joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429a1c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x435db4]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004299b1
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004151b0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x429a6b
cmp dword [ebp - 0x1c], 5
jb 0x429a83
jmp 0x429a7f
cmp dword [ebp - 0x10], 1
jne 0x429a83
cmp dword [ebp - 0x1c], 4
ja 0x429a7f
jne 0x429a83
cmp dword [ebp - 0x18], 0
jbe 0x429a83
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x42e834
call fcn.00429885
test eax, eax
jge 0x429aa4
mov byte [0x43ad04], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00412bb4
add ebp, 0x78
leave
ret
Function at 0x10004cd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
not eax
je 0x10004d02
lea esp, [esp]
test cl, 3
je 0x10004d02
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x318a460]
add ecx, 1
sub esi, 1
jne 0x10004ce0
cmp esi, 0x20
push ebx
push edi
jb 0x10004eec
mov edi, esi
shr edi, 5
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x318a860]
xor edx, dword [ebx*4 + 0x318ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x318a460]
add ecx, 4
xor edx, dword [eax*4 + 0x318b060]
add ecx, 4
xor edx, dword [ecx - 8]
add ecx, 4
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x318a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x318ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x318a460]
add ecx, 4
xor eax, dword [edx*4 + 0x318b060]
add ecx, 4
xor eax, dword [ecx - 0x10]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x318a860]
xor edx, dword [ebx*4 + 0x318ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x318a460]
xor edx, dword [eax*4 + 0x318b060]
xor edx, dword [ecx - 0xc]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x318a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x318ac60]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x318a460]
xor eax, dword [edx*4 + 0x318b060]
xor eax, dword [ecx - 8]
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x318a860]
xor edx, dword [ebx*4 + 0x318ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x318a460]
xor edx, dword [eax*4 + 0x318b060]
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x318a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x318ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x318a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x318b060]
xor eax, dword [ecx]
add ecx, 4
mov edx, eax
shr edx, 0x10
movzx ebx, ah
and edx, 0xff
mov edx, dword [edx*4 + 0x318a860]
xor edx, dword [ebx*4 + 0x318ac60]
mov ebx, eax
and eax, 0xff
shr ebx, 0x18
xor edx, dword [ebx*4 + 0x318a460]
add ecx, 4
xor edx, dword [eax*4 + 0x318b060]
sub esi, 0x20
xor edx, dword [ecx - 4]
mov eax, edx
shr eax, 0x10
and eax, 0xff
mov eax, dword [eax*4 + 0x318a860]
movzx ebx, dh
xor eax, dword [ebx*4 + 0x318ac60]
mov ebx, edx
shr ebx, 0x18
xor eax, dword [ebx*4 + 0x318a460]
and edx, 0xff
xor eax, dword [edx*4 + 0x318b060]
sub edi, 1
jne 0x10004d12
cmp esi, 4
jb 0x10004f39
mov edx, esi
shr edx, 2
xor eax, dword [ecx]
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x318a860]
movzx ebx, ah
xor edi, dword [ebx*4 + 0x318ac60]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x318a460]
and eax, 0xff
xor edi, dword [eax*4 + 0x318b060]
sub esi, 4
sub edx, 1
mov eax, edi
jne 0x10004ef6
test esi, esi
pop edi
pop ebx
je 0x10004f5d
nop
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x318a460]
add ecx, 1
sub esi, 1
jne 0x10004f40
not eax
pop esi
ret
Function at 0x401000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x42ab3b
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x437ddc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], vtable.ActiveScriptSite.0
mov dword [esi + 4], vtable.ActiveScriptSite.1.0
xor edi, edi
mov dword [esi + 8], vtable.CArray_class_ExposedObject___class_ExposedObject__.0
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x1c]
mov dword [esp + 0x14], edi
call fcn.00409358
mov eax, 1
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x401cc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401cd9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401d14
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401d10
lea ebx, [ebx]
cmp esi, eax
jae 0x401d14
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401d00
cmp esi, eax
jb 0x401d1a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x403350
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call fcn.004125ed
test eax, eax
jne 0x40338a
push str.Fatal_Error:_MFC_initialization_failed_n
call fcn.00419943
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
ret 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0x258
call fcn.004092a8
add esp, 4
test eax, eax
je 0x4033ad
push eax
call fcn.00404310
mov esi, eax
jmp 0x4033af
xor esi, esi
mov ebx, 1
cmp dword [0x43b314], ebx
jle 0x40340d
lea edi, [esi + 0x220]
mov eax, dword [0x43b31c]
mov ecx, dword [eax + ebx*4]
push ecx
lea ecx, [esp + 0x10]
call fcn.00402230
mov eax, dword [edi + 8]
lea edx, [esp + 0xc]
push edx
push eax
mov ecx, edi
call fcn.004097ca
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403404
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
cmp ebx, dword [0x43b314]
jl 0x4033c2
push esi
call fcn.00404b40
mov ecx, dword [esi + 0x234]
push ecx
call fcn.004036c0
push eax
call fcn.004039b0
push 0x430250
mov ecx, esi
call fcn.004114a8
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.WScript
call fcn.00403530
call fcn.004036c0
push eax
call fcn.00403840
mov esi, dword [esi + 0x240]
push ecx
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
sub esi, 0x10
mov dword [esp + 0x10], esp
mov ebx, esp
call eax
cmp dword [esi + 0xc], 0
lea ecx, [esi + 0xc]
jl 0x403482
cmp eax, dword [esi]
jne 0x403482
mov edi, esi
mov edx, 1
lock xadd dword [ecx], edx
jmp 0x4034ba
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
jne 0x40349b
call fcn.00408d30
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea eax, [eax + eax + 2]
push eax
add esi, 0x10
push esi
push eax
lea ecx, [edi + 0x10]
push ecx
call fcn.00419171
add esp, 0x10
add edi, 0x10
mov dword [ebx], edi
call fcn.004036c0
mov ebx, eax
call fcn.00403c70
call fcn.004036c0
mov esi, eax
lea ecx, [esi + 4]
call fcn.0041269d
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4034e9
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esi + 0x48]
test eax, eax
je 0x4034f8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0x54]
test eax, eax
je 0x403507
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
pop edi
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x54], 0
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x10
Function at 0x404b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b283
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x437ddc]
xor eax, esp
mov dword [esp + 0xa8], eax
push ebx
push esi
push edi
mov eax, dword [0x437ddc]
xor eax, esp
push eax
lea eax, [esp + 0xc0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x240]
mov dword [esp + 0x1c], eax
call fcn.00401f00
push 2
push 0x4312bc
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x404d5d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404d5d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x404d5d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea esi, [edi + 0x28]
push 0x400
lea ecx, [esp + 0x28]
lea edi, [eax - 0x28]
call fcn.004145d7
push 0
push edi
push esi
lea ecx, [esp + 0x30]
mov dword [esp + 0xd4], 0
call fcn.0041460c
push 0
push 0x1000
push 1
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x5c]
call fcn.00410a19
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x24]
push edx
lea esi, [esp + 0x60]
mov byte [esp + 0xdc], 1
call fcn.00409230
mov esi, eax
call fcn.00409230
mov esi, eax
call fcn.00409230
mov esi, eax
call fcn.00409230
mov esi, eax
call fcn.00409230
mov edi, dword [esp + 0x18]
push edi
call fcn.004092e2
add esp, 4
mov ebx, eax
push edi
push ebx
lea ecx, [esp + 0x54]
call fcn.004101b0
lea ecx, [esp + 0x4c]
call fcn.00410862
push 0x1335ca
call fcn.00419d2a
add esp, 4
mov byte [esp + 0xb4], 0
xor esi, esi
lea esp, [esp]
call fcn.00419d3c
cdq
mov ecx, 0x3e
idiv ecx
cmp dl, 0x1a
jae 0x404cb7
add dl, 0x41
jmp 0x404cc8
cmp dl, 0x34
jae 0x404cc1
add dl, 0x47
jmp 0x404cc8
cmp dl, cl
jae 0x404ccf
sub dl, 4
mov byte [esp + esi + 0x94], dl
inc esi
cmp esi, 0x20
jl 0x404ca0
lea edx, [esp + 0x94]
mov eax, edi
mov edi, dword [esp + 0x1c]
push edx
push ebx
mov esi, edi
call fcn.004082a0
mov esi, eax
test esi, esi
je 0x404d03
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404cf4
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [edi + 0x240]
call fcn.004020e0
push esi
call fcn.004092d7
push ebx
call fcn.004092d7
mov ecx, dword [esp + 0x1c]
xor eax, eax
add esp, 8
cmp dword [esp + 0x20], eax
mov dword [edi + 0x238], ecx
sete al
lea ecx, [esp + 0x4c]
mov byte [esp + 0xc8], 0
mov dword [edi + 0x234], eax
call fcn.004109db
lea ecx, [esp + 0x24]
mov dword [esp + 0xc8], 0xffffffff
call fcn.0041496d
mov ecx, dword [esp + 0xc0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.00419162
mov esp, ebp
pop ebp
ret 4
Function at 0x406cc0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x42b3a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437ddc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x30]
call fcn.00402230
mov dword [esp + 0x24], 0
mov ecx, dword [ebp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ecx
call esi
cmp dword [ebp + 0x24], 0
je 0x406de2
mov edx, dword [ebp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileType]
test al, 1
mov eax, dword [esp + 0x2c]
push 0
jne 0x406dc4
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov edi, eax
push edi
call fcn.004092e2
push edi
mov esi, eax
push 0
push esi
call fcn.0041aa60
mov ecx, dword [esp + 0x3c]
add esp, 0x10
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call ebx
mov byte [esi + edi - 1], 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
push 0xfde9
mov edi, eax
call ebx
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x406d90
push 0
lea edx, [esp + 0x18]
push edx
sub eax, ecx
push eax
mov eax, dword [ebp + 0x20]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call ebx
push esi
call fcn.004092d7
add esp, 4
jmp 0x406e30
mov ecx, dword [eax - 0xc]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [ebp + 0x20]
add ecx, ecx
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0x20]
push eax
call esi
jmp 0x406e30
mov ecx, dword [esp + 0x2c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00408840
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
push 0
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
mov eax, dword [ebp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 0x20]
push ecx
call esi
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406e30
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406e58
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x408200
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408210
sub eax, edx
mov dword [esp + 0x14], eax
lea edi, [ebp + 0x20]
mov eax, ebp
xor ecx, ecx
sub eax, edi
lea ebx, [eax + 0x120]
lea esp, [esp]
xor edx, edx
mov eax, ecx
div dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea esi, [edi + ecx]
mov dl, byte [edx + eax]
mov byte [esi], cl
inc ecx
cmp ecx, 0xff
mov byte [ebx + esi], dl
jle 0x408230
xor eax, eax
mov ecx, edi
mov esi, 0x100
lea esp, [esp]
mov dl, byte [ecx]
movzx edi, byte [ecx + 0x100]
movzx ebx, dl
add edi, eax
add ebx, edi
mov eax, ebx
and eax, 0x800000ff
jns 0x408280
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
mov bl, byte [eax + ebp + 0x20]
mov byte [ecx], bl
inc ecx
sub esi, 1
mov byte [eax + ebp + 0x20], dl
jne 0x408260
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x4082a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push ebp
mov ebx, eax
push edi
lea ebp, [ebx + 1]
push ebp
call fcn.004092e2
push ebp
mov edi, eax
push 0
push edi
mov dword [esp + 0x1c], edi
call fcn.0041aa60
mov eax, dword [esp + 0x28]
add esp, 0x10
push eax
push esi
call fcn.00408200
test ebx, ebx
jbe 0x408354
mov ebp, dword [esp + 0x14]
xor eax, eax
xor ecx, ecx
sub ebp, edi
mov dword [esp + 0x18], ebx
inc eax
and eax, 0x800000ff
jns 0x4082f1
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
mov dl, byte [eax + esi + 0x20]
movzx ebx, dl
add ecx, ebx
and ecx, 0x800000ff
jns 0x40830d
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, cl
mov bl, byte [ecx + esi + 0x20]
mov byte [eax + esi + 0x20], bl
mov byte [ecx + esi + 0x20], dl
movzx ebx, byte [eax + esi + 0x20]
movzx edx, dl
add ebx, edx
and ebx, 0x800000ff
jns 0x408336
dec ebx
or ebx, 0xffffff00
inc ebx
movzx edx, byte [ebx + esi + 0x20]
xor dl, byte [edi + ebp]
inc edi
sub dword [esp + 0x18], 1
mov byte [edi - 1], dl
jne 0x4082e2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
pop ebx
pop ecx
ret 8
mov eax, edi
pop edi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x411bbe
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x437ddc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x411c56
push 0x42d904
push 4
push eax
call fcn.00419d5e
push eax
call fcn.00401d70
add esp, 0x10
push ebx
push edi
call fcn.0041a9e4
mov edi, dword [eax]
call fcn.0041a9e4
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0041a981
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0041a9e4
cmp dword [eax], ebx
je 0x411c6d
call fcn.0041a9e4
push dword [eax]
call fcn.00409b6d
pop ecx
jmp 0x411c74
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x411c01
jmp 0x411cfb
call fcn.0041a9e4
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x411cf7
cmp dword [ebp - 0x234], esi
jae 0x411cf7
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.0041aa60
add esp, 0xc
push 0x42c820
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x411ce6
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x411ce6
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x411ce6
push ebx
push ebx
push esi
jmp 0x411cef
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x411cf9
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00419162
leave
ret

Function at 0x419162
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437ddc]
jne 0x41916c
repz ret
jmp fcn.0041c987
Function at 0x4237d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041c396
and dword [ebp - 4], 0
cmp dword [0x43be50], 0
mov ebx, eax
jne 0x423881
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x423932
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x423932
push eax
call fcn.0041c324
mov dword [esp], 0x42f074
push edi
mov dword [0x43be50], eax
call esi
push eax
call fcn.0041c324
mov dword [esp], 0x42f060
push edi
mov dword [0x43be54], eax
call esi
push eax
call fcn.0041c324
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43be58], eax
call esi
push eax
call fcn.0041c324
pop ecx
mov dword [0x43be60], eax
test eax, eax
je 0x423881
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041c324
pop ecx
mov dword [0x43be5c], eax
mov eax, dword [0x43be5c]
cmp eax, ebx
je 0x4238d9
cmp dword [0x43be60], ebx
je 0x4238d9
push eax
call fcn.0041c39f
push dword [0x43be60]
mov esi, eax
call fcn.0041c39f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4238d9
test edi, edi
je 0x4238d9
call esi
test eax, eax
je 0x4238d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4238d0
test byte [ebp - 0xc], 1
jne 0x4238d9
or dword [ebp + 0x10], 0x200000
jmp 0x423912
mov eax, dword [0x43be54]
cmp eax, ebx
je 0x423912
push eax
call fcn.0041c39f
pop ecx
test eax, eax
je 0x423912
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x423912
mov eax, dword [0x43be58]
cmp eax, ebx
je 0x423912
push eax
call fcn.0041c39f
pop ecx
test eax, eax
je 0x423912
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43be50]
call fcn.0041c39f
pop ecx
test eax, eax
je 0x423932
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423934
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45a7a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [0x468e54]
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx + 0x3c]
movzx edx, word [eax + ecx + 6]
add eax, ecx
push ebx
mov ebx, dword [0x468e5c]
push ebp
mov ebp, dword [0x467a34]
push esi
lea edx, [edx + edx*4]
mov esi, dword [eax + edx*8 + 0xe4]
lea edx, [eax + edx*8 + 0xd0]
mov eax, dword [eax + 0x34]
sub esi, ebx
sub esi, ebp
push edi
mov edi, dword [edx + 8]
add esi, edi
lea esi, [esi + ecx - 9]
mov ecx, dword [edx + 0xc]
sub ecx, ebx
sub ecx, ebp
lea edx, [ecx + edi - 0xe9]
mov ecx, dword [esi + 0x3c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
cmp ecx, 0x1000
jbe 0x45a811
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret
cmp dword [ecx + esi], 0x4550
movzx edx, word [ecx + esi + 6]
mov dword [esp + 0x18], edx
lea eax, [ecx + esi + 0xf8]
lea edx, [edx + edx*4]
lea ebp, [eax + edx*8 - 0x28]
jne 0x45a807
mov edi, dword [eax + 0xc]
mov ebx, dword [ecx + esi + 0x38]
add eax, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
xor edx, edx
div ebx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
inc eax
imul eax, ebx
add eax, dword [ebp + 0xc]
mov ebx, esi
sub eax, edi
sub edx, eax
mov dword [esp + 0x10], edx
sub edx, dword [ecx + esi + 0x34]
sub ebx, eax
sub edx, edi
mov edi, dword [ebp + 0x14]
add edi, dword [ebp + 0x10]
add dword [esp + 0x14], edx
push edi
sub ebx, 0xe0
call fcn.00459e70
mov ecx, dword [0x468e58]
mov dword [ecx + 0xc], eax
mov edx, dword [0x468e58]
mov eax, dword [edx + 0xc]
add esp, 4
test eax, eax
je 0x45a807
mov ecx, dword [0x467a34]
push ecx
push esi
push eax
call fcn.0045d4e0
mov eax, dword [esp + 0x24]
add esp, 0xc
test eax, eax
jbe 0x45a8ed
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x18], eax
jmp 0x45a8c0
mov edx, dword [ebp + 4]
mov eax, dword [ebp]
sub eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [0x468e58]
add ecx, dword [edx + 0xc]
add eax, ebx
push eax
push ecx
call fcn.0045d4e0
add esp, 0xc
add ebp, 0x28
sub dword [esp + 0x18], 1
jne 0x45a8c0
mov eax, dword [0x468e58]
mov ecx, dword [eax + 0xc]
mov dword [eax + 0x10], ecx
mov edx, dword [esi + 0x3c]
mov eax, dword [0x468e58]
add edx, esi
mov esi, dword [esp + 0x1c]
mov dword [eax + 0x14], edx
mov eax, dword [0x468e58]
mov ecx, dword [eax + 0x14]
sub esi, dword [esp + 0x10]
add ecx, 0x18
mov dword [eax + 0x1c], ecx
mov eax, dword [0x468e58]
mov edx, dword [eax + 0x14]
add edx, 4
mov dword [eax + 0x18], edx
mov eax, dword [0x468e58]
mov ecx, dword [eax + 0x14]
add ecx, 0xf8
mov dword [eax + 0x20], ecx
mov eax, dword [esp + 0x14]
neg eax
push esi
push eax
call fcn.00459fd0
push esi
call fcn.00459f20
mov eax, dword [0x468e58]
mov ecx, dword [eax + 0xc]
add esp, 0xc
push 0
lea edx, [esp + 0x28]
push edx
mov edx, dword [eax + 4]
push edi
push ecx
push edx
call dword [fcn.00464ad4]
mov eax, dword [0x468e58]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.00459ea0
mov edx, dword [0x468e58]
add esp, 4
mov dword [edx + 0xc], eax
cmp dword [esp + 0x24], edi
pop edi
pop esi
pop ebp
sete al
pop ebx
add esp, 0x18
ret