joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8a40
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
call fcn.004089e4
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b8a96
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004048f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b8a9d
mov eax, dword [ebp - 4]
call fcn.004027f0
ret

Function at 0x4b906c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe08
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 0x1f8], edx
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x1ec], edx
mov dword [ebp - 0x1f0], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b9295
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027d0
push 0xff
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4b926f
inc eax
mov dword [ebp - 0xc], eax
xor esi, esi
mov byte [ebp - 5], 0
mov edx, 0x4b92ac
lea eax, [ebp - 0x1d8]
call fcn.00402d3c
lea eax, [ebp - 0x1d8]
call fcn.00402ac0
call fcn.00402938
lea edx, [ebp - 4]
lea eax, [ebp - 0x1d8]
call fcn.00403128
lea eax, [ebp - 0x1d8]
call fcn.00403194
call fcn.00402938
jmp 0x4b919b
lea ecx, [ebp - 0x1e0]
mov edx, esi
mov eax, dword [ebx + 0x348]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1e0]
lea edx, [ebp - 0x1dc]
call fcn.00408cd8
mov eax, dword [ebp - 0x1dc]
push eax
lea edx, [ebp - 0x1e4]
mov eax, dword [ebp - 4]
call fcn.00408cd8
mov edx, dword [ebp - 0x1e4]
pop eax
call fcn.00404b04
jne 0x4b917d
mov byte [ebp - 5], 1
jmp 0x4b91af
lea edx, [ebp - 4]
lea eax, [ebp - 0x1d8]
call fcn.00403128
lea eax, [ebp - 0x1d8]
call fcn.00403194
call fcn.00402938
lea eax, [ebp - 0x1d8]
call fcn.00402fa8
call fcn.00402938
test al, al
je 0x4b9130
cmp byte [ebp - 5], 0
jne 0x4b9255
lea ecx, [ebp - 0x1f0]
mov edx, esi
mov eax, dword [ebx + 0x348]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1f0]
lea edx, [ebp - 0x1ec]
call fcn.00408cd8
mov ecx, dword [ebp - 0x1ec]
lea eax, [ebp - 0x1e8]
mov edx, 0x4b92c4
call fcn.00404a0c
mov edx, dword [ebp - 0x1e8]
mov ecx, dword [ebx + 0x2fc]
mov eax, ebx
call fcn.004b9ba0
lea eax, [ebp - 0x1d8]
call fcn.00402ad8
call fcn.00402938
lea ecx, [ebp - 0x1f8]
mov edx, esi
mov eax, dword [ebx + 0x348]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1f8]
lea edx, [ebp - 0x1f4]
call fcn.00408cd8
mov edx, dword [ebp - 0x1f4]
lea eax, [ebp - 0x1d8]
call fcn.00404dd4
call fcn.00403410
call fcn.00402938
lea eax, [ebp - 0x1d8]
call fcn.00402e04
call fcn.00402938
inc esi
dec dword [ebp - 0xc]
jne 0x4b90ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b929c
lea eax, [ebp - 0x1f8]
mov edx, 8
call fcn.0040472c
lea eax, [ebp - 4]
call fcn.00404708
ret
Function at 0x4b9868
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe04
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1fc], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b991c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call sub.user32.dll_GetForegroundWindow
mov edi, eax
push 0xfb
lea eax, [ebp - 0x1f6]
push eax
push edi
call sub.user32.dll_GetClassNameA
push 0xfb
lea eax, [ebp - 0xfb]
push eax
push edi
call sub.user32.dll_GetWindowTextA
mov dl, 1
mov eax, dword [0x422470]
call fcn.00424394
mov dword [esi + 0x310], eax
lea edx, [ebp - 0x1fc]
lea eax, [ebp - 0x1f6]
call fcn.004094d8
mov eax, dword [ebp - 0x1fc]
mov edx, 0x4b9934
call fcn.00404b04
jne 0x4b9903
push edi
call sub.user32.dll_GetDC
mov edx, eax
mov eax, dword [esi + 0x310]
call fcn.00424a0c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b9923
lea eax, [ebp - 0x1fc]
call fcn.00404708
ret

Function at 0x4bbf34
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push 1
mov ecx, 0x4bbf9c
mov edx, 0x4bbfa8
mov eax, 0x4bbfbc
call fcn.004b8978
xor edx, edx
mov eax, dword [ebx + 0x2f0]
call fcn.0045acc8
mov eax, dword [ebx + 0x2f0]
xor edx, edx
mov dword [eax + 0x83c], edx
push 1
push 0x4bbfd4
push 0x4bbfd4
push 0x4bbfd8
push 0x4bbfe8
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x4bff38]
mov eax, dword [eax]
call fcn.00459298
pop ebx
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
mov esi, dword [0x408008]
push edi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwareWinRAR
mov edi, 0x80000002
push edi
mov byte [ebp - 0x70], bl
call esi
test eax, eax
jne 0x401075
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.exe32
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x104
call dword [section..rdata]
push dword [ebp - 0x74]
call dword [0x408004]
cmp byte [ebp - 0x70], bl
jne 0x4010bd
lea eax, [ebp - 0x74]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsWinRAR.exe
push edi
call esi
test eax, eax
jne 0x4010b8
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x408198
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x104
call dword [section..rdata]
push dword [ebp - 0x74]
call dword [0x408004]
cmp byte [ebp - 0x70], bl
je 0x4010f7
lea eax, [ebp - 0x70]
push 0x5c
push eax
call fcn.00401790
pop ecx
pop ecx
cmp eax, ebx
je 0x4010f7
mov edi, dword [ebp - 0x7c]
mov byte [eax], bl
lea eax, [ebp - 0x70]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4010dc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4010e7
mov esi, str._rarext.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004017bd
add ebp, 0x98
leave
ret 4

Function at 0x403c70
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x403c81
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x403c7e
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
ret

Function at 0x403ca0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
push edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x403cda
mov edi, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x403cd2
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x403cdc
inc edx
add eax, 0x28
cmp edx, esi
jb 0x403cc2
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x4506c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x456fac
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x46f1b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esi], 0x45e988
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
mov ecx, 0x471864
call edx
add eax, 0x10
mov dword [esi + 0x14], eax
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
mov ecx, 0x471864
call edx
add eax, 0x10
mov dword [esi + 0x18], eax
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
mov ecx, 0x471864
call edx
add eax, 0x10
mov dword [esi + 0x74], eax
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
mov ecx, 0x471864
call edx
add eax, 0x10
mov dword [esi + 0x78], eax
mov dword [esi + 0x70], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], edi
mov eax, 0x45f0b4
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], edi
mov byte [esp + 0x14], 3
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
mov ecx, 0x471864
call edx
add eax, 0x10
mov dword [esi + 0xe4], eax
mov byte [esp + 0x14], 4
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
mov ecx, 0x471864
call edx
add eax, 0x10
mov dword [esi + 0xe8], eax
mov byte [esp + 0x14], 5
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
mov ecx, 0x471864
call edx
add eax, 0x10
mov dword [esi + 0xf0], eax
mov byte [esp + 0x14], 6
push 0x7f89
push edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x98], edi
mov dword [esi + 0x2c], 0x2ee
mov dword [esi + 0x9c], edi
call dword [fcn.0045c3a8]
mov dword [esi + 0xa0], eax
mov dword [esi + 0x84], edi
call fcn.00450590
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x450bd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x458d58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push edi
mov eax, dword [0x46f1b0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push 0
call dword [fcn.0045c194]
mov ebx, eax
xor eax, eax
push 0x7f00
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
push eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0x404190
mov dword [esp + 0x2c], ebx
call dword [fcn.0045c3a8]
push 0x1b
push 0x45e920
push 0x679
mov dword [esp + 0x38], eax
call fcn.0047ecf9
mov dword [esp + 0x44], eax
add esp, 0xc
lea eax, [esp + 0x14]
push eax
call dword [0x45c3a4]
mov edi, dword [esi + 0x30]
neg edi
sbb edi, edi
lea ecx, [esp + 0x10]
and edi, 0xfffc0004
push ecx
add edi, 0x40000
call fcn.00475faa
add esp, 4
push esi
push ebx
push 0
mov dword [esp + 0x54], 0
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x48]
mov eax, dword [eax]
push edx
mov edx, dword [esi + 0x44]
push ecx
mov ecx, dword [esi + 0x38]
push edx
mov edx, dword [esi + 0x34]
push ecx
push edx
push 0x80080000
push eax
push 0x1b
push 0x45e920
push 0x679
call fcn.0047ecf9
add esp, 0xc
push eax
push edi
call dword [0x45c4b0]
mov dword [esi + 0x68], eax
mov dword [esp + 0x48], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x450d05
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x68]
test eax, eax
je 0x450d67
movzx ecx, byte [esi + 0xaf]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push eax
call dword [0x45c4cc]
cmp byte [esi + 0xaf], 0
je 0x450d49
mov edx, dword [esi + 0x68]
push edx
call dword [0x45c4a8]
mov eax, dword [esi + 0x68]
push eax
call dword [0x45c434]
mov ecx, dword [esi + 0x68]
push ecx
call dword [0x45c3ac]
mov edx, dword [esi + 0x68]
push 0
push edx
call dword [0x45c414]
test eax, eax
je 0x450d67
push 1
push 0xf060
push eax
call dword [0x45c4b8]
mov eax, dword [esi + 0x9c]
push eax
call dword [0x45c1a0]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45af00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45790b
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46f1b0]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, 0x14
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov eax, dword [0x471864]
mov edx, dword [eax + 0xc]
xor esi, esi
mov ecx, 0x471864
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x20], 0x45f214
mov dword [esp + 0x28], 0x45f224
mov dword [esp + 0x30], 0x45f238
mov dword [esp + 0x34], 0x10
mov dword [esp + 0x38], 0x45f24c
mov dword [esp + 0x3c], 0x12
mov dword [esp + 0x40], 0x45f25c
mov dword [esp + 0x44], 9
mov dword [esp + 0x48], 0x45f26c
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
call edx
add eax, 0x10
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0x60], esi
lea ebp, [esp + 0x1c]
cmp eax, 0x45f214
je 0x45b055
mov esi, 0x45f214
mov ecx, dword [ebp]
push ecx
call dword [fcn.0045c3f8]
mov edx, dword [0x471864]
mov ebx, eax
mov eax, dword [edx + 0xc]
mov ecx, 0x471864
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
push edx
mov eax, ebx
shr eax, 8
movzx ecx, al
push ecx
movzx edx, bl
push edx
push esi
push 0x45f280
lea edi, [esp + 0x2c]
mov byte [esp + 0x74], 1
call fcn.004522f0
mov esi, dword [esp + 0x2c]
mov eax, dword [esi - 0xc]
add esp, 0x14
push eax
push esi
lea ecx, [esp + 0x1c]
call fcn.0044f640
lea eax, [esi - 0x10]
mov byte [esp + 0x60], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45b047
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp + 0xc]
add ebp, 8
test esi, esi
jne 0x45afc4
mov eax, dword [0x4729fc]
cmp eax, esi
jne 0x45b08c
push 0x9c
call 0x48cc98
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x60], 2
cmp eax, esi
je 0x45b080
push eax
call fcn.004750ec
jmp 0x45b082
xor eax, eax
mov byte [esp + 0x60], 0
mov dword [0x4729fc], eax
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00475993
mov dword [esp + 0x60], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45b0bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x30029220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0xc]
push ebx
mov dword [esp + 8], ecx
mov ecx, dword [ebp + 0xc]
push esi
mov dword [esp + 0x20], edx
push edi
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
mov dl, 0x80
movd mm0, edx
movq mm1, mm0
punpcklbw mm1, mm0
movq mm0, mm1
mov dword [esp + 0x14], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 8]
punpcklbw mm1, mm0
movq mm0, mm1
punpcklbw mm1, mm0
mov dword [esp + 0x18], edi
movq mm0, mm1
mov dword [esp + 0x1c], eax
test eax, eax
je 0x3002930e
add ecx, 7
and ecx, 0xfffffff8
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x14]
lea esi, [eax + edi]
lea eax, [ecx + ecx]
lea edx, [eax + edi]
add esi, eax
mov eax, dword [esp + 0x10]
lea ebx, [ecx + eax]
mov eax, ecx
neg eax
je 0x300292ef
mov edi, edx
lea ecx, [esi + eax*2 + 8]
sub edi, esi
jmp 0x300292b0
movq mm1, qword [edx + eax*2]
movq mm2, qword [ecx - 8]
por mm1, mm2
psrlw mm1, 1
movq mm2, qword [edi + ecx]
movq mm3, qword [ecx]
por mm2, mm3
psrlw mm2, 1
packuswb mm1, mm2
movq mm2, mm0
pxor mm1, mm2
pcmpgtb mm1, mm2
movq qword [eax + ebx], mm1
add eax, 8
add ecx, 0x10
test eax, eax
jne 0x300292b0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
add dword [esp + 0x10], edx
add eax, eax
add edi, eax
sub dword [esp + 0x1c], 1
mov dword [esp + 0x18], edi
jne 0x30029283
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x30029410
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0xc]
push ebx
mov ebx, dword [ecx + 0x14]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, dword [eax]
mov eax, dword [ecx + 0x10]
mov esi, edi
imul esi, dword [esp + 0x20]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x18]
add esi, dword [edx]
shr ebx, 1
add eax, eax
mov dword [esp + 0x24], ebp
test ebx, ebx
jle 0x30029498
shr eax, 2
lea ecx, [edi + edi]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
mov edx, eax
mov ecx, esi
test edx, edx
jle 0x30029483
mov edi, ebp
sub edi, esi
mov eax, dword [edi + ecx]
mov ebp, dword [ecx]
and eax, 0xff00ff
or ebp, eax
and eax, 0xff14ff14
xor ebp, eax
mov dword [ecx], ebp
dec edx
add ecx, 4
test edx, edx
jg 0x30029462
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
add ebp, dword [esp + 0x10]
add esi, dword [esp + 0x20]
dec ebx
mov dword [esp + 0x24], ebp
test ebx, ebx
jg 0x30029456
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x30033e31
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3003a410]
jne 0x30033e3b
repz ret
jmp fcn.30035704

Function at 0x30035427
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.30031a46
and dword [ebp - 4], 0
cmp dword [0x3003b334], 0
mov ebx, eax
jne 0x300354d8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x30035589
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x30035589
push eax
call fcn.300319d4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x3003b334], eax
call esi
push eax
call fcn.300319d4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x3003b338], eax
call esi
push eax
call fcn.300319d4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x3003b33c], eax
call esi
push eax
call fcn.300319d4
pop ecx
mov dword [0x3003b344], eax
test eax, eax
je 0x300354d8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.300319d4
pop ecx
mov dword [0x3003b340], eax
mov eax, dword [0x3003b340]
cmp eax, ebx
je 0x30035530
cmp dword [0x3003b344], ebx
je 0x30035530
push eax
call fcn.30031a4f
push dword [0x3003b344]
mov esi, eax
call fcn.30031a4f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x30035530
test edi, edi
je 0x30035530
call esi
test eax, eax
je 0x30035527
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x30035527
test byte [ebp - 0xc], 1
jne 0x30035530
or dword [ebp + 0x10], 0x200000
jmp 0x30035569
mov eax, dword [0x3003b338]
cmp eax, ebx
je 0x30035569
push eax
call fcn.30031a4f
pop ecx
test eax, eax
je 0x30035569
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x30035569
mov eax, dword [0x3003b33c]
cmp eax, ebx
je 0x30035569
push eax
call fcn.30031a4f
pop ecx
test eax, eax
je 0x30035569
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x3003b334]
call fcn.30031a4f
pop ecx
test eax, eax
je 0x30035589
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x3003558b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x431423
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CMenu.0
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.0042129f
mov dword [ebx], method.CPtrArray.virtual_0
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.0042129f
or eax, 0xffffffff
push 0x43f650
mov dword [ebx], method.CPtrArray.virtual_0
push edi
mov dword [esi], 0x433624
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x404c70
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x431900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CPen.0
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.00429140
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00428923
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.00428d23
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call fcn.00428d6f
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.00428d23
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call fcn.00428d6f
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.00428d23
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call fcn.00428d6f
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.00428d23
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call fcn.00428d6f
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.00428d23
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call fcn.00428d6f
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call fcn.00428d23
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call fcn.00428d6f
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call fcn.00428d23
push ebp
push ebx
mov ecx, esi
call fcn.00428d6f
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.00428923
lea ecx, [esp + 0x10]
call fcn.00429197
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.00429197
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10