joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6982544e
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
je 0x69825462
lea eax, [esi + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [esi + 4], 0xffffffff
je 0x69825489
push edi
push 0
lea eax, [esp + 0xc]
push eax
lea edi, [esi + 0x54]
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
xor eax, eax
pop esi
pop ecx
ret

Function at 0x69825493
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x6982627d
call fcn.69825040
sub esp, 0x218
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 1
push 0x20019
push 0x69822f40
mov edi, 0x80000002
push edi
lea ecx, [ebp - 0x1c]
mov dword [esi], ebx
mov dword [esi + 0x1054], ebx
call fcn.6982523b
test eax, eax
jne 0x69825509
push 0x69822f5c
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.69825270
cmp eax, ebx
mov eax, dword [ebp - 0x14]
je 0x698254fb
mov eax, ebx
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [esi + 0x1054], ecx
push 0x20019
push 0x69822ed8
push edi
lea ecx, [ebp - 0x10]
call fcn.6982523b
cmp eax, ebx
jne 0x698255e6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x69823060
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x69825560
lea eax, [ebp - 0x224]
push eax
lea eax, [esi + 8]
push eax
call fcn.698253ae
push 0x69823048
lea eax, [esi + 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.69825401
push 0x69823028
lea eax, [esi + 0x14]
push eax
lea ecx, [ebp - 0x10]
call fcn.69825425
lea eax, [esi + 0xc]
push 0x69823010
push eax
lea ecx, [ebp - 0x10]
call fcn.69825425
push 0x69822ff0
lea edi, [esi + 0x10]
push edi
lea ecx, [ebp - 0x10]
call fcn.69825425
push 0x69822fd0
lea eax, [esi + 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.69825425
push 0x69822fac
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.69825425
push 0x69822f8c
lea eax, [esi + 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.69825425
cmp dword [edi], ebx
jne 0x698255e0
cmp dword [esi + 0xc], ebx
je 0x698255e6
mov dword [esi], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
call fcn.69825224
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.69825224
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x69825795
Capabilities:
Get file size
Persist via application shimming
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x50]
call fcn.698252f5
xor ebx, ebx
cmp dword [esi], ebx
je 0x69825910
mov eax, dword [ebp + 0x14]
test dword [esi + 0x24], eax
je 0x69825910
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
jne 0x698257ce
mov dword [esi + 0x48], 0x69823360
jmp 0x69825805
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [edi + eax*2 - 2]
xor ecx, ecx
cmp eax, edi
jbe 0x69825802
cmp ecx, 3
jge 0x698257f6
dec eax
dec eax
cmp word [eax], 0x5c
je 0x698257f1
cmp eax, edi
ja 0x698257e5
inc ecx
cmp eax, edi
ja 0x698257e0
cmp eax, edi
jbe 0x69825802
add eax, 2
mov dword [esi + 0x48], eax
jmp 0x69825805
mov dword [esi + 0x48], edi
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 0x1c]
inc edi
cmp dword [esi + 0xc], ebx
mov dword [esi + 0x40], eax
je 0x6982590c
mov eax, dword [esi + 8]
cmp eax, ebx
jne 0x6982582f
mov eax, 0x698211b8
push ebx
push 0x80
push 4
push ebx
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
jne 0x6982585f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x698232c8
jmp 0x69825903
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push edi
push ebx
push 2
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_LockFileEx]
test eax, eax
jne 0x6982589d
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x69823200
jmp 0x69825903
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x698258d2
mov eax, dword [ebp - 8]
or eax, dword [ebp - 4]
jne 0x698258d2
or byte [ebp + 0x16], 0xff
push ebx
lea eax, [ebp + 8]
push eax
push 2
lea eax, [ebp + 0x16]
push eax
push dword [esi + 4]
mov byte [ebp + 0x17], 0xfe
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 2
push ebx
push ebx
push ebx
push dword [esi + 4]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x6982590c
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x69823138
push esi
call fcn.6982560e
add esp, 0xc
mov dword [esi + 0x3c], edi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x18
Function at 0x10001990
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor ebp, ebp
push ebp
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x10001a77
mov ebx, dword [esp + 0x2c]
lea edi, [ebx + 5]
push edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], ebp
call fcn.10022839
add esp, 4
cmp ebx, ebp
mov esi, eax
jne 0x100019f2
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
xor eax, eax
mov dword [esi], eax
mov al, byte [esp + 0x20]
sub ecx, ebx
sub ecx, 5
mov byte [esi], al
mov dword [esi + 1], ecx
jmp 0x10001a2d
push edi
push ebp
push esi
call fcn.10023a50
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov dl, byte [esp + 0x2c]
sub eax, ebx
sub eax, 5
add esp, 0xc
cmp edi, 5
mov byte [esi], dl
mov dword [esi + 1], eax
jle 0x10001a2d
lea ecx, [edi - 5]
push ecx
lea eax, [esi + 5]
push 0x90
push eax
call fcn.10023a50
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x10]
push edx
push 0x40
push edi
push ebx
call ebp
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push edi
push esi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10001a5c
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
push edi
push ebx
call ebp
push esi
call fcn.10023c8a
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x10001d80
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 2
call esi
or eax, 2
push eax
call esi
push str.GlobalCacheD
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x1004e7d8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
pop esi
jne 0x10001dd0
push 0
push str.Interlude_Extension
push str.CacheD_is_already_running_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 4
lea eax, [esp + 4]
push eax
push 0x423171
mov dword [esp + 0xc], 0x10001ad0
call fcn.10001c90
push 0
push 0x10001b70
push 0x4416a1
push 0xe8
call fcn.10001990
push 0
push 0x10001b70
push 0x441705
push 0xe8
call fcn.10001990
push 0
push 0x10001c00
push 0x424e48
push 0xe8
call fcn.10001990
call fcn.10020090
call fcn.100017e0
call fcn.1000f8a0
call fcn.1001fba0
call fcn.10021290
push 1
push 0x10001a90
push 0x422c67
push 0xe8
call fcn.10001990
add esp, 0x4c
pop ecx
ret
Function at 0x10010380
Capabilities:
Get common file path
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x1004d4e8]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
lea eax, [esp + 4]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.l2cache.ini
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [esp + 4]
push edx
push 0
push str.PrivateStoreInDB
push str.Setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [esp + 0x20c]
mov dword [esi], eax
pop esi
xor ecx, esp
call fcn.1002369f
add esp, 0x20c
ret

Function at 0x10019460
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003ac48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1004d4e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.10022986
mov dword [esp + 0x28], 0
mov edi, dword [0x1004ec08]
mov ecx, 0x1004f13c
mov dword [esp + 0xc], edi
call fcn.10010000
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x100194db
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x100194df
cmp byte [eax + 0x14], 0
je 0x100194df
call fcn.10022a14
cmp esi, dword [eax + 0xc]
jae 0x100194e5
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x100194e1
xor ecx, ecx
jmp 0x100194c3
mov esi, ecx
test esi, esi
jne 0x10019536
test edi, edi
je 0x100194ed
mov esi, edi
jmp 0x10019536
lea eax, [esp + 0xc]
push eax
call fcn.100173d0
add esp, 4
cmp eax, 0xffffffff
jne 0x1001951c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.10023f18
push 0x1004a1f0
lea ecx, [esp + 0x18]
push ecx
call fcn.10024223
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1004ec08], esi
call fcn.10010080
push esi
call fcn.10022ae2
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100229a7
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x1001b590
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003ac48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1004d4e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.10022986
mov dword [esp + 0x28], 0
mov edi, dword [0x1004ec0c]
mov ecx, 0x1004ec18
mov dword [esp + 0xc], edi
call fcn.10010000
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1001b60b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1001b60f
cmp byte [eax + 0x14], 0
je 0x1001b60f
call fcn.10022a14
cmp esi, dword [eax + 0xc]
jae 0x1001b615
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x1001b611
xor ecx, ecx
jmp 0x1001b5f3
mov esi, ecx
test esi, esi
jne 0x1001b666
test edi, edi
je 0x1001b61d
mov esi, edi
jmp 0x1001b666
lea eax, [esp + 0xc]
push eax
call fcn.1001ac30
add esp, 4
cmp eax, 0xffffffff
jne 0x1001b64c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.10023f18
push 0x1004a1f0
lea ecx, [esp + 0x18]
push ecx
call fcn.10024223
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1004ec0c], esi
call fcn.10010080
push esi
call fcn.10022ae2
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100229a7
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x1001b690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1003ac48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x1004d4e8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0
lea ecx, [esp + 0x14]
call fcn.10022986
mov dword [esp + 0x28], 0
mov edi, dword [0x1004ec10]
mov ecx, 0x1004ec14
mov dword [esp + 0xc], edi
call fcn.10010000
mov esi, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
cmp esi, dword [eax + 0xc]
jae 0x1001b70b
mov ecx, dword [eax + 8]
mov ecx, dword [ecx + esi*4]
test ecx, ecx
jne 0x1001b70f
cmp byte [eax + 0x14], 0
je 0x1001b70f
call fcn.10022a14
cmp esi, dword [eax + 0xc]
jae 0x1001b715
mov edx, dword [eax + 8]
mov esi, dword [edx + esi*4]
jmp 0x1001b711
xor ecx, ecx
jmp 0x1001b6f3
mov esi, ecx
test esi, esi
jne 0x1001b766
test edi, edi
je 0x1001b71d
mov esi, edi
jmp 0x1001b766
lea eax, [esp + 0xc]
push eax
call fcn.1001acb0
add esp, 4
cmp eax, 0xffffffff
jne 0x1001b74c
push str.bad_cast
lea ecx, [esp + 0x18]
call fcn.10023f18
push 0x1004a1f0
lea ecx, [esp + 0x18]
push ecx
call fcn.10024223
mov esi, dword [esp + 0xc]
mov ecx, esi
mov dword [0x1004ec10], esi
call fcn.10010080
push esi
call fcn.10022ae2
add esp, 4
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.100229a7
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x10021480
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2038
call fcn.100236b0
mov eax, dword [0x1004d4e8]
xor eax, esp
mov dword [esp + 0x2034], eax
push esi
mov esi, dword [esp + 0x2040]
cmp dword [esi + 0x1c], 0xffffffff
je 0x10021577
push edi
push 0x1002
lea eax, [esp + 0x103c]
push 0
push eax
call fcn.10023a50
lea ecx, [esp + 0x18]
push ecx
call fcn.100240ad
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.100246fc
mov ecx, dword [esp + 0x2060]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x50]
push edx
add eax, 1
push eax
add ecx, 0x76c
push ecx
push str.__0.4d__0.2d__0.2d__0.2d:_0.2d:_0.2d___s_r_n
lea edx, [esp + 0x70]
push 0x800
push edx
call fcn.10024c64
add esp, 0x40
lea eax, [esp + 0x204c]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1040]
push edx
call dword [sym.imp.USER32.dll_wvsprintfW]
push esi
mov edi, eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi + 0x18], 1
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x1c]
lea ecx, [edi + edi]
push ecx
lea edx, [esp + 0x1044]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [esi + 0x18], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [esp + 0x2038]
pop esi
xor ecx, esp
call fcn.1002369f
add esp, 0x2038
ret
Function at 0x100215a0
Capabilities:
Create directory
Get file attributes
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1003b76b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1004d4e8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1004d4e8]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebp, ebp
cmp eax, 0x10
je 0x100215f2
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi + 0x18], 1
push ebp
push 0x80
push 2
push ebp
push 1
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
or ebx, 0xffffffff
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x1002169c
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
mov dword [esp + 0x40], ebp
push 0xfeff
push 1
push ebp
lea ecx, [esp + 0x24]
call fcn.10021800
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
mov dword [esp + 0x14], ebp
jae 0x1002165b
lea eax, [esp + 0x1c]
mov edx, dword [esp + 0x2c]
push ebp
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edx + edx]
mov edx, dword [esi + 0x1c]
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x30], edi
jb 0x1002168b
mov eax, dword [esp + 0x1c]
push eax
call fcn.10023250
add esp, 4
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebp
mov word [esp + 0x1c], bp
add dword [esi + 0x18], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.1002369f
add esp, 0x30
ret 8

Function at 0x1002369f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004d4e8]
jne 0x100236a9
repz ret
jmp fcn.1002895c
Function at 0x1003469e
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10028343
xor ebx, ebx
cmp dword [0x1004fda8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x10034773
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x100346de
xor eax, eax
jmp 0x10034837
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x100346d7
push eax
call fcn.100282e0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1004fda8], eax
call esi
push eax
call fcn.100282e0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1004fdac], eax
call esi
push eax
call fcn.100282e0
mov dword [0x1004fdb0], eax
lea eax, [ebp - 8]
push eax
call fcn.1002c5f1
test eax, eax
pop ecx
pop ecx
je 0x10034741
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100240f3
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x10034773
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.100282e0
cmp eax, ebx
pop ecx
mov dword [0x1004fdb8], eax
je 0x10034773
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100282e0
pop ecx
mov dword [0x1004fdb4], eax
mov eax, dword [0x1004fdb4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x100347ec
cmp dword [0x1004fdb8], esi
je 0x100347ec
push eax
call fcn.1002834c
pop ecx
call eax
cmp eax, ebx
je 0x100347b9
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x1004fdb8]
call fcn.1002834c
pop ecx
call eax
test eax, eax
je 0x100347b9
test byte [ebp - 0x18], 1
jne 0x100347ec
lea eax, [ebp - 0xc]
push eax
call fcn.1002c628
test eax, eax
pop ecx
je 0x100347d4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.100240f3
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x100347e3
or dword [ebp + 0x10], 0x200000
jmp 0x1003481d
or dword [ebp + 0x10], 0x40000
jmp 0x1003481d
mov eax, dword [0x1004fdac]
cmp eax, esi
je 0x1003481d
push eax
call fcn.1002834c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1003481d
mov eax, dword [0x1004fdb0]
cmp eax, esi
je 0x1003481d
push dword [ebp - 4]
push eax
call fcn.1002834c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x1004fda8]
call fcn.1002834c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2c33700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02c3378f
jae 0x2c3370e
xor ecx, ecx
call fcn.02c3378f
jae 0x2c3373d
xor eax, eax
call fcn.02c3378f
jae 0x2c3374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02c3378f
adc al, al
jae 0x2c3372f
jne 0x2c33779
stosb byte es:[edi], al
jmp 0x2c33711
call fcn.02c3379b
sub ecx, ebx
jne 0x2c33756
call fcn.02c33799
jmp 0x2c33775
lodsb al, byte [esi]
shr eax, 1
je 0x2c33783
adc ecx, ecx
jmp 0x2c33772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02c33799
cmp eax, 0x7d00
jae 0x2c33772
cmp ah, 5
jae 0x2c33773
cmp eax, 0x7f
ja 0x2c33774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2c33711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x2c53700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02c5378f
jae 0x2c5370e
xor ecx, ecx
call fcn.02c5378f
jae 0x2c5373d
xor eax, eax
call fcn.02c5378f
jae 0x2c5374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02c5378f
adc al, al
jae 0x2c5372f
jne 0x2c53779
stosb byte es:[edi], al
jmp 0x2c53711
call fcn.02c5379b
sub ecx, ebx
jne 0x2c53756
call fcn.02c53799
jmp 0x2c53775
lodsb al, byte [esi]
shr eax, 1
je 0x2c53783
adc ecx, ecx
jmp 0x2c53772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02c53799
cmp eax, 0x7d00
jae 0x2c53772
cmp ah, 5
jae 0x2c53773
cmp eax, 0x7f
ja 0x2c53774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2c53711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80c004]
jne 0x401010
repz ret
jmp fcn.0040160c

Function at 0x4076e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404bff
and dword [ebp - 4], 0
cmp dword [0x80ec9c], 0
mov ebx, eax
jne 0x407796
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407847
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407847
push eax
call fcn.00404b8d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x80ec9c], eax
call esi
push eax
call fcn.00404b8d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x80eca0], eax
call esi
push eax
call fcn.00404b8d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x80eca4], eax
call esi
push eax
call fcn.00404b8d
pop ecx
mov dword [0x80ecac], eax
test eax, eax
je 0x407796
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404b8d
pop ecx
mov dword [0x80eca8], eax
mov eax, dword [0x80eca8]
cmp eax, ebx
je 0x4077ee
cmp dword [0x80ecac], ebx
je 0x4077ee
push eax
call fcn.00404c08
push dword [0x80ecac]
mov esi, eax
call fcn.00404c08
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4077ee
test edi, edi
je 0x4077ee
call esi
test eax, eax
je 0x4077e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4077e5
test byte [ebp - 0xc], 1
jne 0x4077ee
or dword [ebp + 0x10], 0x200000
jmp 0x407827
mov eax, dword [0x80eca0]
cmp eax, ebx
je 0x407827
push eax
call fcn.00404c08
pop ecx
test eax, eax
je 0x407827
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407827
mov eax, dword [0x80eca4]
cmp eax, ebx
je 0x407827
push eax
call fcn.00404c08
pop ecx
test eax, eax
je 0x407827
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80ec9c]
call fcn.00404c08
pop ecx
test eax, eax
je 0x407847
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407849
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409a80
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x80c004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x27263b4], 0x930
jne 0x409aaa
push str.pawafuwenileyipajizudamoyawilamebavewimogopizukevagejihejarusob
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x27263b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x27261f8], eax
jne 0x409add
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
call sub.KERNEL32.dll_VerLanguageNameW
lea edx, [ebp - 0x820]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401006
mov esp, ebp
pop ebp
ret