joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c148
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
mov eax, dword [edi]
call fcn.0049ce2c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
push ebp
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0049c068
pop ecx
call fcn.004d4e1c
test al, al
je 0x49c1f0
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x60], 0
je 0x49c1f0
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00441264
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, dword [edi]
call fcn.00441264
push eax
call sub.user32.dll_SetWindowLongA
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
cmp byte [eax + 0x61], 0
je 0x49c1d9
mov eax, dword [edi]
call fcn.00441264
xor edx, edx
call fcn.004d4e58
jmp 0x49c1f0
mov eax, dword [edi]
call fcn.00441264
mov edx, dword [edi]
mov edx, dword [edx + 0x220]
mov dl, byte [edx + 0x62]
call fcn.004d4e58
push 0x51
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [edi]
call fcn.00441264
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, dword [edi]
call fcn.0043a99c
mov eax, dword [edi]
mov ebx, dword [eax + 0x220]
cmp byte [ebx + 0x61], 0
je 0x49c289
cmp byte [ebx + 0x60], 0
je 0x49c289
call fcn.004d4e1c
test al, al
je 0x49c289
mov eax, dword [0x51e3f4]
mov eax, dword [eax]
call fcn.0045a728
xor ebx, ebx
xor esi, esi
call sub.kernel32.dll_GetTickCount
sub eax, esi
cmp eax, 5
jbe 0x49c279
call sub.kernel32.dll_GetTickCount
mov esi, eax
add ebx, 0xa
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jle 0x49c26b
mov ebx, eax
mov eax, dword [edi]
call fcn.00441264
mov edx, ebx
call fcn.004d4e58
mov eax, dword [edi]
mov eax, dword [eax + 0x220]
movzx eax, byte [eax + 0x62]
cmp ebx, eax
jl 0x49c243
mov eax, dword [edi]
call fcn.0049d36c
mov eax, dword [edi]
call fcn.00441264
push eax
call sub.user32.dll_SetCapture
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1d24
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor ebx, ebx
call fcn.004d4e1c
test al, al
je 0x4c1e2b
mov eax, dword [esi + 4]
mov edx, dword [0x4befd8]
call fcn.004034d0
test al, al
je 0x4c1e2b
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x2f9], 0
je 0x4c1d94
cmp byte [esi + 0x540], 0
jne 0x4c1d94
push 0xffffffffffffffec
mov eax, esi
call fcn.00441264
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00441264
push eax
call sub.user32.dll_SetWindowLongA
jmp 0x4c1dca
cmp byte [ebx + 0x2f9], 0
jne 0x4c1dca
cmp byte [esi + 0x540], 0
je 0x4c1dca
push 0xffffffffffffffec
mov eax, esi
call fcn.00441264
push eax
call sub.user32.dll_GetWindowLongA
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
mov eax, esi
call fcn.00441264
push eax
call sub.user32.dll_SetWindowLongA
mov al, byte [ebx + 0x2f9]
mov byte [esi + 0x540], al
mov al, byte [esi + 0x541]
cmp al, byte [ebx + 0x2fb]
je 0x4c1e2b
cmp byte [ebx + 0x2f9], 0
je 0x4c1e2b
cmp byte [ebx + 0x2fa], 0
je 0x4c1e0d
mov eax, esi
call fcn.00441264
xor edx, edx
call fcn.004d4e58
mov byte [esi + 0x541], 0
jmp 0x4c1e2b
mov eax, esi
call fcn.00441264
mov dl, byte [ebx + 0x2fb]
call fcn.004d4e58
mov al, byte [ebx + 0x2fb]
mov byte [esi + 0x541], al
push 0x51
push 0
push 0
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, esi
call fcn.00441264
push eax
call sub.user32.dll_SetWindowPos
mov dl, 1
mov eax, esi
call fcn.0043a99c
call fcn.004d4e1c
test al, al
je 0x4c1f18
test ebx, ebx
je 0x4c1f18
cmp byte [ebx + 0x2fa], 0
je 0x4c1f18
cmp byte [ebx + 0x2f9], 0
je 0x4c1f18
mov eax, dword [0x51e3f4]
mov eax, dword [eax]
call fcn.0045a728
xor edi, edi
xor ebp, ebp
xor eax, eax
mov al, byte [ebx + 0x2fb]
mov ecx, 0xf
xor edx, edx
div ecx
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x4c1eb6
mov dword [esp + 8], 1
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebp
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x4c1ed7
cmp eax, 5
jbe 0x4c1f00
jmp 0x4c1ed9
jle 0x4c1f00
call sub.kernel32.dll_GetTickCount
mov ebp, eax
add edi, dword [esp + 8]
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jle 0x4c1ef2
mov edi, eax
mov eax, esi
call fcn.00441264
mov edx, edi
call fcn.004d4e58
mov eax, dword [0x51e3f4]
mov eax, dword [eax]
call fcn.0045a728
xor eax, eax
mov al, byte [ebx + 0x2fb]
cmp edi, eax
jl 0x4c1eb6
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4cb0f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4cb244
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4cb21c
cmp dword [eax + 0x3f8], 0
je 0x4cb21c
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2f0]
cmp eax, 0xc8
jbe 0x4cb21c
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2f0], eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.0043aa7c
mov eax, dword [ebp - 0xc]
call fcn.00404374
dec eax
jne 0x4cb19c
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.0043aa7c
mov eax, dword [ebp - 0x10]
call fcn.00404574
push eax
mov eax, ebx
call fcn.004cbd48
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00441264
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
jmp 0x4cb1cf
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.0043aa7c
mov eax, dword [ebp - 0x14]
call fcn.00404574
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00441264
push eax
call sub.user32.dll_SendMessageA
mov esi, eax
test esi, esi
jl 0x4cb21c
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0043aa7c
mov edx, esi
mov eax, ebx
call fcn.004cbd54
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0043aa7c
mov eax, dword [ebp - 4]
call fcn.00404374
mov edx, eax
mov eax, ebx
call fcn.004cb3d4
mov eax, dword [ebp - 8]
call fcn.00404374
push eax
mov eax, dword [ebp - 4]
call fcn.00404374
pop edx
sub edx, eax
mov eax, ebx
call fcn.004cb3f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb24b
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004040d8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040d8
ret
Function at 0x4cb254
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404564
xor eax, eax
push ebp
push 0x4cb371
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x350]
test eax, eax
je 0x4cb35b
cmp dword [eax + 0x3f8], 0
je 0x4cb35b
cmp byte [ebx + 0x2f8], 0
je 0x4cb2dc
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x2f0]
cmp eax, 0x1f4
jb 0x4cb2b5
lea eax, [ebx + 0x2f4]
call fcn.004040b4
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x2f0], eax
lea eax, [ebx + 0x2f4]
mov edx, dword [ebp - 4]
call fcn.0040437c
lea eax, [ebp - 4]
mov edx, dword [ebx + 0x2f4]
call fcn.0040414c
mov eax, dword [ebp - 4]
call fcn.00404374
test eax, eax
jle 0x4cb34b
mov eax, dword [ebp - 4]
call fcn.00404374
dec eax
jne 0x4cb322
mov eax, dword [ebp - 4]
call fcn.00404574
push eax
mov eax, ebx
call fcn.004cbd48
push eax
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00441264
push eax
call sub.user32.dll_SendMessageA
jmp 0x4cb34e
mov eax, dword [ebp - 4]
call fcn.00404574
push eax
push 0xffffffffffffffff
push 0x18f
mov eax, dword [ebx + 0x350]
mov eax, dword [eax + 0x3f8]
call fcn.00441264
push eax
call sub.user32.dll_SendMessageA
jmp 0x4cb34e
or eax, 0xffffffff
test eax, eax
jl 0x4cb35b
mov edx, eax
mov eax, ebx
call fcn.004cbd54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb378
lea eax, [ebp - 4]
call fcn.004040b4
ret
Function at 0x4e3c9c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
test dl, dl
je 0x4e3cb1
add esp, 0xfffffff0
call fcn.00403668
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00404564
xor eax, eax
push ebp
push 0x4e3d8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004ddffc
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041625c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x24], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041625c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x38], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x3c], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041625c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x30], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x34], eax
lea ecx, [ebp - 0xc]
xor edx, edx
xor eax, eax
call fcn.0041625c
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x2c], eax
push 0
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
xor edx, edx
xor eax, eax
call fcn.00416284
push esi
lea edi, [esi + 0x40]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x52], 0
mov byte [esi + 0x53], 0
mov byte [esi + 0x54], 0
mov byte [esi + 0x55], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e3d93
lea eax, [ebp - 4]
call fcn.004040b4
ret
Function at 0x4e9e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4e9f77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 4]
push eax
mov ecx, 0x4e9f90
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 4]
lea eax, [ebx + 8]
call fcn.00404108
push 0xffffffffffffffff
mov ecx, 0x4e9fa0
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x30], eax
push 0xffffffffffffffff
mov ecx, 0x4e9fbc
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x34], eax
mov ecx, 0x4e9fdc
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004d5414
mov byte [ebx + 0xc], al
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4e9ff8
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004d5300
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0xd]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4ea00c
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004d5300
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4ea024
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004d5300
push esi
lea esi, [ebp - 0x14]
lea edi, [ebx + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x4ea040
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004d5414
mov byte [ebx + 0x48], al
mov ecx, 0x4ea054
mov edx, dword [ebx + 4]
mov eax, esi
call fcn.004ddb48
mov byte [ebx + 0x49], al
push 0xffffffffffffffff
mov ecx, 0x4ea068
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x4c], eax
push 0xffffffffffffffff
mov ecx, 0x4ea088
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x50], eax
push 0
mov ecx, 0x4ea0ac
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x54], eax
push 0
mov ecx, 0x4ea0c8
mov edx, dword [ebx + 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 8]
mov dword [ebx + 0x58], eax
push 0xff
mov ecx, 0x4ea0e4
mov edx, dword [ebx + 4]
mov eax, esi
mov esi, dword [eax]
call dword [esi + 8]
mov dword [ebx + 0x5c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e9f7e
lea eax, [ebp - 4]
call fcn.004040b4
ret
Function at 0x516794
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebx, eax
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x5168a0
mov eax, dword [ebx + 0x3c]
mov edx, dword [eax + 0x40]
mov dword [esp], edx
mov edx, dword [eax + 0x44]
mov dword [esp + 4], edx
mov edi, dword [eax + 0x48]
mov ebp, dword [eax + 0x4c]
mov eax, dword [esi + 0xe8]
add dword [esp], eax
mov eax, dword [esi + 0xec]
add dword [esp + 4], eax
add edi, dword [esi + 0xf0]
add ebp, dword [esi + 0xf4]
mov eax, dword [esi + 0x34]
sub dword [esp], eax
mov eax, dword [esi + 0x38]
sub dword [esp + 4], eax
lea eax, [esi + 0x34]
call fcn.004d5024
mov edx, dword [ebx + 0x4c]
add edi, dword [edx + 8]
sub edi, eax
mov eax, dword [ebx + 0x48]
add eax, 0x34
call fcn.004d5040
mov edx, dword [ebx + 0x4c]
add ebp, dword [edx + 0xc]
sub ebp, eax
mov esi, dword [ebx + 0xdc]
xor eax, eax
mov dword [ebx + 0xdc], eax
push edi
push ebp
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, ebx
call fcn.00515a94
mov edi, esi
xor ebp, ebp
xor esi, esi
mov eax, edi
mov ecx, 0xf
cdq
idiv ecx
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
jne 0x51684f
mov dword [esp + 8], 1
mov eax, dword [0x51e3f4]
mov eax, dword [eax]
call fcn.0045a728
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, ebp
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x51687c
cmp eax, 5
jbe 0x51689c
jmp 0x51687e
jle 0x51689c
call sub.kernel32.dll_GetTickCount
mov ebp, eax
add esi, dword [esp + 8]
cmp edi, esi
jge 0x51688f
mov esi, edi
mov dword [ebx + 0xdc], esi
mov eax, ebx
call fcn.005165d8
cmp edi, esi
jg 0x51685b
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x518f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x518fd9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x51dfec]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x518fc3
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00518f60
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x518d68]
call fcn.00519000
mov dword [0x51e050], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x518fe0
lea eax, [ebp - 8]
call fcn.00405b78
ret
Function at 0x401eb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4385ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x448270]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov eax, dword [0x44a334]
mov edx, dword [eax + 0xc]
mov ecx, 0x44a334
mov byte [esp + 0x18], 2
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
mov eax, dword [0x44a334]
mov edx, dword [eax + 0xc]
mov ecx, 0x44a334
mov byte [esp + 0x18], 3
call edx
add eax, 0x10
mov dword [esi + 0x34], eax
mov eax, dword [0x44a334]
mov edx, dword [eax + 0xc]
mov ecx, 0x44a334
mov byte [esp + 0x18], 4
call edx
add eax, 0x10
mov dword [esi + 0x38], eax
mov eax, dword [0x44a334]
mov edx, dword [eax + 0xc]
mov ecx, 0x44a334
mov byte [esp + 0x18], 5
call edx
add eax, 0x10
mov dword [esi + 0x3c], eax
mov dword [esi + 0xc], edi
mov dword [esi + 0x14], edi
mov eax, dword [esi + 0x1c]
cmp eax, edi
mov byte [esp + 0x18], 6
je 0x401f73
mov dword [esi + 0x1c], edi
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [0x44a0ac], edi
mov dword [esi + 0x2c], edi
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x401fa0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x44a0ac]
test eax, eax
push esi
push edi
mov esi, ecx
je 0x401fb6
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x3c]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401fd5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x38]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401ff4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x34]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402013
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x30]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402032
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x402041
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi + 0x18]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x402058
push eax
call edi
mov dword [esi + 0x18], 0
mov eax, dword [esi + 8]
test eax, eax
je 0x402069
push eax
call edi
mov dword [esi + 8], 0
pop edi
pop esi
ret
Function at 0x402070
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x4385db
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x448270]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
push edi
mov eax, dword [0x448270]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
push str.antivirusFileGuardNT.dll
push eax
mov edi, ecx
call fcn.0040e5d0
add esp, 8
xor ebx, ebx
cmp dword [edi + 0x18], ebx
lea esi, [edi + 0x18]
mov dword [esp + 0x228], ebx
jne 0x402166
mov ecx, dword [esp + 0x10]
push 8
push ebx
push ecx
call dword [0x449f04]
xor edx, edx
cmp eax, ebx
setne dl
mov dword [esi], eax
mov eax, edx
cmp eax, ebx
jne 0x402166
push 0x103
lea eax, [esp + 0x19]
push ebx
push eax
mov byte [esp + 0x20], bl
call fcn.004141c0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1c]
push 0x43c4cc
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x228], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40215c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
jmp 0x402214
lea ecx, [edi + 0x14]
push ecx
push 0x43c4bc
push 0x43c4ac
mov ecx, esi
call fcn.00401c50
mov esi, eax
cmp esi, ebx
je 0x4021e4
push 0x103
lea edx, [esp + 0x11d]
push ebx
push edx
mov byte [esp + 0x124], bl
call fcn.004141c0
push esi
lea eax, [esp + 0x128]
push str.CFileNotifySink::LoadFileGuarderDll_CreateInstance_Fail__x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x228], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x402150
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [edi + 0x24], ebx
mov dword [esp + 0x228], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402212
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00413d5c
add esp, 0x21c
ret
Function at 0x402240
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x438620
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x448270]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x448270]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [0x44a334]
mov edx, dword [eax + 0xc]
mov edi, ecx
mov ecx, 0x44a334
mov dword [esp + 0x14], edi
call edx
add eax, 0x10
mov dword [edi], eax
mov ebp, dword [esp + 0x44]
xor ecx, ecx
cmp ebp, ecx
mov dword [esp + 0x38], ecx
jle 0x4023e3
mov ax, word [esp + 0x40]
cmp ax, cx
mov word [esp + 0x18], ax
mov word [esp + 0x1a], cx
lea esi, [ecx + 1]
je 0x4022cf
lea esi, [esp + 0x18]
lea edx, [esi + 2]
lea esp, [esp]
mov ax, word [esi]
add esi, 2
cmp ax, cx
jne 0x4022c0
sub esi, edx
sar esi, 1
mov dword [esp + 0x1c], ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
cmp edx, ecx
mov byte [esp + 0x38], 1
ja 0x4022eb
cmp eax, 0xffffffff
jbe 0x4022f5
push 0x80070057
call fcn.00401000
cmp eax, 0xa
jbe 0x402306
push eax
lea ecx, [esp + 0x20]
call fcn.00404ac0
jmp 0x40230e
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esi + esi + 2]
push edx
push eax
call fcn.00413680
push eax
call fcn.00401020
mov eax, dword [edi]
mov edx, dword [eax - 8]
mov ebx, esi
imul ebx, ebp
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
sub edx, ebx
add esp, 0x14
or ecx, edx
jge 0x402350
push ebx
mov ecx, edi
call fcn.004012e0
cmp esi, 1
mov edi, dword [edi]
jne 0x40237a
test ebp, ebp
mov eax, dword [esp + 0x1c]
movzx eax, word [eax]
jle 0x4023aa
mov dx, ax
mov ecx, ebp
shl edx, 0x10
mov dx, ax
shr ecx, 1
mov eax, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x4023aa
test ebp, ebp
mov ecx, edi
jle 0x4023aa
xor eax, eax
test esi, esi
jle 0x4023a5
jmp 0x402390
mov edx, dword [esp + 0x1c]
mov dx, word [edx + eax*2]
mov word [ecx], dx
add eax, 1
add ecx, 2
cmp eax, esi
jl 0x402390
sub ebp, 1
jne 0x402380
test ebx, ebx
jl 0x4022eb
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
cmp ebx, dword [eax - 8]
jg 0x4022eb
mov dword [eax - 0xc], ebx
mov eax, dword [ecx]
lea ecx, [esp + 0x20]
mov word [eax + ebx*2], 0
cmp dword [esp + 0x1c], ecx
je 0x4023df
lea ecx, [esp + 0x1c]
call fcn.00404ab0
mov edi, dword [esp + 0x14]
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00413d5c
add esp, 0x28
ret 8