joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e270
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5c1068]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.0054d380
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x47e307
cmp dword [esp + 8], 6
jb 0x47e307
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.005349ca
add esp, 0x118
ret

Function at 0x47e320
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57ff00
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x5c1068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00402330
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00468400
mov ecx, eax
call fcn.004684c0
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004022b0
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00402330
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.00468400
mov ecx, eax
call fcn.004684c0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004022b0
test ebx, ebx
je 0x47e435
test esi, esi
je 0x47e435
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48644b
Capabilities:
Terminate thread

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
mov edi, ecx
cmp dword [edi + 0x64], 0
je 0x486462
push dword [edi + 0x64]
call esi
cmp dword [edi + 0x70], 0
je 0x48646d
push dword [edi + 0x70]
call esi
xor ebp, ebp
cmp dword [edi + 0x78], ebp
je 0x48655c
push 0x5c61a0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x78]
test al, 1
je 0x486496
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, dword [edi + 0x78]
test al, 2
je 0x4864a9
push dword [edi + 0x80]
call fcn.0055034c
mov eax, dword [edi + 0x78]
pop ecx
test al, 4
je 0x4864b9
push dword [edi + 0x84]
call fcn.0054be49
pop ecx
mov ebx, dword [0x5c61c0]
mov eax, dword [ebx + 4]
add eax, 0xfffffffc
cmp dword [eax], edi
jne 0x4864ce
mov dword [ebx + 4], eax
jmp 0x48651e
push str.warning:_removing_Breakpad_handler_out_of_order_n
push 2
call fcn.00556089
pop ecx
push eax
call fcn.00482dd0
mov ebx, dword [0x5c61c0]
pop ecx
pop ecx
mov esi, dword [ebx]
mov eax, dword [ebx + 4]
cmp esi, eax
je 0x48651e
lea ebp, [esi + 4]
cmp dword [esi], edi
jne 0x48650f
mov eax, dword [ebx + 4]
sub eax, ebp
push eax
push ebp
push esi
call fcn.0054ce00
add esp, 0xc
add dword [ebx + 4], 0xfffffffc
jmp 0x486515
add esi, 4
add ebp, 4
mov eax, dword [ebx + 4]
cmp esi, eax
jne 0x4864f5
xor ebp, ebp
cmp dword [ebx], eax
jne 0x486551
cmp dword [ebx], 0
je 0x486541
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
and eax, 0xfffffffc
push eax
push dword [ebx]
call fcn.004027c0
pop ecx
pop ecx
mov dword [ebx], ebp
mov dword [ebx + 4], ebp
mov dword [ebx + 8], ebp
push 0xc
push ebx
call fcn.00534a0b
pop ecx
pop ecx
mov dword [0x5c61c0], ebp
push 0x5c61a0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp dword [edi + 0xc], ebp
jne 0x4865a2
push 1
push dword [edi + 0x88]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [edi + 0x88]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [edi + 0x90]
mov dword [edi + 0x88], ebp
push eax
call ebx
push dword [edi + 0xa8]
call esi
push dword [edi + 0xac]
call esi
or eax, 0xffffffff
lock xadd dword [0x5c61b8], eax
jne 0x4865b6
push 0x5c61a0
call ebx
lea ecx, [edi + 0xc0]
call fcn.00486f1a
lea ecx, [edi + 0x40]
call fcn.004022b0
lea ecx, [edi + 0x28]
call fcn.004022b0
lea ecx, [edi + 0x10]
call fcn.004022b0
mov ecx, dword [edi + 0xc]
pop edi
pop esi
pop ebp
pop ebx
test ecx, ecx
je 0x4865ea
push ecx
call fcn.00486f54
ret
Function at 0x48725e
Capabilities:
Read pipe
Write file on windows
Write pipe

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ebx, dword [ebp + 0x360]
lea ecx, [ebp + 0x348]
call fcn.00402ca0
mov esi, dword [ebp + 0x24]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x4c], eax
lea ecx, [ebp + 0x38]
lea eax, [ebp + 0x3c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x58], eax
xor esi, esi
lea eax, [ebp + 0x40]
mov dword [esp + 0x48], 1
mov dword [esp + 0x5c], eax
xorps xmm0, xmm0
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x60], eax
mov eax, dword [ebp + 0x20]
push esi
mov dword [esp + 0x68], eax
lea eax, [esp + 0x14]
push eax
push 0x34
lea eax, [esp + 0x20]
mov dword [esp + 0x60], ecx
push eax
push 0x34
lea eax, [esp + 0x5c]
mov dword [esp + 0x7c], esi
push eax
push dword [esp + 0xcc]
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x94], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
movups xmmword [esp + 0x38], xmm0
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
movups xmmword [esp + 0x50], xmm0
mov dword [esp + 0x60], esi
mov dword [esp + 0x2c], esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
test eax, eax
je 0x4873d3
cmp dword [esp + 0x14], 2
jne 0x4873d3
cmp dword [esp + 0x18], esi
je 0x4873d3
cmp dword [esp + 0x34], esi
je 0x4873d3
cmp dword [esp + 0x38], esi
je 0x4873d3
cmp dword [esp + 0x3c], esi
je 0x4873d3
push esi
lea eax, [esp + 0x14]
mov dword [esp + 0x84], esi
push eax
push 0x34
lea eax, [esp + 0x88]
mov dword [esp + 0x90], esi
push eax
push dword [esp + 0xc4]
xorps xmm0, xmm0
mov dword [esp + 0x9c], esi
movups xmmword [esp + 0xa0], xmm0
mov dword [esp + 0xc0], esi
movups xmmword [esp + 0xb0], xmm0
mov dword [esp + 0x90], 3
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4873d3
mov ecx, dword [esp + 0x34]
mov al, 1
mov dword [ebp + 0x28], ecx
mov ecx, dword [esp + 0x38]
mov dword [ebp + 0x2c], ecx
mov ecx, dword [esp + 0x3c]
mov dword [ebp + 0x30], ecx
mov ecx, dword [esp + 0x18]
mov dword [ebp + 0x34], ecx
jmp 0x4873d5
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret 4
Function at 0x48bdf0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x48bdfb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0048be10
Function at 0x4bf370
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov ebp, edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.00490500
mov esi, eax
add esp, 8
test esi, esi
jne 0x4bf398
lea eax, [esi + 7]
pop edi
pop esi
pop ebp
pop ebx
ret
cmp byte [0x5c1ab4], 0
mov edi, dword [esp + 0x14]
je 0x4bf3e0
mov eax, dword [0x5c1ba4]
test eax, eax
je 0x4bf3bc
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4bf3e0
lea eax, [esi + 4]
mov dword [esi + 8], ebp
push eax
push 0
push esi
push 0x4933f0
push 0
push 0
mov dword [esi + 0xc], edi
call fcn.00556276
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4bf3ed
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x4bf405
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebp
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebp
pop ebx
ret
Function at 0x4cc210
Capabilities:
Reference sql statements

Disassembly:
push ebx
push edi
push dword [esp + 0xc]
mov edi, edx
mov ebx, ecx
push edi
push str.sqlite_master
push edi
push str.SELECT_1_FROM___w_._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push ebx
call fcn.004d10e0
add esp, 0x18
cmp dword [esp + 0xc], 0
jne 0x4cc24a
push edi
push str.sqlite_master
push str.SELECT_1_FROM_temp._s_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push ebx
call fcn.004d10e0
add esp, 0x10
pop edi
pop ebx
ret

Function at 0x4d11f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebx, ecx
mov ebp, edx
mov ecx, dword [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], ebx
xor esi, esi
cmp dword [ebx + 0x14], esi
jle 0x4d128b
nop
mov edi, esi
xor edi, 1
cmp esi, 2
cmovge edi, esi
test ecx, ecx
je 0x4d1243
mov edx, edi
mov eax, ecx
mov ecx, dword [ebx + 0x10]
add edx, edx
mov ebx, dword [ecx + edx*8]
sub ebx, dword [esp + 0x1c]
nop
movzx edx, byte [eax]
movzx ecx, byte [ebx + eax]
cmp edx, ecx
jne 0x4d1268
test edx, edx
jne 0x4d127a
mov ebx, dword [esp + 0x10]
mov eax, dword [ebx + 0x10]
add edi, edi
push 0
mov edx, ebp
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
call fcn.004951a0
add esp, 4
mov eax, dword [eax + 8]
test eax, eax
jne 0x4d12ea
jmp 0x4d1281
movzx ecx, byte [ecx + 0x599bf8]
movzx edx, byte [edx + 0x599bf8]
sub edx, ecx
jne 0x4d127d
inc eax
jmp 0x4d1230
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
inc esi
cmp esi, dword [ebx + 0x14]
jl 0x4d1210
mov edx, str.sqlite_master
sub edx, ebp
movzx ecx, byte [ebp]
movzx eax, byte [edx + ebp]
cmp ecx, eax
jne 0x4d12b6
test ecx, ecx
jne 0x4d12c8
mov eax, dword [ebx + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
test ecx, ecx
jne 0x4d12cb
neg eax
sbb eax, eax
jmp 0x4d12da
movzx eax, byte [eax + 0x599bf8]
movzx ecx, byte [ecx + 0x599bf8]
sub ecx, eax
jne 0x4d12e8
inc ebp
jmp 0x4d1292
test eax, eax
je 0x4d12e8
mov edx, eax
call fcn.00493d10
mov ecx, dword [esp + 0x1c]
test eax, eax
jne 0x4d12e8
mov ebp, str.sqlite_temp_master
jmp 0x4d1203
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4d1630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov eax, ecx
mov dword [esp + 4], edx
push ebx
push edi
xor ebx, ebx
mov dword [esp + 0x10], eax
xor edi, edi
cmp dword [eax + 0x14], ebx
jle 0x4d16ca
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov eax, dword [eax + 0x10]
mov esi, edi
xor esi, 1
cmp edi, 2
cmovge esi, edi
shl esi, 4
add esi, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x4d1689
mov esi, dword [esi]
mov eax, ebp
sub esi, ebp
movzx edx, byte [eax]
movzx ecx, byte [esi + eax]
cmp edx, ecx
jne 0x4d16b5
test edx, edx
jne 0x4d16c7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ecx, [eax + 0x18]
push 0
call fcn.004951a0
add esp, 4
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x4d16ab
mov eax, dword [esp + 0x18]
inc edi
cmp edi, dword [eax + 0x14]
jl 0x4d1652
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
movzx ecx, byte [ecx + 0x599bf8]
movzx edx, byte [edx + 0x599bf8]
sub edx, ecx
jne 0x4d16a1
inc eax
jmp 0x4d1676
pop edi
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x527cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
push edi
push 0x38
xorps xmm0, xmm0
lea eax, [esp + 0x4c]
mov ebp, edx
movlpd qword [esp + 0x2c], xmm0
mov ebx, ecx
mov dword [esp + 0x20], ebp
push 0
movups xmmword [esp + 0x40], xmm0
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x50], 0x13
call fcn.0054d380
add esp, 0xc
lea eax, [esp + 0x48]
mov edx, ebp
mov ecx, ebx
push eax
push 1
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [esp + 0xa0]
call fcn.00518160
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x527ece
push dword [esp + 0x3c]
lea eax, [esp + 0x3c]
mov ecx, ebx
push dword [esp + 0x3c]
lea edx, [esp + 0x50]
mov dword [esp + 0x5c], eax
call fcn.005237e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x527ece
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.00523900
mov esi, eax
cmp esi, 0x64
jne 0x527ece
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebp
mov edi, dword [esp + 0x78]
lea edx, [esp + 0x20]
mov ebp, dword [esp + 0x7c]
xorps xmm0, xmm0
mov ecx, edi
movlpd qword [esp + 0x20], xmm0
add ebp, edi
movlpd qword [esp + 0x30], xmm0
movlpd qword [esp + 0x28], xmm0
call fcn.005143b0
lea esi, [edi + eax]
cmp esi, ebp
jae 0x527eae
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movlpd qword [esp + 0x20], xmm0
call fcn.005143b0
add esi, eax
cmp esi, ebp
jae 0x527eaa
mov ecx, dword [esp + 0x20]
mov eax, ecx
mov edx, dword [esp + 0x24]
or eax, edx
je 0x527e56
cmp ecx, 1
jne 0x527e16
test edx, edx
je 0x527e56
mov eax, dword [esp + 0x28]
add ecx, 0xfffffffe
adc edx, 0xffffffff
add eax, ecx
mov ecx, dword [esp + 0x70]
adc dword [esp + 0x2c], edx
mov edx, dword [esp + 0x74]
push eax
push dword [esp + 0x34]
mov dword [esp + 0x30], eax
push edi
push ebx
push dword [esp + 0x98]
push dword [esp + 0x30]
call fcn.00527c40
xor dword [esp + 0x2c], eax
add esp, 0x18
xor dword [esp + 0x10], edx
jmp 0x527ea2
xorps xmm0, xmm0
or ecx, edx
movlpd qword [esp + 0x30], xmm0
mov ecx, esi
movlpd qword [esp + 0x28], xmm0
je 0x527e78
lea edx, [esp + 0x30]
call fcn.005143b0
add esi, eax
jmp 0x527ea2
lea edx, [esp + 0x20]
call fcn.005143b0
add esi, eax
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xef], 0
je 0x527e9a
sub ebx, dword [esp + 0x20]
sbb edi, dword [esp + 0x24]
jmp 0x527ea2
add ebx, dword [esp + 0x20]
adc edi, dword [esp + 0x24]
cmp esi, ebp
jb 0x527de1
mov ebx, dword [esp + 0x18]
lea edx, [esp + 0x48]
mov ecx, ebx
call fcn.00523900
mov esi, eax
cmp esi, 0x64
je 0x527da4
mov edi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
jmp 0x527ed6
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x48]
call fcn.00524060
mov ecx, dword [esp + 0x8c]
mov edx, edi
pop edi
mov eax, ebp
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x532470
Capabilities:
Reference sql statements

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, edx
mov dword [esp + 0x10], str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
mov esi, ecx
mov dword [esp + 0x14], str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
push edi
mov edi, dword [esi + ebx*4 + 0x18]
test edi, edi
jne 0x5324ac
push dword [esi + 8]
push dword [esi + 4]
push dword [esp + ebx*4 + 0x1c]
push esi
call fcn.00532390
mov edi, eax
add esp, 0x10
mov dword [esi + ebx*4 + 0x18], edi
cmp dword [esi + 0x28], 0
jne 0x53256c
mov ebp, dword [esp + 0x24]
push ebp
push dword [esp + 0x24]
push 1
push edi
call fcn.004b68a0
push edi
call fcn.004b55b0
add esp, 0x14
cmp eax, 0x65
jne 0x532503
mov ecx, str.__parent
test ebx, ebx
mov eax, str.__rowid
cmove eax, ecx
mov ecx, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebp
push ecx
push str.Mapping___lld_____lld__missing_from__s_table
push esi
call fcn.00532410
add esp, 0x1c
jmp 0x53255a
cmp eax, 0x64
jne 0x53255a
push 0
push edi
call fcn.004b5f10
mov ecx, dword [esp + 0x34]
add esp, 8
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0x28]
jne 0x532525
cmp edx, ecx
je 0x53255a
push ecx
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
test ebx, ebx
push ebp
push ecx
mov eax, str.__rowid
mov dword [esp + 0x20], str.__parent
cmove eax, dword [esp + 0x20]
push eax
push edx
push dword [esp + 0x2c]
push ebp
push ecx
push str.Found___lld_____lld__in__s_table__expected___lld_____lld_
push esi
call fcn.00532410
add esp, 0x2c
push edi
call fcn.004b45b0
add esp, 4
cmp dword [esi + 0x28], 0
jne 0x53256c
mov dword [esi + 0x28], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x5369d2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4063c1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x426304]
jne 0x4063cb
repz ret
jmp fcn.004072be

Function at 0x4138ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x426304]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a0cb
and dword [ebp - 0x14], 0
cmp dword [0x428704], 0
mov dword [ebp - 0x18], eax
jne 0x413960
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413a08
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x413a08
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x428704], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x428708], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42870c], eax
call edi
push eax
call esi
mov dword [0x428714], eax
test eax, eax
je 0x413960
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x428710], eax
mov eax, dword [0x428710]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4139b9
cmp dword [0x428714], ecx
je 0x4139b9
push eax
call esi
push dword [0x428714]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4139b9
test ebx, ebx
je 0x4139b9
call edi
test eax, eax
je 0x4139b0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4139b0
test byte [ebp - 8], 1
jne 0x4139b9
or dword [ebp + 0x10], 0x200000
jmp 0x4139ec
mov eax, dword [0x428708]
cmp eax, dword [ebp - 0x18]
je 0x4139ec
push eax
call esi
test eax, eax
je 0x4139ec
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4139ec
mov eax, dword [0x42870c]
cmp eax, dword [ebp - 0x18]
je 0x4139ec
push eax
call esi
test eax, eax
je 0x4139ec
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x428704]
call esi
test eax, eax
je 0x413a08
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413a0a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004063c1
leave
ret
Function at 0x4181bb
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x41db80
call fcn.004194b9
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x4182b2
cmp byte [esi + 0x4a], bl
je 0x4182b2
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x4181f7
xor al, al
jmp 0x4182b4
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004052b0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x418255
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x41825a
dec eax
je 0x41825e
dec eax
dec eax
je 0x4182ae
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401310
mov al, bl
jmp 0x4182b4
mov edx, dword [ebp - 0x2c]
jmp 0x418220
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41826a
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x418290
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x41827d
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.00419ee5
add esp, 0x10
cmp edi, eax
jne 0x418243
cmp byte [esi + 0x4a], 0
je 0x4182ae
test edi, edi
jne 0x418212
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00401f70
jmp 0x418212
mov bl, 1
jmp 0x418245
mov al, 1
call fcn.00419503
ret
Function at 0x4182ba
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x41dbad
call fcn.004194b9
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x4182dc
xor eax, eax
jmp 0x41844f
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x41830a
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x41830a
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x41844f
cmp dword [esi + 0x54], ebx
je 0x41844a
mov ecx, esi
call fcn.004177ed
cmp dword [esi + 0x44], ebx
jne 0x41833a
push dword [esi + 0x54]
push edi
call fcn.00417906
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x41844f
jmp 0x41844a
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.004052b0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4183f7
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push eax
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x14]
xor ebx, ebx
inc ebx
test eax, eax
js 0x41843f
cmp eax, ebx
jg 0x4183ff
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4183a9
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x4183ce
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x4183bc
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push ebx
push eax
call fcn.00419ee5
add esp, 0x10
cmp edi, eax
jne 0x41843f
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], bl
cmp dword [ebp - 0x38], eax
jne 0x41842e
test edi, edi
jne 0x41835b
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x418444
push 8
call fcn.00401f70
jmp 0x41835b
mov edx, dword [ebp - 0x2c]
jmp 0x41836d
cmp eax, 3
jne 0x41843f
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.00417906
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x41841e
mov esi, 0xffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401310
mov ax, si
jmp 0x41844f
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401310
mov ax, word [ebp + 8]
jmp 0x41844f
push 0
lea ecx, [ebp - 0x2c]
push ebx
call fcn.00401310
mov eax, 0xffff
call fcn.00419503
ret 4