joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451f20
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x489078
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x451f59
inc eax
mov dword [esi + 0x10], eax
jmp 0x45206c
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x451f6d
mov eax, 0xffffffc7
jmp 0x45206e
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x451f7e
cmp dword [esi + 8], eax
jne 0x451f6d
cmp dword [esi + 8], eax
jne 0x451f97
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x451f97
mov eax, 0xffffffc7
jmp 0x45206e
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x451fab
push eax
mov ecx, ebx
call fcn.00451750
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0041f500
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x451fdc
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.0041f520
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00450ec0
test eax, eax
mov dword [esp + 0x38], eax
je 0x45200f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x602048
call fcn.0041f700
mov eax, dword [esp + 0x38]
jmp 0x45206e
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00451d80
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x452053
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00451da0
mov esi, eax
test esi, esi
jne 0x452083
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00451d80
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x452025
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x602048
call fcn.0041f700
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x602048
call fcn.0041f700
mov eax, esi
jmp 0x45206e
Function at 0x45e6a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45e6d3
push esi
call fcn.004617b0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45e6cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45e759
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45e742
mov eax, dword [esi + 8]
test eax, eax
je 0x45e6f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45e73e
cmp eax, 2
je 0x45e742
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45e6ea
cmp eax, 3
je 0x45e71d
cmp eax, 1
jne 0x45e6ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45e6ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45e6ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045e780
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45e768
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045e780
add esp, 4
pop esi
ret
Function at 0x67a159
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bsf dx, si
jmp 0x67a0af
lea esp, [esp + 4]
add bl, dl
mov eax, 0x99c82588
shl edx, 0x1f
jge 0x67a04b
jl 0x67a0c6
cmpsb byte [esi], byte es:[edi]
sub al, 0xa2
lds esi, [eax*4 - 0x2d046747]
jg 0x67a0e4
mov al, 0x1a
mov dword [esp], ecx
jmp 0x67a0e9
neg ah
jmp 0x67a0ce
neg ah
bswap edx
lea eax, [edx + edi]
xor eax, esi
lea edx, [ecx + 0x53]
jmp 0x67a139
dec edi
mov eax, 0xd3b393d6
and ax, 0x21c4
jnp 0x67a08a
jp 0x67a092
mov ah, 0x3c
sal byte [ebp + 0x28898744], cl
dec ebx
rdtsc
bsf dx, si
jmp 0x67a0af
bswap edx
lea eax, [edx + edi]
xor eax, esi
jmp 0x67a136
mov al, 0x1a
mov dword [esp], ecx
jmp 0x67a065
lea edx, [eax*4]
mov dl, dh
neg edx
jp 0x67a120
xchg ah, dh
mov eax, esp
inc edx
call fcn.0067a1e0
jb 0x67a10a
xchg ebx, eax
test byte [0x5ac448c1], 0x3d
int3
ror dword [eax - 0x3c], 0x5a
cmp eax, 0xb6f10acc
mov eax, 0x8b24048b
mov byte [eax + 0x310fdce9], 0xeb
into
mov dh, 0xb8
mov eax, dword [esp]
mov eax, esi
sub cl, 0xdc
rdtsc
jmp 0x67a0ee
xchg ah, dh
jmp 0x67a2d7
lea edx, [ecx + 0x53]
inc ax
mov edx, 0xc4104ee2
mov dx, di
mov dl, dh
jmp 0x67a112
dec eax
jmp 0x67a081
sub dx, 0x6230
jmp 0x67a22a
mov eax, esi
lea eax, [esi*4]
rdtsc
jmp 0x67a1e5
rdtsc
mov eax, esi
lea eax, [esi*4]
rdtsc
sub dx, 0x6230
mov edx, 0x48f180c0
mov eax, dword [esp]
inc dh
je 0x67a253
jne 0x67a276
rol cl, 0
mov dx, word [esp]
sub esp, 0x18
jno 0x67a25d
mov word [esp + 0xa], di
sub esp, 4
jmp 0x67a2b3
mov ax, 0xfa39
mov dl, dh
mov dh, ch
jmp 0x67a238
mov word [esp + 0xa], di
jmp 0x67a280
mov ax, 0xfa39
mov dl, dh
mov dh, ch
jmp 0x67a25b
sub esp, 4
neg edx
lea esp, [esp + 0x1c]
dec cl
mov ax, 0x7207
lea eax, [eax*4]
jmp 0x67a2b7
ror cl, 0
cmp ax, 0x602
jo 0x67a218
rdtsc
jmp 0x67a200
neg edx
jmp 0x67a285
lea edx, [ebp + 0x57]
inc dh
js 0x67a30b
mov ax, word [esp]
jmp 0x67a2f4
mov eax, esp
inc edx
jmp 0x67a29f
dec dx
jmp 0x67a319
rdtsc
bt edx, edx
mov dx, sp
jmp 0x67a2dc
mov ax, word [esp]
rdtsc
bt edx, edx
mov dx, sp
dec dx
bts eax, ebx
lea edx, [eax + ebx]
bswap edx
rcl dx, cl
jg 0x67a36f
mov eax, esi
jmp 0x67a355
xchg edx, eax
lea eax, [edx + ebx]
jmp 0x67a40c
mov dx, 0xa36b
shl eax, 2
je 0x67a3e4
setl dh
mov dh, bh
not dx
bsf dx, si
jmp 0x67a3c3
mov eax, esi
rol cl, 0
mov dh, bh
rcl edx, 0x11
jmp 0x67a555
jmp 0x67a353
sub esp, 0x14
jmp 0x67990e
mov dh, bh
not dx
bsf dx, si
jmp 0x67a39f
sub esp, 0x14
call fcn.0067a3e9
jmp 0x67a4c9
setl dh
jmp 0x67a3b8
mov eax, ecx
mov dx, 0x5027
pushal
pop dx
lea esp, [esp + 0x17]
lea esp, [esp + 3]
jmp 0x67a334
jne 0x67a32a
xchg edx, eax
lea eax, [edx + ebx]
jmp 0x67a32f
Function at 0x67b405
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 2]
jmp 0x67b424
pop dx
mov edx, eax
rcl dx, cl
jne 0x67b3ef
je 0x67b446
int3
lea esp, [esp + 0x10]
not cl
lea eax, [ebp + 0x585688f7]
lea edx, [esi*4]
lea eax, [esi - 0x75]
jmp 0x67b466
lea esp, [esp + 2]
jmp 0x67b424
sub dh, ah
mov ax, dx
lea edx, [eax + 0x2dccba09]
lea eax, [ebp - 0x3a306f01]
jmp 0x67b4aa
mov ax, word [esp]
rdtsc
mov dx, word [esp]
rcl dx, cl
jle 0x67b44c
jg 0x67b56e
popfd
push cs
pushfd
sti
push ss
test al, 0x1f
xchg cx, ax
adc byte [esi - 0x71], ah
inc esp
and al, 1
jmp 0x67b622
mov dx, word [esp]
call fcn.0067b48f
mov ax, word [esp]
setg dh
sub esp, 0xe
jl 0x67b541
mov dx, di
setnp ah
jmp 0x67b4de
lea eax, [ebp - 0x3a306f01]
mov dx, word [esp]
jmp 0x67b4ae
push word [esp + 9]
xchg dh, dl
mov word [esp + 2], di
jmp 0x67b50f
setnp ah
push word [esp + 9]
xchg dh, dl
mov word [esp + 2], di
lea edx, [eax + 0x21]
jmp 0x67b518
push dword [esp + 8]
mov ax, 0x2a05
lea edx, [ecx - 0x12f36a65]
lea esp, [esp + 0x14]
not cl
jmp 0x67b546
mov dx, di
jmp 0x67b500
mov edx, esi
lea eax, [ecx*4]
xchg dh, al
rcr dh, 5
jge 0x67b5a6
jl 0x67b57e
mov dh, 0x50
rdtsc
jmp 0x67b5af
sub dh, ah
mov ax, dx
lea edx, [eax + 0x2dccba09]
jmp 0x67b4d2
push edx
pop eax
mov ax, si
jmp 0x67b558
not cl
mov ax, 0x6e6b
lea edx, [ebp - 0x9f]
mov dh, 0x8a
jmp 0x67b5ce
push edx
pop eax
mov ax, si
mov dh, 0x50
rdtsc
mov edx, dword [esp]
lea edx, [edx + edx]
and eax, eax
jmp 0x67b5ee
clc
jnp 0x67b5f2
jp 0x67b5f2
call fcn.0067b66b
push word [esp + 1]
push word [esp + 3]
jmp 0x67b6ae
jle 0x67b585
jg 0x67b585
and ecx, 0x3c
bt edx, edi
ja 0x67b5d3
jbe 0x67b5d3
sti
pop edi
iretd
lea esp, [esp + 4]
inc cl
mov al, byte [esp]
call fcn.0067b3ea
xchg dword [esp], ecx
bswap edx
sub esp, 0xa
lea eax, [esp + eax]
mov dh, bh
push esp
jmp 0x67b69c
pushal
xchg dword [esp + 0x2c], ecx
not edx
lea eax, [esi - 0x270355bb]
neg dx
rol ax, cl
jmp 0x67b6ce
lea esp, [esp + 2]
lea ecx, [ecx - 0x98]
inc dx
not dh
inc eax
clc
jmp 0x67b681
mov eax, dword [ebp]
inc dh
je 0x67b715
lea edx, [esp + ebp]
mov edx, dword [esp]
inc dh
jmp 0x67b887
mov dl, 0x84
push dword [esp + 0x2c]
ret 0x30
invalid
mov edx, dword [esp]
inc dh
jmp 0x67b887
lea edx, [esp + ebp]
jmp 0x67b6fe
mov dx, word [esp]
add ebp, 4
not cl
mov dx, word [esp]
call fcn.0067b7e4
loope 0x67b7b2
outsb dx, byte [esi]
cld
wait
jbe 0x67b6fc
int1
adc dword [ebx], 0x76
test dword [ebp - 0x37], eax
inc esp
fidivr dword [ebp + 0x7071884c]
jae 0x67b743
jmp 0x67b730
xlatb
clc
ror edx, 0xb
sub esp, 0xe
mov byte [esp + 1], ah
xchg dword [esp + 2], ecx
jmp 0x67b7cd
inc ecx
ret
seto cl
neg dx
xchg ch, dl
push dword [esp + 0x10]
ret 0x14
lea esp, [esp + 2]
xchg dword [esp + 0x10], ebp
rdtsc
lea eax, [edi*4]
jmp 0x67b7b6
mov dword [ecx + esi], eax
lea edx, [eax - 0x49b8574f]
not cx
inc ax
jo 0x67b757
mov dx, word [esp]
jmp 0x67b734

Function at 0x67b48f
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
sub cl, 0x4b
rdtsc
jmp 0x67b4b3
Function at 0x7677d1
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
bswap eax
xchg edx, ecx
setbe dh
not ax
rdtsc
call fcn.0076779a
add eax, 0xa455329c
and ebp, dword [ecx - 0x78]
sub eax, dword [edx - 3]
int3
lea edx, [esi + 0xc5]
mov dword [esp], ecx
jmp 0x7677b2

Function at 0x781337
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 2], dx
pop dword [esp]
push edx
push word [esp + 3]
jmp 0x78136a
mov word [esp + 2], sp
push dword [esp + 4]
mov dword [esp + 3], ecx
jmp 0x78130a
pop word [esp + 7]
mov word [esp + 4], sp
lea esp, [esp + 7]
jmp 0x781320
lea ebx, [edx + esi]
mov al, 0xfe
rdtsc
mov dx, word [esp]
cpuid
not bp
jmp 0x78137a
mov dword [esp + 1], ebp
lea esp, [esp + 0xc]
push 0
pushal
mov bp, dx
jmp 0x781347
mov si, word [esp]
xchg ah, bl
lea ebp, [edi + edi]
lea ebp, [eax - 0x47ecbbc7]
mov di, 0x93af
not cx
jmp 0x7813c8
xchg dh, al
mov edx, ecx
mov dx, 0x2c6d
lea edx, [eax - 0x41]
xchg cx, ax
xchg ecx, edi
jmp 0x7813b2

Function at 0x7857c4
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.00784030
push eax
jmp 0x78402b
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x7855a3
mov dword [esp + 0x3c], edi
lea esp, [esp + 0x3c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x7855c4
pop dword [esp]
push word [esp + 3]
lea esp, [esp + 5]
lea esp, [esp + 3]
jmp 0x78560e
Function at 0x402260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402277
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4022a8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4022a4
cmp esi, eax
jae 0x4022a8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x402294
cmp esi, eax
jb 0x4022ae
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x402350
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x40f4d6
mov eax, dword fs:[0]
push eax
sub esp, 0x46c
mov eax, dword [0x4142e0]
xor eax, esp
mov dword [esp + 0x468], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4142e0]
xor eax, esp
push eax
lea eax, [esp + 0x480]
mov dword fs:[0], eax
xor ebx, ebx
push 0x206
lea eax, [esp + 0x27a]
push ebx
push eax
mov edi, ecx
mov esi, edx
mov word [esp + 0x280], bx
call fcn.00404c80
add esp, 0xc
push edi
push 0x411d58
mov eax, 0x208
lea edi, [esp + 0x27c]
call fcn.00401170
add esp, 8
lea ecx, [esp + 0x24]
push ecx
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40255e
lea eax, [esp + 0x50]
push eax
push str.First_file_name_is__s_n
call fcn.00404450
add esp, 8
cmp word [esp + 0x50], 0x2e
je 0x402447
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x54]
call fcn.004027d0
mov dword [esp + 0x488], ebx
lea ebx, [esp + 0x14]
call fcn.00402880
mov dword [esp + 0x488], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x402445
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor ebx, ebx
lea ecx, [esp + 0x24]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40253c
lea edx, [esp + 0x50]
push edx
push str.Next_file_name_is__s_n
call fcn.00404450
add esp, 8
cmp word [esp + 0x50], 0x2e
je 0x402528
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
call fcn.004027d0
mov dword [esp + 0x488], 1
mov ecx, dword [esi + 4]
cmp ecx, ebx
jne 0x40249d
xor edx, edx
jmp 0x4024a5
mov edx, dword [esi + 8]
sub edx, ecx
sar edx, 2
cmp ecx, ebx
je 0x4024de
mov eax, dword [esi + 0xc]
sub eax, ecx
sar eax, 2
cmp edx, eax
jae 0x4024de
mov edi, dword [esi + 8]
mov byte [esp + 0x14], bl
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
push 1
push edi
call fcn.00402f50
add esp, 0x14
add edi, 4
mov dword [esi + 8], edi
jmp 0x4024fd
mov edi, dword [esi + 8]
cmp ecx, edi
jbe 0x4024ea
call fcn.00403d03
push edi
push esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
mov eax, esi
call fcn.004028f0
mov dword [esp + 0x488], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402528
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40245b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x12
je 0x402563
push esi
push str.FindNextFile_error._Error_is__u_n
call fcn.00404450
add esp, 8
or eax, 0xffffffff
jmp 0x402568
mov eax, 1
mov ecx, dword [esp + 0x480]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.0040381d
add esp, 0x478
ret
Function at 0x402590
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push 0x3c
lea eax, [esp + 4]
push 0
push eax
call fcn.00404c80
mov ecx, dword [esp + 0x4c]
add esp, 0xc
lea edx, [esp]
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x440
mov dword [esp + 0x10], str.runas
mov dword [esp + 0x14], str.regsvr32
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x40260a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.regsvr32
push str._s_could_not_be_launched:__d_n
call fcn.004042d5
add eax, 0x40
push eax
call fcn.004040a1
add esp, 0x10
xor eax, eax
add esp, 0x3c
ret
mov eax, dword [esp + 0x38]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x3c
ret

Function at 0x402630
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4142e0]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x11c
lea eax, [esp + 4]
push 0
push eax
call fcn.00404c80
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40268c
cmp dword [esp + 4], 6
jae 0x40268c
xor al, al
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040381d
add esp, 0x120
ret
mov ecx, dword [esp + 0x11c]
xor ecx, esp
mov al, 1
call fcn.0040381d
add esp, 0x120
ret

Function at 0x40355b
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4142e0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0040349a
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00404c80
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4035aa
cmp dword [ebp - 0x1c], 5
jb 0x4035c2
jmp 0x4035be
cmp dword [ebp - 0x10], 1
jne 0x4035c2
cmp dword [ebp - 0x1c], 4
ja 0x4035be
jne 0x4035c2
cmp dword [ebp - 0x18], 0
jbe 0x4035c2
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x410258
call fcn.0040334d
test eax, eax
jge 0x4035e3
mov byte [0x415d0c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040381d
add ebp, 0x78
leave
ret

Function at 0x40381d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4142e0]
jne 0x403827
repz ret
jmp fcn.0040523b
Function at 0x40dec0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040611c
xor ebx, ebx
cmp dword [0x415c3c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40df95
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40df00
xor eax, eax
jmp 0x40e059
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40def9
push eax
call fcn.004060b9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x415c3c], eax
call esi
push eax
call fcn.004060b9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x415c40], eax
call esi
push eax
call fcn.004060b9
mov dword [0x415c44], eax
lea eax, [ebp - 8]
push eax
call fcn.0040998c
test eax, eax
pop ecx
pop ecx
je 0x40df63
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403be3
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40df95
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004060b9
cmp eax, ebx
pop ecx
mov dword [0x415c4c], eax
je 0x40df95
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004060b9
pop ecx
mov dword [0x415c48], eax
mov eax, dword [0x415c48]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40e00e
cmp dword [0x415c4c], esi
je 0x40e00e
push eax
call fcn.00406125
pop ecx
call eax
cmp eax, ebx
je 0x40dfdb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x415c4c]
call fcn.00406125
pop ecx
call eax
test eax, eax
je 0x40dfdb
test byte [ebp - 0x18], 1
jne 0x40e00e
lea eax, [ebp - 0xc]
push eax
call fcn.004099c3
test eax, eax
pop ecx
je 0x40dff6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403be3
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40e005
or dword [ebp + 0x10], 0x200000
jmp 0x40e03f
or dword [ebp + 0x10], 0x40000
jmp 0x40e03f
mov eax, dword [0x415c40]
cmp eax, esi
je 0x40e03f
push eax
call fcn.00406125
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40e03f
mov eax, dword [0x415c44]
cmp eax, esi
je 0x40e03f
push dword [ebp - 4]
push eax
call fcn.00406125
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x415c3c]
call fcn.00406125
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45feb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ac028
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
call fcn.0045a7b0
test eax, eax
je 0x45ffb8
lea ecx, [esp + 0xc]
call fcn.0042eb50
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0045a7b0
mov ecx, eax
call fcn.00457e70
test eax, eax
je 0x45ff9f
mov eax, dword [esp + 0x1c]
test eax, eax
mov ebp, eax
je 0x45ff9f
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x45ff9f
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
neg esi
push edi
push ebx
sbb esi, esi
and esi, edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, ebp
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.0042ed50
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
pop edi
jne 0x45ff81
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x45ff9f
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [0x693598]
push ebx
and eax, 0xffff
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x661f90
call fcn.0042ed50
mov ecx, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x462c80
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ac2b8
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x462cb9
inc eax
mov dword [esi + 0x10], eax
jmp 0x462dcc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x462ccd
mov eax, 0xffffffc7
jmp 0x462dce
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x462cde
cmp dword [esi + 8], eax
jne 0x462ccd
cmp dword [esi + 8], eax
jne 0x462cf7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x462cf7
mov eax, 0xffffffc7
jmp 0x462dce
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x462d0b
push eax
mov ecx, ebx
call fcn.004624b0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.0042eb50
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x462d3c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.0042eb70
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00461c20
test eax, eax
mov dword [esp + 0x38], eax
je 0x462d6f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x661f90
call fcn.0042ed50
mov eax, dword [esp + 0x38]
jmp 0x462dce
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00462ae0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x462db3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00462b00
mov esi, eax
test esi, esi
jne 0x462de3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00462ae0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x462d85
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x661f90
call fcn.0042ed50
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x661f90
call fcn.0042ed50
mov eax, esi
jmp 0x462dce

Function at 0x466030
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x466090
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x466090
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x466090
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x466090
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4660d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret