joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f8f3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10067a68]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001f939
cmp word [ebx], dx
jne 0x1001f939
or byte [eax + edi + 0x28], 4
jmp 0x1001f93e
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1001faa1
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1001fa81
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1001f97f
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001f9b5
cmp eax, edx
jae 0x1001f9c3
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x1001f95a
jmp 0x1001faa1
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1001fa7c
cmp dword [ebp - 0x18], 0
je 0x1001fa7c
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10067a68]
test byte [eax + edi + 0x28], 0x48
je 0x1001fa52
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1001fa16
mov word [esi], cx
jmp 0x1001fa4d
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10067a68]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10067a68]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10067a68]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1001faa1
pop eax
cmp word [ebp - 4], ax
jne 0x1001fa62
cmp esi, ebx
jne 0x1001fa62
mov word [esi], ax
jmp 0x1001fa9e
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1002032c
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1001faa1
push 0xd
pop eax
jmp 0x1001fa5d
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10067a68]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x1001fa9b
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1001faa1
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10023c53
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10023cf0
push ebx
push esi
call fcn.10023c1c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100229f1
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10023c9d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10023cef
push edi
push eax
call fcn.1001c943
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10023cbd
call fcn.1001a182
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10023cee
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100229f1
add esp, 0x20
test eax, eax
jne 0x10023cdc
push edi
call fcn.1001a182
jmp 0x10023ce4
push ebx
call fcn.1001a182
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10025f6d
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1001a526
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10025fdc
cmp esi, dword [ebp - 4]
je 0x10025fd7
cmp dword [ebp + 0xc], 0
je 0x10025fd7
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10025fb4
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10025abf
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10025fde
xor eax, eax
inc eax
jmp 0x10025fde
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10026043
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10066094]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1001a526
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1001a526
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100260ba
cmp word [ecx], dx
je 0x100260ba
mov eax, dword [0x1005c444]
push edi
dec eax
push eax
push 0x1005c330
call fcn.10025fe2
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002612d
cmp word [eax], dx
je 0x1002612d
mov eax, dword [edi]
test eax, eax
je 0x100260de
cmp word [eax], dx
je 0x100260de
lea eax, [ebp - 0x10]
push eax
call fcn.100259c5
jmp 0x100260e7
lea eax, [ebp - 0x10]
push eax
call fcn.10025a60
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10026157
mov eax, dword [0x1005c32c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1005c020
call fcn.10025fe2
add esp, 0xc
test al, al
je 0x10026157
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10026122
cmp word [eax], di
je 0x10026122
lea eax, [ebp - 0x10]
push eax
call fcn.100259c5
pop ecx
jmp 0x10026159
lea eax, [ebp - 0x10]
push eax
call fcn.10025a60
jmp 0x1002611f
mov eax, dword [edi]
test eax, eax
je 0x10026144
cmp word [eax], dx
je 0x10026144
lea eax, [ebp - 0x10]
push eax
call fcn.1002597a
pop ecx
jmp 0x10026157
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10026222
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10025e67
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10026222
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10026222
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10026222
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100261af
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001c50d
test ebx, ebx
je 0x1002621d
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001c50d
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10026222
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10026222
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10028cb4
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10026224
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000db64
leave
ret
Function at 0x4047d0
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x14], eax
push 0x41564c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x41a2e4], eax
push str.IsWow64Process
mov eax, dword [0x41a2e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40481a
push 0x41a2e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0xc]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00405060
add esp, 4
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
mov ecx, 0x41a2f8
call fcn.004052a0
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x10], 2
jge 0x4048e6
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x415678
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x404898
push str.saloon.dat
call fcn.00404670
add esp, 4
push 0
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1c], eax
push 0x40
push 0x1000
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x18], eax
push 0
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
push eax
call eax
ret
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.00404710
add esp, 8
mov dword [ebp - 8], eax
mov ecx, 0x41a2f8
call fcn.004053f0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41018d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040b326
and dword [ebp - 4], 0
cmp dword [0x41ae8c], 0
mov ebx, eax
jne 0x41023e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4102ef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4102ef
push eax
call fcn.0040b2b4
mov dword [esp], 0x416a68
push edi
mov dword [0x41ae8c], eax
call esi
push eax
call fcn.0040b2b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41ae90], eax
call esi
push eax
call fcn.0040b2b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41ae94], eax
call esi
push eax
call fcn.0040b2b4
pop ecx
mov dword [0x41ae9c], eax
test eax, eax
je 0x41023e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b2b4
pop ecx
mov dword [0x41ae98], eax
mov eax, dword [0x41ae98]
cmp eax, ebx
je 0x410296
cmp dword [0x41ae9c], ebx
je 0x410296
push eax
call fcn.0040b32f
push dword [0x41ae9c]
mov esi, eax
call fcn.0040b32f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x410296
test edi, edi
je 0x410296
call esi
test eax, eax
je 0x41028d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41028d
test byte [ebp - 0xc], 1
jne 0x410296
or dword [ebp + 0x10], 0x200000
jmp 0x4102cf
mov eax, dword [0x41ae90]
cmp eax, ebx
je 0x4102cf
push eax
call fcn.0040b32f
pop ecx
test eax, eax
je 0x4102cf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4102cf
mov eax, dword [0x41ae94]
cmp eax, ebx
je 0x4102cf
push eax
call fcn.0040b32f
pop ecx
test eax, eax
je 0x4102cf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41ae8c]
call fcn.0040b32f
pop ecx
test eax, eax
je 0x4102ef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4102f1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401750
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x415206
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x344
push ebp
lea ecx, [esp + 0xc]
call fcn.00402650
mov ebp, dword [esp + 0x358]
lea eax, [esp + 0x1b8]
push ebp
push str._s.
push eax
mov dword [esp + 0x35c], 0
call fcn.00403218
add esp, 0xc
lea ecx, [esp + 0x1b8]
push 0
push ecx
lea ecx, [esp + 0x14]
call fcn.00402713
test eax, eax
je 0x401895
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.00402933
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], eax
call fcn.004028fa
test eax, eax
jne 0x401887
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
call fcn.00402b2b
push 0xc8
mov ecx, eax
mov byte [esp + 0x35c], 1
call fcn.0041065e
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x358], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.004104c4
mov edx, dword [esp + 0x14]
push 0x10
lea ecx, [esp + 0x18]
call dword [edx + 0x38]
test eax, eax
lea eax, [esp + 0x30]
push eax
push ebp
push str._s_s
je 0x401869
lea ecx, [esp + 0x104]
push ecx
call fcn.00403218
lea edx, [esp + 0x108]
push edx
call fcn.00401750
add esp, 0x14
jmp 0x401887
lea ecx, [esp + 0x294]
push ecx
call fcn.00403218
add esp, 0x10
lea edx, [esp + 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4017ba
pop edi
pop esi
lea ecx, [esp + 0xc]
call fcn.004026c9
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
pop ebp
mov dword [esp + 0x34c], 0xffffffff
lea ecx, [esp + 8]
jne 0x4018d5
call fcn.0040268d
xor eax, eax
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
add esp, 0x350
ret
call fcn.0040268d
mov ecx, dword [esp + 0x344]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x350
ret
Function at 0x401930
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x415220
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x41a190]
mov dword [esp], eax
push 0x104
push 0x104
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0
call fcn.0041065e
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 4]
call fcn.004106ad
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
mov dword [esp + 0x10], 1
call fcn.004104ee
mov edx, dword [esp + 8]
lea ecx, [esp + 4]
push ecx
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4019d2
mov ecx, dword [esp]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 8]
mov byte [esp + 0x18], 0
call fcn.004104c4
lea ecx, [esp]
mov dword [esp + 0x18], 0xffffffff
call fcn.004104c4
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x402250
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x415250
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x64
mov eax, dword [esp + 0x78]
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x84]
push 0x6a
push ecx
mov esi, eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov ebx, eax
push ebx
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.GDI32.dll_SelectObject]
lea edx, [esp + 0x3c]
mov dword [esp + 0x20], eax
push edx
push 0x18
push ebx
mov byte [esp + 0x1c], 0
mov byte [esp + 0x1d], 0
mov byte [esp + 0x1f], 0
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0x4163a8
push str.Arial
push 0x20
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x258
push eax
push eax
push eax
push 0x14
mov dword [esp + 0xb4], eax
call dword [sym.imp.GDI32.dll_CreateFontA]
push eax
lea ecx, [esp + 0x28]
call fcn.00413d12
lea ecx, [esp + 0x2c]
call fcn.0041377d
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x80], 1
call fcn.00413834
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x30]
call fcn.0041399b
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x54]
push 0x1e
push edx
push 1
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 1
lea ecx, [esp + 0x30]
call fcn.00413a10
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x88]
call fcn.004104ee
mov eax, dword [esp + 0x84]
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x7c], 2
mov ecx, dword [eax - 8]
push ecx
push eax
push 0x78
push 0x12c
lea ecx, [esp + 0x3c]
call dword [edx + 0x5c]
lea ecx, [esp + 0x84]
mov byte [esp + 0x7c], 1
call fcn.004104c4
lea ecx, [esp + 0x2c]
call fcn.0041386b
push str.Msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.AlphaBlend
push eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esp + 0x84], eax
je 0x40240b
xor ebx, ebx
jmp 0x4023d4
mov eax, dword [esp + 0x84]
mov byte [esp + 0x12], bl
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push ecx
push ebp
push 0
push 0
push esi
push ecx
push ebp
push 0
push 0
push edi
call eax
mov edx, dword [esp + 0x8c]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
add ebx, 0xa
cmp ebx, 0x64
jl 0x4023cd
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x20]
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esp + 0x88]
push edi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x7c], 0
call fcn.0041389c
mov dword [esp + 0x24], vtable.CGdiObject.0
lea ecx, [esp + 0x24]
mov dword [esp + 0x7c], 3
call fcn.00413d69
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x70
ret
Function at 0x4025e0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x50
lea eax, [esp]
push esi
push edi
mov edi, dword [esp + 0x5c]
push 0x50
push eax
push 3
push edi
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push edi
push 0
push 0
push 0xfa
push 0x190
push 0
push 0
lea ecx, [esp + 0x28]
push 0x80000000
push ecx
push str.Static
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push esi
call fcn.00402560
add esp, 4
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x64
push esi
push edi
call fcn.00402250
add esp, 0xc
mov eax, esi
pop edi
pop esi
add esp, 0x50
ret
Function at 0x4064a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov edi, edx
mov esi, eax
mov ebp, dword [esi + 0x10]
mov eax, esi
call fcn.00406958
mov byte [esp], al
cmp byte [esp], 0
jne 0x406631
test edi, edi
je 0x406631
mov byte [esp + 1], 0
test ebp, ebp
jle 0x406571
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0xc], eax
test ebp, ebp
jle 0x40654c
cmp edi, 0xffffffff
je 0x40650d
call sub.kernel32.dll_GetTickCount
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40650d
mov byte [esp], 0
jmp 0x406631
cmp dword [esi], 1
jg 0x40654c
cmp dword [esi], 0
jne 0x40653e
xor eax, eax
mov edx, 1
lock cmpxchg dword [esi], edx
test eax, eax
jne 0x40653e
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov byte [esp], 1
jmp 0x406631
lea eax, [esp + 0xc]
call fcn.00406164
dec ebp
test ebp, ebp
jg 0x4064f2
cmp edi, 0xffffffff
je 0x406571
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
ja 0x40656f
mov byte [esp], 0
jmp 0x406631
sub edi, eax
mov ebx, dword [esi]
test ebx, ebx
je 0x4064b6
lea edx, [ebx + 2]
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x406571
call sub.kernel32.dll_GetTickCount
mov dword [esp + 4], eax
mov eax, esi
call fcn.004066ac
mov edx, eax
mov ebx, dword [0x40d8e0]
mov ecx, edi
xor eax, eax
call dword [ebx + 0x10]
test eax, eax
sete byte [esp]
cmp edi, 0xffffffff
je 0x4065d5
call sub.kernel32.dll_GetTickCount
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
cmp edi, eax
jbe 0x4065d3
mov eax, dword [esp + 8]
sub eax, dword [esp + 4]
sub edi, eax
jmp 0x4065d5
xor edi, edi
cmp byte [esp], 0
je 0x4065fb
mov ebx, dword [esi]
test bl, 1
jne 0x406611
mov edx, ebx
sub edx, 2
or edx, 1
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4065db
mov byte [esp + 1], 1
jmp 0x406611
mov ebx, dword [esi]
mov edx, ebx
sub edx, 2
mov eax, ebx
lock cmpxchg dword [esi], edx
cmp ebx, eax
jne 0x4065fb
mov byte [esp + 1], 1
cmp byte [esp + 1], 0
je 0x406588
cmp byte [esp], 0
je 0x406631
call sub.kernel32.dll_GetCurrentThreadId
mov dword [esi + 8], eax
mov dword [esi + 4], 1
movzx eax, byte [esp]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x407170
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40d040], 0
je 0x4071d7
cmp word [0x40d32c], 0xd7b2
jne 0x407199
cmp dword [0x40d334], 0
jbe 0x407199
mov eax, 0x40d328
call dword [0x40d344]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
mov eax, 0x407204
call fcn.00407974
push eax
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40c01a], 0
jne 0x4071f3
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4099e8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret