joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594890
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x1004610]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 3
jne 0x59491a
movzx eax, word [esi + 0x118]
test ax, ax
jne 0x5948c6
test byte [esi + 0x230], 1
jne 0x5948ee
movzx cx, byte [edi]
cmp cx, ax
jbe 0x5948ee
push 0xfdfd90
push esi
call fcn.00587e90
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00560195
add esp, 0xc
ret
mov dl, byte [edi]
push 1
lea eax, [esp + 0xc]
push eax
push 0xfde018
push esi
mov byte [esp + 0x18], dl
call fcn.00593a70
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00560195
add esp, 0xc
ret
test al, 2
je 0x5949ae
movzx ecx, word [edi + 2]
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.00592a80
movzx eax, word [edi + 4]
push eax
lea ecx, [esp + 0x16]
push ecx
call fcn.00592a80
movzx edx, word [edi + 6]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.00592a80
add esp, 0x18
cmp byte [esi + 0x127], 8
jne 0x594988
mov cl, byte [esp + 0xc]
or cl, byte [esp + 0xa]
or cl, byte [esp + 8]
je 0x594988
push 0xfdfd50
push esi
call fcn.00587e90
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00560195
add esp, 0xc
ret
push 6
lea edx, [esp + 0xc]
push edx
push 0xfde018
push esi
call fcn.00593a70
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00560195
add esp, 0xc
ret
mov cl, byte [esi + 0x127]
movzx eax, word [edi + 8]
mov edx, 1
shl edx, cl
cmp eax, edx
jl 0x5949e2
push 0xfdfd10
push esi
call fcn.00587e90
add esp, 8
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00560195
add esp, 0xc
ret
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00592a80
push 2
lea ecx, [esp + 0x14]
push ecx
push 0xfde018
push esi
call fcn.00593a70
mov ecx, dword [esp + 0x28]
add esp, 0x18
pop edi
pop esi
xor ecx, esp
call fcn.00560195
add esp, 0xc
ret
Function at 0x598360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x24]
push ebp
push esi
mov ebp, dword [edi + 0x34]
sub ebp, dword [edi + 0x6c]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x24]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x5983de
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00560bf0
mov edx, dword [edi + 0x44]
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5983b1
sub eax, ebx
jmp 0x5983b3
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x5983a2
mov ecx, dword [edi + 0x38]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x5983d2
sub eax, ebx
jmp 0x5983d4
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x5983c3
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x598439
mov edx, dword [edi + 0x6c]
add edx, dword [edi + 0x64]
mov ecx, ebp
add edx, dword [edi + 0x30]
push edx
call fcn.00598060
add dword [edi + 0x6c], eax
mov edx, dword [edi + 0x6c]
add esp, 4
cmp edx, 3
jb 0x598425
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x30]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x50]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp edx, 0x106
jae 0x598439
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x598366
pop esi
pop ebp
pop ebx
ret
Function at 0x599890
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x5998aa
pop edi
lea eax, [esi + 1]
pop esi
ret
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x5999ba
push ebp
jmp 0x5998c0
mov eax, ebx
cmp ebx, 0x15b0
jb 0x5998cf
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x59997b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x5998f0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x5998f0
test eax, eax
je 0x59998d
nop
movzx edx, byte [esi]
add ecx, edx
inc esi
add edi, ecx
sub eax, 1
jne 0x599980
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x5998c0
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x64d40e80
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x74480f22
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a251

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..pdata
mov ebx, 0x408f6c
nop
mov ecx, 0x625b2f85
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, 0x902a282c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x91436c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x914376
pushal
call 0x91437c
pop ebp
sub ebp, 0x10
sub ebp, 0x51436c
jmp 0x914392
mov eax, 0x51436c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5f0
mov edx, 0x2f35c2f0
xor byte [eax], dl
inc eax
dec ecx
jne 0x9143a9
jmp 0x9143bc
jnp 0x9143fb
jnp 0x914439
int3
les ebx, [eax]
cmc
invalid
invalid
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40de38
nop
mov ecx, 0xb1a23eb
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x258e6beb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x407e97
Capabilities:
Get disk size

Disassembly:
xor eax, eax
push eax
push eax
push eax
call fcn.00420660
mov edx, dword [esp + 0x10]
lea ecx, [esp]
call fcn.0040e000
mov edx, dword [esp]
push edx
call fcn.004204c0
pop edx
push eax
push edx
call fcn.00420590
mov edx, 0x477a36
push edx
call fcn.00420590
lea eax, [esp + 4]
push eax
call fcn.00420500
lea eax, [esp + 4]
push eax
push 0
push 0
push dword [esp + 0xc]
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
and eax, eax
je 0x407ef1
jmp 0x407ef1
lea eax, [esp + 4]
mov edx, dword [eax + 4]
mov eax, dword [eax]
jmp 0x407f00
push edx
push dword [esp + 4]
call fcn.004206f0
pop edx
add esp, 0xc
ret 4
Function at 0x40e9b3
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x40ea08
push dword [esp + 0x10]
push 0x40e932
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x47e12c]
test esi, esi
je 0x40ea61
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40ea00
cmp byte [esi + 0x10], 0
je 0x40ea00
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x40e9dc
jmp 0x40ea61
mov esi, dword [0x47e12c]
test esi, esi
je 0x40ea61
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x40ea5a
cmp byte [esi + 0x11], 0
je 0x40ea36
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x40ea4d
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x47e12c
call fcn.0042040d
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x40ea15
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x40f1c4
Capabilities:
Read file on windows

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jle 0x40f218
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push 0
push eax
mov eax, dword [esp + 0x20]
sub eax, esi
push eax
lea eax, [esi + ebp]
push eax
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f206
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x40f212
add esi, dword [esp + 0x10]
cmp esi, dword [esp + 0x18]
jl 0x40f1d7
jmp 0x40f216
add esi, dword [esp + 0x10]
pop ebp
pop ebx
mov eax, esi
pop esi
ret 0xc

Function at 0x40f255
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
cmp dword [esp + 0x24], 0x18
mov ebx, eax
je 0x40f314
cmp dword [esp + 0x24], 2
je 0x40f314
push 0x2000
push ebp
push dword [0x47e018]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
jmp 0x40f2e3
cmp dword [esp + 0x18], 2
jne 0x40f2ff
cmp dword [esp + 0x28], 0xffffffff
je 0x40f2a7
cmp ebp, dword [esp + 0x28]
jae 0x40f2ff
add ebp, 2
test ebx, ebx
jne 0x40f2cc
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x47e018]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x40f2ff
cmp ax, 0xd
je 0x40f2e3
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f293
push dword [esp + 0x2c]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.00455380
jmp 0x40f3a6
push eax
push 0
push dword [0x47e018]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [esp + 0x28], 0xffffffff
je 0x40f332
cmp ebp, dword [esp + 0x28]
jae 0x40f38a
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40f38a
cmp dword [esp + 0x18], 1
jne 0x40f38a
inc ebp
test ebx, ebx
jne 0x40f377
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x47e018]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x40f38a
cmp al, 0xd
je 0x40f325
mov byte [esi + edi], al
inc edi
dec ebx
jmp 0x40f325
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x2c]
mov byte [esi + edi], 0
push esi
jne 0x40f3a1
call fcn.004553d0
jmp 0x40f3a6
call fcn.00455580
push esi
push 0
push dword [0x47e018]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x40f615
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
push ebp
xor ebp, ebp
push edi
cmp dword [eax + 8], 1
mov edi, ebp
mov dword [esp + 0x10], edi
mov dword [esp + 8], ebp
jne 0x40f7b4
push esi
mov esi, dword [esp + 0x48]
test esi, esi
je 0x40f7b3
push ebx
push ebp
push pe_nt_image_headers32
push 3
push ebp
push 7
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f7b2
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x200000
push ebp
push dword [0x47e018]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x40f7ab
call fcn.00432610
mov edi, eax
mov dword [esp + 0x1c], edi
test edi, edi
je 0x40f798
lea eax, [esp + 0x20]
push eax
push esi
call sub.MSVCRT.dll__wstat
push 0x1a4
push edi
call fcn.00432ae0
lea eax, [esp + 0x30]
push eax
push edi
call fcn.00432c60
mov esi, dword [esp + 0x60]
add esp, 0x18
mov eax, dword [esi + 0x20]
cmp dword [eax + 8], 1
je 0x40f6e4
cmp dword [eax + 8], 3
je 0x40f6e4
push dword [esp + 0x50]
push edi
call fcn.004323b0
pop ecx
pop ecx
jmp 0x40f702
push dword [esp + 0x50]
call fcn.004554f0
mov esi, eax
push esi
push edi
call fcn.00432ad0
pop ecx
pop ecx
push esi
call fcn.004554e0
mov esi, dword [esp + 0x48]
mov eax, dword [esp + 0x14]
cdq
push edx
push eax
push edi
call fcn.00432b30
push 0x8000
push edi
call fcn.00432980
push edi
push dword [esi]
call fcn.00432dd0
add esp, 0x1c
lea eax, [esp + 0x4c]
push 0
push eax
push 0x200000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x4c]
test eax, eax
jle 0x40f77f
mov edi, dword [esp + 0x10]
push eax
push ebp
push dword [esi]
call fcn.00432d90
add esp, 0xc
cmp eax, dword [esp + 0x4c]
jne 0x40f777
add edi, dword [esp + 0x4c]
lea eax, [esp + 0x4c]
push 0
push eax
push 0x200000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x4c]
test eax, eax
jg 0x40f745
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], eax
jne 0x40f791
mov dword [esp + 0x18], 1
push edi
call fcn.00432540
pop ecx
push ebp
push 0
push dword [0x47e018]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 0x34
ret 0xc
Function at 0x40fed0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x47e340], 0
jne 0x40fede
call fcn.0040fe50
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x47e344]
call esi
test eax, eax
jne 0x40ff01
call fcn.0040fe50
push dword [0x47e344]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x40ff10
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x40ff70
mov ebx, 0x10
test edi, edi
jns 0x40ff79
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x40ff42
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4107ff
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x47e7fc]
call fcn.0041fca9
mov ebx, eax
test ebx, ebx
je 0x410863
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x410828
push dword [esp + 0xc]
push ebx
call eax
jmp 0x410863
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00420820
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00420900
pop edi
pop esi
pop ebx
ret 8
Function at 0x411cd2
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x411e48
mov eax, dword [esp + 0x24]
dec eax
je 0x411e2b
dec eax
jne 0x411e48
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.00411c8b
pop ecx
test eax, eax
je 0x411d89
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x411d4c
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x411e27
dec ebx
je 0x411e23
dec ebx
je 0x411e02
dec ebx
je 0x411dbc
sub ebx, 4
jne 0x411e48
test edi, edi
jne 0x411e48
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x411e48
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x411d4c
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x411d47
sub edi, 0
je 0x411df4
dec edi
je 0x411de6
dec edi
je 0x411dd8
dec edi
jne 0x411e48
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x411e48
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x411e48
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x411e48
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x411e48
sub edi, 0
je 0x411e1f
dec edi
je 0x411e1b
dec edi
jne 0x411e48
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x411e48
push 0x3c
jmp 0x411e47
push 0x32
jmp 0x411e47
push 0x14
jmp 0x411e47
push 5
jmp 0x411e47
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x411e45
cmp eax, 0xa
je 0x411e41
cmp eax, 0x5a
jne 0x411e48
push 0x28
jmp 0x411e47
push 0x1e
jmp 0x411e47
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x411f8b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x47e7f8]
call fcn.0041fca9
mov esi, eax
test esi, esi
je 0x412065
cmp dword [ebp + 0xc], 0
je 0x411fd7
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x411fc8
cmp dword [esi + 0x1c], 0
jne 0x411fc8
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x412065
test byte [ebp + 0x10], 3
je 0x411ff2
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.00412873
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x412017
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x41202b
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x412048
test ebx, ebx
je 0x41203c
push 8
jmp 0x41204e
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x41205b
test ebx, ebx
je 0x412051
push 3
pop ecx
jmp 0x41205b
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc