joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418c30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1a], 0
je 0x418c5a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1b
jb 0x418c50
ret

Function at 0x418c60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x20], 0
je 0x418c9a
movaps xmm1, xmmword [0x4890c0]
xor eax, eax
nop
movups xmm0, xmmword [eax + ecx]
pxor xmm0, xmm1
movups xmmword [eax + ecx], xmm0
add eax, 0x10
cmp eax, 0x20
jb 0x418c70
cmp eax, 0x21
jae 0x418c9a
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x21
jb 0x418c90
ret

Function at 0x418ca0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x18], 0
je 0x418cca
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x19
jb 0x418cc0
ret

Function at 0x418cd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x11], 0
je 0x418cfa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x12
jb 0x418cf0
ret

Function at 0x418d20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x15], 0
je 0x418d4a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x16
jb 0x418d40
ret

Function at 0x418d50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1b], 0
je 0x418d7a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1c
jb 0x418d70
ret

Function at 0x418d80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x1d], 0
je 0x418daa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1e
jb 0x418da0
ret

Function at 0x418db0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xc], 0
je 0x418dc2
xor eax, eax
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0xd
jb 0x418db8
ret

Function at 0x418dd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x19], 0
je 0x418dfa
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x1a
jb 0x418df0
ret

Function at 0x418e00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0x14], 0
je 0x418e2a
movups xmm0, xmmword [ecx]
mov eax, 0x10
movaps xmm1, xmmword [0x4890c0]
pxor xmm1, xmm0
movups xmmword [ecx], xmm1
nop dword [eax]
xor byte [eax + ecx], 0x2e
inc eax
cmp eax, 0x15
jb 0x418e20
ret
Function at 0x420f38
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test ebx, ebx
jg 0x420f5c
jl 0x420f53
test esi, esi
jne 0x420f5c
xor eax, eax
xor edx, edx
jmp 0x42104f
cmp dword [edi + 0x38], 0
je 0x420f71
push ebx
push esi
push dword [ebp + 8]
call fcn.00421056
jmp 0x42104f
mov eax, dword [edi + 0x1c]
mov ecx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], esi
mov ecx, dword [eax]
test ecx, ecx
je 0x420fc5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x420fc5
cmp eax, esi
jb 0x420f97
mov eax, esi
mov dword [ebp - 4], esi
push eax
push ecx
push dword [ebp + 8]
call fcn.0044e860
mov edx, dword [ebp - 4]
mov ecx, esi
mov eax, dword [ebp + 8]
sub ecx, edx
add eax, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
add esp, 0xc
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0xc], ecx
sub dword [eax], edx
mov eax, dword [edi + 0x1c]
add dword [eax], edx
jmp 0x420fcb
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [edi + 0x4c], 0
je 0x421043
mov ecx, edi
call fcn.0042079c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
cmp eax, 0xfff
jbe 0x42101f
mov ecx, dword [ebp - 4]
push dword [edi + 0x4c]
push 0xfff
push 1
push ecx
call fcn.00456a95
mov ecx, dword [ebp - 4]
add esp, 0x10
mov edx, dword [ebp - 8]
add ecx, eax
sub edx, eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
cmp eax, 0xfff
jne 0x42101b
cmp edx, eax
ja 0x420fe8
jmp 0x421022
sub esi, edx
jmp 0x421048
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, eax
test eax, eax
je 0x421046
push dword [edi + 0x4c]
push edx
push 1
push dword [ebp - 4]
call fcn.00456a95
mov ecx, dword [ebp - 0xc]
add esp, 0x10
sub ecx, eax
jmp 0x421046
mov ecx, dword [ebp - 0xc]
sub esi, ecx
sbb ebx, 0
mov eax, esi
mov edx, ebx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x43a01f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x46694f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004667c5
Function at 0x4309d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x427015
lea edi, [esi - 0x26015]
push edi
or ebp, 0xffffffff
jmp 0x4309f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4309f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4309e8
mov eax, 1
add ebx, ebx
jne 0x430a0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x430a00
jne 0x430a1c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430a00
xor ecx, ecx
sub eax, 3
jb 0x430a30
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x430aa2
mov ebp, eax
add ebx, ebx
jne 0x430a3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x430a48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x430a6c
inc ecx
add ebx, ebx
jne 0x430a58
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x430a4d
jne 0x430a69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x430a4d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x430a8c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x430a7d
jmp 0x4309ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x430a8c
add edi, ecx
jmp 0x4309ee
pop esi
mov edi, esi
mov ecx, 0xa47
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x430aaa
cmp byte [edi], 7
jne 0x430aaa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x430aaf
lea edi, [esi + 0x2e000]
mov eax, dword [edi]
or eax, eax
je 0x430b1e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x322a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x32340]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x430adc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x32344]
or eax, eax
je 0x430b18
mov dword [ebx], eax
add ebx, 4
jmp 0x430af9
call dword [esi + 0x32348]
popal
jmp 0x4011cb
Function at 0x407552
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
sub esi, esi
add esi, 0x30
mov edi, dword fs:[esi]
push ecx
mov esi, edi
add esi, 8
mov ecx, dword [esi]
mov ebx, dword [edi + 0xc]
mov edi, dword [ebx + 0xc]
push eax
mov esi, dword [edi + 0x18]
test esi, esi
je 0x407593
mov ebx, dword [edi + 0x30]
mov eax, dword [ebx]
and eax, 0xdf00df
mov ebx, dword [ebx + 0xc]
shl ebx, 8
add ebx, eax
shr ebx, 2
sub ebx, 0xc914cd2
test ebx, ebx
je 0x40759c
mov ebx, dword [edi]
mov edi, ebx
jmp 0x40756c
mov edi, dword [esi + 0x3c]
add edi, esi
mov ebx, dword [edi + 0x78]
add ebx, esi
push edx
mov eax, dword [ebx + 0x20]
add eax, esi
mov edx, dword [eax]
add edx, esi
mov edi, dword [edx + 0xb]
add edi, 0xff8b9c9b
cmp edi, 0
jne 0x4075c0
jmp 0x4075cb
add eax, 4
jmp 0x4075ac
mov edi, dword [ebx + 0x20]
sub eax, edi
sub eax, esi
shr eax, 1
mov edi, dword [ebx + 0x24]
add edi, esi
add edi, eax
mov eax, dword [edi]
mov edi, dword [ebx + 0x1c]
shl eax, 0x10
shr eax, 0xe
add edi, esi
add edi, eax
mov eax, dword [edi]
lea edi, [0x28000]
push esi
add eax, esi
mov edx, 0x40
lea ebx, [0x64000]
push ecx
add ebx, ecx
push edx
push esp
push edx
push edi
push ebx
call eax
pop edi
pop ecx
push eax
mov ebx, 0x11e00
mov esi, 0x4a91
mov edi, 0x64000
mov eax, 8
add edi, ecx
imul esi, eax
add esi, 0x4188
add esi, ecx
call fcn.00407652
mov esi, 0x3b410
mov edi, 0x78000
add esi, ecx
lea ebx, [0x2854]
add edi, ecx
call fcn.00407652
jmp 0x407677
lea edi, [0x64000]
mov ebx, 0x527
daa
add eax, 0xbe0000
add byte [eax], al
adc byte [ebx], al
stc
mov eax, 3
imul ebx, eax
add ebx, 0x8b
sub edi, ebx
mov ebx, edi
sub ebx, esi
mov esi, 0x3e210
mov eax, 0x3fb88
add esi, ecx
add eax, ecx
cmp esi, eax
jge 0x407747
mov edx, dword [esi + 4]
xor edx, 0x1f782e55
cmp edx, 0
je 0x407747
lea edx, [esi]
push ecx
lea ecx, [edx]
sub ecx, esi
test ecx, 3
jne 0x4076d6
jmp 0x4076e7
mov ecx, dword [edx + 6]
xor ecx, 0x1f782e55
shr ecx, 0x10
jmp 0x4076f0
mov ecx, dword [edx + 8]
xor ecx, 0x1f782e55
cmp cx, 0
je 0x407733
cmp esi, edx
je 0x407702
test ecx, 0xfff
je 0x407733
push ecx
and ecx, 0xf000
shr ecx, 0xc
cmp ecx, 3
pop ecx
jne 0x40772b
shl ecx, 0x14
shr ecx, 0x14
push eax
mov eax, dword [esi]
xor eax, 0x1f782e55
add ecx, eax
add ecx, edi
mov eax, dword [ecx]
add eax, ebx
mov dword [ecx], eax
pop eax
add edx, 2
jmp 0x4076c8
pop ecx
mov edx, dword [esi + 4]
xor edx, 0x1f782e55
add esi, edx
add edx, 8
jmp 0x4076ab
lea edi, [0x2e8b]
mov esi, 0x7651
add esi, edi
add esi, ecx
add esi, 0x5d22f
push esi
mov esi, edi
sub edi, edi
ret
Function at 0x40755c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
sub esi, esi
add esi, 0x30
mov edi, dword fs:[esi]
push ecx
mov esi, edi
add esi, 8
mov ecx, dword [esi]
mov ebx, dword [edi + 0xc]
mov edi, dword [ebx + 0xc]
push eax
mov esi, dword [edi + 0x18]
test esi, esi
je 0x407593
mov ebx, dword [edi + 0x30]
mov eax, dword [ebx]
and eax, 0xdf00df
mov ebx, dword [ebx + 0xc]
shl ebx, 8
add ebx, eax
shr ebx, 2
sub ebx, 0xc914cd2
test ebx, ebx
je 0x40759c
mov ebx, dword [edi]
mov edi, ebx
jmp 0x40756c
mov edi, dword [esi + 0x3c]
add edi, esi
mov ebx, dword [edi + 0x78]
add ebx, esi
push edx
mov eax, dword [ebx + 0x20]
add eax, esi
mov edx, dword [eax]
add edx, esi
mov edi, dword [edx + 0xb]
add edi, 0xff8b9c9b
cmp edi, 0
jne 0x4075c0
jmp 0x4075cb
add eax, 4
jmp 0x4075ac
mov edi, dword [ebx + 0x20]
sub eax, edi
sub eax, esi
shr eax, 1
mov edi, dword [ebx + 0x24]
add edi, esi
add edi, eax
mov eax, dword [edi]
mov edi, dword [ebx + 0x1c]
shl eax, 0x10
shr eax, 0xe
add edi, esi
add edi, eax
mov eax, dword [edi]
lea edi, [0x28000]
push esi
add eax, esi
mov edx, 0x40
lea ebx, [0x64000]
push ecx
add ebx, ecx
push edx
push esp
push edx
push edi
push ebx
call eax
pop edi
pop ecx
push eax
mov ebx, 0x11e00
mov esi, 0x4a91
mov edi, 0x64000
mov eax, 8
add edi, ecx
imul esi, eax
add esi, 0x4188
add esi, ecx
call fcn.00407652
mov esi, 0x3b410
mov edi, 0x78000
add esi, ecx
lea ebx, [0x2854]
add edi, ecx
call fcn.00407652
jmp 0x407677
lea edi, [0x64000]
mov ebx, 0x527
daa
add eax, 0xbe0000
add byte [eax], al
adc byte [ebx], al
stc
mov eax, 3
imul ebx, eax
add ebx, 0x8b
sub edi, ebx
mov ebx, edi
sub ebx, esi
mov esi, 0x3e210
mov eax, 0x3fb88
add esi, ecx
add eax, ecx
cmp esi, eax
jge 0x407747
mov edx, dword [esi + 4]
xor edx, 0x1f782e55
cmp edx, 0
je 0x407747
lea edx, [esi]
push ecx
lea ecx, [edx]
sub ecx, esi
test ecx, 3
jne 0x4076d6
jmp 0x4076e7
mov ecx, dword [edx + 6]
xor ecx, 0x1f782e55
shr ecx, 0x10
jmp 0x4076f0
mov ecx, dword [edx + 8]
xor ecx, 0x1f782e55
cmp cx, 0
je 0x407733
cmp esi, edx
je 0x407702
test ecx, 0xfff
je 0x407733
push ecx
and ecx, 0xf000
shr ecx, 0xc
cmp ecx, 3
pop ecx
jne 0x40772b
shl ecx, 0x14
shr ecx, 0x14
push eax
mov eax, dword [esi]
xor eax, 0x1f782e55
add ecx, eax
add ecx, edi
mov eax, dword [ecx]
add eax, ebx
mov dword [ecx], eax
pop eax
add edx, 2
jmp 0x4076c8
pop ecx
mov edx, dword [esi + 4]
xor edx, 0x1f782e55
add esi, edx
add edx, 8
jmp 0x4076ab
lea edi, [0x2e8b]
mov esi, 0x7651
add esi, edi
add esi, ecx
add esi, 0x5d22f
push esi
mov esi, edi
sub edi, edi
ret
Function at 0x420b5b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x420b9a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420b9a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420b9a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x420b9a
cmp dword [ecx + 0x74], 0xe
jbe 0x420b9a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x433310
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43333d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43333d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
jmp section..htext
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x296e7a69
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x51d57333
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4042c3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427c48]
jne 0x4042cd
repz ret
jmp fcn.00407e1b

Function at 0x40a16f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004043e6
and dword [ebp - 4], 0
cmp dword [0x429418], 0
mov ebx, eax
jne 0x40a220
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a2d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40a2d1
push eax
call fcn.00404374
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429418], eax
call esi
push eax
call fcn.00404374
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42941c], eax
call esi
push eax
call fcn.00404374
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429420], eax
call esi
push eax
call fcn.00404374
pop ecx
mov dword [0x429428], eax
test eax, eax
je 0x40a220
push 0x416c8c
push edi
call esi
push eax
call fcn.00404374
pop ecx
mov dword [0x429424], eax
mov eax, dword [0x429424]
cmp eax, ebx
je 0x40a278
cmp dword [0x429428], ebx
je 0x40a278
push eax
call fcn.004043ef
push dword [0x429428]
mov esi, eax
call fcn.004043ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a278
test edi, edi
je 0x40a278
call esi
test eax, eax
je 0x40a26f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a26f
test byte [ebp - 0xc], 1
jne 0x40a278
or dword [ebp + 0x10], 0x200000
jmp 0x40a2b1
mov eax, dword [0x42941c]
cmp eax, ebx
je 0x40a2b1
push eax
call fcn.004043ef
pop ecx
test eax, eax
je 0x40a2b1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a2b1
mov eax, dword [0x429420]
cmp eax, ebx
je 0x40a2b1
push eax
call fcn.004043ef
pop ecx
test eax, eax
je 0x40a2b1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429418]
call fcn.004043ef
pop ecx
test eax, eax
je 0x40a2d1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a2d3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414a2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x4276cc], 0x6b9
mov dword [ebp - 0x10], eax
call fcn.0041517e
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x414a70
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x4276cc], 0x1a0e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x4276d0], 0x866
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x414ba4
jmp 0x414ae7
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x414b3b
jmp 0x414b13
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edx
jmp 0x414abc
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x38], eax
jne 0x414abc
mov al, byte [ebp - 0x42]
test al, 1
jne 0x414b6f
jmp 0x414b44
mov eax, dword [ebp - 0x54]
add eax, 2
mov dword [ebp - 0x58], eax
xor eax, eax
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov edx, dword [ebp - 0x30]
cmp ecx, edx
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x34], eax
jb 0x414af7
jmp 0x414ba4
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax]
mov dword [0x4276cc], 0x2dca
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x4276d0], 0x45bb
mov dword [ebp - 0x5c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x414d5e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.00414602
lea ecx, [0x4149ce]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x64], edx
mov dword [esp + 0x6c], 0x139a00
mov edx, dword [0x4276b8]
mov dword [esp + 0x34], edx
mov edx, dword [0x4276bc]
mov dword [esp + 0x7c], edx
mov edx, dword [0x4276c0]
mov dword [esp + 0x48], edx
mov edx, dword [0x4276c4]
mov dword [esp + 0x5c], edx
mov edx, dword [0x4276c8]
mov dword [esp + 0x70], edx
mov dword [0x4276cc], 0x1e67
mov dword [0x4276d0], 0x1eb0
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x414e34
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x414e34
mov eax, dword [esp + 0x10]
mov dword [esp + 0x74], eax
mov dword [0x4276cc], 0x432
mov dword [0x4276d0], 0x21c8
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x38], edx
call fcn.004158de
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x414e59
jmp 0x414e9f
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x414de4
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x414df8
jmp 0x414de4
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.00414ea7
mov ecx, dword [0x4276d0]
add ecx, 0xffffdb1f
mov dword [0x4276cc], ecx
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x4276cc], 0xd4d
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret