joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460f70
Capabilities:
Capture microphone audio
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
mov eax, dword [0x570f20]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, dword [esp + 0x34]
mov eax, dword [edi + 0x20]
mov esi, dword [edi + 0x3c]
push eax
call fcn.004608b0
add esp, 4
test eax, eax
jne 0x460fad
pop edi
mov eax, 0xffffd8fd
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004a7314
add esp, 0x28
ret
mov eax, dword [eax + 0x18]
dec eax
push ebx
je 0x460fc1
sub eax, 3
je 0x460fc1
mov ebx, dword [edi + 0x18]
lea ecx, [ebx + ebx]
jmp 0x460fcb
mov ebx, dword [edi + 0x18]
lea ecx, [ebx*4]
mov ax, word [edi + 0x18]
fld qword [edi + 0x10]
mov word [esp + 0x1e], ax
fnstcw word [esp + 0xe]
movzx eax, word [esp + 0xe]
fld st(0)
or eax, 0xc00
mov dword [esp + 0x10], eax
mov edx, 1
mov word [esp + 0x1c], dx
fldcw word [esp + 0x10]
mov dword [esp + 0x18], ecx
mov word [esp + 0x28], cx
fistp qword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
fldcw word [esp + 0xe]
fimul dword [esp + 0x18]
fnstcw word [esp + 0xe]
movzx eax, word [esp + 0xe]
or eax, 0xc00
mov dword [esp + 0x10], eax
fldcw word [esp + 0x10]
fistp qword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, ecx
cdq
fldcw word [esp + 0xe]
idiv ebx
xor ecx, ecx
mov word [esp + 0x2c], cx
mov ecx, dword [0x6bbfac]
add eax, eax
add eax, eax
add eax, eax
mov word [esp + 0x2a], ax
mov eax, dword [edi + 0x20]
cmp eax, ecx
jl 0x461062
sub eax, ecx
mov edx, dword [esi + 0x78]
push ebp
push 0x50000
push edi
push edx
lea ecx, [esp + 0x2c]
push ecx
dec eax
push eax
push esi
call dword [sym.imp.WINMM.dll_waveInOpen]
mov edi, eax
test edi, edi
je 0x4610bc
push 0x4cb640
call fcn.004a7323
call fcn.004a90b4
add eax, 0x20
push eax
call fcn.004a93f3
add esp, 8
pop ebp
pop ebx
mov dword [0x6bbfbc], edi
mov ecx, 0xffffd8f0
pop edi
mov eax, ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004a7314
add esp, 0x28
ret
mov eax, dword [esi + 0x48]
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
shl eax, 5
push eax
push 0x40
call ebp
mov dword [esi + 4], eax
test eax, eax
jne 0x4610ee
pop ebp
pop ebx
mov ecx, 0xffffd8f7
pop edi
mov eax, ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004a7314
add esp, 0x28
ret
xor ebx, ebx
cmp dword [esi + 0x48], ebx
jle 0x46113a
xor edi, edi
mov eax, dword [esi + 0xc]
push eax
push 0x40
call ebp
mov edx, dword [esi + 4]
mov dword [edi + edx], eax
mov eax, dword [esi + 4]
cmp dword [eax + edi], 0
je 0x4610d4
mov ecx, dword [esi + 0xc]
mov dword [eax + edi + 4], ecx
mov edx, dword [esi + 4]
mov dword [edx + edi + 0xc], ebx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push 0x20
add eax, edi
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
test eax, eax
jne 0x46114f
inc ebx
add edi, 0x20
cmp ebx, dword [esi + 0x48]
jl 0x4610f7
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004a7314
add esp, 0x28
ret
pop ebp
pop ebx
mov ecx, 0xffffd8f0
mov dword [0x6bbfbc], eax
mov eax, ecx
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.004a7314
add esp, 0x28
ret
Function at 0x461500
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor ebx, ebx
cmp edi, ebx
je 0x461514
mov esi, dword [edi + 0x3c]
cmp esi, ebx
jne 0x46151d
pop edi
pop esi
mov eax, 0xffffd8fd
pop ebx
ret
xorps xmm0, xmm0
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x48], 1
mov eax, dword [esi + 0x70]
push eax
movsd qword [esi + 0x28], xmm0
mov dword [esi + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esi + 0x84]
push ecx
push ebx
push edi
push 0x460db0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x80], eax
cmp eax, ebx
je 0x461588
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x461588
mov edx, dword [esi + 0x80]
push 2
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x461598
mov ebx, 0xffffd8f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x6bbfbc], eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x470470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x80
mov dword [esi + 4], ebx
mov dword [esi + 8], 0x40
fld dword [eax + 0xb74]
mov dword [esi], ecx
fstp dword [esi + 0xc]
mov dword [esi + 0xa4], ebx
mov eax, dword [eax + 4]
cdq
push edi
sub eax, edx
sar eax, 1
push 4
push ebx
mov dword [esp + 0x24], ecx
mov dword [esi + 0xb0], eax
call fcn.004ab061
mov dword [esi + 0x24], eax
lea eax, [esi + 0x10]
push ebx
push eax
call fcn.0046db50
add esp, 0x10
xor edi, edi
mov dword [esp + 0xc], edi
fild dword [esp + 0xc]
fdiv qword [0x5492c0]
fmul qword [0x4c94b8]
call fcn.004aa410
fstp dword [esp + 0x18]
mov ecx, dword [esi + 0x24]
fld dword [esp + 0x18]
fstp dword [ecx + edi*4]
mov edx, dword [esi + 0x24]
movss xmm0, dword [edx + edi*4]
lea eax, [edx + edi*4]
cvtps2pd xmm0, xmm0
inc edi
mulsd xmm0, xmm0
cvtpd2ps xmm0, xmm0
movss dword [eax], xmm0
mov dword [esp + 0xc], edi
cmp edi, ebx
jl 0x4704d8
mov eax, 4
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], eax
mov eax, 6
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov eax, 8
mov dword [esi + 0x28], 2
mov dword [esi + 0x3c], 5
mov dword [esi + 0x58], 9
mov dword [esi + 0x5c], eax
mov dword [esi + 0x68], 0xd
mov dword [esi + 0x6c], eax
mov dword [esi + 0x78], 0x11
mov dword [esi + 0x7c], eax
mov dword [esi + 0x88], 0x16
mov dword [esi + 0x8c], eax
lea edi, [esi + 0x34]
mov dword [esp + 0x18], 7
mov eax, dword [edi - 8]
mov dword [esp + 0x14], eax
add eax, eax
add eax, eax
push eax
call fcn.004a7dcb
mov ecx, dword [esp + 0x18]
xor ebx, ebx
add esp, 4
mov dword [edi - 4], eax
mov dword [esp + 0xc], ebx
test ecx, ecx
jle 0x470603
xorps xmm0, xmm0
cvtsi2sd xmm0, ecx
movsd qword [esp + 0x20], xmm0
mov dword [esp + 0x10], eax
fild dword [esp + 0xc]
fadd qword [0x4c5b80]
fdiv qword [esp + 0x20]
fmul qword [0x4c94b8]
call fcn.004aa410
mov ecx, dword [esp + 0x10]
fstp dword [ecx + ebx*4]
mov eax, dword [edi - 4]
movss xmm0, dword [eax + ebx*4]
movss xmm1, dword [edi]
cvtps2pd xmm0, xmm0
inc ebx
cvtps2pd xmm1, xmm1
addsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
mov dword [esp + 0x10], eax
movss dword [edi], xmm0
mov dword [esp + 0xc], ebx
cmp ebx, dword [esp + 0x14]
jl 0x4705b6
movss xmm0, dword [edi]
movsd xmm1, qword [0x4c5bf8]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
xorps xmm0, xmm0
cvtpd2ps xmm0, xmm1
movss dword [edi], xmm0
add edi, 0x10
dec dword [esp + 0x18]
jne 0x470580
mov eax, dword [esp + 0x1c]
lea edx, [eax*8]
sub edx, eax
push 0x90
push edx
call fcn.004ab061
mov dword [esi + 0x98], eax
mov eax, dword [esi + 0xa4]
push 4
push eax
call fcn.004ab061
add esp, 0x10
pop edi
mov dword [esi + 0xa0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x479020
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
cmp edx, 8
jl 0x4790d5
mov esi, edx
shr esi, 3
mov edi, esi
neg edi
lea edx, [edx + edi*8]
push ebx
lea esp, [esp]
movzx edi, byte [ecx]
movzx ebx, byte [ecx + 1]
shl edi, 8
or edi, ebx
movzx ebx, byte [ecx + 2]
shl edi, 8
or edi, ebx
movzx ebx, byte [ecx + 3]
shl edi, 8
or edi, ebx
xor eax, edi
mov edi, eax
shr edi, 0x10
and edi, 0xff
mov edi, dword [edi*4 + 0x552f88]
mov ebx, eax
shr ebx, 8
and ebx, 0xff
xor edi, dword [ebx*4 + 0x552b88]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x553388]
movzx ebx, byte [ecx + 6]
xor edi, dword [ebx*4 + 0x551b88]
movzx ebx, byte [ecx + 5]
xor edi, dword [ebx*4 + 0x551f88]
movzx ebx, byte [ecx + 4]
xor edi, dword [ebx*4 + 0x552388]
movzx ebx, byte [ecx + 7]
xor edi, dword [ebx*4 + 0x551788]
and eax, 0xff
xor edi, dword [eax*4 + 0x552788]
add ecx, 8
dec esi
mov eax, edi
jne 0x479040
pop ebx
test edx, edx
je 0x4790f8
lea esp, [esp]
movzx edi, byte [ecx]
mov esi, eax
shr esi, 0x18
xor esi, edi
shl eax, 8
xor eax, dword [esi*4 + 0x551788]
inc ecx
dec edx
jne 0x4790e0
pop edi
pop esi
ret
Function at 0x481b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, eax
mov esi, ecx
cmp edi, 8
jl 0x481b8b
push 8
push 0x4c
call fcn.00481a30
sub edi, 8
add esp, 8
cmp edi, 8
jl 0x481b8b
push 8
push 0x41
call fcn.00481a30
sub edi, 8
add esp, 8
cmp edi, 8
jl 0x481b8b
push 8
push 0x4d
call fcn.00481a30
sub edi, 8
add esp, 8
cmp edi, 8
jl 0x481b8b
push 8
push 0x45
call fcn.00481a30
add esp, 8
sub edi, 8
cmp edi, 0x20
jl 0x481bdd
call fcn.0047f720
mov ebp, eax
xor ebx, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x481ba0
sub eax, edx
test eax, eax
jle 0x481bdd
lea ecx, [ecx]
cmp edi, 8
jl 0x481bdd
movsx eax, byte [ebx + ebp]
push 8
push eax
sub edi, 8
call fcn.00481a30
mov eax, ebp
add esp, 8
inc ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x481bd0
sub eax, edx
cmp ebx, eax
jl 0x481bb0
cmp edi, 1
jl 0x481cfa
mov dword [esp + 0x10], edi
lea ebx, [ebx]
mov ecx, dword [esi + 0xcba8]
mov edi, 1
mov dword [esp + 0x14], ecx
nop
cmp dword [esi + 0x130], 0
jne 0x481c9e
inc dword [esi + 0x12c]
mov dword [esi + 0x130], 8
mov eax, dword [esi + 0xcba4]
lea edx, [eax + eax*2]
add edx, edx
mov eax, dword [esi + edx*8 + 0x9ba0]
cmp eax, dword [esi + 0x128]
jne 0x481c8e
mov eax, dword [esi + 0xcba4]
mov ecx, dword [esi + 0x1c]
push ecx
mov ecx, dword [esi + 0x12c]
add ecx, dword [esi + 0x120]
lea edx, [eax + eax*2]
add edx, edx
lea eax, [esi + edx*8 + 0x9ba8]
push eax
push ecx
call fcn.004a6860
mov edx, dword [esi + 0x1c]
add dword [esi + 0x12c], edx
mov eax, dword [esi + 0x1c]
add eax, eax
add eax, eax
add eax, eax
add dword [esi + 0x128], eax
mov ecx, dword [esi + 0xcba4]
inc ecx
add esp, 0xc
and ecx, 0xff
mov dword [esi + 0xcba4], ecx
mov edx, dword [esi + 0x12c]
mov eax, dword [esi + 0x120]
mov byte [edx + eax], 0
mov eax, dword [esi + 0x130]
cmp edi, eax
jge 0x481caa
mov eax, edi
mov ebx, dword [esp + 0x14]
sub dword [esi + 0x130], eax
mov ebp, dword [esi + 0x12c]
add ebp, dword [esi + 0x120]
sub edi, eax
mov ecx, edi
sar ebx, cl
mov ecx, dword [esi + 0x130]
shl bl, cl
or byte [ebp], bl
add dword [esi + 0x128], eax
test edi, edi
jg 0x481c00
xor edx, edx
cmp dword [esi + 0x94], edx
sete dl
xor dword [esi + 0xcba8], edx
dec dword [esp + 0x10]
jne 0x481bf0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4839b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
jle 0x4839ea
mov edx, dword [esp + 8]
push ebx
push edi
mov edi, dword [esp + 0x14]
movzx eax, word [edx]
movzx ebx, byte [ecx + edi]
xor ebx, eax
and ebx, 0xff
shr ax, 8
xor ax, word [ebx*4 + 0x554250]
inc ecx
mov word [edx], ax
cmp ecx, esi
jl 0x4839c5
pop edi
pop ebx
pop esi
ret
Function at 0x494440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x26dc
call fcn.004aa1c0
mov eax, dword [0x570f20]
xor eax, esp
mov dword [esp + 0x26d8], eax
push ebx
mov ebx, dword [esp + 0x26f0]
push ebp
push esi
mov esi, dword [esp + 0x26ec]
push edi
mov edi, dword [esp + 0x26f4]
push 0x2400
lea eax, [esp + 0x2ec]
push 0
push eax
lea ebp, [esi + 0x134]
call fcn.004a6ff0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x8c]
push eax
push ebx
push edi
lea eax, [esp + 0x5c]
mov ecx, esi
call fcn.00494240
add esp, 0x20
cmp dword [esi + 0x50], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 0
jle 0x494550
lea ebx, [esp + 0x2e8]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ecx
lea ebx, [ebx]
xor edi, edi
cmp dword [esi + 0x4c], edi
jle 0x494521
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
nop
push ebx
push esi
mov eax, ebp
call fcn.00491470
add esp, 8
test eax, eax
jne 0x49450a
mov eax, dword [esp + 0x1c]
mov dword [eax], 0
add dword [esp + 0x1c], 4
inc edi
add ebx, 0x900
add ebp, 0x1484
cmp edi, dword [esi + 0x4c]
jl 0x4944f0
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
add dword [esp + 0x14], 8
inc eax
add ebp, 0x2908
add ebx, 0x1200
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x10], ebx
cmp eax, dword [esi + 0x50]
jl 0x4944e0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x7c]
push edx
lea eax, [esp + 0x2f0]
push eax
push esi
call fcn.004998c0
add esp, 0x10
cmp dword [esi + 0x9c], 0
jne 0x4945cf
cmp dword [esp + 0x28], 0
je 0x494589
cmp dword [esi + 0x80], 0
mov ecx, 1
je 0x49458c
mov ecx, dword [esi + 0x74]
mov edx, dword [esi + 0x78]
cmp ecx, edx
jge 0x4945a0
cmp eax, dword [esp + ecx*4 + 0x3c]
jle 0x49459e
inc ecx
cmp ecx, edx
jl 0x494593
cmp ecx, edx
mov edi, dword [esp + 0x18]
cmovg ecx, edx
test edi, edi
jle 0x4945c7
cmp edx, ecx
jle 0x4945bf
nop
mov ebx, dword [esp + edx*4 + 0x3c]
sub ebx, eax
cmp ebx, edi
jle 0x4945bf
dec edx
cmp edx, ecx
jg 0x4945b0
mov dword [esi + 0x14b08], edx
jmp 0x4945d9
mov dword [esi + 0x14b08], ecx
jmp 0x4945d9
mov dword [esi + 0x14b08], 0
mov ecx, dword [esi + 0x14b08]
cmp eax, dword [esp + ecx*4 + 0x3c]
jg 0x494663
lea edx, [esp + 0x18]
push edx
push esi
call fcn.004979d0
xor ebp, ebp
add esp, 8
cmp dword [esi + 0x50], ebp
jle 0x49463c
mov eax, dword [esi + 0x4c]
lea ecx, [esi + 0x134]
mov dword [esp + 0x10], ecx
xor edi, edi
test eax, eax
jle 0x494628
mov ebx, ecx
nop
push ebx
push esi
call fcn.00497b80
mov eax, dword [esi + 0x4c]
inc edi
add esp, 8
add ebx, 0x1484
cmp edi, eax
jl 0x494610
mov ecx, dword [esp + 0x10]
inc ebp
add ecx, 0x2908
mov dword [esp + 0x10], ecx
cmp ebp, dword [esi + 0x50]
jl 0x494607
mov eax, dword [esp + 0x18]
push eax
push esi
call fcn.00497ba0
mov ecx, dword [esp + 0x26f0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a7314
add esp, 0x26dc
ret
push 0x5586c8
push esi
call fcn.0047f600
add esp, 8
push 0xffffffffffffffff
call fcn.004ab80f
int3
Function at 0x4949d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x9d8
mov eax, dword [0x570f20]
xor eax, esp
mov dword [esp + 0x9d4], eax
mov ecx, dword [esp + 0x9e4]
mov eax, dword [esp + 0x9e0]
push ebx
push esi
mov esi, dword [esp + 0x9e4]
push edi
mov edi, dword [esp + 0x9f4]
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x34]
push edx
lea edx, [esp + 0x3c]
push edx
push ecx
xor ebx, ebx
push eax
mov dword [esp + 0x40], ebx
call fcn.00494680
xor edx, edx
add esp, 0x14
mov dword [esp + 0x10], edx
cmp dword [esi + 0x50], ebx
jle 0x494bc0
xorps xmm5, xmm5
push ebp
lea ebp, [esp + 0x38]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], ebp
cmp dword [esi + 0x14b14], 2
jne 0x494a5b
mov eax, edx
lea ecx, [esi + 0x134]
call fcn.00491150
xor edi, edi
cmp dword [esi + 0x4c], edi
jle 0x494b94
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], eax
lea ebx, [ebx + esi + 0x134]
jmp 0x494a84
mov ebp, dword [esp + 0x18]
cmp dword [ebx + 0x12b4], 2
je 0x494a97
movss xmm0, dword [esi + 0x14bb0]
jmp 0x494a9f
movss xmm0, dword [esi + 0x14bb4]
cvtps2pd xmm0, xmm0
subsd xmm0, xmm5
cvtpd2ps xmm0, xmm0
movss dword [esp + 0x2c], xmm0
fld dword [esp + 0x2c]
fmul qword [0x543660]
fld qword [0x4c5be0]
fxch st(1)
call fcn.004aabb0
fstp dword [esi + 0x14bac]
push ebx
mov ecx, esi
call fcn.004917b0
lea ecx, [esp + 0xe8]
push ecx
push esi
mov eax, ebx
call fcn.00491470
add esp, 0xc
test eax, eax
je 0x494b29
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x48]
push edx
push ebx
push eax
push esi
call fcn.0048aec0
add esp, 0x10
test eax, eax
jne 0x494b0b
mov ecx, dword [esp + 0x34]
mov dword [ebp], ecx
mov edx, dword [ebp]
push edx
lea eax, [esp + 0xe8]
push eax
lea ecx, [esp + 0x50]
push ecx
push esi
mov ecx, edi
mov edx, ebx
call fcn.004932a0
add esp, 0x10
mov edx, dword [esp + 0x10]
lea eax, [esi + 0x134]
push eax
mov eax, dword [esp + 0x18]
push edi
push eax
push esi
lea ebp, [edx + esi + 0x134]
call fcn.00496960
add esp, 0x10
cmp dword [esi + 0x28], 1
jne 0x494b5a
push ebp
push esi
call fcn.004959c0
add esp, 8
push ebp
push esi
call fcn.00497b80
add dword [esp + 0x2c], 0x1e8
add dword [esp + 0x20], 4
add dword [esp + 0x18], 0x1484
xorps xmm5, xmm5
inc edi
add esp, 8
add ebx, 0x1484
cmp edi, dword [esi + 0x4c]
jl 0x494a80
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x28]
add dword [esp + 0x1c], 0x3d0
inc edx
add ebp, 8
add ebx, 0x2908
mov dword [esp + 0x14], edx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x20], ebx
cmp edx, dword [esi + 0x50]
jl 0x494a45
pop ebp
mov eax, dword [esi + 0x74]
mov dword [esi + 0x14b08], eax
cmp eax, dword [esi + 0x78]
jg 0x494bf3
mov edi, edi
lea ecx, [esp + 0x2c]
push ecx
push esi
call fcn.004979d0
add esp, 8
test eax, eax
jns 0x494bf3
inc dword [esi + 0x14b08]
mov edx, dword [esi + 0x14b08]
cmp edx, dword [esi + 0x78]
jle 0x494bd0
mov eax, dword [esp + 0x2c]
push eax
push esi
call fcn.00497ba0
mov ecx, dword [esp + 0x9e8]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a7314
add esp, 0x9d8
ret
Function at 0x4a7314
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x570f20]
jne 0x4a731e
repz ret
jmp fcn.004b0b5f

Function at 0x4be091
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x570f20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004b1a5e
and dword [ebp - 0x14], 0
cmp dword [0x6d7104], 0
mov dword [ebp - 0x18], eax
jne 0x4be144
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4be1ec
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4be1ec
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x6d7104], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x6d7108], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x6d710c], eax
call edi
push eax
call esi
mov dword [0x6d7114], eax
test eax, eax
je 0x4be144
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x6d7110], eax
mov eax, dword [0x6d7110]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4be19d
cmp dword [0x6d7114], ecx
je 0x4be19d
push eax
call esi
push dword [0x6d7114]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4be19d
test ebx, ebx
je 0x4be19d
call edi
test eax, eax
je 0x4be194
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4be194
test byte [ebp - 8], 1
jne 0x4be19d
or dword [ebp + 0x10], 0x200000
jmp 0x4be1d0
mov eax, dword [0x6d7108]
cmp eax, dword [ebp - 0x18]
je 0x4be1d0
push eax
call esi
test eax, eax
je 0x4be1d0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4be1d0
mov eax, dword [0x6d710c]
cmp eax, dword [ebp - 0x18]
je 0x4be1d0
push eax
call esi
test eax, eax
je 0x4be1d0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x6d7104]
call esi
test eax, eax
je 0x4be1ec
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4be1ee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a7314
leave
ret
Function at 0x4032f5
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x218
mov ebx, dword [esp + 0x234]
mov edi, dword [esp + 0x230]
mov esi, ebx
and esi, 0x300
lea eax, [esi + 9]
mov ecx, esp
push ecx
push eax
push edi
push dword [esp + 0x238]
call fcn.00407640
test eax, eax
jne 0x4033e4
mov dword [esp + 4], esi
test bl, 2
je 0x403370
xor eax, eax
lea ecx, [esp + 8]
mov dword [ecx], eax
mov edx, dword [esp]
sub esp, 0x20
xorps xmm0, xmm0
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x2e]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4033c6
lea ebp, [esp + 0xe]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x105
push ebp
push 0
push dword [esp + 0xc]
call esi
test eax, eax
jne 0x4033a0
test bl, 1
jne 0x4033c6
push ebx
push ebp
push dword [esp + 8]
call fcn.004032f5
test eax, eax
je 0x40337a
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040679c
test eax, eax
je 0x4033d6
push 0
push dword [esp + 8]
push edi
push dword [esp + 0x238]
call eax
jmp 0x4033e4
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x4033e4
push edi
push dword [esp + 0x230]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x218
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x406710
Capabilities:
Create directory

Disassembly:
push esi
sub esp, 0x20
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0xc]
mov dword [ecx], 0x40001
mov edx, 0x40a714
mov dword [ecx + 4], edx
mov dword [ecx + 8], edx
xor esi, esi
mov dword [ecx + 0xc], esi
mov dword [ecx + 0x10], 0x40a704
mov edx, esp
mov dword [edx], 0xc
mov dword [edx + 4], ecx
mov dword [edx + 8], esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40675b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
add esp, 0x20
pop esi
ret 4

Function at 0x4067d5
Capabilities:
Create process on windows

Disassembly:
push esi
sub esp, 0x38
mov eax, dword [esp + 0x40]
mov dword [0x43c658], 0x44
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], ecx
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x40a6d0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], esi
mov dword [esp + 0x20], 0x43c658
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
je 0x406835
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov esi, dword [esp + 0x28]
mov eax, esi
add esp, 0x38
pop esi
ret 4

Function at 0x40683e
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x4068ea
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
push ebx
call fcn.0040693b
xor esi, esi
cmp eax, 0xffffffff
je 0x406932
mov edi, eax
mov eax, dword [esp + 0x18]
mov ebp, eax
test al, 1
jne 0x406914
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40691b
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406924
xor esi, esi
inc esi
jmp 0x406932
mov eax, ebp
test al, 4
jne 0x406932
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0x40693b
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push edi
push esi
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
je 0x40695c
mov eax, esi
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
pop edi
ret 4