joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441070
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4410a3
push esi
call fcn.00444160
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44109c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441129
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441112
mov eax, dword [esi + 8]
test eax, eax
je 0x4410c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44110e
cmp eax, 2
je 0x441112
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4410ba
cmp eax, 3
je 0x4410ed
cmp eax, 1
jne 0x4410ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4410ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4410ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441150
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441138
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441150
add esp, 4
pop esi
ret

Function at 0x44e4e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44e583
test eax, eax
jbe 0x44e583
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44e583
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44e52e
xor esi, esi
jmp 0x44e534
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44e55f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00451f10
add esi, eax
push esi
mov ebx, esi
call fcn.00451f10
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44e540
pop ebp
test edi, edi
pop edi
jne 0x44e583
test ebx, ebx
je 0x44e583
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00470170
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44e6c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44e7dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44e7dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0048486e
mov esi, eax
test esi, esi
je 0x44e7dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44e7dd
mov ecx, esi
call fcn.0044e630
cmp edi, eax
jge 0x44e7dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44e763
mov dword [esp + 0x34], 1
jmp 0x44e7be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44e7dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044dba0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x459dd0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x459de0
mov esi, 1
push esi
call fcn.00470357
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x459e32
call fcn.0047165a
mov edi, eax
call fcn.0045c930
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x459e16
mov edx, dword [0x4eaef8]
mov dword [0x4eaef4], edx
test al, 0x18
je 0x459e27
push esi
push 0x24
push 5
call fcn.0045d180
add esp, 0xc
test edi, edi
je 0x459e4d
push 1
call fcn.00471335
test byte [esp + 0x14], 0x20
je 0x459e4d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x45af50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x45b044
cmp byte [edx], 0
je 0x45b037
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.0045aed0
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.0045aed0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.0045ae40
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x45b001
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.0045ae80
fmul qword [0x4d0278]
push ecx
fstp qword [esp]
call fcn.0046ecf8
fadd qword [0x4d0270]
add esp, 8
call fcn.0046edc8
mov byte [ebx], al
inc ebx
dec edi
jne 0x45afd4
lea ecx, [esp + 0x20]
push ecx
call fcn.0045ae80
fmul qword [0x4d0278]
push ecx
fstp qword [esp]
call fcn.0046ecf8
add esp, 8
call fcn.0046edc8
cmp esi, ebx
je 0x45b02d
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x45b026
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x45b440
mov byte [edi + esi], 2
jmp 0x45b477
test al, 4
je 0x45b44a
mov byte [edi + esi], 0xd
jmp 0x45b477
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x45b463
mov byte [edi + esi], 2
jmp 0x45b477
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x45b473
mov byte [edi + esi], 0x19
jmp 0x45b477
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x45b427
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x45b4eb
cmp dl, 0xd
je 0x45b4eb
xor edx, edx
jmp 0x45b4f0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x45b4db
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x45b510
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.00459dd0
mov esi, eax
add esp, 8
test esi, esi
jne 0x45b531
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.0045cb70
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x45b556
push esi
call fcn.00459e60
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.0047e0b9
push ebx
push edi
mov ebp, eax
call fcn.0045cbe0
push 0x45b590
push ebp
push esi
call fcn.0045df10
push esi
call fcn.00459e60
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x45c8a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0x5d69e0
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5d6910]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x45c91b
push 0x4c
push 1
call fcn.00470da1
mov esi, eax
add esp, 8
test esi, esi
jne 0x45c8e3
push 0x5d69e0
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0x5d6910]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x5cbdd0]
inc eax
lea edx, [esi + 0xc]
mov dword [0x5cbdd0], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.00460450
add esp, 8
mov byte [esi + 0x3c], 1
push 0x5d69e0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x45cda0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.0047165a
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.0047e0b9
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x45ce9a
call fcn.0047165a
cmp dword [eax], 0
je 0x45cde7
call fcn.0047165a
mov ebp, dword [eax]
jmp 0x45cdea
or ebp, 0xffffffff
call fcn.0045c930
test esi, esi
mov dword [eax], ebp
jne 0x45cdff
call fcn.0047165a
cmp dword [eax], 4
je 0x45ce4f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x45ce32
cmp esi, 0xffffffff
je 0x45ce74
test al, 6
je 0x45ce32
call fcn.0045c930
mov ecx, dword [eax]
push ecx
push ebx
call fcn.00460480
add esp, 4
push eax
push 0x24
push 9
call fcn.0045d180
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x45ce92
test al, 6
je 0x45ce40
test ah, 2
je 0x45ce92
test esi, esi
jbe 0x45ce9e
test ah, 2
je 0x45ce9e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.0047165a
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.0047e0b9
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x45ce9a
jmp 0x45cdd4
call fcn.0045c930
mov eax, dword [eax]
push eax
push ebx
call fcn.00460480
add esp, 4
push eax
push 0x24
push 2
call fcn.0045d180
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x45ceab
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x45ceb4
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x4728e4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x472904
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004715e7
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x472927
test byte [esp + 8], 2
je 0x472927
call fcn.0047165a
mov dword [eax], 0xd
call fcn.00471663
mov dword [eax], 5
jmp 0x472900
xor eax, eax
ret
Function at 0x485211
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x485249
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004832c5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048329d
jmp 0x485255
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x486903
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x486945
call fcn.0048c452
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x486945
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48693c
xor eax, eax
jmp 0x48694d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00486953
pop edi
pop esi
pop ebx
ret 4

Function at 0x48c982
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48c9b0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48c9ce
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048c8e8
jmp 0x48c9ce
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48c9ce
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048c8e8
test edi, edi
mov eax, edi
jne 0x48c9b8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402200
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x130
mov eax, dword [0x421214]
xor eax, esp
mov dword [esp + 0x12c], eax
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x402233
cmp dword [esp + 0x154], 0x10
jmp 0x4022d6
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x10], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x402262
cmp dword [esp + 0x154], 0x10
jb 0x4022e8
mov edx, dword [esp + 0x140]
push edx
jmp 0x4022e0
mov edi, 0x10
jmp 0x402270
mov ecx, dword [esp + 0x140]
cmp dword [esp + 0x154], edi
jae 0x402287
lea ecx, [esp + 0x140]
lea eax, [esp + 0x2c]
jmp 0x402290
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4022b0
test dl, dl
je 0x4022ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4022b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x402290
xor eax, eax
jmp 0x4022b5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402302
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x402270
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x154], edi
jb 0x4022e8
mov eax, dword [esp + 0x140]
push eax
call fcn.00408cf9
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004086af
add esp, 0x130
ret
mov ecx, dword [esp + 0x10]
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp dword [esp + 0x154], edi
jb 0x40232b
mov edx, dword [esp + 0x140]
push edx
call fcn.00408cf9
add esp, 4
mov ecx, dword [esp + 0x134]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.004086af
add esp, 0x130
ret

Function at 0x4032a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41aee0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x421214]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0xc], edi
mov eax, dword [0x464de0]
mov ecx, dword [eax + 4]
mov dword [ecx + 0x464de0], 0x41e8b8
mov edx, dword [0x464de0]
mov esi, dword [edx + 4]
add esi, 0x464de0
mov dword [esp + 0x10], 0x464de0
call fcn.00401c20
mov eax, dword [esp + 0x24]
push esi
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], edi
call fcn.004052c0
mov byte [esi + 0x30], al
cmp dword [esi + 0x28], edi
jne 0x403320
mov eax, dword [esi + 8]
or eax, 4
push edi
push eax
mov ecx, esi
call fcn.00401ac0
mov eax, 0x464de0
mov dword [esi + 4], edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
Function at 0x4041a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41aa2b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x421214]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00419292
push 4
mov dword [esp + 0x20], 0
call fcn.00408e42
mov edi, eax
add esp, 4
test edi, edi
je 0x40421e
call fcn.00418efe
mov dword [edi], eax
call fcn.00418d2c
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0041904e
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404213
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.00419076
jmp 0x404220
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x406130
Capabilities:
Create thread

Disassembly:
ret
call fcn.00406225
pop eax
pop edx
pop dword [0x453fb4]
pop ecx
test edx, edx
push eax
je 0x40612f
push ebx
push esi
push edi
push ebp
mov ebx, 0x451fa4
mov ebp, 0x453fc8
xor eax, eax
mov dword [ebp - 0x10], eax
test cl, 1
mov esi, 0x405f34
jne 0x40616b
test cl, 2
lea esi, [esi + 0xc]
jne 0x40616b
lea esi, [esi - 0x14]
test cl, 8
setne byte [ebp - 0x18]
and cl, 0x10
mov byte [ebp - 0x17], cl
mov edi, ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, edx
cmp dword [ebp - 4], eax
jne 0x40618a
mov word [ebp - 4], 0x8000
push eax
push eax
push eax
push eax
push eax
push eax
push 0x405f1c
push 0xffffffffffffffff
push ebx
call dword [sym.imp.WINMM.dll_waveOutOpen]
call dword [sym.imp.KERNEL32.dll_HeapCreate]
test eax, eax
mov dword [ebx - 8], eax
je 0x4061b9
mov dword [ebp - 0xc], esi
call fcn.004069b8
xchg edi, eax
call dword [ebp + 8]
test edi, edi
je 0x406229
mov esi, 0x463fd8
mov dword [esi + 4], 0x10000
or dword [esi + 0x14], 0xffffffff
push 0xc
mov dword [esi], 0x453fd8
pop dword [esi + 0x10]
push 0x20
push esi
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
xor edi, edi
call fcn.004062ee
cmp dword [ebx + 4], edi
jne 0x4061e3
mov dword [ebx + 8], edi
push 0x20
push esi
push dword [ebx]
call dword [sym.imp.WINMM.dll_waveOutWrite]
test eax, eax
jne 0x406229
push ebp
push edi
push edi
push 0x406298
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebx - 4], eax
je 0x406229
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xchg ebx, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov ebp, 0x451fa0
mov eax, dword [ebp]
test eax, eax
je 0x406247
mov dword [ebp + 0xc], eax
push eax
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov dword [ebp], ebx
mov edi, dword [ebp + 4]
mov dword [ebp + 8], ebx
test edi, edi
je 0x406275
mov dword [ebp + 4], ebx
push edi
push 0x20
push 0x463fd8
push edi
push edi
call dword [sym.imp.WINMM.dll_waveOutReset]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov eax, dword [ebp - 4]
test eax, eax
je 0x406293
mov dword [ebp - 4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xchg ebx, eax
mov ecx, 0x23
mov edi, 0x463ff8
rep stosd dword es:[edi], eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x407840
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x2849c
call fcn.00409060
mov eax, dword [0x421214]
push ebx
push esi
push edi
push 0
push 8
mov dword [esp + 0x284ac], eax
mov dword [esp + 0x20180], 0x224
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
je 0x407a15
lea eax, [esp + 0x20178]
push eax
push ebx
call sub.KERNEL32.dll_Module32First
cmp eax, 1
jne 0x407a0e
lea esp, [esp]
mov esi, dword [ebp + 8]
lea eax, [esp + 0x20198]
lea ebx, [ebx]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4078d4
test cl, cl
je 0x4078d0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4078d4
add eax, 2
add esi, 2
test cl, cl
jne 0x4078b0
xor eax, eax
jmp 0x4078d9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4079f7
mov edx, dword [esp + 0x2018c]
mov ecx, 0x10
mov esi, edx
lea edi, [esp + 0x20138]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x20174]
lea esi, [eax + edx]
mov ecx, 0x3e
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0xb8]
test eax, eax
je 0x4079f7
lea esi, [eax + edx]
mov ecx, 0xa
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
lea esi, [eax + edx]
mov eax, dword [esp + 0x3c]
mov ecx, ebx
lea edi, [esp + 0x138]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + edx]
lea ecx, [ebx + ebx]
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x204a0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x34]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x2c]
lea esi, [eax + edx]
xor eax, eax
test ebx, ebx
lea edi, [esp + 0x10138]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], eax
jbe 0x4079f3
lea ecx, [ecx]
mov esi, dword [esp + eax*4 + 0x138]
add esi, edx
mov ecx, 0x3f
lea edi, [esp + 0x203a0]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [esp + eax*2 + 0x204a0]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [esp + ecx*4 + 0x10138]
mov esi, dword [ebp + 0xc]
add edi, edx
lea eax, [esp + 0x203a0]
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x4079d9
test cl, cl
je 0x4079d5
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x4079d9
add eax, 2
add esi, 2
test cl, cl
jne 0x4079b5
xor eax, eax
jmp 0x4079de
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407a2a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jb 0x407980
mov ebx, dword [esp + 0x10]
lea edx, [esp + 0x20178]
push edx
push ebx
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
je 0x4078a0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x284a4]
call fcn.004086af
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x284a4]
mov eax, edi
call fcn.004086af
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret