joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448a20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cee9c
mov dword [ebp - 0x38], 0x690064
lea esi, [ebp - 0x38]
mov dword [ebp - 0x34], 0x6c0061
push edi
mov dword [ebp - 0x30], 0x67006f
mov edx, 0x1b
mov dword [ebp - 0x2c], 0x630020
sub esi, eax
mov dword [ebp - 0x28], 0x69006c
mov dword [ebp - 0x24], 0x6b0063
mov dword [ebp - 0x20], 0x20002e
mov dword [ebp - 0x1c], 0x6e004f
mov dword [ebp - 0x18], str._z_tr
mov dword [ebp - 0x14], 0x73006f
mov dword [ebp - 0x10], 0x420065
mov dword [ebp - 0xc], 0x6e0074
mov dword [ebp - 8], 0x20
nop dword [eax]
lea ecx, [edx + 0x7fffffe3]
test ecx, ecx
je 0x448abe
movzx ecx, word [esi + eax]
test cx, cx
je 0x448abe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x448aa0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5cee9c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x448ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x57d040]
mov ecx, 0x5cef28
push esi
lea esi, [ebp - 0x20]
mov dword [ebp - 0x10], 0x69746f4e
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x6e744270
mov edx, 0x1b
mov word [ebp - 8], 0x20
sub esi, ecx
nop
lea eax, [edx + 0x7fffffe3]
test eax, eax
je 0x448b39
mov al, byte [esi + ecx]
test al, al
je 0x448b39
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x448b20
lea eax, [ecx - 1]
test edx, edx
pop esi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [eax], 0
mov eax, 0x5cef28
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x448bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x57d040]
mov ecx, 0x5cef0c
push esi
lea esi, [ebp - 0x20]
mov dword [ebp - 0x10], 0x74736154
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0xc], 0x6e744265
mov edx, 0x1b
mov word [ebp - 8], 0x20
sub esi, ecx
nop
lea eax, [edx + 0x7fffffe3]
test eax, eax
je 0x448c49
mov al, byte [esi + ecx]
test al, al
je 0x448c49
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x448c30
lea eax, [ecx - 1]
test edx, edx
pop esi
cmovne eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [eax], 0
mov eax, 0x5cef0c
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x4546c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x24], 0x77002f
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x24]
mov eax, 0x5cf8c0
mov dword [ebp - 0x20], 0x5f0064
push edi
mov dword [ebp - 0x1c], 0x6f0070
mov edx, 0x10
mov dword [ebp - 0x18], 0x750070
sub esi, eax
mov dword [ebp - 0x14], 0x5f0070
mov dword [ebp - 0x10], 0x680073
mov dword [ebp - 0xc], 0x77006f
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffee]
test ecx, ecx
je 0x45473e
movzx ecx, word [esi + eax]
test cx, cx
je 0x45473e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x454720
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, 0x5cf8c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x454760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cfc48
mov dword [ebp - 0x24], 0x780059
lea esi, [ebp - 0x24]
mov dword [ebp - 0x20], 0x470068
mov dword [ebp - 0x1c], 0x6d0061
mov edx, 0x11
mov dword [ebp - 0x18], str.fgk
sub esi, eax
mov dword [ebp - 0x14], 0x610072
mov dword [ebp - 0x10], 0x2e0079
mov dword [ebp - 0xc], 0x780065
mov dword [ebp - 8], 0x65
nop dword [eax + eax]
lea ecx, [edx + 0x7fffffed]
test ecx, ecx
je 0x4547de
movzx ecx, word [esi + eax]
test cx, cx
je 0x4547de
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4547c0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cfc48
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x454800
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5cfa1c
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], 0x630069
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x454883
movzx ecx, word [esi + eax]
test cx, cx
je 0x454883
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x454865
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cfa1c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x454a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x74], 0x4f0053
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x74]
mov eax, 0x5cfe18
mov dword [ebp - 0x70], 0x540046
push edi
mov dword [ebp - 0x6c], 0x410057
mov edx, 0x38
mov dword [ebp - 0x68], 0x450052
sub esi, eax
mov dword [ebp - 0x64], 0x4d005c
mov dword [ebp - 0x60], 0x630069
mov dword [ebp - 0x5c], 0x6f0072
mov dword [ebp - 0x58], 0x6f0073
mov dword [ebp - 0x54], 0x740066
mov dword [ebp - 0x50], 0x57005c
mov dword [ebp - 0x4c], 0x6e0069
mov dword [ebp - 0x48], 0x6f0064
mov dword [ebp - 0x44], 0x730077
mov dword [ebp - 0x40], 0x43005c
mov dword [ebp - 0x3c], 0x720075
mov dword [ebp - 0x38], 0x650072
mov dword [ebp - 0x34], str.mMj_
mov dword [ebp - 0x30], 0x650056
mov dword [ebp - 0x2c], 0x730072
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x5c006e
mov dword [ebp - 0x20], 0x6e0055
mov dword [ebp - 0x1c], 0x6e0069
mov dword [ebp - 0x18], 0x740073
mov dword [ebp - 0x14], 0x6c0061
mov dword [ebp - 0x10], 0x5c006c
mov dword [ebp - 0xc], 0x730025
lea ecx, [edx + 0x7fffffc6]
test ecx, ecx
je 0x454b53
movzx ecx, word [esi + eax]
test cx, cx
je 0x454b53
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x454b35
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cfe18
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x454b80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x68], 0x740068
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x68]
mov eax, 0x5cfad8
mov dword [ebp - 0x64], 0x700074
push edi
mov dword [ebp - 0x60], 0x3a0073
mov edx, 0x32
mov dword [ebp - 0x5c], 0x2f002f
sub esi, eax
mov dword [ebp - 0x58], 0x610077
mov dword [ebp - 0x54], 0x2e006e
mov dword [ebp - 0x50], 0x75006c
mov dword [ebp - 0x4c], 0x610064
mov dword [ebp - 0x48], 0x680073
mov dword [ebp - 0x44], 0x2e0069
mov dword [ebp - 0x40], 0x6f0063
mov dword [ebp - 0x3c], 0x2f006d
mov dword [ebp - 0x38], 0x6d0063
mov dword [ebp - 0x34], 0x2f0073
mov dword [ebp - 0x30], 0x700061
mov dword [ebp - 0x2c], 0x2f0069
mov dword [ebp - 0x28], str._rT_1r
mov dword [ebp - 0x24], 0x720063
mov dword [ebp - 0x20], 0x5f006f
mov dword [ebp - 0x1c], 0x6c0063
mov dword [ebp - 0x18], 0x650069
mov dword [ebp - 0x14], str.mMj_
mov dword [ebp - 0x10], 0x70002e
mov dword [ebp - 0xc], 0x700068
lea ecx, [edx + 0x7fffffcc]
test ecx, ecx
je 0x454c6e
movzx ecx, word [esi + eax]
test cx, cx
je 0x454c6e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x454c50
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5cfad8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x455360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cf8f8
mov dword [ebp - 0x20], 0x64002f
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x790061
mov edx, 0xf
mov dword [ebp - 0x14], 0x75005f
sub esi, eax
mov dword [ebp - 0x10], 0x69006e
mov dword [ebp - 0xc], 0x73006e
mov dword [ebp - 8], 0x74
lea ecx, [edx + 0x7fffffef]
test ecx, ecx
je 0x4553cf
movzx ecx, word [esi + eax]
test cx, cx
je 0x4553cf
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4553b1
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cf8f8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x4553f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5cf988
mov dword [ebp - 0x1c], 0x73002f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x740072
mov edx, 0xd
mov dword [ebp - 0x10], 0x66005f
sub esi, eax
mov dword [ebp - 0xc], 0x6f0072
mov dword [ebp - 8], 0x6d
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x45545e
movzx ecx, word [esi + eax]
test cx, cx
je 0x45545e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x455440
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cf988
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x455480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x34], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x34]
mov eax, 0x5cfcd8
mov dword [ebp - 0x30], 0x540046
mov dword [ebp - 0x2c], 0x410057
mov edx, 0x18
mov dword [ebp - 0x28], 0x450052
sub esi, eax
mov dword [ebp - 0x24], 0x4c005c
mov dword [ebp - 0x20], 0x530044
mov dword [ebp - 0x1c], 0x610047
mov dword [ebp - 0x18], 0x65006d
mov dword [ebp - 0x14], 0x650043
mov dword [ebp - 0x10], str.mMj_
mov dword [ebp - 0xc], 0x720065
lea ecx, [edx + 0x7fffffe6]
test ecx, ecx
je 0x455511
movzx ecx, word [esi + eax]
test cx, cx
je 0x455511
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4554f3
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5cfcd8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0x45ff60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5d027c
mov dword [ebp - 0x1c], 0x73002f
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x610074
mov dword [ebp - 0x14], 0x740072
mov edx, 0xd
mov dword [ebp - 0x10], 0x66005f
sub esi, eax
mov dword [ebp - 0xc], 0x6f0072
mov dword [ebp - 8], 0x6d
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x45ffce
movzx ecx, word [esi + eax]
test cx, cx
je 0x45ffce
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x45ffb0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5d027c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret

Function at 0x45fff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x5c524c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x5d0388
mov dword [ebp - 0x78], 0x4f0053
lea esi, [ebp - 0x78]
mov dword [ebp - 0x74], 0x540046
push edi
mov dword [ebp - 0x70], 0x410057
mov edx, 0x3b
mov dword [ebp - 0x6c], 0x450052
sub esi, eax
mov dword [ebp - 0x68], 0x4d005c
mov dword [ebp - 0x64], 0x630069
mov dword [ebp - 0x60], 0x6f0072
mov dword [ebp - 0x5c], 0x6f0073
mov dword [ebp - 0x58], 0x740066
mov dword [ebp - 0x54], 0x57005c
mov dword [ebp - 0x50], 0x6e0069
mov dword [ebp - 0x4c], 0x6f0064
mov dword [ebp - 0x48], 0x730077
mov dword [ebp - 0x44], 0x43005c
mov dword [ebp - 0x40], 0x720075
mov dword [ebp - 0x3c], 0x650072
mov dword [ebp - 0x38], str.mMj_
mov dword [ebp - 0x34], 0x650056
mov dword [ebp - 0x30], 0x730072
mov dword [ebp - 0x2c], 0x6f0069
mov dword [ebp - 0x28], 0x5c006e
mov dword [ebp - 0x24], 0x6e0055
mov dword [ebp - 0x20], 0x6e0069
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x6c0061
mov dword [ebp - 0x14], 0x5c006c
mov dword [ebp - 0x10], 0x730025
mov dword [ebp - 0xc], 0x25005f
mov dword [ebp - 8], 0x73
nop dword [eax]
lea ecx, [edx + 0x7fffffc3]
test ecx, ecx
je 0x4600fe
movzx ecx, word [esi + eax]
test cx, cx
je 0x4600fe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4600e0
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5d0388
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047268d
mov esp, ebp
pop ebp
ret
Function at 0xd9e1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d9e140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d9e140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d9e140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d9e140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd9ebfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd9ec50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xdb087c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd9ec43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd9ec52
xor eax, eax
pop esi
leave
ret 4

Function at 0x8516ef
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0085176e
jae 0x8516fb
xor ecx, ecx
call fcn.0085176e
jae 0x851725
xor eax, eax
call fcn.0085176e
jae 0x851736
mov al, 0x10
call fcn.0085176e
adc al, al
jae 0x851717
jne 0x851763
stosb byte es:[edi], al
jmp 0x8516fc
call fcn.0085177a
dec ecx
loop 0x851742
mov eax, ebp
call fcn.00851778
jmp 0x851764
lodsb al, byte [esi]
shr eax, 1
je 0x85178a
adc ecx, 2
mov ebp, eax
jmp 0x851764
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00851778
cmp eax, 0x7d00
jae 0x851762
cmp eax, 0x500
jae 0x851763
cmp eax, 0x7f
ja 0x851764
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x8516fc
pop ebp
ret 8
Function at 0x4089ec
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd28
cmp dword [0x4d375c], 0
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
je 0x408a0d
test eax, eax
jl 0x408a0d
cmp eax, 4
jl 0x408a15
or eax, 0xffffffff
jmp 0x408bfe
mov edx, eax
xor ecx, ecx
shl edx, 3
sub edx, eax
xor eax, eax
mov dword [edx*4 + 0x4d8d70], ecx
xor ecx, ecx
mov dword [edx*4 + 0x4d8d74], ecx
mov dword [edx*4 + 0x4d8d78], eax
cmp dword [0x4d5a5c], 3
jne 0x408bfc
mov edx, dword [0x4d7db0]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x408a66
push str.Internal_error:_cant_delete_hardware_breakpoint.
call sym.ollydbg.exe__Error
pop ecx
or eax, 0xffffffff
jmp 0x408bfe
xor ebx, ebx
mov eax, dword [ebp - 8]
lea esi, [eax + 0xc]
jmp 0x408a7f
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_SuspendThread
inc ebx
add esi, 0x66c
cmp ebx, dword [0x4d7d98]
jl 0x408a70
xor ebx, ebx
mov eax, dword [ebp - 8]
lea edx, [eax + 0xc]
mov dword [ebp - 0xc], edx
jmp 0x408bcf
mov dword [ebp - 0x2d8], 0x10010
lea ecx, [ebp - 0x2d8]
push ecx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
push edx
call sub.KERNEL32.DLL_GetThreadContext
test eax, eax
je 0x408bc7
mov ecx, dword [0x4d8d70]
mov eax, dword [0x4d8d8c]
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d0], eax
mov edx, dword [0x4d8da8]
mov ecx, dword [0x4d8dc4]
mov eax, 0x4d8d78
mov dword [ebp - 0x2cc], edx
xor edx, edx
mov dword [ebp - 0x2c8], ecx
mov esi, 0x400
cmp dword [eax], 0
je 0x408ba2
mov ecx, edx
add ecx, ecx
mov edi, 1
shl edi, cl
or esi, edi
mov ecx, dword [eax]
cmp ecx, 7
ja case.0x408b13.0
jmp dword [ecx*4 + 0x408b1a]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [eax - 4], 1
jmp 0x408b7a
mov dword [ebp - 4], 3
or esi, 0x100
jmp 0x408b7a
mov dword [ebp - 4], 1
or esi, 0x100
jmp 0x408b7a
mov dword [ebp - 4], 2
or esi, 0x100
jmp 0x408b7a
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ecx, dword [eax - 4]
sub ecx, 2
je 0x408b89
sub ecx, 2
je 0x408b8f
jmp 0x408b93
or dword [ebp - 4], 4
jmp 0x408b93
or dword [ebp - 4], 0xc
mov ecx, edx
shl ecx, 2
add ecx, 0x10
mov edi, dword [ebp - 4]
shl edi, cl
or esi, edi
inc edx
add eax, 0x1c
cmp edx, 4
jl 0x408af6
mov dword [ebp - 0x2c0], esi
lea eax, [ebp - 0x2d8]
push eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [edx]
push ecx
call sub.KERNEL32.DLL_SetThreadContext
inc ebx
add dword [ebp - 0xc], 0x66c
cmp ebx, dword [0x4d7d98]
jl 0x408a97
xor ebx, ebx
mov eax, dword [ebp - 8]
lea esi, [eax + 0xc]
jmp 0x408bf4
mov eax, dword [esi]
push eax
call sub.KERNEL32.DLL_ResumeThread
inc ebx
add esi, 0x66c
cmp ebx, dword [0x4d7d98]
jl 0x408be5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40f40c
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Get file attributes

Disassembly:
push ebx
push esi
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x40f414
mov eax, dword [esp + 0x4000]
add esp, 0xfffffdfc
push 0x104
lea eax, [esp + 8]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
test eax, eax
jne 0x40f445
mov byte [esp + 4], 0
push 0
push 0
lea edx, [esp + 0x110]
push edx
lea ecx, [esp + 0xc]
push ecx
lea eax, [esp + 0x14]
push eax
call fcn.004a51bc
add esp, 0x14
push 0x4b1712
push str.loaddll
lea edx, [esp + 0x110]
push edx
lea ecx, [esp + 0xc]
push ecx
lea eax, [esp + 0x14]
push eax
call fcn.004a5198
add esp, 0x14
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x40f49d
xor eax, eax
jmp 0x40f53b
push str.KNOWNRESTYPE
push str.RES_LOADDLL
push 0
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
jne 0x40f4ba
or eax, 0xffffffff
jmp 0x40f53b
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x40f4cb
or eax, 0xffffffff
jmp 0x40f53b
push eax
call sub.KERNEL32.DLL_LockResource
test eax, eax
jne 0x40f4da
or eax, 0xffffffff
jmp 0x40f53b
push 0x4000
lea edx, [esp + 0x20c]
push edx
mov ecx, dword [eax]
push ecx
add eax, 4
push eax
call sym.ollydbg.exe__Decompress
add esp, 0x10
mov esi, eax
test esi, esi
jne 0x40f501
or eax, 0xffffffff
jmp 0x40f53b
push 0x4b1384
lea edx, [esp + 8]
push edx
call fcn.004a5374
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x40f51e
or eax, 0xffffffff
jmp 0x40f53b
push ebx
push esi
push 1
lea edx, [esp + 0x214]
push edx
call fcn.004a5744
add esp, 0x10
push ebx
call fcn.004a4ed8
pop ecx
xor eax, eax
add esp, 0x4208
pop esi
pop ebx
ret
Function at 0x41b5a4
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov edi, 0x4cd624
jmp 0x41b74a
dec dword [edi]
mov eax, dword [edi]
lea eax, [eax + eax*2]
mov edx, dword [eax*4 + 0x4cd628]
sub edx, 1
jb 0x41b74a
je 0x41b5da
dec edx
je 0x41b730
jmp 0x41b74a
mov eax, dword [edi]
lea eax, [eax + eax*2]
test byte [eax*4 + 0x4cd632], 1
mov ebp, dword [eax*4 + 0x4cd62c]
je 0x41b70e
push ebp
call sym.ollydbg.exe__Findmodule
pop ecx
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x41b74a
mov eax, dword [esp + 4]
cmp dword [eax + 0x174], 0
je 0x41b74a
cmp dword [0x4d5a5c], 3
jne 0x41b64a
mov ebx, dword [0x4d7db0]
test ebx, ebx
je 0x41b64a
xor esi, esi
jmp 0x41b642
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_SuspendThread
inc esi
add ebx, 0x66c
cmp esi, dword [0x4d7d98]
jl 0x41b632
mov esi, dword [0x4d8134]
test esi, esi
je 0x41b659
call fcn.00418e24
push ebp
call sym.ollydbg.exe__Getbreakpointtype
test ah, 1
pop ecx
jne 0x41b6d4
mov eax, dword [esp + 4]
mov edx, ebp
sub edx, dword [eax + 0xc]
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x174]
test byte [eax + edx], 2
jne 0x41b6d4
push 2
push 1
push ebp
mov ecx, ebp
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub ecx, dword [edx + 0xc]
add ecx, dword [eax + 0x178]
push ecx
call sym.ollydbg.exe__Readmemory
add esp, 0x10
cmp eax, 1
jne 0x41b6d4
mov byte [esp], 0xcc
push 2
push 1
push ebp
lea edx, [esp + 0xc]
push edx
call sym.ollydbg.exe__Writememory
add esp, 0x10
cmp eax, 1
jne 0x41b6d4
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
sub ebp, dword [ecx + 0xc]
mov edx, dword [eax + 0x174]
or byte [edx + ebp], 2
cmp dword [0x4d5a5c], 3
jne 0x41b74a
mov ebx, dword [0x4d7db0]
test ebx, ebx
je 0x41b74a
test esi, esi
je 0x41b6f0
call fcn.00419034
xor esi, esi
jmp 0x41b704
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_ResumeThread
inc esi
add ebx, 0x66c
cmp esi, dword [0x4d7d98]
jl 0x41b6f4
jmp 0x41b74a
push 0
push 0
mov edx, dword [edi]
lea edx, [edx + edx*2]
mov ecx, dword [edx*4 + 0x4cd630]
or ecx, 0xc000
push ecx
push ebp
call sym.ollydbg.exe__Setbreakpointext
add esp, 0x10
jmp 0x41b74a
push 0x4880
mov eax, dword [edi]
lea eax, [eax + eax*2]
mov edx, dword [eax*4 + 0x4cd62c]
push edx
call sym.ollydbg.exe__Tempbreakpoint
add esp, 8
cmp dword [edi], 0
jg 0x41b5b5
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41e2b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffe00
cmp dword [0x4cd6a0], 0
je 0x41e3c2
push 6
push str.CPU__
lea eax, [esp + 8]
push eax
call fcn.004a3530
add esp, 0xc
cmp dword [0x4d3018], 0
je 0x41e317
mov ebx, dword [0x4cda51]
cmp ebx, 1
jne 0x41e2f7
mov eax, 0x4b3899
jmp 0x41e2fc
mov eax, 0x4b3904
push eax
push ebx
push str.Run_trace__i._step_s_back
lea edx, [esp + 0x12]
push edx
call fcn.004a6c2c
add esp, 0x10
add eax, 6
mov ebx, eax
jmp 0x41e344
push 0x804
mov ecx, dword [0x4cd8f9]
push ecx
lea eax, [esp + 0xe]
push eax
call sym.ollydbg.exe__Decodethreadname
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x41e341
mov ebx, 3
mov byte [esp + ebx], 0
jmp 0x41e344
add ebx, 6
mov eax, dword [0x4cda1d]
push eax
call sym.ollydbg.exe__Findmodule
pop ecx
test eax, eax
je 0x41e380
add eax, 0x48
push eax
push 8
cmp ebx, 3
jne 0x41e366
mov edx, 0x4b3966
jmp 0x41e36b
mov edx, 0x4b3992
push edx
push str._smodule__.s
lea eax, [esp + 0x10]
add ebx, eax
push ebx
call fcn.004a6c2c
add esp, 0x14
push 0x100
lea ecx, [esp + 0x104]
push ecx
mov eax, dword [0x4cd6a0]
push eax
call sub.USER32.DLL_GetWindowTextA
push 0x100
lea edx, [esp + 0x104]
push edx
lea ecx, [esp + 8]
push ecx
call fcn.004a37a0
add esp, 0xc
test eax, eax
je 0x41e3c2
push esp
mov eax, dword [0x4cd6a0]
push eax
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop ebx
ret