joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4131b0
Capabilities:
Hide graphical window

Disassembly:
push esi
call fcn.004218e0
test al, al
push 0
je 0x4131fe
mov eax, dword [0x51ce2c]
push eax
push 0
push 0
push 0
push Ordinal_2
push 0
push Ordinal_2
push Ordinal_2
push str.Generic_Window
push 0x4e42f8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x51ce28], esi
pop esi
ret
mov ecx, dword [0x51ce2c]
push ecx
push 0
push 0
push 0
push Ordinal_2
push 0
push Ordinal_2
push Ordinal_2
push 0x4e42e8
push 0x4e42e4
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x51ce28], esi
pop esi
ret

Function at 0x413640
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4902d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ecx
mov dword [ecx], ebx
mov ebp, dword [esp + 0x5c]
mov edi, dword [esp + 0x58]
mov eax, ebp
mov dword [esp + 0x50], ebx
mov dword [0x51ce2c], edi
lea edx, [eax + 1]
jmp 0x413680
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x413680
sub eax, edx
mov esi, eax
je 0x413703
lea eax, [esi + esi + 2]
push eax
call fcn.00487074
add esp, 4
mov edi, eax
mov ecx, ebp
mov edi, edi
movsx dx, byte [ecx]
mov word [eax], dx
add eax, 2
inc ecx
dec esi
jne 0x4136a0
mov word [eax], bx
lea eax, [esp + 0x5c]
push edi
push eax
call fcn.00412db0
add esp, 8
mov esi, eax
mov ecx, dword [esi]
cmp ecx, ebx
mov byte [esp + 0x50], 1
je 0x4136d0
mov edx, dword [ecx]
call dword [edx]
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebp]
cmp ecx, ebx
je 0x4136e0
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esi]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x5c]
cmp ecx, ebx
mov byte [esp + 0x50], bl
je 0x4136f6
mov edx, dword [ecx]
call dword [edx + 4]
push edi
call fcn.004879ad
mov edi, dword [esp + 0x5c]
add esp, 4
push 0x10
push 1
push edi
mov word [0x51ce20], bx
mov word [0x51ce22], bx
mov word [0x51ce24], bx
mov word [0x51ce26], bx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebp, eax
cmp ebp, ebx
je 0x41379d
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp word [eax + 6], bx
lea esi, [eax + 6]
je 0x413750
add esi, 2
cmp word [esi], bx
jne 0x413748
add esi, 2
mov ecx, esi
sub ecx, eax
test cl, 2
je 0x41375f
add esi, 2
mov ecx, 0xd
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov edx, eax
mov word [0x51ce22], ax
mov eax, dword [esp + 0x20]
mov ecx, eax
shr edx, 0x10
shr ecx, 0x10
push ebp
mov word [0x51ce20], dx
mov word [0x51ce24], cx
mov word [0x51ce26], ax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 8
Function at 0x41d070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x491489
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], ebx
mov dword [esi], 0x4e4a10
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
lea edi, [esi + 0x2c]
mov ecx, edi
mov byte [esp + 0x28], 0xe
call fcn.0042f620
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x6c], ebx
lea ecx, [esi + 0x90]
mov byte [esp + 0x28], 0x15
call fcn.0041fe50
mov edi, dword [esp + 0x30]
cmp edi, ebx
mov byte [esp + 0x28], 0x16
je 0x41d10a
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x41d116
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [esi + 0x24], edi
mov edi, dword [esp + 0x40]
cmp edi, ebx
je 0x41d127
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov ecx, dword [esi + 0x1c]
cmp ecx, ebx
je 0x41d133
mov edx, dword [ecx]
call dword [edx + 4]
mov ebp, dword [esp + 0x38]
push ecx
mov eax, esp
mov dword [esi + 0x1c], edi
mov ecx, esi
mov dword [esp + 0x20], esp
mov dword [eax], ebp
call fcn.0041ccf0
push ecx
mov ecx, dword [esp + 0x38]
mov eax, esp
mov dword [eax], ecx
mov ecx, esi
mov dword [esp + 0x20], esp
call fcn.0041c810
mov ecx, dword [esi + 0x3c]
lea edx, [esp + 0x10]
push edx
call fcn.004172c0
mov edi, eax
mov ecx, dword [edi]
cmp ecx, ebx
mov byte [esp + 0x28], 0x17
je 0x41d17c
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [esi + 0x6c]
cmp ecx, ebx
je 0x41d188
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
mov eax, dword [edi]
mov dword [esi + 0x6c], eax
mov byte [esp + 0x28], 0x16
je 0x41d19f
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + 0x1c]
mov eax, dword [esp + 0x40]
cmp byte [eax + 5], bl
je 0x41d1d3
push ecx
mov ecx, dword [esi + 0x6c]
mov eax, esp
mov dword [eax], ecx
mov edx, dword [ebp]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], esp
push eax
mov ecx, ebp
call dword [edx + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov edx, 1
jmp 0x41d1d9
mov dl, byte [esp + 0x14]
xor eax, eax
push eax
mov ecx, esi
call fcn.00416930
test dl, 1
je 0x41d1f3
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
je 0x41d1f3
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, esi
call fcn.004172f0
mov eax, dword [esi + 0x90]
lea ecx, [esi + 0x90]
push edi
call dword [eax]
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x41d222
push edi
push ecx
mov ecx, esp
mov dword [ecx], eax
mov ecx, esi
mov dword [esp + 0x24], esp
call fcn.00418460
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 0x14
Function at 0x421820
Capabilities:
Log keystrokes via application hook

Disassembly:
mov eax, dword [0x51d184]
test eax, eax
je 0x42183a
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x51d184], 0
push 0
call fcn.00413570
push eax
push 0x421790
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x51d184], eax
ret
Function at 0x423610
Capabilities:
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e5ad0
push 0x487e88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x160
mov eax, dword [0x51bdec]
xor eax, dword [ebp + 4]
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x38]
mov dword [ebp - 0x44], ebx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x48], ecx
mov esi, dword [ebp + 8]
cmp ebx, dword [ebp - 0x48]
jae 0x423780
push 0x1c
lea edx, [ebp - 0x64]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x423780
mov eax, dword [ebp - 0x54]
cmp eax, 0x1000
je 0x423697
cmp eax, 0x2000
jne 0x423763
cmp dword [ebp - 0x4c], 0x1000000
jne 0x423763
push 0x104
lea eax, [ebp - 0x168]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x423763
push str.Module
mov ecx, esi
call fcn.00421c50
call fcn.00421b60
call fcn.00421b30
push str.BaseAddress
call fcn.00421ab0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00421a30
call fcn.00421b10
call fcn.00421b60
call fcn.00421b30
push str.File
call fcn.00421ab0
lea eax, [ebp - 0x168]
push eax
call fcn.00421a00
call fcn.00421b10
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x16c], eax
cmp word [eax], 0x5a4d
jne 0x42375c
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [ebp - 0x170], edi
cmp dword [edi], 0x4550
jne 0x42375c
call fcn.00421b60
call fcn.00421b30
push str.TimeStamp
call fcn.00421ab0
mov ecx, dword [edi + 8]
push ecx
mov ecx, esi
call fcn.00421a30
call fcn.00421b10
mov ecx, esi
call fcn.00421cc0
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x42376d
mov eax, dword [ebp - 0x24]
add ebx, eax
mov dword [ebp - 0x44], ebx
jmp 0x423664
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, dword [ebp + 4]
call fcn.00487e6f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e6500
push 0x487e88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], esi
push 0x51d190
lea ecx, [ebp - 0x24]
call fcn.00421be0
push esi
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.004237b0
add esp, 0xc
call fcn.00421b80
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push 0x521190
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
push 0
lea edx, [ebp - 0x30]
push edx
sub eax, 0x51d190
push eax
push 0x51d190
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x423c08
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4245e7
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x491c1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi], 0x4e659c
mov dword [esp + 8], esi
mov dword [esi + 0x10], ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], ebx
call fcn.00468c50
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], 0xf
mov byte [esi + 0x20], bl
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x425ad0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x491d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov esi, dword [esp + 0x60]
mov eax, dword [esi]
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x58], ebx
call dword [eax + 0xc]
mov ebp, dword [esp + 0x64]
mov dword [esp + 0x14], eax
cmp dword [ebp + 0xc], ebx
mov dword [esp + 0x10], 1
je 0x425b1a
mov dword [esp + 0x10], 2
mov edx, dword [esi]
push 2
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call dword [edx + 0x18]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc]
mov edi, eax
movsx eax, word [esp + 0x10]
lea eax, [eax + eax*4]
lea ecx, [edi + eax*2]
mov dword [esp + 0x1a], ecx
push 0xa
lea eax, [esp + 0x1c]
mov word [esp + 0x1c], 0x1000
mov dword [esp + 0x22], 0x10
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x18]
mov edx, dword [esp + 0x10]
cmp dx, 1
jle 0x425b9f
mov eax, dword [ebp + 0xc]
mov word [esp + 0x18], 0x1001
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x425b74
sub eax, ebx
mov dword [esp + 0x1e], eax
movsx eax, dx
lea ecx, [eax + eax*4]
lea edx, [edi + ecx*2 + 0x10]
push 0xa
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1e], edx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x18]
xor ebx, ebx
mov edi, dword [ebp]
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00415ff0
push edi
mov dword [esp + 0x2c], eax
call fcn.00416070
push edi
mov dword [esp + 0x34], eax
call fcn.004160f0
push edi
mov dword [esp + 0x3c], eax
call fcn.00416160
add esp, 0x10
mov dword [esp + 0x30], eax
mov edx, dword [esi]
push 0x10
lea eax, [esp + 0x28]
push eax
mov ecx, esi
call dword [edx + 0x18]
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x425c09
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x425bf7
mov edx, dword [esi]
sub eax, edi
push eax
push ecx
mov ecx, esi
call dword [edx + 0x18]
xor eax, eax
mov ecx, 6
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x50a5ac]
xor cl, 0x40
mov byte [esp + eax + 0x3c], cl
inc eax
cmp eax, 0x12
jne 0x425c20
mov edx, dword [esp + 0x14]
push 0x1a
lea ecx, [esp + 0x38]
mov dword [esp + 0x3c], edx
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x18]
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret
Function at 0x425c60
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x491d98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov ebx, dword [esp + 0x64]
mov eax, dword [ebx]
xor ebp, ebp
mov ecx, ebx
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x14], ebp
call dword [eax + 0xc]
mov esi, dword [ebx]
push ebp
mov ecx, ebx
mov dword [esp + 0x1c], eax
call dword [esi + 0x1c]
sub eax, 0x1a
push eax
mov ecx, ebx
call dword [esi + 8]
mov edx, dword [ebx]
push 0x1a
lea eax, [esp + 0x3c]
push eax
mov ecx, ebx
call dword [edx + 0x18]
xor eax, eax
xor byte [esp + eax + 0x40], 0x40
inc eax
cmp eax, 0x12
jne 0x425cb6
mov ecx, eax
mov edi, 0x50a5ac
lea esi, [esp + 0x40]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x425cd7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x425da9
mov eax, dword [esp + 0x3c]
cmp eax, ebp
je 0x425da9
mov edx, dword [ebx]
push ebp
push eax
mov ecx, ebx
call dword [edx + 8]
push 2
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x18]
cmp word [esp + 0x10], bp
jle 0x425da9
mov edi, 0x1000
jmp 0x425d20
push 0xa
lea eax, [esp + 0x20]
mov word [esp + 0x20], bp
mov dword [esp + 0x22], ebp
mov dword [esp + 0x26], ebp
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x18]
cmp word [esp + 0x1c], di
jne 0x425d97
cmp dword [esp + 0x22], 0x10
jne 0x425d97
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0xc]
mov ecx, dword [esp + 0x1e]
push ebp
mov esi, eax
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 8]
push 0x10
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
mov edx, dword [ebx]
push eax
mov ecx, ebx
call dword [edx + 0x18]
lea ecx, [esp + 0x28]
push ecx
call fcn.00425930
mov edx, dword [ebx]
add esp, 4
push ebp
push esi
mov ecx, ebx
mov dword [esp + 0x1c], eax
call dword [edx + 8]
mov eax, dword [esp + 0x10]
dec eax
cmp ax, bp
mov dword [esp + 0x10], eax
jg 0x425d20
mov ecx, dword [esp + 0x18]
mov eax, dword [ebx]
push ebp
push ecx
mov ecx, ebx
call dword [eax + 8]
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret
Function at 0x434510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4933f1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esi], 0x4e4a8c
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea edi, [esi + 0x10]
mov ecx, edi
mov byte [esp + 0x18], 3
call fcn.00433d60
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov edi, dword [esp + 0x24]
cmp edi, ebx
mov eax, dword [esp + 0x20]
mov byte [esp + 0x18], 4
mov dword [esi + 4], eax
je 0x434570
mov edx, dword [edi]
mov ecx, edi
call dword [edx]
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x43457c
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esi + 8], edi
mov edi, dword [esp + 0x28]
cmp edi, ebx
je 0x43458d
mov edx, dword [edi]
mov ecx, edi
call dword [edx]
mov ecx, dword [esi + 0xc]
cmp ecx, ebx
je 0x434599
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [esp + 0x34]
mov cl, byte [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], edi
mov byte [esi + 0x1d], al
mov byte [esi + 0x1c], cl
mov ecx, dword [esp + 0x10]
pop edi
mov dword [esi + 0x20], edx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x18

Function at 0x460070
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x50a730]
sub esp, 0x204
cmp eax, 0xffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x4600e9
push 0
push 0x80000080
push 4
push 0
push 0
push 0x40000000
push str.Call.log
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x50a730], eax
mov eax, dword [0x50a734]
push eax
push eax
push eax
lea eax, [esp + 0x1c]
push str._s_s__New_Session___s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, dword [0x50a730]
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call edi
mov esi, dword [esp + 0x214]
push 0
lea edx, [esp + 0x10]
push edx
push esi
call ebx
push eax
mov eax, dword [0x50a730]
push esi
push eax
call edi
pop edi
pop esi
pop ebx
add esp, 0x204
ret
Function at 0x460e50
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x498538
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov al, byte [edi + 4]
test al, al
mov dword [esp + 0x1c], 0
je 0x460f66
mov byte [edi + 4], 0
xor ebx, ebx
mov eax, 0x522f58
lea ebx, [ebx]
cmp dword [eax], 0
jne 0x460ea7
add eax, 0x10c
inc ebx
cmp eax, 0x5239d0
jne 0x460e90
jmp 0x460f66
test ebx, ebx
jl 0x460f66
mov eax, dword [edi + 0x24]
mov ecx, dword [edi + 8]
mov esi, ebx
imul esi, esi, 0x10c
add esi, 0x522f58
cmp eax, 0x10
jb 0x460ecd
mov eax, dword [edi + 0x10]
jmp 0x460ed0
lea eax, [edi + 0x10]
push ecx
push eax
lea eax, [esi + 4]
push str._s__04d.bmp
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebp, dword [esp + 0x34]
add esp, 0xc
mov eax, esp
mov dword [esp + 0x14], esp
push 0
mov dword [eax], ebp
call fcn.00460a60
add esp, 8
mov dword [esi + 0x104], eax
push 4
add eax, 0xfff
push 0x1000
and eax, 0xfffff000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
mov dword [esi + 0x108], eax
je 0x460f66
push ecx
mov eax, esp
mov dword [esp + 0x14], esp
mov dword [eax], ebp
mov ecx, dword [esi + 0x108]
push ecx
call fcn.00460a60
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0
push ebx
push 0x460990
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
inc dword [edi + 8]
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 4

Function at 0x467de0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
test esi, esi
setne al
push edi
push str.Invalid_window_handle
mov dword [ecx + 0x34], esi
push eax
call fcn.00460410
add esp, 8
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004218e0
test al, al
push 0x80c80000
push 0xfffffffffffffff0
push esi
je 0x467e23
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x467e29
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push 0
mov ebp, eax
call edi
mov ebx, dword [esp + 0x28]
mov edi, dword [ebx]
mov ebx, dword [ebx + 4]
sub eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, ebp
sub eax, ebx
cdq
sub eax, edx
sar eax, 1
sar ecx, 1
add ebx, eax
push ebx
add edi, ecx
push edi
push eax
push ecx
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0x80c80000
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_AdjustWindowRect]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 4
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x18]
sub edx, ecx
push edx
push eax
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.004219b0
add esp, 8
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc
Function at 0x467ed0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
test esi, esi
setne al
push edi
push str.Invalid_window_handle
mov dword [ecx + 0x34], esi
push eax
call fcn.00460410
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
add esp, 8
push 0
push esi
call edi
call fcn.004218e0
test al, al
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongA]
mov ebp, dword [sym.imp.USER32.dll_SetWindowLongW]
push Ordinal_2
push 0xfffffffffffffff0
push esi
je 0x467f1a
call ebp
jmp 0x467f1c
call ebx
call fcn.004218e0
test al, al
push 8
push 0xffffffffffffffec
push esi
je 0x467f2e
call ebp
jmp 0x467f30
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push 0
push eax
push ecx
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call fcn.004219b0
add esp, 8
push 5
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebp
pop ebx
ret 0xc

Function at 0x46f050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x499d58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov esi, dword [esp + 0x30]
cmp esi, edi
mov byte [esp + 0x24], 2
je 0x46f0a3
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x46f0a3
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x2c]
cmp esi, edi
je 0x46f0b5
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, dword [esp + 0xc]
cmp ecx, edi
je 0x46f0c2
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, dword [ebx + 0x10]
mov dword [esp + 0xc], esi
mov ecx, dword [edi + 4]
lea esi, [ebx + 0xc]
lea eax, [esp + 0xc]
push eax
push ecx
push edi
mov ecx, esi
call fcn.0046dd70
push 1
mov ecx, esi
mov ebx, eax
call fcn.0046ee10
mov dword [edi + 4], ebx
mov eax, dword [ebx + 4]
lea ecx, [esp + 0xc]
mov dword [eax], ebx
mov byte [esp + 0x24], 1
call fcn.0046dc70
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x476350
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x49b290
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 0x20], 0
mov edx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
mov eax, esp
mov dword [esp + 8], esp
push ecx
mov dword [eax], ecx
mov eax, esp
mov dword [eax], edx
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esp
push eax
call fcn.00475d80
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.00475b40
lea ecx, [esp + 8]
push ecx
lea ecx, [esi + 4]
mov byte [esp + 0x24], 3
call fcn.004762e0
lea ecx, [esp + 8]
mov byte [esp + 0x20], 2
call fcn.0045dde0
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 8