joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45b900
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x624
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x634], eax
mov esi, 1
mov dword [ebp - 4], 0
lea eax, [ebp - 0x628]
push eax
call fcn.0040d3c0
add esp, 4
test edi, edi
je 0x402ee2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jl 0x402ee2
movzx eax, byte [edi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaA]
test eax, eax
je 0x402ee2
cmp byte [edi + 1], 0x3a
jne 0x402ee2
cmp byte [edi + 2], 0x5c
jne 0x402ee2
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402f12
push 0xe0000003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Non_directory_path_incoming.
lea eax, [ebp - 0x528]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call ebx
push 0
push 0
push 0
push 0x60000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x124], 0
push 0x104
push 0
lea eax, [ebp - 0x123]
push eax
call fcn.0043a6b0
add esp, 0xc
push edi
lea eax, [ebp - 0x124]
push eax
call ebx
lea eax, [ebp - 0x124]
push eax
call fcn.004060d0
add esp, 4
push dword [ebp - 0x634]
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402f69
mov esi, 1
jmp 0x403028
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402f80
mov esi, 2
jmp 0x403028
push str.CreateDirectory
lea eax, [ebp - 0x628]
push eax
call ebx
push 0
push 0
push 0
push 0x60000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [ebp - 0x62c], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x4036c0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45b8e0
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x75c
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x624]
push eax
call fcn.0040d3c0
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
test esi, esi
je 0x403740
push esi
call edi
cmp eax, 2
jl 0x403740
movzx eax, byte [esi]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaA]
test eax, eax
je 0x403740
cmp byte [esi + 1], 0x3a
jne 0x403740
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x403770
push 0xe0000003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Non_directory_path_incoming.
lea eax, [ebp - 0x524]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call ebx
push 0
push 0
push 0
push 0x60000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [ebp - 0x120], 0
push 0x103
push 0
lea eax, [ebp - 0x11f]
push eax
call fcn.0043a6b0
add esp, 0xc
push esi
lea eax, [ebp - 0x120]
push eax
call ebx
lea eax, [ebp - 0x120]
push eax
call fcn.004060d0
add esp, 4
lea eax, [ebp - 0x120]
push eax
call edi
cmp byte [ebp + eax - 0x121], 0x5c
jne 0x4037d2
lea eax, [ebp - 0x120]
push eax
call edi
dec eax
cmp eax, 0x104
jae 0x40380f
mov byte [ebp + eax - 0x120], 0
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x403814
cmp byte [ebp + 0xc], 0
je 0x4038a4
push 0
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
neg eax
sbb eax, eax
neg eax
jmp 0x4038a6
call fcn.0043836c
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
jmp 0x4038a6
xor al, al
mov byte [ebp - 0x765], al
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x4049d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45bc00
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 0x178], 0
mov dword [ebp - 4], 0
xor ebx, ebx
mov byte [ebp - 0x5c], bl
push 0x3f
push ebx
lea eax, [ebp - 0x5b]
push eax
call fcn.0043a6b0
mov byte [ebp - 0x164], bl
push 0x104
push ebx
lea eax, [ebp - 0x163]
push eax
call fcn.0043a6b0
add esp, 0x18
push esi
lea eax, [ebp - 0x164]
push eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
push 0x44a558
lea eax, [ebp - 0x164]
push eax
call fcn.00439170
add esp, 8
mov esi, eax
test esi, esi
je 0x404a92
lea ecx, [esi + 1]
push ecx
call fcn.004393d3
add esp, 4
movzx ebx, ax
mov byte [esi], 0
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x5c]
push eax
call edi
push 4
call fcn.004380a8
add esp, 4
mov esi, eax
mov dword [ebp - 0x178], esi
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
mov edi, dword [sym.imp.KERNEL32.dll_RaiseException]
cmp eax, 0xffffffff
jne 0x404aca
push 0
push 0
push 0
push 0x60000000
call edi
mov eax, 2
mov word [ebp - 0x174], ax
push ebx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x172], ax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x170], eax
push 0x10
lea eax, [ebp - 0x174]
push eax
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x404b38
push 0
push 0
push 0
push 0x60000000
call edi
jmp 0x404b38
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x405690
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45b980
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x520]
push eax
call fcn.0040d3c0
add esp, 4
cmp byte [ebp + 0x14], 0
je 0x40570c
push 0
push edi
call fcn.00403060
add esp, 8
test eax, eax
jne 0x40570c
push eax
push eax
push eax
push 0x60000000
mov esi, dword [sym.imp.KERNEL32.dll_RaiseException]
call esi
jmp 0x405712
mov esi, dword [sym.imp.KERNEL32.dll_RaiseException]
xor eax, eax
cmp byte [ebp + 0x10], al
setne al
add eax, 0xa
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x405749
push str.MoveFileEx
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push 0
push 0x60000001
call esi
mov al, 1
jmp 0x4057d4
mov byte [ebp - 0x521], al
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x40b510
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45c0a8
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x10d4
call fcn.00439e90
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10e4], eax
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10e8], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x40b570
mov byte [ebx], 0
mov byte [ebp - 0xdc], 0
push 0x7f
push 0
lea eax, [ebp - 0xdb]
push eax
call fcn.0043a6b0
mov byte [ebp - 0x5c], 0
push 0x3f
push 0
lea eax, [ebp - 0x5b]
push eax
call fcn.0043a6b0
add esp, 0x18
push str.get_module_name
lea eax, [ebp - 0x5c]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
test eax, eax
je 0x40b67a
push 0
push 0
lea eax, [ebp - 0xdc]
push eax
call fcn.00404250
add esp, 0xc
test al, al
je 0x40b67a
push str.OpenSCManager
lea eax, [ebp - 0x5c]
push eax
call esi
test eax, eax
je 0x40b67a
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x40b67a
push str.OpenService
lea eax, [ebp - 0x5c]
push eax
call esi
test eax, eax
je 0x40b67a
push 0x10000
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x10e4]
test ecx, ecx
cmovne eax, ecx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x10e4], eax
test eax, eax
je 0x40b67a
push 0x44bb34
lea eax, [ebp - 0x5c]
push eax
call esi
test eax, eax
je 0x40b67a
push dword [ebp - 0x10e4]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40b67a
push 0x44acd4
lea eax, [ebp - 0x5c]
push eax
call esi
test eax, eax
je 0x40b67a
push dword [ebp - 0x10e4]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
test eax, eax
je 0x40b67a
push edi
call esi
test eax, eax
jne 0x40b6ff
test ebx, ebx
je 0x40b6ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov byte [ebp - 0x10dc], 0
push 0xfff
push 0
lea eax, [ebp - 0x10db]
push eax
call fcn.0043a6b0
lea eax, [ebp - 0x10dc]
push eax
push edi
call fcn.0040c5d0
add esp, 0x14
lea eax, [ebp - 0x5c]
push eax
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push str._completed_with_unsuccess._r_n_r_ncommon_environment_state_:_r_n_r_nthreads_last_error_code_value_is
push ebx
call esi
push 0xa
push 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, ebx
push eax
push edi
call fcn.0043971d
add esp, 0x10
push 0x44b880
push ebx
call esi
lea eax, [ebp - 0x10dc]
push eax
push ebx
call esi
push 0
push 0
push 0
push 0x60000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 1
jmp 0x40b752
mov byte [ebp - 0x10dd], al
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x40fed0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45c268
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x520]
push eax
call fcn.0040d3c0
add esp, 4
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x460b60], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x40ff62
push str.CreateEvent
lea eax, [ebp - 0x520]
push eax
call esi
push 0
push 0
push 0
push 0x60000001
mov edi, dword [sym.imp.KERNEL32.dll_RaiseException]
call edi
jmp 0x40ff68
mov edi, dword [sym.imp.KERNEL32.dll_RaiseException]
cmp dword [0x460b58], 0
jne 0x40ffc7
push 0x460b5c
push 0
push ebx
push 0x40e9d0
push 0
push 0
call fcn.0043a802
add esp, 0x18
mov dword [0x460b58], eax
test eax, eax
jne 0x40ffc7
push 0xe000000d
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str._beginthreadex__
lea eax, [ebp - 0x520]
push eax
call esi
push str.jobkernel_thread_could_not_be_started
lea eax, [ebp - 0x420]
push eax
call esi
push 0
push 0
push 0
push 0x60000001
call edi
mov al, 1
jmp 0x410052
mov byte [ebp - 0x521], al
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x41a470
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45c4e8
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x520]
push eax
call fcn.0040d3c0
add esp, 4
cmp dword [0x460e04], 0
jne 0x41a52b
push 0x460e0c
push 0
push esi
push 0x418d10
push 0
push 0
call fcn.0043a802
add esp, 0x18
mov dword [0x460e04], eax
test eax, eax
jne 0x41a52b
push 0xe000000d
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str._beginthreadex__
lea eax, [ebp - 0x520]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
push str.netfconn_thread_could_not_be_started
lea eax, [ebp - 0x420]
push eax
call esi
push 0
push 0
push 0
push 0x60000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 1
jmp 0x41a5cb
mov byte [ebp - 0x521], al
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret

Function at 0x41a600
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45c4c8
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x520]
push eax
call fcn.0040d3c0
add esp, 4
cmp dword [0x460e00], 0
jne 0x41a6bb
push 0x460e08
push 0
push esi
push 0x419320
push 0
push 0
call fcn.0043a802
add esp, 0x18
mov dword [0x460e00], eax
test eax, eax
jne 0x41a6bb
push 0xe000000d
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str._beginthreadex__
lea eax, [ebp - 0x520]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call esi
push str.smsfiler_thread_could_not_be_started
lea eax, [ebp - 0x420]
push eax
call esi
push 0
push 0
push 0
push 0x60000001
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 1
jmp 0x41a746
mov byte [ebp - 0x521], al
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x41c180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x45c748
push 0x439ec0
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x45f478]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x520]
push eax
call fcn.0040d3c0
add esp, 4
push 0x460e3c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x44eab0
push str.Queue.LOG
call fcn.0043ac80
add esp, 8
mov esi, eax
test esi, esi
je 0x41c20a
push esi
push 1
push dword [ebp + 0xc]
push edi
call fcn.0043adec
push esi
call fcn.0043ab45
add esp, 0x14
mov bl, 1
jmp 0x41c2aa
mov byte [ebp - 0x521], bl
mov dword [ebp - 4], 0xfffffffe
push 0x460e3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00439a01
mov esp, ebp
pop ebp
ret
Function at 0x443246
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45f478]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0043c983
mov dword [ebp - 0x14], eax
cmp dword [0x464980], edi
jne 0x443337
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4432c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x443417
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x443417
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x443417
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x464980], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x464984], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x464988], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x464990], eax
test eax, eax
je 0x443334
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x46498c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x44335c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44334f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x443371
push 4
pop eax
jmp 0x443419
cmp dword [ebp - 0x14], edi
je 0x443371
push dword [0x464980]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x443356
mov eax, dword [0x46498c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4433cf
cmp dword [0x464990], esi
je 0x4433cf
push eax
call ebx
push dword [0x464990]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4433cf
test eax, eax
je 0x4433cf
call ecx
test eax, eax
je 0x4433c4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4433c4
test byte [ebp - 8], 1
jne 0x4433cf
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4433ff
mov eax, dword [0x464984]
cmp eax, esi
je 0x4433fc
push eax
call ebx
test eax, eax
je 0x4433fc
call eax
mov edi, eax
test edi, edi
je 0x4433fc
mov eax, dword [0x464988]
cmp eax, esi
je 0x4433fc
push eax
call ebx
test eax, eax
je 0x4433fc
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x464980]
call ebx
test eax, eax
je 0x443417
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x443419
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00439a01
leave
ret
Function at 0x40d15a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407e6b
mov dword [ebp - 0x14], eax
cmp dword [0x4486fc], esi
jne 0x40d24d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d1da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d32d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d32d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d32d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4486fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x448700], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x448704], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44870c], eax
test eax, eax
je 0x40d24a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x448708], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d272
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d265
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d287
push 4
pop eax
jmp 0x40d32f
cmp dword [ebp - 0x14], esi
je 0x40d287
push dword [0x4486fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d26c
mov eax, dword [0x448708]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d2e5
cmp dword [0x44870c], edi
je 0x40d2e5
push eax
call ebx
push dword [0x44870c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d2e5
test eax, eax
je 0x40d2e5
call ecx
test eax, eax
je 0x40d2da
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d2da
test byte [ebp - 8], 1
jne 0x40d2e5
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d315
mov eax, dword [0x448700]
cmp eax, edi
je 0x40d312
push eax
call ebx
test eax, eax
je 0x40d312
call eax
mov esi, eax
test esi, esi
je 0x40d312
mov eax, dword [0x448704]
cmp eax, edi
je 0x40d312
push eax
call ebx
test eax, eax
je 0x40d312
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4486fc]
call ebx
test eax, eax
je 0x40d32d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d32f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043b8
mov esp, ebp
pop ebp
ret
Function at 0x408784
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x4087a8
jl 0x40879f
test esi, esi
jne 0x4087a8
xor eax, eax
xor edx, edx
jmp 0x40889f
cmp dword [edi + 0x38], 0
je 0x4087bd
push ebx
push esi
push dword [ebp + 8]
call fcn.004088a6
jmp 0x40889f
mov eax, dword [edi + 0x1c]
mov edx, esi
mov dword [ebp - 8], edx
mov ecx, dword [eax]
test ecx, ecx
je 0x4087d2
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4087d4
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esi
test eax, eax
je 0x408815
cmp eax, esi
jb 0x4087e7
mov eax, esi
mov dword [ebp - 4], eax
push eax
push ecx
push dword [ebp + 8]
call fcn.0040a2f0
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, dword [ebp + 8]
sub edx, ecx
add eax, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], edx
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x40881b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x408893
mov ecx, edi
call fcn.00407f83
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x40886f
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.00410984
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x40886b
cmp edx, eax
ja 0x408838
jmp 0x408872
sub esi, edx
jmp 0x408898
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x408896
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.00410984
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x408896
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4195af
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00419425