joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444150
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x485643
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004780d9
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0047d775
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047ed88
test eax, eax
je 0x44426c
mov ecx, dword [esp + 0x3c]
call fcn.0047d7a2
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x444230
push edi
mov ecx, esi
call fcn.0047ae04
mov ecx, esi
call fcn.00444420
cmp dword [esp + 0x38], 1
jne 0x444265
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047af3f
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x446470
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4464a3
push esi
call fcn.00454820
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44649c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x446529
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x446512
mov eax, dword [esi + 8]
test eax, eax
je 0x4464c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44650e
cmp eax, 2
je 0x446512
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4464ba
cmp eax, 3
je 0x4464ed
cmp eax, 1
jne 0x4464ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4464ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4464ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00446550
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x446538
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00446550
add esp, 4
pop esi
ret

Function at 0x446dc0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x446de1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x446de1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x446de1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x461340
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x4613a6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x4613a6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x461387
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x461ee0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00462030
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x461f00
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x461ee1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00462030
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x461f00
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x461f30
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x461f87
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x461f9d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00461fc0
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x461fc0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x462050
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x462099
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x462510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x485bc0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004620c0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00462140
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00462140
lea ecx, [esi + 0xc]
call fcn.00476ab3
lea ecx, [esi + 0x10]
call fcn.00476ab3
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00464970
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00464970
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00464970
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00476b28
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00476b28
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4631b8
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x485de8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4631c8
call fcn.004636e0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4632ab
cmp byte [edi], 0
je 0x4632ab
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4631ed
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00461ee0
test eax, eax
jne 0x46320d
push 0x4ab7b4
lea ecx, [esi + 0x38]
call fcn.00476c65
jmp 0x4632ab
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00461f30
test eax, eax
jne 0x46323c
mov ecx, esi
call fcn.00462030
push edi
add esi, 0x38
push 0x4ab790
push esi
call fcn.00474a87
add esp, 0xc
jmp 0x4632ab
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00463f60
test eax, eax
je 0x4632a4
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00463380
test eax, eax
jne 0x4632c0
push edi
lea eax, [esi + 0x38]
push 0x4ab76c
push eax
call fcn.00474a87
add esp, 0xc
mov ecx, esi
call fcn.004636e0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x463368
mov ecx, dword [0x4aba24]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00474a87
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00461fe0
test eax, eax
jne 0x46332a
push 0x4ab750
lea ecx, [esi + 0x38]
call fcn.00476c65
jmp 0x46333a
push 0xfa
mov ecx, esi
call fcn.00463f60
test eax, eax
jne 0x463357
mov ecx, esi
call fcn.004636e0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00476b28
jmp 0x4632ab
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.00476b28
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x478ecf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x478f07
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00476f83
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00476f5b
jmp 0x478f13
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47a5c1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47a603
call fcn.004807f5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47a603
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47a5fa
xor eax, eax
jmp 0x47a60b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047a611
pop edi
pop esi
pop ebx
ret 4

Function at 0x480d25
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x480d53
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x480d71
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00480c8b
jmp 0x480d71
mov eax, dword [esi + 0x14]
test eax, eax
je 0x480d71
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00480c8b
test edi, edi
mov eax, edi
jne 0x480d5b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4036f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [edi + 0xf4]
push ebx
push esi
push edi
push fcn.00403a20
add ecx, 0x8c
mov dword [edi], 0x49ad54
call sym.SH7zInstaller.exe__Disconnect___CSHSignelWatcherT_VCSHActiveSignalArgs_shui___shui__QAEXP8CSHWidget_2_AEXPAV32_AAVCSHActiveSig
mov ecx, dword [edi + 0xfc]
push edi
push 0x403cc0
add ecx, 0x8c
call sym.SH7zInstaller.exe__Disconnect___CSHSignelWatcherT_VCSHActiveSignalArgs_shui___shui__QAEXP8CSHWidget_2_AEXPAV32_AAVCSHActiveSig
mov ecx, dword [edi + 0x10c]
push edi
push 0x4068f0
add ecx, 0x8c
call sym.SH7zInstaller.exe__Disconnect___CSHSignelWatcherT_VCSHActiveSignalArgs_shui___shui__QAEXP8CSHWidget_2_AEXPAV32_AAVCSHActiveSig
mov ecx, dword [edi + 0xf8]
push edi
push fcn.00406910
add ecx, 0x8c
call sym.SH7zInstaller.exe__Disconnect___CSHSignelWatcherT_VCSHActiveSignalArgs_shui___shui__QAEXP8CSHWidget_2_AEXPAV32_AAVCSHActiveSig
mov ecx, dword [edi + 0x110]
push edi
push 0x408f80
add ecx, 0x8c
call sym.SH7zInstaller.exe__Disconnect___CSHSignelWatcherT_VCSHActiveSignalArgs_shui___shui__QAEXP8CSHWidget_2_AEXPAV32_AAVCSHActiveSig
mov ebx, 8
cmp dword [edi + 0x17c], ebx
jb 0x403786
mov eax, dword [edi + 0x168]
jmp 0x40378c
lea eax, [edi + 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [edi + 0x1b8]
call fcn.0040b580
cmp dword [edi + 0x1b4], ebx
jb 0x4037b5
mov eax, dword [edi + 0x1a0]
push eax
call fcn.0046202e
add esp, 4
xor esi, esi
mov ebx, 7
xor ecx, ecx
mov dword [edi + 0x1b4], ebx
mov dword [edi + 0x1b0], esi
mov word [edi + 0x1a0], cx
cmp dword [edi + 0x198], 8
jb 0x4037e9
mov edx, dword [edi + 0x184]
push edx
call fcn.0046202e
add esp, 4
xor eax, eax
mov dword [edi + 0x198], ebx
mov dword [edi + 0x194], esi
mov word [edi + 0x184], ax
cmp dword [edi + 0x17c], 8
jb 0x403816
mov ecx, dword [edi + 0x168]
push ecx
call fcn.0046202e
add esp, 4
xor edx, edx
mov dword [edi + 0x17c], ebx
mov dword [edi + 0x178], esi
mov ecx, edi
mov word [edi + 0x168], dx
call sym.SH7zInstaller.exe_public_virtual:_void___thiscall_shui::CShNormalFrame::destructor_void_
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406630
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x498e9c
push 0xa8
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x406676
xor eax, eax
jmp 0x4067a1
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40666f
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.00464770
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x14]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4066d0
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x12], 0x5c
jne 0x406709
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4066f0
sub eax, edx
sar eax, 1
mov ecx, 0x5c30
mov word [esp + eax*2 + 0x12], cx
lea edx, [esp + 0x14]
push 0
push edx
call fcn.0046272a
add esp, 8
test eax, eax
je 0x406729
push 0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x498eac
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.004629a6
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406780
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ebx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x406784
xor eax, eax
jmp 0x4067a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add ebp, 0x164
push ebp
lea eax, [esp + 0x18]
call fcn.0040a0b0
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00462039
add esp, 0x210
ret 4
Function at 0x408500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4746e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x1c], 7
mov dword [esp + 0x18], ecx
mov word [esp + 8], dx
push 0xffffffffffffffff
mov dword [esp + 0x30], ecx
push ecx
add eax, 0x180
lea ecx, [esp + 0xc]
call fcn.0040a460
push 0x19
mov eax, 0x499ef0
lea ecx, [esp + 8]
call fcn.0040a380
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.0040ee60
add esp, 4
cmp dword [esp + 0x1c], 8
jb 0x40858f
mov ecx, dword [esp + 8]
push ecx
call fcn.0046202e
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00462039
add esp, 0x2c
ret 4

Function at 0x4085c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x473c90
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x78], eax
push esi
push edi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [esp + 0x98]
xor edi, edi
mov dword [esp + 0x90], edi
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0x70], cx
add eax, 0x180
push edi
lea ecx, [esp + 0x70]
mov dword [esp + 0x88], 7
mov dword [esp + 0x84], edi
call fcn.0040a460
push 0xd
mov eax, 0x499d5c
lea ecx, [esp + 0x6c]
mov byte [esp + 0x94], 1
call fcn.0040a380
cmp dword [esp + 0xb0], edi
jbe 0x408673
push 2
mov eax, 0x499f24
lea ecx, [esp + 0x6c]
call fcn.0040a380
push edi
lea edx, [esp + 0xa0]
push edx
or eax, 0xffffffff
lea esi, [esp + 0x70]
call fcn.0040a2c0
push 0x40
lea eax, [esp + 0x24]
push edi
push eax
call fcn.00464770
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x80], 8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], edi
mov dword [esp + 0x1c], 0x44
jae 0x4086af
lea eax, [esp + 0x6c]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x20]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x4086d8
push eax
call esi
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x4086f3
push 0xbb8
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [esp + 0xc]
push eax
call esi
cmp dword [esp + 0x80], 8
jb 0x40870a
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0046202e
add esp, 4
xor edx, edx
cmp dword [esp + 0xb4], 8
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], edi
mov word [esp + 0x6c], dx
jb 0x40873a
mov eax, dword [esp + 0xa0]
push eax
call fcn.0046202e
add esp, 4
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.00462039
add esp, 0x88
ret 0x20
Function at 0x40b0e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x474478
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4c60a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.0040a460
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x40b136
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.0040a380
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.0040a460
cmp dword [esp + 0x24], 8
jb 0x40b17f
mov edx, dword [esp + 0x10]
push edx
call fcn.0046202e
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret

Function at 0x40b850
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x210], eax
lea eax, [esp]
push eax
push 0xf003f
push 0
push 0x49b288
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b925
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x12]
push edx
mov word [esp + 0x14], cx
call fcn.00464770
mov edx, dword [esp + 0xc]
add esp, 0xc
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 0x49b2c0
push edx
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b91b
push esi
push edi
lea edi, [esp + 0x10]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40b8d4
lea eax, [esp + 0x10]
push 0
mov ecx, 9
mov esi, 0x49b2d8
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0046272a
add esp, 8
pop edi
pop esi
test eax, eax
jne 0x40b91b
mov eax, 1
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00462039
add esp, 0x214
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
xor eax, eax
call fcn.00462039
add esp, 0x214
ret
Function at 0x40c330
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x4c60a0]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x218]
push esi
lea edx, [esp + 4]
push edx
push 0xf003f
xor esi, esi
push esi
push ecx
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40c3c2
cmp dword [esp + 0x220], esi
je 0x40c3b2
push 0x206
lea ecx, [esp + 0x12]
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.00464770
mov ecx, dword [esp + 0x10]
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
push esi
push esi
push 0x49a178
push ecx
mov dword [esp + 0x20], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40c3b7
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00462039
add esp, 0x214
ret 8