joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412150
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x475058
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x48]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov edx, ecx
sub edx, dword [esi + 0x94]
mov eax, 0x10624dd3
mul edx
shr edx, 6
cmp edx, 5
jb 0x4121b8
push str.empty_dingdan_old_url
mov dword [esi + 0x94], ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edi, esi
call fcn.00411f40
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x54]
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00403920
mov ecx, esi
call fcn.00411dc0
cmp al, bl
je 0x41221d
push str.dingdan_url_repeat
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0x44], 0x10
jb 0x412207
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0045850d
add esp, 4
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x24
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x54]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00403920
mov ebp, dword [esp + 0x48]
push ebp
call fcn.00411e30
push str.filter_dingdan_url
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [0x497878]
mov eax, dword [edx + 0xe8]
xor ecx, ecx
cmp eax, ebx
jle 0x412282
mov edi, dword [edx + 0xe4]
lea ebx, [ebx]
mov edx, dword [edi]
cmp edx, ebx
je 0x41227a
cmp dword [edx], ebp
je 0x412297
inc ecx
add edi, 4
cmp ecx, eax
jl 0x412270
cmp dword [esp + 0x44], 0x10
jb 0x412207
mov eax, dword [esp + 0x30]
push eax
jmp 0x4121ff
push ebp
sub esp, 0x1c
mov dword [esp + 0x34], esp
mov edi, esp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
lea eax, [edx + 0xc]
push 0xffffffffffffffff
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push ebx
mov word [ecx + 4], dx
call fcn.00403af0
call fcn.0041ab30
add esp, 0x1c
mov ecx, esi
call fcn.00411fe0
cmp al, bl
jne 0x4121f3
push str.no_find_fanli_goto_flag_sendmessage_window
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push ebx
push ebx
push 0xc02
sub esp, 0x1c
mov eax, 0x47a75c
mov ecx, esp
mov dword [esp + 0x3c], esp
call fcn.004025c0
call fcn.00411d00
jmp 0x412282
Function at 0x418d90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x14]
mov esi, dword [eax]
mov ebp, dword [edi]
mov ebx, dword [edi + 0x14]
mov eax, dword [edi]
test ebp, ebp
je 0x418dad
cmp ebp, eax
je 0x418db2
call fcn.004589b8
cmp esi, ebx
je 0x418e83
test ebp, ebp
jne 0x418e2a
call fcn.004589b8
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x418dcf
call fcn.004589b8
mov ebx, dword [esi + 8]
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 4]
cmp eax, 0x9c40
jb 0x418e83
cmp dword [ebx + 0x4c], 0
jne 0x418e34
mov dword [esp + 0x1c], esi
test ebp, ebp
jne 0x418e2f
call fcn.004589b8
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x418e09
call fcn.004589b8
mov ecx, dword [esp + 0x1c]
mov esi, dword [esi]
push ecx
push ebp
lea ebx, [esp + 0x30]
call fcn.0041a450
mov edx, dword [esp + 0x14]
push edx
push edi
call fcn.00418c10
jmp 0x418da0
mov eax, dword [ebp]
jmp 0x418dc5
mov eax, dword [ebp]
jmp 0x418dff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 4]
cmp eax, 0x1d4c0
jb 0x418e83
mov dword [esp + 0x24], esi
test ebp, ebp
jne 0x418e7e
call fcn.004589b8
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x418e5d
call fcn.004589b8
mov eax, dword [esp + 0x24]
mov esi, dword [esi]
push eax
push ebp
lea ebx, [esp + 0x38]
call fcn.0041a450
mov ecx, dword [esp + 0x14]
push ecx
push edi
call fcn.00418c10
jmp 0x418da0
mov eax, dword [ebp]
jmp 0x418e53
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret

Function at 0x41b040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x473df9
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x24], esi
push 0xffffffffffffffff
mov dword [esp + 0x18], esi
push esi
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], esi
push eax
mov ecx, edi
mov dword [esp + 0x24], edi
mov byte [edi + 4], 0
call fcn.00403920
mov dword [esp + 0x24], esi
mov eax, dword [ebx + 0x14]
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov edi, edi
cmp dword [ebp + 0x18], 0x10
mov ecx, dword [ebp + 0x14]
jb 0x41b0be
mov eax, dword [ebp + 4]
jmp 0x41b0c1
lea eax, [ebp + 4]
push ecx
push eax
push edi
mov eax, esi
call fcn.004028a0
mov esi, eax
cmp esi, 0xffffffff
je 0x41b0e9
mov edx, dword [esp + 0xc]
push 0
push ebx
push edx
push edi
or eax, 0xffffffff
call fcn.00402b00
add esi, dword [esp + 0x10]
jmp 0x41b0b0
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x41c280
Capabilities:
Check if file exists
Create directory
Get file attributes
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x474ded
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x48b2b0]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x244]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x254]
xor esi, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x24c], 2
xor eax, eax
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], esi
mov word [ebp + 4], ax
cmp dword [esp + 0x270], 8
mov eax, dword [esp + 0x25c]
mov edi, 1
mov dword [esp + 0x14], edi
jae 0x41c308
lea eax, [esp + 0x25c]
push 0x104
lea ecx, [esp + 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x38]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x41c320
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x3c]
mov esi, ebp
call fcn.00403eb0
mov eax, dword [ebp + 0x14]
lea edx, [eax - 1]
push ebp
mov ecx, edi
lea esi, [esp + 0x20]
call fcn.00402600
mov ecx, eax
mov byte [esp + 0x24c], 3
mov eax, dword [ecx + 0x14]
push 0x47a57c
call fcn.004033f0
test eax, eax
mov edi, 8
setne bl
mov byte [esp + 0x24c], 2
cmp dword [esp + 0x34], edi
jb 0x41c389
mov edx, dword [esp + 0x20]
push edx
call fcn.0045850d
add esp, 4
test bl, bl
je 0x41c39b
push 1
push 0x47a57c
mov eax, ebp
call fcn.00402f10
mov edx, dword [esp + 0x278]
cmp dword [esp + 0x28c], edi
jae 0x41c3b2
lea edx, [esp + 0x278]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41c3b7
sub eax, esi
sar eax, 1
push eax
push edx
mov eax, ebp
call fcn.00402f10
cmp dword [ebp + 0x18], edi
jb 0x41c3d9
mov eax, dword [ebp + 4]
jmp 0x41c3dc
lea eax, [ebp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41c3fe
cmp dword [ebp + 0x18], edi
jb 0x41c3f2
mov eax, dword [ebp + 4]
jmp 0x41c3f5
lea eax, [ebp + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esp + 0x270], edi
jb 0x41c417
mov eax, dword [esp + 0x25c]
push eax
call fcn.0045850d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x270], 7
mov dword [esp + 0x26c], 0
mov word [esp + 0x25c], cx
cmp dword [esp + 0x28c], edi
jb 0x41c450
mov edx, dword [esp + 0x278]
push edx
call fcn.0045850d
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x244]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.004584fe
add esp, 0x23c
ret
Function at 0x423da0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, eax
xor eax, eax
mov byte [esi], al
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
cmp dword [ecx + 0x18], 0x10
mov eax, dword [ecx + 0x14]
jb 0x423de6
mov ecx, dword [ecx + 4]
push ecx
mov ecx, esi
call fcn.004244f0
call fcn.00424590
mov eax, esi
pop esi
ret
add ecx, 4
push ecx
mov ecx, esi
call fcn.004244f0
call fcn.00424590
mov eax, esi
pop esi
ret
Function at 0x427450
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x473c18
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push edi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], edi
mov word [esp + 0xc], ax
lea ecx, [esp + 8]
push ecx
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.00427500
mov dword [esp + 0x2c], 0xffffffff
cmp dword [esp + 0x20], 8
jb 0x4274b5
mov edx, dword [esp + 0xc]
push edx
call fcn.0045850d
add esp, 4
mov ecx, dword [esi + 0x1c]
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], edi
mov word [esp + 0xc], ax
cmp ecx, edi
je 0x4274d7
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esi + 0x20]
cmp ecx, edi
je 0x4274e6
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x28
ret
Function at 0x432980
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x474b28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov esi, dword [ebp + 0x30]
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
mov ebx, eax
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebp
mov ecx, edi
call edx
test al, al
je 0x432a71
cmp dword [ebp + 0x18], 0
je 0x432a4a
mov eax, dword [esi + 0x1c]
lea ecx, [eax + 8]
mov dword [esi + 0x1c], ecx
cmp dword [esi + 0x20], ecx
jae 0x432a05
push 8
mov dword [esi + 0x1c], eax
call fcn.0043a090
test eax, eax
je 0x432a0b
mov dword [eax], edi
mov dword [eax + 4], 0x49650c
mov edi, dword [ebp + 0x18]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebp
mov ecx, edi
mov dword [esp + 0x30], edi
call edx
test al, al
jne 0x4329e7
cmp ebx, dword [esi + 0x1c]
je 0x432a71
lea eax, [esp + 0x2c]
push eax
call fcn.004458b0
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov eax, dword [edx + 0x14]
push ebp
mov ecx, edi
call eax
test al, al
je 0x432a27
jmp 0x4329e7
mov dword [esp + 0x24], 0xffffffff
mov ebx, dword [esp + 0x18]
call fcn.0042ecd0
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov dword [esp + 0x24], 0xffffffff
mov ebx, dword [esp + 0x18]
call fcn.0042ecd0
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4559f0
Capabilities:
Terminate thread

Disassembly:
cmp dword [esi], 1
push ebx
push edi
jne 0x455a1f
push 0x3e8
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 2
push eax
call edi
mov ecx, dword [esi + 0x34]
push 2
push ecx
call edi
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp eax, ebx
je 0x455a34
push eax
call edi
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x455a41
push eax
call edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
cmp dword [esi + 0x2c], 0x10
jb 0x455a59
mov edx, dword [esi + 0x18]
push edx
call fcn.0045850d
add esp, 4
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0xf
pop edi
mov byte [esi + 0x18], bl
pop ebx
ret

Function at 0x455a70
Capabilities:
Create thread

Disassembly:
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, ecx
mov eax, dword [esi + 0x30]
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x455a92
push eax
call edi
mov dword [esi + 0x30], ebx
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x455a9f
push eax
call edi
mov dword [esi + 0x34], ebx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
lea edi, [esi + 0x38]
mov dword [esi + 0x3c], ebx
mov dword [edi], ebx
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], ecx
cmp ebp, ebx
jne 0x455afc
xor edx, edx
push 0xb
mov eax, 0x47f3e0
lea esi, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
call fcn.00403eb0
cmp dword [esp + 0x28], 8
jb 0x455af0
mov eax, dword [esp + 0x14]
push eax
call fcn.0045850d
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret 0xc
cmp dword [esi], 1
mov dword [esi + 0x58], ebp
jne 0x455b3d
lea ecx, [esp + 0x10]
cmp dword [esi + 8], ebx
je 0x455b25
mov eax, 0x47f3f8
call fcn.004025c0
cmp dword [esp + 0x28], 8
jb 0x455b7e
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x455b76
mov eax, 0x47f414
call fcn.004025c0
cmp dword [esp + 0x28], 8
jb 0x455b7e
mov edx, dword [esp + 0x14]
push edx
jmp 0x455b76
push edi
push ebx
push esi
push 0x455c30
push ebx
push ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
cmp dword [edi], ebx
je 0x455b7e
mov eax, 0x47f42c
lea ecx, [esp + 0x10]
mov dword [esi], 1
call fcn.004025c0
cmp dword [esp + 0x28], 8
jb 0x455b7e
mov eax, dword [esp + 0x14]
push eax
call fcn.0045850d
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret 0xc
Function at 0x455cb0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x47498b
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x48b2b0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14c]
mov esi, dword [esp + 0x150]
mov edi, ecx
mov ebx, edx
push 0x47f478
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], esi
call fcn.00458edf
mov ebp, eax
xor eax, eax
add esp, 8
mov dword [esp + 0x14], ebp
cmp ebp, eax
jne 0x455d61
cmp ebx, eax
je 0x455d5a
lea edi, [esp + 0x2c]
call fcn.00456390
push 0xffffffffffffffff
push 0
mov ecx, ebx
mov dword [esp + 0x14c], 0
call fcn.00403af0
cmp dword [esp + 0x44], 8
jb 0x455d5a
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0045850d
add esp, 4
xor al, al
jmp 0x455e98
cmp esi, eax
je 0x455d6d
mov edx, dword [esi]
mov dword [esp + 0x18], edx
jmp 0x455d71
mov dword [esp + 0x18], eax
xor ecx, ecx
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov dword [esp + 0x62], eax
mov dword [esp + 0x66], eax
mov dword [esp + 0x6a], eax
mov word [esp + 0x6e], ax
or eax, 0xffffffff
xor ebx, ebx
mov esi, edi
mov word [esp + 0x48], cx
call fcn.00403a60
push 2
push ebx
push ebp
call fcn.0045a920
push ebp
call fcn.0045ab42
push ebx
push ebx
push ebp
mov edi, eax
call fcn.0045a920
add esp, 0x1c
test edi, edi
je 0x455e3e
push edi
call fcn.00458343
mov edx, dword [esp + 0x18]
push edx
push 1
mov ebp, eax
push edi
push ebp
call fcn.00459686
push edi
mov edx, ebp
xor ecx, ecx
call fcn.00456180
mov ebx, eax
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00458343
mov esi, eax
push edi
mov edx, ebp
mov ecx, esi
mov dword [esp + 0x48], esi
call fcn.00456180
add esp, 0x20
mov eax, esi
mov esi, dword [esp + 0x24]
push ebx
call fcn.00403eb0
mov eax, dword [esp + 0x28]
push eax
call fcn.00458ded
push ebp
call fcn.00458ded
mov ebp, dword [esp + 0x1c]
add esp, 8
push ebx
push edi
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x7c]
push str._s_d_bytes_to__d_wide_chars
push edx
call fcn.0045abb0
mov esi, dword [esp + 0x30]
add esp, 0x14
test esi, esi
je 0x455e7f
lea eax, [esp + 0x70]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x455e66
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x74]
call fcn.00403eb0
push ebp
call fcn.00459151
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x455e96
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.004584fe
add esp, 0x134
ret
Function at 0x456390
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x474961
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0xc], 0
lea ebx, [edi + 4]
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], 0
mov dword [esp + 0x10], edi
mov word [ebx], ax
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], 1
call fcn.0045b0d1
mov ecx, dword [eax]
push ecx
call fcn.0045b01c
mov ecx, eax
add esp, 4
lea esi, [ecx + 2]
jmp 0x456400
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x456400
sub ecx, esi
sar ecx, 1
push ecx
mov esi, edi
call fcn.00403eb0
xor esi, esi
cmp esi, dword [edi + 0x14]
jge 0x4564a8
jbe 0x456429
call fcn.004589b8
cmp dword [edi + 0x18], 8
jb 0x456433
mov eax, dword [ebx]
jmp 0x456435
mov eax, ebx
cmp word [eax + esi*2], 0xd
je 0x456473
cmp esi, dword [edi + 0x14]
jbe 0x456446
call fcn.004589b8
cmp dword [edi + 0x18], 8
jb 0x456450
mov eax, dword [ebx]
jmp 0x456452
mov eax, ebx
cmp word [eax + esi*2], 0xa
je 0x456473
inc esi
cmp esi, dword [edi + 0x14]
jl 0x456422
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret
mov ecx, esi
push edi
xor edx, edx
lea esi, [esp + 0x18]
call fcn.00402600
push 0xffffffffffffffff
push 0
mov ecx, edi
mov dword [esp + 0x40], 1
call fcn.00403af0
cmp dword [esp + 0x2c], 8
jb 0x4564a8
mov edx, dword [esp + 0x18]
push edx
call fcn.0045850d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x30
ret

Function at 0x4570d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x473f48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x48b2b0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ebx, ebx
cmp ecx, eax
mov dword [esp + 0xc], ebx
jle 0x45712e
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [edi + 4], ax
push ebx
mov eax, 0x47a964
mov esi, edi
call fcn.00403eb0
jmp 0x45718a
mov edx, dword [edx + 0xc]
sub eax, ecx
inc eax
lea ecx, [edx + ecx*2]
xor edx, edx
push eax
mov eax, ecx
lea esi, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov word [esp + 0x18], dx
call fcn.00403eb0
mov dword [esp + 0x38], ebx
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push 0xffffffffffffffff
mov word [edi + 4], ax
push ebx
mov eax, esi
mov ecx, edi
call fcn.00403af0
cmp dword [esp + 0x28], 8
jb 0x45718a
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045850d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004584fe
add esp, 0x30
ret
Function at 0x4580c0
Capabilities:
Write file on windows

Disassembly:
cmp dword [0x497a8c], 0
je 0x4580f2
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4580d0
mov ecx, dword [0x497a90]
push ecx
sub eax, edx
push eax
push 1
push esi
call fcn.00459058
add esp, 0x10
mov eax, 1
ret
xor eax, eax
ret

Function at 0x458190
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4748e0
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x48b2b0]
xor eax, esp
mov dword [esp + 0x74], eax
push ebx
push esi
push edi
mov eax, dword [0x48b2b0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x80], 0xf
mov dword [esp + 0x7c], ebx
mov byte [esp + 0x6c], bl
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0xac], ebx
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
mov word [esi + 4], ax
mov eax, 0x497880
mov dword [esp + 0x30], esp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x458201
sub eax, edx
sar eax, 1
push eax
mov eax, 0x497880
call fcn.00403eb0
lea edi, [esp + 0x34]
call fcn.0041ab30
add esp, 0x1c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x74]
mov byte [esp + 0x9c], 1
call fcn.00403920
mov esi, 0x10
cmp dword [esp + 0x30], esi
jb 0x458254
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0045850d
add esp, 4
mov eax, dword [esp + 0x6c]
cmp dword [esp + 0x80], esi
jae 0x458265
lea eax, [esp + 0x6c]
lea edx, [esp + 0x34]
push edx
push eax
call fcn.0045b384
add esp, 8
cmp eax, 0xffffffff
jne 0x458293
cmp dword [esp + 0x80], esi
jb 0x45828e
mov eax, dword [esp + 0x6c]
push eax
call fcn.0045850d
add esp, 4
or eax, 0xffffffff
jmp 0x4582af
mov edi, dword [esp + 0x48]
cmp dword [esp + 0x80], esi
jb 0x4582ad
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0045850d
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x74]
xor ecx, esp
call fcn.004584fe
add esp, 0x84
ret

Function at 0x4584fe
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x48b2b0]
jne 0x458508
repz ret
jmp fcn.0045d968
Function at 0x46dc8d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045eac0
and dword [ebp - 4], 0
cmp dword [0x4975e8], 0
mov ebx, eax
jne 0x46dd3e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46ddef
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x46ddef
push eax
call fcn.0045ea4e
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4975e8], eax
call esi
push eax
call fcn.0045ea4e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4975ec], eax
call esi
push eax
call fcn.0045ea4e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4975f0], eax
call esi
push eax
call fcn.0045ea4e
pop ecx
mov dword [0x4975f8], eax
test eax, eax
je 0x46dd3e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045ea4e
pop ecx
mov dword [0x4975f4], eax
mov eax, dword [0x4975f4]
cmp eax, ebx
je 0x46dd96
cmp dword [0x4975f8], ebx
je 0x46dd96
push eax
call fcn.0045eac9
push dword [0x4975f8]
mov esi, eax
call fcn.0045eac9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46dd96
test edi, edi
je 0x46dd96
call esi
test eax, eax
je 0x46dd8d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46dd8d
test byte [ebp - 0xc], 1
jne 0x46dd96
or dword [ebp + 0x10], 0x200000
jmp 0x46ddcf
mov eax, dword [0x4975ec]
cmp eax, ebx
je 0x46ddcf
push eax
call fcn.0045eac9
pop ecx
test eax, eax
je 0x46ddcf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46ddcf
mov eax, dword [0x4975f0]
cmp eax, ebx
je 0x46ddcf
push eax
call fcn.0045eac9
pop ecx
test eax, eax
je 0x46ddcf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4975e8]
call fcn.0045eac9
pop ecx
test eax, eax
je 0x46ddef
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46ddf1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret