joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406294
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4062a4
invalid
jnp 0x3faf2f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
push dword [ebx]
leave
mov edi, 0x60000000
jmp 0x4062c2
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x406320
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x406307
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x406310
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40631a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x4062fc
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x406286
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40636d
dec eax
je 0x406364
sub eax, 3
je 0x40635b
mov dword [ebp - 4], 0x40
jmp 0x40638a
mov dword [ebp - 4], 4
jmp 0x406370
mov dword [ebp - 4], 0x20
jmp 0x406370
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4063bc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40633c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00405bcd
invalid
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00405bab
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
invalid
movsd dword es:[edi], dword [esi]

Function at 0x407dc0
Capabilities:
Get common file path

Disassembly:
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x407dba
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x407dba
call fcn.00405bcd
imul ecx, dword [esi + 0x5a8bc40c], 0x24
add ebx, edi
mov cx, word [ebx + ecx*2]
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.00405bcd
std
jns 0x407e6a
jmp 0xff48f3fc
shr dword [ebx], 1
stc
lea edx, [esp + 0x10]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
mov ebx, eax
test ebx, ebx
jne 0x407f1c
lea ecx, [esp + 0x10]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x407f1c
mov edi, 0x40b1ec
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.QuickTime.qts
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x404da8
Capabilities:
Set file attributes

Disassembly:
test edx, 0xf0000000
je 0x404db6
and edx, 0x3fff
jmp fcn.00404d1a

Function at 0x404dbb
Capabilities:
Delete directory

Disassembly:
mov eax, 0x434464
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_RemoveDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x404dea
push edi
call esi
test eax, eax
je 0x404dea
mov al, 1
jmp 0x404e2e
test ebx, ebx
je 0x404e2c
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x404e26
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
test esi, esi
pop ecx
setne al
jmp 0x404e2e
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x404e3d
Capabilities:
Move file

Disassembly:
mov eax, 0x434480
call fcn.004339e0
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], ecx
call fcn.00407553
mov ecx, dword [ebp - 0x10]
mov esi, eax
call fcn.00407553
mov edi, dword [sym.imp.kernel32.dll_MoveFileW]
mov dword [ebp - 0x14], eax
push 1
pop ebx
cmp esi, ebx
je 0x404e86
cmp eax, ebx
je 0x404e86
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call edi
test eax, eax
je 0x404e86
mov al, bl
jmp 0x404efd
test esi, esi
jne 0x404e8f
cmp dword [ebp - 0x14], esi
je 0x404efb
lea ecx, [ebp - 0x30]
call fcn.004028e9
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.004028e9
cmp esi, ebx
mov byte [ebp - 4], bl
je 0x404eaf
cmp dword [ebp - 0x14], ebx
jne 0x404eb1
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00430a10
test al, al
push dword [ebp - 0x24]
je 0x404eec
push dword [ebp - 0x30]
call edi
mov esi, eax
push dword [ebp - 0x24]
call fcn.00401abd
push dword [ebp - 0x30]
call fcn.00401abd
pop ecx
test esi, esi
pop ecx
setne al
jmp 0x404efd
call fcn.00401abd
push dword [ebp - 0x30]
call fcn.00401abd
pop ecx
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405008
Capabilities:
Create directory

Disassembly:
mov eax, 0x4344b0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_CreateDirectoryW]
mov ebx, eax
cmp ebx, 1
je 0x405046
push 0
push edi
call esi
test eax, eax
je 0x405039
mov al, 1
jmp 0x40508f
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x40508d
test ebx, ebx
je 0x40508d
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
je 0x405084
push 0
push dword [ebp - 0x18]
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
test esi, esi
pop ecx
setne al
jmp 0x40508f
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x405c83
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4345c0
call fcn.004339e0
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
call fcn.00407553
mov esi, dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 1
je 0x405caf
push edi
call esi
cmp eax, 0xffffffff
jne 0x405cf1
test ebx, ebx
je 0x405cee
lea ecx, [ebp - 0x18]
call fcn.004028e9
and dword [ebp - 4], 0
cmp ebx, 1
setne al
push eax
lea edx, [ebp - 0x18]
mov ecx, edi
call fcn.0040765c
test al, al
push dword [ebp - 0x18]
je 0x405ce8
call esi
mov esi, eax
push dword [ebp - 0x18]
call fcn.00401abd
pop ecx
mov eax, esi
jmp 0x405cf1
call fcn.00401abd
pop ecx
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x406306
Capabilities:
Get disk information

Disassembly:
mov eax, 0x434664
call fcn.004339e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.0041c900
mov edi, dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x14], ebx
je 0x4063d4
mov eax, SysReAllocString
cmp ebx, eax
ja 0x406342
mov eax, ebx
add eax, eax
push eax
call fcn.00430a10
mov esi, eax
pop ecx
mov dword [ebp - 0x20], esi
and dword [ebp - 4], 0
push esi
push ebx
call edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x10], ebx
je 0x4063cd
cmp ebx, dword [ebp - 0x14]
ja 0x4063cd
lea ecx, [ebp - 0x2c]
call fcn.004028e9
test ebx, ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
jbe 0x4063b5
push 2
xor eax, eax
pop ebx
cmp word [esi + ebx - 2], 0
jne 0x4063aa
add eax, esi
lea ecx, [ebp - 0x2c]
push eax
call fcn.00430a10
mov ecx, dword [ebp - 0x18]
lea eax, [edi + 1]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.0040150c
mov eax, ebx
inc edi
inc ebx
inc ebx
cmp edi, dword [ebp - 0x10]
jb 0x406380
mov ebx, dword [ebp - 0x10]
push dword [ebp - 0x2c]
call fcn.00401abd
push esi
call fcn.00401abd
cmp dword [ebp - 0x14], ebx
pop ecx
pop ecx
sete al
jmp 0x4063d6
push esi
call fcn.00401abd
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x430a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x430a1f
pop dword [ebp - 0x38]
mov eax, 0xdebef44e
sub eax, 0xde7bea2f
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x3a6d7
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x46ec
xor edi, edi
add edi, eax
mov esi, 0x368b4270
sub esi, 0x36467c70
add esi, dword [ebp - 0x38]
mov ebx, 0xad46650f
add ebx, 0x6b368f6a
sub dword [ebp - 8], ebx
mov edx, dword [esi]
xor dword [ebp - 0x1c], 0xfca11f61
sub edx, ebx
sub dword [ebp - 4], 0x29322cb9
mov dword [edi], edx
add dword [ebp - 0x14], ecx
add edi, 0x6c851fa0
sub edi, 0x6c851f9c
add esi, 4
loop 0x430a75
add eax, 0xda81337d
add eax, 0x257fdb06
mov ebx, eax
add eax, 0xcdeceea7
add eax, 0x3213115e
mov ecx, 0x400000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4
Function at 0x40a1c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40a1d7
pop dword [ebp - 0x2c]
mov eax, 0x4d0cc1ab
sub eax, 0x4ccc1fd4
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3da85
push 0
mov eax, 0x1eeba54f
add eax, 0xe1571dad
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0xb9feb359
sub ecx, 0xb9fe7fef
xor edx, edx
add edx, eax
mov ebx, 0x448800
add ebx, dword [ebp - 0x2c]
mov edi, 0xeafed1c5
add dword [ebp - 0x20], edi
mov esi, dword [ebx]
add dword [ebp - 8], 0xe8d211f2
add esi, edi
xor dword [ebp - 4], edx
mov dword [edx], esi
xor dword [ebp - 4], 0x8636f98f
add edx, 0xdb9e269
sub edx, 0xdb9e265
add ebx, 0xa74b3771
add ebx, 0x58b4c893
loop 0x40a22c
add eax, 0xe72ab5bb
sub eax, 0xe729f540
xor ebx, ebx
add ebx, eax
add eax, 0x86307a9d
sub eax, 0x86307a98
mov ecx, 0xfecba031
add ecx, 0x1745fcf
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x40bf30
Capabilities:
Get system information on windows

