joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468530
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x468579
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x4689f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a2260
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004685a0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00468620
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00468620
lea ecx, [esi + 0xc]
call fcn.00494225
lea ecx, [esi + 0x10]
call fcn.00494225
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00469bc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00469bc0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00469bc0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0049429a
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049429a
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x46e910
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4edf5c]
xor edx, edx
cmp eax, edx
jne 0x46e936
xor eax, eax
mov byte [eax + 0x4ede5c], al
inc eax
cmp eax, 0x100
jl 0x46e91e
mov dword [0x4edf5c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4ede5c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x46e9c7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x46e99a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x46e968
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x46e9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x46ea23
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x46ea0a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4753a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a265e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00475cc0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4ab30c
call fcn.00493fdb
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x475433
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00493fdb
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x47542c
push 0
mov ecx, eax
call fcn.0046c540
mov dword [esi + 0xc], eax
jmp 0x475435
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x475435
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x49664e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x496686
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004946f5
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004946cd
jmp 0x496692
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x497d3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x497d7e
call fcn.0049d97d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x497d7e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x497d75
xor eax, eax
jmp 0x497d86
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00497d8c
pop edi
pop esi
pop ebx
ret 4

Function at 0x49dead
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49dedb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49def9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049de13
jmp 0x49def9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49def9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049de13
test edi, edi
mov eax, edi
jne 0x49dee3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x1000ba2f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1000ba3e
pop dword [ebp - 0x10]
mov eax, 0xbd1b20dd
sub eax, 0xad1a669f
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe457a1b1
add dword [ebp - 0x20], 0x69faa39a
mov dword [ebp - 0x1c], 0xa676309f
add dword [ebp - 0x1c], 0x8bbd1ba6
mov dword [ebp - 0x18], 0xe1b278d2
sub dword [ebp - 0x18], 0x956634a4
mov dword [ebp - 0x14], 0x1d6fad3b
add dword [ebp - 0x14], 0xe29052c5
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x828f2ffa
add dword [ebp - 0x20], 0xf1e3395c
mov dword [ebp - 0x1c], 0x47777caa
sub dword [ebp - 0x1c], 0x60b1b35
mov dword [ebp - 0x18], 0xef78fa52
add dword [ebp - 0x18], 0x73f6721a
mov dword [ebp - 0x14], 0xb4c64f9b
add dword [ebp - 0x14], 0x4b39b065
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x40204b62
sub eax, 0x301dfae6
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac09
push 0
call eax
mov ecx, 0xc50046e7
sub ecx, 0xc500027c
mov edx, eax
mov edi, 0x74e9298e
sub edi, 0x64e61d8e
add edi, dword [ebp - 0x10]
mov esi, 0xdcbe1742
sub esi, 0xb6092e7
xor dword [ebp - 0xc], eax
mov ebx, dword [edi]
mov dword [ebp - 4], 0x28139b75
xor ebx, esi
xor dword [ebp - 4], 0x4f5461fe
mov dword [edx], ebx
add dword [ebp - 0xc], esi
add edx, 0x671cb599
sub edx, 0x671cb595
add edi, 0x9b1ca5f2
add edi, 0x64e35a12
loop 0x1000bb5b
add eax, 0x1047f
xor ebx, ebx
add ebx, eax
add eax, 0x12863d39
add eax, 0xed79c2cc
mov ecx, 0x37d6a3b8
sub ecx, 0x27d6a3b8
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x401030
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 8], ebp
je 0x40115b
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x24]
push eax
push 0x40000
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x40114a
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
push ecx
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x40114a
mov eax, dword [esp + 0x30]
test eax, eax
je 0x401145
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0x20019
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x40114a
push eax
push eax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x30]
push ebp
lea eax, [esp + 0x40]
push edx
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40114a
push 0x105
call sub.MFC42.DLL_operatornew
mov esi, eax
mov eax, dword [esp + 0x2c]
add esp, 4
xor edi, edi
test eax, eax
jbe 0x40113c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edx, dword [esp + 0x10]
push 0x105
push esi
push edi
push edx
call ebx
test eax, eax
jne 0x40112c
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push 1
push eax
push esi
push ecx
call fcn.00401030
add esp, 0x10
jmp 0x401133
cmp eax, 0x103
je 0x40113c
mov eax, dword [esp + 0x28]
inc edi
cmp edi, eax
jb 0x401103
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ebp, 1
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x40115b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x4016c0
Capabilities:
Enumerate pe sections

Disassembly:
add byte [ebx - 0x7fcc388], cl
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.004014c5
lodsb al, byte [esi]
insd dword es:[edi], dx
xor ecx, dword [edi]
mov bh, 0x47
push es
lea eax, [eax + eax*4]
add cl, 0xe0
add ebp, dword [ebx]
inc ebp
adc byte [ebx], al
invalid
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.004014c5
ror byte [edx + ecx*2 + 0x77], 0x66
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x40171f
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x401719
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x40170a
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004014c5
lahf
out dx, eax
fsub qword [esi + 0x50a8458d]
call fcn.004014d5
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0040148a
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4017b3
invalid
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004014c5
adc al, 0x9e
ja 0x401795
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x4016e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add cl, 0xe0
add ebp, dword [ebx]
inc ebp
adc byte [ebx], al
invalid
Function at 0x401830
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ebp
call 0xe99da086
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
int 0xc6
inc ebp
cmc
fcmovb st(0), st(6)
inc ebp
neg dl
mov byte [ebp - 9], 0xbf
call fcn.004014d5
push eax
push esi
push dword [ebp + 8]
call fcn.0040148a
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004014d5
push eax
push esi
push dword [ebp + 8]
call fcn.0040148a
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004014d5
push eax
push esi
push dword [ebp + 8]
call fcn.0040148a
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004014c5
sbb eax, 0x888b6389
popfd
jl 0x40194a
invalid
invalid

Function at 0x401a10
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.00401436
add esp, 0xc
inc dword [ebp + 0xc]
mov ax, word [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x401a02
call fcn.004014c5
add eax, 0x8b28e814
jle 0x401a7d
add edi, esi
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x401cb4
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x401a6a
cmp dword [eax + 0xc], ebx
je 0x401b0d
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004014c5
mov ebx, 0x39b8fca1
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
invalid
call fcn.004014c5
in eax, dx
or byte [eax], 0xec
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x401b79
Function at 0x401b50
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x401b79
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x401b74
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x401b5e
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add byte [ebx + 0x34572bd6], cl
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x401b66
cmp edx, ebx
jne 0x401cb4
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x401b35
add eax, dword [eax + 4]
jmp 0x401b22
mov dword [ebp + 0xc], ebx
jmp 0x401b84

Function at 0x401ba0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x401b9c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x401bba
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x401c18
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401bff
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401c08
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401c12
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401bf4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x401b7e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x401c65
dec eax
je 0x401c5c
sub eax, 3
je 0x401c53
mov dword [ebp - 4], 0x40
jmp 0x401c82
mov dword [ebp - 4], 4
jmp 0x401c68
mov dword [ebp - 4], 0x20
jmp 0x401c68
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x401cb4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x401c34
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004014c5
sub esp, dword fs:[esp + edx*4 + 0x6a1475ff]
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x401cc0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401bb0
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x401b9c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x401bba
movzx eax, ax
lea eax, [eax + eax*4]
add al, 0x80
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x401c18
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
add byte [eax], al
invalid
invalid
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x401bff
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x401c08
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x401c12
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x401bf4
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x401b7e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x401c65
dec eax
je 0x401c5c
sub eax, 3
je 0x401c53
mov dword [ebp - 4], 0x40
jmp 0x401c82
mov dword [ebp - 4], 4
jmp 0x401c68
mov dword [ebp - 4], 0x20
jmp 0x401c68
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x401cb4
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x401c34
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004014c5
sub esp, dword fs:[esp + edx*4 + 0x6a1475ff]
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x401cc0
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401bf0
Capabilities:
Inspect section memory permissions

Disassembly:
add byte [eax], al
add byte [eax + 0x3b184d8b], al
sal dword [esp + eax - 0x80], cl
or al, 8
add dword [ecx], edi
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454030]
jne 0x401116
repz ret
jmp fcn.00401b11

Function at 0x408edc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004047d5
and dword [ebp - 4], 0
cmp dword [0x45678c], 0
mov ebx, eax
jne 0x408f8d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40903e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40903e
push eax
call fcn.00404763
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45678c], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x456790], eax
call esi
push eax
call fcn.00404763
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x456794], eax
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x45679c], eax
test eax, eax
je 0x408f8d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404763
pop ecx
mov dword [0x456798], eax
mov eax, dword [0x456798]
cmp eax, ebx
je 0x408fe5
cmp dword [0x45679c], ebx
je 0x408fe5
push eax
call fcn.004047de
push dword [0x45679c]
mov esi, eax
call fcn.004047de
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408fe5
test edi, edi
je 0x408fe5
call esi
test eax, eax
je 0x408fdc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408fdc
test byte [ebp - 0xc], 1
jne 0x408fe5
or dword [ebp + 0x10], 0x200000
jmp 0x40901e
mov eax, dword [0x456790]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40901e
mov eax, dword [0x456794]
cmp eax, ebx
je 0x40901e
push eax
call fcn.004047de
pop ecx
test eax, eax
je 0x40901e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45678c]
call fcn.004047de
pop ecx
test eax, eax
je 0x40903e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409040
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret