joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401b4b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401b5a
pop dword [ebp - 0x2c]
mov eax, 0x4d37463d
add eax, 0xb308d51d
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1c489829
add dword [ebp - 0x3c], 0x3209ad22
mov dword [ebp - 0x38], 0xf7f7e517
sub dword [ebp - 0x38], 0xc5c498d2
mov dword [ebp - 0x34], 0xfc11eec1
sub dword [ebp - 0x34], 0xafc5aa93
mov dword [ebp - 0x30], 0xc27edb08
add dword [ebp - 0x30], 0x3d8124f8
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x185281d5
sub dword [ebp - 0x3c], 0xa3e0187f
mov dword [ebp - 0x38], 0x75548a4c
add dword [ebp - 0x38], 0xcc17d729
mov dword [ebp - 0x34], 0xfabac6e4
add dword [ebp - 0x34], 0x68b4a588
mov dword [ebp - 0x30], 0xd1b9bf00
add dword [ebp - 0x30], 0x2e464100
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0xa317ac6f
sub eax, 0xa2d6dc23
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x33b8d
push 0
call eax
mov ecx, 0x82e325d8
sub ecx, 0x82e2f5c3
mov ebx, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x2c]
mov edi, 0xabea6147
sub edi, 0xd497f3b1
add dword [ebp - 0x24], 0x7a0a55d7
mov esi, dword [edx]
xor dword [ebp - 0x18], esi
xor esi, edi
sub dword [ebp - 0x18], 0xaaf91cc5
mov dword [ebx], esi
xor dword [ebp - 0xc], 0x69d19102
add ebx, 0x35cba767
sub ebx, 0x35cba763
add edx, 4
loop 0x401c71
add eax, 0xb327
mov ebx, eax
add eax, 0x9b736dd7
add eax, 0x648c922e
mov ecx, 0xa60624b9
add ecx, 0x5a39db47
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4a2529
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004a2480
add esp, 0xc
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
je 0x4a2558
mov eax, 0xea61
jmp 0x4a25d6
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x3c], 0
jne 0x4a2568
mov eax, 0xea62
jmp 0x4a25d6
push 0xf8
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x3c]
add eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.004a2480
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0x4550
je 0x4a2595
mov eax, 0xea62
jmp 0x4a25d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x14c
je 0x4a25ad
mov eax, 0xea65
jmp 0x4a25d6
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov cx, word [eax + 0x16]
test ch, 0x10
je 0x4a25c2
mov eax, 0xea66
jmp 0x4a25d6
mov eax, dword [ebp + 0x10]
cmp dword [eax + 0x74], 0x10
jbe 0x4a25d2
mov eax, 0xea67
jmp 0x4a25d6
xor eax, eax
jmp 0x4a25d6
pop edi
pop esi
pop ebx
leave
ret

Function at 0x7b4e20
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7b4e2a
pushal
call 0x7b4e30
pop ebp
sub ebp, 0x10
sub ebp, 0x3b4e20
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7b4e54
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7b4e5d
mov eax, 0x3b4e20
add eax, ebp
add eax, 0x63
mov ecx, 0x5eb
mov edx, 0xddf18361
xor byte [eax], dl
inc eax
dec ecx
jne 0x7b4e74
jmp 0x7b4e87
ljmp 0x6161:0x5de8eaac
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x66662efe
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5dff5d30
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4022b0
Capabilities:
Create process on windows
Create thread

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
call fcn.00402a00
call sub.KERNEL32.dll_FreeConsole
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4014d3
mov dword [esp + 8], 0x401698
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x4014d3
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp - 0x10], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeThread
sub esp, 8
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x40247d
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x401a78
mov dword [esp + 8], 0x401698
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x401bcc
mov dword [esp + 8], 0x401698
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x401bcc
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
jmp 0x4024b4
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.https:__google.com
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov eax, 0
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x402b10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x402b5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x402b54
test esi, esi
je 0x402b54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402b30
mov dword [esp], 0x408044
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402d40
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x402d90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x402e68
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x402dce
cmp eax, 4
jne 0x402df0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x402dde
cmp edx, 4
je 0x402dde
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402d40
Function at 0xb2ac90
Capabilities:
Encode data using xor

Disassembly:
jmp 0xb2ac9a
pushal
call 0xb2aca0
pop ebp
sub ebp, 0x10
sub ebp, 0x72ac90
mov al, byte [esp + 0x28]
cmp al, 1
je 0xb2acc4
popal
xor eax, eax
inc eax
ret 0xc
jmp 0xb2accd
mov eax, 0x72ac90
add eax, ebp
add eax, 0x63
mov ecx, 0x5e6
mov edx, 0x7ff91df1
xor byte [eax], dl
inc eax
dec ecx
jne 0xb2ace4
jmp 0xb2acf7
jp 0xb2ad35
jp 0xb2ad73
int 0xf1
int1
int1
jo 0xb2ad31
or ecx, esi
int1
int1
cmp al, 0x49
cmc
int1
int1
int1
dec ebx
fyl2x
int1
int1
push es
adc esi, edx
cmp dword [edx + 0x70], edi
std
int1
int1
int1
xor al, 0x7c
xchg ebp, eax
aad 0xd
js 0xb2ad18
aad 0xa1
cdq
invalid
aad 0x99
push eax
xlatb
xlatb
jge 0xb2ad51
hlt
jl 0xb2ad34
int1
int1
int1
xor byte [eax], bl
sal bl, 0x72
xor esi, ebp
mov eax, 0xe0574fe
push cs
push cs
lodsb al, byte [esi]
xor edi, ebp
int1
jp 0xb2ade8
aad 0xf5
int1
int1
int1
cdq
invalid
push ecx
cdq
xchg edi, eax
ret
push cs
fdivr dword [ebp + 0x3072f0c8]
hlt

Function at 0x40545e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40546d
pop dword [ebp - 0x40]
mov eax, 0xf4913c1a
add eax, 0xbaf1853
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x939d954c
sub dword [ebp - 0x50], 0x454b5001
mov dword [ebp - 0x4c], 0x46ad813b
add dword [ebp - 0x4c], 0xeb85cb0a
mov dword [ebp - 0x48], 0x17035a38
sub dword [ebp - 0x48], 0xcab7160a
mov dword [ebp - 0x44], 0x662fc68
sub dword [ebp - 0x44], 0x662fc68
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x55854055
add dword [ebp - 0x50], 0x1eed2901
mov dword [ebp - 0x4c], 0xda41ca11
add dword [ebp - 0x4c], 0x672a9764
mov dword [ebp - 0x48], 0x953b3e13
add dword [ebp - 0x48], 0xce342e59
mov dword [ebp - 0x44], 0x600c4d24
add dword [ebp - 0x44], 0x9ff3b2dc
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xf4bc7b60
add eax, 0xb85b5c4
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x40597
push 0
call eax
mov ecx, 0xf2ee883c
sub ecx, 0xf2ee3631
mov esi, eax
mov edi, 0xc757e902
sub edi, 0xc714a502
add edi, dword [ebp - 0x40]
mov ebx, 0x2709c512
add ebx, 0x97623ed8
add dword [ebp - 8], esi
mov edx, dword [edi]
add dword [ebp - 0x1c], 0xab03f746
xor edx, ebx
mov dword [ebp - 0x20], 0x81a258f3
mov dword [esi], edx
add dword [ebp - 0x1c], 0x528f47bf
add esi, 0x5b86ac24
add esi, 0xa47953e0
add edi, 4
loop 0x40558a
add eax, 0x13aff
mov ebx, eax
add eax, 0x3ae33102
sub eax, 0x3ae330fd
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c
Function at 0x494a18
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov eax, ebp
mov edx, dword [esp]
call fcn.00404a14
mov esi, ebx
mov eax, dword [ebp]
call fcn.00404c80
test ax, ax
jbe 0x494a83
mov word [esp + 4], ax
mov bx, 1
mov eax, ebp
call fcn.00404ed8
movzx edi, bx
mov edx, dword [ebp]
mov dl, byte [edx + edi - 1]
movzx ecx, si
shr ecx, 8
xor dl, cl
mov byte [eax + edi - 1], dl
mov eax, dword [esp]
movzx eax, byte [eax + edi - 1]
add si, ax
imul ax, si, 0xce6d
add ax, 0x58bf
mov esi, eax
inc ebx
dec word [esp + 4]
jne 0x494a48
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x49546c
Capabilities:
Create thread

Disassembly:
push ecx
push esp
push 0
push 0
push 0x495258
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
ret

Function at 0x495bd4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x495d23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x49f114]
mov edx, dword [eax]
call dword [edx + 0x54]
test al, al
je 0x495ceb
xor edx, edx
mov eax, dword [0x49f134]
call fcn.0042f70c
mov edx, 0x495d3c
mov eax, dword [0x49f114]
mov ecx, dword [eax]
call dword [ecx + 0x7c]
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
or ecx, 0xffffffff
mov edx, 0x495d4c
mov eax, dword [0x49f114]
mov esi, dword [eax]
call dword [esi + 0x70]
xor eax, eax
push ebp
push 0x495cd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x495d58
call fcn.00404dcc
jne 0x495c5b
mov eax, ebx
call fcn.00495dd0
mov eax, dword [ebp - 4]
mov edx, 0x495d70
call fcn.00404dcc
jne 0x495c71
mov eax, ebx
call fcn.00495f14
mov eax, dword [ebp - 4]
mov edx, 0x495d88
call fcn.00404dcc
jne 0x495c87
mov eax, ebx
call fcn.00495fdc
mov eax, dword [ebp - 4]
mov edx, 0x495d9c
call fcn.00404dcc
jne 0x495c9d
mov eax, ebx
call fcn.004960c8
mov eax, dword [ebp - 4]
mov edx, 0x495dac
call fcn.00404dcc
jne 0x495cb3
mov eax, ebx
call fcn.00496254
mov eax, dword [ebp - 4]
mov edx, 0x495dc4
call fcn.00404dcc
jne 0x495cc9
mov eax, ebx
call fcn.00496400
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x495cdd
mov dl, 1
mov eax, dword [0x49f134]
call fcn.0042f70c
jmp 0x495d0d
xor edx, edx
mov eax, dword [0x49f134]
call fcn.0042f70c
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x495930
push 0
push 0
call sub.kernel32.dll_CreateThread_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495d2a
lea eax, [ebp - 4]
call fcn.004049c0
ret

Function at 0x498248
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov ebx, eax
mov eax, ebx
call fcn.00441704
mov dword [0x49f1dc], eax
push esp
push 0
push 0
push 0x497cf0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop edx
pop ebx
ret

Function at 0xae219d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae219d
ret
Function at 0x408945
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4085d8
add edi, 1
call fcn.00408970
xor dword [ebx], eax
add ecx, 0xac3a2941
add ebx, 1
cmp ebx, esi
jne fcn.00408945
add edi, 0x828ddb93
ret
Function at 0x40448c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40b084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040333e
and dword [ebp - 0x14], 0
cmp dword [0x40c9a8], 0
mov dword [ebp - 0x18], eax
jne 0x40453f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4045e7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4045e7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40c9a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40c9ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40c9b0], eax
call edi
push eax
call esi
mov dword [0x40c9b8], eax
test eax, eax
je 0x40453f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40c9b4], eax
mov eax, dword [0x40c9b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404598
cmp dword [0x40c9b8], ecx
je 0x404598
push eax
call esi
push dword [0x40c9b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404598
test ebx, ebx
je 0x404598
call edi
test eax, eax
je 0x40458f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40458f
test byte [ebp - 8], 1
jne 0x404598
or dword [ebp + 0x10], 0x200000
jmp 0x4045cb
mov eax, dword [0x40c9ac]
cmp eax, dword [ebp - 0x18]
je 0x4045cb
push eax
call esi
test eax, eax
je 0x4045cb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4045cb
mov eax, dword [0x40c9b0]
cmp eax, dword [ebp - 0x18]
je 0x4045cb
push eax
call esi
test eax, eax
je 0x4045cb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40c9a8]
call esi
test eax, eax
je 0x4045e7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4045e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004018df
leave
ret
Function at 0x43af70
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46443c
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x482110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [edi], 0x46f404
mov dword [edi + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [edi + 0x10], ebx
mov byte [ebp - 4], 1
mov dword [edi + 0x14], ebx
mov byte [ebp - 4], 2
lea esi, [edi + 0x48]
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
call fcn.0041a0f0
mov byte [ebp - 4], 3
or eax, 0xffffffff
mov dword [edi + 4], 1
mov dword [edi + 8], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x40], eax
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x4c], ebx
mov dword [ebp - 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x456970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x482110]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
push edi
mov byte [eax], 1
mov eax, dword [esi + 0x78]
push eax
mov edi, ecx
call dword [fcn.00469380]
push eax
call dword [fcn.004694d4]
cmp byte [esi + 0x27], 0
jne 0x456a0e
cmp byte [esi + 0x24], 0
mov dword [esi + 0xc0], 9
je 0x456ae2
cmp byte [esi + 0x25], 0
je 0x456ae2
cmp byte [esi + 0x26], 0
je 0x456ae2
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x456ae2
mov eax, dword [esi + 4]
test eax, eax
je 0x456ae2
cmp byte [eax + 0xab], 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
sete al
movzx eax, al
push 0
push eax
push esi
call edx
xor eax, eax
pop edi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004673fc
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x3c]
mov dword [esp + 4], eax
mov eax, dword [esi + 0x38]
dec eax
mov dword [esp + 0xc], eax
sub eax, dword [esi + 0xb4]
inc ecx
mov dword [esp + 4], eax
mov eax, dword [esi + 0xb8]
add eax, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x10], eax
movsx eax, di
mov dword [esp + 8], ecx
shr edi, 0x10
movsx ecx, di
push ecx
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [fcn.00469528]
test eax, eax
je 0x456a72
mov dword [esi + 0xc0], 2
mov dword [esi + 0xbc], 1
jmp 0x456a86
mov dword [esi + 0xc0], 6
mov dword [esi + 0xbc], 0
cmp byte [esi + 0x24], 0
je 0x456abe
cmp byte [esi + 0x25], 0
je 0x456abe
cmp byte [esi + 0x26], 0
je 0x456abe
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x456abe
mov eax, dword [esi + 4]
test eax, eax
je 0x456abe
cmp byte [eax + 0xab], 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
sete al
movzx eax, al
push 0
push eax
push esi
call edx
mov eax, dword [esi + 0xbc]
push eax
mov eax, esi
call fcn.00456de0
mov ecx, dword [esi + 0x78]
push 0
push 0xc8
push 0x3e9
push ecx
call dword [fcn.00469490]
mov ecx, dword [esp + 0x14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.004673fc
mov esp, ebp
pop ebp
ret 4
Function at 0x456b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [0x482110]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x78]
push edi
push 0x3e9
push eax
mov edi, ecx
call dword [fcn.0046948c]
cmp byte [esi + 0x27], 0
jne 0x456b38
mov dword [esi + 0xc0], 9
jmp 0x456b92
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov edx, dword [esi + 0x3c]
dec eax
mov dword [esp + 0xc], eax
sub eax, dword [esi + 0xb4]
mov dword [esp + 4], ecx
mov ecx, dword [esi + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esi + 0xb8]
inc ecx
add eax, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x10], eax
movsx eax, di
mov dword [esp + 8], ecx
shr edi, 0x10
movsx ecx, di
push ecx
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [fcn.00469528]
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 5
mov dword [esi + 0xc0], eax
cmp byte [esi + 0x24], 0
je 0x456bca
cmp byte [esi + 0x25], 0
je 0x456bca
cmp byte [esi + 0x26], 0
je 0x456bca
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x456bca
mov eax, dword [esi + 4]
test eax, eax
je 0x456bca
cmp byte [eax + 0xab], 0
mov edx, dword [ecx]
mov edx, dword [edx + 0x14]
sete al
movzx eax, al
push 0
push eax
push esi
call edx
mov ecx, dword [esp + 0x14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.004673fc
mov esp, ebp
pop ebp
ret
Function at 0x4636f0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462373
mov eax, dword fs:[0]
push eax
mov eax, dword [0x482110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, 1
mov dword [eax], 0x46fd28
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x20], edx
mov byte [eax + 0x18], dl
mov dword [eax + 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [eax], 0x472800
mov dword [eax + 0x28], 0x470898
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov byte [ebp - 4], dl
mov dword [eax + 8], edx
mov dword [eax + 0x24], ecx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x463ba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462338
mov eax, dword fs:[0]
push eax
mov eax, dword [0x482110]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, 1
mov dword [eax], 0x46fd28
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x20], edx
mov byte [eax + 0x18], dl
mov dword [eax + 0x1c], ecx
mov dword [ebp - 4], ecx
mov dword [eax], 0x472828
mov dword [eax + 8], 2
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov byte [eax + 0x38], cl
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4