joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4301b0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4cd1fc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x4c]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea edi, [esi + 0x34]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [edi + 4], ebx
mov dword [edi], vtable.CBitmap.0
lea ebp, [esi + 0x3c]
mov dword [esp + 0x3c], ebx
mov dword [ebp + 4], ebx
mov dword [ebp], vtable.CBitmap.0
lea ecx, [esi + 0x44]
mov byte [esp + 0x3c], 1
call fcn.004944df
lea ecx, [esi + 0x54]
mov byte [esp + 0x3c], 2
call fcn.004944df
mov byte [esp + 0x3c], 3
call fcn.0049402d
movzx ecx, word [esp + 0x48]
mov eax, dword [eax + 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
mov ecx, edi
call fcn.00494d1f
xor eax, eax
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x38]
push 0x18
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x44]
call fcn.00494a58
cmp edi, ebx
jne 0x430291
xor edi, edi
jmp 0x430294
mov edi, dword [edi + 4]
mov ecx, dword [esi + 0x48]
push edi
push ecx
call fcn.00494da4
cmp dword [esi + 0xc], 1
jne 0x4302e6
call fcn.0049402d
movzx ecx, word [esp + 0x48]
mov eax, dword [eax + 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
mov ecx, ebp
call fcn.00494d1f
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [esi + 0x54]
call fcn.00494a58
cmp ebp, ebx
jne 0x4302d9
xor ebp, ebp
jmp 0x4302dc
mov ebp, dword [ebp + 4]
mov edx, dword [esi + 0x58]
push ebp
push edx
call fcn.00494da4
lea eax, [esi + 0x1c]
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
push eax
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov eax, dword [esi + 0x38]
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esi + 0x20]
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 4]
xor edx, edx
cmp eax, edi
setl dl
cmp ecx, ebx
mov dword [esi + 0x10], edx
ja 0x430322
mov ecx, eax
mov ebp, dword [esi + 8]
cmp ebp, ebx
mov dword [esi + 4], ecx
ja 0x43032e
mov ebp, edi
cmp edx, ebx
mov dword [esi + 8], ebp
jne 0x43033b
xor edx, edx
div ecx
jmp 0x430341
mov eax, edi
xor edx, edx
div ebp
mov dword [esi], eax
mov eax, esi
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x430ce0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x24
push ebx
push edi
mov edi, eax
mov ecx, dword [edi + 0x80]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [edi + 0x20]
lea edx, [esp + 0x18]
push edx
push 0
push 0x419
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, edi
call fcn.00490706
test al, 2
mov eax, dword [edi + 0xec]
je 0x430d5a
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0xc]
mov ebx, dword [esp + 0x1c]
mov dword [esi], eax
sub eax, dword [esp + 8]
add eax, dword [esp + 0x10]
mov dword [esi + 8], eax
mov eax, ecx
sub eax, dword [esp + 0x24]
sub eax, edi
add eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
mov dword [esi + 4], eax
sub eax, edi
add eax, ecx
mov dword [esi + 0xc], eax
pop edi
pop ebx
add esp, 0x24
ret
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 8]
mov ebx, dword [esp + 0x18]
mov dword [esi + 4], eax
sub eax, dword [esp + 0xc]
add eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov eax, ecx
sub eax, dword [esp + 0x20]
sub eax, edi
add eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, ebx
mov dword [esi], eax
sub eax, edi
add eax, ecx
pop edi
mov dword [esi + 8], eax
pop ebx
add esp, 0x24
ret
Function at 0x433c80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4cb54b
mov eax, dword fs:[0]
push eax
mov eax, 0x400c
call fcn.004ae4e0
mov eax, dword [0x500770]
xor eax, esp
mov dword [esp + 0x4004], eax
push esi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x4014]
mov dword fs:[0], eax
mov eax, edi
call fcn.004338a0
mov eax, dword [esp + 0x4024]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00433a60
mov dword [esp + 0x401c], 0
mov edx, dword [esp + 8]
push edx
push 0x4000
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
test eax, eax
jle 0x433d4e
xor esi, esi
jmp 0x433d00
movzx eax, word [esp + esi*2 + 0xc]
test ax, ax
jne 0x433d16
cmp word [esp + esi*2 + 0xe], ax
je 0x433d4e
test ax, ax
je 0x433d25
test esi, esi
jne 0x433d43
mov ecx, dword [esp + 8]
push ecx
lea ecx, [esp + 0x10]
jmp 0x433d3d
test esi, esi
jne 0x433d34
mov ecx, dword [esp + 8]
push ecx
lea ecx, [esp + 0x10]
jmp 0x433d3d
mov edx, dword [esp + 8]
lea ecx, [esp + esi*2 + 0xe]
push edx
push edi
call fcn.00433db0
add esi, 1
cmp esi, 0x4000
jb 0x433d00
mov dword [esp + 0x401c], 0xffffffff
mov eax, dword [esp + 8]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x433d79
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x4014]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x4004]
xor ecx, esp
call fcn.004a74b2
add esp, 0x4018
ret 4
Function at 0x433db0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x7d18c
call fcn.004ae4e0
mov eax, dword [0x500770]
xor eax, esp
mov dword [esp + 0x7d184], eax
mov eax, dword [esp + 0x7d194]
push ebx
push ebp
mov ebp, dword [esp + 0x7d198]
push esi
push edi
push eax
push 0x7d000
lea eax, [esp + 0x198]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov ebx, eax
test ebx, ebx
jle 0x433f98
push ebx
lea ecx, [esp + 0x194]
push ecx
push str.SECTION_TYPE
call fcn.004334f0
add esp, 0xc
lea edx, [esp + 0x10]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x433e13
push ebx
lea edx, [esp + 0x194]
push edx
push str.SECTION_USAGE
call fcn.004334f0
add esp, 0xc
lea edx, [esp + 0x90]
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x433e41
mov edi, 1
push edi
lea eax, [esp + 0x114]
push str.S_.3d
push eax
call fcn.004a7803
add esp, 0xc
push ebx
lea ecx, [esp + 0x194]
push ecx
lea edx, [esp + 0x118]
push edx
call fcn.004334f0
add esp, 0xc
test eax, eax
je 0x433f98
mov edx, 0x4d97fc
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x433ebb
test si, si
je 0x433eb7
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x433ebb
add ecx, 4
add edx, 4
test si, si
jne 0x433e95
xor ecx, ecx
jmp 0x433ec0
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x433f98
call fcn.00433440
mov esi, eax
mov ecx, str.MENU
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x433efe
test dx, dx
je 0x433efa
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x433efe
add eax, 4
add ecx, 4
test dx, dx
jne 0x433ed8
xor eax, eax
jmp 0x433f03
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x433f2d
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
lea ecx, [esp + 0x94]
push ecx
push edx
call fcn.004a7a1f
mov ecx, dword [esi]
add esp, 4
push eax
push edi
push ebp
lea eax, [esp + 0x24]
call fcn.00433930
mov ecx, str.TEXT
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x433f5c
test dx, dx
je 0x433f58
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x433f5c
add eax, 4
add ecx, 4
test dx, dx
jne 0x433f36
xor eax, eax
jmp 0x433f61
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x433f80
mov eax, dword [esi + 4]
push eax
lea ecx, [esp + 0x94]
push ecx
mov ecx, dword [esi]
push 0xffffffffffffffff
push edi
push ebp
lea eax, [esp + 0x24]
call fcn.00433930
push esi
call fcn.00488fd0
add edi, 1
add esp, 4
cmp edi, 0x3e8
jl 0x433e57
mov ecx, dword [esp + 0x7d194]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor al, al
call fcn.004a74b2
add esp, 0x7d18c
ret 8

Function at 0x434f50
Capabilities:
Stop service

Disassembly:
mov edx, dword [ecx]
sub esp, 0x1c
lea eax, [esp]
push eax
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
add esp, 0x1c
ret
Function at 0x439690
Capabilities:
Access peb ldr_data
Get graphical window text
Get ntdll base address
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4ccdd2
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00490080
push 0x82
mov ecx, edi
call fcn.004907ea
mov esi, dword [edi + 0x20]
push 0x3ec
push 0x506f68
call fcn.0045b680
call fcn.00488fda
test eax, eax
je 0x4396f7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x74]
call eax
mov ebp, eax
jmp 0x4396f9
xor ebp, ebp
push 0x50
call fcn.00488fa5
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
test esi, esi
mov dword [esp + 0x28], 0
je 0x43972f
mov ecx, esi
call fcn.004894a8
mov dword [esi], vtable.CPhCoreThread.0
mov dword [esi + 0x44], 0
mov byte [esi + 0x4c], 0
jmp 0x439731
xor esi, esi
push 0
push 0
push 4
mov ecx, esi
mov dword [esp + 0x34], 0xffffffff
call fcn.0048995a
mov ecx, dword [edi + 0x20]
mov eax, dword [esi + 0x30]
mov dword [esi + 0x44], ecx
mov dword [ebp + 0x1d10], eax
mov edx, dword [esi + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, vtable.CBitmap.0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 1
call fcn.0049402d
mov eax, dword [eax + 0xc]
push 0xa0
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
lea ecx, [esp + 0x18]
call fcn.00494d1f
push 1
push 0
push 0x19
push 0xd
push 0xd
lea ecx, [edi + 0x94]
call fcn.0049657a
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x98]
push ecx
push eax
call fcn.0049402d
mov edx, dword [eax + 0x78]
mov ecx, dword [edx]
call fcn.0043ef60
mov eax, dword [edi + 0x20]
push 0
push 0x190
push 0x101
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [edi + 0x20]
push 0
push 0
push 5
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], esi
call fcn.00408810
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov esp, ebp
pop ebp
ret
Function at 0x43e650
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf0
mov eax, dword [0x500770]
xor eax, esp
mov dword [esp + 0xec], eax
push esi
xor esi, esi
cmp ecx, esi
push edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
jle 0x43e6b0
push esi
push ecx
lea esi, [esp + 0x10]
lea eax, [ecx*8]
push esi
call fcn.00434da0
add esp, 0xc
lea edi, [esp + 0x60]
lea esi, [esp + 8]
call fcn.00434e50
push 0x80
lea eax, [esp + 0x74]
push 0
push eax
call fcn.004ac850
add esp, 0xc
xor esi, esi
lea edi, [esp + 0x70]
jmp 0x43e6e0
movzx ecx, byte [esp + esi + 0x60]
push ecx
push str._02x
push edi
call fcn.004a9556
add esi, 1
add esp, 0xc
add edi, 2
cmp esi, 0x10
jl 0x43e6e0
lea eax, [esp + 0x70]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x43e710
mov ecx, dword [esp + 0xf4]
pop edi
pop esi
xor ecx, esp
call fcn.004a74b2
mov esp, ebp
pop ebp
ret
Function at 0x448340
Capabilities:
Query service status
Start service
Stop service

Disassembly:
sub esp, 0x38
push ebx
push esi
push edi
push 0x15
push str.ServicesActive
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x4483ab
push 0x35
push str.PeanuthullDDNSCore
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x4483a8
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x4483a5
cmp dword [esp + 0x10], 1
je 0x4483a5
lea ecx, [esp + 0x28]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
call ebx
push edi
call ebx
pop edi
pop esi
pop ebx
add esp, 0x38
ret
Function at 0x44e130
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf4
mov eax, dword [0x500770]
xor eax, esp
mov dword [esp + 0xf0], eax
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x20]
push edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0048c8d6
lea esi, [eax + 0x3641]
mov dword [esp + 0x20], esi
mov edi, 0x4d97fe
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
jne 0x44e208
mov eax, dword [ebx + 0x190]
xor edi, edi
push edi
push 1
push 0xf1
push eax
call esi
mov ecx, dword [ebx + 0x13c]
push edi
push edi
push 0xf1
push ecx
call esi
lea esi, [ebx + 0xc8]
push edi
mov ecx, esi
call fcn.00490887
add ebx, 0x74
push edi
mov ecx, ebx
call fcn.00490887
xor eax, eax
lea edx, [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push edx
mov ecx, esi
mov word [esp + 0x14], 0x7ce
mov word [esp + 0x16], 4
mov word [esp + 0x1a], 3
mov word [esp + 0x1c], di
mov word [esp + 0x1e], di
mov word [esp + 0x20], di
call fcn.004972d2
mov ecx, ebx
jmp 0x44e34f
mov ecx, dword [ebx + 0x190]
push 0
push 0
push 0xf1
push ecx
call esi
mov edx, dword [ebx + 0x13c]
push 0
push 1
push 0xf1
push edx
call esi
lea esi, [ebx + 0xc8]
push 1
mov ecx, esi
call fcn.00490887
lea edi, [ebx + 0x74]
push 1
mov ecx, edi
call fcn.00490887
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x78]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x44e251
lea eax, [esp + 0x78]
push 0x2d
push eax
call fcn.004a7a40
add esp, 8
test eax, eax
je 0x44e359
mov byte [eax], 0
xor ecx, ecx
lea esp, [esp]
mov dl, byte [esp + ecx + 0x78]
mov byte [esp + ecx + 0x38], dl
add ecx, 1
test dl, dl
jne 0x44e280
add eax, 1
lea edx, [esp + 0x58]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x44e298
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x3c]
push edx
lea ebx, [esp + 0x3c]
lea ecx, [esp + 0x28]
call fcn.0044e4f0
test al, al
je 0x44e359
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x5c]
push ecx
lea ebx, [esp + 0x2c]
lea ecx, [esp + 0x34]
call fcn.0044e4f0
test al, al
je 0x44e359
movzx edx, word [esp + 0x20]
movzx ecx, word [esp + 0x28]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
movzx eax, word [esp + 0x34]
mov word [esp + 0x18], dx
lea edx, [esp + 0x10]
mov word [esp + 0x1c], cx
push edx
mov ecx, esi
mov word [esp + 0x14], 0x7ce
mov word [esp + 0x16], 4
mov word [esp + 0x1a], 3
mov word [esp + 0x1e], ax
call fcn.004972d2
movzx ecx, word [esp + 0x24]
movzx eax, word [esp + 0x2c]
movzx edx, word [esp + 0x30]
mov word [esp + 0x1a], cx
mov word [esp + 0x18], ax
mov word [esp + 0x1c], dx
mov ecx, edi
lea eax, [esp + 0x10]
push eax
call fcn.004972d2
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a74b2
mov esp, ebp
pop ebp
ret
Function at 0x45fd20
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4cebe8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
xor edi, edi
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], di
call fcn.00406430
mov eax, 0x4e5798
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x45fd77
sub eax, edx
sar eax, 1
push eax
push 0x4e5798
lea ecx, [esp + 0x14]
call fcn.0045f6e0
push 0xffffffffffffffff
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push edi
mov ecx, esi
mov word [esi + 4], di
call fcn.00406430
cmp dword [esp + 0x24], 8
jb 0x45fdc1
mov eax, dword [esp + 0x10]
push eax
call fcn.00488fd0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4671e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c8e5e
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.TiXmlAttribute.0
mov eax, 0xf
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], ebx
mov byte [ecx + 4], bl
lea edi, [esi + 0x30]
mov dword [edi + 0x18], eax
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov eax, ebp
lea edx, [eax + 1]
mov byte [esp + 0x1c], 2
mov dword [esp + 0x28], edx
nop
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x467250
sub eax, dword [esp + 0x28]
push eax
push ebp
call fcn.00406990
mov ebp, dword [esp + 0x2c]
mov eax, ebp
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x467270
sub eax, edx
push eax
push ebp
mov ecx, edi
call fcn.00406990
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x46c970
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4cbfd0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x500770]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x6c]
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x60], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
sub esp, 0x1c
mov esi, esp
mov byte [esp + 0x7c], 1
mov eax, ecx
lea edx, [eax + 2]
mov dword [esp + 0x30], esp
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
lea edi, [esp + 0x54]
mov word [esi + 4], bx
mov dword [esp + 0x30], edx
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x46ca00
sub eax, dword [esp + 0x30]
sar eax, 1
push eax
push ecx
call fcn.00406b80
call fcn.0046dc00
mov esi, esp
mov eax, ebp
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
lea edi, [esp + 0x38]
mov dword [esp + 0x30], esp
mov word [esi + 4], bx
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x46ca40
sub eax, edx
sar eax, 1
push eax
push ebp
call fcn.00406b80
call fcn.0046dc00
mov edx, dword [esp + 0x3c]
mov esi, 0x10
add esp, 0x1c
cmp dword [esp + 0x34], esi
jae 0x46ca71
lea edx, [esp + 0x20]
cmp dword [esp + 0x50], esi
mov ecx, dword [esp + 0x3c]
jae 0x46ca7f
lea ecx, [esp + 0x3c]
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 0x20]
push eax
call fcn.00467d80
cmp dword [esp + 0x34], esi
jb 0x46ca9f
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00488fd0
add esp, 4
cmp dword [esp + 0x50], esi
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jb 0x46cac2
mov edx, dword [esp + 0x3c]
push edx
call fcn.00488fd0
add esp, 4
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.004a74b2
add esp, 0x50
ret 8
Function at 0x470700
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 8
cmp eax, 0x1edf
push ebx
push esi
mov esi, ecx
jne 0x47076f
push eax
mov eax, dword [esi + 0x48]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [esi + 0x130]
push 0x1edf
push esi
call fcn.0045ce10
mov ecx, dword [esi + 0x48]
push 0
push 0x32
push 0x1ee0
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esp + 8], esi
mov esi, dword [esi + 0x130]
add esi, 0x120
lea ebx, [esp + 8]
mov dword [esp + 0xc], 0x1ee0
call fcn.0045f510
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x1ee0
jne 0x47087a
mov ecx, dword [esi + 0x2b4]
add ecx, 0xffffffff
mov edx, 4
xor eax, eax
cmp ecx, edx
ja case.0x470792.2
jmp dword [ecx*4 + 0x470884]
mov eax, dword [esi + 0x29c]
test byte [eax + 0xc0], dl
je 0x47087a
mov ecx, dword [esi + 0x2ec]
cmp ecx, dword [esi + 0x2e0]
jle 0x47087a
xor eax, eax
jmp case.0x470792.2
mov eax, dword [esi + 0x2a0]
test byte [eax + 0xc0], dl
je 0x47087a
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x48]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004708a0
cmp dword [esi + 0x2ec], eax
jle 0x47087a
mov eax, 2
jmp case.0x470792.2
mov eax, dword [esi + 0x2a8]
test byte [eax + 0xc0], dl
je 0x47087a
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x48]
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0xc]
push ecx
call fcn.004708a0
cmp dword [esi + 0x2ec], eax
jge 0x47087a
mov eax, 3
jmp case.0x470792.2
mov eax, dword [esi + 0x2ac]
test byte [eax + 0xc0], dl
je 0x47087a
mov ecx, dword [esi + 0x2ec]
cmp ecx, dword [esi + 0x2e4]
jge 0x47087a
mov eax, 1
push esi
push 0
push eax
lea ecx, [esi + 0x278]
call fcn.00438230
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4710f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4cf7db
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x500770]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebp
push esi
push edi
mov eax, dword [0x500770]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
test ebp, ebp
jne 0x47113e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4711df
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4711df
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x4711df
push 0x94
call fcn.00488fa5
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x38], 0
je 0x471184
push eax
call fcn.00470ed0
jmp 0x471186
xor eax, eax
mov dword [esp + 0x38], 0xffffffff
mov dword [ebx], eax
push edi
add eax, 8
push eax
mov ecx, ebp
call fcn.00471560
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [ebx]
push 0
push 0
call fcn.004716f0
mov ecx, dword [ebx]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, 0x18
call fcn.00471910
mov edi, 0x4e57b0
lea esi, [esp + 0x14]
mov ecx, 9
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4711df
mov eax, 1
cmp dword [esp + 0x28], eax
je 0x4711e1
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004a74b2
add esp, 0x2c
ret