joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480860
Capabilities:
Encode data using xor

Disassembly:
cmc
sbb dword [esi - 0x30], 0xc1f5e224
jno 0x4808c9
stosd dword es:[edi], eax
fmul qword [ebx - 0x7bc28afc]
lea esp, [eax]
pop esi
cmpsd dword ss:[esi], dword es:[edi]
and eax, 0xa9d3c5e6
invalid
jg 0x480948
leave
into
adc al, 0x1f
lahf
movsd dword es:[edi], dword [esi]
jnp 0x480941
xchg ebx, eax
aas
sub eax, 0x35aa0ead
sahf
jb 0x480877
in eax, dx
sbb byte [ecx], bh
jnp 0x480907
dec eax
add byte [eax + 0xc], 0x62
in al, 0xcf
pop ds
xchg ebx, eax
xchg ecx, eax
aad 0xa0
xor dword [ebp + 0x40717351], esi
inc ecx
xor byte [ecx], ah
inc eax
shl dword [eax - 0x5f2e0d6a], 1
push esp
das
pop ss
inc esi
insd dword es:[edi], dx
adc dword [eax], esi
hlt
xor ah, dh
xor dl, cl
xchg edi, eax
xor esp, 0xffffffb5
iretd
push ebx
adc byte [eax + 0x46], 0x6b
scasd eax, dword es:[edi]
invalid
loopne 0x480963
sub eax, dword [eax]
fsubr qword [esi - 0x52]
push eax
insb byte es:[edi], dx
xor dword [ebx + 0x5d7fb15f], ecx
pop ebp
test eax, 0x9ddea756
sub al, 0x5b
push ecx
jno 0x480939
ja 0x48092e
pushal
popal
add al, 0x22
xchg ecx, eax
xchg ecx, eax
sbb dh, dl
lodsb al, byte [esi]
and dh, cl
xchg esi, eax
add al, 0x4f
dec edi
jae 0x4809ab
jno 0x480963
les edx, [ecx - 0x77547c80]
fst qword [eax + 0x2d02b1c0]
sbb byte [edi], 0x58
dec ebp
push es
fisttp word [esi + 0x1c97ae05]
add eax, 0x88db3eda
push 0x20
lahf
dec esi
xchg edi, eax
sbb al, 5
fidivr dword [esi]
fisttp dword [eax + 0x4e9f206a]
jbe 0x4809ad
or al, 5
retf 0xa9e9
xchg ebp, eax
jp 0x48097d
iretd
pop edi
xlatb
stosd dword es:[edi], eax
and eax, 0xd07207fb
push ecx
xchg cl, bh
pop es
push ds
and eax, 0xdaca954e
jmp 0xa99f93bd

Function at 0x484a0b
Capabilities:
Encode data using xor

Disassembly:
iretd
clc
push eax
jl 0x4849ee
lodsd eax, dword [esi]
scasb al, byte es:[edi]
imul edi, esp, 0x69
xchg dword [ebx], ebp
invalid
mov ah, 0x81
outsd dx, dword [esi]
sbb al, 0x7e
shr byte [0x8cbab11d], cl
jle 0x484993
sub eax, 0x8cbab11d
sbb byte [ecx + 0x2d], dh
mov ebx, 0xc249c730
mov esp, 0x1ec7c2f2
into
sti
scasd eax, dword es:[edi]
test al, 0x2d
jo 0x4849aa
out dx, eax
inc edx
shl dword [ebx - 0x67], 0x27
imul eax, dword [eax - 0x6d], 0xfffffffe
sal eax, cl
xchg byte [edi - 0x10aad361], dl
xor esi, ebx
stc
inc edx
fisttp word [esi + 0x3ac8b528]
mov dh, 3
sbb ch, bl
sbb ecx, dword [ebx + 0x488a2f95]
pop ebp
jge 0x4849bf
iretd
loope 0x4849ba
test byte [ebp + 0x57], ch
salc
pop ds
xor eax, dword [edx + 0x59af7dfc]
adc dword [ecx + 0x62], esp
adc dword fs:[eax + edi*2 - 0x80], edx
adc ecx, ebp
outsd dx, dword [esi]
sub dword [ebp - 0x112eb124], 0x4d4c355d
cmp cl, dh
movsb byte es:[edi], byte [esi]
cwde
pushal
xor eax, 0xac3398c9
dec esp
cli
loope 0x484a21
jmp 0xdcf5cb95
push esp
adc eax, 0x3da4720b
loope 0x484a78
leave
into
inc esp
xchg edx, eax
xor esp, 0x15c115a3
mov dword [ebx], ebx
push eax
sbb byte [edi + edx*4 + 0x7a4120a8], dl
mov edi, 0x7d7e3789
xchg edi, eax
push ebx
fidiv word [edx + 0x395627b9]
outsd dx, dword [esi]
lea ebp, [edx + 0x1f850fdc]
fmul qword [edi]
test dword [edi], ebx
or dword [0x31355830], esi
Function at 0x49dec2
Capabilities:
Encode data using xor

Disassembly:
popfd
pop es
cmp eax, 0xfd1ca3b1
invalid
mov edi, dword [ebp - 0x68]
or eax, 0x46fe09c9
push edi
adc byte [ebp + 0x35f8286a], dh
imul ebp, ebx, 0x54
loopne 0x49de89
adc ecx, dword [ecx]
sbb dword [0xc40f6189], 0x6f
mov dword [ecx - 0x46cfde53], ecx
pop eax
mov bl, 0xd1
sbb ebp, dword [edx - 0x3b54d0c6]
ret 0xd17e
jne 0x49de49
xor al, 0x7d
xchg ebp, eax
pop edi
stc
pop eax
hlt
sal dword [esi], 0xb4
invalid
js 0x49de55
and dl, byte [ebx]
push ebx
dec edx
cwde
not byte [0x15802a35]
xor eax, 0x3260fd75
insd dword es:[edi], dx
test eax, 0xc2c111b7
rol edx, 0xaf
out dx, eax
xchg ebp, eax
inc eax
inc ebp
xor al, 0xe7
and edx, dword [eax - 0x653135de]
in al, dx
mov al, byte [0x2386c8b5]
scasb al, byte es:[edi]
mov esi, dword [esi - 0x7f]
lahf
loope 0x49df05
push edx
mov dword [0x2aaafdf5], eax
out 0xd7, al
jecxz 0x49de96
xor al, 0xeb
xor bh, byte [edx - 0x73]
outsd dx, dword [esi]
jl 0x49dee8
pop eax
in al, 0x5c
cmp dword [esi], ebx
jb 0x49deb9
cwde
cwde
rol byte [ebp + 0x15], 1
pop ebp
sub bl, cl
jmp 0x23764f2a
inc ebp
adc eax, 0xe9cb285d
jo 0x49df2f
and edi, dword [eax]
jbe 0x49defa
jno 0x49def8
cmpsd dword [esi], dword es:[edi]
sal byte [ebp + 0x4ac1654b], 0x5e
hlt
pop ds
sub dword [0x69b507c0], ebp
scasd eax, dword es:[edi]
pushfd
adc ch, byte [esi - 0x54]
add bl, byte [edi]
invalid
rol byte gs:[edi], 0xb5
imul ebp, dword [edi - 0x5391ed64], 0x7ac61f02
inc esp
loope 0x49df94
mov esp, 0x12b9e1a3
add byte [edi - 0x695b7003], bh
sbb ch, byte [ebp - 0x73]
mov cl, 0xd2
lodsb al, byte [esi]
inc ebp
inc ebp
insd dword es:[edi], dx
dec eax
xchg byte [eax + 4], bh
rcl byte [edi - 0x709538a5], cl
and ebp, ebx
mov dh, 0x51
into
cwde
push eax
ja 0x49df2c
retf 0x4bfe
push edx
shr byte [esp + ebp - 0x54], 1
pop eax
in al, 0xda
mov bh, 0x51
xchg edx, eax
cmp eax, 0xb4d42bbc
daa
and ecx, dword [edx - 0xa]
add dword [ebp + 0x46], ebx
enter 0x25b4, 0x78
or ebp, eax
cmp eax, 0x8ee553a6
or dword [ecx + 0x3fc49fa0], edi
daa
fcmovb st(0), st(0)
clc
push edx
lds ebp, [ecx + 0x1a]
pop esp
cvtps2pd xmm4, qword [ebx + 0x77e8688f]
xor al, 0x2c
insd dword es:[edi], dx
jl 0x49e043
cmc
div ecx
invalid
adc byte [edx], bl
push eax
jmp 0x49e0b9
aam 0x8f
mov ebp, 0xf8e00192
and al, al
mov cl, 0xe5
invalid

Function at 0x4ab17a
Capabilities:
Encode data using xor

Disassembly:
sahf
sub esi, dword [ecx + 0x6c82111e]
mov dl, 0x24
stosb byte es:[edi], al
mov ch, 0x53
push ebx
mov ebx, 0xde931a95
and ah, byte [ecx - 0x3a]
and dword [ebp + 0x360e308], ebx
xor ebp, eax
dec esi
arpl word [ecx + 0x3e], di
rcr dword [ebx + edx*2 - 0x7a], 1
dec esi
stosd dword es:[edi], eax
dec ebp
pop esp
jnp 0x4ab185
sahf
ljmp 0x13ef
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x401bd7
pop dword [ebp - 0x24]
mov eax, 0x401bd7
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xd91d8ef2
add dword [ebp - 0x34], 0x7534b659
mov dword [ebp - 0x30], 0x348fdb0d
add dword [ebp - 0x30], 0xfda37138
mov dword [ebp - 0x2c], 0x2275964e
sub dword [ebp - 0x2c], 0xd6295220
mov dword [ebp - 0x28], 0x3a52d7eb
sub dword [ebp - 0x28], 0x3a52d7eb
lea eax, [ebp - 0x34]
push eax
mov eax, 0x2e9a901a
add eax, 0xd1a5e046
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x55e9d9ee
add dword [ebp - 0x34], 0x1e888f68
mov dword [ebp - 0x30], 0xdfc91ae9
sub dword [ebp - 0x30], 0x9e5cb974
mov dword [ebp - 0x2c], 0xa4162c2
sub dword [ebp - 0x2c], 0xa6d1f656
mov dword [ebp - 0x28], 0xbaa1c5ee
add dword [ebp - 0x28], 0x455e3a12
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0xde3b0f4c
add eax, 0x220561b4
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x392cf
push 0
call eax
mov ecx, 0xa97eadfe
add ecx, 0x5681a469
mov esi, eax
mov edx, 0x410000
add edx, dword [ebp - 0x24]
mov edi, 0x45d8dafe
xor dword [ebp - 0x20], edx
mov ebx, dword [edx]
add dword [ebp - 4], 0xf2036f11
xor ebx, edi
mov dword [esi], ebx
add esi, 0x20aab6d9
add esi, 0xdf55492b
add edx, 4
loop 0x401ce8
add eax, 0xc3c13dc2
add eax, 0x3c3ffead
xor ebx, ebx
add ebx, eax
add eax, 0x6661100c
add eax, 0x999eeff9
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x1000bc8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000bc99
pop dword [ebp - 0x48]
mov eax, 0x1000bc99
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x38793
push 0
mov eax, 0x9e7925b0
sub eax, 0x8e7694a4
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x1c8367c8
add ecx, 0xe37cd780
mov ebx, eax
mov esi, 0x3778fe61
add esi, 0xd88b6d9f
add esi, dword [ebp - 0x48]
mov edi, 0x42a4828a
sub edi, 0x15adf911
add dword [ebp - 0x10], edi
mov edx, dword [esi]
sub dword [ebp - 0x38], edx
xor edx, edi
mov dword [ebp - 4], 0x28ecf4a0
mov dword [ebx], edx
add ebx, 0xbb4da596
add ebx, 0x44b25a6e
add esi, 0x31f146fa
sub esi, 0x31f146f6
loop 0x1000bcf3
add eax, 0xeff3
xor ebx, ebx
add ebx, eax
add eax, 0x780b0dd5
add eax, 0x87f4f230
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40107e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [0x42f6c8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x42f6cc]
xor esi, esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
call fcn.00401077
mov eax, dword [0x42f6d0]
add dword [ebp - 0xc], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x42f6d4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
jmp 0x4010ce
xor esi, esi
mov dword [ebp - 8], 2
add dword [ebp - 8], 3
mov eax, ebx
shl eax, 4
cmp dword [0x43e914], 0xc
mov dword [ebp - 4], eax
jne 0x4010f8
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x43e914]
cmp eax, 0xfa9
jne 0x401114
mov dword [0x43e910], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401133
push str.komovavukuniburubawumukoni
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x43e868], esi
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, ebx
add eax, ebx
shr edx, cl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [0x43e90c], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, edx
sub edi, eax
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov esi, edi
shr esi, cl
add eax, edi
mov dword [ebp - 0x18], eax
add esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
cmp dword [0x43e914], 0xb03
jne 0x4011ac
push str.ruyenemilimusibubigukexem
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
xor dword [ebp - 4], esi
sub ebx, dword [ebp - 4]
add dword [ebp - 0xc], 0x61c88647
dec dword [ebp - 0x1c]
jne 0x4010cc
mov eax, dword [ebp + 8]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ebx
pop ebx
leave
ret 4
Function at 0x4073c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e83c]
jne 0x4073ca
repz ret
jmp fcn.0040b7cf

Function at 0x40b1bd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405d57
and dword [ebp - 4], 0
cmp dword [0x433904], 0
mov ebx, eax
jne 0x40b26e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b31f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b31f
push eax
call fcn.00405ce5
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433904], eax
call esi
push eax
call fcn.00405ce5
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433908], eax
call esi
push eax
call fcn.00405ce5
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43390c], eax
call esi
push eax
call fcn.00405ce5
pop ecx
mov dword [0x433914], eax
test eax, eax
je 0x40b26e
push 0x42af18
push edi
call esi
push eax
call fcn.00405ce5
pop ecx
mov dword [0x433910], eax
mov eax, dword [0x433910]
cmp eax, ebx
je 0x40b2c6
cmp dword [0x433914], ebx
je 0x40b2c6
push eax
call fcn.00405d60
push dword [0x433914]
mov esi, eax
call fcn.00405d60
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b2c6
test edi, edi
je 0x40b2c6
call esi
test eax, eax
je 0x40b2bd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b2bd
test byte [ebp - 0xc], 1
jne 0x40b2c6
or dword [ebp + 0x10], 0x200000
jmp 0x40b2ff
mov eax, dword [0x433908]
cmp eax, ebx
je 0x40b2ff
push eax
call fcn.00405d60
pop ecx
test eax, eax
je 0x40b2ff
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2ff
mov eax, dword [0x43390c]
cmp eax, ebx
je 0x40b2ff
push eax
call fcn.00405d60
pop ecx
test eax, eax
je 0x40b2ff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433904]
call fcn.00405d60
pop ecx
test eax, eax
je 0x40b31f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b321
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401007
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4526f8]
push esi
mov esi, dword [ebx + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4526fc]
push edi
mov edi, dword [ebx]
xor edx, edx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0x34], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x452700]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x24], eax
mov eax, dword [0x452704]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, edi
shl eax, 4
cmp dword [0x46194c], 0xc
mov dword [ebp - 4], eax
jne 0x401085
push edx
lea eax, [ebp - 0x38]
push eax
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [0x46194c]
cmp eax, 0xfa9
jne 0x4010a1
mov dword [0x461948], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010c2
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AreAllAccessesGranted]
and dword [0x4618a0], 0
xor edx, edx
mov eax, dword [ebp - 8]
add eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [0x461944], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0x1c], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0xc]
sub edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x34]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x401059
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x408c88
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x451f30]
jne 0x408c92
repz ret
jmp fcn.0040cc04

Function at 0x409f03
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402a0e
and dword [ebp - 4], 0
cmp dword [0x456940], 0
mov ebx, eax
jne 0x409fb4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a065
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a065
push eax
call fcn.0040299c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x456940], eax
call esi
push eax
call fcn.0040299c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x456944], eax
call esi
push eax
call fcn.0040299c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x456948], eax
call esi
push eax
call fcn.0040299c
pop ecx
mov dword [0x456950], eax
test eax, eax
je 0x409fb4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040299c
pop ecx
mov dword [0x45694c], eax
mov eax, dword [0x45694c]
cmp eax, ebx
je 0x40a00c
cmp dword [0x456950], ebx
je 0x40a00c
push eax
call fcn.00402a17
push dword [0x456950]
mov esi, eax
call fcn.00402a17
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a00c
test edi, edi
je 0x40a00c
call esi
test eax, eax
je 0x40a003
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a003
test byte [ebp - 0xc], 1
jne 0x40a00c
or dword [ebp + 0x10], 0x200000
jmp 0x40a045
mov eax, dword [0x456944]
cmp eax, ebx
je 0x40a045
push eax
call fcn.00402a17
pop ecx
test eax, eax
je 0x40a045
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a045
mov eax, dword [0x456948]
cmp eax, ebx
je 0x40a045
push eax
call fcn.00402a17
pop ecx
test eax, eax
je 0x40a045
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x456940]
call fcn.00402a17
pop ecx
test eax, eax
je 0x40a065
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a067
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401d18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x401dba
push 9
push str.ERROR_
push dword [0x40923e]
call sym._Top002B
mov edi, dword [0x40923e]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [ebp + 8]
call fcn.004028ab
cmp dword [0x408cde], 0
je 0x401d93
push 0xa
push str._IN_LINE
push dword [0x40923e]
call fcn.0040264d
mov edi, dword [0x40923e]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x408cde]
call fcn.004028ab
push 3
push 0x408090
push dword [0x40923e]
call fcn.0040264d
push pe_overlay
push dword [ebp + 0xc]
push dword [0x40923e]
call fcn.0040264d
jmp 0x401dcd
push pe_overlay
push dword [ebp + 0xc]
push dword [0x40923e]
call sym._Top002B
push 0x15
push str.ERROR
push dword [0x40923e]
push 0
call sub.USER32.dll_MessageBoxA
cmp eax, 2
jne 0x401df0
mov esi, 0x408cf0
jmp 0x4069ac
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x401df7
Capabilities:
Write file on windows

Disassembly:
push eax
push ebx
push edi
pushfd
mov ebx, dword [0x40b24e]
cmp ebx, 0x200
jae 0x401e47
mov edi, dword [0x40923e]
mov dword [ebx*4 + 0x40924e], edi
add ebx, 1
mov dword [0x40b24e], ebx
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
mov eax, pe_overlay
sub eax, ecx
test eax, 1
je 0x401e39
add eax, 1
add eax, dword [0x40923e]
cmp eax, dword [0x40b252]
jl 0x401e9a
popfd
push 0x37
push str.PASPLUS_RUNTIME_ERROR:_STRING_MEMORY_OVERFLOW_IN_LINE
push dword [0x40923e]
call sym._Top002B
mov edi, dword [0x40923e]
sub eax, eax
mov ecx, pe_overlay
repne scasb al, byte es:[edi]
sub edi, 1
push edi
push 0
push 0xa
push dword [0x408cde]
call fcn.004028ab
push 0x10
push str.ERROR
push dword [0x40923e]
push 0
call sub.USER32.dll_MessageBoxA
mov esi, 0x408cf0
jmp 0x4069ac
mov dword [0x40923e], eax
popfd
pop edi
pop ebx
pop eax
ret
push eax
push esi
push dword [0x408cd2]
call sub.KERNEL32.dll_GlobalFree
pop eax
sub eax, 0x408cf0
je 0x406a34
mov dword [0x408c60], eax
push ecx
push pe_overlay
push 0x4083d9
call fcn.00401000
push 0
push 0x408c68
push eax
push 0x4083d9
push dword [0x408c78]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x408c68]
push esi
mov esi, dword [0x408c60]
call fcn.004010fc
pop esi
push ecx
push pe_overlay
push 0x408c80
call fcn.00401000
push 0
push 0x408c68
push eax
push 0x408c80
push dword [0x408c78]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x408c68]
call sym.atof_ExpNoPlus
push dword [0x408b50]
call sub.KERNEL32.dll_GlobalFree
push dword [0x408710]
call sub.KERNEL32.dll_GlobalFree
pop eax
push eax
call sub.KERNEL32.dll_ExitProcess
int3

Function at 0x401fa9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
mov ebx, dword [ebp + 8]
sub edx, edx
call sub.KERNEL32.dll_GetCommandLineA
mov esi, eax
cmp dword [0x408cea], 0
jne 0x401fca
call fcn.00401f35
cmp ebx, dword [0x408cea]
jbe 0x401fdd
mov edi, dword [ebp + 0xc]
mov byte [edi], 0
jmp 0x402094
lodsb al, byte [esi]
Function at 0x402566
Capabilities:
Write file on windows

Disassembly:
push esi
push 0
push 0x408c68
push 2
push 0x408001

Function at 0x402a3b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov ebx, dword [ebp + 0xc]
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x402a54
lea ebx, [0x408ff8]
mov dword [ebp - 4], ebx
mov eax, 0
mov dword [ebp - 8], eax
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x402a68
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
mov dword [esi], 0
add esi, 4
mov dword [esi], 0
add byte [ebx + 0x458b04c6], al
invalid
mov dword [esi], eax

Function at 0x404640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.00401df7
mov dword [esi], 0
add esi, 4
push pe_overlay
push dword [ebp + 0xc]
push dword [0x40923e]
call sym._Top002B
mov cl, 0xdf
invalid
invalid
call fcn.00401df7
mov eax, 0xd
mov dword [esi], eax
mov ebx, dword [0x40923e]
movzx eax, byte [esi]
mov dword [ebx], eax
call fcn.00401ea4
push pe_overlay
push dword [0x409242]
push dword [0x40923e]
call fcn.0040264d
call fcn.00401df7
mov eax, 0xa
mov dword [esi], eax
mov ebx, dword [0x40923e]
movzx eax, byte [esi]
mov dword [ebx], eax
call fcn.00401ea4
push pe_overlay
push dword [0x409242]
push dword [0x40923e]
call fcn.0040264d
call fcn.00401df7
call fcn.00404436
push pe_overlay
push eax
push dword [0x40923e]
call sym._Top002B
call fcn.00401ea4
push pe_overlay
push dword [0x409242]
push dword [0x40923e]
call fcn.0040264d
mov ecx, dword [0x40923e]
mov dword [esi], ecx
push ecx
add esi, 4
add eax, 0x1000
add dword [0x40923e], eax
push pe_overlay
inc dword [eax]
add byte [eax - 0x17], ch
jno 0x40475e
add bh, bh
xor eax, 0x40923e

Function at 0x404eff
Capabilities:
Check for time delay via gettickcount
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
inc eax

Function at 0x4063de
Capabilities:
Write file on windows

Disassembly:
mov edi, 0x408cf0
mov ecx, 0x40b270
sub ecx, edi
sub ecx, 4
shr ecx, 2
sub eax, eax
rep stosd dword es:[edi], eax
push 0x20000
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x408710], eax
test eax, eax
jne 0x406428
call sub.KERNEL32.dll_GetLastError
mov dword [0x408c70], eax
push str.INITSTRINGS:_failed_to_allocate_memory_
call fcn.004018d4
push dword [0x408c70]
call sub.KERNEL32.dll_ExitProcess
mov ebx, eax
mov byte [ebx], 0
push 0x10000
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x408b50], eax
test eax, eax
jne 0x406461
call sub.KERNEL32.dll_GetLastError
mov dword [0x408c70], eax
push str.INITSTRINGS:_failed_to_allocate_memory_
call fcn.004018d4
push dword [0x408c70]
call sub.KERNEL32.dll_ExitProcess
mov ebx, eax
mov byte [ebx], 0
mov eax, 0xffffffff
sub eax, eax
mov al, 0
mov byte [0x408714], al
mov byte [0x408820], al