joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406d69
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42ae70
cmp edx, dword [eax]
je 0x406d8b
add eax, 8
inc ecx
cmp eax, 0x42af00
jl 0x406d7c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42ae70]
jne 0x406eb9
mov eax, dword [0x42fbd8]
cmp eax, 1
je 0x406e93
test eax, eax
jne 0x406dbc
cmp dword [0x42a830], 1
je 0x406e93
cmp edx, 0xfc
je 0x406eb9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x406df3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004097e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004043e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406e36
lea eax, [ebp - 0x1a4]
push eax
call fcn.004043e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x425474
push edi
call fcn.0040a680
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004097e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004097f0
lea eax, [ebp - 0xa0]
push 0x425454
push eax
call fcn.004097f0
push dword [esi + 0x42ae74]
lea eax, [ebp - 0xa0]
push eax
call fcn.004097f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040a5f7
add esp, 0x2c
pop edi
jmp 0x406eb9
lea eax, [ebp + 8]
lea esi, [esi + 0x42ae74]
push 0
push eax
push dword [esi]
call fcn.004043e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40fad0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00403f80
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x40fb9b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x40fb9b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x40fb4e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x40fb59
or bh, 8
and edi, 0x8000000
je 0x40fb74
mov eax, dword [0x43137c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x40fb9b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ff70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40ff9b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x40ffbf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x40ffda
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x41202d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x412065
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0041540b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004153e3
jmp 0x412071
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x413abf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x413b01
call fcn.0041f178
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x413b01
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x413af8
xor eax, eax
jmp 0x413b09
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00413b0f
pop edi
pop esi
pop ebx
ret 4

Function at 0x417075
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0041f178
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4170a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004170b9
pop edi
pop esi
pop ebx
ret 8
Function at 0x4173ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x4218f8
call fcn.004036d8
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
mov eax, dword [esi + 0x48]
mov edi, dword [esi + 0x44]
mov dword [ebp - 0x18], eax
call fcn.0041f178
cmp dword [esi + 0x40], 0
mov ebx, dword [eax + 0xc]
je 0x4173ea
call fcn.0041f178
mov ebx, dword [eax + 0xc]
push 5
push dword [esi + 0x40]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4173f8
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x417406
or eax, 0xffffffff
jmp 0x4174ee
mov ecx, esi
call fcn.00417321
mov dword [ebp - 0x14], eax
call fcn.00411b7d
xor edi, edi
cmp dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
je 0x41743d
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41743d
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x20], 1
push esi
mov dword [ebp - 4], edi
call fcn.00411b31
push dword [ebp - 0x14]
call fcn.0041167f
push ebx
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.004170b9
cmp eax, edi
je 0x4174b0
test byte [esi + 0x24], 0x10
je 0x41747e
push 4
mov ecx, esi
pop ebx
call fcn.004141f7
test ah, 1
je 0x417476
push 5
pop ebx
push ebx
mov ecx, esi
call fcn.00413c11
cmp dword [esi + 0x1c], edi
je 0x4174b0
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004142dd
jmp 0x4174b0
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], edi
je 0x4174c4
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4174dd
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x1c]
jne 0x4174dd
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, esi
call fcn.0041735b
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x41fc77
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41fca5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41fcc3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041fbdd
jmp 0x41fcc3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41fcc3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041fbdd
test edi, edi
mov eax, edi
jne 0x41fcad
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4b3970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x10], edx
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [0x4eb480], 0
je 0x4b3ab1
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
mov edx, dword [0x4e3e70]
mov edx, dword [edx]
xor al, byte [edx + 0xb8]
je 0x4b3ab1
mov eax, dword [0x4eb484]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [0x4eb480]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4b3a80
inc ebx
xor edi, edi
mov edx, edi
mov eax, dword [0x4eb480]
call fcn.00423b34
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x10]
je 0x4b3a78
mov eax, dword [ebp - 0x14]
cmp byte [eax + 0x1e2], 0
je 0x4b3a78
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
call dword [edx + 0x4c]
test al, al
je 0x4b3a78
mov eax, dword [ebp - 0x14]
call fcn.004bea4c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b3a78
push ebp
call fcn.004b392c
pop ecx
test al, al
jne 0x4b3a78
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbb
call fcn.00403fbc
test al, al
je 0x4b3a78
mov byte [ebp - 1], 1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 1]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov si, 0xffbc
call fcn.00403fbc
cmp byte [ebp - 1], 0
je 0x4b3a78
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x28]
call fcn.00408714
test al, al
je 0x4b3a78
mov edx, dword [ebp - 0x14]
mov eax, dword [0x4eb484]
call fcn.004b30a4
inc edi
dec ebx
jne 0x4b39d5
mov eax, dword [0x4eb484]
cmp dword [eax + 8], 0
jle 0x4b3a98
mov eax, dword [0x4eb484]
jo 0x4b3afa
outsd dx, dword [esi]
jae 0x4b3b05
push 0x2e656e65
imul esp, dword [bp], 0xe8458b55
imul esp, dword cs:[bp], 0xe8458b55
call fcn.004b3790
pop ecx
test al, al
jne 0x4b3ab1
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004239dc
jmp 0x4b3b12
or al, 0x8b
shl byte [ecx + 0x4eb480], 1
call fcn.00423a28
pop esi
pop ebx
ret
Function at 0x407c22
Capabilities:
Encode data using xor

Disassembly:
shr dword [eax], 0xe7
cdq
and dword [edi], esi
sbb esp, dword [eax - 0x3f28d645]
invalid

Function at 0x40fec0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x40ff18
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x46a718
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x40ff0b
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
jmp 0x40ff1a
xor eax, eax
pop esi
leave
ret 4

Function at 0x4100ef
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x465044]
jne 0x410100
test ecx, 0xffff0000
jne 0x410100
ret
jmp fcn.00410105
Function at 0x41c000
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20c
mov esi, dword [ebp + 0x1c]
test esi, esi
je 0x41c165
cmp dword [0x4b0600], 0
jne 0x41c096
call fcn.004142b0
push 0x46b588
call sub.msvcrt.dll_getenv
pop edx
test eax, eax
jne 0x41c039
mov eax, str.XErrorDB
push eax
call fcn.00415dcd
mov edx, dword [0x465058]
mov edi, eax
pop eax
cmp dword [edx], 0
je 0x41c057
mov eax, dword [0x465050]
push dword [eax]
call dword [edx]
pop eax
cmp dword [0x4b0600], 0
mov ebx, 1
jne 0x41c06d
mov dword [0x4b0600], edi
xor bl, bl
mov edx, dword [0x465054]
cmp dword [edx], 0
je 0x41c082
mov eax, dword [0x465050]
push dword [eax]
call dword [edx]
pop eax
test ebx, ebx
je 0x41c08d
push edi
call fcn.004183ed
pop ecx
cmp dword [0x4b0600], 0
je 0x41c114
cld
mov edi, dword [ebp + 0xc]
xor edx, edx
mov al, dl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edi, dword [ebp + 0x10]
mov ebx, ecx
or ecx, 0xffffffff
not ebx
repne scasb al, byte es:[edi]
not ecx
lea edi, [ebp - 0x20c]
lea eax, [ecx + ebx]
cmp eax, 0x200
jbe 0x41c0ca
push eax
call sub.msvcrt.dll_malloc
pop edx
mov edi, eax
test edi, edi
je 0x41c114
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x46b59a
push edi
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
push str.ErrorType.ErrorNumber
push edi
push dword [0x4b0600]
call fcn.00418305
lea eax, [ebp - 0x20c]
add esp, 0x24
cmp edi, eax
je 0x41c11e
push edi
call sub.msvcrt.dll_free
pop eax
jmp 0x41c11e
mov dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0
jne 0x41c143
cld
mov eax, dword [ebp + 0x14]
or ecx, 0xffffffff
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x210], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov dword [ebp - 0x214], ecx
push esi
push dword [ebp - 0x210]
push dword [ebp + 0x18]
call sub.msvcrt.dll_strncpy
add esp, 0xc
cmp dword [ebp - 0x214], esi
jbe 0x41c165
mov ecx, dword [ebp + 0x18]
mov byte [ecx + esi - 1], 0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401000
Capabilities:
Execute command
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Hello_World__n
push esi
call fcn.004010c0
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Calculator_Console_Application
push 0x4012e0
push 0x4012e0
call fcn.004010c0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x4012e0
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.Please_enter_the_operation_to_perform._Format:_ab__a_b__ab__a_b
call fcn.004010c0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
call esi
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call esi
push 0
push str.asdsadsadsad
push str.sadsadsad
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0
push 0
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.hello_world
call fcn.004010c0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401bcf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c0e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c0e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c0e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c0e
cmp dword [ecx + 0x74], 0xe
jbe 0x401c0e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10001000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
push esi
push edi
jne 0x1000117c
push 0x2ff
lea ecx, [ebp - 0x304]
push ecx
push eax
mov dword [0x10044a70], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x304]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001043
sub eax, edx
je 0x10001066
mov edi, edi
mov cl, byte [ebp + eax - 0x304]
cmp cl, 0x5c
je 0x10001066
cmp cl, 0x3a
je 0x10001066
sub eax, 1
jne 0x10001050
push 0x2ff
lea edx, [ebp - 0x604]
push edx
mov byte [ebp + eax - 0x304], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x604]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x60c], eax
mov dword [ebp - 0x608], ecx
mov edi, dword [ebp - 0x608]
mov esi, dword [ebp - 0x60c]
mov eax, 1
cmp eax, 0
je 0x100010dd
movzx eax, byte [edi]
movzx edx, byte [esi]
inc esi
inc edi
cmp eax, edx
je 0x100010a9
cmp eax, 0x61
jb 0x100010c7
cmp eax, 0x7a
ja 0x100010c7
sub eax, 0x20
cmp edx, 0x61
jb 0x100010d4
cmp edx, 0x7a
ja 0x100010d4
sub edx, 0x20
sub eax, edx
je 0x100010ae
cdq
lea eax, [edx + edx + 1]
test eax, eax
je 0x10001154
push 0x2ff
lea edx, [ebp - 0x604]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x604]
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x608], eax
mov dword [ebp - 0x60c], ecx
mov edi, dword [ebp - 0x60c]
mov esi, dword [ebp - 0x608]
mov eax, 1
cmp eax, 0
je 0x10001150
movzx eax, byte [edi]
movzx edx, byte [esi]
inc esi
inc edi
cmp eax, edx
je 0x1000111c
cmp eax, 0x61
jb 0x1000113a
cmp eax, 0x7a
ja 0x1000113a
sub eax, 0x20
cmp edx, 0x61
jb 0x10001147
cmp edx, 0x7a
ja 0x10001147
sub edx, 0x20
sub eax, edx
je 0x10001121
cdq
lea eax, [edx + edx + 1]
test eax, eax
jne 0x1000117c
push 0x10
push str.Bink_Error
push str.The_BinkW32.DLL_file_is_installed_in_the_Windows_or_Windows_system_directory___it_must_be_installed_in_the_application_directory.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100329a0
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.100329a0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000a5a0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
xor ebx, ebx
push edi
cmp dword [0x1003b39c], ebx
je 0x1000a673
push 0x10
lea eax, [ebp - 0x14]
push eax
push str.RAD_USE_TGT
mov dword [0x1003b39c], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1000a5e8
cmp byte [ebp - 0x14], 0x31
je 0x1000a626
push 0x10045048
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1000a626
push 0x10045040
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov dword [0x1004503c], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x10045050], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100329a0
mov esp, ebp
pop ebp
ret
call esi
mov dword [0x10045210], eax
mov dword [0x1004503c], ebx
mov dword [0x10045048], ebx
mov dword [0x1004504c], ebx
call esi
sub eax, dword [0x10045210]
mov ecx, dword [0x1004503c]
mov edx, eax
sub edx, ecx
cmp edx, 0xc0000000
ja 0x1000a726
mov dword [0x1004503c], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100329a0
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x10045048]
or ecx, dword [0x1004504c]
je 0x1000a63f
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x1c]
mov edi, eax
mov eax, dword [ebp - 0x20]
sub eax, dword [0x10045040]
push ebx
sbb ecx, dword [0x10045044]
push 0x3e8
push ecx
push eax
call fcn.100326b0
mov ecx, dword [0x1004504c]
push ecx
mov ecx, dword [0x10045048]
push ecx
push edx
push eax
call fcn.100326f0
mov ebx, dword [0x1004503c]
mov ecx, eax
add ecx, dword [0x10045210]
mov eax, edi
sub eax, dword [0x10045050]
mov edx, ecx
mov esi, eax
sub edx, ebx
sub esi, edx
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xc8
jle 0x1000a6fb
add dword [0x10045210], esi
add ecx, esi
mov edx, ecx
sub edx, ebx
cmp edx, 0xc0000000
jbe 0x1000a71a
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100329a0
mov esp, ebp
pop ebp
ret
mov dword [0x10045050], edi
mov dword [0x1004503c], ecx
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100329a0
mov esp, ebp
pop ebp
ret
Function at 0x10021b10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
mov byte [0xa345c635], al
and al, 0xc6
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.1002172c
push eax
push esi
push dword [ebp + 8]
call fcn.100216e1
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1002172c
push eax
push esi
push dword [ebp + 8]
call fcn.100216e1
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1002171c
mov edi, 0x881ca1c6
popfd
jl 0x10021ba1
invalid
invalid