joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425c83
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00425af9

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x318b14ec
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xe0a766a
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x414363
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
mov edx, 0x10e
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41436a
call fcn.0042e5c0
mov edx, dword [esp + 0x448]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b4001], 0x4000096
mov dword [0x4b4001], 0x400009a
push dword [esp + 0x444]
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x42c], eax
mov dword [0x4b4001], 0x400009b
cmp dword [esp + 0x42c], 0
je 0x4144e7
mov dword [0x4b4001], 0x400009c
lea ebp, [esp + 4]
mov dword [ebp], 0x428
mov dword [0x4b4001], 0x400009d
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32FirstW
mov dword [esp + 0x430], eax
mov dword [0x4b4001], 0x400009e
cmp dword [esp + 0x430], 0
je 0x4144d1
mov dword [0x4b4001], 0x400009f
push edx
call fcn.0042e420
pop edx
push eax
push 1
push 1
push dword [esp + 0xc]
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
lea ebp, [esp + 0x1c]
lea eax, [ebp + 0x20]
push eax
call fcn.0042d4d0
call fcn.00419292
add dword [esp], edx
call fcn.0042c4e0
call fcn.004192b0
and eax, eax
je 0x414496
mov dword [0x4b4001], 0x40000a0
lea ebp, [esp + 4]
push dword [ebp + 0x14]
pop eax
mov dword [esp + 0x434], eax
mov dword [0x4b4001], 0x40000a1
jmp 0x4144d1
mov dword [0x4b4001], 0x40000a2
mov dword [0x4b4001], 0x40000a3
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32NextW
mov dword [esp + 0x430], eax
mov dword [0x4b4001], 0x40000a4
jmp 0x414406
mov dword [0x4b4001], 0x40000a5
push dword [esp + 0x42c]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x40000a6
mov dword [0x4b4001], 0x40000a8
mov eax, dword [esp + 0x434]
jmp 0x414510
push dword [esp]
call fcn.0042e620
add esp, 0x438
pop ebx
pop ebp
ret 8
Function at 0x4153aa
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4153b1
call fcn.0042e5c0
mov dword [0x4b4001], 0x400007f
mov dword [0x4b4001], 0x4000081
mov dword [esp + 0x30], 0
mov dword [0x4b4001], 0x4000083
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov dword [0x4b4001], 0x4000084
lea ebp, [esp + 0xc]
movsx ebx, word [ebp]
cmp ebx, 9
jne 0x4154e3
mov dword [0x4b4001], 0x4000085
mov eax, str.IsWow64Process
push eax
mov eax, str.kernel32.dll
push eax
call fcn.004152b2
mov dword [esp], eax
mov dword [0x4b4001], 0x4000086
cmp dword [esp], 0
je 0x4154d9
mov dword [0x4b4001], 0x4000087
push dword [esp + 0x40]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 8], eax
mov dword [0x4b4001], 0x4000088
cmp dword [esp + 8], 0
je 0x4154cf
mov dword [0x4b4001], 0x4000089
lea eax, [esp + 4]
push eax
push dword [esp + 0xc]
push dword [esp + 8]
call fcn.0041c1ad
mov dword [0x4b4001], 0x400008a
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x400008b
mov ebx, dword [esp + 4]
and ebx, ebx
jne 0x4154c5
mov dword [0x4b4001], 0x400008c
mov dword [esp + 0x30], 1
mov dword [0x4b4001], 0x400008d
mov dword [0x4b4001], 0x400008e
mov dword [0x4b4001], 0x400008f
mov dword [0x4b4001], 0x4000090
mov dword [0x4b4001], 0x4000092
mov eax, dword [esp + 0x30]
jmp 0x415509
add esp, 0x34
pop ebx
pop ebp
ret 4

Function at 0x415734
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41573b
call fcn.0042e5c0
mov dword [0x4b4001], 0x15d
mov dword [0x4b4001], 0x15e
mov byte [esp], 0
mov dword [0x4b4001], 0x160
lea eax, [esp + 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
and eax, eax
je 0x41587b
mov dword [0x4b4001], 0x161
lea eax, [esp + 8]
mov dword [0x4b4001], 0x163
lea eax, [esp + 8]
push eax
mov eax, str.SeDebugPrivilege
push eax
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueW
and eax, eax
je 0x41585e
mov dword [0x4b4001], 0x164
lea eax, [esp + 0x10]
mov dword [0x4b4001], 0x167
lea ebp, [esp + 0x10]
mov dword [ebp], 1
mov dword [0x4b4001], 0x168
lea ebp, [esp + 8]
push dword [ebp]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b4001], 0x169
lea ebp, [esp + 8]
push dword [ebp + 4]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 8], eax
mov dword [0x4b4001], 0x16a
push ebp
pop ebp
mov dword [ebp + 0xc], 2
mov dword [0x4b4001], 0x16c
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push eax
pop eax
mov byte [esp], al
mov dword [0x4b4001], 0x16d
mov dword [0x4b4001], 0x16e
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x16f
mov dword [0x4b4001], 0x170
movsx eax, byte [esp]
movsx eax, al
jmp 0x4158a4
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x416711
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0042e5c0
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b4001], 0x3a2
mov dword [0x4b4001], 0x3a4
push 5
call sub.USER32.DLL_GetDesktopWindow
push eax
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
mov dword [0x4b4001], 0x3a5
cmp dword [esp + 4], 0
je 0x41686c
mov dword [0x4b4001], 0x3a6
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextLengthW
mov ebx, eax
add ebx, 2
push ebx
call fcn.0042ce10
lea eax, [esp + 0xc]
push eax
call fcn.0042e4c0
mov dword [0x4b4001], 0x3a7
push dword [esp + 8]
call fcn.0042c5c0
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextW
mov dword [0x4b4001], 0x3a8
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042cf50
call fcn.0042e550
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push dword [esp + 0x18]
call fcn.0042cf50
call fcn.00419292
add dword [esp], edx
call fcn.00419292
add dword [esp + 4], edx
call fcn.0042c560
call fcn.004192b0
and eax, eax
je 0x416837
mov dword [0x4b4001], 0x3a9
mov eax, 1
jmp 0x416886
mov dword [0x4b4001], 0x3aa
mov dword [0x4b4001], 0x3ab
push 2
push dword [esp + 8]
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
mov dword [0x4b4001], 0x3ac
jmp 0x416750
mov dword [0x4b4001], 0x3ad
xor eax, eax
jmp 0x416886
push dword [esp]
call fcn.0042e620
push dword [esp + 8]
call fcn.0042e620
add esp, 0xc
pop ebx
ret 4
Function at 0x416943
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov edx, 0x10d
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x416949
call fcn.0042e5c0
mov edx, dword [esp + 0x440]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b4001], 0x2000085
mov dword [0x4b4001], 0x2000088
lea ebp, [esp + 8]
mov dword [ebp], 0x428
mov dword [0x4b4001], 0x200008b
push dword [esp + 0x43c]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 4], eax
mov dword [0x4b4001], 0x200008c
cmp dword [esp + 4], 0
je 0x416b22
mov dword [0x4b4001], 0x200008d
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Module32FirstW
and eax, eax
je 0x416b05
mov dword [0x4b4001], 0x200008e
mov dword [0x4b4001], 0x200008f
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
lea ebp, [esp + 0x10]
lea eax, [ebp + 0x20]
push eax
call fcn.0042d4d0
lea eax, [esp + 0x434]
push eax
call fcn.0042e4c0
mov dword [0x4b4001], 0x2000090
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
lea eax, [ebp + 0x220]
push eax
call fcn.0042d4d0
lea eax, [0x4fcee0]
push eax
call fcn.0042e4c0
mov dword [0x4b4001], 0x2000094
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push dword [esp + 0x438]
call fcn.0042c810
call fcn.0042e550
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042c810
call fcn.004192c0
mov edx, eax
pop ecx
push ecx
call fcn.004192c0
mov ecx, eax
call fcn.00419240
je 0x416ace
mov dword [0x4b4001], 0x2000096
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x2000097
lea ebp, [esp + 8]
mov eax, dword [ebp + 0x14]
jmp 0x416b46
mov dword [0x4b4001], 0x2000098
mov dword [0x4b4001], 0x2000099
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Module32NextW
and eax, eax
je 0x416af8
xor eax, eax
jmp 0x416afd
mov eax, 1
and eax, eax
je 0x4169dd
mov dword [0x4b4001], 0x200009a
mov dword [0x4b4001], 0x200009b
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x200009c
mov dword [0x4b4001], 0x200009e
xor eax, eax
jmp 0x416b46
push dword [esp]
call fcn.0042e620
push dword [esp + 0x430]
call fcn.0042e620
add esp, 0x434
pop ebp
ret 8
Function at 0x4174a2
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov edx, 0x8e
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4174a8
call fcn.0042e5c0
mov edx, dword [esp + 0x240]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b4001], 0x200006b
mov dword [0x4b4001], 0x200006f
lea ebp, [esp + 8]
mov dword [ebp], 0x22c
mov dword [0x4b4001], 0x2000071
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 4], eax
mov dword [0x4b4001], 0x2000072
cmp dword [esp + 4], 0
je 0x417662
mov dword [0x4b4001], 0x2000073
lea ebp, [esp + 8]
mov dword [ebp], 0x22c
mov dword [0x4b4001], 0x2000074
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32FirstW
and eax, eax
je 0x417645
mov dword [0x4b4001], 0x2000075
mov dword [0x4b4001], 0x2000076
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
lea ebp, [esp + 0x10]
lea eax, [ebp + 0x24]
push eax
call fcn.0042d4d0
lea eax, [esp + 0x238]
push eax
call fcn.0042e4c0
mov dword [0x4b4001], 0x2000078
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push dword [esp + 0x23c]
call fcn.0042c810
call fcn.0042e550
push edx
call fcn.0042e420
pop edx
push eax
push edx
call fcn.0042e420
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042c810
call fcn.004192c0
mov edx, eax
pop ecx
push ecx
call fcn.004192c0
mov ecx, eax
call fcn.00419240
je 0x41760e
mov dword [0x4b4001], 0x2000079
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x200007a
lea ebp, [esp + 8]
mov eax, dword [ebp + 8]
jmp 0x417686
mov dword [0x4b4001], 0x200007b
mov dword [0x4b4001], 0x200007c
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32NextW
and eax, eax
je 0x417638
xor eax, eax
jmp 0x41763d
mov eax, 1
and eax, eax
je 0x41754f
mov dword [0x4b4001], 0x200007d
mov dword [0x4b4001], 0x200007e
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b4001], 0x200007f
mov dword [0x4b4001], 0x2000081
xor eax, eax
jmp 0x417686
push dword [esp + 0x234]
call fcn.0042e620
push dword [esp]
call fcn.0042e620
add esp, 0x238
pop ebp
ret 4
Function at 0x419a24
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x4fd68c
cmp dword [0x4fd688], edi
jne 0x419a53
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4fd688], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4fd684]
test esi, esi
je 0x419aae
test edi, edi
jne 0x419bf5
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x419a84
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x419a75
jmp 0x419aa0
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.004199cd
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x419a64
test edi, edi
jne 0x419bf5
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x419bf5
mov esi, dword [0x4fd684]
jmp 0x419aef
cmp dword [esi + 0xc], 0x3f
jl 0x419b90
mov esi, dword [esi]
test esi, esi
jne 0x419ae3
push 0x310
push 8
push dword [0x4fca5c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x419bef
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 8], eax
test eax, eax
je 0x419be1
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x419c08
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x419bdc
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.004199cd
mov eax, dword [0x4fd684]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x419b88
mov dword [eax + 4], esi
mov dword [0x4fd684], esi
jmp 0x419bf5
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.004199cd
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x419bf5
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x4fca5c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x4fd68c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x41a604
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push ebx
push dword [0x4fd6fc]
xor ebp, ebp
mov edi, ebp
mov dword [esp + 0x18], ebp
call fcn.0042db82
mov esi, eax
test esi, esi
je 0x41a799
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
cmp dword [esi + 0x14], ebp
je 0x41a6ae
push ebx
call fcn.0041aa47
jmp 0x41a646
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], 0
jne 0x41a63e
push dword [esi + 0x14]
call fcn.0041aae6
mov eax, dword [esp + 0x1c]
push ebp
push esi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
call fcn.0041a58f
pop ecx
pop ecx
lea eax, [esp + 0x1c]
push eax
push ebp
push esi
push 0x41a7b3
push 0x2000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41a68b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], 0xffffffff
je 0x41a69c
push dword [esp + 0x20]
push ebx
call fcn.0041a907
mov eax, dword [esi]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esi]
push 1
jmp 0x41a74e
test byte [esp + 0x1c], 1
je 0x41a6bd
mov dword [esp + 0x10], 1
test byte [esp + 0x1c], 2
je 0x41a758
push esi
call fcn.0041a526
lea eax, [esi + 4]
push 0x10
push eax
call fcn.0042e37e
pop ecx
pop ecx
mov ecx, dword [0x4fd748]
mov edi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x14]
test eax, eax
jne 0x41a799
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
mov byte [edi + 5], al
mov byte [edi + 4], 1
mov eax, dword [esp + 0x18]
push dword [esi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [esp + 0x18]
push dword [esi + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
cmp dword [esp + 0x20], 0xffffffff
je 0x41a739
push edi
push dword [esp + 0x24]
push ebx
call fcn.0041a867
jmp 0x41a746
mov eax, dword [esp + 0x18]
push dword [esi + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x18]
push dword [esp + 0x10]
mov ecx, dword [eax]
push ebp
push ebp
push eax
call dword [ecx + 0x30]
jmp 0x41a799
mov eax, dword [ecx]
push ecx
call dword [eax + 0x48]
mov eax, dword [esp + 0x18]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp dword [esp + 0x20], 0xffffffff
je 0x41a77a
push dword [esp + 0x20]
push ebx
call fcn.0041a907
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
push ebx
push ebp
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x41a799
xor edi, edi
mov byte [esi + 0x1c], 1
inc edi
mov byte [esi + 0x1e], bl
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x41acdd
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x41ad32
push dword [esp + 0x10]
push 0x41ac5c
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4fd704]
test esi, esi
je 0x41ad8b
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x41ad2a
cmp byte [esi + 0x10], 0
je 0x41ad2a
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x41ad06
jmp 0x41ad8b
mov esi, dword [0x4fd704]
test esi, esi
je 0x41ad8b
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x41ad84
cmp byte [esi + 0x11], 0
je 0x41ad60
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x41ad77
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x4fd704
call fcn.0042e33e
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x41ad3f
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x41b443
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x4fe728]
call fcn.0042da11
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x41b543
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x41b499
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x41b491
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x41b4d9
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x41b51b
push 0x22
pop edx
cmp cx, dx
je 0x41b4cb
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x41b4bb
xor ecx, ecx
cmp word [eax], cx
je 0x41b51b
mov ecx, eax
add eax, 2
jmp 0x41b51d
test dx, dx
je 0x41b523
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x41b4cb
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x41b511
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x41b51b
cmp cx, dx
je 0x41b50e
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x41b4fe
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x41b4e3
jmp 0x41b4cb
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x41b525
xor edx, edx
cmp dword [ebp], ebx
jne 0x41b52e
test edi, edi
jne 0x41b54b
test edx, edx
je 0x41b533
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x41b487
test edi, edi
jne 0x41b55c
mov eax, ebx
jmp 0x41b560
test esi, esi
je 0x41b55c
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x41b560
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret