joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x403014]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0xa8c]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa8c]
push eax
mov dword [ebp - 0xa8c], esi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
call esi
mov edi, eax
lea eax, [ebp - 0xa38]
push eax
mov dword [ebp - 0xa38], ebx
call esi
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x401064
sub eax, ecx
sar eax, 1
mov ecx, eax
mov eax, str._impress
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, bx
jne 0x40107c
sub eax, edx
sar eax, 1
add eax, ecx
lea eax, [eax + eax + 4]
call fcn.00401230
mov edi, esp
mov dword [ebp - 0xa30], edi
call esi
mov edx, edi
movzx ecx, word [eax]
inc eax
mov word [edx], cx
inc eax
inc edx
inc edx
cmp cx, bx
jne 0x4010a1
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4010b2
mov esi, 0x40211c
mov eax, str._impress
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4010ca
mov edi, dword [ebp - 0xa30]
sub eax, edx
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
cmp cx, bx
jne 0x4010de
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll__wsplitpath]
push 0x402120
push str.soffice
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll__wmakepath]
add esp, 0x28
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0xa8c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp - 0xa30]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4011b1
push 0xffffffffffffffff
push dword [ebp - 0xa48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xa48]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xa44]
call esi
xor eax, eax
jmp 0x4011f2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push ebx
push ebx
lea ecx, [ebp - 0xa34]
push ecx
push 0x400
push eax
push ebx
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x10
push ebx
push dword [ebp - 0xa34]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0xa34]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
lea esp, [ebp - 0xa98]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040121c
leave
ret 0x10
Function at 0x40121c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403014]
jne 0x401226
repz ret
jmp fcn.004015dc
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x463004]
jne 0x40100a
repz ret
jmp fcn.0040130d

Function at 0x403f8b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x463004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402540
and dword [ebp - 0x14], 0
cmp dword [0x465adc], 0
mov dword [ebp - 0x18], eax
jne 0x40403e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4040e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4040e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x465adc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x465ae0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x465ae4], eax
call edi
push eax
call esi
mov dword [0x465aec], eax
test eax, eax
je 0x40403e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x465ae8], eax
mov eax, dword [0x465ae8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404097
cmp dword [0x465aec], ecx
je 0x404097
push eax
call esi
push dword [0x465aec]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404097
test ebx, ebx
je 0x404097
call edi
test eax, eax
je 0x40408e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40408e
test byte [ebp - 8], 1
jne 0x404097
or dword [ebp + 0x10], 0x200000
jmp 0x4040ca
mov eax, dword [0x465ae0]
cmp eax, dword [ebp - 0x18]
je 0x4040ca
push eax
call esi
test eax, eax
je 0x4040ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4040ca
mov eax, dword [0x465ae4]
cmp eax, dword [ebp - 0x18]
je 0x4040ca
push eax
call esi
test eax, eax
je 0x4040ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x465adc]
call esi
test eax, eax
je 0x4040e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4040e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x409ce0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x463f60]
sub esp, 0x10
push esi
mov esi, dword [0x4aaea8]
push edi
mov edi, dword [0x4ab184]
push eax
call fcn.00409bd0
add esp, 4
cmp dword [0x4ab184], 0x2f
jne 0x409d40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Bihux_nivew_zuziduzaz_winojego_roli
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push esi
call fcn.00409c20
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409fd0
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x4ab184]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
nop
cmp eax, 0x8cf
jne 0x409ff2
push 0
push 0
call edi
mov eax, dword [0x4ab184]
cmp esi, 0x845013
jne 0x40a009
mov eax, dword [0x464d80]
add eax, 0xa231
mov dword [0x4ab184], eax
cmp eax, 0x141
jne 0x40a024
mov dword [0x466020], 0xec58acac
mov dword [0x466024], 0xffffffff
inc esi
cmp esi, 0xbbe2a98
jl 0x409fe0
call fcn.00409d50
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x406b80
Capabilities:
Reference sql statements

Disassembly:
push 0xffffffffffffffff
push 0x40bef8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 8]
mov ecx, esi
push eax
push 0x3f1
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CWnd::GetDlgItemTextA
lea ecx, [esp + 4]
push ecx
push 0x3f0
mov ecx, esi
call sub.MFC42.DLL_CWnd::GetDlgItemTextA
mov edx, dword [esp + 8]
mov eax, dword [edx - 8]
test eax, eax
je 0x406c38
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x406c38
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
push edx
lea eax, [esp + 0x14]
push str.SELECT__FROM_CP_WHERE__s_s
push eax
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push ecx
mov ecx, esi
call fcn.00405fc0
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 1
call fcn.0040afa0
jmp 0x406c44
push str.SELECT__FROM_CP
mov ecx, esi
call fcn.00405fc0
lea ecx, [esp + 4]
mov byte [esp + 0x18], 0
call fcn.0040afa0
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040afa0
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x101417c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x101803d0
call fcn.1006fb85
mov eax, dword [0x1017d958]
mov dword [ebp - 8], eax
jmp 0x101417f7
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x10141810
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x1014180e
mov eax, dword [ebp - 8]
jmp 0x10141893
jmp 0x101417ef
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.1006f2f2
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10141890
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
mov dword [eax], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x20
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 8]
cmp eax, 0xfe0
jbe 0x10141853
mov eax, dword [ebp - 8]
mov ecx, dword [0x1017d958]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov dword [0x1017d958], eax
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret
Function at 0x10143360
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea edi, [ebp - 0x4c]
mov ecx, 0x13
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10176880]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10180558
call fcn.1006fb85
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x1017d940]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x101433cd
mov eax, dword [ebp - 0x30]
sub eax, 5
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
add eax, 2
mov dword [ebp - 0x24], eax
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1006f2f2
test eax, eax
jne 0x101433f8
mov eax, 0xa
jmp 0x101434fa
cmp dword [ebp + 0xc], 0
je 0x10143445
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov byte [eax], 0xe9
mov eax, dword [ebp - 0x30]
add eax, 5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
sub edx, eax
mov eax, dword [ebp - 0x3c]
mov dword [eax + 1], edx
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10143443
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov byte [eax], 0xeb
mov eax, dword [ebp - 0x48]
mov byte [eax + 1], 0xf9
jmp 0x10143481
mov eax, dword [ebp - 0xc]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x1014346c
push 7
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.1006fa36
add esp, 0xc
jmp 0x10143481
push 5
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.1006fa36
add esp, 0xc
mov esi, esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1006f2f2
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1006f2f2
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.1006f2f2
mov al, byte [ebp + 0xc]
and al, 1
shl al, 1
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfd
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
mov al, byte [ebp + 0xc]
and al, 1
shl al, 2
mov ecx, dword [ebp - 0xc]
mov dl, byte [ecx + 0x14]
and dl, 0xfb
or dl, al
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], dl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x1014352c]
call fcn.1006efb4
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006eb4f
add esp, 0x10c
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret
Function at 0x10143680
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
lea edi, [ebp - 0x40]
mov ecx, 0x10
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x10176880]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0x10180558
call fcn.1006fb85
push 0
push 4
call fcn.1006ea96
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x1014380b
mov dword [ebp - 0x30], 0x1c
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1006e965
test eax, eax
je 0x101437f8
cmp dword [ebp - 0x30], 0x10
jb 0x101437dc
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.1006f2f2
cmp dword [ebp - 0x24], eax
jne 0x101437dc
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.1006f2f2
cmp dword [ebp - 0x28], eax
je 0x101437dc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10143763
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
mov esi, esp
push ecx
push 0
mov edx, dword [0x1017d4e4]
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.1006f2f2
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x10143761
jmp 0x101437f8
jmp 0x101437bc
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x101437bc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x1017d4e4]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.1006f2f2
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x101437a6
jmp 0x101437f8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov edx, dword [ebp - 0x28]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
add ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 0x30], 0x1c
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.1006e0d2
test eax, eax
jne 0x101436e1
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1006f2f2
push edx
mov ecx, ebp
push eax
lea edx, [0x1014383c]
call fcn.1006efb4
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006eb4f
add esp, 0x100
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret
Function at 0x10143ae0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10180558
call fcn.1006fb85
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10143680
add esp, 4
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10143bbb
mov dword [ebp - 8], 0
jmp 0x10143b4c
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10143bbb
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1006f2f2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10143bb9
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1006f2f2
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call fcn.101448c0
add esp, 0xc
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1006f2f2
jmp 0x10143b43
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret

Function at 0x10144c70
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
lea edi, [ebp - 0x18]
mov ecx, 6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10180558
call fcn.1006fb85
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x10144d2c
mov dword [ebp - 8], 0
jmp 0x10144cb3
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10144d0e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov esi, esp
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx*4]
push eax
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.1006f2f2
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10144d0c
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.1006f2f2
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.1006f2f2
jmp 0x10144caa
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push 0
mov edx, dword [0x1017d4e4]
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.1006f2f2
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret
Function at 0x10145460
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x1018061c
call fcn.1006fb85
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x101454c8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x90
je 0x101454c8
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0xcc
je 0x101454c8
xor eax, eax
jmp 0x10145509
mov dword [ebp - 8], 1
jmp 0x101454da
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0xc]
jae 0x10145504
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
mov edx, 1
imul eax, edx, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + eax]
cmp ecx, eax
je 0x10145502
xor eax, eax
jmp 0x10145509
jmp 0x101454d1
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.1006f2f2
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a4004]
jne 0x40100a
repz ret
jmp fcn.00401368

Function at 0x40425b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a4004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403568
and dword [ebp - 0x14], 0
cmp dword [0x4a6940], 0
mov dword [ebp - 0x18], eax
jne 0x40430e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4043b6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4043b6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a6940], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a6944], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a6948], eax
call edi
push eax
call esi
mov dword [0x4a6950], eax
test eax, eax
je 0x40430e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4a694c], eax
mov eax, dword [0x4a694c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404367
cmp dword [0x4a6950], ecx
je 0x404367
push eax
call esi
push dword [0x4a6950]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404367
test ebx, ebx
je 0x404367
call edi
test eax, eax
je 0x40435e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40435e
test byte [ebp - 8], 1
jne 0x404367
or dword [ebp + 0x10], 0x200000
jmp 0x40439a
mov eax, dword [0x4a6944]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40439a
mov eax, dword [0x4a6948]
cmp eax, dword [ebp - 0x18]
je 0x40439a
push eax
call esi
test eax, eax
je 0x40439a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a6940]
call esi
test eax, eax
je 0x4043b6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4043b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x4a05d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
mov edx, dword [0x1f78de4]
mov eax, dword [0x1f78b08]
xor ecx, ecx
mov word [0x1f78e00], cx
lea ecx, [ebp - 8]
push ecx
push 0x40
push edx
push eax
mov dword [0x1f78dec], 0x6e0072
mov dword [0x1f78df0], 0x6c0065
mov dword [0x1f78df4], 0x320033
mov dword [0x1f78df8], 0x64002e
mov dword [0x1f78dfc], 0x6c006c
mov dword [0x1f78de8], 0x65006b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x4a0750
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x4a4004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp edi, 0x182
jne 0x4a077d
lea eax, [ebp - 0x820]
push eax
push str.wosevir
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push esi
xor esi, esi
test edi, edi
jle 0x4a07c4
cmp edi, 0x2d
jne 0x4a0791
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
call fcn.004a0690
xor byte [ebx + esi], al
cmp edi, 0xf
jne 0x4a07bf
push 0
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
inc esi
cmp esi, edi
jl 0x4a0784
pop esi
cmp edi, 0x2d
jne 0x4a07de
mov dword [0x1f79170], 0xa62e7790
mov dword [0x1f79174], 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret

Function at 0x4a07f0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4a4dc0]
sub esp, 0x10
push ebx
mov ebx, dword [0x1f78b08]
push edi
mov edi, dword [0x1f78de4]
push eax
call fcn.004a0700
add esp, 4
cmp dword [0x1f78de4], 0x2f
jne 0x4a084d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.004a0750
pop edi
pop ebx
mov esp, ebp
pop ebp
ret