joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41be10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push edi
call esi
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0041d1a0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x41be44
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], bl
pop ebx
pop ebp
ret 4
call esi
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebx]
xor esi, esi
test cl, cl
je 0x41be90
cmp cl, 0x22
jne 0x41be7f
xor ecx, ecx
test esi, esi
sete cl
mov esi, ecx
jmp 0x41be88
cmp cl, 0x20
jne 0x41be88
test esi, esi
je 0x41be90
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x41be6f
cmp byte [eax], 0x20
jne 0x41be9e
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x20
je 0x41be95
mov esi, dword [ebp + 8]
push 0x400
push eax
push esi
call fcn.00421320
push ebx
mov byte [esi + 0x3ff], 0
call fcn.0041d1c0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41f1d0
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b6f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov eax, dword [esi + 0x2e0]
mov dword [esi], 0x42d0e0
cmp eax, 0xffffffff
je 0x41f213
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x2e0], 0xffffffff
mov eax, dword [esi + 0x478]
test eax, eax
je 0x41f256
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edi, [esi + 0x10]
push 0x80
push edi
call ebx
test eax, eax
jne 0x41f240
lea eax, [esi + 0x178]
push 0x80
push eax
call ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call edi
test eax, eax
jne 0x41f256
lea ecx, [esi + 0x178]
push ecx
call edi
mov dword [esi + 0x488], 0x42c240
mov dword [esi], 0x42d02c
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0041ee50
mov ecx, 0x5a
xor eax, eax
lea edi, [esi + 0x10]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x46c]
cmp eax, ebx
je 0x41f297
push eax
call fcn.0041d1c0
add esp, 4
mov dword [esi + 0x46c], ebx
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x42c240
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x41f630
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx]
call dword [eax + 0x34]
test byte [ebx + 0x2e4], 1
je 0x41f66c
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebx + 0x10]
push 0x80
push ecx
call esi
test eax, eax
jne 0x41f66c
lea edx, [ebx + 0x178]
push 0x80
push edx
call esi
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea esi, [ebx + 0x10]
push 1
push eax
push esi
call edi
test eax, eax
jne 0x41f720
mov ecx, dword [ebp + 8]
push 1
lea edx, [ebx + 0x178]
push ecx
push edx
call edi
test eax, eax
mov dword [ebp - 4], eax
jne 0x41f720
test esi, esi
je 0x41f7c4
push esi
call fcn.00420ad0
add esp, 4
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 8], eax
je 0x41f7c4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 8], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jb 0x41f6f1
push 2
lea eax, [esi + 1]
push 0x43139c
push eax
call fcn.00422490
add esp, 0xc
test eax, eax
jne 0x41f6f1
lea ecx, [esi + 3]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push 0x3a
push edx
call fcn.00422510
add esp, 8
test eax, eax
je 0x41f7c4
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0xb4]
test eax, eax
mov dword [ebp - 4], eax
je 0x41f7c4
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x80
push esi
call edi
test eax, eax
jne 0x41f740
lea edx, [ebx + 0x178]
push 0x80
push edx
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
test eax, eax
mov dword [ebp - 4], eax
jne 0x41f760
lea eax, [ebx + 0x178]
push eax
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x41f7be
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41f78a
mov eax, dword [0x43258c]
test eax, eax
jne 0x41f775
call fcn.0041d630
cmp dword [0x432580], 3
je 0x41f78a
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041ff50
add esp, 4
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
lea edi, [ebx + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x28]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
push eax
call esi
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x28]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41fce0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
and eax, 0xff
add eax, 0x40
push eax
push str._c:_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x41fd16
jmp dword [eax*4 + 0x41fd48]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret
mov eax, 2
mov esp, ebp
pop ebp
ret
mov eax, 3
mov esp, ebp
pop ebp
ret
mov eax, 4
mov esp, ebp
pop ebp
ret
Function at 0x41fd60
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x42b73b
push eax
mov eax, 0x1084
mov dword fs:[0], esp
call fcn.004224d0
push esi
mov esi, dword [ebp + 8]
and esi, 0xff
lea ecx, [ebp - 0x14]
lea eax, [esi + 0x40]
push eax
push str._c:_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp ax, 2
jne 0x41fe29
lea eax, [ebp - 0x1090]
push 0xa
dec esi
push eax
push esi
call fcn.00429f85
add esp, 0xc
lea ecx, [ebp - 0x890]
push eax
call fcn.0041d740
lea ecx, [ebp - 0x890]
mov dword [ebp - 4], 0
call fcn.0041c6e0
lea ecx, [ebp - 0x1090]
push 0x200
push ecx
lea ecx, [ebp - 0x890]
call fcn.0041c970
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
je 0x41fe24
call fcn.0041db10
mov eax, 1
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0041db10
lea edx, [ebp + 8]
lea eax, [ebp + 8]
push edx
lea ecx, [ebp + 8]
push eax
lea edx, [ebp + 8]
push ecx
lea eax, [ebp - 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x41fe10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x15
je 0x41fe57
cmp eax, 0xf
jne 0x41fe10
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41fe70
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x43258c]
test eax, eax
jne 0x41fe81
call fcn.0041d630
mov eax, dword [0x432580]
push ebx
push esi
cmp eax, 1
push edi
jne 0x41fe9b
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov word [eax], 0
pop ebp
ret
mov ecx, dword [str.RWABS_MUTEX]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
push 0xffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [ebp + 0x10]
cmp eax, 0x102
jne 0x41fec9
mov word [edi], 0x63
push str.rwabs32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x41ff0b
push str.rwabs32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x41ff04
push str._Basil_1_32
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41ff04
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
push edx
push ecx
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
mov word [edi], 0x63
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x41ff50
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x14
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x10], 0x400
mov dword [ebp - 0xc], 0x50
mov dword [ebp - 8], 0
call fcn.0041d1a0
push 0x400
mov edi, eax
call fcn.0041d1a0
mov esi, eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041d1a0
mov ecx, dword [ebp - 0xc]
mov ebx, eax
push ecx
call fcn.0041d1a0
add esp, 0x10
mov dword [ebp - 4], eax
test edi, edi
je 0x42004e
test esi, esi
je 0x42004e
test ebx, ebx
je 0x42004e
test eax, eax
je 0x42005b
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x42004b
push 2
push 0x400
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x42004b
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
push edx
push eax
lea edx, [ebp - 0x10]
push ecx
push edx
push ebx
push str.Administrators
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
test eax, eax
je 0x42004b
push ebx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x42004b
push ebx
push 0xc01f0000
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x42004b
push 0
push esi
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x42004b
mov eax, dword [ebp + 8]
push edi
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
test eax, eax
je 0x42004b
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x42005b
push eax
call fcn.0041d1c0
add esp, 4
test ebx, ebx
je 0x420068
push ebx
call fcn.0041d1c0
add esp, 4
test esi, esi
je 0x420075
push esi
call fcn.0041d1c0
add esp, 4
test edi, edi
je 0x420082
push edi
call fcn.0041d1c0
add esp, 4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42897a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x431f28
cmp edx, dword [eax]
je 0x42899c
add eax, 8
inc ecx
cmp eax, 0x431fb8
jl 0x42898d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x431f28]
jne 0x428aca
mov eax, dword [0x43261c]
cmp eax, 1
je 0x428aa4
test eax, eax
jne 0x4289cd
cmp dword [0x431444], 1
je 0x428aa4
cmp edx, 0xfc
je 0x428aca
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x428a04
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004276f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00425e60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x428a47
lea eax, [ebp - 0x1a4]
push eax
call fcn.00425e60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42d7f0
push edi
call fcn.00421320
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004276f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00427700
lea eax, [ebp - 0xa0]
push 0x42d7d0
push eax
call fcn.00427700
push dword [esi + 0x431f2c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00427700
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00429d3d
add esp, 0x2c
pop edi
jmp 0x428aca
lea eax, [ebp + 8]
lea esi, [esi + 0x431f2c]
push 0
push eax
push dword [esi]
call fcn.00425e60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4a3fcc
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x70fa6edc
out dx, eax
xor eax, 0xfa291c35
sal byte [esp + esi*4], 1
xor eax, 0xd0fa291c
xor al, 0xb4
mov ebp, 0x1db451d2
xchg esp, eax
loopne 0x4a3fd3
mov ch, 0x68
pop ebp
salc
scasd eax, dword es:[edi]
fsubr qword [edi]
push esp
pop ebx
ret
Function at 0x40561c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x40562b
lodsb al, byte [esi]
nop
jmp 0x405639
ror edi, 0xd
nop
add edi, eax
nop

Function at 0x405640
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
mov esi, dword [edx + 0x28]
jmp 0x405518
xor edi, edi
movzx ecx, word [edx + 0x26]
nop
nop
xor eax, eax
lodsb al, byte [esi]
nop
jmp 0x405531
cmp al, 0x61
nop
jmp 0x40553f
jl 0x405559
jmp 0x40554b
sub al, 0x20
nop
jmp 0x405559
nop
jmp 0x40556a
ror edi, 0xd
nop
jmp 0x40557f
add edi, eax
nop
jmp 0x405590
dec ecx
jne 0x40551f
nop
jmp 0x4055a4
nop
push edx
nop
mov edx, dword [edx + 0x10]
push edi
mov eax, dword [edx + 0x3c]
nop
add eax, edx
nop
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
je 0x405739
add eax, edx
jmp 0x4055cb
mov ecx, dword [eax + 0x18]
nop
jmp 0x4055da
invalid
mov ebx, dword [eax + 0x20]
nop
add ebx, edx
push eax
nop
nop
test ecx, ecx
jmp 0x4055f6
je 0x405727
nop
nop
xor edi, edi
jmp 0x405611
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
nop
nop
xor eax, eax
nop
jmp 0x405651
cmp al, ah
nop
jmp 0x405660
jne 0x405618
nop
nop
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
jne 0x4055e2
jmp 0x405685
jmp 0x405693
pop eax
nop
mov ebx, dword [eax + 0x24]
add ebx, edx
jmp 0x4056a4
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
jmp 0x4056b7
add ebx, edx
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
nop
jmp 0x4056cf
mov dword [esp + 0x24], eax
jmp 0x4056df
pop ebx
jmp 0x4056f1
pop ebx
jmp 0x4056fd
popal
pop ecx
jmp 0x405711
pop edx
push ecx
jmp eax
nop
pop eax
nop
jmp 0x405739
nop
jmp 0x405747
pop edi
pop edx
mov edx, dword [edx]
jmp 0x40575d
jmp 0x405509
Function at 0x404b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x404b33
pop dword [ebp - 0x34]
mov eax, 0x404b33
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7effb586
sub dword [ebp - 0x44], 0x30ad703b
mov dword [ebp - 0x40], 0x43f01ec
sub dword [ebp - 0x40], 0xd20bb5a7
mov dword [ebp - 0x3c], 0x8fb0e9b5
add dword [ebp - 0x3c], 0xbc9b5a79
mov dword [ebp - 0x38], 0x2282e2d2
add dword [ebp - 0x38], 0xdd7d1d2e
lea eax, [ebp - 0x44]
push eax
mov eax, 0xfcbd97fb
sub eax, 0xfc7b6787
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2395c81c
sub dword [ebp - 0x44], 0xaf235ec6
mov dword [ebp - 0x40], 0xce929477
sub dword [ebp - 0x40], 0x8d263302
mov dword [ebp - 0x3c], 0x78b9b427
sub dword [ebp - 0x3c], 0x154a47bb
mov dword [ebp - 0x38], 0x9ef4c72a
add dword [ebp - 0x38], 0x610b38d6
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa1f54a95
add eax, 0x5e4ce68f
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3f49c
push 0
call eax
mov ecx, 0x123232b4
add ecx, 0xedce1b8f
mov ebx, eax
mov edi, 0x434400
add edi, dword [ebp - 0x34]
mov edx, 0x39326cf1
add edx, 0x5eb848e4
sub dword [ebp - 0x18], ecx
mov esi, dword [edi]
xor dword [ebp - 0x24], ecx
add esi, edx
xor dword [ebp - 0xc], esi
mov dword [ebx], esi
add dword [ebp - 0x14], eax
add ebx, 0xbeeb79f1
sub ebx, 0xbeeb79ed
add edi, 0x1bcf7207
sub edi, 0x1bcf7203
loop 0x404c4a
add eax, 0x12bdf
mov ebx, eax
add eax, 0xb994808e
add eax, 0x466b7f77
mov ecx, 0xeb58fdec
add ecx, 0x14e70214
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x401237
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41a2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401230
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41a300]
add ebx, 0x23f
mov edx, dword [0x41a304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xb5ee04], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xb5ee00]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xb5ee04], 0x3eb
mov dword [0xb5ee00], eax
mov eax, dword [0xb5ed58]
cmove eax, dword [ebp - 0x10]
mov dword [0xb5ed58], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xb5edfc], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401291
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cc39
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419f20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004096de
mov dword [ebp - 0x14], eax
cmp dword [0x4ba5f8], esi
jne 0x40cd2c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40ccb9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ce0c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40ce0c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ce0c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ba5f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ba5fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ba600], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ba608], eax
test eax, eax
je 0x40cd29
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ba604], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40cd51
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40cd44
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40cd66
push 4
pop eax
jmp 0x40ce0e
cmp dword [ebp - 0x14], esi
je 0x40cd66
push dword [0x4ba5f8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40cd4b
mov eax, dword [0x4ba604]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40cdc4
cmp dword [0x4ba608], edi
je 0x40cdc4
push eax
call ebx
push dword [0x4ba608]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cdc4
test eax, eax
je 0x40cdc4
call ecx
test eax, eax
je 0x40cdb9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40cdb9
test byte [ebp - 8], 1
jne 0x40cdc4
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cdf4
mov eax, dword [0x4ba5fc]
cmp eax, edi
je 0x40cdf1
push eax
call ebx
test eax, eax
je 0x40cdf1
call eax
mov esi, eax
test esi, esi
je 0x40cdf1
mov eax, dword [0x4ba600]
cmp eax, edi
je 0x40cdf1
push eax
call ebx
test eax, eax
je 0x40cdf1
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ba5f8]
call ebx
test eax, eax
je 0x40ce0c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40ce0e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404137
mov esp, ebp
pop ebp
ret
Function at 0x4163e0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x5fc28c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4165ee
sub esp, 0x18
mov eax, dword [0x5fc1b4]
test eax, eax
jne 0x4165d7
nop
nop
lea eax, [0x5fc1a4]
mov dword [esp], eax
call sym.runtime.lock2
mov eax, dword [0x5fc1a8]
test eax, eax
je 0x416428
cmp dword [eax + 8], 0xcc
jne 0x41649e
mov edx, dword [0x5fc1ac]
test edx, edx
jne 0x416480
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x6009d0]
mov dword [esp + 8], eax
call sym.runtime.persistentalloc
mov eax, dword [esp + 0xc]
mov dword [0x5fc1ac], eax
mov ecx, dword [0x5fc1b0]
mov dword [eax], ecx
mov eax, dword [0x5fc1ac]
mov dword [0x5fc1b0], eax
movzx eax, byte [0x5fc6a0]
test al, al
jne 0x416480
xor eax, eax
jmp 0x4165a8
mov edx, dword [0x5fc1ac]
mov ebx, dword [edx + 4]
mov dword [0x5fc1ac], ebx
mov ebx, dword [0x5fc1a8]
mov dword [edx + 4], ebx
mov dword [0x5fc1a8], edx
mov edx, dword [0x5fc1a8]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x416587
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call sym.runtime_internal_atomic.Xadd
mov eax, dword [0x5fc3f0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x4164e8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x4164fe
call sym.runtime.gcWriteBarrier2
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x5fc3f0]
test eax, eax
jne 0x416522
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x416550
call sym.runtime.gcWriteBarrier6
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x5fc1a4]
mov dword [esp], eax
call sym.runtime.unlock2
nop
lea eax, [0x5fc1a0]
mov dword [esp], eax
mov dword [esp + 4], 8
call sym.runtime_internal_atomic.Or
add esp, 0x18
ret
mov ecx, 0xcc
call sym.runtime.panicIndexU
lea edx, [0x5cc1fc]
movzx ebx, byte [edx + eax]
lea ebp, [0x5fc6a0]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x416480
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x416591
mov ecx, 5
call sym.runtime.panicIndex
lea eax, [0x50fa15]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.runtime.queuefinalizer