joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ae3b
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push ecx
mov ebx, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ae7e
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp eax, 0x6400000
jb 0x40ae87
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xa
push eax
call fcn.0041747f
mov edi, eax
pop ecx
test edi, edi
je 0x40ae77
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov byte [edi + eax], 0
test ebx, ebx
je 0x40aebf
mov eax, dword [ebp - 4]
mov dword [ebx], eax
mov eax, edi
jmp 0x40ae80

Function at 0x40aff6
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x443d7c]
test eax, eax
jne 0x40b069
push ebx
mov ebx, 0x443d80
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x443d7c], 0
jne 0x40b05a
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0x443d7c
push edi
mov esi, eax
push esi
push 0x40aec3
push edi
push edi
call fcn.0041e53b
add esp, 0x18
test eax, eax
jne 0x40b048
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b058
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop edi
pop esi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x443d7c]
test eax, eax
pop ebx
setne al
ret

Function at 0x40b2d0
Capabilities:
Get common file path

Disassembly:
cmp byte [0x441e48], 0
push ebx
push esi
push edi
jne 0x40b3a0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, 0x104
push edi
push 0x442a80
xor ebx, ebx
mov byte [0x441e48], 1
push ebx
call esi
push edi
mov edi, 0x442878
push edi
push dword [0x44123c]
call esi
push 0x5c
push edi
call fcn.0041969d
pop ecx
pop ecx
mov esi, 0x441e50
xor ecx, ecx
push esi
push ebx
push ebx
push 0x1a
push ebx
mov word [eax], cx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.SogouGame
push 0x104
push esi
call fcn.00422ad2
add esp, 0xc
push esi
push str._sTemp
push 0x442058
call fcn.0040b281
add esp, 0xc
push esi
push str._sIcon
push 0x442260
call fcn.0040b281
add esp, 0xc
push esi
push str._sFlash
push 0x442468
call fcn.0040b281
add esp, 0xc
push esi
push str._sMicroClient
push 0x442670
call fcn.0040b281
add esp, 0xc
mov ecx, esi
call fcn.0040ac68
add esi, 0x208
cmp esi, 0x442878
jl 0x40b38b
pop edi
pop esi
pop ebx
ret
Function at 0x40bfdc
Capabilities:
Accept command line arguments

Disassembly:
push 0x6c
mov eax, 0x42eafb
call fcn.0042d090
lea eax, [ebp - 0x78]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x40c0ba
cmp dword [ebp - 0x78], 5
jl 0x40c0ba
xor ebx, ebx
mov dword [ebp - 0x3c], 7
push ebx
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x40], ebx
call fcn.004026e0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], str.4.3.0.3508
push dword [esi + 4]
call fcn.0041e204
test eax, eax
pop ecx
setne byte [ebp - 0x6c]
push dword [esi + 8]
call fcn.0041e204
pop ecx
mov dword [ebp - 0x68], eax
push dword [esi + 0xc]
call fcn.0041e204
pop ecx
mov dword [ebp - 0x64], eax
push dword [esi + 0x10]
call fcn.0041e204
pop ecx
push 6
pop edi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x78], edi
jle 0x40c0a2
push dword [esi + edi*4]
lea ecx, [ebp - 0x2c]
call fcn.00403240
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x38]
call fcn.00407e1d
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.00402610
inc edi
cmp edi, dword [ebp - 0x78]
jl 0x40c076
lea ecx, [ebp - 0x74]
call fcn.0040d7c3
lea ecx, [ebp - 0x38]
call fcn.00407dc6
lea ecx, [ebp - 0x50]
call fcn.00402610
call fcn.0042d04b
ret
Function at 0x40db5f
Capabilities:
Enumerate process modules

Disassembly:
push 0x438
mov eax, 0x42edd3
call fcn.0042d090
mov eax, dword [ebp + 8]
push edx
push 0
push 0x1f0fff
mov dword [ebp - 0x444], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40dc5c
push 0x2801
mov dword [ebp - 0x440], 0x2800
call fcn.0041747f
pop ecx
mov ecx, dword [ebp - 0x440]
mov ebx, eax
lea eax, [ebp - 0x440]
inc ecx
push eax
push ecx
push ebx
push edi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40dc4b
xor esi, esi
test dword [ebp - 0x440], 0xfffffffc
jbe 0x40dc4b
push 0x208
lea eax, [ebp - 0x424]
push eax
push dword [ebx + esi*4]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
cmp eax, 4
jbe 0x40dc3d
lea eax, [ebp + eax*2 - 0x42c]
push str..tmp
push eax
call fcn.0041d595
pop ecx
pop ecx
test eax, eax
jne 0x40dc3d
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x43c]
call fcn.00403240
mov ecx, dword [ebp - 0x444]
lea eax, [ebp - 0x43c]
and dword [ebp - 4], 0
push eax
call fcn.00407e1d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.00402610
mov eax, dword [ebp - 0x440]
inc esi
shr eax, 2
cmp esi, eax
jb 0x40dbd3
push 1
push ebx
call fcn.004171e6
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042d04b
ret
Function at 0x40f31a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x44000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
mov esi, str.Unknown
call fcn.0041123d
cmp eax, 6
jg 0x40f394
je 0x40f38d
cmp eax, 0xfffffc18
je 0x40f386
cmp eax, 1
je 0x40f37f
cmp eax, 2
je 0x40f378
cmp eax, 3
je 0x40f371
cmp eax, 4
je 0x40f36a
cmp eax, 5
jne 0x40f3d0
mov esi, str.Windows_XP_SP3
jmp 0x40f3d0
mov esi, str.Windows_XP_SP2
jmp 0x40f3d0
mov esi, str.Windows_XP_SP1
jmp 0x40f3d0
mov esi, str.Windows_XP
jmp 0x40f3d0
mov esi, str.Windows_2000
jmp 0x40f3d0
mov esi, str.Old_Windows
jmp 0x40f3d0
mov esi, str.Windows_2003
jmp 0x40f3d0
sub eax, 7
je 0x40f3cb
sub eax, 1
je 0x40f3c4
sub eax, 1
je 0x40f3bd
sub eax, 1
je 0x40f3b6
sub eax, 0x3de
jne 0x40f3d0
mov esi, str.Windows_Newest
jmp 0x40f3d0
mov esi, str.Windows_7
jmp 0x40f3d0
mov esi, str.Windows_Vista_SP2
jmp 0x40f3d0
mov esi, str.Windows_Vista_SP1
jmp 0x40f3d0
mov esi, str.Windows_Vista
push pe_nt_image_headers32
lea eax, [ebp - 0x174]
mov dword [ebp - 0x178], 0x114
push 0
push eax
call fcn.00419740
add esp, 0xc
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, dword [ebp - 0x174]
mov edx, esi
mov ecx, ebx
call fcn.0040a70c
mov edx, 0x43a548
mov ecx, eax
call fcn.0040a70c
push 0xa
mov esi, eax
lea eax, [ebp - 0x24]
push 0x20
push eax
push edi
call fcn.00422776
lea edx, [ebp - 0x24]
mov ecx, esi
call fcn.0040a70c
mov edi, dword [ebp - 0x170]
mov dl, 0x2e
mov ecx, eax
call fcn.0040a22b
push 0xa
mov esi, eax
lea eax, [ebp - 0x44]
push 0x20
push eax
push edi
call fcn.00422776
lea edx, [ebp - 0x44]
mov ecx, esi
call fcn.0040a70c
mov esi, dword [ebp - 0x16c]
mov dl, 0x2e
mov ecx, eax
call fcn.0040a22b
push 0xa
mov edi, eax
lea eax, [ebp - 0x64]
push 0x20
push eax
push esi
call fcn.00422776
add esp, 0x30
lea edx, [ebp - 0x64]
mov ecx, edi
call fcn.0040a70c
mov dl, 0x29
mov ecx, eax
call fcn.0040a22b
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004171a2
mov esp, ebp
pop ebp
ret
Function at 0x40f4a3
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x44000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
pop esi
push 7
mov ebx, ecx
mov dword [ebp - 0x104], esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x100]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0xa
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x100]
call fcn.00422776
lea edx, [ebp - 0x24]
mov ecx, ebx
call fcn.0040a70c
mov edi, dword [ebp - 0xfc]
mov ecx, eax
mov edx, str.__memory_in_use.
lea edi, [edi + 0xfffff]
shr edi, 0x14
call fcn.0040a70c
mov edx, str._r_n
mov ecx, eax
call fcn.0040a70c
push 0xa
mov esi, eax
lea eax, [ebp - 0x44]
push 0x20
push eax
push edi
call fcn.00422776
lea edx, [ebp - 0x44]
mov ecx, esi
call fcn.0040a70c
mov edi, dword [ebp - 0xf8]
mov ecx, eax
mov edx, str._MBytes_physical_memory.
lea edi, [edi + 0xfffff]
shr edi, 0x14
call fcn.0040a70c
mov edx, str._r_n
mov ecx, eax
call fcn.0040a70c
push 0xa
mov esi, eax
lea eax, [ebp - 0x64]
push 0x20
push eax
push edi
call fcn.00422776
lea edx, [ebp - 0x64]
mov ecx, esi
call fcn.0040a70c
mov edi, dword [ebp - 0xf4]
mov ecx, eax
mov edx, str._MBytes_physical_memory_free.
lea edi, [edi + 0xfffff]
shr edi, 0x14
call fcn.0040a70c
mov edx, str._r_n
mov ecx, eax
call fcn.0040a70c
push 0xa
mov esi, eax
lea eax, [ebp - 0x84]
push 0x20
push eax
push edi
call fcn.00422776
add esp, 0x40
lea edx, [ebp - 0x84]
mov ecx, esi
call fcn.0040a70c
mov edi, dword [ebp - 0xf0]
mov ecx, eax
mov edx, str._MBytes_paging_file.
lea edi, [edi + 0xfffff]
shr edi, 0x14
call fcn.0040a70c
mov edx, str._r_n
mov ecx, eax
call fcn.0040a70c
push 0xa
mov esi, eax
lea eax, [ebp - 0xa4]
push 0x20
push eax
push edi
call fcn.00422776
lea edx, [ebp - 0xa4]
mov ecx, esi
call fcn.0040a70c
mov edi, dword [ebp - 0xec]
mov ecx, eax
mov edx, str._MBytes_paging_file_free.
lea edi, [edi + 0xfffff]
shr edi, 0x14
call fcn.0040a70c
mov edx, str._r_n
mov ecx, eax
call fcn.0040a70c
push 0xa
mov esi, eax
lea eax, [ebp - 0xc4]
push 0x20
push eax
push edi
call fcn.00422776
lea edx, [ebp - 0xc4]
mov ecx, esi
call fcn.0040a70c
mov edi, dword [ebp - 0xe8]
mov ecx, eax
mov edx, str._MBytes_user_address_space.
lea edi, [edi + 0xfffff]
shr edi, 0x14
call fcn.0040a70c
mov edx, str._r_n
mov ecx, eax
call fcn.0040a70c
push 0xa
mov esi, eax
lea eax, [ebp - 0xe4]
push 0x20
push eax
push edi
call fcn.00422776
add esp, 0x30
lea edx, [ebp - 0xe4]
mov ecx, esi
call fcn.0040a70c
mov edx, str._MBytes_user_address_space_free.
mov ecx, eax
call fcn.0040a70c
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004171a2
mov esp, ebp
pop ebp
ret
Function at 0x40f6bd
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x2801
mov ebx, edx
mov dword [ebp - 4], 0x2800
mov edi, ecx
call fcn.0041747f
mov edx, dword [ebp - 4]
pop ecx
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
inc edx
push edx
push eax
push dword [ebx]
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40f72f
xor esi, esi
test dword [ebp - 4], 0xfffffffc
jbe 0x40f72f
mov eax, dword [ebx]
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + esi*4]
mov dword [ebp - 0xc], eax
call fcn.0040f738
mov edx, 0x43a188
mov ecx, eax
call fcn.0040a70c
mov eax, dword [ebp - 4]
inc esi
shr eax, 2
cmp esi, eax
jb 0x40f700
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40fb8e
Capabilities:
Enumerate processes

Disassembly:
push 0x2ac
mov eax, 0x42efba
call fcn.0042d090
mov esi, ecx
mov dword [ebp - 0x2b0], esi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x2b8], ebx
cmp ebx, 0xffffffff
je 0x40fd26
push 0x228
lea eax, [ebp - 0x2a8]
mov dword [ebp - 0x2ac], 0x22c
push 0
push eax
call fcn.00419740
add esp, 0xc
lea eax, [ebp - 0x2ac]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40fd1f
mov esi, 0xfde9
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x288]
lea ecx, [ebp - 0x64]
call fcn.00409d37
mov ecx, dword [ebp - 0x2b0]
mov edx, str._____
mov edi, dword [ebp - 0x2a4]
mov dword [ebp - 0x2b4], eax
call fcn.0040a70c
push 0xa
mov ebx, eax
lea eax, [ebp - 0x34]
push 0x20
push eax
push edi
call fcn.00422776
add esp, 0x18
lea edx, [ebp - 0x34]
mov ecx, ebx
call fcn.0040a70c
mov edx, 0x43a7a8
mov ecx, eax
call fcn.0040a70c
mov edx, dword [ebp - 0x2b4]
mov ecx, eax
call fcn.0040a596
xor ebx, ebx
lea ecx, [ebp - 0x64]
push ebx
push 1
call fcn.00408008
cmp dword [ebp - 0x2a4], ebx
je 0x40fced
push dword [ebp - 0x2a4]
push ebx
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40fced
mov edx, edi
lea ecx, [ebp - 0x7c]
call fcn.0040f137
push esi
mov edx, eax
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x4c]
call fcn.00409dad
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.00402610
cmp dword [ebp - 0x3c], ebx
je 0x40fcdb
mov ecx, dword [ebp - 0x2b0]
mov edx, 0x43a548
call fcn.0040a70c
lea edx, [ebp - 0x4c]
mov ecx, eax
call fcn.0040a596
mov edx, 0x43a7b4
mov ecx, eax
call fcn.0040a70c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.00408008
mov ecx, dword [ebp - 0x2b0]
mov edx, 0x43a188
call fcn.0040a70c
mov ebx, dword [ebp - 0x2b8]
lea eax, [ebp - 0x2ac]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40fbfb
mov esi, dword [ebp - 0x2b0]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0042d04b
ret
Function at 0x40ff0c
Capabilities:
Get graphical window text

Disassembly:
push 0x430
mov eax, 0x42f01a
call fcn.0042d090
mov ebx, ecx
mov dword [ebp - 0x438], ebx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebx], eax
lea eax, [ebx + 4]
push 0xf
pop edx
mov dword [ebp - 0x43c], ebx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], ecx
cmp edx, 0x10
jb 0x40ff43
mov eax, dword [eax]
mov byte [eax], cl
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x1c]
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], ecx
cmp edx, 0x10
jb 0x40ff58
mov eax, dword [eax]
mov byte [eax], cl
mov dword [ebx + 0x44], ecx
push ecx
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x48], 7
call fcn.004026e0
xor eax, eax
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], eax
mov byte [ebp - 4], 3
push dword [ebx]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
lea edi, [ebx + 0x4c]
push edi
push dword [ebx]
setne al
mov byte [ebx + 0x54], al
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebx + 0x50], eax
mov esi, 0x80
push esi
lea eax, [ebp - 0x114]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
lea eax, [ebp - 0x214]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClassNameW]
mov esi, 0xfde9
lea edx, [ebp - 0x114]
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x434]
call fcn.00409d37
pop ecx
pop ecx
push eax
lea ecx, [ebx + 4]
call fcn.0040b745
push 0
push 1
lea ecx, [ebp - 0x434]
call fcn.00408008
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x434]
call fcn.00409d37
pop ecx
pop ecx
push eax
lea ecx, [ebx + 0x1c]
call fcn.0040b745
push 0
push 1
lea ecx, [ebp - 0x434]
call fcn.00408008
push dword [edi]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x41007d
push 0x104
lea eax, [ebp - 0x41c]
push eax
push 0
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x410076
lea eax, [ebp - 0x41c]
push 0x5c
push eax
call fcn.0041969d
pop ecx
pop ecx
test eax, eax
lea edx, [ebp - 0x41c]
lea ecx, [eax + 2]
cmovne edx, ecx
lea ecx, [ebx + 0x34]
push edx
call fcn.00406850
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
call fcn.0042d04b
ret 4
Function at 0x410087
Capabilities:
Enumerate gui resources

Disassembly:
push 0x234
mov eax, 0x42f063
call fcn.0042d090
mov dword [ebp - 0x240], ecx
mov ecx, dword [edx + 0x1c]
test ecx, ecx
je 0x410233
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
push ecx
push ecx
lea eax, [ebp - 0x23c]
mov dword [ebp - 4], ebx
push eax
call fcn.0040a480
add esp, 0xc
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 1
push eax
push 0x4102ba
call dword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
je 0x4101f9
mov ecx, ebx
mov dword [ebp - 0x21c], 0x200
lea edx, [ebp - 0x214]
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x218], edx
mov byte [ebp - 4], 2
mov edi, ebx
mov eax, dword [ebp - 0x228]
sub eax, dword [ebp - 0x22c]
sar eax, 2
test eax, eax
je 0x4101c1
mov eax, dword [ebp - 0x238]
sub eax, dword [ebp - 0x23c]
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x230], eax
test eax, eax
je 0x410199
mov esi, dword [ebp - 0x23c]
cmp dword [esi + 0x14], 8
jb 0x410166
mov ecx, dword [esi]
jmp 0x410168
mov ecx, esi
mov eax, dword [ebp - 0x22c]
mov eax, dword [eax + edi*4]
add eax, 0x34
cmp dword [eax + 0x14], 8
jb 0x41017c
mov eax, dword [eax]
push ecx
push eax
call fcn.0041d595
pop ecx
pop ecx
test eax, eax
je 0x410239
inc ebx
add esi, 0x18
cmp ebx, dword [ebp - 0x230]
jb 0x41015c
xor ebx, ebx
mov eax, dword [ebp - 0x228]
inc edi
sub eax, dword [ebp - 0x22c]
sar eax, 2
cmp edi, eax
mov eax, dword [ebp - 0x230]
jb 0x410152
mov edx, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x220]
push ecx
mov byte [edx + ecx], bl
mov edx, str.wndinfo.txt
push ecx
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x240]
call fcn.0041178a
lea eax, [ebp - 0x214]
add esp, 0xc
cmp dword [ebp - 0x218], eax
je 0x4101f9
push dword [ebp - 0x218]
call fcn.0041aac0
pop ecx
mov ecx, dword [ebp - 0x22c]
test ecx, ecx
je 0x410228
mov edx, dword [ebp - 0x224]
sub edx, ecx
push 4
sar edx, 2
call fcn.004013a0
pop ecx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
lea ecx, [ebp - 0x23c]
call fcn.00407dc6
call fcn.0042d04b
ret
mov edx, dword [ebp - 0x22c]
lea ecx, [ebp - 0x220]
xor ebx, ebx
push ebx
mov edx, dword [edx + edi*4]
call fcn.0041030e
pop ecx
jmp 0x41019b

Function at 0x41052a
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x43d240
call fcn.00417eb0
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x410591
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x410591
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x410591
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x410591
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x41059a
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.00417ef6
ret
Function at 0x4105cb
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x443d20]
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x443d14]
test edx, edx
jne 0x410619
test eax, eax
je 0x41062c
mov edx, eax
mov dword [0x443d20], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x41062c
cmp ecx, ebx
jb 0x41062c
cmp ecx, edi
jbe 0x410707
mov edx, eax
test eax, eax
jmp 0x41064e
test edx, edx
je 0x410649
mov eax, dword [edx + 8]
test eax, eax
je 0x410649
cmp eax, ebx
jb 0x410649
cmp eax, edi
jbe 0x410707
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x443d20], edx
jne 0x410632
and esi, 0xffff0000
mov ecx, esi
cmp esi, ebx
jbe 0x4107a7
lea eax, [ecx - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x3c]
push 0x1c
cmovbe ecx, edx
push eax
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4107a7
mov eax, 0x10000
cmp dword [ebp - 0x2c], eax
jne 0x4106a0
cmp dword [ebp - 0x30], eax
jae 0x4106b2
mov ecx, dword [ebp - 0x38]
add ecx, 0xffff0000
cmp ecx, ebx
ja 0x410666
jmp 0x4107a7
push 0x40
push 0x3000
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x443d20], edx
test edx, edx
je 0x4107a7
mov eax, dword [0x443d14]
xor ecx, ecx
mov dword [edx + 4], eax
mov esi, 0x7fd
mov dword [edx], 0x52727464
lea eax, [edx + 0xffe0]
mov dword [edx + 8], ecx
mov dword [0x443d14], edx
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
sub esi, 1
jne 0x4106f7
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x4107ab
cmp esi, edi
ja 0x4107ab
mov ecx, dword [esi + 0x18]
mov eax, 0xcccccccc
mov dword [edx + 8], ecx
mov edi, esi
push 8
pop ecx
rep stosd dword es:[edi], eax
mov eax, esi
jmp 0x4107ad
lea eax, [esi - 0x70000000]
mov ecx, 0x80010000
cmp eax, 0x10000000
lea eax, [ebp - 0x20]
push 0x1c
cmovbe esi, ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4107ab
mov eax, 0x10000
cmp dword [ebp - 0x10], eax
jne 0x41079f
mov ecx, dword [ebp - 0x14]
cmp ecx, eax
jb 0x4107a2
movzx edx, si
test edx, edx
je 0x410780
mov esi, dword [ebp - 0x20]
sub eax, edx
sub ecx, eax
add esi, eax
mov dword [ebp - 0x14], ecx
mov eax, 0x10000
mov dword [ebp - 0x20], esi
push 0x40
push 0x3000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x443d20], edx
test edx, edx
jne 0x4106d3
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add esi, ecx
cmp esi, edi
jb 0x410730
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410876
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x443d1c], 0
je 0x41088a
mov eax, 0x10dd
jmp 0x4108ed
push esi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x443d1c
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4108ab
mov eax, 0x10dd
jmp 0x4108ec
mov dword [0x443d08], esi
mov dword [0x443d0c], esi
mov dword [0x443d10], esi
mov dword [0x443d24], esi
mov dword [0x443d18], esi
mov esi, dword [0x443d14]
jmp 0x4108e6
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
test esi, esi
jne 0x4108d1
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4108f1
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x443d1c], eax
je 0x41090d
mov eax, 0x10dd
jmp 0x41099b
push ebx
push esi
push edi
mov edi, dword [0x443d0c]
xor ebx, ebx
test edi, edi
je 0x41095a
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x10]
push dword [edi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [edi + 4], ebx
jne 0x410948
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x410948
call fcn.004107b4
mov dword [edi + 0x10], ebx
mov esi, dword [edi]
push 0x18
push edi
call fcn.004171e6
mov edi, esi
pop ecx
pop ecx
test esi, esi
jne 0x41091c
mov dword [0x443d0c], ebx
call fcn.004105a0
mov edi, dword [0x443d10]
test edi, edi
je 0x41098a
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [edi]
push 8
push edi
call fcn.004171e6
mov edi, esi
pop ecx
pop ecx
test esi, esi
jne 0x41096f
pop edi
pop esi
mov dword [0x443d10], ebx
xor eax, eax
mov dword [0x443d1c], ebx
pop ebx
mov esp, ebp
pop ebp
ret