joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4343a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50aa80
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x55300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov ebx, dword [ebp + 8]
lea eax, [edi + 4]
xorps xmm0, xmm0
mov dword [edi], vtable.std::exception.0
push eax
movq qword [eax], xmm0
lea eax, [ebx + 4]
push eax
call fcn.004b56b8
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov dword [edi], vtable.boost::system::system_error.0
movq xmm0, qword [ebx + 0xc]
movq qword [edi + 0xc], xmm0
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
lea eax, [ebx + 0x18]
push eax
call fcn.00434650
mov dword [edi], vtable.boost::thread_resource_error.0
lea esi, [edi + 0x30]
mov dword [ebp - 4], 1
mov dword [esi], vtable.boost::exception.0
mov ecx, dword [ebx + 0x34]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x43443c
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebx + 0x38]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 0x10], eax
mov eax, edi
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.0
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::thread_resource_error_.1.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x438a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x214]
push 0x208
push 0
push eax
mov dword [ebp - 0x220], edi
call fcn.004b62b0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push str.SoftwareGSoSoftGSoInput
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x438b1b
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x220], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push str.RimeUserDir
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x218]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x438b1b
cmp dword [ebp - 0x21c], 1
jne 0x438b1b
cmp word [ebp - 0x214], si
je 0x438b1b
lea eax, [ebp - 0x214]
mov ecx, edi
push eax
call fcn.00406e00
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00482225
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.0046a820
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00482225
mov esp, ebp
pop ebp
ret
Function at 0x439a70
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x55300c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov esi, ecx
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x10], esi
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x439ae5
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00482634
add esp, 4
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
cmp dword [esp + 0xc], 0
ja 0x439b18
push edi
call fcn.00482295
add esp, 4
xor eax, eax
mov dword [esi + 0x10], 0
push eax
mov dword [esi + 0x14], 7
mov ecx, esi
push 0x52ad90
mov word [esi], ax
call fcn.00406c50
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00482225
mov esp, ebp
pop ebp
ret
mov ecx, edi
mov dword [esp + 0x20], 0
xor eax, eax
mov dword [esp + 0x24], 7
mov word [esp + 0x10], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x439b34
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [esp + 0x18]
call fcn.00406c50
push edi
call fcn.00482295
movups xmm0, xmmword [esp + 0x14]
mov ecx, dword [esp + 0x40]
add esp, 4
mov dword [esi + 0x10], 0
mov eax, esi
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
pop edi
movq xmm0, qword [esp + 0x1c]
movq qword [esi + 0x10], xmm0
pop esi
xor ecx, esp
call fcn.00482225
mov esp, ebp
pop ebp
ret
Function at 0x43a7d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b338
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004ab460
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4c]
push 0
push eax
push 0xc
mov edi, dword [esi + 0x1c]
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x43a872
call ebx
cmp eax, 0xea
jne 0x43a9ff
push dword [esi + 0x24]
push 0
push dword [esi + 0x28]
call fcn.004b62b0
add esp, 0xc
lea eax, [ebp - 0x4c]
push 0
push eax
push dword [esi + 0x24]
push dword [esi + 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43aa10
mov byte [esi + 0x20], 0
call fcn.004ab460
mov esi, dword [ebp - 0x38]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x43a818
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
test edx, edx
je 0x43a8a4
lock inc dword [edx + 4]
mov ecx, dword [esi + 0x24]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movq xmm0, qword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x7c], vtable.std::_Func_impl_no_alloc_class__lambda_cb63575d452b5fdbafa144aac7ec2e8f___void__unsigned_long_int__class_weasel::PipeServerChannel__.0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 3
test ecx, ecx
je 0x43aa23
mov eax, dword [ecx]
lea edx, [ebp - 0x44]
push edx
lea edx, [ebp - 0x7c]
push edx
lea edx, [ebp - 0x30]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x43a90c
mov edx, dword [ecx]
lea eax, [ebp - 0x7c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x43a818
call fcn.004472d0
jmp 0x43a818
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push 0x54d22c
push eax
call fcn.004b573a
call ebx
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push 0x54d22c
push eax
call fcn.004b573a
call fcn.004832f5
int3
Function at 0x43f360
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50b8e8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
push 0
push 0x3e8
push dword [eax + 4]
push dword [eax]
call fcn.00503150
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x58], edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x43f3bf
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
jmp 0x43f43a
cmp dword [ebp - 0x5c], 0
jg 0x43f3d7
jl 0x43f3b5
cmp dword [ebp - 0x60], 0
ja 0x43f3d7
xorps xmm0, xmm0
movlpd qword [ebp - 0x50], xmm0
jmp 0x43f43a
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0x68]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x43f400
nop dword [eax]
inc esi
cmp esi, 3
ja 0x43f3b5
lea eax, [ebp - 0x68]
push eax
call edi
test eax, eax
je 0x43f3f0
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x68]
call fcn.00503600
mulsd xmm0, qword [0x531208]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
movsd qword [ebp - 0x50], xmm0
call fcn.00503600
movsd xmm1, qword [ebp - 0x50]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.005034af
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
adc eax, dword [ebp - 0x58]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x70], ecx
mov ecx, ebx
push eax
call fcn.004aad20
mov esi, eax
lea eax, [ebp - 0x54]
push eax
call fcn.004aace0
add esp, 4
mov ecx, dword [eax]
cmp ecx, dword [esi]
je 0x43f49f
lea eax, [ebp - 0x41]
mov ecx, ebx
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.004aa780
neg al
sbb al, al
and al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482225
mov esp, ebp
pop ebp
ret 4
sub esp, 8
lea ecx, [ebp - 0x40]
call fcn.00446a90
push eax
mov dword [ebp - 4], 0
call fcn.00434930
int3
Function at 0x445c10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bee4
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edi
mov dword [edi], vtable.boost::detail::thread_data_base.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
lea esi, [edi + 0x14]
mov dword [edi + 0xc], 0
mov ecx, esi
mov dword [edi + 0x10], 0
mov dword [ebp - 0x44], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00444a20
mov dword [esi], eax
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
push 0
push 0
push 1
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x445ceb
mov dword [edi + 0x34], eax
mov eax, edi
mov byte [edi + 0x38], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00482225
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x40]
call fcn.00436270
push eax
mov byte [ebp - 4], 4
call fcn.00434930
int3

Function at 0x446940
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
jne 0x44696f
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0xc], 0
jg 0x44697f
jl 0x446959
cmp dword [esp + 8], 0
jbe 0x446959
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x10]
push eax
xor esi, esi
call edi
test eax, eax
jne 0x4469a3
inc esi
cmp esi, 3
ja 0x446959
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x446992
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
call fcn.00503600
mulsd xmm0, qword [0x531208]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp + 0x10], xmm0
call fcn.00503600
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movaps xmm0, xmm1
call fcn.005034af
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], edx
mov esp, ebp
pop ebp
ret
Function at 0x44fda0
Capabilities:
Connect pipe
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50c6d0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x55300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x1c], 0xffffffff
jne 0x44fedb
cmp byte [edi], 0
je 0x44fe29
cmp dword [edi + 0x18], 8
lea ecx, [edi + 4]
jb 0x44fdee
mov ecx, dword [ecx]
push dword [edi + 0x30]
mov eax, dword [edi + 0x24]
push 0
push eax
push eax
push 0xff
push 6
push 3
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44feef
push 0
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x44feef
jmp 0x44fec0
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
mov dword [ebp - 0x14], esi
jb 0x44fe40
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
nop word [eax + eax]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x44fe4a
mov eax, dword [esi]
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x44fe88
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xe7
jne 0x44ff06
push 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
jmp 0x44fe40
push 0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
test eax, eax
je 0x44ff17
jmp 0x44febe
mov esi, ebx
cmp esi, 0xffffffff
mov dword [edi + 0x1c], esi
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push 0x54d22c
push eax
call fcn.004b573a
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push 0x54d22c
push eax
call fcn.004b573a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push 0x54d22c
push eax
call fcn.004b573a
int3

Function at 0x4500d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x450114
push dword [esi + 0x24]
push 0
push dword [esi + 0x28]
call fcn.004b62b0
add esp, 0xc
push 0
push dword [ebp + 0xc]
push dword [esi + 0x24]
push dword [esi + 0x28]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x450125
mov byte [esi + 0x20], 0
pop esi
pop ebp
ret 8
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 0x54d22c
push eax
call fcn.004b573a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 0x54d22c
push eax
call fcn.004b573a
int3
Function at 0x470da0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2058
call fcn.004825c0
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x2000
lea eax, [ebp - 0x2004]
mov esi, ecx
push 0
push eax
call fcn.004b62b0
push 0xfff
push esi
lea eax, [ebp - 0x2004]
push 0x1000
push eax
call fcn.004c0530
add esp, 0x1c
mov dword [ebp - 0x2058], 0x44
lea eax, [ebp - 0x2014]
xorps xmm0, xmm0
movlpd qword [ebp - 0x2054], xmm0
movlpd qword [ebp - 0x204c], xmm0
push eax
lea eax, [ebp - 0x2058]
movlpd qword [ebp - 0x2044], xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2004]
movlpd qword [ebp - 0x203c], xmm0
push eax
push 0
movlpd qword [ebp - 0x2034], xmm0
movlpd qword [ebp - 0x202c], xmm0
movlpd qword [ebp - 0x2024], xmm0
movlpd qword [ebp - 0x201c], xmm0
movups xmmword [ebp - 0x2014], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x470e7a
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482225
mov esp, ebp
pop ebp
ret
push 0x1388
push dword [ebp - 0x2014]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x2014]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2010]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00482225
mov esp, ebp
pop ebp
ret
Function at 0x47d950
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5115c6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x47d9fc
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x47d9fc
call fcn.0047c5a0
mov edi, eax
jmp 0x47db1b
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x47da1f
call fcn.0047c5a0
jmp 0x47db0e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x47da3d
call fcn.0047c5a0
jmp 0x47db0e
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x47da5e
mov edi, 0x8007000e
jmp 0x47db10
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x47db54
jb 0x47da7c
cmp eax, 0xffffffff
ja 0x47db54
cmp eax, 0x400
jbe 0x47da91
push eax
lea ecx, [ebp - 0x418]
call fcn.0047c4c0
jmp 0x47dab7
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x47dab7
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x47dace
mov edi, 0x8007000e
jmp 0x47db10
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x47daee
call fcn.0047c5a0
jmp 0x47db0e
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0047d7b0
mov edi, eax
test esi, esi
je 0x47db1b
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x47db34
lea ecx, [ebp - 0x418]
call fcn.0047c940
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00482225
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00448080
int3
Function at 0x47e340
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x55300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x47e391
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
xorps xmm0, xmm0
push eax
push edi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
call sub.KERNEL32.dll_Thread32First
test eax, eax
jne 0x47e3a6
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482225
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x47e3f6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x18]
cmp ecx, eax
je 0x47e3f6
push ecx
push 0
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x47e391
push esi
test ebx, ebx
je 0x47e3e9
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x47e3ef
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20]
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x47e3b0
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00482225
mov esp, ebp
pop ebp
ret 4
Function at 0x47fbc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x511720
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x55300c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0043c7c0
lea edi, [esi + 8]
mov dword [ebp - 4], 0
push 0x314
mov dword [ebp - 0x14], edi
call fcn.00482265
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x47fc1f
mov ecx, eax
call fcn.00407900
jmp 0x47fc21
xor eax, eax
mov dword [edi], eax
mov dword [esi + 0x1c], 0
xor eax, eax
mov dword [esi + 0x20], 7
mov word [esi + 0xc], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], 0x7ffe795f
mov dword [esi + 0x30], 0x7ffe795f
mov dword [esi + 0x34], eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0047feb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a3eb0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, ecx
push edi
mov edx, dword [esi]
sub ebx, edx
mov eax, dword [esi + 4]
sub eax, edx
sar ebx, 3
sar eax, 3
cmp eax, 0x1fffffff
je 0x4a403d
mov ecx, dword [esi + 8]
lea ebp, [eax + 1]
sub ecx, edx
mov dword [esp + 0x14], ebp
sar ecx, 3
mov eax, 0x1fffffff
mov edx, ecx
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x4a3ef9
mov eax, ebp
jmp 0x4a3f01
lea eax, [edx + ecx]
cmp eax, ebp
cmovb eax, ebp
lea ecx, [eax*8]
mov dword [esp + 0x18], ecx
cmp eax, 0x1fffffff
jbe 0x4a3f18
or ecx, 0xffffffff
jmp 0x4a3f20
cmp ecx, 0x1000
jb 0x4a3f47
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.00482265
add esp, 4
test eax, eax
je 0x4a4038
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4a3f5a
test ecx, ecx
je 0x4a3f58
push ecx
call fcn.00482265
add esp, 4
mov edi, eax
jmp 0x4a3f5a
xor edi, edi
mov ecx, dword [esp + 0x24]
lea edx, [ebx*8]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
mov eax, dword [ecx]
mov dword [edx + edi], eax
mov al, byte [ecx + 4]
mov byte [edx + edi + 4], al
mov ax, word [ecx + 6]
mov word [edx + edi + 6], ax
mov ebp, dword [esi + 4]
mov edx, dword [esi]
cmp ebx, ebp
jne 0x4a4017
cmp edx, ebp
je 0x4a3fbe
mov ebx, edx
lea ecx, [edi + 6]
sub ebx, edi
nop word [eax + eax]
mov eax, dword [edx]
lea ecx, [ecx + 8]
mov dword [ecx - 0xe], eax
mov al, byte [edx + 4]
add edx, 8
mov byte [ecx - 0xa], al
mov ax, word [ebx + ecx - 8]
mov word [ecx - 8], ax
cmp edx, ebp
jne 0x4a3fa0
mov ebp, dword [esp + 0x10]
mov eax, dword [esi]
test eax, eax
je 0x4a3ff4
mov ecx, dword [esi + 8]
sub ecx, eax
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x4a3fea
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a4038
mov eax, edx
push ecx
push eax
call fcn.00481e07
add esp, 8
mov eax, dword [esp + 0x14]
mov dword [esi], edi
lea eax, [edi + eax*8]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x18]
add eax, edi
mov dword [esi + 8], eax
mov eax, dword [esi]
pop edi
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret 8
push edi
push ebx
push edx
mov ecx, esi
call fcn.004a6510
mov ebp, dword [esp + 0x10]
mov ecx, esi
lea eax, [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
push ebx
call fcn.004a6510
jmp 0x4a3fc2
call fcn.004c022b
call fcn.004a6720
int3