joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d33a
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4b47e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [esp + 8]
mov byte [esp + 0x14], 1
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea edx, [esp + 0x24]
push str.Thread:_d____s_n
push edx
call sub.MFC42.DLL_CString::Format_1
mov eax, dword [esp + 0x2c]
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esi + 0x28]
push 0
mov edi, dword [ecx + 0x24]
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esi + 0x28]
push eax
push edi
call fcn.0043f620
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x45f060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x20
mov eax, ecx
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
mov esi, dword [eax - 4]
sub eax, 4
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x3c]
sub eax, 0
je 0x45f159
dec eax
jne 0x45f231
fld qword [ebx + 0x78]
fcomp qword [0x4c5d38]
fnstsw ax
test ah, 1
je 0x45f0e5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
add eax, 8
xor ecx, ecx
xor edi, edi
mov eax, dword [eax]
mov edx, dword [eax - 8]
test edx, edx
jbe 0x45f0c1
movsx ebp, byte [eax + ecx]
add edi, ebp
inc ecx
cmp ecx, edx
jb 0x45f0b6
mov eax, edi
xor edx, edx
mov ecx, 0x2710
mov dword [esp + 0x14], 0
div ecx
mov dword [esp + 0x10], edx
fild qword [esp + 0x10]
fmul qword [0x4c5d30]
fstp qword [ebx + 0x78]
fld qword [esi + 0x78]
fcomp qword [0x4c5d38]
fnstsw ax
test ah, 1
je 0x45f13b
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
add eax, 8
xor ecx, ecx
xor edi, edi
mov eax, dword [eax]
mov edx, dword [eax - 8]
test edx, edx
jbe 0x45f117
movsx ebp, byte [eax + ecx]
add edi, ebp
inc ecx
cmp ecx, edx
jb 0x45f10c
mov eax, edi
xor edx, edx
mov ecx, 0x2710
mov dword [esp + 0x1c], 0
div ecx
mov dword [esp + 0x18], edx
fild qword [esp + 0x18]
fmul qword [0x4c5d30]
fstp qword [esi + 0x78]
fild dword [ebx + 0x70]
fadd qword [ebx + 0x78]
fild dword [esi + 0x70]
fadd qword [esi + 0x78]
fcompp
fnstsw ax
test ah, 0x41
jne 0x45f249
jmp 0x45f21a
fld qword [ebx + 0x78]
fcomp qword [0x4c5d38]
fnstsw ax
test ah, 1
je 0x45f1af
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 8]
add eax, 8
xor ecx, ecx
xor edi, edi
mov eax, dword [eax]
mov edx, dword [eax - 8]
test edx, edx
jbe 0x45f18b
movsx ebp, byte [eax + ecx]
add edi, ebp
inc ecx
cmp ecx, edx
jb 0x45f180
mov eax, edi
xor edx, edx
mov ecx, 0x2710
mov dword [esp + 0x24], 0
div ecx
mov dword [esp + 0x20], edx
fild qword [esp + 0x20]
fmul qword [0x4c5d30]
fstp qword [ebx + 0x78]
fld qword [esi + 0x78]
fcomp qword [0x4c5d38]
fnstsw ax
test ah, 1
je 0x45f205
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 8]
add eax, 8
xor ecx, ecx
xor edi, edi
mov eax, dword [eax]
mov edx, dword [eax - 8]
test edx, edx
jbe 0x45f1e1
movsx ebp, byte [eax + ecx]
add edi, ebp
inc ecx
cmp ecx, edx
jb 0x45f1d6
mov eax, edi
xor edx, edx
mov ecx, 0x2710
mov dword [esp + 0x2c], 0
div ecx
mov dword [esp + 0x28], edx
fild qword [esp + 0x28]
fmul qword [0x4c5d30]
fstp qword [esi + 0x78]
fild dword [ebx + 0x70]
fadd qword [ebx + 0x78]
fild dword [esi + 0x70]
fadd qword [esi + 0x78]
fcompp
fnstsw ax
test ah, 1
je 0x45f23b
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [eax]
mov dword [ecx], edx
mov ecx, eax
mov dword [esp + 0x34], ecx
jmp 0x45f071
pop edi
pop esi
mov dword [ecx], ebx
pop ebp
pop ebx
add esp, 0x20
ret
mov edx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword [edx], ebx
pop ebx
add esp, 0x20
ret
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebp
mov dword [eax], ebx
pop ebx
add esp, 0x20
ret
Function at 0x460a60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b4a79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
lea edi, [esi + 8]
mov dword [esp + 0x1c], 1
mov ecx, edi
call sub.MFC42.DLL_CString::CString_3
lea ebp, [esi + 0xc]
mov byte [esp + 0x1c], 2
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_3
lea ebx, [esi + 0x10]
mov byte [esp + 0x1c], 3
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esi + 0x14]
mov byte [esp + 0x1c], 4
call sub.MFC42.DLL_CString::CString_3
push 0x539050
mov ecx, ebx
mov byte [esp + 0x20], 5
call fcn.0045f6be
lea eax, [esp + 0x28]
lea ecx, [esi + 0x14]
push eax
call sub.MFC42.DLL_CString::operator_3
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 0x1c], ecx
xor ebx, ebx
push 0x519238
lea ecx, [esp + 0x28]
mov dword [esi], edx
mov dword [esi + 0x18], ebx
call sub.MFC42.DLL_CString::TrimLeft_1
push 0x5c
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Left
push eax
mov ecx, ebp
mov byte [esp + 0x20], 6
call sub.MFC42.DLL_CString::operator_3
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1c], 5
call sub.MFC42.DLL_CString::CString
push 0x519238
mov ecx, ebp
call sub.MFC42.DLL_CString::TrimRight_2
mov ecx, dword [esp + 0x24]
push 0x5c
mov ebp, dword [ecx - 8]
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::ReverseFind
sub ebp, eax
lea edx, [esp + 0x2c]
push ebp
push edx
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::Right
push eax
mov ecx, edi
mov byte [esp + 0x20], 7
call sub.MFC42.DLL_CString::operator_3
mov byte [esp + 0x1c], 5
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
push 0x519238
mov ecx, edi
call sub.MFC42.DLL_CString::TrimLeft_1
push 0x519238
mov ecx, edi
call sub.MFC42.DLL_CString::TrimRight_2
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.00460c50
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x460c50
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b4ac8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0xc]
lea edi, [esi + 4]
push edi
push 0x20019
push ebx
push eax
mov eax, dword [esi]
mov dword [esp + 0x28], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x460d36
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push eax
mov eax, dword [edi]
push eax
mov dword [esp + 0x28], ebx
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
lea edx, [esp + 0x10]
mov ebx, eax
mov eax, dword [esi + 8]
push edx
mov edx, dword [edi]
lea ecx, [esp + 0x18]
push ebx
push ecx
push 0
push eax
push edx
call ebp
test eax, eax
push ebx
jne 0x460d25
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString_1
lea ebp, [esi + 0x10]
push eax
mov ecx, ebp
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::operator_3
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
push ebx
call sub.MFC42.DLL_operatordelete
mov eax, dword [edi]
add esp, 4
mov dword [esi + 0x18], 1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
jmp 0x460d3a
call sub.MFC42.DLL_operatordelete
mov ecx, dword [edi]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0x14
push esi
mov esi, dword [esp + 0x30]
mov ecx, esi
call sub.MFC42.DLL_CString::CString_4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4

Function at 0x460d60
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [esi]
lea edi, [esi + 4]
push ecx
push edi
push 0
push 0x20006
push 0
push 0x539050
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x460dbd
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 8]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [edi]
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x460db4
mov dword [esi + 0x18], 1
mov ecx, dword [edi]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ecx
ret
Function at 0x4619e0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x4b4d20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0041c010
add esp, 4
push str.qmacro_
lea ecx, [esp + 0x14]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x30], esi
call sub.MFC42.DLL_operator_3
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.IMAGEHLP.dll_MakeSureDirectoryPathExists]
lea eax, [esp + 0x10]
push str.qdisp.dll
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.MFC42.DLL_operator_3
mov eax, dword [eax]
mov ebp, dword [sym.imp.MSVCRT.dll_fopen]
push 0x519b0c
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x18]
mov edi, eax
call sub.MFC42.DLL_CString::CString
mov ebx, dword [sym.imp.MSVCRT.dll_fputc]
cmp edi, esi
je 0x461a99
xor edx, edx
push edi
mov dl, byte [esi + 0x4c5e28]
xor edx, 0x7d
push edx
call ebx
add esp, 8
inc esi
cmp esi, 0x9000
jb 0x461a74
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
push str.cfgdll.dll
lea eax, [esp + 0x1c]
push 0x53a158
push eax
call sub.MFC42.DLL_operator_3
mov eax, dword [eax]
push 0x519b0c
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x18]
mov edi, eax
call sub.MFC42.DLL_CString::CString
test edi, edi
je 0x461af0
xor esi, esi
xor ecx, ecx
push edi
mov cl, byte [esi + 0x4cee28]
xor ecx, 0x7d
push ecx
call ebx
add esp, 8
inc esi
cmp esi, 0xe718
jb 0x461acb
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x461b20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov cl, byte [eax + 0x4dd540]
xor cl, 0x7d
mov byte [eax + 0x559c5c], cl
inc eax
cmp eax, 0x6865
jb 0x461b22
mov eax, 0x559c5c
ret
Function at 0x461b90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b4d59
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
lea esi, [edi + 4]
mov ecx, esi
mov dword [esp + 0x14], esi
call sub.MFC42.DLL_CString::CString_3
xor ebx, ebx
lea ecx, [esi + 4]
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::CString_3
mov al, byte [esp + 0x28]
mov cl, byte [esp + 0x28]
mov byte [esi + 0xc], al
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x1c], cl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
lea ebx, [edi + 0x3c]
push 0xa
mov ecx, ebx
mov dword [esp + 0x24], 1
call fcn.004aa396
lea ebp, [edi + 0x58]
push 0xa
mov ecx, ebp
mov byte [esp + 0x24], 2
call sub.MFC42.DLL_CMapStringToString::CMapStringToString
mov edx, dword [esp + 0x28]
push 0x53a538
push edx
mov ecx, esi
mov byte [esp + 0x28], 3
mov dword [edi], 0x4e3da8
call fcn.00428050
push 1
push 0x1000
mov ecx, ebx
call sub.MFC42.DLL_CMapStringToOb::InitHashTable
push 1
push 0x1000
mov ecx, ebp
call sub.MFC42.DLL_CMapStringToString::InitHashTable
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x539050
call sub.MFC42.DLL_CString::CString_1
push esi
mov ecx, edi
call fcn.00461f50
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4

Function at 0x462410
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.NtProtectVirtualMemory
push str.NTDLL.DLL
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ZwDeviceIoControlFile
push str.NTDLL.DLL
mov ebx, eax
call esi
push eax
call edi
push 0
push ebx
mov esi, eax
call fcn.004624e0
push 1
push esi
call fcn.004624e0
mov eax, dword [sym.imp.USER32.dll_SetCursorPos]
push 2
push eax
call fcn.004624e0
mov ecx, dword [sym.imp.USER32.dll_SendInput]
push 3
push ecx
call fcn.004624e0
mov edx, dword [sym.imp.USER32.dll_GetCursorPos]
push 4
push edx
call fcn.004624e0
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
push 5
push eax
call fcn.004624e0
mov ecx, dword [sym.imp.GDI32.dll_GetDIBits]
push 6
push ecx
call fcn.004624e0
mov edx, dword [sym.imp.GDI32.dll_BitBlt]
push 7
push edx
call fcn.004624e0
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
add esp, 0x40
push 8
push eax
call fcn.004624e0
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x400
push 0x5604f8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4637d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call esi
mov bx, word [esp + 0xc]
mov cl, bl
sar eax, 0xf
shr cl, 2
and eax, 1
and ecx, 1
xor eax, ecx
test ax, ax
je 0x4637fb
pop esi
xor eax, eax
pop ebx
ret
push 0x11
call esi
mov dl, bl
sar eax, 0xf
shr dl, 1
and eax, 1
and edx, 1
xor eax, edx
test ax, ax
je 0x463818
pop esi
xor eax, eax
pop ebx
ret
push 0x10
call esi
sar eax, 0xf
and eax, 0xffff
and ebx, 0xffff
not eax
xor eax, ebx
pop esi
and eax, 1
pop ebx
ret

Function at 0x464890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b5058
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x4e3ec0
mov eax, dword [esi + 0x2c]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x4648ca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x2c], edi
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x4648da
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [esi + 0x28], edi
mov eax, dword [esi + 0x24]
cmp eax, edi
je 0x4648ea
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esi + 0x24], edi
mov edx, dword [esi + 0x34]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esi + 0x30]
push eax
call edi
mov ecx, esi
call fcn.00463960
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00463960
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x466080
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 4]
push 1
push eax
call edi
mov ecx, dword [esi + 4]
push 2
push ecx
mov dword [esi + 0x18], eax
call edi
mov edx, dword [esi + 4]
push 4
push edx
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov eax, dword [esi + 4]
push 5
push eax
call edi
mov ecx, dword [esi + 4]
push 6
push ecx
mov dword [esi + 0x24], eax
call edi
mov edx, dword [esi + 4]
push 7
push edx
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x34], eax
mov eax, dword [esi + 4]
push 9
push eax
call edi
mov ecx, dword [esi + 4]
push 0xa
push ecx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
pop edi
pop esi
ret
Function at 0x467d10
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x24c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x18]
push ebx
xor eax, eax
push ecx
lea edx, [esp + 0x1c]
push 4
mov dword [esp + 0x30], eax
push edx
push ebx
mov dword [esp + 0x3c], eax
push ebx
push 0x80022054
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], eax
mov dword [esp + 0x30], ebx
call fcn.00462310
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x467d64
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
push str.win32k.sys
call fcn.004680c0
add esp, 4
cmp eax, ebx
mov dword [esp + 0x1c], eax
jne 0x467d86
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24c
ret
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x5c]
push 0x200
push ecx
sub ebp, eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x467dab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret
mov edi, str._system32win32k.sys
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.dummy.dat
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push 0x53a158
rep movsb byte es:[edi], byte [esi]
push eax
call sub.MFC42.DLL_operator_3
mov ecx, dword [eax]
push ebx
lea edx, [esp + 0x60]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
push str.dummy.dat
lea eax, [esp + 0x14]
push 0x53a158
push eax
call sub.MFC42.DLL_operator_3
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 0x10]
mov ebx, eax
call sub.MFC42.DLL_CString::CString
test ebx, ebx
jne 0x467e3e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24c
ret
mov ecx, dword [esp + 0x260]
lea edx, [ebx + ecx*4 - 0x4000]
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov eax, dword [edx + ebp]
mov edx, dword [ecx + 0x34]
mov ecx, dword [esp + 0x1c]
sub eax, edx
xor edi, edi
lea ebp, [eax + ecx]
lea esi, [eax + ebx]
lea edx, [esi + edi]
push edx
call fcn.00466c50
add edi, eax
add esp, 4
cmp edi, 5
jl 0x467e65
mov eax, dword [esp + 0x264]
test eax, eax
jne 0x467e8a
mov eax, dword [esp + 0x260]
mov ecx, edi
mov dword [esp + 0x58], edi
mov edx, ecx
lea edi, [esp + 0x38]
shr ecx, 2
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x28]
push 0x10
push ecx
lea edx, [esp + 0x40]
push 0x2c
push edx
push 0x80022050
call fcn.00462310
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x24c
ret
Function at 0x468120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 4], eax
lea edi, [ecx + ecx + 2]
push edi
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x468159
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ebx
push esi
call dword [sym.imp.MSVCRT.dll_mbstowcs]
push esi
call dword [sym.imp.MSVCRT.dll__wcslwr]
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp + 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
cmp ecx, 1
mov eax, dword [eax + 0xc]
lea edx, [eax + 0xc]
mov dword [ebp + 8], edx
jne 0x46819a
mov ebx, dword [edx]
mov dword [ebp + 8], edx
jmp 0x4681c0
cmp ecx, 2
jne 0x4681ab
add eax, 0x14
mov edx, eax
mov dword [ebp + 8], eax
mov ebx, dword [edx]
jmp 0x4681c0
cmp ecx, 3
jne 0x4681b6
add eax, 0x1c
mov dword [ebp + 8], eax
mov edx, dword [ebp + 8]
mov ebx, dword [edx]
jmp 0x4681c0
mov ecx, dword [ebp + 0xc]
mov esi, ebx
lea eax, [ecx*8]
sub esi, eax
mov ecx, 0x12
add esi, 8
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x250]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.MSVCRT.dll__wcslwr]
mov ecx, dword [ebp - 8]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 0x14
test eax, eax
je 0x46821e
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 4], 1
mov dword [edx], eax
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [ecx + 4], edx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x50]
cmp eax, 1
je 0x46823b
cmp eax, 2
jne 0x468233
mov ebx, dword [ebp - 0x48]
jmp 0x46823b
cmp eax, 3
jne 0x46823b
mov ebx, dword [ebp - 0x40]
cmp ebx, dword [ebp + 8]
jne 0x4681bd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468730
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebp, dword [esp + 0x34]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
push 2
push ecx
push edx
call fcn.004aa640
push 0
push 0x3e8
push edx
push eax
call fcn.004aa590
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x20], edx
call esi
push 0
call edi
lea ecx, [esp + 0x20]
push ecx
call esi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x24]
sbb eax, edx
mov edx, dword [esp + 0x1c]
cmp eax, edx
jl 0x468796
jg 0x4687c5
cmp ecx, dword [esp + 0x18]
jb 0x468796
call fcn.00462310
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push 1
push ecx
push 0x64
mov ecx, eax
call dword [edx + 8]
test dword [esp + 0x10], ebp
je 0x4687f5
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [esp + 0x14]
cmp eax, 0x7d0
jb 0x46875f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4