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x74]
push 9
pop ecx
xor eax, eax
mov dword [ebp - 0xc], esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
and dword [esi + 8], eax
rep stosd dword es:[edi], eax
push 0x1c
lea eax, [ebp - 0x30]
push eax
push 0
jmp 0x40c036
cmp dword [ebp - 0x20], 0x1000
jne 0x40c027
mov eax, dword [ebp - 0xc]
lea esi, [ebp - 0x30]
push 7
pop ecx
lea edi, [ebp - 0x50]
add eax, 0xc
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
call main
mov esi, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp esi, eax
je 0x40bfc2
cmp edi, dword [esi + 0x10]
jae 0x40c004
push 0x30
call main
mov edx, eax
xor eax, eax
pop ecx
mov ecx, dword [ebp - 4]
push 7
lea edi, [edx + 0x10]
mov dword [edi], ecx
add edi, 4
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
lea eax, [edx + 0x10]
push edx
push eax
push esi
lea eax, [ebp - 0x14]
mov word [edx + 0xc], 0
push eax
call main
mov esi, dword [ebp - 0x14]
lea edi, [esi + 0x14]
push 7
pop ecx
lea esi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
test byte [ebp - 0x1c], 0x70
je 0x40c027
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, ecx
div dword [ebp - 0x70]
mov edx, dword [ebp - 0xc]
add dword [edx + 8], eax
jmp 0x40c02a
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
add eax, ecx
lea ecx, [ebp - 0x30]
push 0x1c
push ecx
push eax
push dword [ebx + 8]
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
cmp eax, 0x1c
je 0x40bf7d
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x402ee4
pop dword [ebp - 0x34]
mov eax, 0x402ee4
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xac6a1ce
add dword [ebp - 0x44], 0x438ba37d
mov dword [ebp - 0x40], 0x60c1e7
add dword [ebp - 0x40], 0x31d28a5e
mov dword [ebp - 0x3c], 0x34dc0019
add dword [ebp - 0x3c], 0x17704415
mov dword [ebp - 0x38], 0x344962b5
sub dword [ebp - 0x38], 0x344962b5
lea eax, [ebp - 0x44]
push eax
mov eax, 0x3a6a52cb
add eax, 0xc5d62e39
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xd236c70f
add dword [ebp - 0x44], 0xa23ba247
mov dword [ebp - 0x40], 0x566f33bc
add dword [ebp - 0x40], 0xeafd2db9
mov dword [ebp - 0x3c], 0xa391b9b3
add dword [ebp - 0x3c], 0xbfddb2b9
mov dword [ebp - 0x38], 0x12501177
add dword [ebp - 0x38], 0xedafee89
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3c46b
push 0
call eax
mov ecx, 0x5cf6
xor edi, edi
add edi, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x34]
mov esi, 0x5ae46fa3
add esi, 0x150df0d8
mov edx, dword [ebx]
add edx, esi
xor dword [ebp - 0x1c], 0xc64b797f
mov dword [edi], edx
add dword [ebp - 0x24], esi
add edi, 0xb3884391
add edi, 0x4c77bc73
add ebx, 0xe1ff2371
sub ebx, 0xe1ff236d
loop 0x402ff2
add eax, 0x8a23f2d8
add eax, 0x75dd73d3
mov ebx, eax
add eax, 5
mov ecx, 0x1426ed96
add ecx, 0xec19126a
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x10020263
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10005270]
jne 0x10020613
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x10028550], eax
mov dword [0x1002854c], ecx
mov dword [0x10028548], edx
mov dword [0x10028544], ebx
mov dword [0x10028540], esi
mov dword [0x1002853c], edi
mov word [0x10028568], ss
mov word [0x1002855c], cs
mov word [0x10028538], ds
mov word [0x10028534], es
mov word [0x10028530], fs
mov word [0x1002852c], gs
pushfd
pop dword [0x10028560]
mov eax, dword [ebp]
mov dword [0x10028554], eax
mov eax, dword [ebp + 4]
mov dword [0x10028558], eax
lea eax, [ebp + 8]
mov dword [0x10028564], eax
mov eax, dword [ebp - 0x320]
mov dword [0x100284a0], 0x10001
mov eax, dword [0x10028558]
mov dword [0x10028454], eax
mov dword [0x10028448], 0xc0000409
mov dword [0x1002844c], 1
mov eax, dword [0x10005270]
mov dword [ebp - 0x328], eax
mov eax, dword [0x10024b90]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x10028498], eax
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x10005278
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x10028498], 0
jne 0x100206ff
push 1
call sub.msvcr100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret
Function at 0x102d8c17
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10322780]
jne 0x102d8c21
repz ret
jmp fcn.102da70b

Function at 0x102db9ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.102d8d1c
and dword [ebp - 4], 0
cmp dword [0x10324aa8], 0
mov ebx, eax
jne 0x102dbab0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x102dbb61
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x102dbb61
push eax
call fcn.102d8caa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10324aa8], eax
call esi
push eax
call fcn.102d8caa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10324aac], eax
call esi
push eax
call fcn.102d8caa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10324ab0], eax
call esi
push eax
call fcn.102d8caa
pop ecx
mov dword [0x10324ab8], eax
test eax, eax
je 0x102dbab0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.102d8caa
pop ecx
mov dword [0x10324ab4], eax
mov eax, dword [0x10324ab4]
cmp eax, ebx
je 0x102dbb08
cmp dword [0x10324ab8], ebx
je 0x102dbb08
push eax
call fcn.102d8d25
push dword [0x10324ab8]
mov esi, eax
call fcn.102d8d25
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x102dbb08
test edi, edi
je 0x102dbb08
call esi
test eax, eax
je 0x102dbaff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x102dbaff
test byte [ebp - 0xc], 1
jne 0x102dbb08
or dword [ebp + 0x10], 0x200000
jmp 0x102dbb41
mov eax, dword [0x10324aac]
cmp eax, ebx
je 0x102dbb41
push eax
call fcn.102d8d25
pop ecx
test eax, eax
je 0x102dbb41
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x102dbb41
mov eax, dword [0x10324ab0]
cmp eax, ebx
je 0x102dbb41
push eax
call fcn.102d8d25
pop ecx
test eax, eax
je 0x102dbb41
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10324aa8]
call fcn.102d8d25
pop ecx
test eax, eax
je 0x102dbb61
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x102dbb63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102dd55b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x10322204], 0x17bb
mov dword [ebp - 0x10], eax
call fcn.102de654
mov ecx, eax
mov edx, dword [eax + 0x3c]
mov esi, ecx
add esi, edx
mov dword [0x10322208], 0x589
cmp dword [eax + edx], 0x4550
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
je 0x102dd64c
jmp 0x102dd636
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add ecx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x102dd669
xor eax, eax
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov edx, dword [ebp - 0x2c]
add edx, 2
mov esi, dword [ebp - 0x30]
cmp ecx, esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
jb 0x102dd669
jmp 0x102dd62b
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov dword [0x10322204], ecx
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ecx + eax + 0x20]
mov esi, dword [ebp - 0x18]
mov edi, dword [esi + eax + 0x24]
mov dword [0x10322208], 0x17c0
mov ebx, dword [esi + eax + 0x18]
cmp ebx, 0
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], edx
jne 0x102dd5a4
mov eax, dword [ebp - 0x34]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [0x10322204]
add ecx, 0xd81
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jmp 0x102dd5e3
mov eax, 0x1be4
mov dword [0x10322204], 0xe63
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
jmp 0x102dd5e3
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov esi, dword [ebp - 0x44]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x52], cl
je 0x102dd6d4
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x52]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x102dd683
mov al, byte [ebp - 0x52]
test al, 1
jne 0x102dd6e0
jmp 0x102dd5b9
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x40]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10322208], 0x942
mov edx, dword [ebp - 0x18]
add edx, ecx
mov dword [0x10322204], 0x19c2
mov dword [ebp - 0x34], edx
jmp 0x102dd62b