joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b164
Capabilities:
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4912b2
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x4b14c4]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push esi
push edi
mov eax, dword [0x4b14c4]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
push str.Software
lea eax, [esp + 0x3c]
call fcn.00401556
mov ebx, 0x49f164
xor esi, esi
push ebx
mov dword [esp + 0xbc], esi
call fcn.0047519c
pop ecx
mov edi, eax
push ebx
lea eax, [esp + 0x3c]
call fcn.00406553
cmp dword [esp + 0x4c], 8
mov eax, dword [esp + 0x38]
jae 0x41b1e9
lea eax, [esp + 0x38]
lea ecx, [esp + 0x18]
push ecx
mov ebx, 0xf003f
push ebx
push esi
push eax
mov edi, 0x80000001
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x41b229
cmp dword [esp + 0x4c], 8
mov eax, dword [esp + 0x38]
jae 0x41b216
lea eax, [esp + 0x38]
push esi
lea ecx, [esp + 0x1c]
push ecx
push esi
push ebx
push esi
push esi
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x41b33d
mov ecx, dword [esp + 0x14]
lea ebx, [esp + 0x1c]
call fcn.0041a468
mov byte [esp + 0xb8], 1
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x1c]
push 0x1c
cdq
pop ecx
idiv ecx
mov dword [esp + 0x14], esi
test eax, eax
je 0x41b334
xor ebx, ebx
jmp 0x41b266
xor esi, esi
lea eax, [esp + 0x2c]
push eax
call fcn.004798cc
push dword [esp + 0x34]
lea ecx, [esp + 0x78]
push dword [esp + 0x34]
call fcn.0041ae7e
mov byte [esp + 0xc4], 2
mov eax, dword [esp + 0x28]
lea edi, [ebx + eax]
lea eax, [esp + 0x60]
push 0x49f16c
push eax
call fcn.0041024b
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x88]
mov byte [esp + 0xd0], 3
call fcn.0041acf8
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x41b2c6
mov eax, dword [eax]
cmp dword [esp + 0x68], 8
mov ecx, dword [esp + 0x54]
jae 0x41b2d5
lea ecx, [esp + 0x54]
push 0x64
push eax
push 1
push esi
push ecx
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
xor edi, edi
lea esi, [esp + 0x90]
call fcn.0040162a
push 1
lea esi, [esp + 0x58]
call fcn.0040162a
push edi
push 1
lea ecx, [esp + 0x78]
mov byte [esp + 0xc0], 1
call fcn.00406268
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x1c]
push 0x1c
cdq
pop ecx
idiv ecx
inc dword [esp + 0x14]
add ebx, 0x1c
cmp dword [esp + 0x14], eax
jb 0x41b264
lea esi, [esp + 0x1c]
call fcn.00406513
push 1
xor edi, edi
lea esi, [esp + 0x3c]
call fcn.0040162a
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00474c58
mov esp, ebp
pop ebp
ret
Function at 0x41bf8e
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x468
mov eax, 0x48ed33
call fcn.0047ae8f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x444], eax
xor eax, eax
push 0x206
mov word [ebp - 0x224], ax
xor esi, esi
lea eax, [ebp - 0x222]
push esi
push eax
mov ebx, ecx
call fcn.00474d90
add esp, 0xc
mov dword [ebp - 4], esi
cmp dword [ebx + 0x14], 8
mov dword [ebp - 0x450], 0x104
mov dword [ebp - 0x44c], esi
jb 0x41bfe5
mov eax, dword [ebx]
jmp 0x41bfe7
mov eax, ebx
lea ecx, [ebp - 0x448]
push ecx
push 0x20019
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
mov edi, 0x80000002
push edi
call esi
test eax, eax
je 0x41c029
cmp dword [ebx + 0x14], 8
jb 0x41c00f
mov ebx, dword [ebx]
lea eax, [ebp - 0x448]
push eax
push 0x20119
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x41c159
mov ebx, dword [ebp - 0x444]
push 0x49bf80
mov esi, ebx
call fcn.00401c1b
pop ecx
test al, al
je 0x41c047
mov al, 1
jmp 0x41c15b
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x44c]
push eax
xor esi, esi
push esi
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x44c], esi
jbe 0x41c159
mov dword [ebp - 0x444], esi
mov eax, dword [ebp - 0x444]
cmp eax, dword [ebp - 0x44c]
jae 0x41c159
lea eax, [ebp - 0x460]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x444]
mov dword [ebp - 0x454], 0xff
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x41c148
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x440]
call fcn.00401556
cmp dword [ebx + 0x14], 8
mov ecx, dword [ebx + 0x10]
jb 0x41c117
mov eax, dword [ebx]
jmp 0x41c119
mov eax, ebx
push ecx
push eax
xor eax, eax
lea ecx, [ebp - 0x440]
call fcn.004062f4
xor edi, edi
push 1
lea esi, [ebp - 0x440]
cmp eax, 0xffffffff
je 0x41c141
call fcn.0040162a
jmp 0x41c040
call fcn.0040162a
xor esi, esi
inc dword [ebp - 0x444]
jmp 0x41c0ae
xor al, al
call fcn.0047aeeb
ret
Function at 0x41c268
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49012c
mov eax, dword fs:[0]
push eax
sub esp, 0x538
mov eax, dword [0x4b14c4]
xor eax, esp
mov dword [esp + 0x530], eax
push ebx
push esi
push edi
mov eax, dword [0x4b14c4]
xor eax, esp
push eax
lea eax, [esp + 0x548]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
xor ebx, ebx
push str.TEhA
lea eax, [esp + 0xe8]
mov dword [esp + 0x2c], ebx
call fcn.00401556
lea eax, [esp + 0xe4]
push eax
mov dword [esp + 0x554], ebx
call fcn.00404533
mov ecx, eax
lea eax, [esp + 0x104]
call fcn.00404573
push str.1955
mov esi, eax
mov byte [esp + 0x554], 1
call fcn.00401c1b
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x104]
mov byte [esp + 0x1b], al
call fcn.0040162a
or dword [esp + 0x550], 0xffffffff
push 1
lea esi, [esp + 0xe8]
call fcn.0040162a
cmp byte [esp + 0x17], bl
je 0x41c42e
xor eax, eax
mov esi, 0x208
push esi
mov word [esp + 0x330], ax
lea eax, [esp + 0x332]
push ebx
push eax
call fcn.00474d90
add esp, 0xc
xor eax, eax
push esi
mov word [esp + 0x120], ax
lea eax, [esp + 0x122]
push ebx
push eax
call fcn.00474d90
add esp, 0xc
mov eax, 0x105
push eax
lea ecx, [esp + 0x120]
push ecx
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push eax
lea eax, [esp + 0x344]
push eax
push 0x49f260
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x41c42e
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
push eax
call fcn.0041db22
push esi
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x558], 2
call fcn.00411ffd
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x30]
call fcn.0041dbcb
mov esi, dword [esp + 0x18]
lea ebx, [esp + 0xc8]
mov byte [esp + 0x550], 3
call fcn.00406bcb
push 1
mov esi, ebx
call fcn.0040162a
or dword [esp + 0x550], 0xffffffff
lea ecx, [esp + 0x7c]
call fcn.0041db8c
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0x80], vtable.std::ios_base.0
call fcn.00474a58
pop ecx
jmp 0x41c43c
mov eax, dword [esp + 0x18]
push 0x49bf80
call fcn.00401556
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x548]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x530]
xor ecx, esp
call fcn.00474c58
mov esp, ebp
pop ebp
ret
Function at 0x41cb42
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x491148
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4b14c4]
xor eax, esp
mov dword [esp + 0xa0], eax
push ebx
push esi
push edi
mov eax, dword [0x4b14c4]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
push str.T25ia3ddbWFVWkk
lea eax, [esp + 0x60]
call fcn.00401556
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
lea ecx, [esp + 0x60]
mov dword [esp + 0xc4], ebx
call fcn.0041fe3a
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x60]
mov byte [esp + 0xc4], 2
call fcn.0040162a
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x41cbd3
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
mov edi, 0xf003f
push edi
push ebx
push eax
mov esi, 0x80000001
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x41cc13
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x41cc00
lea eax, [esp + 0x24]
push ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
push edi
push ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x41ccc3
lea eax, [esp + 0x1c]
push eax
call fcn.004798cc
pop ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x7c]
push dword [esp + 0x20]
call fcn.0041ae7e
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x48]
push 0x49f334
push eax
mov byte [esp + 0xd0], 3
call fcn.0041024b
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x8c]
mov byte [esp + 0xd4], 4
call fcn.0041acf8
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x41cc79
mov eax, dword [eax]
cmp dword [esp + 0x54], 8
mov ecx, dword [esp + 0x40]
jae 0x41cc88
lea ecx, [esp + 0x40]
push 0x64
push eax
push 1
push ebx
push ecx
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 1
xor edi, edi
lea esi, [esp + 0x98]
call fcn.0040162a
push 1
lea esi, [esp + 0x44]
call fcn.0040162a
push ebx
push 1
lea ecx, [esp + 0x80]
call fcn.00406268
push 1
xor edi, edi
lea esi, [esp + 0x28]
call fcn.0040162a
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00474c58
mov esp, ebp
pop ebp
ret
Function at 0x423240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4b69c0], eax
cmp eax, esi
jne 0x42325e
xor eax, eax
jmp 0x42328b
push edi
lea eax, [ebp - 4]
push eax
push esi
push 0x4b6990
push 0x42328e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
jne 0x423288
push dword [0x4b69c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x428805
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
cmp dword [ebp + 8], eax
jle 0x42882e
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x498868]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [ebp + 8]
cmp dword [ebp + 8], 0
jg 0x428810
pop esi
pop ebp
ret

Function at 0x42da85
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [edi + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, eax
mov dword [ebp - 4], ebx
cmp dword [edx], ebx
jne 0x42dabe
mov eax, dword [edi + 0x78]
mov ecx, dword [edi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
push edx
push ebx
push ecx
call dword [ecx + 0x18]
add esp, 0x14
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x42db94
mov ecx, dword [edi + 0x18]
cmp ecx, dword [edi + 0x24]
jbe 0x42daf8
mov eax, dword [edi + 0x80]
push ebx
cdq
push ecx
push edx
push eax
call fcn.004831e0
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x3c]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x28]
mov eax, dword [edi + 0x18]
add esp, 0xc
mov dword [edi + 0x24], eax
jmp 0x42daf8
xor ebx, ebx
cmp esi, ebx
je 0x42db94
mov ebx, dword [esi + 0x14]
cmp ebx, dword [edi + 0x18]
ja 0x42db87
test byte [esi + 0x18], 0x20
jne 0x42db87
mov eax, dword [edi + 0x80]
cdq
push edx
push eax
lea ecx, [ebx - 1]
push 0
push ecx
call fcn.004831e0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp ebx, 1
jne 0x42db32
call fcn.0042d1a6
push dword [ebp - 0xc]
mov eax, dword [esi + 4]
push dword [ebp - 0x10]
mov dword [ebp - 8], eax
push dword [edi + 0x80]
push eax
mov eax, dword [edi + 0x3c]
call fcn.00425411
add esp, 0x10
mov dword [ebp - 4], eax
cmp ebx, 1
jne 0x42db6d
mov eax, dword [ebp - 8]
add eax, 0x18
push 0x10
push eax
lea eax, [edi + 0x64]
push eax
call fcn.004751c0
add esp, 0xc
cmp ebx, dword [edi + 0x20]
jbe 0x42db75
mov dword [edi + 0x20], ebx
inc dword [edi + 0xa8]
push dword [esi + 4]
mov eax, dword [edi + 0x58]
call fcn.00437fbe
pop ecx
cmp dword [ebp - 4], 0
mov esi, dword [esi + 0xc]
je 0x42daf6
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x46a3ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [esi + 0x94], 0
je 0x46a40f
cmp dword [esi + 0x98], 0
jbe 0x46a40f
and dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x46a3cf
mov eax, dword [eax]
push 0x4a4c0c
push eax
lea eax, [ebp - 4]
push eax
call fcn.0047a4e1
add esp, 0xc
test eax, eax
jne 0x46a40f
cmp dword [ebp - 4], eax
je 0x46a40f
push dword [ebp - 4]
push 1
push dword [esi + 0x98]
push dword [esi + 0x94]
call fcn.004788bb
push dword [ebp - 4]
call fcn.00478e2f
add esp, 0x14
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x46b556
Capabilities:
Delete file

Disassembly:
push 0xc0
mov eax, 0x49329b
call fcn.0047ae59
mov eax, dword [ebp + 8]
mov dword [ebp - 0xcc], eax
lea eax, [ebp + 0x4c]
xor ebx, ebx
push eax
lea esi, [ebp - 0x80]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc8], ebx
call fcn.00405b15
push 0x49c154
lea esi, [ebp + 0x1b8]
mov byte [ebp - 4], 1
call fcn.00401c1b
test al, al
lea eax, [ebp - 0x2c]
setne byte [ebp - 0xc4]
mov dword [esp], str.RU1PS0FIR1s9QzxRRg
call fcn.00401556
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 2
call fcn.00404533
mov ecx, eax
lea eax, [ebp - 0x9c]
call fcn.00404573
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0040162a
fldz
push 0x49f200
fstp dword [ebp - 0xc0]
lea esi, [ebp - 0x9c]
call fcn.00401c1b
pop ecx
test al, al
jne 0x46b634
call fcn.004799ad
push ebx
push dword [ebp - 0xc4]
lea edx, [ebp - 0x80]
lea ecx, [ebp + 0x68]
mov esi, eax
call fcn.00414ca7
pop ecx
pop ecx
mov dword [ebp - 0xc8], eax
call fcn.004799ad
sub eax, esi
mov dword [ebp - 0xbc], eax
fild dword [ebp - 0xbc]
fstp dword [ebp - 0xc0]
jmp 0x46b64b
fld dword [0x4a51a0]
push 0x2710
fstp dword [ebp + 0x328]
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x2c]
push ebx
push eax
mov dword [ebp - 0xbc], ebx
call fcn.00419564
pop ecx
pop ecx
test al, al
jne 0x46b66f
push 3
pop eax
mov dword [ebp - 0xbc], eax
mov dword [ebp + 0x2c], eax
jmp 0x46b67b
mov eax, dword [ebp - 0xcc]
inc dword [eax + 0x3c0]
push str.a2ViXHJlXw
lea eax, [ebp - 0x64]
call fcn.00401556
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.0041fe3a
lea ecx, [ebp + 0x30]
push ecx
mov edx, eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.0041abc7
pop ecx
pop ecx
push 1
xor edi, edi
lea esi, [ebp - 0xb8]
call fcn.0040162a
push 1
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 9
call fcn.0040162a
push 0x49cb24
lea esi, [ebp + 0x260]
call fcn.00401c1b
pop ecx
test al, al
jne 0x46b6ee
push 0xffffffffffffffff
push ebx
mov eax, esi
lea ecx, [ebp - 0x48]
call fcn.00401590
push dword [ebp - 0xc8]
fld dword [ebp - 0xc0]
push ebx
push dword [ebp + 0x32c]
call fcn.0048e340
fld dword [ebp + 0x328]
push eax
call fcn.0048e340
push eax
lea eax, [ebp + 0x19c]
push eax
push dword [ebp + 0x28]
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0xbc]
lea eax, [ebp + 0x110]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0041592c
add esp, 0x2c
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.0040162a
cmp byte [ebp - 0xc4], bl
je 0x46b761
cmp dword [ebp + 0x7c], 8
mov eax, dword [ebp + 0x68]
jae 0x46b75a
lea eax, [ebp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040162a
push 1
lea esi, [ebp - 0x9c]
call fcn.0040162a
push 1
lea esi, [ebp - 0x80]
call fcn.0040162a
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0xc]
push eax
call fcn.00410ffe
call fcn.0047aedc
ret 0x328
Function at 0x46c7b4
Capabilities:
Accept command line arguments

Disassembly:
push 0x2b4
mov eax, 0x490559
call fcn.0047ae59
cmp byte [ecx + 4], 0
jne 0x46c937
xor ebx, ebx
inc ebx
mov byte [ecx + 4], bl
call fcn.0046b7f2
lea ecx, [ebp - 0x234]
call fcn.00419284
and dword [ebp - 4], 0
mov esi, 0x49e094
push esi
call fcn.0047519c
pop ecx
mov edi, eax
push esi
lea eax, [ebp - 0x234]
call fcn.00406553
push 0x4a4d14
lea eax, [ebp - 0x288]
call fcn.00401556
lea eax, [ebp - 0x288]
push eax
mov byte [ebp - 4], bl
call fcn.00404533
mov ecx, eax
lea eax, [ebp - 0x2a4]
call fcn.00404573
push str..lnk
push eax
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 2
call fcn.004102a7
pop ecx
pop ecx
push 0
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x234]
mov byte [ebp - 4], 3
call fcn.00406680
push ebx
xor edi, edi
lea esi, [ebp - 0x2c0]
call fcn.0040162a
push ebx
lea esi, [ebp - 0x2a4]
call fcn.0040162a
push ebx
lea esi, [ebp - 0x288]
mov byte [ebp - 4], 0
call fcn.0040162a
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [0x4b4fc4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x26c]
call fcn.00401556
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [ebp - 0x250]
call fcn.00401556
mov byte [ebp - 4], 5
cmp dword [ebp - 0x23c], 8
mov edx, dword [ebp - 0x250]
jae 0x46c8dc
lea edx, [ebp - 0x250]
cmp dword [ebp - 0x220], 8
mov ecx, dword [ebp - 0x234]
jae 0x46c8f1
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x258], 8
mov eax, dword [ebp - 0x26c]
jae 0x46c906
lea eax, [ebp - 0x26c]
push edx
push ecx
push eax
call fcn.00419206
add esp, 0xc
push ebx
xor edi, edi
lea esi, [ebp - 0x250]
call fcn.0040162a
push ebx
lea esi, [ebp - 0x26c]
call fcn.0040162a
push ebx
lea esi, [ebp - 0x234]
call fcn.0040162a
call fcn.0047aedc
ret
Function at 0x473bd1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4b4ff8], 0
push esi
push edi
jne 0x473b47
call fcn.00473ab3
test eax, eax
je 0x473b8c
mov eax, dword [0x4b4ff8]
cmp eax, 1
jne 0x473b68
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x473b8c
jmp 0x473bce
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x473bce
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x473b90
xor eax, eax
jmp 0x473bce
mov eax, dword [esi]
push dword [0x4b4ff8]
call edi
mov edi, eax
test edi, edi
je 0x473bb2
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x473bce
lea edi, [esi + 0xff0]
push esi
push dword [0x4b4ff8]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x473bb8
mov eax, esi
pop edi
pop esi
ret
jmp 0x473b33

Function at 0x474c58
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b14c4]
jne 0x474c62
repz ret
jmp fcn.0047d1fc
Function at 0x487c08
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b14c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047e696
and dword [ebp - 0x14], 0
cmp dword [0x4b60e0], 0
mov dword [ebp - 0x18], eax
jne 0x487cbb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x487d63
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49835c
push ebx
call edi
test eax, eax
je 0x487d63
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4b60e0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4b60e4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4b60e8], eax
call edi
push eax
call esi
mov dword [0x4b60f0], eax
test eax, eax
je 0x487cbb
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4b60ec], eax
mov eax, dword [0x4b60ec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x487d14
cmp dword [0x4b60f0], ecx
je 0x487d14
push eax
call esi
push dword [0x4b60f0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x487d14
test ebx, ebx
je 0x487d14
call edi
test eax, eax
je 0x487d0b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x487d0b
test byte [ebp - 8], 1
jne 0x487d14
or dword [ebp + 0x10], 0x200000
jmp 0x487d47
mov eax, dword [0x4b60e4]
cmp eax, dword [ebp - 0x18]
je 0x487d47
push eax
call esi
test eax, eax
je 0x487d47
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x487d47
mov eax, dword [0x4b60e8]
cmp eax, dword [ebp - 0x18]
je 0x487d47
push eax
call esi
test eax, eax
je 0x487d47
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4b60e0]
call esi
test eax, eax
je 0x487d63
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x487d65
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00474c58
leave
ret
Function at 0x401850
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 8
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401880
push str._addattr____malloc___
call dword [sym.imp.MSVCR90.dll_perror]
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
push 0x3d
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4018bc
mov ecx, dword [ebp + 0xc]
push ecx
push str.Invalid_argument_specification:__s_n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 0xc
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov edx, dword [ebp - 4]
mov byte [edx], 0
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.MSVCR90.dll__strdup]
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x4018fb
push 0x40435c
call dword [sym.imp.MSVCR90.dll_perror]
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.MSVCR90.dll__strdup]
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
jne 0x40192d
push str._addattr____strdup___
call dword [sym.imp.MSVCR90.dll_perror]
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004010c0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x401950
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll__strdup]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401980
push str._addnode____strdup___
call dword [sym.imp.MSVCR90.dll_perror]
add esp, 4
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004010c0
add esp, 8
mov esp, ebp
pop ebp
ret