joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6500
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, 0x20
push esi
push edi
lea esi, [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x8c]
test esi, esi
je 0x4c66c6
cmp dword [esi + 0x208], 0
je 0x4c66c6
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4c66b2
mov edi, dword [ebp - 0x24]
test edi, edi
js 0x4c66b2
movzx edx, word [esi + 0x234]
lea ecx, [edi + 1]
imul ecx, edx
push ebx
xor ebx, ebx
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 9], bl
call fcn.004a8f05
push dword [ebp - 0x20]
mov dword [esi + 0x210], eax
push ebx
push eax
call fcn.004a35f0
add esp, 0x10
cmp dword [ebp - 0x20], ebx
jbe 0x4c665f
nop
cmp byte [0x51f324], 1
je 0x4c669d
test edi, edi
js 0x4c6696
movzx eax, word [esi + 0x234]
shr eax, 2
imul eax, dword [esi + 0x214]
cmp edi, eax
jle 0x4c65db
push str.SAT_index_out_of_bounds.
call fcn.004076b0
add esp, 4
mov byte [ebp - 9], 1
push 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [ebp - 9], 0
jne 0x4c6608
mov eax, dword [esi + 0x208]
mov ecx, dword [eax + edi*4]
movzx eax, word [esi + 0x234]
inc ecx
imul ecx, eax
mov dword [ebp - 0x14], ecx
movzx eax, word [esi + 0x234]
mov ecx, dword [ebp - 0x20]
add eax, ebx
cmp eax, ecx
jbe 0x4c6621
mov eax, ecx
sub eax, ebx
mov dword [ebp - 0x10], eax
jmp 0x4c6624
mov eax, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
mov eax, dword [esi + 0x210]
add eax, ebx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
add ebx, eax
cmp eax, dword [ebp - 0x10]
jb 0x4c6674
cmp byte [ebp - 9], 1
je 0x4c6681
mov eax, dword [esi + 0x208]
mov edi, dword [eax + edi*4]
cmp ebx, dword [ebp - 0x20]
jb 0x4c65a0
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x88
push str.Premature_end_of_file_encountered_while_building_the_short_stream_container.
call fcn.004076b0
add esp, 4
pop ebx
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x88
push str.Invalid_SAT_termination_index.
jmp 0x4c6679
pop ebx
pop edi
mov al, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x88
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x88
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x88
Function at 0x4c75d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x4c761e
mov edx, esi
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4c75e0
sub edx, ecx
xor ecx, ecx
sar edx, 1
dec edx
test edx, edx
jle 0x4c761e
nop word [eax + eax]
mov ax, word [esi + edx*2]
xor word [esi + ecx*2], ax
movzx eax, word [esi + ecx*2]
xor word [esi + edx*2], ax
movzx eax, word [esi + edx*2]
dec edx
xor word [esi + ecx*2], ax
inc ecx
cmp ecx, edx
jl 0x4c7600
pop esi
ret

Function at 0x4c7bb0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x40], 8
lea eax, [esi + 0x2c]
jb 0x4c7bd1
mov eax, dword [eax]
push 0x4fcb64
push eax
lea eax, [ebp - 0x20c]
push str._s_s_
push eax
call fcn.00407e80
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c7c0b
lea eax, [ebp - 0x20c]
push eax
call fcn.0049e156
add esp, 4
lea ecx, [ebp - 0x20c]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4c7c14
mov eax, dword [str.Config.ini]
mov dword [ecx], eax
mov eax, dword [0x4fdabc]
mov dword [ecx + 4], eax
mov eax, dword [0x4fdac0]
mov dword [ecx + 8], eax
mov eax, dword [0x4fdac4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4fdac8]
mov dword [ecx + 0x10], eax
mov ax, word [0x4fdacc]
mov word [ecx + 0x14], ax
cmp word [ebp - 0x20c], 0
jne 0x4c7c5f
xor ecx, ecx
jmp 0x4c7c7f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c7c70
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x1b0]
call fcn.00403330
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00499a52
mov esp, ebp
pop ebp
ret
Function at 0x4c8260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0xc]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push ecx
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
push ecx
push eax
push ebx
push 0x80000002
mov byte [ebp - 0xd], 0
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4c8335
push edi
push dword [ebp - 0xc]
call fcn.004a8f05
push dword [ebp - 0xc]
mov edi, eax
push 0
push edi
call fcn.004a35f0
add esp, 0x10
mov dword [ebp - 8], 1
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
push ebx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test edi, edi
je 0x4c831f
mov bl, 1
mov eax, edi
sub esi, edi
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [esi + eax - 2], cx
test cx, cx
jne 0x4c82f1
push edi
call fcn.004a51e5
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0xd]
xor ecx, ebp
pop esi
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ca420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7335
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x238]
push eax
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0x4fdb3c
mov dword [ebp - 0x228], 0x51
mov dword [ebp - 0x224], 0x4ca560
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
test eax, eax
je 0x4ca536
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4ca536
mov dword [ebp - 0x23c], 0
mov dword [ebp - 4], 1
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
mov ecx, dword [esi]
call fcn.004cd2c0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x23c]
test ecx, ecx
je 0x4ca51c
mov edx, dword [ecx]
lea eax, [ebp - 0x260]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x23c], 0
push 1
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 4
Function at 0x4cfb70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0x400000
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push edi
push eax
call fcn.004a2a80
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [ebp - 8]
call fcn.0040f720
mov ecx, dword [ebp - 8]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret
Function at 0x4d2040
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8bb6
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x18]
call fcn.004d4480
test al, al
jne 0x4d21a3
push 0x14
call fcn.00499a63
mov esi, eax
add esp, 4
mov dword [ebp - 0x138], esi
mov byte [ebp - 4], 2
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x10], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x20]
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.004d4180
test al, al
jne 0x4d21a5
push 0x110
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.004a35f0
add esp, 0xc
mov dword [ebp - 0x134], 0x114
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x130]
cmp eax, 6
jb 0x4d214b
jne 0x4d2144
cmp dword [ebp - 0x12c], 0
je 0x4d214b
mov ecx, 0x100
jmp 0x4d2150
mov ecx, 0x60
mov edx, dword [ebp - 0x20]
mov eax, ecx
mov dword [ebp - 0x13c], ecx
cmp ecx, edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x138], eax
jge 0x4d216c
cmp eax, ecx
jl 0x4d219b
test edx, edx
je 0x4d2187
test ecx, ecx
je 0x4d2187
lea eax, [ebp - 0x20]
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.004d3e60
test al, al
je 0x4d219b
jmp 0x4d21a5
lea eax, [ebp - 0x13c]
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.004d3e60
test al, al
jne 0x4d21a5
push ecx
mov ecx, esi
call fcn.00407f20
xor esi, esi
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4d21b9
push ecx
call fcn.00413460
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x18]
call fcn.004a51e5
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d3190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8f43
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x51b08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0x10]
mov dword [edi + 8], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0xc], eax
call fcn.004072c0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x58]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 0
mov byte [ecx + 0x14], 1
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
push dword [ebp + 8]
call fcn.00412ff0
cmp byte [ebp + 0xc], 0
je 0x4d3229
mov ecx, edi
call fcn.004d25a0
lea eax, [edi + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [edi + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push edi
push 0x4d27b0
push 0
push 0
mov dword [edi + 0xac], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0xa8], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x4da990
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9e3f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x51b08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.CoreUI.dll_public:_void___thiscall_UiLib::WindowImplBase::constructor_void_]
mov dword [ebp - 4], 0
lea edi, [ebx + 0x860]
mov dword [edi], method.TiXmlBase.virtual_4
lea eax, [ebx + 0x868]
mov dword [ebx], 0x501398
mov dword [ebx + 0x30], 0x501498
mov dword [ebx + 0x40], 0x5007f4
mov dword [ebx + 0x44], 0x5001d0
mov dword [ebx + 0x48], 0x5007f8
mov dword [edi], 0x5001cc
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x88c], 0
mov byte [ebp - 4], 2
lea eax, [ebx + 0x890]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x8b4], 0
mov byte [ebp - 4], 4
lea eax, [ebx + 0x8b8]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x8dc], 0
mov byte [ebp - 4], 6
lea eax, [ebx + 0x8e0]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x904], 0
mov byte [ebp - 4], 8
lea eax, [ebx + 0x908]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x92c], 0
mov byte [ebp - 4], 0xa
lea eax, [ebx + 0x930]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x954], 0
mov byte [ebp - 4], 0xc
lea esi, [ebx + 0x9c4]
mov byte [ebx + 0x958], 0
mov dword [ebx + 0x964], 0
mov dword [ebx + 0x968], 0
mov dword [ebx + 0x96c], 0
mov dword [ebx + 0x970], 0
mov dword [ebx + 0x974], 0
mov dword [ebx + 0x978], 0
mov dword [ebx + 0x97c], 0
mov dword [ebx + 0x980], 0
mov dword [ebx + 0x984], 0
mov dword [ebx + 0x988], 0
mov dword [ebx + 0x98c], 0
mov dword [ebx + 0x990], 0
mov dword [ebx + 0x994], 0
mov dword [ebx + 0x998], 0
mov dword [ebx + 0x99c], 0
mov dword [ebx + 0x9a0], 0
mov dword [ebx + 0x9a4], 0
mov dword [ebx + 0x9a8], 0
mov dword [ebx + 0x9ac], 0
mov dword [ebx + 0x9b0], 0
mov dword [ebx + 0x9b4], 0
mov dword [ebx + 0x9b8], 0
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414410
mov dword [esi], eax
mov byte [ebp - 4], 0xf
lea esi, [ebx + 0x9cc]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414410
mov dword [esi], eax
mov byte [ebp - 4], 0x12
lea esi, [ebx + 0x9d4]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414410
mov dword [esi], eax
mov byte [ebp - 4], 0x15
lea esi, [ebx + 0x9dc]
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00414410
mov dword [esi], eax
mov byte [ebp - 4], 0x18
xor eax, eax
mov dword [ebx + 0x9f8], 7
mov dword [ebx + 0x9f4], 0
mov word [ebx + 0x9e4], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebx + 0x4c]
push edi
call dword [sym.imp.CoreUI.dll_public:_bool___thiscall_UiLib::CPaintManagerUI::AddTranslateAccelerator_class_UiLib::ITranslateAccelerator__]
push 0xb
push str.normal_skin
lea ecx, [ebx + 0x9e4]
call fcn.00403330
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4dee40
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp ebx, 6
jne 0x4dee71
push 3
push 0x4fb700
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [edi]
test eax, eax
je 0x4def23
cmp dword [eax], 0
je 0x4def23
xorps xmm0, xmm0
mov dword [ebp - 0x10], 0xc
movq qword [ebp - 0xc], xmm0
lea edx, [ebp - 0x10]
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 1
mov eax, dword [eax]
push 0
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x4deeba
cmp eax, 0x80004001
jne 0x4def23
cmp ebx, 6
jne 0x4deec8
push 0
push 0x4fe070
jmp 0x4deed3
cmp dword [esi + 0x14], 8
jb 0x4deed0
mov esi, dword [esi]
push 0
push esi
mov eax, dword [edi]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
test eax, eax
js 0x4def23
mov eax, dword [edi]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x14], ebx
push 0
mov eax, dword [eax]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x4def23
mov eax, dword [edi]
push 7
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
pop edi
test eax, eax
pop esi
setns al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00499a52
mov esp, ebp
pop ebp
ret 8
Function at 0x4df020
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea2cb
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x51b08c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x2a], 0
jne 0x4df190
nop word [eax + eax]
cmp byte [esi + 0x28], 0
je 0x4df17e
lea ebx, [esi + 0x2c]
mov dword [ebp - 0x42c], ebx
mov ecx, ebx
mov eax, dword [ebx]
mov byte [ebp - 0x428], 0
call dword [eax]
mov byte [ebp - 0x428], 1
mov dword [ebp - 4], 0
cmp dword [esi + 0x20], 0
jne 0x4df098
xor edi, edi
jmp 0x4df0a3
cmp dword [esi + 0x24], 8
lea edi, [esi + 0x10]
jb 0x4df0a3
mov edi, dword [edi]
mov dword [ebp - 4], 0xffffffff
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax + 4]
test edi, edi
je 0x4df186
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.004ad703
add esp, 0x14
mov dword [ebp - 0x18], 0x5c
push 3
push 0
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x424], eax
cmp eax, 0xffffffff
jne 0x4df10d
call ebx
push eax
push str.Error_Code_:__d_n
call fcn.00414a40
add esp, 8
mov byte [esi + 0x29], 0
cmp byte [esi + 0x29], 0
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x420], eax
je 0x4df17e
nop dword [eax]
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x424]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x4df178
push str.__________________
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push 0x2b11
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
test eax, eax
jne 0x4df178
call ebx
push eax
push str.Error_Code_:__d_n
call fcn.00414a40
add esp, 8
mov byte [esi + 0x29], 0
cmp byte [esi + 0x29], 0
jne 0x4df120
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x2a], 0
je 0x4df060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00499a52
mov esp, ebp
pop ebp
ret
Function at 0x4df410
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea375
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x51b08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
xor eax, eax
mov dword [edi + 4], 0
mov dword [edi + 0x24], 7
mov dword [edi + 0x20], 0
mov dword [ebp - 0x14], edi
mov word [edi + 0x10], ax
mov dword [ebp - 4], eax
lea esi, [edi + 0x2c]
mov word [edi + 0x28], ax
mov byte [edi + 0x2a], al
mov dword [ebp - 0x10], esi
mov dword [esi], method.TiXmlBase.virtual_4
mov byte [ebp - 4], 1
mov dword [esi], 0x5021c0
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 4], eax
mov byte [ebp - 4], 2
push 0
push 0
push edi
push 0x4df1b0
push 0
push 0
call fcn.004ad8ba
add esp, 0x18
mov dword [edi + 8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0xc], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e1580
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ea62d
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x51b08c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
lea ecx, [eax + 0x5c]
xor edx, edx
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
mov word [ecx], dx
mov dword [ebp - 4], edx
lea ebx, [eax + 0x74]
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], edx
mov word [ebx], dx
mov byte [ebp - 4], 1
lea edi, [eax + 0x8c]
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], edx
mov word [edi], dx
mov byte [ebp - 4], 2
lea esi, [eax + 0xa4]
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], edx
mov word [esi], dx
mov byte [ebp - 4], 3
push edx
push 0x4fb700
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], edx
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
mov dword [eax + 0x38], edx
mov dword [eax + 0x3c], edx
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
call fcn.00403330
push 0
push 0x4fb700
mov ecx, ebx
call fcn.00403330
push 0
push 0x4fb700
mov ecx, edi
call fcn.00403330
push 0
push 0x4fb700
mov ecx, esi
call fcn.00403330
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..retplne
mov ebx, 0x40de38
nop
mov ecx, 0x2c21073c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x429d5ba9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219