joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a984
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417c6c]
call fcn.00404b34
xor eax, eax
push ebp
push 0x46aac8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49d008], 0
jne 0x46a9d7
mov ecx, dword [0x49e194]
mov dl, 1
mov eax, dword [0x4076d0]
call fcn.0040c148
call fcn.00403bb0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402e14
mov eax, ebx
call fcn.00404a04
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x46aad8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405c30
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404a14
test eax, eax
jle 0x46aa6f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x46aa68
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404418
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404400
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408680
test eax, eax
jne 0x46aa68
mov ebx, 0x15
jmp 0x46aa74
mov ebx, 0x10
jmp 0x46aa74
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x49d008]
call fcn.0046a8dc
mov eax, dword [ebp - 8]
call fcn.0046a8dc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405c48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46aacf
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004041b4
lea eax, [ebp - 0x10]
mov edx, dword [0x417c6c]
call fcn.00404c04
ret

Function at 0x46e2a4
Capabilities:
Hide graphical window

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
mov eax, ebx
call fcn.0046dd44
test byte [ebx + 0x23d], 4
jne 0x46e339
mov edx, esp
mov eax, ebx
call fcn.004469e8
push esp
mov eax, ebx
call fcn.0044d664
push eax
push 0
mov eax, ebx
test eax, eax
je 0x46e2d9
sub eax, 0xfffffd9c
push eax
push 0
push 0xfffffffffffffffb
mov eax, dword [ebx + 0x218]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebx + 0x22c], 0
jne 0x46e30a
mov ecx, dword [0x49e3b8]
mov dl, 1
mov eax, dword [0x46a59c]
call fcn.0040c148
call fcn.00403bb0
mov eax, ebx
call fcn.0046e878
cmp byte [ebx + 0x57], 0
jne 0x46e340
mov eax, ebx
call fcn.0044d868
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46e340
push 0
mov eax, ebx
call fcn.0044d868
push eax
call sub.user32.dll_ShowWindow
jmp 0x46e340
mov eax, ebx
call fcn.0044a7e8
add esp, 0x10
pop ebx
ret
Function at 0x473110
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x473177
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
call sub.user32.dll_GetWindowTextLengthA
mov ebx, eax
lea edi, [ebx + 1]
mov edx, edi
lea eax, [ebp - 8]
call fcn.004047dc
push edi
mov eax, dword [ebp - 8]
call fcn.00404650
push eax
push esi
call sub.user32.dll_GetWindowTextA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004041e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47317e
lea eax, [ebp - 8]
call fcn.00404190
ret

Function at 0x477ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
push 0x40
push 0x1000
push pe_nt_image_headers32
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x477b3a
xor edx, edx
push ebp
push 0x477b1b
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov dword [eax], 0x448b5050
mov dword [eax + 4], 0x44890824
mov dword [eax + 8], 0x58b0424
lea edx, [ebx + 4]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], 0x8244489
mov dword [eax + 0x14], 0x25ff9058
mov dword [eax + 0x18], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x477b3a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x47b9ec
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47ba1a
mov eax, ebx
call fcn.0047c4a0
cmp dword [ebx + 0x40], 0
je 0x47ba13
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47ba8b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47ba7d
cmp dword [ebx + 8], 0
je 0x47ba3c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47ba4e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47ba7d
cmp dword [ebx + 8], 0
je 0x47ba2f
cmp eax, 3
je 0x47ba61
dec eax
jne 0x47ba2f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47ba2f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47ba2f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47baa9
cmp dword [ebx + 0x14], 0xcc
je 0x47baa9
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047bab4
pop ebx
ret
Function at 0x48c2e4
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404640
mov eax, dword [ebp - 8]
call fcn.00404640
mov eax, dword [ebp - 0xc]
call fcn.00404640
xor eax, eax
push ebp
push 0x48c413
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00404650
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 3
mov eax, dword [ebp - 0xc]
call fcn.00404650
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
call fcn.00430c48
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404650
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48c3f8
xor eax, eax
push ebp
push 0x48c3f1
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
push 0
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x48c3d1
push 0
push 0
push 0x25
push 0
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x48c3d5
xor eax, eax
jmp 0x48c3d7
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c3f8
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c41a
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041b4
ret
Function at 0x48c424
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404640
mov eax, dword [ebp - 8]
call fcn.00404640
mov eax, dword [ebp - 0xc]
call fcn.00404640
mov eax, dword [ebp + 0xc]
call fcn.00404640
xor eax, eax
push ebp
push 0x48c58e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov ebx, 0x14
mov dword [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x40], 2
mov eax, dword [ebp - 8]
call fcn.00404650
mov esi, eax
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x34], 3
mov eax, 0x48c5a0
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 4]
call fcn.00404650
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x48c56b
xor edx, edx
push ebp
push 0x48c564
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 3
mov eax, dword [ebp + 0xc]
call fcn.00404650
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404650
push eax
mov ax, word [ebp + 8]
push eax
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetConnectA
test eax, eax
je 0x48c54d
push ebx
lea eax, [ebp - 0x28]
push eax
push 0x4b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x48c544
push 0
push 0
push 0x25
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetSetOptionA
test eax, eax
jne 0x48c548
xor eax, eax
jmp 0x48c54a
mov al, 1
mov byte [ebp - 0xd], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c56b
mov eax, dword [ebp - 0x14]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c595
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041b4
lea eax, [ebp + 0xc]
call fcn.00404190
ret
Function at 0x48c5a8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov byte [ebp - 1], 0
mov ebx, 0x14
mov dword [ebp - 0x1c], 0x14
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x34], 2
mov eax, 0x48c670
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 3
mov eax, 0x48c674
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 1
push 0x48c670
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x48c667
xor eax, eax
push ebp
push 0x48c660
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4b
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
push 0
push 0
push 0x25
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetSetOptionA
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c667
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48c8e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48caf4
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 0x105
mov eax, dword [ebp - 0x18]
call fcn.00402800
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48c95e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
je 0x48c948
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.00404388
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48c965
mov eax, dword [ebp - 8]
call fcn.00402820
ret

Function at 0x48dec0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov bl, 2
lea eax, [ebp - 0xa]
xor ecx, ecx
mov edx, 0xa
call fcn.00402e14
push 0xa
lea eax, [ebp - 0xa]
push eax
push 0xd
push 0x400
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
je 0x48defa
cmp byte [ebp - 0xa], 0x31
jne 0x48def8
mov bl, 1
jmp 0x48defa
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f620
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0044db6c
test al, al
je 0x48f6de
mov byte [ebp - 9], 0
xor ebx, ebx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 8], eax
jmp 0x48f6bc
cmp word [esi + 0x5f2], 0
je 0x48f671
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 9]
push eax
mov ecx, dword [ebp - 8]
mov edx, esi
mov eax, dword [esi + 0x5f4]
call dword [esi + 0x5f0]
mov al, byte [esi + 0x5e8]
or al, byte [ebp - 9]
jne 0x48f693
cmp dword [ebp - 4], 0
jbe 0x48f68f
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
ja 0x48f693
xor ebx, ebx
jmp 0x48f695
mov bl, 1
test bl, bl
jne 0x48f6de
mov eax, dword [0x49e4d4]
mov eax, dword [eax]
cmp byte [eax + 0x9c], 0
jne 0x48f6de
mov eax, dword [0x49e4d4]
mov eax, dword [eax]
call fcn.00466e78
push 1
call sub.kernel32.dll_Sleep_1
test esi, esi
je 0x48f6de
cmp byte [esi + 0x588], 0
jne 0x48f6de
mov edx, 0xfffffdf3
mov eax, esi
call fcn.0046e6b0
cmp eax, 4
jne 0x48f64e
mov byte [esi + 0x5e8], 0
test bl, bl
sete al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49918c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x499253
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov ecx, 0x49926c
mov edx, 0x49927c
mov eax, 0x499288
call fcn.00434160
push 0
push 0
push 0xe
push esi
call sub.user32.dll_SendMessageA
mov ebx, eax
inc ebx
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004047dc
lea eax, [ebp - 4]
call fcn.004046a8
push eax
push ebx
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea ecx, [ebp - 0xc]
mov edx, 9
mov eax, 0x4992b8
call fcn.004341fc
mov eax, dword [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
mov edx, 2
mov eax, 0x4992e8
call fcn.004341fc
mov edx, dword [ebp - 0x10]
pop eax
call fcn.0040459c
jne 0x49922e
lea edx, [ebp - 0x14]
mov eax, 0x4992f8
call fcn.004084a0
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.004041e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49925a
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004041b4
ret
Function at 0x499300
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x499308
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404640
xor eax, eax
push ebp
push 0x499471
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x499488
mov eax, 0x4994b8
call fcn.0040cdb8
mov eax, edi
call fcn.00404190
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404650
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x49944e
mov eax, ebx
call fcn.00402800
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4994e8
mov edx, 0x4994f8
mov eax, 0x499504
call fcn.00434160
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.00404650
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x49952c
push esi
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.004088fc
push dword [ebp - 0x18]
push 0x499538
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x1c]
call fcn.004088fc
push dword [ebp - 0x1c]
push 0x499538
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
shr eax, 0x10
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.004088fc
push dword [ebp - 0x20]
push 0x499538
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
and eax, 0xffff
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004088fc
push dword [ebp - 0x24]
mov eax, edi
mov edx, 7
call fcn.00404510
push 0x4015
push 0x9e1b8800
push 0
call fcn.0042b8ac
cmp eax, 0xc8c2ac
jne 0x499447
mov eax, 0x499544
call fcn.00430c48
mov eax, esi
call fcn.00402820
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x499478
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004041b4
lea eax, [ebp - 4]
call fcn.00404190
ret
Function at 0x425685
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e6cf
and dword [ebp - 4], 0
cmp dword [0x4501f0], 0
mov ebx, eax
jne 0x425736
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4257e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4257e7
push eax
call fcn.0041e65d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4501f0], eax
call esi
push eax
call fcn.0041e65d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4501f4], eax
call esi
push eax
call fcn.0041e65d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4501f8], eax
call esi
push eax
call fcn.0041e65d
pop ecx
mov dword [0x450200], eax
test eax, eax
je 0x425736
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e65d
pop ecx
mov dword [0x4501fc], eax
mov eax, dword [0x4501fc]
cmp eax, ebx
je 0x42578e
cmp dword [0x450200], ebx
je 0x42578e
push eax
call fcn.0041e6d8
push dword [0x450200]
mov esi, eax
call fcn.0041e6d8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42578e
test edi, edi
je 0x42578e
call esi
test eax, eax
je 0x425785
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425785
test byte [ebp - 0xc], 1
jne 0x42578e
or dword [ebp + 0x10], 0x200000
jmp 0x4257c7
mov eax, dword [0x4501f4]
cmp eax, ebx
je 0x4257c7
push eax
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4257c7
mov eax, dword [0x4501f8]
cmp eax, ebx
je 0x4257c7
push eax
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4501f0]
call fcn.0041e6d8
pop ecx
test eax, eax
je 0x4257e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4257e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x763700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0076378f
jae 0x76370e
xor ecx, ecx
call fcn.0076378f
jae 0x76373d
xor eax, eax
call fcn.0076378f
jae 0x76374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0076378f
adc al, al
jae 0x76372f
jne 0x763779
stosb byte es:[edi], al
jmp 0x763711
call fcn.0076379b
sub ecx, ebx
jne 0x763756
call fcn.00763799
jmp 0x763775
lodsb al, byte [esi]
shr eax, 1
je 0x763783
adc ecx, ecx
jmp 0x763772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00763799
cmp eax, 0x7d00
jae 0x763772
cmp ah, 5
jae 0x763773
cmp eax, 0x7f
ja 0x763774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x763711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10001860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1008b548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push 0x1006c5a0
push eax
lea eax, [ebp - 0x28]
xor esi, esi
push eax
call fcn.1003b42d
add esp, 0xc
test eax, eax
jne 0x100018c8
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push 0x20
push 1
push eax
call fcn.1003b736
add esp, 0x10
cmp eax, 0x20
jne 0x100018bf
push 8
lea eax, [ebp - 0x24]
push str.QHDIFF01
push eax
call fcn.10037c04
add esp, 0xc
test eax, eax
push 2
pop ecx
cmove esi, ecx
push dword [ebp - 0x28]
call fcn.1003b4ea
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1002f237
leave
ret
Function at 0x10002ce5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
test edi, edi
je 0x10002cf6
mov dword [edi], ecx
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10002e42
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x13c4], ecx
test eax, eax
je 0x10002e42
mov ebx, dword [ebp + 0x14]
test ebx, ebx
js 0x10002e42
cmp byte [esi + 0x1390], cl
je 0x10002d38
test edi, edi
je 0x10002d2c
or dword [edi], 0xffffffff
or dword [esi + 0x13c4], 0xffffffff
jmp 0x10002e55
test ebx, ebx
jne 0x10002d4d
test edi, edi
je 0x10002d42
mov dword [edi], ecx
mov dword [esi + 0x13c4], ecx
jmp 0x10002e55
mov dword [esi + 0x13a8], ebx
mov dword [esi + 0x13a4], eax
jmp 0x10002df1
cmp dword [esi + 0x1398], 0
jne 0x10002dae
push dword [esi]
call fcn.10001f41
pop ecx
test al, al
jne 0x10002dae
push dword [esi]
lea eax, [esi + 4]
push 0x1388
push 1
push eax
call fcn.1003b736
push dword [esi]
mov dword [ebp + 8], eax
call fcn.1003c7b1
add esp, 0x14
test eax, eax
jne 0x10002e01
mov eax, dword [ebp + 8]
mov dword [esi + 0x138c], eax
mov dword [esi + 0x1398], eax
lea eax, [esi + 4]
mov dword [esi + 0x1394], eax
lea eax, [esi + 0x1394]
push eax
call fcn.10002ade
test eax, eax
jne 0x10002e25
push dword [esi]
call fcn.10001f41
pop ecx
test al, al
je 0x10002de7
xor eax, eax
cmp dword [esi + 0x1398], eax
jne 0x10002de9
cmp dword [esi + 0x13a8], eax
jbe 0x10002de9
push 0xfffffffffffffff9
pop eax
test edi, edi
je 0x10002e4f
mov dword [edi], eax
jmp 0x10002e4f
xor eax, eax
cmp dword [esi + 0x13a8], eax
je 0x10002e17
push dword [esi]
call fcn.1003c7b1
pop ecx
test eax, eax
je 0x10002d5e
test edi, edi
je 0x10002e0b
mov dword [edi], 0xfffffffa
mov dword [esi + 0x13c4], 0xfffffffa
jmp 0x10002e55
test edi, edi
je 0x10002e1d
mov dword [edi], eax
mov dword [esi + 0x13c4], eax
jmp 0x10002e3e
push 4
pop ecx
cmp eax, ecx
jne 0x10002ddf
test edi, edi
je 0x10002e32
mov dword [edi], ecx
sub ebx, dword [esi + 0x13a8]
mov dword [esi + 0x13c4], ecx
mov eax, ebx
jmp 0x10002e57
push 0xfffffffffffffffe
pop eax
test edi, edi
je 0x10002e4b
mov dword [edi], eax
test esi, esi
je 0x10002e55
mov dword [esi + 0x13c4], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x10007387
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x100073b0
movsx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x1008acb0]
inc esi
sub edx, 1
jne 0x10007398
not ecx
mov eax, ecx
pop esi
pop ebp
ret