joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x72fcb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.004b6fac
mov dword [ebx], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.004b6fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.004b6fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
mov edx, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
mov eax, dword [esi*4 + reloc.RASAPI32.dll_RasHangUpA]
xor eax, dword [esp]
call fcn.004b6f70
mov edi, eax
mov eax, edi
call fcn.004b6fac
mov dword [ebx + reloc.RASAPI32.dll_RasHangUpA], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x4b6fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b7138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x4b716d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x4b7193
inc ebx
cmp ebx, 0xf
jne 0x4b717d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x4b714f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x58bbf6
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0x575d69

Function at 0x58c973
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ah, byte [esp + 1]
xchg edx, eax
mov dx, word [esp]
mov edx, 0xda28ea22
jmp 0x58c9dc
push edx
lea esp, [esp + 1]
mov byte [esp + 1], ah
not dh
lea edx, [ecx + ebx]
lea eax, [edx + edi]
jmp 0x58ca0c
pop ebx
rdtsc
bswap eax
xchg dh, dl
xchg dx, ax
bswap eax
jmp 0x58c9eb
xchg edx, eax
pop dx
lea esp, [esp + 2]
push ebx
mov dh, ch
xchg ah, bl
jmp 0x58c9b1
pushal
setns ah
rdtsc
xchg dword [esp], edx
mov edx, dword [esp + 0x20]
lea eax, [edi + edi]
call fcn.0058ca3e
push ebx
salc
inc esp
and ebx, esi
push 0x58796ec7
mov ebx, 0x86d88b92
add al, 0x24
mov ebx, eax
xchg byte [esp], al
xchg word [esp], bx
rdtsc
mov al, 0x6e
lea esp, [esp + 3]
jmp 0x58c9c4
Function at 0x753fa3
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 1], ebp
setbe dh
xchg dh, dl
bswap edx
setnp dh
jmp 0x754036
lea esp, [esp + 8]
neg al
btc edx, edi
jns 0x754d41
js 0x754873
mov ds, word [bx + di]
js 0x754077
mov dl, 0x86
push esp
and al, 3
xchg byte [esp + 3], dl
jmp 0x754002
bsr dx, cx
js 0x75401d
xchg byte [esp + 3], dl
jmp 0x754002
add al, 0x8d
and al, 2
sub esp, 6
sub esp, 6
xchg dh, dl
pop edx
lea edx, [edx*4]
inc dl
Function at 0x76dad4
Capabilities:
Encode data using xor

Disassembly:
call fcn.0076dad4
rep stosb byte es:[edi], al
jmp 0x79fae8
call 0x76da6b
lea esp, [esp + 4]
inc eax
push edx
pop word [esp]
lea esp, [esp + 2]
jmp 0x76da2f
not ch
mov ecx, dword [esp]
mov ecx, dword [esp + 4]
push edx
push edx
jmp 0x76d7d5
mov dword [esp + 3], esi
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0x76d7f7
sub esp, 0
or cx, 0xb71e
jmp 0x76d7c4
lea esp, [esp + 4]
cmp dword [ecx + eax*4], 0
push esp
mov dword [esp], eax
pop word [esp]
jmp 0x76db1b
ret
dec eax
jns 0x76d7ed
js 0x74600b
mov byte [edx - 0x7b], cl
std
invalid
jl 0x76dabc
imul ecx, dword [eax], reloc.RASAPI32.dll_RasHangUpA
dec eax
das
ficomp dword [ecx]
mov esp, 0x39caaf3f
int1
xchg edx, eax
mov byte [esp + 1], dh
lea esp, [esp + 4]
jmp 0x76dab4
lea esp, [esp + 2]
jne 0x74600b
je 0x745fc4
imul esp, edi, 0x5fe11277
xchg ecx, eax
sbb byte [esi - 0xa24e717], cl
mov ss, word [esi]
test bl, ah
push ds
scasb al, byte es:[edi]
sbb al, 0x8b
sbb edi, dword [esi - 0x73]
cmp eax, 0xc5a22cb2
xor al, 0xf7
movsb byte es:[edi], byte [esi]
cmp dword [ecx - reloc.RASAPI32.dll_RasHangUpA], ebp
sbb cl, byte [eax - 0x1b24e511]
jg 0x76db48
mov bh, byte [ecx + 0x46]
push eax
invalid
push 0x678ff1af
call fcn.007551e3
mov byte [0x20d1b620], al
xchg esi, eax
fcomp qword [ebp - 0x33]
xchg esp, eax
salc
sub al, 0x3f
push es
mov cl, 0xe9
jae 0x79fb04
invalid
invalid

Function at 0x7737de
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x24]
mov esi, 0xff
mov bl, bh
jmp 0x7737f6
jmp 0x7737c5
xor eax, 0x1000000
xchg bl, bh
btr ebx, edx
mov edi, ebp
mov bl, 0x32
jmp 0x773802
and eax, esi
mov eax, dword [eax*4 + reloc.RASAPI32.dll_RasHangUpA]
clc
jmp 0x7737e0
mov edi, edx
shl bl, 1
jmp 0x77382b
shr edi, 8
setbe bl
push esp
and edi, esi
jmp 0x77387d
bswap ebp
mov edi, dword [edi*4 + reloc.RASAPI32.dll_RasHangUpA]
lea esp, [esp + 4]
and edi, 0xff0000
jmp 0x773852

Function at 0x8651c5
Capabilities:
Parse pe header

Disassembly:
pop word [esp + 7]
push esp
call fcn.008651d1
xor al, 0x89
invalid
je 0x8651f8
or dl, byte [edx - 0x15]
cmp al, 0x36
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
inc edx
pop esp
int3
rol dword [ebx + 0x26], cl
aad 0x22
ret 0xca54

Function at 0x8651d1
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.0086406b
mov dword [esp + 0xa], esi
push edx
jmp 0x865214
mov dword [esp + 0xb], esi
pop word [esp + 3]
lea esp, [esp + 3]
mov dword [esp + 0x30], esi
push edx
push esp
jmp 0x8652b1
push eax
jmp 0x864066
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x86524a
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x865266
mov dword [esp + 3], eax
mov word [esp + 4], bx
push word [esp + 7]
mov word [esp], bx
push esp
lea esp, [esp + 2]
jmp 0x86528b

Function at 0x8653fd
Capabilities:
Parse pe header

Disassembly:
pop word [esp + 1]
push esp
mov dword [esp + 0x20], ebp
call fcn.00865208
mov word [esp + 0xc], di
jmp 0x86523b
Function at 0x401570
Capabilities:
Set registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x42bb00]
xor eax, esp
mov dword [esp + 0x110], eax
push str.SYSTEMCurrentControlSetControlSession_Manager
lea ecx, [esp + 4]
mov dword [esp + 8], 2
call fcn.00402d10
mov edx, dword [esp]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401605
push 0x103
push eax
lea ecx, [esp + 0x15]
push ecx
mov byte [esp + 0x18], al
call fcn.004123a0
lea eax, [esp + 0x18]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015e2
sub eax, edx
push eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push 1
push 0
push str.BootExecute
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401624
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0040fe69
add esp, 0x114
ret

Function at 0x4018f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x421a79
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x42bb00]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [0x42bb00]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
call fcn.004042dd
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x401947
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x38], ebx
mov ecx, edi
mov dword [esp + 8], 1
call fcn.004032a0
mov ecx, dword [esi + 8]
call ecx
test eax, eax
jne 0x4019be
push 0x1a
lea edx, [esp + 0x14]
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov dword [esp + 0x29], eax
mov byte [esp + 0x2d], al
mov eax, dword [esi + 0x24]
push edx
mov byte [esp + 0x18], bl
call eax
cmp eax, ebx
jne 0x4019be
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4019a8
sub eax, edx
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.004037e0
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0040fe69
add esp, 0x34
ret
Function at 0x401bd0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x1c
lea eax, [esp + 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401c2f
lea ecx, [esp + 0xc]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp + 4]
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x1c
ret
Function at 0x40fe69
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42bb00]
jne 0x40fe73
repz ret
jmp fcn.00413cff

Function at 0x41d4d9
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00414d4c
and dword [ebp - 4], 0
cmp dword [0x42f7b4], 0
mov ebx, eax
jne 0x41d58a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41d63b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x426790
push edi
call esi
test eax, eax
je 0x41d63b
push eax
call fcn.00414cda
mov dword [esp], 0x426780
push edi
mov dword [0x42f7b4], eax
call esi
push eax
call fcn.00414cda
mov dword [esp], 0x42676c
push edi
mov dword [0x42f7b8], eax
call esi
push eax
call fcn.00414cda
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42f7bc], eax
call esi
push eax
call fcn.00414cda
pop ecx
mov dword [0x42f7c4], eax
test eax, eax
je 0x41d58a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00414cda
pop ecx
mov dword [0x42f7c0], eax
mov eax, dword [0x42f7c0]
cmp eax, ebx
je 0x41d5e2
cmp dword [0x42f7c4], ebx
je 0x41d5e2
push eax
call fcn.00414d55
push dword [0x42f7c4]
mov esi, eax
call fcn.00414d55
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41d5e2
test edi, edi
je 0x41d5e2
call esi
test eax, eax
je 0x41d5d9
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41d5d9
test byte [ebp - 0xc], 1
jne 0x41d5e2
or dword [ebp + 0x10], 0x200000
jmp 0x41d61b
mov eax, dword [0x42f7b8]
cmp eax, ebx
je 0x41d61b
push eax
call fcn.00414d55
pop ecx
test eax, eax
je 0x41d61b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41d61b
mov eax, dword [0x42f7bc]
cmp eax, ebx
je 0x41d61b
push eax
call fcn.00414d55
pop ecx
test eax, eax
je 0x41d61b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42f7b4]
call fcn.00414d55
pop ecx
test eax, eax
je 0x41d63b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41d63d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401580
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x4261d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x40c], eax
xor edi, edi
mov dword [ebp - 0x408], ecx
xor eax, eax
nop
mov dword [ebp + eax*4 - 0x404], eax
inc eax
cmp eax, 0x100
jne 0x4015b0
xor ecx, ecx
lea esi, [ecx + 2]
xor edx, edx
mov eax, ecx
div dword [ebp - 0x408]
movzx edx, byte [edx + ebx]
add edx, dword [ebp + ecx*4 - 0x404]
add edi, edx
and edi, 0x800000ff
jns 0x4015eb
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + ecx*4 - 0x404]
mov edx, dword [ebp + edi*4 - 0x404]
movzx eax, al
mov dword [ebp + ecx*4 - 0x404], edx
mov dword [ebp + edi*4 - 0x404], eax
xor edx, edx
lea eax, [esi - 1]
div dword [ebp - 0x408]
movzx edx, byte [edx + ebx]
add edx, dword [ebp + ecx*4 - 0x400]
add edi, edx
and edi, 0x800000ff
jns 0x401632
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + ecx*4 - 0x400]
mov edx, dword [ebp + edi*4 - 0x404]
movzx eax, al
mov dword [ebp + ecx*4 - 0x400], edx
mov dword [ebp + edi*4 - 0x404], eax
xor edx, edx
mov eax, esi
div dword [ebp - 0x408]
movzx edx, byte [edx + ebx]
add edi, edx
add edi, dword [ebp + ecx*4 - 0x3fc]
and edi, 0x800000ff
jns 0x401678
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + ecx*4 - 0x3fc]
mov edx, dword [ebp + edi*4 - 0x404]
movzx eax, al
mov dword [ebp + ecx*4 - 0x3fc], edx
mov dword [ebp + edi*4 - 0x404], eax
xor edx, edx
lea eax, [esi + 1]
div dword [ebp - 0x408]
movzx edx, byte [edx + ebx]
add edx, dword [ebp + ecx*4 - 0x3f8]
add edi, edx
and edi, 0x800000ff
jns 0x4016bf
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + ecx*4 - 0x3f8]
mov edx, dword [ebp + edi*4 - 0x404]
mov dword [ebp + ecx*4 - 0x3f8], edx
movzx eax, al
add esi, 4
add ecx, 4
mov dword [ebp + edi*4 - 0x404], eax
cmp esi, 0x102
jl 0x4015c4
mov ebx, dword [ebp + 0x10]
xor eax, eax
test ebx, ebx
je 0x401784
lea ecx, [ecx]
inc ecx
and ecx, 0x800000ff
jns 0x401711
dec ecx
or ecx, 0xffffff00
inc ecx
mov edx, dword [ebp + ecx*4 - 0x404]
add edi, edx
and edi, 0x800000ff
jns 0x40172a
dec edi
or edi, 0xffffff00
inc edi
mov esi, dword [ebp + edi*4 - 0x404]
movzx edx, dl
mov dword [ebp + ecx*4 - 0x404], esi
mov dword [ebp + edi*4 - 0x404], edx
mov esi, dword [ebp + ecx*4 - 0x404]
add esi, edx
and esi, 0x800000ff
jns 0x40175b
dec esi
or esi, 0xffffff00
inc esi
movzx edx, byte [ebp + esi*4 - 0x404]
mov esi, dword [ebp - 0x40c]
xor byte [esi + eax], dl
inc eax
cmp eax, ebx
jb 0x401700
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406291
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x40c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406291
mov esp, ebp
pop ebp
ret
Function at 0x406291
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4261d0]
jne 0x40629b
repz ret
jmp fcn.0040871c

Function at 0x40adfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4261d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004074b2
and dword [ebp - 0x14], 0
cmp dword [0x427a30], 0
mov dword [ebp - 0x18], eax
jne 0x40aeaf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40af57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40af57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x427a30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427a34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427a38], eax
call edi
push eax
call esi
mov dword [0x427a40], eax
test eax, eax
je 0x40aeaf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427a3c], eax
mov eax, dword [0x427a3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40af08
cmp dword [0x427a40], ecx
je 0x40af08
push eax
call esi
push dword [0x427a40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40af08
test ebx, ebx
je 0x40af08
call edi
test eax, eax
je 0x40aeff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aeff
test byte [ebp - 8], 1
jne 0x40af08
or dword [ebp + 0x10], 0x200000
jmp 0x40af3b
mov eax, dword [0x427a34]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40af3b
mov eax, dword [0x427a38]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x427a30]
call esi
test eax, eax
je 0x40af57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40af59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406291
leave
ret
Function at 0x401f30
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x430684]
sub esp, 0x80c
test eax, eax
je 0x401f4d
mov ecx, dword [0x430688]
test ecx, ecx
jne 0x40209b
push esi
push edi
lea eax, [esp + 0x14]
push 0x400
push eax
push 0
call dword [0x4280c0]
mov edi, dword [0x4285c8]
lea ecx, [esp + 0x14]
push ecx
call edi
mov eax, dword [0x43068c]
xor esi, esi
test eax, eax
jle 0x401f8a
lea edx, [esp + 0x14]
push edx
call edi
mov eax, dword [0x43068c]
inc esi
cmp esi, eax
jl 0x401f79
lea eax, [esp + 0x14]
push str.MiniUI.dll
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [0x4285cc]
call dword [0x4280c4]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
call dword [0x4280c8]
mov esi, eax
cmp esi, 0xffffffff
je 0x402008
lea edx, [esp + 0x10]
push 0
push edx
lea eax, [esp + 0x10]
push 4
push eax
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0x22204c
push esi
call dword [0x4280cc]
push esi
mov edi, eax
call dword [0x4280d0]
test edi, edi
je 0x402008
mov eax, dword [esp + 8]
test eax, eax
jne 0x402049
lea edx, [esp + 0x14]
test edx, edx
je 0x402045
lea eax, [esp + 0x14]
push eax
call dword [0x4285d0]
test eax, eax
je 0x402049
lea ecx, [esp + 0x14]
push ecx
call fcn.004090f0
add esp, 4
test eax, eax
jne 0x402049
push 1
call fcn.00425090
lea edx, [esp + 0x18]
push eax
push edx
call fcn.004252a0
add esp, 0xc
xor eax, eax
jmp 0x402054
lea eax, [esp + 0x14]
push eax
call dword [0x4280d4]
pop edi
mov dword [0x430688], eax
test eax, eax
pop esi
jne 0x402066
add esp, 0x80c
ret
push str.GetMiniUI
push eax
call dword [0x4280d8]
test eax, eax
mov dword [0x430684], eax
jne 0x40209b
mov ecx, dword [0x430688]
push ecx
call dword [0x4280dc]
mov dword [0x430688], 0
xor eax, eax
add esp, 0x80c
ret
call eax
add esp, 0x80c
ret
Function at 0x405a90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42615e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 1
call sub.MFC42u.DLL_CString::CString_1
push 0x4306d8
lea ecx, [esp + 0x10]
mov byte [esp + 0x48], 2
call sub.MFC42u.DLL_CString::operator
push 0x4306d8
lea ecx, [esp + 0x14]
call sub.MFC42u.DLL_CString::operator
push 0x4306d8
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::operator
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x4c]
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x48], 3
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x28]
lea edx, [esp + 0xc]
mov dword [esp + 0x4c], ecx
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x48], 4
call sub.MFC42u.DLL_CString::CString_3
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
mov byte [esp + 0x48], 5
call sub.MFC42u.DLL_CString::CString_3
lea ecx, [esp + 0x14]
mov byte [esp + 0x44], 6
push ecx
lea ecx, [esp + 0x34]
call sub.MFC42u.DLL_CString::CString_3
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 4]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x4c], 7
call fcn.00407530
lea eax, [esp + 0x28]
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], 0xa
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov byte [esp + 0x44], 9
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 8
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x44], 0xc
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 0xb
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 4]
pop esi
lea eax, [ecx + 0x10]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret 4