joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100ca30f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
add ebx, 0xe1f5
pop ebx
push esi
or esi, 0x24fe
xor esi, 0x11f
pop esi
push edi
push ecx
add esp, 4
xor edi, 0xad35
sub edi, 0x2d67
add edi, 0x96f8
pop edi
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
out dx, eax
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
fdiv st(5), st(0)
invalid
dec dword [ebx - 0xcdb7b]
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea edi, [eax - 0x74000011]
xchg ebp, eax
and al, 0xf3
invalid
inc dword [ebx - 0x6a76fd3e]
and al, 0xf3
invalid
jmp dword [esi - 0x75]
test dword [eax + 0x66ffffef], edi
mov dword [ebp - 0x40], eax
push edi
push edi
add esp, 4
xor edi, 0x1589a
call 0x100ca2fe
add byte [ecx + 0x4d], al
xor cl, byte [ebx + 0x4b]
xor eax, 0x4a393d33
add esp, 4
jmp 0x100ca308
pop edi
push esi
push edx
add esp, 4
add esi, 0x12bc2
mov dl, 0x2b
add dword [eax], eax
mov dl, 0x2b
add dword [eax], eax
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x100ca332
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x100ca38c
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x100ca25a
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x100ca25a
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x100ca376
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x100ca380
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x100ca3d5
push edi
push ecx
add esp, 4
xor edi, 0x137ae
or edi, 0x5e3d
sub edi, 0x15dca
pop edi
push esi
push edx
add esp, 4
add esi, 0x11102
jmp 0x100ca3c0
xor esi, 0x8932
pop esi
mov edx, dword [ebp - 0x51c]
push esi
push esi
add esp, 4
and esi, 0xddcf
and esi, 0x4d0b
jmp 0x100ca3eb
pop esi
push esi
push edx
add esp, 4
call 0x100ca3fd
add byte [esi + 0x34], al
aaa
aas
cmp al, 0x49
add esp, 4
xor esi, 0x15aad
pop esi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x100ca433
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
invalid
invalid
Function at 0x100ca3fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebx
add esp, 4
add ebx, 0xe1f5
pop ebx
push esi
or esi, 0x24fe
xor esi, 0x11f
pop esi
push edi
push ecx
add esp, 4
xor edi, 0xad35
sub edi, 0x2d67
add edi, 0x96f8
pop edi
mov edx, dword [ebp - 0xcd8]
mov ax, word [edx]
mov word [ebp - 0x1046], ax
mov ecx, dword [ebp - 0xcd8]
add ecx, 2
mov dword [ebp - 0xcd8], ecx
mov dx, word [ebp - 0x1046]
out dx, eax
invalid
jmp dword [esi - 0x77]
xchg ebp, eax
fdiv st(5), st(0)
invalid
dec dword [ebx - 0xcdb7b]
jmp dword [esi - 0x75]
or byte [esi - 0x77], ah
lea edi, [eax - 0x74000011]
xchg ebp, eax
and al, 0xf3
invalid
inc dword [ebx - 0x6a76fd3e]
and al, 0xf3
invalid
jmp dword [esi - 0x75]
test dword [eax + 0x66ffffef], edi
mov dword [ebp - 0x40], eax
push edi
push edi
add esp, 4
xor edi, 0x1589a
call 0x100ca2fe
add byte [ecx + 0x4d], al
xor cl, byte [ebx + 0x4b]
xor eax, 0x4a393d33
add esp, 4
jmp 0x100ca308
pop edi
push esi
push edx
add esp, 4
add esi, 0x12bc2
mov dl, 0x2b
add dword [eax], eax
mov dl, 0x2b
add dword [eax], eax
pop esi
movzx ecx, word [ebp - 0x40]
test ecx, ecx
jne 0x100ca332
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x1684], edx
jmp 0x100ca38c
movzx ecx, word [ebp - 0x224]
movzx edx, word [ebp - 0x40]
cmp ecx, edx
je 0x100ca25a
movzx eax, word [ebp - 0x224]
xor eax, 0x20
movzx ecx, word [ebp - 0x40]
cmp eax, ecx
je 0x100ca25a
movzx edx, word [ebp - 0x224]
movzx eax, word [ebp - 0x40]
cmp edx, eax
jge 0x100ca376
mov dword [ebp - 0x1680], 0xffffffff
jmp 0x100ca380
mov dword [ebp - 0x1680], 1
mov ecx, dword [ebp - 0x1680]
mov dword [ebp - 0x1684], ecx
cmp dword [ebp - 0x1684], 0
jne 0x100ca3d5
push edi
push ecx
add esp, 4
xor edi, 0x137ae
or edi, 0x5e3d
sub edi, 0x15dca
pop edi
push esi
push edx
add esp, 4
add esi, 0x11102
jmp 0x100ca3c0
xor esi, 0x8932
pop esi
mov edx, dword [ebp - 0x51c]
push esi
push esi
add esp, 4
and esi, 0xddcf
and esi, 0x4d0b
jmp 0x100ca3eb
pop esi
push esi
push edx
add esp, 4
call 0x100ca3fd
add byte [esi + 0x34], al
aaa
aas
cmp al, 0x49
add esp, 4
xor esi, 0x15aad
pop esi
mov eax, dword [ebp - 0x51c]
mov ecx, dword [eax]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ebp - 0xce0]
je 0x100ca433
mov eax, dword [ebp - 0x51c]
cmp dword [eax + 0x30], 0
invalid
invalid
Function at 0x4031b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4031bf
pop dword [ebp - 0x30]
mov eax, 0xf53d766c
add eax, 0xb02bb53
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xaa588c9d
sub dword [ebp - 0x40], 0x5c064752
mov dword [ebp - 0x3c], 0x404837b2
sub dword [ebp - 0x3c], 0xe14eb6d
mov dword [ebp - 0x38], 0x81d59937
add dword [ebp - 0x38], 0xca76aaf7
mov dword [ebp - 0x34], 0x63271efd
sub dword [ebp - 0x34], 0x63271efd
lea eax, [ebp - 0x40]
push eax
mov eax, 0x2e9b1df6
sub eax, 0x2e59ed66
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xfaa1bfa4
add dword [ebp - 0x40], 0x79d0a9b2
mov dword [ebp - 0x3c], 0x7b6964a6
add dword [ebp - 0x3c], 0xc602fccf
mov dword [ebp - 0x38], 0x409d63cf
sub dword [ebp - 0x38], 0xdd2df763
mov dword [ebp - 0x34], 0xc85c672e
add dword [ebp - 0x34], 0x37a398d2
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x4c92aa62
add eax, 0xb3ae85da
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3b6cd
push 0
call eax
mov ecx, 0x4b83
xor edx, edx
add edx, eax
mov edi, 0x41a000
add edi, dword [ebp - 0x30]
mov esi, 0x2d419797
add esi, 0xc50b9074
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0xcf291170
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x28], eax
add edx, 0xac4046e
add edx, 0xf53bfb96
add edi, 0x80fa6395
sub edi, 0x80fa6391
loop 0x4032d7
add eax, 0x67116e35
sub eax, 0x67104d56
mov ebx, eax
add eax, 0x3f7661d7
add eax, 0xc0899e2e
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x41e810
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422dab
mov eax, dword fs:[0]
push eax
mov eax, 0x123c
call fcn.0041fd70
mov eax, dword [0x42e07c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0x210]
push str.FN_CSharedMemoryChannel_GetMessage
push eax
call fcn.00401880
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x423484
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, edi
call fcn.0041e4b0
cmp eax, 0xfffe00ff
jne 0x41e8cc
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
mov ecx, edi
call fcn.0041e4b0
lea edx, [eax - 1]
cmp edx, 0xffe
ja 0x41e8b2
push eax
lea eax, [ebp - 0x1210]
mov ecx, edi
push eax
call fcn.0041e540
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041ecc2
mov esp, ebp
pop ebp
ret
push str.Invalid_Message_Header
lea ecx, [ebp - 0x1228]
call fcn.00402d30
lea eax, [ebp - 0x1228]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x1244]
call fcn.00401b80
push 0x42b38c
lea eax, [ebp - 0x1244]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x41f37b
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x42b2e0
call fcn.0041fa90
push 1
call fcn.0041f03d
pop ecx
test al, al
je 0x41f4d7
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041f00b
mov byte [ebp - 0x24], al
mov eax, dword [0x43222c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x41f4d7
test eax, eax
jne 0x41f405
mov dword [0x43222c], ecx
push 0x423340
push 0x42332c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41f3e8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41f4d1
push 0x423328
push 0x423314
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x43222c], 2
jmp 0x41f40a
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041f1aa
pop ecx
call fcn.0041fc0d
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x41f43b
push esi
call fcn.0041f120
pop ecx
test al, al
je 0x41f43b
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call dword [0x423310]
call esi
call fcn.0041fc13
mov esi, eax
cmp dword [esi], edi
je 0x41f459
push esi
call fcn.0041f120
pop ecx
test al, al
je 0x41f459
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.0041f819
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.0041f84f
test al, al
je 0x41f4de
test bl, bl
jne 0x41f487
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0041f1c7
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41f4d1
call fcn.0041fad6
ret
push 7
call fcn.0041f6fd
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.00572000
jmp 0x41f37b
Function at 0x401774
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401783
pop dword [ebp - 0x34]
mov eax, 0x401783
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0xbb9de9d
add dword [ebp - 0x44], 0x429866ae
mov dword [ebp - 0x40], 0x6ac6cda9
add dword [ebp - 0x40], 0xc76c7e9c
mov dword [ebp - 0x3c], 0xab427783
sub dword [ebp - 0x3c], 0x5ef63355
mov dword [ebp - 0x38], 0x8a65bac1
sub dword [ebp - 0x38], 0x8a65bac1
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x5be888aa
sub dword [ebp - 0x44], 0xe7761f54
mov dword [ebp - 0x40], 0xab6656ac
add dword [ebp - 0x40], 0x96060ac9
mov dword [ebp - 0x3c], 0xac1e5154
sub dword [ebp - 0x3c], 0x48aee4e8
mov dword [ebp - 0x38], 0xb1207946
sub dword [ebp - 0x38], 0xb1207946
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa761d804
add eax, 0x58de981c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b5ad
push 0
call eax
mov ecx, 0x9486b0d
sub ecx, 0x94814a3
xor edi, edi
add edi, eax
mov esi, 0xf38f4a1
add esi, 0xf107d35f
add esi, dword [ebp - 0x34]
mov ebx, 0x5a01938
add ebx, 0xce636d66
sub dword [ebp - 0xc], ecx
mov edx, dword [esi]
xor dword [ebp - 0x20], 0xeb9eb567
sub edx, ebx
mov dword [edi], edx
mov dword [ebp - 0x10], 0x54e9aaa5
add edi, 0x4abf4644
add edi, 0xb540b9c0
add esi, 4
loop 0x40189d
add eax, 0x14c7b
mov ebx, eax
add eax, 0xe07eaabf
sub eax, 0xe07eaaba
mov ecx, 0x92429400
sub ecx, 0x92029400
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4045f7
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x406af3
call fcn.004054fb
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x404616
mov al, 1
jmp 0x4046e2
test esi, esi
je 0x4046e0
xor ebx, ebx
cmp word [esi], bx
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4046e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x4046e0
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.00401774
pop ecx
pop ecx
mov esi, dword [0x40a010]
xor edi, edi
inc edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x4046d1
lea eax, [ebp - 0x28]
push eax
call fcn.00401774
pop ecx
test al, al
jne 0x4046d1
cmp dword [ebp - 0x18], esi
jbe 0x4046d1
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4046d1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x4046d1
push 0x4075c8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
movzx ebx, bl
pop ecx
pop ecx
cmovne ebx, edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.00401774
mov al, bl
jmp 0x4046e2
xor al, al
call fcn.004054b6
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b030]
jne 0x401116
repz ret
jmp fcn.00401b11

Function at 0x408edc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047d5
and dword [ebp - 4], 0
cmp dword [0x42d78c], 0
mov ebx, eax
jne 0x408f8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40903e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40903e
push eax
call fcn.00404763
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d78c], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d790], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d794], eax
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x42d79c], eax
test eax, eax
je 0x408f8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x42d798], eax
mov eax, dword [0x42d798]
cmp eax, ebx
je 0x408fe5
cmp dword [0x42d79c], ebx
je 0x408fe5
push eax
call fcn.004047de
push dword [0x42d79c]
mov esi, eax
call fcn.004047de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408fe5
test edi, edi
je 0x408fe5
call esi
test eax, eax
je 0x408fdc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408fdc
test byte [ebp - 0xc], 1
jne 0x408fe5
or dword [ebp + 0x10], 0x200000
jmp 0x40901e
mov eax, dword [0x42d790]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40901e
mov eax, dword [0x42d794]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d78c]
call fcn.004047de
pop ecx
test eax, eax
je 0x40903e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409040
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b0e0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x42b030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x82a82c]
push ebx
mov ebx, dword [0x82a54c]
push esi
mov esi, dword [0x42bf60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b121
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x82a82c]
mov dword [0x82a548], esi
cmp eax, 0x114e
jne 0x40b14b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.durinarusunavabaxomoyowev
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x82a82c]
cmp eax, 0x2f
jne 0x40b16d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040b050
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x430364bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4306c004]
jne 0x43065ea5
repz ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x4306c5f0], eax
mov dword [0x4306c5ec], ecx
mov dword [0x4306c5e8], edx
mov dword [0x4306c5e4], ebx
mov dword [0x4306c5e0], esi
mov dword [0x4306c5dc], edi
mov word [0x4306c608], ss
mov word [0x4306c5fc], cs
mov word [0x4306c5d8], ds
mov word [0x4306c5d4], es
mov word [0x4306c5d0], fs
mov word [0x4306c5cc], gs
pushfd
pop dword [0x4306c600]
mov eax, dword [ebp]
mov dword [0x4306c5f4], eax
mov eax, dword [ebp + 4]
mov dword [0x4306c5f8], eax
lea eax, [ebp + 8]
mov dword [0x4306c604], eax
mov eax, dword [ebp - 0x320]
mov dword [0x4306c540], 0x10001
mov eax, dword [0x4306c5f8]
mov dword [0x4306c4f4], eax
mov dword [0x4306c4e8], 0xc0000409
mov dword [0x4306c4ec], 1
mov eax, dword [0x4306c004]
mov dword [ebp - 0x328], eax
mov eax, dword [0x4306c218]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x4306c538], eax
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x43065fa8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x4306c538], 0
jne 0x43065f91
push 1
call sub.MSVCR100.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x43037cf3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4306c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
xor eax, eax
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xa
lea eax, [ebp - 0x18]
xor ebx, ebx
push eax
inc ebx
push 0x43037904
mov dword [0x4306c05c], ebx
call esi
push 4
pop edi
test eax, eax
jne 0x4303ff48
and dword [0x4306c058], 0
and dword [0x4306c054], 0
push 0xa
lea eax, [ebp - 0x18]
push eax
push 0x43037d70
call esi
test eax, eax
jne 0x4303ff8c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.430364bf
leave
ret
mov ecx, 0x430437fc
lea eax, [ebp - 0x18]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4303ff74
test dx, dx
je 0x4303ff70
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4303ff74
add eax, edi
add ecx, edi
test dx, dx
jne 0x4303ff50
xor eax, eax
jmp 0x4303ff79
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43037d3e
mov dword [0x4306c854], ebx
jmp 0x43037d3e
mov ecx, 0x43043800
lea eax, [ebp - 0x18]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4303ffb8
test dx, dx
je 0x4303ffb4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4303ffb8
add eax, edi
add ecx, edi
test dx, dx
jne 0x4303ff94
xor eax, eax
jmp 0x4303ffbd
sbb eax, eax
sbb eax, 0xffffffff
mov dword [0x4306c054], ebx
test eax, eax
jne 0x4303ffd2
and dword [0x4306c058], eax
jmp 0x43037d61
mov dword [0x4306c058], ebx
jmp 0x43037d61
Function at 0x4304c25f
Capabilities:
Hide graphical window

Disassembly:
cmp byte [edi + 0x30], 0
push esi
sete al
mov byte [edi + 0x30], al
lea esi, [edi + 4]
test al, al
je 0x4304c28c
push 5
push 0x1f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x2c]
jmp 0x4304c2a5
push 0
push 0x1f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0x28]
call fcn.4305499e
xor eax, eax
pop esi
ret

Function at 0x4304eb37
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x4306c86c], 0
jne 0x4304eb50
push 0x4304eb78
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x4306c86c], eax
cmp dword [0x4306c868], 0
jne 0x4304eb74
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4304eb9e
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x4306c868], eax
ret
Function at 0x43054cc6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x4306c004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x634], eax
xor edi, edi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x638], esi
cmp dword [0x4306c854], edi
je 0x43054f39
push ebx
push 0x1fe
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push edi
push eax
mov dword [ebp - 0x630], edi
call sub.MSVCR100.dll_memset
add esp, 0xc
push dword [esi + 0x50]
mov esi, 0x105
mov edx, SysReAllocString
mov eax, esi
lea ecx, [ebp - 0x210]
call fcn.4305499e
mov ebx, eax
cmp ebx, edi
jl 0x43054f20
push 0x43043804
lea edi, [ebp - 0x210]
call fcn.4305499e
mov ebx, eax
test ebx, ebx
js 0x43054f20
push 0x43043810
mov eax, edi
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x43054e5b
lea eax, [ebp - 0x41c]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
lea ecx, [eax - 1]
cmp ecx, 0x103
ja 0x43054f1b
xor ecx, ecx
mov word [ebp - 0x214], cx
cmp word [ebp + eax*2 - 0x41e], 0x5c
je 0x43054de0
push 0x5c
pop ecx
mov word [ebp + eax*2 - 0x41c], cx
inc eax
cmp eax, esi
jae 0x43054f1b
xor ecx, ecx
mov word [ebp + eax*2 - 0x41c], cx
lea eax, [ebp - 0x41c]
push eax
mov edx, SysReAllocString
mov eax, esi
lea ecx, [ebp - 0x210]
call fcn.4305499e
mov ebx, eax
test ebx, ebx
js 0x43054f20
mov eax, dword [ebp - 0x638]
push dword [eax + 0x48]
lea edi, [ebp - 0x210]
call fcn.4305499e
mov ebx, eax
test ebx, ebx
js 0x43054f20
push 0x43043804
call fcn.4305499e
mov ebx, eax
test ebx, ebx
js 0x43054f20
push 0x43043810
mov eax, edi
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x43054e5b
mov ebx, 0x80070005
jmp 0x43054f20
cmp dword [ebp - 0x630], 0
je 0x43054f36
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.kernel32.dll_GetLocalTime]
push 0x100
lea eax, [ebp - 0x61c]
push eax
push 0
lea eax, [ebp - 0x62c]
push eax
push SysReAllocString
push 0x800
call dword [sym.imp.kernel32.dll_GetTimeFormatW]
mov esi, dword [sym.imp.MSVCR100.dll_fwprintf]
test eax, eax
je 0x43054ebb
lea eax, [ebp - 0x61c]
push eax
push 0x43043818
push dword [ebp - 0x630]
call esi
add esp, 0xc
push 0x43043850
push dword [ebp - 0x630]
call esi
push dword [ebp - 0x640]
mov edi, 0x4304389c
push edi
push dword [ebp - 0x630]
call esi
push 0x430438a8
push dword [ebp - 0x630]
call esi
push dword [ebp - 0x63c]
push edi
push dword [ebp - 0x630]
call esi
push 0x430438f8
push dword [ebp - 0x630]
call esi
push dword [ebp - 0x634]
push edi
push dword [ebp - 0x630]
call esi
add esp, 0x3c
test eax, eax
jns 0x43054f20
mov ebx, 0x8000ffff
cmp dword [ebp - 0x630], 0
je 0x43054f36
push dword [ebp - 0x630]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.430364bf
leave
ret 0xc