joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040cffb
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040cffb
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040cffb
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040cffb
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040cffb
mov dword [0x41203c], eax
call fcn.0040cffb
test eax, eax
jge 0x402550
push 8
call fcn.0040cffb
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040cffb
pop ecx
push 1
call fcn.0040cffb
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040cffb
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040cffb
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040cffb
jmp 0x402495

Function at 0x40cffb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40d00a
pop dword [ebp - 0x4c]
mov eax, 0x2ad1398d
add eax, 0xd56f967d
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x34eba
push 0
mov eax, 0xcc0e3c07
sub eax, 0xcbcd5b2f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x36c2
xor esi, esi
add esi, eax
mov edx, 0x413bc4
add edx, dword [ebp - 0x4c]
mov ebx, 0x3e3cf107
xor dword [ebp - 0x2c], eax
mov edi, dword [edx]
xor dword [ebp - 0x38], esi
add edi, ebx
mov dword [esi], edi
sub dword [ebp - 0x40], edi
add esi, 0x177906c9
add esi, 0xe886f93b
add edx, 0x45c153b1
sub edx, 0x45c153ad
loop 0x40d059
add eax, 0x22939f05
add eax, 0xdd6d2ed6
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x9d0d096e
sub ecx, 0x9ccd096e
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x406371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x238
mov eax, 0x40e86a
call fcn.0040d30f
mov dword [ebp - 0x21c], ecx
movzx eax, word [ebp + 8]
xor edi, edi
mov esi, dword [0x4166e8]
inc edi
push 0xf0
push eax
push esi
call dword [sym.imp.kernel32.dll_FindResourceW]
test eax, eax
je 0x4064e2
push eax
push esi
call dword [sym.imp.kernel32.dll_LoadResource]
test eax, eax
je 0x4064e2
push eax
call dword [sym.imp.kernel32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4064e2
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x4064e2
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
add esi, 8
mov dword [ebp - 0x220], ecx
mov ecx, 0x403
cmp cx, ax
jne 0x40645b
push 3
lea eax, [ebp - 0x110]
push esi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x114], eax
call main
push dword [ebp - 0x114]
mov eax, dword [ebp - 0x21c]
and dword [ebp - 4], 0
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x110]
cmove edi, ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x114], eax
je 0x4064d4
push dword [ebp - 0x114]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x4064d4
mov ecx, 0x1234
cmp cx, ax
jne 0x4064d4
or dword [ebp - 0x240], 0xffffffff
lea eax, [ebp - 0x214]
push 3
push esi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x218], eax
call main
mov eax, dword [ebp - 0x218]
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x23c], eax
cmp eax, ecx
je 0x4064ae
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea eax, [ebp - 0x244]
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x220]
test edi, edi
jne 0x4063c9
mov eax, edi
call fcn.0040d2ca
ret 4

Function at 0x409413
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x409422
pop dword [ebp - 8]
mov eax, 0xc8324b8
sub eax, 0xc429096
sub dword [ebp - 8], eax
push 0x40
push 0x1000
push 0x3a5d2
push 0
mov eax, 0xf77e6a1b
sub eax, 0xf73d798b
add eax, dword [ebp - 8]
call dword [eax]
mov ecx, 0xddff4f95
sub ecx, 0xddfeff88
mov esi, eax
mov edi, 0x3f7362fd
sub edi, 0x3f31b8fd
add edi, dword [ebp - 8]
mov edx, 0xf015ee24
add dword [ebp - 4], 0x3b1fee3a
mov ebx, dword [edi]
xor dword [ebp - 4], 0x5a715624
sub ebx, edx
add dword [ebp - 4], 0x3444f345
mov dword [esi], ebx
sub dword [ebp - 4], 0xf4ff6d25
add esi, 4
add edi, 0x7a987cf4
add edi, 0x85678310
loop 0x40947b
add eax, 0x13307
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xf1dc278a
sub ecx, 0xf19c278a
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d08b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40d09a
pop dword [ebp - 0x24]
mov eax, 0x90a90e73
add eax, 0x6f97c227
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x35c16
push 0
mov eax, 0x15ba1c8a
add eax, 0xea86c44e
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0xfd9df088
add ecx, 0x262498c
xor edx, edx
add edx, eax
mov edi, 0x28f02f89
sub edi, 0x28aef3c5
add edi, dword [ebp - 0x24]
mov esi, 0x358654c0
add esi, 0x81df17ca
mov dword [ebp - 8], 0x59e86ca6
mov ebx, dword [edi]
xor dword [ebp - 0x14], edx
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x18], ebx
add edx, 0xd3f6afba
add edx, 0x2c09504a
add edi, 0x82352b8a
sub edi, 0x82352b86
loop 0x40d0fb
add eax, 0xdab59c07
add eax, 0x254b3f1c
xor ebx, ebx
add ebx, eax
add eax, 0x7e300734
sub eax, 0x7e30072f
mov ecx, 0x8437ce13
add ecx, 0x7c0831ed
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x40216b
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
call main
jmp 0x402175
push 0x14
push 0x411788
call fcn.00405300
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x4021a3
xor ebx, ebx
jmp 0x4021d6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40219f
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40219f
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x4021d6
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004048ef
test eax, eax
jne 0x4021ea
push 0x1c
call main
pop ecx
call fcn.00403b58
test eax, eax
jne 0x4021fb
push 0x10
call main
pop ecx
call fcn.004051cc
and dword [ebp - 4], 0
call fcn.00404904
test eax, eax
jns 0x402215
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4162e8], eax
call main
mov dword [0x414430], eax
call main
test eax, eax
jns 0x40223b
push 8
call main
pop ecx
call fcn.00404de7
test eax, eax
jns 0x40224c
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x40225f
push eax
call main
pop ecx
call fcn.00405299
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x402281
push esi
call main
call fcn.00404663
jmp 0x4022b6
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00405345
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x405a80
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x240
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x148]
push str.svchost.exe
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x405b83
lea edx, [esp + 0x148]
push 0x408d74
push edx
call sub.MSVCRT.dll_fopen
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x405b83
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call fcn.00405430
add esp, 0x14
test al, al
je 0x405b6b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00405570
add esp, 0x10
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x405b83
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
call fcn.00405600
mov eax, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00405890
add esp, 0x30
push ebx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x240
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x240
ret

Function at 0x40a32e
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
invalid
or dword [ecx], ecx
sti
je 0x40a30f
add dword [ebp - 0x58], edx
sub cl, dl
jecxz 0x40a320
inc esi
lea esp, [ebx + ecx*4 + 0x52]
xor bl, ch
or byte [ebp - 0x68de3dd3], bl
invalid
ret 0x9721
xchg edi, eax
Function at 0x407d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x407d2f
pop dword [ebp - 8]
mov eax, 0x6c029e09
sub eax, 0x6bc220da
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x93189460
sub dword [ebp - 0x18], 0x44c64f15
mov dword [ebp - 0x14], 0x134a8d9a
add dword [ebp - 0x14], 0x1ee8beab
mov dword [ebp - 0x10], 0xd66039b6
sub dword [ebp - 0x10], 0x8a13f588
mov dword [ebp - 0xc], 0x21893c44
add dword [ebp - 0xc], 0xde76c3bc
lea eax, [ebp - 0x18]
push eax
mov eax, 0xb83b0b43
sub eax, 0xb7f9aaab
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x5cbd66a8
sub dword [ebp - 0x18], 0xe84afd52
mov dword [ebp - 0x14], 0xa99656bf
sub dword [ebp - 0x14], 0x6829f54a
mov dword [ebp - 0x10], 0x10da9241
add dword [ebp - 0x10], 0x5294da2b
mov dword [ebp - 0xc], 0x8e1d1097
sub dword [ebp - 0xc], 0x8e1d1097
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x956c69d8
sub eax, 0x952b0964
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x39df7
push 0
call eax
mov ecx, 0x4377
xor edx, edx
add edx, eax
mov ebx, 0x934232f6
add ebx, 0x6d00730a
add ebx, dword [ebp - 8]
mov edi, 0xea89a307
sub edi, 0x19c416dd
mov esi, dword [ebx]
xor dword [ebp - 4], esi
sub esi, edi
add dword [ebp - 4], eax
mov dword [edx], esi
sub dword [ebp - 4], 0xfbbfbae
add edx, 0xc8cd9e82
sub edx, 0xc8cd9e7e
add ebx, 0x62e13a26
add ebx, 0x9d1ec5de
loop 0x407e4d
add eax, 0x254b59c2
sub eax, 0x254a5913
mov ebx, eax
add eax, 5
mov ecx, 0x5d7e3990
sub ecx, 0x5d3e3990
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x405d20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call 0x555f20
pop ebx
ror byte [edi], 0xd
std
add byte [eax], al
add byte [ebx + 0x418bb63d], al
add byte [edi + ecx], dl
mov esi, gs
add byte [eax], al
add byte [ecx + 0x410384], ah
test eax, eax
jne 0x6a405e2e
mov dword [0xcc050384], 0xa600c8
enter 0xffffffffffffa600, 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x405d53
mov eax, dword [0x960358]
test eax, eax
out dx, al
sbb eax, 0xf4106850
inc eax
inc esp
push 4
call fcn.0040a940
sbb dword [eax + ebp*2 - 0x5d], 0x1e
add eax, dword [ecx]
test dword [edi - 0x6150dff1], ecx
add byte [ebp + ecx*4 + 0x6d], bl
cld
push ecx
push esi
xor eax, dword [esi - 0x97a0f48]
imul ebx, dword [0x8bfc558b], 0x56520c45
invalid

Function at 0x409120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
insb byte es:[edi], dx
inc ebp
inc ebp
mov ecx, dword [ebp + 6]
jp 0x409185
push eax
add dl, cl
aam 0x51
push edx
call 0xffb66b10
mov ebp, 0x4dabb145
or byte [ecx - 0x42], al
or al, byte [eax]
add byte [eax], al
mov dl, byte [eax*4 + 0x5fc4d8]
lea eax, [eax*4 + 0x244048d8]
ror dword [edx], cl
xor al, 0xe3
cwde
in al, dx
cmp dword [ebx - 0x547500af], edx
add dword [ebx - 0x617717b7], ecx
inc ecx
lea eax, [ebx + ecx*4]
test al, 0x98
inc eax
add dh, al
add dword [eax], esp
inc ecx
mov dl, byte [eax]
mov byte [ecx], dl
mov dl, byte [eax + 1]
sub eax, dword [eax - 0x5b]
adc dword [edx - 0x77bed1c0], ecx
add dword [ebx], edx
inc ebp
in al, 0x99
cdq
not dword [ebx + 0x2001c674]
inc ecx
xchg dword [eax], esi
add dl, 0x30
mov byte [ecx], al
mov eax, dword [ebp - 0x2f]
inc ecx
arpl word [ecx], dx
inc ecx
cdq
add dword [ebx + 0x6341d145], ecx
adc dword [ecx - 0x67], eax
mov bh, dh
mov byte [ecx], 0xce
inc ecx
add al, 0x30
add dl, 3
and dword [ecx], eax
mov eax, dword [ebp - 0x24]
inc ecx
adc dword [ecx - 0x67], eax
std
inc dh
add dword [edx], edi
inc ecx
add al, 0x30
add dl, 0x30
xor eax, dword [ecx]
mov eax, dword [ebp - 0x28]
inc ecx
insd dword es:[edi], dx
adc ebx, esp
cdq
idiv esi
mov byte [ecx], 0x3a
inc ecx
add al, 0x30
add dl, 0x30
mov byte [ecx], al
stosd dword es:[edi], eax
mov byte [ecx], dl
inc ecx
or esp, edx
in al, dx
mov edi, 0xf2e8
je 0x409193
and byte [ecx - 0x73], al
mov dl, 0x89
pop es
add byte [eax], al
mov eax, esi
cdq
idiv edi
xchg esp, eax
add byte fs:[eax], al
add byte [edi + edx*2], al
pushfd
add dword [eax + 0x51eb851f], edi
not esp
jae 0x4091fa
jmp 0x40924d
or eax, 0xc413d8b
call 0x8c10950d
mov byte [eax + 0x11b030c2], 0x41
cdq
idiv edi
mov eax, 0x1f666667
pop edi
imul edx
pop esi
cli
add bl, byte [ebx - 0x3e]
shr eax, 0x1f
mov byte [0x80c68bd0], al
ret 0xbe30
nop
nop
invalid
Function at 0x446fed
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44701b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x447039
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00446f57
jmp 0x447039
mov eax, dword [esi + 0x14]
test eax, eax
je 0x447039
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00446f57
test edi, edi
mov eax, edi
jne 0x447023
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x5714cc]
test ecx, ecx
je 0x4470ec
jmp 0x446fec
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401368
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov eax, 0x4041c4
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x4041c0], eax
xor eax, eax
mov edi, eax
mov dword [ebp - 0x4c], 0x30
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], 3
mov dword [0x4041b0], eax
mov eax, edi
mov dword [ebp - 0x44], 0x401284
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Happ
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push edi
push dword [ebp - 0x38]
push edi
push edi
push 0x190
push 0x258
push 0xffffee08
push 0xffffee6c
push 0
push str.umbrage
push str.Happ
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4041b8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4041b8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x401451
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x401436
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4045f0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov dword [esi], 0
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x404613
cmp dword [eax + 0x14], 8
jb 0x404615
mov eax, dword [eax]
jmp 0x404615
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x40463d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov eax, esi
jne 0x40463f
mov byte [esi + 5], 1
pop esi
ret 4
mov eax, esi
pop esi
ret 4

Function at 0x404670
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x41d878
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x428008]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
mov eax, dword [0x428008]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x2c]
test eax, eax
je 0x4046ba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [esp + 0x14]
mov word [edi + 4], 0
mov dword [esp + 0x14], 0
call fcn.0040a190
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x14]
cmp dword [esi], 0
je 0x4046e7
lea eax, [esi + 8]
jmp 0x4046e9
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x4046f9
cmp dword [ebx + 0x14], 8
jb 0x4046fb
mov ebx, dword [ebx]
jmp 0x4046fb
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x40471c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40471c
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x404746
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40475b
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push esi
call fcn.0040f7d6
add esp, 4
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0040f01f
add esp, 0x18
ret 4

Function at 0x405580
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x428008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.00410bb0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x405617
cmp dword [esp + 8], 6
jb 0x405617
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.0040f01f
add esp, 0x118
ret
Function at 0x405630
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x41da1c
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov eax, dword [0x428008]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
push 0xc
xor eax, eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x1c]
push str.wintrust.dll
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.00402350
mov dword [esp + 0x50], 0
mov eax, dword [0x42a7cc]
test al, 1
jne 0x4056cf
or eax, 1
mov dword [0x42a7cc], eax
mov byte [esp + 0x50], 1
mov dword [0x42a7c8], 0
call fcn.0040abe0
push 0x41eb20
call fcn.0040f79f
add esp, 4
mov byte [esp + 0x50], 0
lea eax, [esp + 0x18]
mov ecx, 0x42a7c8
push eax
call fcn.0040ad20
mov edi, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x2c], 8
jb 0x4056fb
push dword [esp + 0x18]
call fcn.0040f7d6
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
push 0xb
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], eax
push str.crypt32.dll
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], eax
mov word [esp + 0x38], ax
call fcn.00402350
mov dword [esp + 0x50], 2
mov eax, dword [0x42a7cc]
test al, 1
jne 0x40577a
or eax, 1
mov dword [0x42a7cc], eax
mov byte [esp + 0x50], 3
mov dword [0x42a7c8], 0
call fcn.0040abe0
push 0x41eb20
call fcn.0040f79f
add esp, 4
mov byte [esp + 0x50], 2
lea eax, [esp + 0x30]
mov ecx, 0x42a7c8
push eax
call fcn.0040ad20
mov ebp, eax
mov dword [esp + 0x50], 0xffffffff
cmp dword [esp + 0x44], 8
jb 0x4057a6
push dword [esp + 0x30]
call fcn.0040f7d6
add esp, 4
xor eax, eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], 0
mov word [esp + 0x30], ax
test edi, edi
je 0x405839
test ebp, ebp
je 0x405839
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push edi
call esi
push str.CryptCATAdminAcquireContext
push edi
mov dword [ebx + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push edi
mov dword [ebx + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push edi
mov dword [ebx + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push edi
mov dword [ebx + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push edi
mov dword [ebx + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push edi
mov dword [ebx + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push edi
mov dword [ebx + 0x1c], eax
call esi
push str.WinVerifyTrust
push edi
mov dword [ebx + 0x20], eax
call esi
push str.CertNameToStrW
push ebp
mov dword [ebx + 0x24], eax
call esi
mov dword [ebx + 0x28], eax
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret