joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46f56c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x46f583
add esp, 0xfffffff0
call fcn.00404218
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0042caa0
mov eax, dword [0x4a891c]
cmp byte [eax], 0
jne 0x46f5b0
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4a8c20]
cmp word [eax + 2], 0
jne 0x46f5ca
mov eax, dword [0x4a8c20]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004714b8
mov eax, dword [0x4a8d24]
cmp word [eax + 2], 0
jne 0x46f5e4
mov eax, dword [0x4a8d24]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004716c8
mov byte [ebx + 0x31], 0
mov dl, 1
mov eax, dword [0x430ef8]
call fcn.00432cf8
mov esi, eax
mov dword [ebx + 0x38], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x471b5c
mov dl, 1
mov eax, dword [0x420434]
call fcn.00403d04
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x420434]
call fcn.00403d04
mov dword [ebx + 0xac], eax
xor eax, eax
mov dword [ebx + 0x5c], eax
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x58], 0xff000018
mov dword [ebx + 0x74], 0x1f4
mov byte [ebx + 0x78], 1
xor eax, eax
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x70], 0x9c4
mov byte [ebx + 0x84], 0
mov byte [ebx + 0xa1], 1
mov byte [ebx + 0xb8], 1
mov dl, 1
mov eax, dword [0x431aac]
call fcn.0043a300
mov esi, eax
mov dword [ebx + 0x9c], esi
push 0x46f7c0
mov eax, dword [0x4a8abc]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0043a704
mov eax, dword [ebx + 0x9c]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x471e0c
mov dl, 1
mov eax, dword [0x420434]
call fcn.00403d04
mov dword [ebx + 0x94], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4a8abc]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0040c680
test eax, eax
je 0x46f6f2
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.0040c480
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.0040c668
test eax, eax
je 0x46f70a
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x88]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00405a54
push ebx
push 0x470ecc
call fcn.00465d28
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xcc], 0
mov eax, dword [0x4a891c]
cmp byte [eax], 0
jne 0x46f75b
mov eax, ebx
call fcn.0046f934
mov byte [ebx + 0x55], 1
mov byte [ebx + 0x56], 1
mov byte [ebx + 0x57], 1
mov byte [ebx + 0xa2], 1
mov byte [ebx + 0xcd], 0
mov byte [ebx + 0xd8], 0
xor eax, eax
mov dword [ebx + 0xd0], eax
mov byte [ebx + 0xcf], 0
xor eax, eax
mov dword [ebx + 0xa4], eax
mov eax, ebx
call fcn.00472034
mov eax, ebx
call fcn.00472bf8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x46f7b8
call fcn.00404270
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fbdc
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x46fc7e
cmp dword [ebx + 0x90], 0
jne 0x46fc78
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x46fb54
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x8c]
cmp dword [eax + 8], 0
je 0x46fc78
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x46fc3e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x8c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46fc78
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x8c]
call fcn.004230d0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x46fc4d
inc dword [ebx + 0x90]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x46fe9c
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4ae180]
cmp dword [eax + 0x170], 0
je 0x470001
test bl, bl
jne 0x46ff4f
cmp dword [esi + 0x98], 0
jne 0x46ff44
mov eax, esi
call fcn.00472a48
push eax
push 0x46fda8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x40], 0
je 0x46ff15
mov eax, dword [0x4ae180]
cmp byte [eax + 0xcf], 0
je 0x46ff15
mov eax, dword [esi + 0xd4]
call fcn.00406ccc
mov edi, eax
cmp edi, 0
jl 0x46ff15
push 0
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46fefe
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46ff44
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.004230d0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46ff24
inc dword [esi + 0x98]
jmp 0x470001
cmp dword [esi + 0x98], 0
jle 0x470001
dec dword [esi + 0x98]
cmp dword [esi + 0x98], 0
jne 0x470001
cmp dword [esi + 0x40], 0
je 0x46ffac
mov eax, dword [0x4ae180]
cmp byte [eax + 0xcf], 0
je 0x46ffac
mov eax, dword [esi + 0xd4]
call fcn.00406ccc
mov edi, eax
cmp edi, 0
jl 0x46ffac
push 5
mov eax, dword [esi + 0xd4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x46ff95
mov eax, dword [esi + 0x94]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x46ffdb
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x94]
call fcn.004230d0
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x46ffbb
mov eax, dword [esi + 0x94]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd4]
mov ecx, 1
mov edx, dword [0x465734]
call fcn.00406e8c
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x470bbc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa8], 0
je 0x470c27
cmp byte [ebx + 0xcf], 0
jne 0x470c27
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004059d8
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x470c14
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x470c34
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040589c
jmp 0x470c34
mov eax, esi
mov edx, dword [ebx + 0x88]
call fcn.0040589c
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x472208
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x80]
test esi, esi
je 0x472276
mov eax, esi
call fcn.00458f68
test al, al
je 0x472276
mov eax, dword [ebx + 0x80]
call fcn.00458c60
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x472276
mov eax, dword [ebx + 0x80]
mov edx, dword [eax]
call dword [edx + 0xec]
test al, al
je 0x47226a
push 0
mov eax, dword [ebx + 0x80]
call fcn.00458c60
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x80]
call fcn.004502f0
jmp 0x472276
mov cl, 1
mov edx, dword [ebx + 0x70]
mov eax, ebx
call fcn.00472054
pop esi
pop ebx
ret
Function at 0x479f68
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd74
push ebx
xor edx, edx
mov dword [ebp - 0x28c], edx
mov dword [ebp - 0x288], edx
mov dword [ebp - 0x284], edx
mov dword [ebp - 0x280], edx
mov dword [ebp - 0x27c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405884
lea eax, [ebp - 0x278]
mov edx, dword [0x4099c4]
call fcn.00406288
xor eax, eax
push ebp
push 0x47a15a
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x479fdb
mov eax, ebx
sub eax, 0xa
cmp word [eax], 2
je 0x479fdb
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405144
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x479ff8
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x479ff8
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00405144
test eax, eax
je 0x47a001
sub eax, 4
mov eax, dword [eax]
cmp word [ebx + eax*2 - 2], 0x5c
je 0x47a016
lea eax, [ebp - 4]
mov edx, 0x47a174
call fcn.00405ba8
lea eax, [ebp - 0x27c]
mov ecx, 0x47a184
mov edx, dword [ebp - 4]
call fcn.00405c28
mov eax, dword [ebp - 0x27c]
lea ecx, [ebp - 0x278]
mov edx, 0x1ff
call fcn.0040bf58
test eax, eax
jne 0x47a118
cmp dword [ebp - 0x268], 0x10
jne 0x47a0bc
mov eax, dword [ebp - 0x264]
mov edx, 0x47a198
call fcn.00405ea0
je 0x47a105
mov eax, dword [ebp - 0x264]
mov edx, 0x47a1a8
call fcn.00405ea0
je 0x47a105
lea eax, [ebp - 0x280]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405c28
mov eax, dword [ebp - 0x280]
call fcn.00479f68
lea eax, [ebp - 0x284]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405c28
mov eax, dword [ebp - 0x284]
call fcn.0040c3ec
jmp 0x47a105
lea eax, [ebp - 0x288]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405c28
mov eax, dword [ebp - 0x288]
mov edx, 0x20
call fcn.0040beac
lea eax, [ebp - 0x28c]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 4]
call fcn.00405c28
mov eax, dword [ebp - 0x28c]
call fcn.00405928
push eax
call sub.kernel32.dll_DeleteFileW
lea eax, [ebp - 0x278]
call fcn.0040bfa8
test eax, eax
je 0x47a047
lea eax, [ebp - 0x278]
call fcn.0040bfcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a161
lea eax, [ebp - 0x28c]
mov edx, 5
call fcn.00405894
lea eax, [ebp - 0x278]
mov edx, dword [0x4099c4]
call fcn.00406360
lea eax, [ebp - 4]
call fcn.0040588c
ret

Function at 0x47a2c8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf0
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x105
call fcn.00405a54
add esp, 0x210
pop ebx
ret
Function at 0x47d37c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x47d3aa
mov eax, ebx
call fcn.0047de30
cmp dword [ebx + 0x40], 0
je 0x47d3a3
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x47d41b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x47d40d
cmp dword [ebx + 8], 0
je 0x47d3cc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x47d3de
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x47d40d
cmp dword [ebx + 8], 0
je 0x47d3bf
cmp eax, 3
je 0x47d3f1
dec eax
jne 0x47d3bf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x47d3bf
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x47d3bf
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x47d439
cmp dword [ebx + 0x14], 0xcc
je 0x47d439
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0047d444
pop ebx
ret
Function at 0x401200
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [ecx + 8]
sub esp, 8
dec eax
mov dword [ecx + 8], eax
jns 0x401216
call fcn.004060c0
mov dword [esp], eax
jmp 0x40124c
mov edx, dword [ecx + 4]
mov eax, dword [edx]
add edx, 4
mov dword [ecx + 4], edx
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov edx, eax
and edx, 0xff3a58ad
shl edx, 7
xor eax, edx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov edx, eax
shr edx, 0x12
xor edx, eax
mov dword [esp], edx
mov eax, dword [esp + 0xc]
mov edx, dword [esp]
mov ecx, 0xffffffff
mul edx
div ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add esp, 8
ret 4
Function at 0x402530
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x41a100]
sub esp, 0x4c
test eax, eax
je 0x402636
push 0x41a0c8
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
push 0
call fcn.00409523
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
call fcn.0040a6b6
push eax
push str._y__m__d__H:_M:_S
lea ecx, [esp + 0x1c]
push 0x3f
push ecx
call fcn.0040a69b
lea eax, [esp + 0x24]
add esp, 0x18
mov byte [esp + 0x4b], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402581
mov ecx, dword [0x41a100]
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_WriteFile]
sub eax, edx
push 0
lea edx, [esp + 8]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
push ecx
call esi
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x58]
push edx
push eax
push 0xfff
push 0x41a110
mov byte [0x41a110], 0
call fcn.00409686
mov eax, 0x41a110
add esp, 0x10
mov byte [0x41b10f], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4025e0
push 0
lea ecx, [esp + 8]
push ecx
sub eax, edx
mov edx, dword [0x41a100]
push eax
push 0x41a110
push edx
call esi
mov edx, dword [0x41a100]
push 0
lea eax, [esp + 8]
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x20], 0xa0d
call esi
mov eax, dword [0x41a100]
push eax
call dword [sym.imp.KERNEL32.DLL_FlushFileBuffers]
push 0x41a0c8
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
add esp, 0x4c
ret
Function at 0x403a30
Capabilities:
Check os version

Disassembly:
cmp dword [0x41c118], 0x80000000
jae 0x403a41
jmp fcn.00403b80
jmp 0x403dc0
mov eax, dword [0x41c140]
sub esp, 0x24
test eax, eax
push ebp
push esi
push edi
mov ebp, edx
mov edi, ecx
jne 0x403dd8
call fcn.00403c80
push 0
push 4
call dword [0x41c12c]
mov esi, eax
cmp esi, 0xffffffff
je 0x403e59
test esi, esi
je 0x403e59
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x1c
call dword [0x41c128]
test eax, eax
je 0x403e47
push ebx
mov ebx, dword [esp + 0x38]
lea ebx, [ebx]
cmp dword [esp + 0x24], edi
jne 0x403e2e
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
mov edx, ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edi
call ebp
test eax, eax
je 0x403e46
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], 0x1c
call dword [0x41c13c]
test eax, eax
jne 0x403e10
pop ebx
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret 4
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x24
ret 4
Function at 0x404aa0
Capabilities:
Resume thread

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov eax, ebx
mov edi, edx
mov ebp, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404ab4
sub eax, edx
push 0x40
push 0x101000
inc eax
push eax
xor edx, edx
mov ecx, ebp
call fcn.00404f40
mov esi, eax
test esi, esi
jne 0x404ae8
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 4
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404af0
sub eax, edx
lea ecx, [esp + 0x14]
push ecx
inc eax
push eax
push ebx
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
push edi
je 0x404ad6
call dword [sym.imp.KERNEL32.DLL_GetThreadPriority]
mov ebx, dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push 0xfffffffffffffff1
push edi
mov dword [esp + 0x18], eax
call ebx
lea edx, [esp + 0x18]
push edx
push 0
push esi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov edx, 0x414310
mov ecx, eax
call fcn.00404be0
push eax
push 0x400000
xor edx, edx
mov ecx, ebp
call fcn.00404fb0
mov esi, eax
push 2
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x32
call ebp
push edi
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
lea eax, [esp + 0x20]
push eax
push esi
mov dword [esp + 0x28], 0x103
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
je 0x404ba7
cmp dword [esp + 0x20], 0x103
jne 0x404ba7
push 0x32
call ebp
lea ecx, [esp + 0x20]
push ecx
push esi
mov dword [esp + 0x28], 0x103
call dword [sym.imp.KERNEL32.DLL_GetExitCodeThread]
test eax, eax
jne 0x404b81
mov edx, dword [esp + 0x10]
push edx
push edi
call ebx
mov eax, dword [esp + 0x20]
cmp eax, 0x103
je 0x404adc
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
add esp, 0xc
ret 4
Function at 0x404be0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412ca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
je 0x404d4d
test edi, edi
je 0x404d4d
cmp word [esi], 0x5a4d
mov dword [ebp - 4], 0
jne 0x404d4d
mov edx, dword [esi + 0x3c]
mov eax, dword [edx + esi]
add edx, esi
cmp eax, 0x4550
mov dword [ebp - 0x18], edx
jne 0x404d4d
mov ebx, dword [edx + 0x78]
test ebx, ebx
je 0x404d4d
test edi, 0xffff0000
je 0x404cc6
mov eax, dword [ebx + esi + 0x20]
add eax, esi
mov dword [ebp - 0x20], eax
xor ecx, ecx
cmp ecx, dword [ebx + esi + 0x18]
mov dword [ebp - 0x14], ecx
jae 0x404cac
mov eax, dword [eax + ecx*4]
add eax, esi
nop
mov dl, byte [edi]
mov cl, dl
cmp dl, byte [eax]
jne 0x404c94
test cl, cl
je 0x404c90
mov dl, byte [edi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x404c94
add edi, 2
add eax, 2
test cl, cl
jne 0x404c70
xor eax, eax
jmp 0x404c99
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
je 0x404cac
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
inc ecx
jmp 0x404c61
cmp ecx, dword [ebx + esi + 0x18]
jae 0x404d4d
mov eax, dword [ebx + esi + 0x24]
add eax, esi
movzx eax, word [eax + ecx*2]
add eax, dword [ebx + esi + 0x10]
jmp 0x404cc8
mov eax, edi
mov ecx, dword [ebx + esi + 0x1c]
mov edi, dword [ebx + esi + 0x10]
add ecx, esi
sub eax, edi
mov eax, dword [ecx + eax*4]
mov ecx, dword [edx + 0x78]
mov edx, dword [edx + 0x7c]
add ecx, esi
add eax, esi
add edx, ecx
cmp eax, ecx
jb 0x404d4f
cmp eax, edx
ja 0x404d4f
push 0x104
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0040ade0
add esp, 0xc
lea esi, [ebp - 0x124]
mov al, byte [esi]
test al, al
je 0x404d4d
cmp al, 0x2e
je 0x404d13
inc esi
jmp 0x404d06
cmp byte [esi], 0
je 0x404d4d
lea ecx, [ebp - 0x124]
mov byte [esi], 0
push ecx
inc esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x404d4d
mov edx, esi
mov ecx, eax
call fcn.00404be0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x20
push esi
push 0x1c
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x405048
mov edx, dword [esp + 0x18]
xor ecx, ecx
cmp edx, 0x1000
mov edx, dword [esp + 0x1c]
sete cl
not edx
and ecx, edx
and ecx, 1
mov dword [esp + 4], ecx
jne 0x40504f
xor eax, eax
pop esi
add esp, 0x20
ret
cmp word [esi], 0x5a4d
jne 0x405048
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + esi]
add eax, esi
cmp ecx, 0x4550
jne 0x405048
mov eax, dword [eax + 0x50]
pop esi
add esp, 0x20
ret
Function at 0x405380
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4053f2
lea ecx, [esp + 4]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x4053e8
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push 0
push 0
push 0x10
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x10]
push 0
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 2
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [esp]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
add esp, 0x1c
ret

Function at 0x405440
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x13c
push ebp
mov ebp, dword [esp + 0x14c]
test ebp, ebp
jne 0x40545c
xor eax, eax
pop ebp
add esp, 0x13c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_ReadProcessMemory]
push esi
mov esi, dword [esp + 0x150]
push edi
mov edi, dword [esp + 0x150]
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x1c]
push ecx
push esi
push edi
call ebx
test eax, eax
jne 0x405494
pop edi
pop esi
pop ebx
xor eax, eax
pop ebp
add esp, 0x13c
ret
cmp word [esp + 0x14], 0x5a4d
jne 0x405487
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x10]
push edx
push 0xf8
lea eax, [esp + 0x5c]
push eax
add ecx, esi
push ecx
push edi
call ebx
test eax, eax
je 0x405487
cmp dword [esp + 0x54], 0x4550
jne 0x405487
mov edx, dword [esp + 0xa4]
pop edi
pop esi
pop ebx
mov dword [ebp], edx
mov eax, 1
pop ebp
add esp, 0x13c
ret
Function at 0x406000
Capabilities:
Resume thread

Disassembly:
mov eax, dword [0x41c178]
test eax, eax
je 0x406064
push eax
call dword [sym.imp.KERNEL32.DLL_GetThreadPriority]
cmp eax, 2
jne 0x40603a
mov eax, dword [0x41a078]
test eax, eax
jne 0x406039
mov eax, dword [0x41c178]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push str.UpdateThreadSettings__:_Changed_thread_priority_to_THREAD_PRIORITY_NORMAL.
call fcn.00402530
add esp, 4
ret
test eax, eax
jne 0x406039
mov eax, dword [0x41a078]
test eax, eax
je 0x406039
mov ecx, dword [0x41c178]
push 2
push ecx
call dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push str.UpdateThreadSettings__:_Changed_thread_priority_to_THREAD_PRIORITY_HIGHEST.
call fcn.00402530
add esp, 4
ret
mov eax, dword [0x41a078]
xor ecx, ecx
test eax, eax
setne cl
jmp fcn.00405f90

Function at 0x4060c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub esp, 8
push ebx
lea eax, [ecx + 0x640]
push ebp
push esi
mov dword [esp + 0x10], eax
cmp dword [ecx + 8], 0xffffffff
lea esi, [ecx + 0xc]
push edi
mov dword [esp + 0x10], esi
lea edx, [ecx + 0x14]
jge 0x40610e
mov eax, esi
mov ebx, 0x1105
mov dword [ecx], 0x1105
mov dword [ecx + 8], 0
mov dword [eax], ebx
add eax, 4
mov edi, 0x26f
nop
imul ebx, ebx, 0x10dcd
mov dword [eax], ebx
add eax, 4
dec edi
jne 0x406100
mov edi, dword [esp + 0x14]
lea eax, [ecx + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [eax]
mov dword [ecx + 8], 0x26f
mov ecx, dword [esi]
sub edi, edx
mov ebp, 0xe3
lea ebx, [ebx]
mov ebx, eax
xor ebx, ecx
and ebx, 0x7ffffffe
xor ebx, ecx
mov ecx, eax
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor ebx, ecx
xor ebx, dword [edi + edx]
mov dword [esi], ebx
mov ecx, eax
mov eax, dword [edx]
add esi, 4
add edx, 4
dec ebp
jne 0x406130
mov edi, dword [esp + 0x10]
mov ebp, 0x18c
lea ebx, [ebx]
mov ebx, eax
xor ebx, ecx
and ebx, 0x7ffffffe
xor ebx, ecx
mov ecx, eax
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor ebx, ecx
xor ebx, dword [edi]
mov dword [esi], ebx
mov ecx, eax
mov eax, dword [edx]
add esi, 4
add edi, 4
add edx, 4
dec ebp
jne 0x406170
mov edx, dword [esp + 0x10]
mov edx, dword [edx]
mov eax, edx
xor eax, ecx
and eax, 0x7ffffffe
xor eax, ecx
shr eax, 1
mov ecx, edx
and cl, 1
neg cl
sbb ecx, ecx
and ecx, 0x9908b0df
xor eax, ecx
xor eax, dword [edi]
mov dword [esi], eax
mov eax, edx
shr eax, 0xb
xor edx, eax
mov ecx, edx
and ecx, 0xff3a58ad
shl ecx, 7
xor edx, ecx
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
pop esi
mov eax, edx
shr eax, 0x12
pop ebp
xor eax, edx
pop ebx
add esp, 8
ret