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call ebx
mov dword [ebp - 0x148], eax
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x1014e1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1014e33
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x50
pop ecx
lea esi, [ebp - 0x144]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
push dword [ebp - 0x148]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
test esi, esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01012bde
leave
ret 8

Function at 0x1014e8f
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
mov dword [ebp - 4], 1
call fcn.01013fed
mov edi, eax
mov al, byte [edi + 1]
cmp al, 0x3a
jne 0x1014ec0
cmp byte [edi + 2], 0x5c
jne 0x1014ec0
push 0x5c
lea eax, [edi + 3]
push eax
jmp 0x1014ef6
cmp byte [edi], 0x5c
jne 0x1014ef3
cmp al, 0x5c
jne 0x1014ef3
mov esi, dword [sym.imp.msvcrt.dll__mbschr]
lea eax, [edi + 2]
push 0x5c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1014f69
inc eax
push 0x5c
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1014f69
push 0x5c
inc eax
push eax
jmp 0x1014efc
push 0x5c
push edi
mov esi, dword [sym.imp.msvcrt.dll__mbschr]
call esi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x1014f69
push 0
push edi
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1014f2d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1014f40
mov dword [ebp - 4], 1
mov byte [ebx], 0x5c
push 0x5c
inc ebx
push ebx
call esi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x1014f06
jmp 0x1014f63
push dword [0x101eef8]
call sub.LOG.dll_LogBegin
push edi
push 0x1002e30
push 0x1002e28
call sub.LOG.dll_LogA
add esp, 0xc
call sub.LOG.dll_LogEnd
cmp dword [ebp - 4], 0
je 0x1014f93
cmp dword [ebp + 0xc], 0
je 0x1014f93
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov dword [ebp - 4], eax
jne 0x1014f93
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1014f93
mov dword [ebp - 4], 1
push edi
push 0
call fcn.01013df5
cmp dword [ebp - 4], 0
jne 0x1014fcb
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x1014fa4
sub edi, ecx
cmp edi, 0xf8
jb 0x1014fcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1014fcb
push 0xce
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1014fda
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1017484]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x210]
push eax
mov esi, 0x20a
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebx, ebx
cmp eax, ebx
je 0x1015076
cmp eax, esi
ja 0x1015076
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll__mbsrchr]
cmp eax, ebx
pop ecx
pop ecx
je 0x1015035
cmp byte [eax + 1], bl
jne 0x1015035
mov byte [eax], bl
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.01014db7
test eax, eax
jne 0x1015054
push 1
lea eax, [ebp - 0x210]
push eax
call fcn.01014e8f
cmp dword [ebp + 0xc], 0x104
jb 0x1015087
push dword [ebp - 0x420]
lea eax, [ebp - 0x210]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x10150dd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01012bde
leave
ret 0xc
lea eax, [ebp - 0x41c]
push eax
push ebx
push edi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x10150a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1015076
lea eax, [ebp - 0x41c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10150b2
sub eax, edx
lea ecx, [eax + 1]
cmp ecx, dword [ebp + 0xc]
ja 0x1015076
mov edi, dword [ebp - 0x420]
mov eax, ecx
shr ecx, 2
lea esi, [ebp - 0x41c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
inc eax
jmp 0x1015078
Function at 0x40115f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [esp + 0x2c], 1
je 0x401178
movzx esi, word [esp + 0x30]
xor eax, eax
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x402660], eax
mov dword [ebp - 0x4c], 0x30
call fcn.0040114f
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x401050
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Lyrik
mov dword [ebp - 0x20], eax
call fcn.00401142
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x40124c
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0x80
push str.Dindom
push str.Lyrik
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x402668], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402668]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x40124c
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401230
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x405bc3
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x405d0a
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x405c69
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x405c13
cmp ecx, 0x40010001
je 0x405c13
cmp ecx, 0x40020001
je 0x405c13
cmp ecx, 0x40030001
jne 0x405c1e
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x405c30
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x405c63
dec ecx
je 0x405c5d
dec ecx
je 0x405c57
dec ecx
je 0x405c51
dec ecx
je 0x405c4b
dec ecx
jne 0x405c76
or dword [ebp - 4], 0xe
jmp 0x405c76
or dword [ebp - 4], 0xc
jmp 0x405c76
or dword [ebp - 4], 0xa
jmp 0x405c76
or dword [ebp - 4], 8
jmp 0x405c76
or dword [ebp - 4], 6
jmp 0x405c76
or dword [ebp - 4], 2
jmp 0x405c76
cmp ecx, 0x40030000
jne 0x405c76
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x405c86
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x405c94
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x405ca2
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x405cb0
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x405cc5
push 3
jmp 0x405cf0
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x405cf6
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x405ce2
xor edx, edx
inc edx
jmp 0x405cf1
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x405d02
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x405cb3
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x405d17
mov eax, 0x8876086c
jmp 0x405d21
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8

Function at 0x410415
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x41046d
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x41046d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x41046d
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x410496
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x410504
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4104fb
cmp dword [ebp - 0xc], 4
jne 0x4104fb
cmp dword [ebp - 0x10], edi
je 0x4104fb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x718d7c], edi
xor eax, eax
jmp 0x41052c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x718d7c], edi
jge 0x410527
mov dword [0x718d7c], edi
call fcn.00410471
test eax, eax
je 0x410527
emms
mov dword [0x718d7c], 1
mov eax, dword [0x718d7c]
pop edi
leave
ret

Function at 0x41060c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x410643
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x410665
cmp dword [ebp - 0x20], 4
ja 0x41066f
jne 0x41065f
cmp dword [ebp - 0x1c], 0xa
jb 0x41065f
cmp word [ebp - 0x18], 0x55d
jae 0x41066f
mov byte [ebp + 0x73], 1
jmp 0x41066f
cmp dword [ebp - 0x14], 2
jne 0x410685
test bl, bl
je 0x4106a0
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x410690
dec eax
je 0x410689
sub eax, 3
jne 0x410685
cmp byte [ebp + 0x73], 0
je 0x4106b1
xor eax, eax
jmp 0x4106b9
call fcn.0041052f
jmp 0x4106b9
cmp byte [ebp + 0x73], 0
jne 0x410685
call fcn.00410567
and eax, 4
jmp 0x4106b9
cmp dword [ebp + 0x7c], 0xa
je 0x4106b1
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x4106b9
call fcn.00410567
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret