joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100253b0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1003da50]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100253f6
cmp word [ebx], dx
jne 0x100253f6
or byte [eax + edi + 0x28], 4
jmp 0x100253fb
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x1002555e
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x1002553e
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1002543c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10025472
cmp eax, edx
jae 0x10025480
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10025417
jmp 0x1002555e
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10025539
cmp dword [ebp - 0x18], 0
je 0x10025539
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1003da50]
test byte [eax + edi + 0x28], 0x48
je 0x1002550f
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100254d3
mov word [esi], cx
jmp 0x1002550a
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1003da50]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1003da50]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1003da50]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x1002555e
pop eax
cmp word [ebp - 4], ax
jne 0x1002551f
cmp esi, ebx
jne 0x1002551f
mov word [esi], ax
jmp 0x1002555b
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001e278
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x1002555e
push 0xd
pop eax
jmp 0x1002551a
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1003da50]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10025558
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x1002555e
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10029cf1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.10029c6d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10029e60
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10029e60
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10029e15
jg 0x10029d4d
test eax, eax
je 0x10029e0b
push 1
push 0x1000
call fcn.1001e3fd
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10029d70
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10029e02
push 0x8000
push ebx
call fcn.10029b9e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10029d99
jg 0x10029d94
cmp ecx, 0x1000
jb 0x10029d99
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001d81e
add esp, 0x10
cmp eax, 0xffffffff
je 0x10029dde
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10029d94
jl 0x10029dc5
test ecx, ecx
jne 0x10029d86
push dword [ebp - 0xc]
push ebx
call fcn.10029b9e
push esi
call fcn.1001bcdc
add esp, 0xc
xor ebx, ebx
jmp 0x10029e6e
cmp byte [edi + 0x24], 0
je 0x10029df5
cmp dword [edi + 0x20], 5
jne 0x10029df5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10029e00
mov ebx, dword [edi + 0x18]
jmp 0x10029e02
xor ebx, ebx
push esi
call fcn.1001bcdc
pop ecx
jmp 0x10029e6e
test ecx, ecx
jg 0x10029dd7
jl 0x10029e15
test eax, eax
jae 0x10029dd7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001e278
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10029e35
cmp byte [edi + 0x1c], 0
je 0x10029dd7
jmp 0x10029e66
push ebx
call fcn.10025fad
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10029dd7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10029e6e
cmp byte [edi + 0x1c], 0
je 0x10029e6b
mov ebx, dword [edi + 0x18]
jmp 0x10029e6e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001e278
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1002b420
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002b44d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002b44d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405fb1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40ec80]
jne 0x405fbb
repz ret
jmp fcn.00407ccc

Function at 0x40627b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40ec80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040300a
and dword [ebp - 0x14], 0
cmp dword [0x40f960], 0
mov dword [ebp - 0x18], eax
jne 0x40632e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4063d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4063d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40f960], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40f964], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40f968], eax
call edi
push eax
call esi
mov dword [0x40f970], eax
test eax, eax
je 0x40632e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40f96c], eax
mov eax, dword [0x40f96c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x406387
cmp dword [0x40f970], ecx
je 0x406387
push eax
call esi
push dword [0x40f970]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x406387
test ebx, ebx
je 0x406387
call edi
test eax, eax
je 0x40637e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40637e
test byte [ebp - 8], 1
jne 0x406387
or dword [ebp + 0x10], 0x200000
jmp 0x4063ba
mov eax, dword [0x40f964]
cmp eax, dword [ebp - 0x18]
je 0x4063ba
push eax
call esi
test eax, eax
je 0x4063ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4063ba
mov eax, dword [0x40f968]
cmp eax, dword [ebp - 0x18]
je 0x4063ba
push eax
call esi
test eax, eax
je 0x4063ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40f960]
call esi
test eax, eax
je 0x4063d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4063d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405fb1
leave
ret
Function at 0x404690
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xca195a0d
jmp 0x4046d0
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0x8707487d
nop
mov eax, dword [ebp - 0x14]
cmp eax, 0x3d7e7610
jg 0x404720
cmp eax, 0x39f1a9d3
jg 0x404730
cmp eax, 0xeadcf411
jg 0x404740
cmp eax, 0xe27e6bdf
jg 0x40475a
cmp eax, 0x8807c575
je 0x404771
cmp eax, 0xca195a0d
jne 0x404784
mov eax, 0x3d7e7611
cmp dword [ebp - 4], 0
je 0x404711
mov eax, 0x39f1a9d4
mov dword [ebp - 0x14], eax
jmp 0x4046d0
cmp eax, 0x3d7e7611
jne 0x4046d0
jmp 0x4046c1
cmp eax, 0x39f1a9d4
jne 0x4046d0
mov dword [ebp - 0x14], 0x8807c575
jmp 0x4046d0
cmp eax, 0xeadcf412
jne 0x4046d0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x8807c575
jmp 0x4046d0
cmp eax, 0xe27e6be0
jne 0x4046d0
mov dword [ebp - 0x14], 0x8707487d
jmp 0x4046d0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0xe27e6be0
jmp 0x4046d0
cmp eax, 0x8707487d
jne 0x4046d0
mov eax, dword [ebp - 8]
add esp, 0x1c
pop ebp
ret

Function at 0x4047a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
sub esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x4b41be07
jmp 0x4047ee
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0x2c52d818
mov eax, dword [ebp - 0x14]
cmp eax, 0x4b41be06
jg 0x404810
cmp eax, 0x2d698d25
je 0x404830
cmp eax, 0x47e2d0fc
je 0x4047e0
cmp eax, 0x2c52d818
jne 0x4047ee
jmp 0x404840
cmp eax, 0x4b41be07
jne 0x4047ee
mov eax, 0x2d698d25
cmp dword [ebp - 4], 0
je 0x404827
mov eax, 0x47e2d0fc
mov dword [ebp - 0x14], eax
jmp 0x4047ee
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x14], 0x2c52d818
jmp 0x4047ee
mov eax, dword [ebp - 8]
add esp, 0x1c
pop ebp
ret
Function at 0x405660
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x134
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call fcn.00404b50
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x130], 0x24d96d10
lea esi, [ebp - 0x125]
mov edi, 0x758e49bb
jmp 0x40577e
mov dword [esp], esi
mov dword [esp + 8], 0x105
mov dword [esp + 4], 0
call fcn.00404390
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.00404390
mov dword [esp], esi
mov dword [esp + 4], 0x105
call fcn.00404d40
mov dword [esp], esi
call fcn.00404b50
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.00404850
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
add edx, edi
sub edx, ecx
add edx, 0x8a71b645
add ecx, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], ecx
call fcn.00404850
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], 0x24d96d10
mov eax, dword [ebp - 0x130]
cmp eax, 0x9052aa1a
je 0x4057b8
cmp eax, 0x2d92127e
je 0x4056c0
cmp eax, 0x24d96d10
jne 0x40577e
mov eax, 0x2d92127e
cmp dword [ebp - 0x12c], 0
je 0x4057b0
mov eax, 0x9052aa1a
mov dword [ebp - 0x130], eax
jmp 0x40577e
add esp, 0x134
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4095d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x4091d0
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004170d5
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0x36698084
jmp 0x409630
mov dword [ebp - 0x14], 0x63eaca28
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x14]
cmp eax, 0xf0ff7e01
jg 0x409650
cmp eax, 0x9120e1be
jne 0x409630
jmp 0x409624
cmp eax, 0x63eaca27
jg 0x4096a0
cmp eax, 0x4f2d9bc8
jg 0x4096b0
cmp eax, 0x36698083
jg 0x4096de
cmp eax, 0x340f9445
jg 0x409701
cmp eax, 0xf21ab66b
jg 0x409718
cmp eax, 0xf0ff7e02
jne 0x409630
mov al, byte [ebp - 1]
test al, al
mov eax, 0xf21ab66c
jne 0x409693
mov eax, 0xb05bd
mov dword [ebp - 0x14], eax
jmp 0x409630
cmp eax, 0x63eaca28
jne 0x409630
mov dword [ebp - 0x14], 0xffaca213
jmp 0x409630
cmp eax, 0x4f2d9bc9
jne 0x409630
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov dword [ebp - 0x14], 0x63eaca28
jmp 0x409630
cmp eax, 0x36698084
jne 0x409630
mov eax, 0x9120e1be
cmp dword [ebp - 8], 0
je 0x4096f9
mov eax, 0x4f2d9bc9
mov dword [ebp - 0x14], eax
jmp 0x409630
cmp eax, 0x340f9446
jne 0x409630
mov dword [ebp - 0x14], 0xffaca213
jmp 0x409630
cmp eax, 0xf21ab66c
je 0x40973a
cmp eax, 0xffaca213
jne 0x409755
cmp dword [ebp - 0x10], 0
setne byte [ebp - 1]
mov dword [ebp - 0x14], 0xf0ff7e02
jmp 0x409630
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [ebp - 0x14], 0xb05bd
jmp 0x409630
cmp eax, 0xb05bd
jne 0x409630
add esp, 0x2c
pop ebp
ret
Function at 0x40dbb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [0x40e9ec]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], 0x26bd72a5
jmp 0x40dbf0
mov dword [ebp - 0x24], 0xaf284987
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp - 0x24]
cmp eax, 0x6285b625
jg 0x40dc10
cmp eax, 0x9e897dde
jg 0x40dc20
cmp eax, 0x911a3cc8
jne 0x40dbf0
jmp 0x40dc2e
cmp eax, 0x6285b626
jne 0x40dbf0
jmp 0x40dbe3
cmp eax, 0xa88be784
jg 0x40dc3e
cmp eax, 0x9e897ddf
jne 0x40dbf0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x24], 0x264f0ad7
jmp 0x40dbf0
cmp eax, 0xaf284986
jg 0x40dc68
cmp eax, 0xa88be785
jne 0x40dbf0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [str._vTO8], eax
call fcn.00416b3f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x264f0ad7
jmp 0x40dbf0
cmp eax, 0x4e3c385
jg 0x40dcc4
cmp eax, 0xaf284987
jne 0x40dbf0
mov dword [esp], 0
call fcn.0040dd70
mov dword [esp], eax
call fcn.00416b62
mov eax, dword [ebp - 0x18]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.00404c40
mov ecx, dword [ebp - 0x18]
movzx edi, word [ecx + eax*2 - 2]
add edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add eax, edi
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
sete byte [ebp - 9]
mov dword [ebp - 0x24], 0x4e3c386
jmp 0x40dbf0
cmp eax, 0x1384b000
jg 0x40dcef
cmp eax, 0x4e3c386
jne 0x40dbf0
mov al, byte [ebp - 9]
test al, al
mov eax, 0xa88be785
jne 0x40dce7
mov eax, 0x9e897ddf
mov dword [ebp - 0x24], eax
jmp 0x40dbf0
cmp eax, 0x1384b001
je 0x40dd15
cmp eax, 0x26bd72a5
jne 0x40dd5a
mov eax, 0x911a3cc8
cmp dword [ebp - 0x10], 0
je 0x40dd0d
mov eax, 0x6285b626
mov dword [ebp - 0x24], eax
jmp 0x40dbf0
mov dword [esp], 0
call fcn.0040dd70
mov dword [esp], eax
call fcn.00416b62
mov eax, dword [ebp - 0x18]
movzx esi, word [eax]
mov dword [esp], eax
call fcn.00404c40
mov ecx, dword [ebp - 0x18]
movzx edi, word [ecx + eax*2 - 2]
neg edi
sub edi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
sub eax, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 0xaf284987
jmp 0x40dbf0
cmp eax, 0x264f0ad7
jne 0x40dbf0
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop esi
pop edi
pop ebp
ret
Function at 0x41eb8a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4c73e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041b9da
mov dword [ebp - 0x14], eax
cmp dword [0x4c8c7c], edi
jne 0x41ec7b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x41ec08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41ed5b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x41ed5b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41ed5b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4c8c7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4c8c80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4c8c84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c8c8c], eax
test eax, eax
je 0x41ec78
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4c8c88], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41eca0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41ec93
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x41ecb5
push 4
pop eax
jmp 0x41ed5d
cmp dword [ebp - 0x14], edi
je 0x41ecb5
push dword [0x4c8c7c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41ec9a
mov eax, dword [0x4c8c88]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x41ed13
cmp dword [0x4c8c8c], esi
je 0x41ed13
push eax
call ebx
push dword [0x4c8c8c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41ed13
test eax, eax
je 0x41ed13
call ecx
test eax, eax
je 0x41ed08
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41ed08
test byte [ebp - 8], 1
jne 0x41ed13
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x41ed43
mov eax, dword [0x4c8c80]
cmp eax, esi
je 0x41ed40
push eax
call ebx
test eax, eax
je 0x41ed40
call eax
mov edi, eax
test edi, edi
je 0x41ed40
mov eax, dword [0x4c8c84]
cmp eax, esi
je 0x41ed40
push eax
call ebx
test eax, eax
je 0x41ed40
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4c8c7c]
call ebx
test eax, eax
je 0x41ed5b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x41ed5d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418ae9
leave
ret
Function at 0x1313130
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x1313140
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea esi, [esi + eax*2]
lea edi, [edi + eax*2]
cmp eax, 1
jne 0x1313150
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1313710
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x228
mov eax, dword [0x15316ec]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x22c]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 4]
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
mov ecx, dword [edi]
or edx, 0x2001f
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.013136a0
mov ebp, eax
cmp ebp, esi
je 0x1313774
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x131376d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
jmp 0x131380d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
push esi
push esi
push esi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push esi
push edx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
jne 0x13137da
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.01313710
mov ebp, eax
cmp ebp, esi
jne 0x131375e
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x18]
push esi
push esi
push esi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x44]
push eax
push esi
push ecx
mov dword [esp + 0x40], 0x100
call ebx
test eax, eax
je 0x13137a0
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x13137ef
push eax
call ebp
mov dword [esp + 0x14], esi
mov ebx, dword [esp + 0x24]
mov eax, edi
mov dword [esp + 0x18], esi
call fcn.01313890
mov edi, eax
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x131380b
push eax
call ebp
mov eax, edi
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.01458a41
add esp, 0x228
ret 4
Function at 0x13143e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x14c2ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x15316ec]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x410]
mov ebx, dword [ebp + 0x414]
xor esi, esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp], esi
push 2
push esi
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x1c], edi
cmp edi, esi
jne 0x131445f
call fcn.01312970
mov esi, eax
jmp 0x1314554
mov eax, dword [ebp - 0x14]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
cmp ebx, esi
jne 0x131447b
call fcn.01312970
jmp 0x131454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp eax, esi
jne 0x1314494
call fcn.01312970
jmp 0x131454b
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
mov dword [ebp - 0x14], ebx
cmp eax, ebx
jae 0x13144b2
mov esi, 0x8007000e
jmp 0x131454d
xor ecx, ecx
shld ecx, eax, 1
add eax, eax
mov byte [ebp - 4], 2
cmp ecx, esi
ja 0x13144c7
cmp eax, 0xffffffff
jbe 0x13144d1
push 0x80070216
call fcn.01314db0
cmp eax, 0x400
jbe 0x13144fa
lea ecx, [ebp]
push ecx
call fcn.01313110
jmp 0x1314500
lea edx, [ebp + 4]
mov dword [ebp], edx
mov dword [ebp - 4], 1
mov eax, dword [ebp]
cmp eax, esi
jne 0x1314515
mov esi, 0x8007000e
jmp 0x131454d
push ebx
push eax
mov eax, dword [ebp - 0x18]
push ebx
push eax
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, esi
jne 0x1314530
call fcn.01312970
jmp 0x131454b
mov edx, dword [ebp]
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea esi, [ebp - 0x24]
call fcn.01314250
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x1314564
lea eax, [ebp]
call fcn.013130f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.01458a41
lea esp, [ebp + 0x408]
pop ebp
ret 0xc