joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fc90
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x14]
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, 0xc350
push edi
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
jle 0x41fcbe
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov edx, dword [0xa04c60]
lea eax, [eax + eax*4]
push ebp
push ebp
mov ecx, dword [eax*8 + 0x81c7e4]
lea esi, [eax*8 + 0x81c7e0]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 0xc]
push eax
call fcn.00492d06
mov ebx, eax
add esp, 4
cmp ebx, ebp
jne 0x41fcfb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov ecx, 0x100
xor eax, eax
mov edi, 0xc1de24
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
rep stosd dword es:[edi], eax
mov edx, dword [esi + 8]
mov eax, dword [0xa04c60]
lea ecx, [esp + 0x28]
add edx, 4
push ecx
push edx
push 0xc1de24
push eax
call ebp
test eax, eax
je 0x41fd3d
mov eax, dword [esp + 0x24]
xor edi, edi
cmp eax, edi
jne 0x41fd3f
mov dword [esp + 0x10], edi
jmp 0x41fd3f
xor edi, edi
mov edx, dword [esi + 0xc]
mov eax, dword [0xa04c60]
lea ecx, [esp + 0x24]
push edi
push ecx
push edx
push ebx
push eax
call ebp
test eax, eax
je 0x41fd5c
cmp dword [esp + 0x24], edi
je 0x41fd83
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push ecx
push eax
push ebx
mov dword [eax], 0x5ab7dc
call fcn.0048a550
add esp, 0x14
test eax, eax
jne 0x41fd87
mov dword [esp + 0x10], edi
push ebx
call fcn.00491fed
mov ebx, dword [esp + 0x3c]
add esp, 4
mov dword [ebx], edi
mov eax, dword [esi + 0x10]
cmp eax, edi
jbe 0x41fe13
push eax
call fcn.00492d06
mov edi, eax
add esp, 4
test edi, edi
jne 0x41fdb4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esi + 0x10]
mov ecx, dword [0xa04c60]
lea edx, [esp + 0x24]
push 0
push edx
push eax
push edi
push ecx
call ebp
test eax, eax
je 0x41fdd5
mov eax, dword [esp + 0x24]
test eax, eax
je 0x41fdfc
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x20]
push ecx
push edx
push eax
push edi
mov dword [eax], 0xc1e224
call fcn.0048a550
add esp, 0x14
test eax, eax
jne 0x41fe04
mov dword [esp + 0x10], 0
push edi
call fcn.00491fed
add esp, 4
mov dword [ebx], 1
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x43e1d0
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 8], 0
mov eax, ecx
inc eax
cmp eax, 0x64
mov ecx, eax
jge 0x43e256
mov edx, dword [0x4b9fec]
lea edx, [edx + edx*2 - 2]
cmp eax, edx
jle 0x43e21c
push str.lsgen:_badly_configured_work_buflen_n
push 0x4d71c0
call fcn.004925be
add esp, 8
push 1
call fcn.00492872
mov edx, eax
and edx, reloc.DSOUND.dll_DirectSoundCreate
jns 0x43e22b
dec edx
or edx, 0xfffffffe
inc edx
cmp edx, 1
jne 0x43e233
lea ecx, [eax + 1]
mov edx, dword [0x4ba010]
mov byte [edx], cl
mov edx, dword [0x4ba010]
mov ecx, eax
lea edi, [edx + 1]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x43e299
mov edx, eax
and edx, reloc.DSOUND.dll_DirectSoundCreate
jns 0x43e265
dec edx
or edx, 0xfffffffe
inc edx
jne 0x43e26a
lea ecx, [eax + 1]
mov eax, dword [0x4ba010]
mov edi, esi
mov byte [eax], cl
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x4ba010]
repne scasb al, byte es:[edi]
mov eax, dword [0x4b9fec]
not ecx
dec ecx
inc edx
push ecx
lea ecx, [eax + eax*2 - 1]
push esi
push ecx
push edx
call fcn.0043e930
add esp, 0x10
inc eax
test eax, eax
jg 0x43e2b9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push 0x4ba3b4
push ecx
call fcn.0043dc40
add esp, 0xc
pop edi
pop esi
pop ecx
ret
mov esi, dword [0x4ba010]
mov edi, dword [0x4ba008]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4b9fec]
lea ecx, [ecx + ecx*2 - 1]
push ecx
mov ecx, dword [0x4ba00c]
push edx
mov edx, dword [0x4ba008]
push ecx
push 0x3123d13
push eax
push edx
call fcn.0043e6c0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
mov edx, dword [0x4ba00c]
push eax
push ecx
push edx
call fcn.0043e410
add esp, 0x24
pop edi
pop esi
pop ecx
ret
Function at 0x43f830
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4560210]
sub esp, 0x10
push esi
push edi
push eax
call fcn.00491a50
mov eax, dword [0x54a90c]
mov esi, dword [0x4560210]
add esp, 4
mov ecx, dword [eax + 0x8c]
mov edx, dword [eax + 0x88]
neg esi
push ecx
push edx
sbb esi, esi
push 0
lea eax, [esp + 0x14]
and esi, 0x70ca0000
push 0
push eax
add esi, 0x90000000
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0
lea ecx, [esp + 0x10]
push esi
push ecx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [0x45600f4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x43f8db
mov edx, dword [0x45600f8]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push 0
push edx
mov edx, dword [esp + 0x14]
sub eax, edx
mov edx, dword [esp + 0x10]
push 0
push 0
sub ecx, edx
push eax
push ecx
push 0
push 0
push esi
push 0x4b88c4
push 0x4b88c4
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x45600f4], eax
jmp 0x43f91e
push esi
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edx, dword [0x45600f0]
mov eax, dword [0x45600f4]
push edx
push eax
call edi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov eax, dword [0x45600f4]
sub ecx, edx
mov edx, dword [esp + 0x10]
push 0x20
sub edx, esi
push ecx
push edx
push 0
push 0
push 0xfffffffffffffffe
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [0x45600f0]
mov edx, dword [0x45600f4]
push ecx
push edx
call edi
mov eax, dword [0x45600f4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4419b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
xor ecx, ecx
test esi, esi
jle 0x4419f2
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xffff
shr ebx, 8
movzx dx, byte [edx + 0x4bb454]
xor dx, word [ebx*2 + 0x4bb554]
xor ebx, ebx
mov bh, al
xor edx, ebx
inc ecx
cmp ecx, esi
mov eax, edx
jl 0x4419c3
pop edi
pop ebx
pop esi
ret

Function at 0x445070
Capabilities:
Check for time delay via gettickcount

Disassembly:
call fcn.00445100
call fcn.004452f0
call fcn.00445650
call fcn.00446320
call fcn.00446b30
call fcn.00446e80
cmp dword [0x456b178], 2
jne 0x4450d3
mov eax, dword [0x45829a8]
test eax, eax
jne 0x4450ac
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x45829a8], eax
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x45829a8]
cmp eax, 0x9c4
jbe 0x4450d3
mov dword [0x456b178], 0
mov dword [0x45829a8], 0
ret
Function at 0x449e00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x9a74
call fcn.00492d80
mov eax, dword [esp + 0x9a7c]
push ebx
push ebp
push esi
push edi
push 0x49e468
push eax
call fcn.00492394
mov edi, eax
xor ebx, ebx
add esp, 8
cmp edi, ebx
mov dword [esp + 0x10], edi
jne 0x449e3c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x9a74
ret
mov ebp, dword [esp + 0x9a88]
push edi
push 1
lea ecx, [esp + 0x1c]
push 0x10
push ecx
call fcn.0049212c
add esp, 0x10
cmp eax, 1
jb 0x449ef0
xor ecx, ecx
mov eax, 0x4c107c
mov dl, byte [eax]
add eax, 4
xor byte [esp + ecx + 0x14], dl
inc ecx
cmp eax, 0x4c10bc
jl 0x449e65
movsx eax, byte [esp + 0x23]
lea esi, [esp + 0x14]
mov byte [esp + eax + 0x14], bl
mov eax, ebp
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x449ea9
cmp cl, bl
je 0x449ea5
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x449ea9
add eax, 2
add esi, 2
cmp cl, bl
jne 0x449e85
xor eax, eax
jmp 0x449eae
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x449ed4
mov eax, dword [esp + 0x9a90]
push 1
lea eax, [eax + eax*4]
shl eax, 4
push eax
push edi
call fcn.004920a0
add esp, 0xc
test eax, eax
jne 0x449ef0
jmp 0x449e43
mov esi, dword [esp + 0x9a90]
push edi
push esi
lea ecx, [esp + 0x2c]
push 0x50
push ecx
call fcn.0049212c
add esp, 0x10
cmp eax, esi
jae 0x449f06
push edi
call fcn.00492214
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9a74
ret
xor ebp, ebp
cmp esi, ebx
jbe 0x449f49
cmp ebx, 0x8980
jl 0x449f1c
cmp ebx, 0x9010
jle 0x449f41
lea esi, [esp + ebx + 0x24]
lea edi, [ebx + 0x45837c8]
mov ecx, 0x14
push ebp
rep movsd dword es:[edi], dword [esi]
call fcn.00449910
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x9a94]
add esp, 4
inc ebp
add ebx, 0x50
cmp ebp, esi
jb 0x449f0c
push edi
call fcn.00492214
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9a74
ret
Function at 0x449f70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x26d4
call fcn.00492d80
push ebx
push ebp
push esi
push edi
push 0x49e468
push str.data_album.dat
call fcn.00492394
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x10], edi
jne 0x449fa5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26d4
ret
mov ebp, dword [esp + 0x26e8]
push edi
push 1
lea eax, [esp + 0x1c]
push 0x10
push eax
call fcn.0049212c
add esp, 0x10
cmp eax, 1
jb 0x44a056
xor ecx, ecx
mov eax, 0x4c107c
mov dl, byte [eax]
mov bl, byte [esp + ecx + 0x14]
xor bl, dl
add eax, 4
mov byte [esp + ecx + 0x14], bl
inc ecx
cmp eax, 0x4c10bc
jl 0x449fce
movsx eax, byte [esp + 0x23]
lea esi, [esp + 0x14]
mov byte [esp + eax + 0x14], 0
mov eax, ebp
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44a01d
test cl, cl
je 0x44a019
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44a01d
add eax, 2
add esi, 2
test cl, cl
jne 0x449ff5
xor eax, eax
jmp 0x44a022
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44a03f
push 1
push 0x26c0
push edi
call fcn.004920a0
add esp, 0xc
test eax, eax
jne 0x44a056
jmp 0x449fac
push edi
push 0x7c
lea eax, [esp + 0x2c]
push 0x50
push eax
call fcn.0049212c
add esp, 0x10
cmp eax, 0x7c
jae 0x44a06c
push edi
call fcn.00492214
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26d4
ret
mov edx, dword [0x45e7af4]
lea ebp, [esp + 0x48]
mov ebx, 0x7c
xor eax, eax
test edx, edx
jle 0x44a0db
mov esi, dword [ebp + 0x28]
mov ecx, 0x4bd450
test esi, esi
je 0x44a0db
mov edi, dword [ebp]
cmp edi, dword [ecx]
je 0x44a0a2
mov edi, dword [esp + 0x10]
inc eax
add ecx, 0x1c
cmp eax, edx
jl 0x44a089
jmp 0x44a0db
lea ecx, [eax*8]
lea esi, [ebp - 0x24]
sub ecx, eax
mov eax, dword [ecx*4 + 0x4bd438]
mov ecx, 0x14
push eax
lea edi, [eax + eax*4]
shl edi, 4
add edi, 0x45837c8
rep movsd dword es:[edi], dword [esi]
call fcn.00449910
mov edx, dword [0x45e7af4]
mov edi, dword [esp + 0x14]
add esp, 4
add ebp, 0x50
dec ebx
jne 0x44a07b
push edi
call fcn.00492214
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26d4
ret

Function at 0x44b080
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x4630b48]
mov byte [0x4630c90], 0
test eax, eax
je 0x44b0a5
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x4630b48]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x45c680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb8
mov al, byte [0x4e220c]
push edi
mov byte [esp + 0x3c], al
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x3d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x45e12c0]
test eax, eax
jne 0x45c6d5
push eax
mov eax, dword [0x45f1a4c]
cdq
sub eax, edx
push 2
sar eax, 1
add eax, 2
push eax
push 7
push 0x64
push 0x78
call fcn.00448610
add esp, 0x18
mov dword [0x45e12c0], eax
pop edi
add esp, 0xb8
ret
mov ecx, dword [eax + 0x78]
test ecx, ecx
jle 0x45c81f
push ebx
mov ebx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
push ebp
push esi
mov ecx, 0xb
mov esi, str.__________
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
push 0
mov dword [esp + 0x18], eax
push ecx
push 4
add eax, 0xf
lea ebp, [ebx + 0xa]
push 1
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.0041d860
mov eax, dword [0x45f1a4c]
add esp, 0x18
xor edi, edi
test eax, eax
jle 0x45c7ce
mov edx, dword [esp + 0x14]
mov dword [esp + 0x10], 0x45e9340
mov ebx, 0x45e64ec
lea esi, [edx + 0x3a]
push 0
push ebx
push 5
lea eax, [esi - 0x12]
push 1
push eax
push ebp
call fcn.0041d860
mov ecx, dword [esp + 0x30]
push 0x6b
push esi
lea edx, [esi - 0x15]
lea eax, [ecx + 0x140]
push eax
push edx
push ebp
call fcn.0044aba0
add esp, 0x2c
test eax, eax
je 0x45c7ab
test byte [0x45f1bc4], 1
je 0x45c7ab
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x48]
mov ecx, dword [eax]
push ecx
push str.J_d
push edx
call fcn.004923a7
mov ecx, dword [0x461b404]
lea eax, [esp + 0x54]
push eax
push ecx
call fcn.00490290
add esp, 0x14
mov word [0x564e5e], 0
mov ecx, dword [esp + 0x10]
mov eax, dword [0x45f1a4c]
inc edi
add ebx, 0x40
add esi, 0x14
add ecx, 4
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x45c73f
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea edx, [edi + edi*4]
push 0
push 0x4c2334
lea esi, [eax + edx*4]
push 5
lea edi, [ebx + 0x1e]
push 1
lea ecx, [esi + 0x32]
push ecx
push edi
call fcn.0041d860
lea edx, [esi + 0x44]
push 0x6b
add ebx, 0x154
push edx
add esi, 0x2f
push ebx
push esi
push edi
call fcn.0044aba0
add esp, 0x2c
test eax, eax
pop esi
pop ebp
pop ebx
je 0x45c81f
test byte [0x45f1bc4], 1
je 0x45c81f
call fcn.0045c340
pop edi
add esp, 0xb8
ret
Function at 0x45d530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x88
mov al, byte [0x4e220c]
push ebx
push edi
mov byte [esp + 0x10], al
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x11]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x458f620]
cmp eax, ebx
jne 0x45d57f
push ebx
push 2
push 2
push 3
push ebx
push 0x10e
call fcn.00448610
add esp, 0x18
mov dword [0x458f620], eax
pop edi
pop ebx
add esp, 0x88
ret
cmp dword [eax + 0x78], ebx
jle 0x45d669
mov edi, dword [eax + 0x1c]
push esi
mov esi, dword [eax + 0x18]
push ebx
push 0x45e19c0
push 5
lea ecx, [edi + 0x1e]
push 1
lea edx, [esi + 0x14]
push ecx
push edx
call fcn.0041d860
push 2
add edi, 0x3c
push 0x65eb
push 0x69
lea eax, [esi + 0x5a]
push edi
push eax
call fcn.0047e210
push 2
push 0x65ec
push 0x69
add esi, 0x64
push edi
push esi
mov dword [esp + 0x4c], eax
call fcn.0047e210
add esp, 0x40
mov dword [esp + 0x10], eax
xor esi, esi
mov ecx, dword [0x45f1bf0]
mov eax, dword [esp + esi*4 + 0xc]
cmp ecx, eax
jne 0x45d65e
test byte [0x45f1bc4], 1
je 0x45d65e
cmp esi, ebx
jne 0x45d61b
mov edx, dword [0x45f1a50]
lea eax, [esp + 0x14]
push edx
push str.A_d1
push eax
call fcn.004923a7
mov edx, dword [0x461b404]
lea ecx, [esp + 0x20]
push ecx
push edx
jmp 0x45d63b
mov eax, dword [0x45f1a50]
lea ecx, [esp + 0x14]
push eax
push str.A_d0
push ecx
call fcn.004923a7
mov eax, dword [0x461b404]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00490290
mov ecx, dword [0x458f620]
add esp, 0x14
push ecx
call fcn.004011c0
add esp, 4
mov dword [0x458f620], ebx
mov byte [0x45f1a3b], bl
inc esi
cmp esi, 2
jl 0x45d5dc
pop esi
pop edi
pop ebx
add esp, 0x88
ret
Function at 0x45ebd0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x45ebf2
xor eax, eax
add esp, 0x190
ret
mov ecx, dword [0x461b404]
push ecx
push 0x4000
push fcn.0045ece0
call fcn.0043d7a0
add esp, 0xc
xor eax, eax
mov dword [0x461b420], eax
mov dword [0x461b424], eax
mov dword [0x461b3f8], 1
mov eax, 1
add esp, 0x190
ret
Function at 0x45fdc0
Capabilities:
Create thread

Disassembly:
cmp dword [0x461c000], 1
jne 0x45fead
push esi
push edi
mov edi, dword [esp + 0x10]
mov dword [0x461c000], 2
mov esi, str.successful
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45fe08
test cl, cl
je 0x45fe04
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45fe08
add eax, 2
add esi, 2
test cl, cl
jne 0x45fde4
xor eax, eax
jmp 0x45fe0d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x45fe43
mov eax, dword [0x461c00c]
test eax, eax
jne 0x45fe43
push 0x461b64c
push 0
push 0x461bf64
push 0x465900
push 0
push 0
mov word [0x461bffc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x461c00c], eax
mov esi, str.failed
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45fe6e
test cl, cl
je 0x45fe6a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45fe6e
add eax, 2
add esi, 2
test cl, cl
jne 0x45fe4a
xor eax, eax
jmp 0x45fe73
sbb eax, eax
sbb eax, 0xffffffff
pop edi
pop esi
test eax, eax
jne 0x45fe9c
mov eax, dword [0x461c00c]
test eax, eax
jne 0x45fe9c
mov eax, dword [esp + 0xc]
push eax
call fcn.004929fe
add esp, 4
cmp eax, 0xfffffe0a
jne 0x45fe9c
mov word [0x461bffc], ax
mov dword [0x564e70], 0
mov byte [0x564e74], 0
ret
Function at 0x47a3f0
Capabilities:
Inspect section memory permissions

Disassembly:
mov ax, word [0x4582a22]
mov cx, word [0x4582a28]
mov word [0x4582a24], ax
mov eax, dword [0x45e8ce0]
test eax, 0x40000000
mov word [0x4582a2a], cx
mov word [0x464f488], 0
mov dword [0x5ab6f8], 0
je 0x47a433
mov dword [0x45e19b0], 1
call fcn.0044aff0
call fcn.00418370
call fcn.004445c0
call fcn.00424f50
mov dword [0x5676b4], 0
call fcn.0041b870
call fcn.00401170
call fcn.0047e440
call fcn.00445070
call fcn.004419a0
call fcn.00440e90
call fcn.00410850
call fcn.004117e0
call fcn.0047d8c0
call fcn.00412a40
jmp fcn.0047dc60

Function at 0x47c4f0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
movsx eax, word [0x4630a88]
push eax
call fcn.0047c910
add esp, 4
call fcn.0047ca50
call fcn.0047cb00
call fcn.0047cb60
jmp fcn.0047c550

Function at 0x47c550
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov eax, 0x1024
call fcn.00492d80
mov eax, dword [0x455f8f8]
test eax, eax
je 0x47c60a
mov eax, dword [0x456021c]
push 0x455fa18
push eax
mov dword [0x455fa18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x47c600
mov ecx, dword [0x455fa20]
mov eax, dword [0x455f8f8]
cmp ecx, eax
je 0x47c5b8
mov edx, dword [0x456021c]
push 0x455fa18
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x47c600
mov eax, dword [0x455fa20]
mov ecx, dword [0x455f8f8]
cmp eax, ecx
jne 0x47c594
push str.explorer.exe
push 0x455fa3c
call fcn.00492020
add esp, 8
test eax, eax
jne 0x47c600
mov ecx, dword [0x455f8f8]
push ecx
push eax
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [0x4560220], eax
je 0x47c600
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x4560220]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x455f8f8], 0
push esi
push edi
mov ecx, 0x1f
mov esi, 0x463330c
lea edi, [esp + 0xc]
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push 0xfa0
lea ecx, [esp + 0x90]
movsw word es:[edi], word [esi]
push eax
push ecx
push 0
lea edx, [esp + 0x1c]
push 0x7f
push edx
movsb byte es:[edi], byte [esi]
call fcn.0048a2f0
push 0x4d1854
push 0x4d1840
call fcn.00492394
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x47c660
pop edi
pop esi
add esp, 0x1024
ret
mov eax, dword [esp + 8]
push esi
push eax
lea ecx, [esp + 0x94]
push 1
push ecx
call fcn.0049226a
mov ecx, dword [esp + 0x18]
add esp, 0x10
cmp eax, ecx
jae 0x47c68b
pop edi
xor eax, eax
pop esi
add esp, 0x1024
ret
push esi
call fcn.00492214
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x1024
ret
Function at 0x4813f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x4814b1
mov eax, dword [0x45600f8]
xor ebx, ebx
push ebx
push 0x4cb6d24
push 0x700
push eax
call sub.DINPUT.dll_DirectInputCreateA
test eax, eax
jne 0x4814b1
mov eax, dword [0x4cb6d24]
push ebx
push 0x4ebe424
push 0x49c4d0
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x481455
mov eax, dword [0x4cb6d24]
cmp eax, ebx
je 0x4814b1
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x4cb6d24], ebx
xor eax, eax
pop ebx
ret
mov eax, dword [0x4ebe424]
push 0x49c4f0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
mov eax, dword [0x4ebe424]
je 0x481474
cmp eax, ebx
je 0x48149c
jmp 0x481490
mov ecx, dword [0x45600f4]
mov edx, dword [eax]
push 6
push ecx
push eax
call dword [edx + 0x34]
test eax, eax
mov eax, dword [0x4ebe424]
je 0x4814b5
cmp eax, ebx
je 0x48149c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov dword [0x4ebe424], ebx
mov eax, dword [0x4cb6d24]
cmp eax, ebx
je 0x4814b1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x4cb6d24], ebx
xor eax, eax
pop ebx
ret
mov edx, dword [eax]
push eax
call dword [edx + 0x1c]
mov eax, dword [0x45600f8]
push ebx
push 0x4cb6d28
push 0x700
push eax
call sub.DINPUT.dll_DirectInputCreateA
test eax, eax
je 0x4814d9
xor eax, eax
pop ebx
ret
mov eax, 1
mov byte [0x4ebe4a8], bl
mov byte [0x4ebe4a9], al
pop ebx
ret
Function at 0x489070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov edx, dword [0x4d4adc]
mov eax, dword [str._base.bmp]
mov dword [esp + 0x18], edx
xor edx, edx
mov dword [esp + 0x1e], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x22], edx
mov ax, word [0x4d4ae0]
mov dword [esp + 0x26], edx
mov word [esp + 0x1c], ax
mov dword [esp + 0x2a], edx
mov eax, dword [str.up_arrow_g.bmp]
mov dword [esp + 0x2e], edx
mov dword [esp + 0x34], eax
mov word [esp + 0x32], dx
mov edx, dword [0x4d4acc]
mov dword [esp + 0x38], edx
mov edx, dword [0x4d4ad4]
mov dword [esp + 0x40], edx
mov edx, dword [str.up_arrow_r.bmp]
mov eax, dword [0x4d4ad0]
mov dword [esp + 0x54], edx
mov edx, dword [0x4d4ac0]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x5c], edx
xor edx, edx
mov dword [esp + 0x64], edx
xor eax, eax
mov dword [esp + 0x68], edx
mov dword [esp + 0x44], eax
mov dword [esp + 0x6c], edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x70], edx
mov edx, dword [0x4d4aa8]
mov dword [esp + 0x78], edx
mov edx, dword [0x4d4ab0]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x80], edx
mov dword [esp + 0x50], eax
mov eax, dword [0x4d4abc]
xor edx, edx
mov dword [esp + 0x58], eax
mov eax, dword [0x4d4ac4]
mov dword [esp + 0x86], edx
mov dword [esp + 0x8a], edx
mov dword [esp + 0x60], eax
mov eax, dword [str.down_arrow_g.bmp]
mov dword [esp + 0x8e], edx
mov dword [esp + 0x74], eax
mov eax, dword [0x4d4aac]
mov word [esp + 0x92], dx
mov edx, dword [0x4d4a94]
mov dword [esp + 0x7c], eax
mov ax, word [0x4d4ab4]
mov dword [esp + 0x98], edx
mov edx, dword [0x4d4a9c]
mov word [esp + 0x84], ax
mov eax, dword [str.down_arrow_r.bmp]
mov dword [esp + 0xa0], edx
xor edx, edx
mov dword [esp + 0x94], eax
mov eax, dword [0x4d4a98]
mov dword [esp + 0xa6], edx
mov dword [esp + 0xaa], edx
mov ebp, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x9c], eax
mov ax, word [0x4d4aa0]
mov dword [esp + 0xae], edx
mov dword [esp + 0x10], ecx
mov word [esp + 0xa4], ax
mov word [esp + 0xb2], dx
xor ebx, ebx
lea edi, [esp + 0x14]
lea esi, [ecx + 0xc]
mov eax, dword [esp + 0x138]
push edi
push eax
lea ecx, [esp + 0xbc]
push str._s_s
push ecx
call fcn.004923a7
add esp, 0x10
lea edx, [esp + 0xb4]
push 0x50
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
mov dword [esi], eax
je 0x489277
push 0
call ebp
mov dword [esi + 0x28], eax
mov ecx, dword [esi]
push ecx
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x14], eax
inc ebx
add esi, 4
add edi, 0x20
cmp ebx, 5
jl 0x4891eb
push 0
call ebp
mov esi, dword [esp + 0x10]
push 0x9b
push 0x285
mov edx, dword [esi + 0x34]
mov dword [esi + 0x48], eax
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x4c], eax
push eax
mov eax, dword [esi + 0x48]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0x50], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x124
ret 4

Function at 0x489810
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004117c0
ret 4