joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415dd0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov cl, byte [esi + 0xd9]
xor eax, eax
cmp cl, al
je 0x415e2c
push 0x464124
push eax
push esi
push 0x4052c0
mov byte [esi + 0xd9], al
push eax
push 0x464128
mov byte [0x464146], al
mov dword [0x464128], 0xc
mov dword [0x46412c], eax
mov dword [0x464130], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x100
push eax
mov dword [0x464120], eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 5
mov ecx, esi
call fcn.0043cdf8
pop esi
ret

Function at 0x416880
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x44bef0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, ecx
lea eax, [esp + 0x38]
push eax
lea ecx, [esi + 0x18]
mov dword [esp + 0x34], 0
call fcn.0041c340
push str..TempFile
lea ecx, [esp + 8]
call fcn.0041c370
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x3c], 1
call fcn.00416240
lea ecx, [esp + 4]
mov byte [esp + 0x30], 3
call fcn.0041c1c0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041c2d0
lea edx, [esp + 0x10]
push edx
lea ecx, [esi + 0x24]
mov byte [esp + 0x34], 4
call fcn.0041c340
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.0041c1c0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.0041c1c0
lea ecx, [esp + 0x38]
mov dword [esp + 0x30], 0xffffffff
call fcn.0041c1c0
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc

Function at 0x4174a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44c0ab
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
push 0x20
mov dword [esp + 0x24], 0
call fcn.00440dbc
add esp, 4
mov dword [esp + 8], eax
test eax, eax
mov byte [esp + 0x20], 1
je 0x4174e6
mov ecx, eax
call fcn.0041cdc0
mov edi, eax
jmp 0x4174e8
xor edi, edi
sub esp, 0xc
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov byte [esp + 0x30], 0
call fcn.0041c2d0
mov ecx, edi
call fcn.0041d3c0
mov al, byte [esi + 0x10]
test al, al
jne 0x41752c
sub esp, 0xc
lea edx, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.0041c2d0
mov ecx, esi
call fcn.00416880
mov byte [esi + 0x11], 1
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x14], esp
push eax
mov ecx, edi
call fcn.0041ce90
mov ecx, esi
call fcn.00416e80
test edi, edi
je 0x417550
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx]
push 0xf
push 4
sub esp, 0xc
mov eax, esp
mov dword [esp + 0x1c], esp
push 0
push eax
call fcn.0040b590
add esp, 8
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00417220
lea edx, [esp + 0xc]
push edx
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 2
call fcn.0041c340
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.0041c1c0
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0xffffffff
call fcn.0041c1c0
mov ecx, dword [esp + 0x18]
pop edi
mov al, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x1c
ret 0xc
Function at 0x417a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44c1c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
push esi
mov ebp, ecx
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x30], 0
call fcn.0040ce50
add esp, 8
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.0041c1b0
sub eax, 2
push eax
push 2
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041c540
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 2
call fcn.0041c340
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 1
call fcn.0041c1c0
push esi
mov ecx, ebp
call fcn.004177c0
mov esi, eax
cmp esi, 0xffffffff
jne 0x417b02
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.0041c1c0
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], esi
call fcn.0041c1c0
pop esi
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
mov eax, dword [ebp + 0x18]
add eax, 8
test esi, esi
jl 0x417bc4
cmp esi, dword [eax + 8]
jge 0x417bc4
mov ecx, dword [eax + 4]
push edi
lea edi, [esi + esi*2]
lea edx, [esp + 0xc]
shl edi, 2
add ecx, edi
push edx
call fcn.0041c340
push 0x4513dc
lea ecx, [esp + 0x1c]
call fcn.0041c370
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x10]
add eax, 8
cmp esi, ecx
mov byte [esp + 0x2c], 3
jge 0x417bbf
mov eax, dword [eax + 4]
lea ecx, [esp + 0x18]
add eax, edi
push ecx
mov ecx, eax
call fcn.0041c5d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 1
call fcn.0041c1c0
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x10]
add eax, 8
cmp esi, ecx
jge 0x417bbf
mov eax, dword [eax + 4]
add eax, edi
lea edx, [esp + 0x38]
push edx
mov ecx, eax
call fcn.0041c5d0
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.0041c1c0
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0041c1c0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
call fcn.0043b2cd
call fcn.0043b2cd
int3
Function at 0x419d50
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x44c66e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x81c
push esi
push edi
mov edi, ecx
mov eax, dword [esp + 0x838]
lea edx, [esp + 0x24]
mov dword [esp + 0x82c], 0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x419d87
lea esi, [esp + 0x24]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x419d98
sub esi, ecx
test esi, esi
jle 0x419db2
mov al, 0x5c
cmp byte [esp + esi + 0x24], al
je 0x419db2
dec esi
test esi, esi
jg 0x419da7
lea eax, [esp + 0x834]
push eax
lea ecx, [esp + 0xc]
inc esi
call fcn.0041c2d0
push 1
sub esp, 0xc
mov edx, esp
mov dword [esp + 0x24], esp
lea ecx, [esi - 1]
push ecx
push 1
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x848], 1
call fcn.0041c540
mov ecx, edi
call fcn.00419ae0
lea ecx, [esp + 8]
call fcn.0041c1b0
sub eax, esi
push eax
inc esi
push esi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.0041c540
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x830], 2
call fcn.0041c340
lea ecx, [esp + 0x18]
mov byte [esp + 0x82c], 1
call fcn.0041c1c0
mov ecx, dword [esp + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 8]
mov byte [esp + 0x82c], 0
call fcn.0041c1c0
lea ecx, [esp + 0x834]
mov dword [esp + 0x82c], 0xffffffff
call fcn.0041c1c0
mov ecx, dword [esp + 0x824]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x828
ret 0xc

Function at 0x419e80
Capabilities:
Delete registry value

Disassembly:
push 0xffffffffffffffff
push 0x44c66e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x81c
push esi
push edi
mov edi, ecx
mov eax, dword [esp + 0x838]
lea edx, [esp + 0x24]
mov dword [esp + 0x82c], 0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x419eb7
lea esi, [esp + 0x24]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x419ec8
sub esi, ecx
test esi, esi
jle 0x419ee2
mov al, 0x5c
cmp byte [esp + esi + 0x24], al
je 0x419ee2
dec esi
test esi, esi
jg 0x419ed7
lea eax, [esp + 0x834]
push eax
lea ecx, [esp + 0xc]
inc esi
call fcn.0041c2d0
push 1
sub esp, 0xc
mov edx, esp
mov dword [esp + 0x24], esp
lea ecx, [esi - 1]
push ecx
push 1
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x848], 1
call fcn.0041c540
mov ecx, edi
call fcn.00419ae0
lea ecx, [esp + 8]
call fcn.0041c1b0
sub eax, esi
push eax
inc esi
push esi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.0041c540
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x830], 2
call fcn.0041c340
lea ecx, [esp + 0x18]
mov byte [esp + 0x82c], 1
call fcn.0041c1c0
mov ecx, dword [esp + 0xc]
mov edx, dword [edi + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 8]
mov byte [esp + 0x82c], 0
call fcn.0041c1c0
lea ecx, [esp + 0x834]
mov dword [esp + 0x82c], 0xffffffff
call fcn.0041c1c0
mov ecx, dword [esp + 0x824]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x828
ret 0xc
Function at 0x419fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x44c6a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa34
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0xc], ebx
mov eax, dword [ecx + 8]
cmp eax, ebx
mov edi, 1
mov dword [esp + 0xa48], edi
jne 0x419ffc
mov esi, dword [esp + 0xa50]
push 0x44f6bf
mov ecx, esi
call fcn.0041c370
jmp 0x41a046
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0xa60]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
push eax
mov dword [esp + 0x28], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov esi, dword [esp + 0xa50]
mov ecx, esi
jne 0x41a03c
lea eax, [esp + 0x18]
push eax
call fcn.0041c370
jmp 0x41a046
push 0x44f6bf
call fcn.0041c370
lea ecx, [esp + 0xa54]
mov dword [esp + 0xc], edi
mov byte [esp + 0xa48], bl
call fcn.0041c1c0
mov ecx, dword [esp + 0xa40]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xa40
ret 0x10

Function at 0x41a080
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44c6d0
push eax
mov dword fs:[0], esp
push ebp
push esi
push edi
mov ebp, ecx
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esp + 0x14], 1
je 0x41a103
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x28]
call fcn.0041c1b0
push eax
mov eax, dword [ebp + 8]
push esi
push 1
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41a103
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], al
call fcn.0041c1c0
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041c1c0
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
add esp, 0xc
ret 0x18
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 0
call fcn.0041c1c0
lea ecx, [esp + 0x28]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041c1c0
mov ecx, dword [esp + 0xc]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebp
add esp, 0xc
ret 0x18

Function at 0x41a140
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44c6e8
push eax
mov dword fs:[0], esp
mov eax, dword [ecx + 8]
test eax, eax
je 0x41a19a
mov edx, dword [esp + 0x14]
push 4
lea ecx, [esp + 0x20]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41a19a
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
call fcn.0041c1c0
mov al, 1
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 8], 0xffffffff
call fcn.0041c1c0
mov ecx, dword [esp]
xor al, al
mov dword fs:[0], ecx
add esp, 0xc
ret 0x10
Function at 0x41e430
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44cfde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x451f38
mov dword [esi + 4], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 8], ebp
lea ecx, [esi + 0x1c]
mov dword [esp + 0x30], ebp
call fcn.0041c400
push 0x20
mov byte [esp + 0x34], 1
call fcn.00440dbc
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebp
mov byte [esp + 0x30], 2
je 0x41e497
mov ecx, eax
call fcn.0041cdc0
jmp 0x41e499
xor eax, eax
mov ecx, eax
mov byte [esp + 0x30], 1
mov dword [esi + 0x14], eax
call fcn.0041d130
cmp dword [esi + 4], ebp
je 0x41e4e4
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, ebp
jle 0x41e4d5
xor ebx, ebx
jmp 0x41e4c0
mov ecx, dword [esi + 4]
add ecx, ebx
call fcn.00420440
mov eax, dword [esi + 8]
inc edi
add ebx, 0x10
cmp edi, eax
jl 0x41e4c0
mov eax, dword [esi + 4]
push eax
call fcn.00440dec
add esp, 4
mov dword [esi + 4], ebp
mov edi, dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov dword [esi + 0xc], ebp
mov dword [esi + 8], ebp
call fcn.0041f180
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x1c]
mov byte [esp + 0x34], 6
call fcn.0041c340
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.0041c1c0
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 8]
cmp eax, ebp
jle 0x41e58b
xor ebx, ebx
lea esp, [esp]
test ebx, ebx
jl 0x41e5a2
cmp ebp, eax
jge 0x41e5a2
mov eax, dword [edi + 4]
add eax, ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.004226f0
mov edx, dword [esi + 8]
sub esp, 0x10
lea eax, [esp + 0x28]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x44], 7
mov dword [esp + 0x4c], edx
call fcn.004226f0
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, esi
call fcn.0041dbd0
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00420440
mov eax, dword [edi + 8]
inc ebp
add ebx, 0x10
cmp ebp, eax
jl 0x41e530
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 4
call fcn.0043b2cd
int3

Function at 0x41f930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44d2a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 8]
sub esp, 0x28
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov dword [esp + 0x40], 0
call fcn.0041e430
push edi
mov ecx, esi
call fcn.0041f650
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0041ddf0
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x28
Function at 0x422540
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44d789
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [esp + 0xc], 0
lea eax, [esp + 0x40]
mov ebx, 1
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], ebx
call fcn.0041c2d0
push 0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4522d8
mov byte [esp + 0x48], 2
call fcn.0041c370
lea ecx, [esp + 0x24]
call fcn.0041c250
push 0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4522dc
mov edi, eax
call fcn.0041c370
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 3
call fcn.0041c1b0
dec eax
push eax
push 2
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x30]
call fcn.0041c540
mov ecx, eax
mov byte [esp + 0x44], 5
call fcn.0041c250
lea ecx, [esp + 0x20]
mov esi, eax
mov byte [esp + 0x34], 2
call fcn.0041c1c0
inc esi
cmp edi, ebx
jl 0x42260f
cmp esi, ebx
jl 0x42260f
sub esi, edi
dec esi
push esi
mov esi, dword [esp + 0x40]
inc edi
push edi
push esi
lea ecx, [esp + 0x20]
call fcn.0041c540
jmp 0x42261f
mov esi, dword [esp + 0x3c]
push 0x44f6bf
mov ecx, esi
call fcn.0041c370
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], bl
mov dword [esp + 0xc], ebx
call fcn.0041c1c0
lea ecx, [esp + 0x40]
mov byte [esp + 0x34], 0
call fcn.0041c1c0
mov ecx, dword [esp + 0x2c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x422770
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x44d831
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push 0x4522dc
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.0041c370
mov eax, dword [esi]
push eax
lea eax, [esp + 0x1c]
mov ebx, 1
push eax
mov dword [esp + 0x34], ebx
call fcn.00420450
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 2
call fcn.0041c5d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0041c1c0
push 0x4522d8
lea ecx, [esp + 0x1c]
call fcn.0041c370
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 3
call fcn.0041c5d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0041c1c0
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.004226d0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 4
call fcn.0041c5d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0041c1c0
push 0x4522e0
lea ecx, [esp + 0x1c]
call fcn.0041c370
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 5
call fcn.0041c5d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0041c1c0
mov esi, dword [esi]
lea ecx, [esp + 0x18]
push esi
push ecx
call fcn.00420450
add esp, 8
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 6
call fcn.0041c5d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0041c1c0
push 0x4522d8
lea ecx, [esp + 0x1c]
call fcn.0041c370
lea edx, [esp + 0x18]
mov byte [esp + 0x2c], 7
push edx
lea ecx, [esp + 0x10]
call fcn.0041c5d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], bl
call fcn.0041c1c0
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.0041c2d0
lea ecx, [esp + 0xc]
mov dword [esp + 8], ebx
mov byte [esp + 0x2c], 0
call fcn.0041c1c0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x422f60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x44d950
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push esi
push edi
mov esi, ecx
push 0x4524a8
lea ecx, [esp + 0x10]
call fcn.0041c370
lea eax, [esp + 0x24]
push 6
push eax
mov dword [esp + 0x4c], 0
call fcn.0041b820
add esp, 8
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
mov byte [esp + 0x50], 1
call fcn.00422bb0
lea edi, [esi + 0xc8]
push eax
mov ecx, edi
mov byte [esp + 0x48], 2
call fcn.0041c340
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 1
call fcn.0041c1c0
lea ecx, [esp + 0x24]
mov byte [esp + 0x44], 0
call fcn.0041c1c0
lea ecx, [esp + 0xc]
mov dword [esp + 0x44], 0xffffffff
call fcn.0041c1c0
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x14], esp
push edi
call fcn.0041c2d0
lea eax, [esp + 0x3c]
push eax
call fcn.00404890
add esp, 0x10
push eax
mov ecx, edi
mov dword [esp + 0x48], 3
call fcn.0041c340
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 0xffffffff
call fcn.0041c1c0
mov eax, dword [esp + 0x4c]
mov edx, dword [esi]
push eax
push 0x85
mov ecx, esi
mov byte [esi + 0x108], 0
call dword [edx + 0x134]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x40
ret 4
Function at 0x424b96
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x424be9
call fcn.00446a4b
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x424be9
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x424bdf
xor eax, eax
jmp 0x424d02
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x424c19
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x424c19
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x424cff
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x424c46
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.00425ad5
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x424cff
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x424c8f
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x424c8f
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x424c89
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.00425ad5
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x424cef
and dword [ebp + 0xc], 0
jmp 0x424cef
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x424cef
push 0xc
call fcn.00440dbc
mov esi, eax
test esi, esi
pop ecx
je 0x424cd1
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x424cd3
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x424cea
push dword [ebp - 8]
call fcn.0043bc89
jmp 0x424cef
call fcn.0043bc60
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x424c54
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42eaea
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0042e100
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42eb85
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x479540]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x42eb85
cmp eax, 1
je 0x42eba6
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42eb85
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x42eb52
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x42eb81
xor eax, eax
inc eax
jmp 0x42ebc5
cmp edi, eax
jae 0x42eb89
xor eax, eax
jmp 0x42ebc5
cmp eax, esi
jae 0x42eb90
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x479540]
jmp 0x42eba9
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret