joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c40
Capabilities:
Check for debugger via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40461d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401cb5
push str.NtDelayExecution
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x401cb5
mov dword [ebp - 0x20], 0xff5b3480
xor esi, esi
mov dword [ebp - 0x1c], 0xffffffff
nop dword [eax + eax]
lea eax, [ebp - 0x20]
push eax
push 0
call edi
test eax, eax
js 0x401cb5
inc esi
cmp esi, 0x4e20
jl 0x401ca0
push 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 4
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x1000
nop dword [eax]
mov byte [esi], 0
lea esi, [esi + 1]
sub eax, 1
jne 0x401ce0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [ebp - 0x14], 0
je 0x401d0c
mov eax, 1
jmp 0x401d66
push 0x4052f4
lea ecx, [ebp - 0x38]
call fcn.00402940
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 0
call fcn.00401600
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x401d64
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401d5a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401d5a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00403a38
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret
Function at 0x402680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4026b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4026ec
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4026ec
lea ecx, [edi - 1]
mov eax, ebx
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
pop edi
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4027c3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x402714
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402720
movsx eax, bl
jmp 0x402758
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x402782
sub eax, 1
je 0x402782
sub eax, 2
jne 0x4027c3
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmove ebx, ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4027a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x4027c3
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040368f
mov esp, ebp
pop ebp
ret 4
Function at 0x402b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x408040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x402c0c
cmp byte [esi + 0x3d], 0
je 0x402c0c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x402bfa
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x402bc1
sub eax, 1
je 0x402bc5
sub eax, 2
jne 0x402bfa
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402be3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x402bfa
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040368f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0040368f
mov esp, ebp
pop ebp
ret

Function at 0x4041a5
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4041e4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4041e4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4041e4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4041e4
cmp dword [ecx + 0x74], 0xe
jbe 0x4041e4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4036b8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4036f7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4036f7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4036f7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4036f7
cmp dword [ecx + 0x74], 0xe
jbe 0x4036f7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x18cb6ae8
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, str._3
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3dc92b2f
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x791e50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x791e5a
pushal
call 0x791e60
pop ebp
sub ebp, 0x10
sub ebp, 0x391e50
jmp 0x791e76
mov eax, 0x391e50
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c4
mov edx, 0x8ab17d8f
xor byte [eax], dl
inc eax
dec ecx
jne 0x791e8d
jmp 0x791ea0
add al, 0x42
add al, 6
mov bl, 0x8f
invalid
Function at 0x906058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90606a
add dl, dl
jne 0x906089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9060dc
xor eax, eax
add dl, dl
jne 0x906096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90617d
add dl, dl
jne 0x9060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x906075
mov eax, 1
add dl, dl
jne 0x9060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9060e1
sub eax, ebx
mov ebx, 1
jne 0x906128
mov ecx, 1
add dl, dl
jne 0x90610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x906119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906136
cmp eax, 0x7d00
jae 0x90616d
cmp eax, 0x500
jb 0x906168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
cmp eax, 0x7f
ja 0x906170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x906075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4013b2
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x34], edi
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41a318]
mov dword [ebp - 0x24], eax
mov eax, dword [0x41a31c]
mov dword [ebp - 0x2c], eax
call fcn.004013ab
mov esi, dword [ebp - 0x10]
mov ecx, dword [0x41a320]
add esi, 0x23f
mov eax, dword [0x41a324]
push 0x20
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], eax
pop edi
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov edx, dword [ebp - 0x14]
mov eax, edx
shl eax, 4
add eax, ecx
mov dword [ebp - 0x1c], 0xedeb2e40
cmp dword [0x484dc8], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x484dc4]
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp dword [0x484dc8], 0x3eb
mov dword [0x484dc4], eax
mov eax, dword [0x484850]
cmove eax, dword [ebp - 0x1c]
mov dword [0x484850], eax
lea eax, [esi + edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 8], eax
mov eax, ebx
mov dword [0x484dc0], 0xf4ea3dee
shl eax, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, ebx
shr eax, cl
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 0x1c]
cmp dword [0x484dc8], 0xb03
mov dword [ebp - 4], eax
jne 0x4014df
push str.Poh_pabatosipixalilasexamupopajohija_xopitotazucepewifodufalejilemi_karemabuzaniyuzavegusaribufate
push edx
push edx
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
add esi, 0x61c88647
mov dword [ebp - 0x10], esi
dec edi
jne 0x401404
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], ebx
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d337
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407aeb
mov dword [ebp - 0x14], eax
cmp dword [0x43f55c], esi
jne 0x40d42a
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d3b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d50a
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d50a
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d50a
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43f55c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43f560], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43f564], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43f56c], eax
test eax, eax
je 0x40d427
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43f568], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d44f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d442
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d464
push 4
pop eax
jmp 0x40d50c
cmp dword [ebp - 0x14], esi
je 0x40d464
push dword [0x43f55c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d449
mov eax, dword [0x43f568]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d4c2
cmp dword [0x43f56c], edi
je 0x40d4c2
push eax
call ebx
push dword [0x43f56c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d4c2
test eax, eax
je 0x40d4c2
call ecx
test eax, eax
je 0x40d4b7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d4b7
test byte [ebp - 8], 1
jne 0x40d4c2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4f2
mov eax, dword [0x43f560]
cmp eax, edi
je 0x40d4ef
push eax
call ebx
test eax, eax
je 0x40d4ef
call eax
mov esi, eax
test esi, esi
je 0x40d4ef
mov eax, dword [0x43f564]
cmp eax, edi
je 0x40d4ef
push eax
call ebx
test eax, eax
je 0x40d4ef
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43f55c]
call ebx
test eax, eax
je 0x40d50a
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d50c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404010
mov esp, ebp
pop ebp
ret
Function at 0x405680
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword [0x42f3dc]
mov ecx, 0x19
push ebx
push esi
push edi
push 0x42
push 0
push 0
push eax
push 0x54e
push 0x3a4
push 0
push 0
mov esi, 0x429a60
mov dword [0x42a750], 0
mov edi, 0x429ac8
mov dword [0x42a764], 0
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x42a75c], 0
mov dword [0x42a754], 0
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [0x42f3e4]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push ebx
push dword [0x42f3dc]
call edi
push 1
push 0
push 0
push 0
push dword [0x42f3dc]
mov esi, eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
push esi
push dword [0x42f3dc]
call edi
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
xor edx, edx
mov ecx, 0x429a60
call fcn.00405150
mov edi, dword [sym.imp.GDI32.dll_BitBlt]
mov esi, 0x10
nop word [eax + eax]
mov eax, dword [0x42f3dc]
push 0xcc0020
push 0x52d
push 0
push eax
push 0x11
push 0x3a4
push esi
push 0
push eax
call edi
add esi, 0x11
cmp esi, 0x52d
jl 0x405740
mov edx, 1
mov ecx, 0x429ac8
pop edi
pop esi
pop ebx
jmp fcn.00405150

Function at 0x405c30
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, ecx
test edi, edi
jne 0x405c5c
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x405c61
sub esi, ecx
mov dword [ebp - 8], esi
lea eax, [esi + 1]
push eax
call fcn.0040f92d
mov edx, eax
add esp, 4
mov dword [ebp - 4], edx
test edx, edx
je 0x405d51
xor ecx, ecx
test esi, esi
je 0x405d42
cmp esi, 0x10
jb 0x405d16
lea eax, [edi - 1]
add eax, esi
cmp edx, eax
ja 0x405cab
lea eax, [edx - 1]
add eax, esi
cmp eax, edi
jae 0x405d16
movaps xmm4, xmmword [0x4273f0]
mov eax, esi
movaps xmm5, xmmword [str._________________]
and eax, 0xfffffff0
mov esi, edi
mov dword [ebp - 0x10], eax
sub esi, edx
mov eax, edx
mov dword [ebp - 0xc], esi
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
movups xmm3, xmmword [edx + eax]
add ecx, 0x10
lea eax, [eax + 0x10]
movups xmm0, xmmword [eax - 0x10]
movaps xmm2, xmm3
pcmpeqb xmm2, xmm5
movaps xmm1, xmm2
pandn xmm1, xmm0
movaps xmm0, xmm2
pand xmm0, xmm4
por xmm1, xmm0
pand xmm1, xmm2
pandn xmm2, xmm3
por xmm1, xmm2
movups xmmword [eax - 0x10], xmm1
cmp ecx, dword [ebp - 0x10]
jb 0x405cd0
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
cmp ecx, esi
jae 0x405d42
sub edi, dword [ebp - 4]
add edx, ecx
mov dword [ebp - 0x10], esi
sub esi, ecx
cmp byte [edx + edi], 0x2f
lea edx, [edx + 1]
movzx ecx, byte [edx + edi - 1]
mov eax, 0x5c
cmove ecx, eax
mov byte [edx - 1], cl
sub esi, 1
jne 0x405d20
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
mov byte [edx + esi], 0
mov eax, edx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.Memory_allocation_failed_n
push 2
call fcn.0040c7b9
add esp, 4
push eax
call fcn.00405120
add esp, 8
push 1
call fcn.0040c321
int3
Function at 0x40a544
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40a583
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40a583
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a583
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40a583
cmp dword [ecx + 0x74], 0xe
jbe 0x40a583
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x416f58
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416dce

Function at 0x4181f9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417e76

Function at 0x41ee10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ee3d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ee3d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401749
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401788
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401788
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401788
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401788
cmp dword [ecx + 0x74], 0xe
jbe 0x401788
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4071ff
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40729c
push ebx
push esi
call fcn.004071c8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407111
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x407249
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40729b
push edi
push eax
call fcn.00407a77
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407269
call fcn.00405d21
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40729a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407111
add esp, 0x20
test eax, eax
jne 0x407288
push edi
call fcn.00405d21
jmp 0x407290
push ebx
call fcn.00405d21
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x408183
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ff68
push 0x40ff60
push str.FlsAlloc
push 0x1e
call fcn.004080a1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4081b7
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e10c]
call esi
jmp 0x4081bd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x408201
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ff78
push 0x40ff70
push str.FlsGetValue
push 0x20
call fcn.004080a1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408238
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e10c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]