joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55ea60
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x290
mov eax, dword [0x5c5678]
xor eax, esp
mov dword [esp + 0x28c], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00545940
push 0x80
lea ebx, [esp + 0x20]
mov ecx, edi
call fcn.0055d990
lea eax, [esp + 0x1a0]
mov edx, edi
mov ecx, eax
add esp, 0x10
mov esi, 0x104
sub edx, ecx
lea esp, [esp]
lea ecx, [esi + 0x7ffffefa]
test ecx, ecx
je 0x55eacb
mov cl, byte [edx + eax]
test cl, cl
je 0x55eacb
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x55eab0
jmp 0x55eacf
test esi, esi
jne 0x55ead0
dec eax
lea edx, [esp + 0x10]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x198]
push eax
call fcn.0055d900
push 0xff
lea ecx, [esp + 0x95]
push 0
push ecx
mov dword [esp + 0x18], 1
mov byte [esp + 0x9c], 0
call fcn.00545940
add esp, 0xc
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x58d6e4
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x100
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x55ebab
mov ecx, edi
lea eax, [esp + 0x90]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x55eb73
test dl, dl
je 0x55eb6f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x55eb73
add eax, 2
add ecx, 2
test dl, dl
jne 0x55eb53
xor eax, eax
jmp 0x55eb78
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x55ebab
lea eax, [esp + 0x90]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x55eb86
sub eax, edx
push eax
lea edx, [esp + 0x94]
push edx
push 1
push str.mid_old
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
lea eax, [esp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x55ebb5
sub eax, edx
push eax
lea eax, [esp + 0x194]
push eax
push 1
push 0x58d6e4
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov ecx, dword [esp + 0x294]
pop esi
pop ebx
xor ecx, esp
call fcn.0053d78d
add esp, 0x290
ret

Function at 0x8ccba8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x8cc92e
add edx, edx
sub edx, 1
sub edi, edx
call fcn.008ccbec
add edi, edi
xor dword [eax], ecx
add edx, edx
sub edx, 0x54c8cb0f
sub edx, 0x897ec3b3
add eax, 1
sub edx, 1
or edx, edx
mov edx, edi
cmp eax, ebx
jne fcn.008ccba8
sub esp, 4
mov dword [esp], edx
pop edi
ret

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x51c643ff
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x53aa0efc
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ed0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x46c53089
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4cee395a
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403804
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x40382d
cmp al, 0x22
je 0x403825
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403819
cmp byte [esi], 0x22
jne 0x403837
inc esi
jmp 0x403837
cmp al, 0x20
jle 0x403837
inc esi
cmp byte [esi], 0x20
jg 0x403831
mov al, byte [esi]
test al, al
je 0x403841
cmp al, 0x20
jle 0x40382a
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004038af
push 0x405004
push section..data
call fcn.00403895
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x403871
movzx eax, word [ebp - 0x14]
jmp 0x403874
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004038c7
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x433f49
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0xc], 0
call fcn.004aba60
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0049196f
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43414c
mov eax, dword [0xb40414]
cmp dword [ebp + 8], eax
jne 0x434062
mov eax, dword [0xb40418]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0049196f
sub esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x433fc9
mov eax, dword [0xb40418]
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.00491f16
sub esp, 8
mov dword [ebp - 0x20], eax
jmp 0x433fca
nop
mov eax, dword [0xb40414]
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.00491f16
sub esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [0xb40414]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call fcn.004919fd
sub esp, 4
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 9
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [ebp - 0x34], eax
mov eax, dword [0xb40414]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call fcn.004919fd
sub esp, 4
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sub.USER32.dll_SetForegroundWindow
sub esp, 4
mov dword [ebp - 0x40], eax
mov eax, dword [0xb40414]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.00491ccf
sub esp, 4
mov dword [ebp - 0x48], eax
jmp 0x434063
nop
mov eax, dword [0xb40418]
cmp dword [ebp + 8], eax
jne 0x43414f
mov eax, dword [0xb40414]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call fcn.0049196f
sub esp, 4
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x4340b3
mov eax, dword [0xb40414]
mov dword [ebp - 0x54], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x54]
mov dword [esp], eax
call fcn.00491f16
sub esp, 8
mov dword [ebp - 0x58], eax
jmp 0x4340b4
nop
mov eax, dword [0xb40418]
mov dword [ebp - 0x5c], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call fcn.00491f16
sub esp, 8
mov dword [ebp - 0x60], eax
mov eax, dword [0xb40418]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call fcn.004919fd
sub esp, 4
mov dword [ebp - 0x68], eax
mov dword [esp + 4], 9
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [ebp - 0x6c], eax
mov eax, dword [0xb40418]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call fcn.004919fd
sub esp, 4
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sub.USER32.dll_SetForegroundWindow
sub esp, 4
mov dword [ebp - 0x78], eax
mov eax, dword [0xb40418]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call fcn.00491ccf
sub esp, 4
mov dword [ebp - 0x80], eax
jmp 0x434150
nop
jmp 0x434150
nop
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x4588dc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
call fcn.004aba60
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov eax, str.Kernel32
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleHandleW
sub esp, 4
mov dword [ebp - 0x18], eax
mov eax, 0xb336e0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateRemoteThread
sub esp, 0x1c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x45898b
mov dword [ebp - 0xc], 0
jmp 0x4589db
nop
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeThread
sub esp, 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
nop
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x458b61
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
call fcn.004aba60
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp + 8]
mov dword [esp], eax
call fcn.004abd50
sub esp, 8
mov ecx, 0
mov eax, 0x1c
and eax, 0xfffffffc
mov edx, eax
mov eax, 0
mov dword [ebp + eax - 0x48], ecx
add eax, 4
cmp eax, edx
jb 0x458b9c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.ADVAPI32.dll_OpenSCManagerW
sub esp, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x458c5a
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.dll_OpenServiceW
sub esp, 0xc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x458c40
lea eax, [ebp - 0x48]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.dll_QueryServiceStatus
sub esp, 8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.dll_CloseServiceHandle
sub esp, 4
mov dword [ebp - 0x28], eax
jmp 0x458c41
nop
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.dll_CloseServiceHandle
sub esp, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xc], eax
jmp 0x458c62
nop
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004abd20
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x459728
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
call fcn.004aba60
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
lea eax, [ebp + 0xc]
mov dword [esp], eax
call fcn.004abd50
sub esp, 8
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp + 0x10]
mov dword [esp], eax
call fcn.004abd50
sub esp, 8
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov edx, eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.ADVAPI32.dll_RegCreateKeyExW
sub esp, 0x24
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x45981e
mov eax, dword [ebp + 0x10]
mov ecx, eax
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp + 0x1c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 0x18]
mov dword [esp + 0x10], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.ADVAPI32.dll_RegSetValueExW
sub esp, 0x18
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.ADVAPI32.dll_RegCloseKey
sub esp, 4
mov dword [ebp - 0x20], eax
jmp 0x45981f
nop
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.004abd20
sub esp, 4
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004abd20
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret 0x18

Function at 0x45aae3
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
call fcn.004aba60
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x45ab6c
mov dword [esp + 4], 1
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateProcess
sub esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45ab58
mov dword [ebp - 0xc], 1
jmp 0x45ab59
nop
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [ebp - 0x20], eax
jmp 0x45ab6d
nop
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
nop
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x45e4cd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004abe40
sub esp, 4
call fcn.004aba60
mov dword [ebp - 0x3c], 0
mov eax, dword [0xb40a5c]
test eax, eax
jne 0x45e52b
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.USER32.dll_FindWindowW
sub esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [0xb40a60], eax
mov dword [0xb40a5c], 1
jmp 0x45e555
nop
mov eax, dword [0xb40a60]
mov dword [ebp - 0x14], eax
mov dword [esp + 4], 2
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.USER32.dll_GetWindow
sub esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [0xb40a60], eax
mov eax, dword [0xb40a60]
test eax, eax
je 0x45e650
mov eax, dword [0xb40a60]
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], 0xfffffff0
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.USER32.dll_GetWindowLongW
sub esp, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
and eax, 0x10000000
test eax, eax
je 0x45e64a
mov eax, dword [0xb40a60]
mov dword [ebp - 0x24], eax
mov dword [esp + 4], 0xffffffec
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.USER32.dll_GetWindowLongW
sub esp, 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
and eax, 0x80
test eax, eax
jne 0x45e64d
call fcn.004abac0
call fcn.004abac0
call fcn.004abb10
mov dword [esp + 4], eax
mov dword [esp], 0x100
call fcn.004a9a90
sub esp, 8
call fcn.004abb10
mov dword [esp + 4], eax
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call fcn.004abc90
sub esp, 8
mov eax, dword [0xb40a60]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], 0x100
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextW
sub esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], 0xb40a9c
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call fcn.004abda0
test eax, eax
je 0x45e66a
jmp 0x45e64e
nop
jmp 0x45e65b
nop
jmp 0x45e65b
nop
mov dword [0xb40a5c], 0
mov eax, dword [0xb40a60]
test eax, eax
je 0x45e66d
nop
jmp 0x45e4f4
nop
jmp 0x45e66e
nop
call fcn.004abac0
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004abde0
sub esp, 4
call fcn.004abc10
mov dword [ebp - 0xc], eax
nop
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004abd20
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret 4
Function at 0x46a380
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
lea eax, [esp + 8]
xor esi, esi
push eax
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push 0x1000
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
je 0x46a418
push edi
push 0xb4239c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0xb40b60]
test edi, edi
je 0x46a3ec
push ebx
push esi
lea ebx, [edi + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x46a3e5
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [edi]
push ebx
push 0xb40b60
call fcn.004ab25c
pop ecx
pop ecx
jmp 0x46a3e7
mov edi, dword [edi]
test edi, edi
jne 0x46a3bc
pop ebx
mov eax, dword [0xb3b1e4]
mov esi, eax
inc eax
push 0x10
push 0xb40b60
mov dword [0xb3b1e4], eax
call fcn.004ab29c
pop ecx
pop ecx
push 0xb4239c
mov dword [eax], ebp
mov dword [eax + 4], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x46a4dd
Capabilities:
Terminate thread

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
push edi
call fcn.0046a491
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ebx, 0xb4239c
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0xb40b60]
jmp 0x46a50e
cmp dword [esi + 0xc], edi
je 0x46a514
mov esi, dword [esi]
test esi, esi
jne 0x46a507
jmp 0x46a52c
add esi, 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0xb40b60
call fcn.004ab25c
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
ret 4
Function at 0x46aa71
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push ebx
push dword [0xb40b64]
xor ebp, ebp
mov edi, ebp
mov dword [esp + 0x18], ebp
call fcn.004aab27
mov esi, eax
test esi, esi
je 0x46ac06
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
cmp dword [esi + 0x14], ebp
je 0x46ab1b
push ebx
call fcn.0046ade1
jmp 0x46aab3
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], 0
jne 0x46aaab
push dword [esi + 0x14]
call fcn.0046b1eb
mov eax, dword [esp + 0x1c]
push ebp
push esi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
call fcn.0046a9fc
pop ecx
pop ecx
lea eax, [esp + 0x1c]
push eax
push ebp
push esi
push 0x46ac20
push 0x2000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x46aaf8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], 0xffffffff
je 0x46ab09
push dword [esp + 0x20]
push ebx
call fcn.0046aeb5
mov eax, dword [esi]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esi]
push 1
jmp 0x46abbb
test byte [esp + 0x1c], 1
je 0x46ab2a
mov dword [esp + 0x10], 1
test byte [esp + 0x1c], 2
je 0x46abc5
push esi
call fcn.0046a993
lea eax, [esi + 4]
push 0x10
push eax
call fcn.004ab29c
pop ecx
pop ecx
mov ecx, dword [0xb40b80]
mov edi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x14]
test eax, eax
jne 0x46ac06
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
mov byte [edi + 5], al
mov byte [edi + 4], 1
mov eax, dword [esp + 0x18]
push dword [esi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [esp + 0x18]
push dword [esi + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
cmp dword [esp + 0x20], 0xffffffff
je 0x46aba6
push edi
push dword [esp + 0x24]
push ebx
call fcn.0046ae15
jmp 0x46abb3
mov eax, dword [esp + 0x18]
push dword [esi + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x18]
push dword [esp + 0x10]
mov ecx, dword [eax]
push ebp
push ebp
push eax
call dword [ecx + 0x30]
jmp 0x46ac06
mov eax, dword [ecx]
push ecx
call dword [eax + 0x48]
mov eax, dword [esp + 0x18]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp dword [esp + 0x20], 0xffffffff
je 0x46abe7
push dword [esp + 0x20]
push ebx
call fcn.0046aeb5
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
push ebx
push ebp
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x46ac06
xor edi, edi
mov byte [esi + 0x1c], 1
inc edi
mov byte [esi + 0x1e], bl
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x46b32b
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x46b380
push dword [esp + 0x10]
push 0x46b2aa
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0xb40bac]
test esi, esi
je 0x46b3d9
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x46b378
cmp byte [esi + 0x10], 0
je 0x46b378
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x46b354
jmp 0x46b3d9
mov esi, dword [0xb40bac]
test esi, esi
je 0x46b3d9
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x46b3d2
cmp byte [esi + 0x11], 0
je 0x46b3ae
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x46b3c5
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0xb40bac
call fcn.004ab25c
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x46b38d
pop ebp
pop edi
pop esi
pop ebx
ret 4