joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4552c8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4ebea0]
cmp byte [eax + 0xc], 0
je 0x455435
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45542e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ecb84], 0
jne 0x45531c
push 0x45543c
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x455444
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecb84], eax
cmp dword [0x4e9d90], 0
jne 0x455417
push 0x455454
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4e9d90], eax
cmp dword [0x4e9d90], 0
je 0x455417
push 0x455460
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecb88], eax
push 0x455470
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecb8c], eax
push 0x455484
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecb90], eax
push 0x45549c
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecb94], eax
push 0x4554b4
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecb98], eax
push 0x4554c8
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecb9c], eax
push 0x4554e0
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecba0], eax
push 0x4554f8
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecba4], eax
push 0x455514
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecba8], eax
push 0x455520
mov eax, dword [0x4e9d90]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4ecbac], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455435
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45d24c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0045d0ec
dec esi
jne 0x45d26e
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret
Function at 0x46fad0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
cmp byte [ebx + 0xd], 0
je 0x46faeb
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
je 0x46faeb
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x4d0378
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4d0416
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x34]
add eax, 8
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0xc
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x1c
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x20
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x18
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x24
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x28
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x30
call fcn.00404c48
mov eax, dword [ebx + 0x34]
add eax, 0x34
call fcn.00404c48
mov eax, dword [ebx + 0x34]
mov eax, dword [eax + 0x10]
call fcn.00464564
mov eax, dword [ebx + 0x1c]
call fcn.00464564
mov eax, dword [ebx + 0x20]
call fcn.00464564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d0420
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d32c8
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d3420
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4eb85c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x4ebcac]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 5
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 1
mov dword [eax + 0x30], 1
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 0
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4ebd6c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4ebaec]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4eba08]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4ebe44]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4eb9b8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4eb8cc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4eba80]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4ebac4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4ebafc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4ebab8]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d342a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d364c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d37cd
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4ebd68]
mov edx, dword [edx]
call fcn.00404c9c
mov ecx, dword [0x4eb990]
mov ecx, dword [ecx]
mov edx, dword [0x4eb6dc]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.00404f54
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x4eb6dc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 3
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4eba60]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4eb7b4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4eb6e8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4ebb4c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4eb69c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4ebdcc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4eb768]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4eb798]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4eb7c0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4eb790]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d37d7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d3994
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d3b15
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4eb918]
mov edx, dword [edx]
call fcn.00404c9c
mov ecx, dword [0x4eb990]
mov ecx, dword [ecx]
mov edx, dword [0x4ebaa8]
mov edx, dword [edx]
mov eax, dword [ebx + 0x44]
add eax, 0x1c
call fcn.00404f54
mov eax, dword [ebx + 0x44]
add eax, 0xc
mov edx, dword [0x4ebaa8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 0xa
mov dword [eax + 0x28], 9
mov dword [eax + 0x2c], 7
mov dword [eax + 0x34], 2
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 9], 1
mov dword [eax + 0x30], 2
mov byte [eax + 0xa], 1
mov byte [eax + 0x21], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4ebe14]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4ebb90]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4ebab4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4eb6e4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4eba50]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4eb98c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4ebb38]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4ebb78]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4ebb98]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4ebb64]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3b1f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d3cdc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d3db8
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x4c], 1
mov byte [ebx + 0x30], 0
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 5
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4ebe28]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4ebba0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4ebacc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4eb700]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4eba78]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4eb99c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x4eb7ec]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3dc2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4d404c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d4124
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x31], 0
mov byte [ebx + 0x30], 1
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 0
mov eax, dword [ebx + 0x34]
mov dword [eax + 0x38], 6
mov dword [eax + 0x3c], 4
mov byte [eax + 4], 1
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4ebccc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4eba14]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4eb92c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4ebd88]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4eb8dc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4eb804]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x10
mov edx, dword [0x4ebe8c]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d412e
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d435c
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d44b9
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4eb818]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x4ebc50]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 8
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 0
mov byte [ebx + 0x18], 1
mov eax, dword [ebx + 0x44]
xor edx, edx
mov dword [eax + 0x30], edx
mov byte [eax + 0xa], 0
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 0
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4ebd0c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4eba84]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4eb9a0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4ebddc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4eb954]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4eb870]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4eba28]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4eba4c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4eba90]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4eba34]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d44c3
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4d48d8
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor edx, edx
push ebp
push 0x4d4a45
push dword fs:[edx]
mov dword fs:[edx], esp
mov byte [ebx + 0x64], 0
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x31], 1
mov eax, dword [ebx + 0x44]
add eax, 0x18
mov edx, dword [0x4eb788]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
add eax, 0x1c
mov edx, dword [0x4ebbc4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x44]
mov byte [eax + 8], 1
mov byte [eax + 0x20], 9
mov dword [eax + 0x28], 8
mov dword [eax + 0x2c], 8
mov dword [eax + 0x34], 3
mov byte [eax + 9], 0
xor edx, edx
mov dword [eax + 0x30], edx
mov byte [eax + 0xa], 0
mov byte [eax + 0x21], 2
mov eax, dword [ebx + 0x34]
mov byte [eax + 4], 1
mov dword [eax + 0x38], 6
mov eax, dword [ebx + 0x3c]
add eax, 4
mov edx, dword [0x4ebc8c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 8
mov edx, dword [0x4eb9dc]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0xc
mov edx, dword [0x4eb8e4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x3c]
add eax, 0x10
mov edx, dword [0x4ebd38]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x20
mov edx, dword [0x4ebe60]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 4
mov edx, dword [0x4eb8a0]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 8
mov edx, dword [0x4eb7e8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0xc
mov edx, dword [0x4eb97c]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x1c
mov edx, dword [0x4eb9b4]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x24
mov edx, dword [0x4eb9e8]
mov edx, dword [edx]
call fcn.00404c9c
mov eax, dword [ebx + 0x38]
add eax, 0x28
mov edx, dword [0x4eb9a4]
mov edx, dword [edx]
call fcn.00404c9c
mov dword [ebx + 0x54], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0xc]
mov dword [ebx + 0x50], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4a4f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4e5230
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.0048236c
xor edx, edx
push ebp
push 0x4e52a2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4e52ac
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40894d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.0040896e
and ebx, ebx
and esi, ebx
xor dword [edi], edx
add esi, ebx
inc edi
cmp edi, ecx
jne fcn.0040894d
sub ebx, 0xe2dd3157
ret
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rol edi, 0xa9
dec esi
sub esi, 0x2e
rol edx, 0x55
rol edi, 0x99
dec eax
add eax, 8
rcr ebx, 0xdf
rol edx, 0xc6
rcr edx, 0x8f
ror ebx, 0x2d
rol edi, 0x9c
rcr edx, 0x17
and eax, 0xf0
neg eax
add edi, 0x7b
imul edi
bswap esi
imul edi
add esi, 0x37
mov eax, 0x26
rcr esi, 0xed
dec eax
rcr eax, 0xdb
rol esi, 0xff
bswap esi
rcr edi, 0x37
neg esi
imul esi
imul edx
neg ebx
sbb edi, 0x28
rol ebx, 0xa
inc edx
rol ebx, 0xd4
or edx, 0x2d
inc ebx
add esi, 0xd6
rcr esi, 0xf8
bswap eax
neg ebx
not esi
dec ebx
inc edx
bswap edi
not edi
imul esi
sbb eax, 0xd4
neg edx
or edi, 0x40
xor ecx, ecx
xor edi, edi
sbb edi, 0xa1
imul esi
ror ebx, 0
bswap esi
neg ebx
ror edi, 0xaa
rcl ebx, 0x91
dec edx
rcl eax, 0x62
ror edx, 0x19
mov ebx, 0xb2
sub edx, 0x4d
bswap edx
or edx, 0x75
rcl edx, 0xa6
ror esi, 0x27
neg eax
ror eax, 2
mov eax, 0xf1
mov eax, 0xde
bswap eax
not esi
ror edx, 0x98
add ebx, 0x26
rcl ebx, 0xf7
add esi, 0x99
neg ebx
dec ebx
and esi, 0xfc
or esi, 0xbf
sbb edi, 0xdb
sbb ebx, 0xa3
and ebx, 0xc1
sbb edi, 0x87
rol eax, 0x71
dec edi
neg ebx
inc esi
dec eax
neg esi
dec edi
add edi, 0xac
dec eax
not edx
dec edi
rcr ebx, 0x41
bswap ebx
rcl ebx, 0x5b
or ebx, 0xf4
and edx, 0x72
mov ecx, dword [ebp + 0xc]
or eax, 0xd8
bswap edi
mov esi, 0x78
neg edi
bswap eax
and edi, 0x3a
bswap ebx
dec edx
and edx, 0xeb
rcr esi, 0x81
rcl ebx, 0x2e
imul eax
bswap edx
sbb edx, 0x37
inc edx
rol edi, 0xf
dec ebx
rcl eax, 0xa8
ror edx, 0xda
bswap ebx
and ebx, 0xbe
neg ebx
sbb ebx, 0xec
sub esi, 0x13
sbb edx, 0x30
imul ebx
bswap edx
add eax, 0xc3
neg eax
not edi
inc edi
rol edx, 0xf2
not esi
rcl esi, 0x2a
bswap edi
sbb edx, 0xbe
add edi, 0x91
mov eax, 0xb3
rol esi, 0x1b
imul edi
or ebx, 0x50
sbb eax, 0xbc
add edx, 0xe8
imul eax
sub edx, 0xe9
add eax, 0xe9
neg esi
imul esi
sbb ebx, 0xbc
or eax, 0x81
mov edi, dword [ebp + 8]
mov ebx, ebx
mov esi, esi
xor ebx, esi
not byte [edi]
xor eax, esi
mov esi, ebx
xor ebx, ebx
xor eax, ebx
xor eax, ebx
mov esi, esi
mov ebx, ebx
mov ebx, esi
mov eax, ebx
add byte [edi], 0x79
xor eax, esi
mov ebx, ebx
xor eax, ebx
xor eax, ebx
mov esi, ebx
mov esi, esi
xor eax, ebx
xor ebx, ebx
xor eax, esi
sub byte [edi], 0x30
mov ebx, esi
xor esi, eax
xor ebx, eax
mov esi, eax
xor esi, ebx
xor esi, ebx
xor ebx, ebx
mov eax, esi
mov eax, eax
imul byte [edi]
inc edi
loop 0x4013f7
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4042f5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4441d0]
jne 0x4042ff
repz ret
jmp fcn.00406075