joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41584d
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4341b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x14]
mov ecx, 0x442af0
push eax
mov dword [esp + 0x230], ebx
call fcn.004022f0
push str.ancamcorder.ini
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x238], 1
call sub.MFC42.DLL_operator_2
mov edx, dword [eax]
lea eax, [esp + 0x10]
push edx
push 0x441c04
push eax
mov byte [esp + 0x238], 2
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x18]
mov byte [esp + 0x22c], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x22c], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
lea edx, [esp + 0x124]
push 0x104
push edx
push str.FALSE
push str.MOUSEPOT
push str.OPTION
call ebp
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
je 0x415955
lea eax, [esp + 0x120]
push str.TRUE
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x415955
mov ecx, dword [esi + 0x1c0]
push ebx
push 1
push 0xf1
push ecx
call edi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push 0x104
push eax
push str.MEDIUM
push str.RECORD_SELECT
push str.OPTION
call ebp
cmp eax, 0xffffffff
je 0x4159f4
mov ebp, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x1c]
push str.HIGH
push ecx
call ebp
add esp, 8
test eax, eax
jne 0x4159a4
mov edx, dword [esi + 0x80]
push ebx
push 1
push 0xf1
push edx
jmp 0x4159f2
lea eax, [esp + 0x1c]
push str.MEDIUM
push eax
call ebp
add esp, 8
test eax, eax
jne 0x4159c7
mov ecx, dword [esi + 0xc0]
push ebx
push 1
push 0xf1
jmp 0x4159f1
lea edx, [esp + 0x1c]
push 0x441cd8
push edx
call ebp
add esp, 8
test eax, eax
push ebx
push 1
push 0xf1
jne 0x4159eb
mov eax, dword [esi + 0x100]
push eax
jmp 0x4159f2
mov ecx, dword [esi + 0x140]
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x22c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x220
ret
Function at 0x417740
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
call ebp
mov esi, eax
mov dword [esp + 8], esi
call ebp
mov ecx, dword [esp + 0x2c]
sub eax, esi
cmp eax, ecx
jae 0x4177b9
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call esi
test eax, eax
je 0x4177a7
lea ecx, [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
call ebx
push 1
push 0
push 0
lea eax, [esp + 0x20]
push 0
push eax
call esi
test eax, eax
jne 0x417786
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
sub eax, edx
cmp eax, ecx
jb 0x417773
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x20
ret 4

Function at 0x417cc0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x417cd0
xor eax, eax
pop esi
ret 0x20
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x20]
push eax
call fcn.00430d8a
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x24], ecx
mov dword [esi + 0x28], edx
mov edx, dword [esp + 8]
lea ecx, [esi + 0x2c]
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x3c], 0
mov dword [ecx], edx
mov edx, dword [esp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
push 0x4177d0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov eax, 1
pop esi
ret 0x20

Function at 0x41c720
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x434a8e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [esp + 4], esi
mov dword [esi], 0x437524
mov dword [esi + 4], eax
mov ecx, 0x437510
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esp + 0x10], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x28], ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0xe0]
mov byte [esp + 0x10], 2
call fcn.00430ff4
mov ecx, dword [esp + 8]
mov dword [esi], 0x43a25c
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x41c7c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x434ae4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x43a25c
mov eax, dword [esi + 4]
mov dword [esp + 0x18], 3
push eax
call fcn.0041d250
lea ecx, [esi + 0xe0]
mov byte [esp + 0x18], 2
call sub.MFC42.DLL_CImageList::CImageList
lea edi, [esi + 0x30]
mov dword [esp + 0xc], edi
mov dword [edi], 0x436b98
mov ecx, edi
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x436b84
lea edi, [esi + 0x28]
mov dword [esp + 0xc], edi
mov dword [edi], 0x436b98
mov ecx, edi
mov byte [esp + 0x18], 5
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov dword [edi], 0x436b84
mov dword [esi], 0x437524
mov ecx, esi
mov dword [esp + 0x18], 6
call sub.MFC42.DLL_CMenu::DestroyMenu
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x436b84
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x41fc80
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push 5
push 0x442bbc
push 0x442bbc
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
ret 4

Function at 0x421273
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov ebp, dword [esi + 0x198]
mov ebx, dword [esi + 0x19c]
cmp ebp, ebx
je 0x4212ea
mov ecx, dword [esi + 0xe8]
test ecx, ecx
je 0x42129b
mov edx, dword [ebp]
mov eax, dword [ecx]
push edx
push esi
call dword [eax + 8]
mov eax, dword [ebp]
mov ecx, esi
push eax
call fcn.004216b0
mov edi, eax
test edi, edi
je 0x4212cc
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4212cc
push edi
call dword [sym.imp.USER32.dll_GetParent]
cmp eax, dword [esi + 0x20]
jne 0x4212cc
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [ebp]
test edi, edi
je 0x4212e3
mov ecx, edi
call fcn.00421220
push edi
call sub.MFC42.DLL_operatordelete
add esp, 4
add ebp, 4
cmp ebp, ebx
jne 0x421287
mov edx, dword [esi + 0x19c]
mov ecx, dword [esi + 0x198]
mov eax, edx
cmp eax, edx
je 0x42130a
mov edi, dword [eax]
add eax, 4
mov dword [ecx], edi
add ecx, 4
cmp eax, edx
jne 0x4212fc
mov edx, dword [esi + 0x19c]
mov dword [esi + 0x19c], ecx
mov ecx, esi
mov dword [esp + 0x10], edx
call fcn.00424420
push 1
mov ecx, esi
call fcn.00424640
xor eax, eax
pop edi
mov dword [esi + 0xfc], eax
mov dword [esi + 0x104], eax
mov dword [esi + 0x100], eax
mov dword [esi + 0x108], eax
mov byte [esi + 0x112], al
mov byte [esi + 0x111], al
mov byte [esi + 0x110], al
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x422540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x435138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x10], ebx
cmp dword [edi + 4], 0xffffffff
je 0x4225ab
mov cl, byte [edi + 0x10]
cmp cl, bl
jne 0x422581
mov eax, dword [esi + 0x60]
cmp eax, ebx
je 0x422581
cmp dword [eax + 4], ebx
jne 0x422592
cmp cl, 1
jne 0x4225ab
mov eax, dword [esi + 0x6c]
cmp eax, ebx
je 0x4225ab
cmp dword [eax + 4], ebx
je 0x4225ab
cmp cl, bl
jne 0x42259b
mov ebp, dword [esi + 0x70]
jmp 0x42259e
mov ebp, dword [esi + 0x78]
mov ecx, esi
call fcn.00423920
add eax, ebp
mov dword [esp + 0x10], eax
push esi
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CClientDC::CClientDC
mov ecx, esi
mov dword [esp + 0x50], ebx
call fcn.00423030
push eax
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CDC::SelectObject_2
mov dword [esp + 0x58], eax
mov eax, dword [edi + 8]
mov ebx, dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
lea edx, [esp + 0x14]
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
mov eax, dword [esp + 0x48]
push eax
call ebx
mov ebp, dword [esp + 0x14]
mov ecx, esi
call fcn.004230d0
push eax
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CDC::SelectObject_2
mov eax, dword [edi + 8]
lea edx, [esp + 0x24]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x48]
push eax
call ebx
mov eax, dword [esp + 0x24]
mov ecx, ebp
cmp ecx, eax
jg 0x422633
mov eax, dword [edi + 8]
lea edx, [esp + 0x24]
push edx
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x48]
push eax
call ebx
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x58]
push ecx
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CDC::SelectObject_2
lea edx, [esp + 0x14]
mov ecx, esi
push edx
call fcn.004238d0
mov ebx, dword [eax]
push edi
mov ecx, dword [eax + 4]
mov dword [esp + 0x2c], ecx
mov ecx, esi
mov edx, dword [eax + 8]
mov dword [esp + 0x30], edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x34], eax
call fcn.00423940
mov edi, dword [esp + 0x2c]
mov esi, eax
mov eax, dword [esp + 0x10]
add esi, edi
add esi, ebx
lea ecx, [esp + 0x34]
add esi, ebp
mov dword [esp + 0x50], 0xffffffff
add esi, eax
call fcn.00430fe8
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x4231c0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
push ebx
mov ebx, dword [esp + 0x28]
push edi
mov edi, ecx
cmp dword [edi + 0xfc], ebx
je 0x423297
cmp byte [ebx + 0x10], 1
je 0x423297
lea eax, [edi + 0x140]
push esi
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x10], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x14], ecx
mov ecx, edi
mov edx, dword [eax + 0xc]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], edx
call fcn.00423830
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CRect::DeflateRect
mov esi, dword [ebx]
lea ecx, [esp + 0x1c]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x1c]
push 2
push edx
push esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x423272
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
sub edx, eax
push edx
mov edx, dword [esp + 0x1c]
sub edx, ecx
push edx
push eax
push ecx
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [ebx]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push eax
call esi
mov eax, dword [edi + 0xfc]
test eax, eax
je 0x423290
mov ecx, dword [eax]
push 0
push ecx
call esi
mov dword [edi + 0xfc], ebx
pop esi
pop edi
pop ebx
add esp, 0x20
ret 4
Function at 0x42f380
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov al, byte [0x442f69]
push ebx
push esi
push edi
test al, 1
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
jne 0x42f40b
mov bl, al
lea eax, [ebp - 0x11]
push eax
lea ecx, [ebp - 0x12]
push 0
or bl, 1
push ecx
mov ecx, 0x442f9c
mov byte [0x442f69], bl
call fcn.0042f5a0
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push 0
push 0x42fc90
push 2
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x442f80
mov dword [0x442f98], eax
call ebx
push 0x42fd90
call fcn.004312cc
add esp, 4
jmp 0x42f41d
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x442f80
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov al, byte [0x442f69]
test al, 1
jne 0x42f477
mov cl, al
lea edx, [ebp - 0x13]
or cl, 1
push edx
lea eax, [ebp - 0x14]
mov byte [0x442f69], cl
push 0
push eax
mov ecx, 0x442f9c
call fcn.0042f5a0
call edi
push eax
push 0
push 0x42fc90
push 2
call esi
push 0x442f80
mov dword [0x442f98], eax
call ebx
push 0x42fd90
call fcn.004312cc
add esp, 4
lea ecx, [ebp + 8]
lea edx, [ebp - 0x1c]
push ecx
push edx
mov ecx, 0x442f9c
call fcn.0042f5d0
mov al, byte [0x442f69]
mov dword [ebp - 4], 0xffffffff
test al, 1
jne 0x42f4e9
mov cl, byte [ebp + 0xb]
or al, 1
mov byte [0x442f69], al
mov al, byte [ebp + 0xb]
mov byte [0x442f9d], cl
mov ecx, 0x442f9c
mov byte [0x442f9c], al
mov byte [0x442fa4], 0
call fcn.0042f700
call edi
push eax
push 0
push 0x42fc90
push 2
call esi
push 0x442f80
mov dword [0x442f98], eax
call ebx
push 0x42fd90
call fcn.004312cc
add esp, 4
push 0x442f80
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42fba0
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0xffffffffffffffff
push 0x4357a9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push ebx
push esi
mov esi, ecx
mov cl, byte [esp + 0xb]
xor ebx, ebx
mov byte [esi + 0x1d], cl
push edi
lea ecx, [esp + 0x10]
mov byte [esi + 0x1c], al
mov byte [esi + 0x24], bl
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::constructor_void_]
mov eax, dword [0x442f30]
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jne 0x42fc0b
push 0x14
call sub.MFC42.DLL_operatornew
mov dword [eax + 4], ebx
mov dword [eax + 0x10], 1
mov dword [0x442f30], eax
mov dword [eax], ebx
mov edx, dword [0x442f30]
add esp, 4
mov dword [edx + 8], ebx
mov ecx, dword [0x442f38]
mov edi, dword [0x442f30]
inc ecx
push 0x14
mov dword [0x442f38], ecx
call sub.MFC42.DLL_operatornew
mov dword [eax + 4], edi
mov dword [eax + 0x10], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x28], ebx
mov dword [eax], eax
mov eax, dword [esi + 0x20]
add esp, 4
lea ecx, [esp + 0x10]
mov dword [eax + 8], eax
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::_Lockit::destructor_void_]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x42fc90
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push esi
mov dword [esi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x403725
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00403918
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0040e46d
xor ebx, ebx
cmp eax, ebx
jne 0x4038d3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00403918
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0040b14c
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0045ca41
add esp, 0x10
test eax, eax
jne 0x4037ee
push esi
call 0x400dd7
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4037ee
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4037d9
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4037ee
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4037e7
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0040f980
cmp byte [esp + 0x13], bl
je 0x40381e
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00403955
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x40388e
push 0x14
call int.0045bcae
cmp eax, ebx
pop ecx
je 0x403848
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x40384a
xor edi, edi
cmp edi, ebx
je 0x40388e
push esi
push edi
call fcn.00402e7b
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00402f43
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0040306c
add esp, 0x18
call fcn.00403918
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call int.0040db3a
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4038a5
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4038b7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4038fa
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4038fa
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00402f43
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0040306c
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
push eax
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baaa0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4ba070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baaa0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ba05c
push eax
call esi
mov ecx, dword [0x4baaa0]
push 0x4ba044
push ecx
mov dword [0x4baa9c], eax
call esi
mov ecx, dword [0x4baa9c]
mov dword [0x4baaa4], eax
test ecx, ecx
je 0x417ac7
test eax, eax
je 0x417ac7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x4baaa0], 0
xor eax, eax
pop esi
add esp, 0x50
ret
Function at 0x422141
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
pop ds
mov dl, 0x58
pop eax
pop eax
xor byte [edi + 0x17], dh
inc esp
push ecx
mov dl, 0x55
mov ecx, dword [edi - 0x5022854b]
mov ch, 0x44
std
out dx, al
scasd eax, dword es:[edi]
sub al, 0xb2
out dx, eax
push esp
or byte [edi], 0x35
dec edi
in al, dx
add dword [edi + 0x7cd91eda], ebx
invalid

Function at 0x42e99d
Capabilities:
Encode data using xor

Disassembly:
sub byte [ecx - 0x35], al
movsb byte es:[edi], byte [esi]
in al, 0xbe
out dx, eax
arpl word [0xb2f56801], bx
imul esp, esp, 0xffffffa9
test eax, 0xd1424b45
mov ch, 0xb0
out 0xbd, al
jecxz 0x42e98e
in al, 0xcd
out 0xd6, eax
test eax, 0xd1424b45
mov ch, 0xb0
out 0xbd, al
jecxz 0x42e98e
in al, 0xcd
out 0xd6, eax
pop ebp
shl byte fs:[ecx + 0x3ece2e5d], 1
cdq
or al, 0xe3
scasd eax, dword es:[edi]
in al, 0x8d
mov esp, 0x22fb18d7
not byte [eax]
salc
call 0x97bed38b
add dword [edx], ebp
call 0x1bd52afe
test eax, 0x754fb9a0
xor eax, 0x42956d6e
in eax, dx
mov ecx, 0x605a4841
jnp 0x42e9b5
pop es
fcmovnu st(0), st(5)
pop ss
inc ecx
push ss
wait
les ecx, [ebx - 0x2a2ee013]
pop ss
fistp dword [ebp - 0x74e5dc4d]
add dword [edx], ebp
sar byte [edi + esi*4], 1
adc al, 0x6f
movsd dword es:[edi], dword [esi]
mov byte [0x3ff80dbf], al
adc dword [eax + 0x79648a69], 0xffffffbd
sub esi, esp
out 0xe8, al
test al, 0xa3
cld
shr byte [ecx - 0x61c516aa], cl
Function at 0x45e945
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0045eb38
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0046968d
xor ebx, ebx
cmp eax, ebx
jne 0x45eaf3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0045eb38
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0046636c
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call int.004b7c61
add esp, 0x10
test eax, eax
jne 0x45ea0e
push esi
call fcn.0045bff7
mov esi, eax
cmp esi, ebx
pop ecx
je 0x45ea0e
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x45e9f9
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x45ea0e
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45ea07
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0046aba0
cmp byte [esp + 0x13], bl
je 0x45ea3e
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0045eb75
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x45eaae
push 0x14
call fcn.004b6ece
cmp eax, ebx
pop ecx
je 0x45ea68
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x45ea6a
xor edi, edi
cmp edi, ebx
je 0x45eaae
push esi
push edi
call fcn.0045e09b
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0045e163
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e28c
add esp, 0x18
call fcn.0045eb38
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00468d5a
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45eac5
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x45ead7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x45eb1a
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x45eb1a
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0045e163
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e28c
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret