joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4142f0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x48e6e3
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4b82d8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebp
push esi
mov eax, dword [0x4b82d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0xc], ebp
xor eax, eax
mov word [esp + 0x14], ax
mov eax, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], ebp
lea esi, [eax + 2]
mov edi, edi
mov dx, word [eax]
add eax, 2
cmp dx, bp
jne 0x414340
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00405210
mov eax, dword [esp + 0x24]
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x38], ebp
neg ecx
or ecx, eax
push ecx
call fcn.00419bd0
mov esi, eax
add esp, 4
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x24]
xor eax, eax
mov word [esi + ecx*2], ax
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
mov byte [esp + 0x38], 1
jae 0x4143a0
lea eax, [esp + 0x14]
mov edx, dword [esp + 0x24]
push esi
push edx
push eax
call fcn.004075d0
add esp, 0xc
xor eax, eax
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebp
mov word [edi + 4], ax
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4143c4
sub eax, edx
sar eax, 1
push eax
push esi
mov ecx, edi
call fcn.00405210
cmp esi, ebp
je 0x4143e9
push esi
call fcn.00419bc5
add esp, 4
cmp dword [esp + 0x28], 8
jb 0x4143fd
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00419bc5
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0045cd9b
add esp, 0x30
ret
Function at 0x414b90
Capabilities:
Check if file exists

Disassembly:
push edi
mov edi, eax
mov eax, dword [edi + 0xc]
test eax, eax
je 0x414bff
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414bff
push ebx
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x414bb2
call fcn.00414420
mov eax, dword [edi + 0x24]
sub eax, dword [edi + 0x20]
pop ebx
sar eax, 2
test eax, eax
ja 0x414bc5
call fcn.0045d981
mov eax, dword [edi + 0x10]
push esi
mov esi, dword [edi + 0x20]
mov edi, dword [edi + 0xc]
call fcn.00414b30
mov ecx, dword [0x4b9854]
mov edi, eax
test ecx, ecx
je 0x414bfa
mov esi, ecx
call fcn.00415cd0
push esi
call fcn.00419bc5
add esp, 4
mov dword [0x4b9854], 0
pop esi
mov eax, edi
pop edi
ret
mov eax, 0x3f2
pop edi
ret

Function at 0x414d30
Capabilities:
Set registry value

Disassembly:
sub esp, 0x28
mov eax, dword [0x4b82d8]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
lea eax, [esp + 8]
push eax
mov esi, ecx
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push 0x496384
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x414de1
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea edi, [esp + 0x10]
call fcn.00414c10
mov ecx, dword [esi + 0x14]
mov edi, 8
cmp dword [esi + 0x18], edi
jb 0x414d90
mov esi, dword [esi + 4]
jmp 0x414d93
add esi, 4
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], edi
jae 0x414da1
lea eax, [esp + 0x14]
lea edx, [ecx + ecx + 2]
push edx
push esi
push 1
push 0
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x28], edi
pop edi
jb 0x414de1
mov eax, dword [esp + 0x10]
push eax
call fcn.00419bc5
add esp, 4
mov ecx, dword [esp + 0x28]
pop esi
xor ecx, esp
call fcn.0045cd9b
add esp, 0x28
ret
Function at 0x418400
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
test eax, eax
je 0x41844b
mov ecx, dword [esi + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 0x40]
push 0xbb8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x418433
mov eax, dword [esi + 0x40]
push 3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
push 0x30
mov dword [esi], 0
push 0
add esi, 4
push esi
call fcn.0045cf50
add esp, 0xc
pop esi
ret

Function at 0x41a6e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x41a709
cmp dword [edi + 0x54], 0
jne 0x41a709
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041cf8a
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0041a6a6
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4260f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x426140
call fcn.0041cf8a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x426140
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42615c
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00425c71
mov esi, eax
test edi, edi
je 0x42615a
test ebx, ebx
je 0x42615a
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42840a
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x48fc5b
call fcn.0045e69f
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x42842f
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x428475
lea ecx, [ebp - 0x10]
call fcn.00401720
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041acf2
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004012d0
mov eax, esi
call fcn.0045e777
ret 8
Function at 0x42be18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x42be60
call fcn.0041cf8a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42be60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x42bea3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x42be8c
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x42be8c
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x42bea0
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42e496
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x4902bb
call fcn.0045e69f
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00403350
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42e4f8
call fcn.0041c370
cmp eax, 1
jne 0x42e4f8
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x4984c8
push eax
call fcn.00404ef0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403030
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004012d0
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004012d0
mov eax, esi
call fcn.0045e777
ret 0x10

Function at 0x42e521
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x4902e6
call fcn.0045e69f
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00403350
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42e583
call fcn.0041c370
cmp eax, 1
jne 0x42e583
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x4984c8
push eax
call fcn.00404ef0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403030
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004012d0
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004012d0
mov eax, esi
call fcn.0045e777
ret 0x14
Function at 0x42e5af
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x490311
call fcn.0045e69f
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00403350
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x42e611
call fcn.0041c370
cmp eax, 1
jne 0x42e611
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push 0x4984c8
push eax
call fcn.00404ef0
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00403030
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004012d0
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004012d0
mov eax, esi
call fcn.0045e777
ret 8

Function at 0x45cd9b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b82d8]
jne 0x45cda5
repz ret
jmp fcn.004695bc

Function at 0x46e74f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x46e780
call fcn.0045eb27
mov dword [eax], esi
call fcn.0045eb14
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0045d95b
add esp, 0x14
push 0x16
pop eax
jmp 0x46e7d5
test dword [ebp + 0xc], 0xfffffff9
jne 0x46e75c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x46e7ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045eb3a
pop ecx
call fcn.0045eb14
mov eax, dword [eax]
jmp 0x46e7d5
test al, 0x10
jne 0x46e7d3
test al, 1
je 0x46e7d3
test byte [ebp + 0xc], 2
je 0x46e7d3
call fcn.0045eb27
mov dword [eax], 5
call fcn.0045eb14
mov dword [eax], 0xd
jmp 0x46e7a4
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4740c3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004648fc
and dword [ebp - 4], 0
cmp dword [0x4bc360], 0
mov ebx, eax
jne 0x474174
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x474225
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x474225
push eax
call fcn.0046488a
mov dword [esp], 0x49f8a8
push edi
mov dword [0x4bc360], eax
call esi
push eax
call fcn.0046488a
mov dword [esp], 0x49f894
push edi
mov dword [0x4bc364], eax
call esi
push eax
call fcn.0046488a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4bc368], eax
call esi
push eax
call fcn.0046488a
pop ecx
mov dword [0x4bc370], eax
test eax, eax
je 0x474174
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046488a
pop ecx
mov dword [0x4bc36c], eax
mov eax, dword [0x4bc36c]
cmp eax, ebx
je 0x4741cc
cmp dword [0x4bc370], ebx
je 0x4741cc
push eax
call fcn.00464905
push dword [0x4bc370]
mov esi, eax
call fcn.00464905
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4741cc
test edi, edi
je 0x4741cc
call esi
test eax, eax
je 0x4741c3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4741c3
test byte [ebp - 0xc], 1
jne 0x4741cc
or dword [ebp + 0x10], 0x200000
jmp 0x474205
mov eax, dword [0x4bc364]
cmp eax, ebx
je 0x474205
push eax
call fcn.00464905
pop ecx
test eax, eax
je 0x474205
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x474205
mov eax, dword [0x4bc368]
cmp eax, ebx
je 0x474205
push eax
call fcn.00464905
pop ecx
test eax, eax
je 0x474205
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4bc360]
call fcn.00464905
pop ecx
test eax, eax
je 0x474225
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x474227
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x481cba
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x481ceb
call fcn.0045eb27
mov dword [eax], esi
call fcn.0045eb14
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0045d95b
add esp, 0x14
push 0x16
pop eax
jmp 0x481d40
test dword [ebp + 0xc], 0xfffffff9
jne 0x481cc7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x481d18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0045eb3a
pop ecx
call fcn.0045eb14
mov eax, dword [eax]
jmp 0x481d40
test al, 0x10
jne 0x481d3e
test al, 1
je 0x481d3e
test byte [ebp + 0xc], 2
je 0x481d3e
call fcn.0045eb27
mov dword [eax], 5
call fcn.0045eb14
mov dword [eax], 0xd
jmp 0x481d0f
xor eax, eax
pop esi
pop ebp
ret
Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call esi
cmp eax, 7
jne 0x44b624
push 1
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x661210], al
mov byte [0xa636f4], al
mov eax, 0xd7b0
mov dword [0x661228], ecx
mov word [0xa6374c], ax
mov word [0xa6374e], ax
mov word [0x661624], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x661258], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b678
call esi
cmp al, 4
ja 0x44b67e
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x661254], eax
pop esi
ret
Function at 0x466337
Capabilities:
Encode data using xor

Disassembly:
dec ecx
dec esp
out dx, eax
or eax, 0xd624492c
insb byte es:[edi], dx
add edx, dword [esi - 0x593ecd95]
fistp dword [edx*4 - 0x2110c22e]
call eax
outsd dx, dword [esi]
cmp dword [eax + esi*2 - 0xf06fdda], ebp
movsb byte es:[edi], byte [esi]
xor ch, byte [eax]
rol byte [ebx + 0x6e54cb1c], 1
sbb byte [0x9d4ec31], dh
sar byte [edi], 0xfe
outsb dx, byte fs:[esi]
sbb al, 0x68
outsb dx, byte [esi]
or byte [edx - 0x716b0537], 0x49
xchg edi, eax
push esi
out 0xa5, eax
in al, dx
push ebx
mov esp, 0xd0f8f8c
mov byte [0xbfb84a37], al
lahf
xor dh, byte [esi + 1]
pop ds
clc
jmp 0x466392
test byte [edx + 0x21], bh
xchg esp, eax
xor dword [edi + 0x22], esp
and bh, bh
inc ebp
lahf
jl 0x4663fa
xchg esp, eax
dec dword [ebp - 0x1d15a841]
sbb eax, 0xbfcc6771
push edi
sub bh, byte [ebx + 0x71]
int1
pop ebp
and byte [ecx + 0x62], bh
mov gs, word [edi + 0x3d]
add dword [ebx + 0x73625bc], esp
pushal
outsd dx, dword [esi]
lodsb al, byte [esi]
iretd
push ebx
add dword [ecx + 0x22a22a6], eax
pop ecx
sbb eax, 0x9c9983ef
scasd eax, dword es:[edi]
dec ebx
popfd
clc
inc ebp
mov dl, 0xff
mov byte [0xf55423aa], al
loope 0x466431
enter 0xb9b, 0xffffffffffffffaa
jmp [edx - 0x2e837859]
push esp
out dx, eax
stosb byte es:[edi], al
mov al, byte [ecx]
jle 0x4663c6
pushal
mov ebp, 0x37669e92
insd dword es:[edi], dx
into
push esi
and byte [esi - 0x7a], ah
cmp edi, esp
or ecx, dword [ebp - 0x43]
sub dh, bh
dec ecx
cmp dword fs:[ebx], ecx
feni8087_nop
xchg edx, eax
retf
push esi
not byte [ecx + 0x6e]
shr ecx, 1
xchg ecx, eax
stc
cmc
inc eax
in al, dx
fmul qword [esp + ebx*8]
fnsave dword [ecx + 0x318dd8ca]
dec esi
out dx, al
xchg ah, cl
pop ebp
salc
xor eax, edi
adc eax, 0x52c5fa6
adc esp, dword [ecx]
insb byte es:[edi], dx
fistp qword [esi + ebx*4]
insd dword es:[edi], dx
stosd dword es:[edi], eax
sal dword [esp + edi*2 + 0x1c3113d5], cl
xchg ebp, eax
sbb dword [esi + ecx*2], edi
cmp al, 0x4e
enter 0xffffffffffffee68, 0x31
outsb dx, byte [esi]
cmp dword [ebp + 0x58], ebx
insd dword es:[edi], dx
or ah, bl
scasd eax, dword es:[edi]
cmp ecx, eax
and al, 0x9d
cmp al, 0xc8
dec ecx
mov ss, eax
xor dword [ebp + 0x1e], ebp
fadd st(7), st(0)
jle 0x466466
dec edx
invalid
Function at 0x624447
Capabilities:
Encode data using xor

Disassembly:
sar byte [ecx], 0xc5
inc ebp
push esp
lds eax, [ebp + 0x54]
loope 0x624489
inc ebp
add ch, dl
or byte [ebx], bh
add al, 0x36
cli
jns 0x624449
out dx, al
cwde
aam 0x5d
daa
sar bh, 9
nop
fdivr dword [edx]
pop edi
invalid
test byte [ebp + 0x5ee86420], dl
insd dword es:[edi], dx
ljmp 0x234
Function at 0x401100
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call fcn.00402620
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
mov ecx, dword [edx + 0x10]
mov ecx, dword [ecx + 0x1c]
add esp, 4
test ecx, ecx
je 0x40116f
cmp dword [0x4a5694], 6
jl 0x40113f
push 0
lea edx, [ebp - 4]
push edx
push eax
push esi
push ecx
call dword [0x4a32c0]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x4a31c0]
test edx, edx
je 0x40116f
test cl, 3
jne 0x40116f
push 0
push 0
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push ecx
mov dword [ebp - 0xc], 0xc0000365
mov dword [ebp - 8], 0xffffffd5
call edx
mov esp, ebp
pop ebp
ret

Function at 0x401180
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x1c]
sub esp, 0xc
test eax, eax
je 0x4011ec
cmp dword [0x4a5694], 6
jl 0x4011b9
push 0
lea ecx, [ebp - 4]
push ecx
push 1
lea edx, [ebp + 8]
push edx
push eax
call dword [0x4a32c0]
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4a31c0]
test ecx, ecx
je 0x4011ec
test al, 3
jne 0x4011ec
push 0
push 0
push 1
lea edx, [ebp + 8]
push edx
lea edx, [ebp - 0xc]
push edx
push 0
push 0
push 0
push eax
mov dword [ebp - 0xc], 0xc0000365
mov dword [ebp - 8], 0xffffffd5
call ecx
mov esp, ebp
pop ebp
ret
Function at 0x406dc0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov esi, eax
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov edi, dword [esi + 0x48]
sub edi, dword [ecx + 8]
push 0x4468
lea ebx, [esi + 0x4a0]
push 0
push ebx
add edi, 0x4a7350
mov dword [ebp - 4], 0
call fcn.004127e0
mov eax, dword [esi]
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x4468
push ebx
push edi
push eax
call dword [0x4a3128]
test eax, eax
jns 0x406e27
push eax
push edi
push str.NtReadVirtualMemory___p___failed_reading_child_process_status:__x_n
push eax
push str.supR3HardNtChildProcessRequest
call fcn.00406c70
mov eax, dword [esi + 0x4ac]
cmp eax, dword [ebp + 8]
je 0x406f21
mov ecx, dword [esi + 0x4b4]
mov edx, dword [esi + 0x4b0]
lea edi, [esi + 0x508]
push edi
lea ebx, [esi + 0x4b8]
push ebx
push ecx
push edx
push eax
push str.supR3HardenedWinCheckChild:_enmRequest_d_rc_d_enmWhat_d__s:__s_n
mov byte [esi + 0x4907], 0
mov byte [esi + 0x507], 0
call fcn.004014e0
mov eax, dword [esi + 0x4ac]
add esp, 0x18
cmp eax, 2
je 0x406e93
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
push str.Unexpected_child_request__d._Was_expecting__d___s_._n
push 0xfffffffffffffffe
push str.supR3HardenedWinCheckChild
call fcn.00406c70
mov eax, dword [esi + 0xc]
push 0
push eax
call dword [0x4a3150]
test eax, eax
jns 0x406eb4
push eax
push str.NtSetEvent_failed:__x_n
push eax
push str.supR3HardNtChildProcessRequest
call fcn.00406c70
mov edx, dword [esi]
lea ecx, [ebp - 0xc]
push ecx
push 0
push edx
mov dword [ebp - 0xc], 0xfd050f80
mov dword [ebp - 8], 0xffffffff
call fcn.004031d7
test eax, eax
je 0x406ef0
push eax
push str.supR3HardNtChildProcessRequest:_Child_is_taking_too_long_to_quit__rcWait_x___killing_it..._n
call fcn.004014e0
mov eax, dword [esi]
add esp, 8
push 0x40010004
push eax
call dword [0x4a3190]
mov eax, dword [esi + 0x4b4]
push edi
push 0x4686e8
test eax, eax
jne 0x406f13
mov ecx, dword [esi + 0x4b0]
push ecx
push 5
push str.supR3HardenedWinCheckChild
call fcn.00401f50
mov edx, dword [esi + 0x4b0]
push edx
push eax
push ebx
call fcn.00401f50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416a70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 2
jne 0x416a82
mov edi, 3
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
push 0
push 0
push 4
lea eax, [ebp + 0x10]
push eax
push esi
call ecx
add esp, 0x14
test eax, eax
js 0x416c27
mov eax, dword [ebp + 0x10]
mov edx, 0x5a4d
cmp ax, dx
je 0x416af3
cmp eax, 0x4550
je 0x416af3
cmp eax, 0x464c457f
je 0x416af3
mov ecx, 0x584c
cmp ax, cx
je 0x416af3
cmp eax, 0xfeedfacf
je 0x416af3
cmp eax, 0xfefaedfe
je 0x416af3
cmp eax, 0xfeedface
je 0x416af3
cmp eax, 0xcefaedfe
je 0x416af3
cmp eax, 0xcafebabe
je 0x416af3
cmp eax, 0xbebafeca
jne 0x416c22
mov dword [ebp + 8], 0
cmp ax, dx
jne 0x416b6c
mov ecx, dword [esi + 4]
push 0
push 0x3c
push 4
lea eax, [ebp + 8]
push eax
push esi
call ecx
add esp, 0x14
test eax, eax
js 0x416c27
mov eax, dword [ebp + 8]
cmp eax, 0x40
jbe 0x416c22
push 0
push eax
mov eax, dword [esi + 4]
push 4
lea edx, [ebp + 0x10]
push edx
push esi
call eax
add esp, 0x14
test eax, eax
js 0x416c27
mov eax, dword [ebp + 0x10]
cmp eax, 0x4550
je 0x416b73
mov ecx, 0x584c
cmp ax, cx
je 0x416b6c
mov edx, 0x454c
cmp ax, dx
je 0x416b6c
mov ecx, 0x454e
cmp ax, cx
jne 0x416c22
cmp eax, 0x4550
jne 0x416b93
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push eax
push 0
push ecx
push edi
push edx
push esi
call fcn.00441770
add esp, 0x1c
pop edi
pop esi
pop ebp
ret
cmp eax, 0x464c457f
jne 0x416ba3
pop edi
mov eax, 0xfffffda7
pop esi
pop ebp
ret
cmp eax, 0xfeedfacf
je 0x416c22
cmp eax, 0xfefaedfe
je 0x416c22
cmp eax, 0xfeedface
je 0x416c22
cmp eax, 0xcefaedfe
je 0x416c22
cmp eax, 0xcafebabe
je 0x416c22
cmp eax, 0xbebafeca
je 0x416c22
mov ecx, 0x584c
cmp ax, cx
jne 0x416be0
pop edi
mov eax, 0xfffffda5
pop esi
pop ebp
ret
mov edx, 0x454c
cmp ax, dx
jne 0x416bf3
pop edi
mov eax, 0xfffffda4
pop esi
pop ebp
ret
mov ecx, 0x454e
cmp ax, cx
jne 0x416c06
pop edi
mov eax, 0xfffffda3
pop esi
pop ebp
ret
xor ecx, ecx
mov edx, 0x5a4d
cmp ax, dx
setne cl
pop edi
pop esi
lea eax, [ecx - 1]
and eax, 0xfffffffa
add eax, 0xfffffda8
pop ebp
ret
mov eax, 0xfffffda8
pop edi
pop esi
pop ebp
ret
Function at 0x417640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
push edi
push ecx
call fcn.00404450
mov edx, dword fs:[0x18]
mov edi, eax
mov eax, dword [edx + 0x30]
mov ebx, dword [eax + 0xc]
mov esi, dword [ebx + 0x14]
add ebx, 0x14
add esp, 4
add edi, edi
mov dword [ebp - 4], 0
cmp esi, ebx
je 0x4176c0
cmp dword [ebp - 4], 0x400
jae 0x4176c0
movzx eax, word [esi + 0x1c]
lea ecx, [edi + 2]
cmp eax, ecx
jbe 0x4176b7
mov edx, dword [esi + 0x20]
sub eax, edi
shr eax, 1
lea ecx, [edx + eax*2]
movzx eax, word [ecx - 2]
cmp eax, 0x5c
je 0x4176a3
cmp eax, 0x2f
jne 0x4176b7
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
push edx
push ecx
call fcn.00416510
add esp, 8
test eax, eax
je 0x4176d7
mov esi, dword [esi]
inc dword [ebp - 4]
cmp esi, ebx
jne 0x417677
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x4176e7
pop edi
pop esi
mov dword [eax + 0x14], 0
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp + 8]
pop edi
pop esi
mov dword [ecx + 0x14], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dl, byte [1]
inc dl
mov byte [1], dl
int3