joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402360
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x513b94]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
test edi, edi
je 0x402401
mov edx, dword [ebp + 0xc]
lea eax, [edx - 1]
test eax, eax
jne 0x402401
cmp edx, 1
jne 0x4023f0
push esi
push 0x110
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.004a3e00
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4023e0
mov eax, dword [ebp - 0x114]
cmp eax, 6
ja 0x4023db
cmp eax, 6
jne 0x4023e0
cmp dword [ebp - 0x110], esi
jbe 0x4023e0
mov esi, 1
shl esi, 0xb
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, eax
pop esi
mov eax, ecx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a0e13
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004a0e13
mov esp, ebp
pop ebp
ret
Function at 0x404620
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x101
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40468d
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4dce84
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40468d
xor eax, eax
cmp dword [ebp - 8], eax
setne al
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x404de0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
test edi, edi
je 0x404dfa
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x404e2c
push 0x4dcea0
push 1
push 0x4dceb4
call fcn.00402360
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x404e98
mov edi, 0x517d48
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
mov ebx, eax
xor esi, esi
cmp dword [edi], esi
jle 0x404e98
push 0x4dcecc
push dword [ebx + esi*4]
call fcn.004a8747
add esp, 8
test eax, eax
je 0x404e66
push 0x4dcee4
push dword [ebx + esi*4]
call fcn.004a8747
add esp, 8
test eax, eax
je 0x404e66
xor ecx, ecx
inc esi
mov dword [ebp - 4], ecx
cmp esi, dword [edi]
jl 0x404e32
jmp 0x404e9a
mov edx, dword [edi]
mov ecx, 1
mov dword [ebp - 4], ecx
lea eax, [edx - 1]
cmp esi, eax
jge 0x404e91
mov dword [ebp - 4], ecx
nop word [eax + eax]
mov eax, dword [ebx + esi*4 + 4]
mov dword [ebx + esi*4], eax
inc esi
mov edx, dword [edi]
lea eax, [edx - 1]
cmp esi, eax
jl 0x404e80
lea eax, [edx - 1]
mov dword [edi], eax
jmp 0x404e9a
xor ecx, ecx
push ecx
push dword [ebp + 8]
call fcn.00404990
mov ecx, dword [ebp - 4]
add esp, 8
test eax, eax
mov edx, 1
cmovne ecx, edx
xor eax, eax
pop edi
test ecx, ecx
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407aa0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
ret
Function at 0x4083a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cbcbe
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x513b94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
call fcn.00407970
mov ecx, eax
test ecx, ecx
je 0x4084a3
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
mov edi, dword [edi]
mov ebx, 1
mov ecx, ebx
mov dword [ebp - 4], 0
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
add eax, 0xffffff80
mov dword [ebp - 0x10], 1
or ecx, eax
jge 0x408422
push 0x80
mov ecx, esi
call fcn.00407ff0
mov ecx, dword [esi]
cmp dword [ecx - 8], 0x80
jl 0x408499
push edi
push 0x80
push ecx
push dword [ebp + 0x14]
mov dword [ecx - 0xc], 0x80
xor edx, edx
mov eax, dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov word [eax + 0x100], dx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
js 0x408499
mov ecx, dword [esi]
sub ebx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, edi
or ebx, ecx
jge 0x408471
push edi
mov ecx, esi
call fcn.00407ff0
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x408499
mov dword [eax - 0xc], edi
xor eax, eax
mov ecx, dword [esi]
mov word [ecx + edi*2], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80070057
call fcn.004075e0
push 0x80004005
call fcn.004075e0
int3

Function at 0x408970
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4089cb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4089cb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4089ba
cmp esi, edx
jae 0x4089cb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4089a8
cmp esi, edx
jae 0x4089cb
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40f800
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc19d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x513b94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004a0e21
mov edi, eax
add esp, 4
test edi, edi
je 0x40f89d
push 1
mov dword [ebp - 4], 0
call fcn.004a30e0
add esp, 4
mov dword [edi + 4], eax
jmp 0x40f89f
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
call fcn.004058f0
add esp, 4
mov ecx, dword [eax]
push 0x20
mov edx, dword [ecx + 0x30]
mov ecx, eax
call edx
movzx ebx, ax
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x40f8fb
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
test eax, eax
je 0x40f8fb
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov word [esi + 0x40], bx
jne 0x40f918
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x40f93b
cmp byte [ebp + 0xc], 0
je 0x40f927
push esi
call fcn.004a36bb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x40f947
mov esi, 0x4dd2a8
jmp 0x40f957
test cl, 2
mov esi, 0x4dd2c0
mov eax, 0x4dd2d8
cmove esi, eax
lea eax, [ebp - 0x14]
push 1
push eax
call fcn.0040f980
add esp, 8
lea ecx, [ebp - 0x28]
push eax
push esi
call fcn.004064e0
push 0x5051c8
lea eax, [ebp - 0x28]
push eax
call fcn.004a423e
int3
Function at 0x410d70
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc285
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x513b94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [ebx + 1]
xor edx, eax
movzx eax, byte [ebx + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [ebx + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, edi
push eax
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.00410a80
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x410e03
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 8], 0x15555555
je 0x410f51
lea eax, [edi + 4]
mov dword [ebp - 0x14], eax
push 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.004a0e21
mov ecx, dword [ebx]
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov dword [esi + 8], ecx
mov eax, dword [edi + 8]
mov ebx, dword [edi + 0x1c]
inc eax
movss xmm3, dword [edi]
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4dde40]
mov eax, ebx
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x4dde40]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm3
jbe 0x410ef3
divss xmm2, xmm3
sub esp, 8
cvtps2pd xmm0, xmm2
movsd qword [ebp - 0x1c], xmm0
fld qword [ebp - 0x1c]
fstp qword [esp]
call fcn.004b4660
fstp qword [ebp - 0x1c]
movsd xmm0, qword [ebp - 0x1c]
add esp, 8
cvtpd2ps xmm0, xmm0
call fcn.004a1480
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp ebx, ecx
jae 0x410ed5
cmp ebx, 0x200
jae 0x410ed3
shl ebx, 3
cmp ebx, ecx
jae 0x410ed5
mov ebx, ecx
push ebx
mov ecx, edi
call fcn.00418b80
push dword [ebp + 0xc]
lea eax, [esi + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00410a80
mov edx, dword [eax]
jmp 0x410ef6
mov edx, dword [ebp - 0x1c]
mov ebx, dword [edx + 4]
inc dword [edi + 8]
mov dword [esi], edx
mov dword [esi + 4], ebx
mov dword [ebx], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 0x18]
and eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0xc]
mov esi, dword [ebp - 0x14]
mov edi, dword [ecx + eax*8]
cmp edi, dword [esi]
mov esi, dword [ebp - 0x10]
jne 0x410f21
mov dword [ecx + eax*8], esi
jmp 0x410f30
cmp edi, edx
jne 0x410f2a
mov dword [ecx + eax*8], esi
jmp 0x410f34
cmp dword [ecx + eax*8 + 4], ebx
jne 0x410f34
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x4dddf0
call fcn.004a2d75
int3
Function at 0x411200
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cc364
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x513b94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
call fcn.00407970
mov ecx, eax
test ecx, ecx
je 0x41137e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
call fcn.00407970
mov ecx, eax
test ecx, ecx
je 0x411388
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 4], eax
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
mov dword [edi + 8], 0xffffffff
mov dword [edi + 0xc], 0xffffffff
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x14], 0xffffffff
mov byte [edi + 0x18], 0
mov dword [edi + 0x1c], 0xffffffff
mov dword [edi + 0x20], 0xffffffff
mov dword [edi + 0x24], 0xffffffff
mov dword [edi + 0x28], 0xffffffff
mov dword [edi + 0x2c], 0xffffffff
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0xffffffff
push 5
mov dword [edi + 0x38], 0xa0a0a
mov dword [edi + 0x3c], 0x232425
mov byte [edi + 0x40], 0
call esi
push 8
mov dword [edi + 0x44], eax
call esi
mov dword [edi + 0x48], eax
push 0xf
mov dword [edi + 0x4c], 0xffffffff
mov dword [edi + 0x50], 0xffffffff
call esi
push 8
mov dword [edi + 0x54], eax
call esi
push 0xf
mov dword [edi + 0x58], eax
call esi
push 8
mov dword [edi + 0x5c], eax
call esi
mov dword [edi + 0x60], eax
push 5
mov dword [edi + 0x64], 0x505050
mov dword [edi + 0x68], 0x808080
call esi
mov dword [edi + 0x6c], eax
mov dword [edi + 0x70], 0xc0c0c0
mov byte [edi + 0x74], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x84], 0
push 0x4113a0
push 0x411760
push 0x1f
push 4
lea eax, [edi + 0x88]
mov byte [ebp - 4], 5
push eax
call fcn.004a12ef
mov word [edi + 0x180], 1
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004075e0
push 0x80004005
call fcn.004075e0
int3

Function at 0x412960
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x4129dc
mov esi, dword [ebp + 8]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x412995
push edi
mov ecx, esi
call fcn.00407ff0
push edi
push dword [esi]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x4129bd
mov ecx, dword [esi]
test ecx, ecx
je 0x4129c1
push dword [ecx - 8]
push ecx
call fcn.004b4122
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x4129dc
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x4129dc
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.004075e0
int3
Function at 0x413db0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
sar eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
imul ecx, edx, 0x1000193
mov eax, ebx
sar eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
lea ecx, [edi + 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00410a80
mov eax, dword [eax + 4]
test eax, eax
jne 0x413e17
mov eax, dword [edi + 0xc]
mov edi, dword [edi + 0xc]
cmp eax, edi
jne 0x413e4d
mov esi, dword [edi]
cmp esi, edi
je 0x413e42
mov ebx, dword [sym.imp.USER32.dll_IsChild]
nop word [eax + eax]
push dword [ebp + 8]
push dword [esi + 8]
call ebx
test eax, eax
jne 0x413e4d
mov esi, dword [esi]
cmp esi, edi
jne 0x413e30
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4185c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x513b94]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
mov edi, ecx
mov dword [ebp - 0x1c], 0x17
push eax
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 1
lea eax, [ebp - 0x20]
push eax
push 2
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41861d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
inc eax
cmp ecx, eax
jge 0x41861d
mov ebx, 5
push ebx
jmp 0x418620
xor ebx, ebx
push ebx
push dword [edi + 0x24]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x3c], ebx
call esi
lea eax, [ebp - 0x20]
push eax
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetScrollInfo]
push 1
lea eax, [ebp - 0x20]
push eax
push 2
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x41866b
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
inc eax
cmp ecx, eax
jge 0x41866b
mov dword [ebp - 0x38], 5
push 5
jmp 0x418674
mov dword [ebp - 0x38], 0
push 0
push dword [edi + 0x28]
call esi
mov eax, dword [ebp + 8]
add eax, dword [ebp + 0xc]
jne 0x4186a1
lea eax, [ebp - 0x30]
xorps xmm0, xmm0
push eax
push dword [edi + 4]
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp + 0xc], eax
cmp ebx, 5
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
jne 0x4186e7
cmp dword [ebp - 0x38], 5
jne 0x4186bb
push 3
call ebx
mov dword [ebp - 0x34], eax
jmp 0x4186c2
mov dword [ebp - 0x34], 0
push 2
call ebx
push 2
mov esi, eax
call ebx
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp - 0x34]
mov edx, dword [ebp + 8]
push 1
push ecx
push esi
push 0
sub edx, eax
push edx
push dword [edi + 0x24]
call dword [sym.imp.USER32.dll_MoveWindow]
cmp dword [ebp - 0x38], 5
jne 0x418724
push 3
call ebx
cmp dword [ebp - 0x3c], 5
mov dword [ebp - 0x34], eax
jne 0x418702
push 2
call ebx
mov esi, eax
jmp 0x418704
xor esi, esi
push 3
call ebx
mov ecx, dword [ebp + 0xc]
push 1
push dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp + 8]
sub eax, esi
push eax
push ecx
push 0
push dword [edi + 0x28]
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a0e13
mov esp, ebp
pop ebp
ret 8
Function at 0x418b80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov eax, 0x1fffffff
push ebx
push esi
push edi
mov edi, ecx
mov esi, 1
bsr ecx, eax
mov eax, esi
mov dword [ebp - 0xc], edi
shl eax, cl
cmp edx, eax
ja 0x418ccc
mov ebx, dword [edi + 4]
lea eax, [edx - 1]
or eax, esi
mov dword [ebp - 4], ebx
bsr ecx, eax
push ebx
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [edi + 0xc]
lea eax, [esi + esi]
push eax
call fcn.00418a90
lea eax, [esi - 1]
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], eax
mov ecx, dword [edi + 4]
mov ecx, dword [ecx]
cmp ecx, ebx
je 0x418ca7
mov eax, ecx
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul esi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor esi, edx
movzx edx, byte [eax + 0xa]
imul esi, esi, 0x1000193
xor esi, edx
movzx edx, byte [eax + 0xb]
imul esi, esi, 0x1000193
xor esi, edx
imul edx, esi, 0x1000193
mov esi, dword [edi + 0x18]
and esi, edx
mov edx, dword [edi + 0xc]
mov edi, dword [edx + esi*8]
lea ebx, [edx + esi*8]
mov dword [ebp + 8], ebx
cmp edi, dword [ebp - 4]
jne 0x418c35
mov dword [ebx], eax
mov dword [ebx + 4], eax
jmp 0x418c99
mov edx, dword [ebx + 4]
mov esi, dword [eax + 8]
cmp esi, dword [edx + 8]
jne 0x418c6c
mov edx, dword [edx]
mov dword [ebp - 8], edx
cmp edx, eax
je 0x418c67
mov edi, dword [eax + 4]
mov ebx, dword [ebp - 8]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov ebx, dword [ebp + 8]
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
mov dword [ebx + 4], eax
jmp 0x418c99
cmp edi, edx
je 0x418c7c
mov edx, dword [edx + 4]
cmp esi, dword [edx + 8]
je 0x418cb0
cmp edi, edx
jne 0x418c70
mov ebx, dword [eax + 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov esi, dword [edx + 4]
mov dword [esi], eax
mov dword [edx + 4], edi
mov edx, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], esi
mov dword [edx], eax
mov eax, ecx
mov edi, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
jne 0x418be2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, dword [eax + 4]
mov ebx, dword [edx]
mov dword [edi], ecx
mov esi, dword [ecx + 4]
mov dword [esi], ebx
mov edx, dword [ebx + 4]
mov dword [edx], eax
mov dword [ebx + 4], esi
mov dword [ecx + 4], edi
mov dword [eax + 4], edx
jmp 0x418c99
push 0x4dde0c
call fcn.004a2d75
int3
Function at 0x418d50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi - 0x10000]
movzx eax, cx
mov edi, ecx
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
jbe 0x418e0e
nop dword [eax]
cmp edi, dword [0x513164]
jb 0x418d98
cmp edi, dword [0x513168]
ja 0x418d98
sub edi, 0x8000000
jmp 0x418e06
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push edi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x418e0e
cmp dword [ebp - 0xc], 0x10000
jne 0x418df1
cmp dword [ebp - 0x10], 0x10000
jb 0x418df1
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x418eba
sub edi, 0x10000
jmp 0x418e06
mov ecx, dword [ebp - 0x18]
add ecx, 0xffff0000
mov edi, ecx
movzx eax, di
sub edi, eax
test eax, eax
cmove edi, ecx
cmp edi, ebx
ja 0x418d80
movzx eax, si
test eax, eax
je 0x418e1d
sub esi, eax
add esi, 0x10000
mov edi, dword [ebp + 0x10]
cmp esi, edi
jae 0x418eb8
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
cmp esi, dword [0x513164]
jb 0x418e48
cmp esi, dword [0x513168]
ja 0x418e48
add esi, 0x8000000
jmp 0x418eb0
push 0x1c
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call ebx
test eax, eax
je 0x418eb8
cmp dword [ebp - 0xc], 0x10000
mov ecx, dword [ebp - 0x10]
jne 0x418e9b
cmp ecx, 0x10000
jb 0x418e9b
push 0x40
push 0x3000
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x418eba
add esi, 0x10000
jmp 0x418eb0
mov esi, dword [ebp - 0x1c]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x418eb0
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x418e30
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4191d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5058e0
push 0x4a4eb0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x513b94]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x419282
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x419282
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp dword [ebp + 0xc], eax
jb 0x419282
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp dword [ebp + 0xc], eax
jae 0x419282
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4197d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x517e30], 0
jne 0x41984c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x517e30
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41984c
push esi
mov esi, dword [0x517e20]
mov dword [0x517e40], eax
mov dword [0x517e3c], eax
mov dword [0x517e38], eax
push edi
test esi, esi
je 0x41982e
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x41983b
mov esi, dword [esi + 4]
test esi, esi
jne 0x419815
xor eax, eax
pop edi
mov dword [0x517e34], eax
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
mov dword [0x517e34], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret