joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f7840
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514975
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5522f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x78
call fcn.004275db
mov esi, eax
push 0x74
push 0
lea edx, [esi + 4]
push edx
call fcn.00432620
mov ecx, dword [0x5b500c]
add esp, 0x10
inc ecx
mov dword [0x5b500c], ecx
mov dword [esi], ecx
push 0
push 1
push 1
push 0
call dword [0x5162f0]
push 0xfa0
lea edi, [esi + 8]
mov dword [esi + 4], eax
push edi
call dword [0x51625c]
lea eax, [ebp - 0x10]
mov dword [esi + 0x20], 0
push eax
push 0
push esi
push 0x4f7050
push 0
push 0
mov dword [esi + 0x24], 0
call fcn.00438d7e
add esp, 0x18
test eax, eax
je 0x4f793b
push 0x160
mov dword [esi + 0x6c], eax
call fcn.004275db
mov edx, eax
add esp, 4
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0
mov ecx, dword [0x56ab28]
call fcn.0049af70
push eax
mov ecx, edx
call fcn.004b2720
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x70], eax
mov eax, dword [0x5b5010]
mov dword [esi + 0x74], eax
mov dword [0x5b5010], esi
mov eax, dword [esi]
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [0x516304]
push dword [esi + 4]
call dword [0x5162f4]
push 0x78
push esi
call fcn.0042760b
add esp, 8
mov eax, 0xd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4fa290
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514b91
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x5522f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.004275db
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.004a8a40
mov dword [ebp - 4], 0xffffffff
mov dword [0x5b50d4], eax
call fcn.0044c8f0
push 0xfa0
push 0x5b5074
mov dword [0x5b50b4], 1
call dword [0x51625c]
push 0
push 0
push 0x4f9c50
mov dword [0x5b508c], 1
call fcn.00438cf0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4fa327
push 1
push eax
mov dword [0x5b5100], eax
call dword [0x516300]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4fa3c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514bb7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5522f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov esi, ecx
push 0x34
call fcn.004275db
mov ebx, eax
add esp, 4
lea edi, [ebx + 0x14]
mov dword [ebp - 0x1c], ebx
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [ebx + 0x10], esi
mov esi, ecx
mov dword [ebx + 8], 0
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4fa430
sub esi, edx
mov edx, dword [edi + 0x14]
mov dword [ebp - 0x1c], edx
cmp esi, edx
ja 0x4fa46c
mov dword [ebp - 0x14], edi
mov eax, edi
cmp edx, 0x10
jb 0x4fa452
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
push esi
push ecx
push eax
mov dword [edi + 0x10], esi
call fcn.00432fa0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x4fa54f
cmp esi, 0x7fffffff
ja 0x4fa5ad
mov ecx, esi
or ecx, 0xf
cmp ecx, 0x7fffffff
jbe 0x4fa48c
mov ecx, 0x7fffffff
jmp 0x4fa4b0
mov eax, edx
shr eax, 1
mov dword [ebp - 0x14], eax
mov eax, 0x7fffffff
sub eax, dword [ebp - 0x14]
cmp edx, eax
jbe 0x4fa4a6
mov ecx, 0x7fffffff
jmp 0x4fa4b0
mov eax, dword [ebp - 0x14]
add eax, edx
cmp ecx, eax
cmovb ecx, eax
lea edx, [ecx + 1]
mov dword [ebp - 0x10], ecx
cmp edx, 0x1000
jb 0x4fa4ea
lea eax, [edx + 0x23]
or ecx, 0xffffffff
cmp eax, edx
cmovbe eax, ecx
push eax
call fcn.004275db
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4fa5b2
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
mov ecx, dword [ebp - 0x10]
jmp 0x4fa4fe
test edx, edx
je 0x4fa4fc
push edx
call fcn.004275db
mov ecx, dword [ebp - 0x10]
add esp, 4
jmp 0x4fa4fe
xor eax, eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push eax
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], ecx
call fcn.00432780
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
mov byte [eax + esi], 0
cmp ecx, 0x10
jb 0x4fa54d
mov eax, dword [edi]
inc ecx
cmp ecx, 0x1000
jb 0x4fa540
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4fa5b2
mov eax, edx
push ecx
push eax
call fcn.0042760b
mov eax, dword [ebp - 0x14]
add esp, 8
mov dword [edi], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebx + 0x2c], eax
mov eax, dword [ebp + 0xc]
push 0
push 0x4f9a40
mov dword [ebx + 0x30], eax
call fcn.00438cf0
add esp, 0xc
cmp eax, 0xffffffff
je 0x4fa58f
push 0
push eax
mov dword [ebx], eax
call dword [0x516300]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, ebx
call fcn.00404b10
xor ebx, ebx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004043c0
call fcn.00439a99
int3
Function at 0x4fa6c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x18
mov edi, edx
mov esi, ecx
call fcn.004275db
mov ebx, eax
mov eax, dword [ebp + 8]
push ebx
push 0
push 0x4f9ae0
mov dword [ebx + 4], 0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], eax
call fcn.00438cf0
add esp, 0x10
cmp eax, 0xffffffff
je 0x4fa714
push 2
push eax
mov dword [ebx], eax
call dword [0x516300]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
push 0x18
push ebx
call fcn.0042760b
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4fa7d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x18
mov edi, edx
mov esi, ecx
call fcn.004275db
mov ebx, eax
mov eax, dword [ebp + 8]
push ebx
push 0
push 0x4f9bb0
mov dword [ebx + 4], 0
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], eax
call fcn.00438cf0
add esp, 0x10
cmp eax, 0xffffffff
je 0x4fa824
push 2
push eax
mov dword [ebx], eax
call dword [0x516300]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret
push 0x18
push ebx
call fcn.0042760b
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x503320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor cl, cl
mov dword [ebp - 0x10], esi
xor bl, bl
mov dword [ebp - 0xc], edi
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x5033f9
cmp esi, 0x20
jb 0x5033f9
mov ecx, esi
xorps xmm2, xmm2
and ecx, 0xffffffe0
xorps xmm4, xmm4
xorps xmm3, xmm3
xorps xmm5, xmm5
nop
movups xmm1, xmmword [edi + eax]
movaps xmm0, xmm1
pxor xmm5, xmm1
movups xmm1, xmmword [edi + eax + 0x10]
add eax, 0x20
paddb xmm2, xmm0
movaps xmm0, xmm1
pxor xmm3, xmm1
paddb xmm4, xmm0
cmp eax, ecx
jb 0x503360
pxor xmm3, xmm5
paddb xmm4, xmm2
movaps xmm0, xmm3
psrldq xmm0, 8
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 2
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 1
pxor xmm3, xmm0
movaps xmm0, xmm4
psrldq xmm0, 8
paddb xmm4, xmm0
movd ebx, xmm3
movups xmm0, xmm4
psrldq xmm0, 4
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 2
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 1
paddb xmm4, xmm0
movd ecx, xmm4
mov dword [ebp - 8], ecx
xor dh, dh
mov byte [ebp - 1], 0
cmp eax, esi
jae 0x503444
mov ecx, esi
sub ecx, eax
cmp ecx, 2
mov ch, byte [ebp - 1]
jb 0x503431
lea edi, [esi - 1]
mov esi, dword [ebp - 0xc]
mov dl, byte [esi + eax]
mov cl, byte [esi + eax + 1]
add ch, dl
xor dl, cl
add eax, 2
add dh, cl
xor bl, dl
cmp eax, edi
jb 0x503415
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
cmp eax, esi
jae 0x50343d
mov al, byte [eax + edi]
add byte [ebp - 8], al
xor bl, al
add dh, ch
mov ecx, dword [ebp - 8]
add cl, dh
cmp byte [ebp + 8], cl
jne 0x50345a
cmp byte [ebp + 0xc], bl
jne 0x50345a
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x503470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor bl, bl
push edi
mov dword [ebp - 0xc], ecx
mov edi, edx
xor cl, cl
mov dword [ebp - 0x10], edi
xor eax, eax
mov dword [ebp - 8], ecx
test esi, esi
je 0x50354b
cmp esi, 0x20
jb 0x50354b
mov edx, dword [ebp + 8]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm2, xmm2
xorps xmm4, xmm4
xorps xmm3, xmm3
xorps xmm5, xmm5
movups xmm1, xmmword [edx + eax]
movaps xmm0, xmm1
pxor xmm5, xmm1
movups xmm1, xmmword [edx + eax + 0x10]
add eax, 0x20
paddb xmm2, xmm0
movaps xmm0, xmm1
pxor xmm3, xmm1
paddb xmm4, xmm0
cmp eax, ecx
jb 0x5034b2
pxor xmm3, xmm5
paddb xmm4, xmm2
movaps xmm0, xmm3
psrldq xmm0, 8
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 2
pxor xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 1
pxor xmm3, xmm0
movaps xmm0, xmm4
psrldq xmm0, 8
paddb xmm4, xmm0
movd ebx, xmm3
movups xmm0, xmm4
psrldq xmm0, 4
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 2
paddb xmm4, xmm0
movups xmm0, xmm4
psrldq xmm0, 1
paddb xmm4, xmm0
movd ecx, xmm4
mov dword [ebp - 8], ecx
xor dh, dh
mov byte [ebp - 1], 0
cmp eax, esi
jae 0x5035a7
mov ecx, esi
sub ecx, eax
cmp ecx, 2
mov ch, byte [ebp - 1]
jb 0x503583
lea edi, [esi - 1]
mov esi, dword [ebp + 8]
mov dl, byte [esi + eax]
mov cl, byte [esi + eax + 1]
add ch, dl
xor dl, cl
add eax, 2
add dh, cl
xor bl, dl
cmp eax, edi
jb 0x503567
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x10]
cmp eax, esi
jae 0x503592
mov esi, dword [ebp + 8]
mov al, byte [eax + esi]
add byte [ebp - 8], al
xor bl, al
mov eax, dword [ebp - 8]
add dh, ch
add al, dh
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov byte [edi], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xc]
mov byte [edx], cl
mov byte [edi], bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505b30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x514e7c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5522f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.0050a840
mov dword [ebp - 4], 0
mov dword [ebx], vtable.YCMFEVRPresenter.3.0
mov dword [ebx + 8], vtable.YCMFEVRPresenter.5.0
mov dword [ebx + 0xc], vtable.YCMFEVRPresenter.2.0
mov dword [ebx + 0x10], vtable.YCMFEVRPresenter.4.0
mov dword [ebx + 0x14], vtable.YCMFEVRPresenter.0
mov dword [ebx + 0x18], vtable.YCMFEVRPresenter.6.0
mov dword [ebx + 0x1c], vtable.YCMFEVRPresenter.1.0
mov dword [ebx + 0x20], vtable.YCMFAsyncCallback_class_YCMFEVRPresenter_.0
mov dword [ebx + 0x24], ebx
mov dword [ebx + 0x28], 0x504a50
mov dword [ebx + 0x2c], 0
lea edi, [ebx + 0x34]
mov dword [ebp - 0x18], edi
mov dword [edi], vtable.YCMFEVRPresenter::YSMFEVRPFrameStep.0
lea esi, [edi + 8]
mov dword [ebp - 0x1c], esi
mov dword [esi], 0
mov dword [esi + 4], 0
push 0
push 0
call fcn.00405d00
mov dword [esi], eax
mov byte [ebp - 4], 3
mov dword [edi + 4], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 4
lea ecx, [ebx + 0x4c]
call fcn.004a2060
mov byte [ebp - 4], 5
lea ecx, [ebx + 0x78]
call fcn.0050a720
mov byte [ebp - 4], 6
lea ecx, [ebx + 0xf0]
call fcn.00509cd0
mov byte [ebp - 4], 7
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [ebx + 0x30], 4
mov dword [ebx + 0x150], 0
mov dword [ebx + 0x154], 0
mov dword [ebx + 0x158], 0
mov dword [ebx + 0x15c], 0
mov dword [ebx + 0x160], 0
mov dword [ebx + 0x12c], 0
mov dword [ebx + 0x130], 0
mov dword [ebx + 0x138], 0
mov dword [ebx + 0x134], 0
mov dword [ebx + 0x14c], 0x3f800000
mov dword [ebx + 0x128], 0
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x140], 0
mov dword [ebx + 0x13c], 0
mov dword [ebx + 0x148], 0x3f800000
mov dword [ebx + 0x144], 0x3f800000
mov byte [ebp - 4], 8
wait
push 0x88
call fcn.004275db
add esp, 4
wait
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 9
push esi
mov ecx, eax
call fcn.005097c0
wait
mov byte [ebp - 4], 8
mov dword [ebx + 0x150], eax
push eax
lea ecx, [ebx + 0x78]
call fcn.0050a650
wait
mov dword [ebp - 4], 7
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x5083b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5152f5
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5522f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0050a840
mov dword [ebp - 4], 0
lea ecx, [esi + 0x98]
mov dword [esi], vtable.YCMFPlayer.1.0
mov dword [esi + 8], vtable.YCMFPlayer.0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0x3f800000
mov dword [esi + 0x70], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0x3f800000
mov dword [esi + 0x88], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
call fcn.004a2060
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov word [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [esi + 0x54], 0
mov dword [esi + 0x58], 0x80
mov byte [esi + 0x5c], 0
mov dword [esi + 0x60], 0x3f800000
mov dword [esi + 0x64], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x50a440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
je 0x50a45b
mov eax, 0x8000ffff
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0x34]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x50a46f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x50a47f
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
push ebx
push edi
push 8
lea ebx, [esi + 0x3c]
push ebx
call dword [0x5165a8]
test eax, eax
jne 0x50a4a4
push dword [ebx]
call dword [0x5165c0]
test eax, eax
jne 0x50a4a4
mov dword [esi + 0x44], 1
push 0
push 0
push 0
push 0
call dword [0x5162f0]
mov edi, dword [0x5162b4]
mov dword [esi + 0x50], eax
test eax, eax
jne 0x50a4de
call edi
mov edi, eax
test edi, edi
jle 0x50a4d2
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x50a565
mov edi, dword [0x5162b4]
push 0
push 0
push 0
push 0
call dword [0x5162f0]
mov dword [esi + 0x54], eax
test eax, eax
jne 0x50a508
call edi
mov edi, eax
test edi, edi
jle 0x50a506
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x50a565
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x509f30
push 0
push 0
call fcn.00438d7e
add esp, 0x18
mov dword [esi + 0x4c], eax
test eax, eax
jne 0x50a540
call dword [0x5162b4]
mov edi, eax
test edi, edi
jle 0x50a53e
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x50a565
mov eax, dword [esi + 0x50]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x4c]
push 0xffffffffffffffff
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 0
push eax
push 2
call dword [0x5161ec]
test eax, eax
je 0x50a5a6
mov edi, 0x8000ffff
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x50a57a
push eax
call dword [0x5162f4]
mov dword [esi + 0x4c], 0
mov eax, dword [esi + 0x54]
test eax, eax
je 0x50a58f
push eax
call dword [0x5162f4]
mov dword [esi + 0x54], 0
cmp dword [esi + 0x44], 0
je 0x50a5ae
push dword [ebx]
call dword [0x5165a4]
mov dword [esi + 0x44], 0
jmp 0x50a5ae
mov eax, dword [ebp - 4]
xor edi, edi
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
test eax, eax
je 0x50a5c3
push eax
call dword [0x5162f4]
mov dword [esi + 0x50], 0
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40100c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476008]
jne 0x401016
repz ret
jmp fcn.004018a0

Function at 0x40924e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004053be
and dword [ebp - 4], 0
cmp dword [0x478774], 0
mov ebx, eax
jne 0x4092ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093b0
push eax
call fcn.0040534c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x478774], eax
call esi
push eax
call fcn.0040534c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x478778], eax
call esi
push eax
call fcn.0040534c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47877c], eax
call esi
push eax
call fcn.0040534c
pop ecx
mov dword [0x478784], eax
test eax, eax
je 0x4092ff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040534c
pop ecx
mov dword [0x478780], eax
mov eax, dword [0x478780]
cmp eax, ebx
je 0x409357
cmp dword [0x478784], ebx
je 0x409357
push eax
call fcn.004053c7
push dword [0x478784]
mov esi, eax
call fcn.004053c7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409357
test edi, edi
je 0x409357
call esi
test eax, eax
je 0x40934e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40934e
test byte [ebp - 0xc], 1
jne 0x409357
or dword [ebp + 0x10], 0x200000
jmp 0x409390
mov eax, dword [0x478778]
cmp eax, ebx
je 0x409390
push eax
call fcn.004053c7
pop ecx
test eax, eax
je 0x409390
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409390
mov eax, dword [0x47877c]
cmp eax, ebx
je 0x409390
push eax
call fcn.004053c7
pop ecx
test eax, eax
je 0x409390
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x478774]
call fcn.004053c7
pop ecx
test eax, eax
je 0x4093b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b770
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x27608b4], 0x930
jne 0x40b78d
push str.butupoxehurelelehocosohixunexa
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
cmp dword [0x27608b4], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x27605d0], eax
jne 0x40b7b3
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
lea ecx, [ebp - 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov esp, ebp
pop ebp
ret
Function at 0x100035f8
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x10003645
mov al, cl
cmp al, 0x61
jb 0x10003620
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x10003645
mov al, cl
cmp al, 0x61
jb 0x10003638
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x10003611
cmp edx, dword [esp + 0x18]
je 0x10003655
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x1000360a
xor eax, eax
jmp 0x10003658
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x10003660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x10003747
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x1000374d
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x100036ac
cmp al, 0x61
jb 0x100036a4
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x10003697
cmp edx, dword [esp + 0x14]
je 0x100036bc
dec ecx
jne 0x1000368c
xor eax, eax
jmp 0x10003747
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x10003747
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x10003747
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x100036f8
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x10003707
jmp 0x100036ef
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.100035f8
test eax, eax
je 0x10003747
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x10003742
cmp al, 0x61
jb 0x1000373a
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x1000372d
call fcn.10003660
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x10003765
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x10003765
sub edx, ecx
mov ecx, edx
jmp 0x100036bc
xor eax, eax
jmp 0x10003747
Function at 0x10004616
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.100048b5
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.100048b5
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x10004692
call fcn.10001ece
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 0x13
call fcn.100048c1
cmp dword [ebp - 0x18], esp
je 0x100046c8
push 0x75
push 0x4022fc2
push 6
call fcn.100048bb
add esp, 0xc
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 0x14
call fcn.100048c1
cmp dword [ebp - 0x18], esp
je 0x10004700
push 0xa2
push 0x4022fc2
push 6
call fcn.100048bb
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 0x1008961c
push 0
mov eax, 0x15
call fcn.100048c1
cmp dword [ebp - 0x18], esp
je 0x10004736
push 0xcc
push 0x4022fc2
push 6
call fcn.100048bb
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x16
call fcn.100048c1
cmp dword [ebp - 0x18], esp
je 0x100047cf
push 0x1dc
push 0x4022fc2
push 6
call fcn.100048bb
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 0x17
call fcn.100048c1
cmp dword [ebp - 0x18], esp
je 0x100047fe
push 0x21c
push 0x4022fc2
push 6
call fcn.100048bb
add esp, 0xc
mov eax, dword [ebp - 0x14]
jmp 0x10004806
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.100048af
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.100048af
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8