joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd41058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd411a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd4107e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd4106a
add dl, dl
jne 0xd41089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd410dc
xor eax, eax
add dl, dl
jne 0xd41096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd4117d
add dl, dl
jne 0xd410a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd410b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd410bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd410c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd410d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd41075
mov eax, 1
add dl, dl
jne 0xd410ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd410f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd410e1
sub eax, ebx
mov ebx, 1
jne 0xd41128
mov ecx, 1
add dl, dl
jne 0xd4110e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd41119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd41105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd41075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd4113f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd4114a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd41136
cmp eax, 0x7d00
jae 0xd4116d
cmp eax, 0x500
jb 0xd41168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd41075
cmp eax, 0x7f
ja 0xd41170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd41075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd4119e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd41075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404de1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x408460]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi + 0x24], edi
mov dword [ebp - 4], edi
mov dword [esi + 0x2c], edi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov dword [esi + 4], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x14], ecx
mov cl, byte [ebp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [ebp + 0x20]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x24]
mov byte [ebp - 4], 1
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esi + 0x20], cl
mov dword [esi + 0x30], edi
test cl, cl
jne 0x403b63
mov dword [ebp + 0x28], edi
test eax, eax
je 0x403b30
lea ecx, [edx + 0xc]
mov edx, eax
mov eax, dword [ecx]
cmp eax, edi
jbe 0x403b1a
mov edi, eax
add ecx, 0x10
dec edx
jne 0x403b12
mov dword [ebp + 0x28], edi
mov eax, 0x406784
cmp edi, 0x100000
ja 0x403b33
lea eax, [ebp + 0x28]
mov eax, dword [eax]
mov dword [esi + 0x28], eax
add eax, 0xa
push eax
call fcn.00404230
mov edi, eax
mov eax, dword [esi + 0x24]
add esp, 4
cmp eax, edi
je 0x403b59
push eax
call fcn.004042c6
add esp, 4
mov dword [esi + 0x24], edi
push 0
call fcn.004042c6
add esp, 4
xor ecx, ecx
mov eax, ebx
mov edx, 0x44
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.00404230
add esp, 4
mov dword [ebp + 0x28], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x403baf
push 0x402640
push 0x402600
push ebx
lea edi, [eax + 4]
push 0x44
push edi
mov dword [eax], ebx
call fcn.0040438d
jmp 0x403bb1
xor edi, edi
mov eax, dword [esi + 0x2c]
mov byte [ebp - 4], 1
cmp eax, edi
je 0x403be0
test eax, eax
je 0x403bdd
mov ecx, dword [eax - 4]
lea ebx, [eax - 4]
push 0x402640
push ecx
push 0x44
push eax
call fcn.0040432a
push ebx
call fcn.004042c6
add esp, 4
mov dword [esi + 0x2c], edi
mov ecx, esi
call fcn.004036d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24

Function at 0x10553204
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1055320e
pushal
call 0x10553214
pop ebp
sub ebp, 0x10
sub ebp, 0x553204
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10553238
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10553241
mov eax, 0x553204
add eax, ebp
add eax, 0x63
mov ecx, 0x5fc
mov edx, 0xfa44e47f
xor byte [eax], dl
inc eax
dec ecx
jne 0x10553258
jmp 0x1055326b
hlt
Function at 0x493953
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004939d2
jae 0x49395f
xor ecx, ecx
call fcn.004939d2
jae 0x493989
xor eax, eax
call fcn.004939d2
jae 0x49399a
mov al, 0x10
call fcn.004939d2
adc al, al
jae 0x49397b
jne 0x4939c7
stosb byte es:[edi], al
jmp 0x493960
call fcn.004939de
dec ecx
loop 0x4939a6
mov eax, ebp
call fcn.004939dc
jmp 0x4939c8
lodsb al, byte [esi]
shr eax, 1
je 0x4939ee
adc ecx, 2
mov ebp, eax
jmp 0x4939c8
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004939dc
cmp eax, 0x7d00
jae 0x4939c6
cmp eax, 0x500
jae 0x4939c7
cmp eax, 0x7f
ja 0x4939c8
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x493960
pop ebp
ret 8

Function at 0x4cc953
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004cc9d2
jae 0x4cc95f
xor ecx, ecx
call fcn.004cc9d2
jae 0x4cc989
xor eax, eax
call fcn.004cc9d2
jae 0x4cc99a
mov al, 0x10
call fcn.004cc9d2
adc al, al
jae 0x4cc97b
jne 0x4cc9c7
stosb byte es:[edi], al
jmp 0x4cc960
call fcn.004cc9de
dec ecx
loop 0x4cc9a6
mov eax, ebp
call fcn.004cc9dc
jmp 0x4cc9c8
lodsb al, byte [esi]
shr eax, 1
je 0x4cc9ee
adc ecx, 2
mov ebp, eax
jmp 0x4cc9c8
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004cc9dc
cmp eax, 0x7d00
jae 0x4cc9c6
cmp eax, 0x500
jae 0x4cc9c7
cmp eax, 0x7f
ja 0x4cc9c8
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4cc960
pop ebp
ret 8

Function at 0x5052b3
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00505332
jae 0x5052bf
xor ecx, ecx
call fcn.00505332
jae 0x5052e9
xor eax, eax
call fcn.00505332
jae 0x5052fa
mov al, 0x10
call fcn.00505332
adc al, al
jae 0x5052db
jne 0x505327
stosb byte es:[edi], al
jmp 0x5052c0
call fcn.0050533e
dec ecx
loop 0x505306
mov eax, ebp
call fcn.0050533c
jmp 0x505328
lodsb al, byte [esi]
shr eax, 1
je 0x50534e
adc ecx, 2
mov ebp, eax
jmp 0x505328
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0050533c
cmp eax, 0x7d00
jae 0x505326
cmp eax, 0x500
jae 0x505327
cmp eax, 0x7f
ja 0x505328
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5052c0
pop ebp
ret 8
Function at 0x408520
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x45fae4]
mov dword [ebp - 4], eax
mov dword [ebp - 0xac], ecx
mov ecx, dword [ebp - 0xac]
call fcn.00408960
mov eax, dword [ebp - 0xac]
mov dword [eax], 0x3c
mov ecx, dword [ebp - 0xac]
mov dword [ecx + 8], 0x400000
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax + 8]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 0xac]
mov byte [edx + 0xc], 0
push 0x94
push 0
lea eax, [ebp - 0xa0]
push eax
call fcn.0040d000
add esp, 0xc
mov dword [ebp - 0xa0], 0x94
lea ecx, [ebp - 0xa0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 2
jne 0x4085c2
cmp dword [ebp - 0x9c], 5
jb 0x4085c0
mov edx, dword [ebp - 0xac]
mov byte [edx + 0xc], 1
jmp 0x4085f0
cmp dword [ebp - 0x90], 1
jne 0x4085f0
cmp dword [ebp - 0x9c], 4
ja 0x4085e6
cmp dword [ebp - 0x9c], 4
jne 0x4085f0
cmp dword [ebp - 0x98], 0
jbe 0x4085f0
mov eax, dword [ebp - 0xac]
mov byte [eax + 0xc], 1
mov ecx, dword [ebp - 0xac]
mov dword [ecx + 0x10], 0x710
mov edx, dword [ebp - 0xac]
mov dword [edx + 0x14], 0x428d40
mov ecx, dword [ebp - 0xac]
add ecx, 0x18
call fcn.00408c50
test eax, eax
jge 0x408672
push str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
push 0
mov ecx, 0x46b010
call fcn.00408c40
push eax
push 0x3c
push 0x428d50
lea ecx, [ebp - 0xa8]
call fcn.00408ba0
push eax
call fcn.00408bd0
add esp, 0x10
xor eax, eax
jne 0x40866b
push 0x428da4
push 0
push 0x3d
push 0x428da8
push 2
call fcn.0040f7d0
add esp, 0x14
cmp eax, 1
jne 0x40866b
int3
mov byte [0x4605e4], 1
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 4]
call fcn.0040f460
mov esp, ebp
pop ebp
ret
Function at 0x40a870
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x45fae4]
mov dword [ebp - 0xc], eax
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x410], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x414], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040b130
movzx edx, al
test edx, edx
je 0x40aa16
mov ecx, 0x46b07c
call fcn.0040b2d0
movzx eax, byte [eax + 0x42b]
test eax, eax
je 0x40a941
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s__d__:
mov eax, 0x400
sub eax, dword [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x414]
lea edx, [ebp + ecx - 0x410]
push edx
call fcn.00415a00
add esp, 0x14
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], 0
jge 0x40a92f
mov dword [ebp - 0x414], 0x400
jmp 0x40a941
mov eax, dword [ebp - 0x414]
add eax, dword [ebp - 0x418]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 8], 0
je 0x40a9b9
mov ecx, 0x46b07c
call fcn.0040b2d0
movzx ecx, byte [eax + 0x42a]
test ecx, ecx
je 0x40a9b9
mov ecx, dword [ebp - 8]
call fcn.0040b2f0
push eax
push str._S:
mov edx, 0x400
sub edx, dword [ebp - 0x414]
push edx
mov eax, dword [ebp - 0x414]
lea ecx, [ebp + eax - 0x410]
push ecx
call fcn.00415a00
add esp, 0x10
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jge 0x40a9a7
mov dword [ebp - 0x414], 0x400
jmp 0x40a9b9
mov edx, dword [ebp - 0x414]
add edx, dword [ebp - 0x41c]
mov dword [ebp - 0x414], edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, 0x400
sub edx, dword [ebp - 0x414]
push edx
mov eax, dword [ebp - 0x414]
lea ecx, [ebp + eax - 0x410]
push ecx
call fcn.00415b30
add esp, 0x10
mov byte [ebp - 0x11], 0
cmp dword [ebp - 4], 0
je 0x40aa09
lea edx, [ebp - 0x410]
push edx
push 0x42a368
push 0
push 0
push 0
push 0
call dword [ebp - 4]
add esp, 0x18
jmp 0x40aa16
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0xc]
call fcn.0040f460
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40b840
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ab60
push 0x4158f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov dword [ebp - 0x40], ecx
push 0
mov ecx, dword [ebp - 0x40]
call fcn.0040b970
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 0x40]
cmp dword [edx + 0x24], 0
jne 0x40b896
jmp 0x40b8f0
push 0
push 0
push 0
push 0xf001f
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, dword [ebp - 0x40]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 0x40]
cmp dword [eax + 0x2c], 0
jne 0x40b8bf
jmp 0x40b8f0
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x40]
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx + 0x1c]
call fcn.0040c3b0
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp - 0x40]
mov byte [edx + 0x28], 1
mov dword [ebp - 4], 0xffffffff
call fcn.0040b8fe
jmp 0x40b954
mov edx, dword [ebp - 0x40]
mov al, byte [edx + 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40f460
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45fae4]
jne 0x40f469
ret
jmp fcn.0040f470
Function at 0x412540
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x412566
xor eax, eax
jmp 0x4125ed
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x4550
je 0x412581
xor eax, eax
jmp 0x4125ed
mov edx, dword [ebp - 8]
add edx, 0x18
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x10b
je 0x4125a7
cmp dword [ebp - 0x14], 0x20b
je 0x4125c7
jmp 0x4125eb
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x5c], 0xe
ja 0x4125b4
xor eax, eax
jmp 0x4125ed
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp dword [eax + 0xd0], 0
setne cl
mov eax, ecx
jmp 0x4125ed
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x6c], 0xe
ja 0x4125da
xor eax, eax
jmp 0x4125ed
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ecx + 0xe0], 0
setne al
jmp 0x4125ed
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x412dc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46b138], 1
jne 0x412ddd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x46b134], 1
mov cl, byte [ebp + 0x10]
mov byte [0x46b130], cl
cmp dword [ebp + 0xc], 0
jne 0x412e42
cmp dword [0x46c7ec], 0
je 0x412e30
mov edx, dword [0x46c7e8]
sub edx, 4
mov dword [0x46c7e8], edx
mov eax, dword [0x46c7e8]
cmp eax, dword [0x46c7ec]
jb 0x412e30
mov ecx, dword [0x46c7e8]
cmp dword [ecx], 0
je 0x412e2e
mov edx, dword [0x46c7e8]
call dword [edx]
jmp 0x412dff
push 0x4300ec
push 0x4300e4
call fcn.00412ef0
add esp, 8
push 0x4300f8
push 0x4300f0
call fcn.00412ef0
add esp, 8
cmp dword [0x46b13c], 0
jne 0x412e7b
push 0xffffffffffffffff
call fcn.0040e510
add esp, 4
and eax, 0x20
je 0x412e7b
mov dword [0x46b13c], 1
call fcn.0040edf0
cmp dword [ebp + 0x10], 0
je 0x412e83
jmp 0x412e99
mov dword [0x46b138], 1
mov eax, dword [ebp + 8]
push eax
call fcn.00412ea0
add esp, 4
pop ebp
ret
Function at 0x418ee0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
cmp dword [0x46b184], 0
jne 0x418f9b
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x418f32
push str.MessageBoxA
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46b184], eax
cmp dword [0x46b184], 0
jne 0x418f39
xor eax, eax
jmp 0x41904a
push str.GetActiveWindow
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46b188], eax
push str.GetLastActivePopup
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46b18c], eax
cmp dword [0x46b0f8], 2
jne 0x418f9b
push str.GetUserObjectInformationA
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46b194], eax
cmp dword [0x46b194], 0
je 0x418f9b
push str.GetProcessWindowStation
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46b190], eax
cmp dword [0x46b190], 0
je 0x418fdc
call dword [0x46b190]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x418fd5
lea edx, [ebp - 0x18]
push edx
push 0xc
lea eax, [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [0x46b194]
test eax, eax
je 0x418fd5
mov edx, dword [ebp - 4]
and edx, 1
jne 0x418fdc
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0
je 0x419006
cmp dword [0x46b104], 4
jb 0x418ff8
mov eax, dword [ebp + 0x10]
or eax, 0x200000
mov dword [ebp + 0x10], eax
jmp 0x419004
mov ecx, dword [ebp + 0x10]
or ecx, 0x40000
mov dword [ebp + 0x10], ecx
jmp 0x419034
cmp dword [0x46b188], 0
je 0x419018
call dword [0x46b188]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x419034
cmp dword [0x46b18c], 0
je 0x419034
mov edx, dword [ebp - 0x14]
push edx
call dword [0x46b18c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [0x46b184]
mov esp, ebp
pop ebp
ret
Function at 0x41c0f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x45fae4]
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 4], 0
jmp 0x41c114
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x13
jae 0x41c12d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx*8 + 0x460078]
jne 0x41c12b
jmp 0x41c12d
jmp 0x41c10b
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax*8 + 0x460078]
jne 0x41c2eb
cmp dword [ebp + 8], 0xfc
je 0x41c173
cmp dword [ebp + 8], 0xff
je 0x41c173
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x46007c]
push eax
push 0
push 0
push 0
push 1
call fcn.0040f7d0
add esp, 0x14
cmp eax, 1
jne 0x41c173
int3
cmp dword [0x46b0e4], 1
je 0x41c18e
cmp dword [0x46b0e4], 0
jne 0x41c1c7
cmp dword [0x45fb84], 1
jne 0x41c1c7
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx*8 + 0x46007c]
push eax
call fcn.0040cc30
add esp, 4
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*8 + 0x46007c]
push edx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41c2eb
cmp dword [ebp + 8], 0xfc
je 0x41c2eb
mov byte [ebp - 0x1c], 0
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41c204
push str._program_name_unknown_
lea ecx, [ebp - 0x120]
push ecx
call fcn.004189c0
add esp, 8
lea edx, [ebp - 0x120]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.0040cc30
add esp, 4
add eax, 1
cmp eax, 0x3c
jbe 0x41c24d
lea ecx, [ebp - 0x120]
push ecx
call fcn.0040cc30
add esp, 4
mov edx, dword [ebp - 0x10]
lea eax, [edx + eax - 0x3b]
mov dword [ebp - 0x10], eax
push 3
push 0x42b87c
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00419050
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
call fcn.0040cc30
add esp, 4
mov esi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax*8 + 0x46007c]
push ecx
call fcn.0040cc30
add esp, 4
lea eax, [esi + eax + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.00415af0
mov dword [ebp - 0x124], esp
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0xc], edx
push str.Runtime_Error__n_nProgram:
mov eax, dword [ebp - 0xc]
push eax
call fcn.004189c0
add esp, 8
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.004189d0
add esp, 8
push 0x42b7f0
mov eax, dword [ebp - 0xc]
push eax
call fcn.004189d0
add esp, 8
mov ecx, dword [ebp - 4]
mov edx, dword [ecx*8 + 0x46007c]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.004189d0
add esp, 8
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00418ee0
add esp, 0xc
lea esp, [ebp - 0x128]
mov ecx, dword [ebp - 0x14]
call fcn.0040f460
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41c350
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, 4
call fcn.00415af0
mov dword [ebp - 0x64], esp
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x10], eax
push 0x1c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x41c384
xor eax, eax
jmp 0x41c492
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
not eax
and eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x46b0f8]
sub ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0xfffffff1
add ecx, 0x11
imul ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x60]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 8]
jae 0x41c3d7
xor eax, eax
jmp 0x41c492
cmp dword [0x46b0f8], 1
je 0x41c45d
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c], eax
push 0x1c
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x41c401
xor eax, eax
jmp 0x41c492
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp - 0x48]
and ecx, 0x1000
je 0x41c3e6
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x5c], edx
mov eax, dword [ebp - 0x44]
and eax, 0x100
je 0x41c42c
mov eax, 1
jmp 0x41c492
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x5c]
jae 0x41c438
xor eax, eax
jmp 0x41c492
mov edx, dword [ebp - 0x5c]
cmp edx, dword [ebp - 8]
jae 0x41c446
mov eax, dword [ebp - 8]
mov dword [ebp - 0x5c], eax
push 4
push 0x1000
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jmp 0x41c463
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
mov ecx, dword [0x46b0f8]
sub ecx, 1
neg ecx
sbb ecx, ecx
and ecx, 0x103
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x64]
mov esp, ebp
pop ebp
ret

Function at 0x41c4a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x45fae4]
mov dword [ebp - 8], eax
mov byte [ebp - 0xa], 0
push 6
lea eax, [ebp - 0x10]
push eax
push 0x1004
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41c4d4
mov dword [ebp - 4], 0xffffffff
jmp 0x41c4e3
lea edx, [ebp - 0x10]
push edx
call fcn.00422700
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0040f460
mov esp, ebp
pop ebp
ret