joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4586a4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4586bb
add esp, 0xfffffff0
call fcn.0040358c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041aeb4
mov eax, dword [0x49fa14]
cmp word [eax + 2], 0
jne 0x4586e3
mov eax, dword [0x49fa14]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459d94
mov eax, dword [0x49fb04]
cmp word [eax + 2], 0
jne 0x4586fd
mov eax, dword [0x49fb04]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00459f8c
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412630]
call fcn.00403238
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412630]
call fcn.00403238
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d400]
call fcn.00425014
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x458884
mov eax, dword [0x49f8ec]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004253e4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45a53c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x49f8ec]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c9a0
test eax, eax
je 0x4587f2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408afc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c9c8
test eax, eax
je 0x458806
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404228
mov eax, dword [0x49f74c]
cmp byte [eax], 0
jne 0x45883a
mov eax, ebx
call fcn.004589ac
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045a718
mov eax, ebx
call fcn.0045b0dc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45887a
call fcn.004035e4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x458c2c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4a0be4]
cmp dword [eax + 0x30], 0
je 0x458cd6
cmp dword [ebx + 0x94], 0
jne 0x458cd0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458bbc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458cd0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x458c96
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458cd0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414b24
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x458ca5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x459838
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45986d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040a8
jmp 0x45987a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040400c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45a8f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45a935
mov eax, esi
call fcn.00440dd8
test al, al
je 0x45a935
mov eax, dword [ebx + 0x84]
call fcn.00440ad4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45a935
push 0
mov eax, dword [ebx + 0x84]
call fcn.00440ad4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x470f74
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x47102e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004046c4
mov eax, dword [0x49f7f0]
cmp byte [eax], 0
je 0x470fe3
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404a24
mov eax, dword [ebx]
call fcn.00404850
push eax
mov eax, dword [ebx]
call fcn.00404840
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404850
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404a24
jmp 0x471015
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00408cd4
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471035
lea eax, [ebp - 0x3f0]
call fcn.00403fb8
ret
Function at 0x47415c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4741b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi + 0x2c8], ecx
mov dword [esi + 0x2cc], edx
mov eax, dword [edx + 0x4c]
mov dword [esi + 0x2bc], eax
mov eax, dword [eax + 0x44]
mov dword [esi + 0xc], eax
mov edx, dword [esi + 0x2c8]
mov eax, esi
call fcn.004741c0
mov eax, dword [esi + 0x2c8]
mov edx, dword [eax + 0x30]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4741bd
ret

Function at 0x479a54
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov edi, edx
mov ebx, eax
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_IsWindow
test eax, eax
jne 0x479a8a
jmp 0x479b30
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_GetWindowLongA
mov esi, eax
mov eax, esp
push eax
push 0
push 0x419
mov eax, dword [ebx + 0x50]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
test esi, 2
jbe 0x479ace
mov edx, dword [ebx + 0x4c]
cmp dword [edx + 0x168], 0
je 0x479ace
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0x168]
mov eax, dword [eax + 0x14]
jmp 0x479ade
mov edx, dword [ebx + 0x4c]
mov edx, dword [edx + 0x164]
test edx, edx
je 0x479ade
mov eax, dword [edx + 0x14]
test eax, eax
je 0x479af7
push eax
push 2
push 5
mov edx, dword [edi + 0x10]
lea ecx, [esp + 0xc]
mov eax, ebx
call fcn.00476448
jmp 0x479b30
mov dl, 1
mov eax, dword [0x41cc60]
call fcn.0041eba4
mov esi, eax
mov edx, dword [edi + 0x10]
mov eax, esi
call fcn.0041f614
mov eax, dword [ebx + 0x4c]
mov edx, dword [eax + 0xbc]
mov eax, dword [esi + 0x10]
call fcn.0041e754
mov edx, esp
mov eax, esi
call fcn.0041f2a8
mov eax, esi
call fcn.00403268
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x47c048
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, ebx
call fcn.00440ad4
push eax
call sub.user32.dll_ShowWindow
mov byte [ebx + 0x279], 0
xor edx, edx
mov eax, ebx
call fcn.0043a0f8
pop ebx
ret
Function at 0x48142c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4814e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004046c4
mov eax, dword [0x49f7f0]
cmp byte [eax], 0
je 0x48149b
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404a24
mov eax, dword [ebx]
call fcn.00404850
push eax
mov eax, dword [ebx]
call fcn.00404840
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404850
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404a24
jmp 0x4814cd
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00408cd4
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4814ed
lea eax, [ebp - 0x3f0]
call fcn.00403fb8
ret

Function at 0x481688
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff00
mov ebp, edx
mov esi, eax
mov edx, ebp
mov eax, dword [esi + 0x3c]
call dword [esi + 0x38]
cmp dword [ebp + 0xc], 0
jne 0x481741
push esp
call sub.user32.dll_GetKeyboardState
mov eax, esp
call fcn.00450f1c
mov ebx, eax
mov dx, word [ebp + 4]
mov eax, esi
call fcn.00481370
mov edi, eax
test edi, edi
je 0x4816e7
mov al, byte [0x48174c]
cmp al, bl
jne 0x4816e7
mov edx, edi
mov eax, esi
call fcn.004812a8
mov dword [ebp + 0xc], 1
mov byte [esi + 0x31], 1
jmp 0x481741
cmp byte [esi + 0x161], 2
jne 0x481712
mov eax, dword [ebp + 8]
push eax
movzx ecx, word [ebp + 4]
mov eax, dword [0x49fbf0]
mov eax, dword [eax]
mov eax, dword [eax + 0x50]
mov edx, 0xb006
call fcn.0043b38c
test eax, eax
jne 0x481741
jmp 0x48173c
mov eax, dword [0x49fadc]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
cmp eax, dword [esi + 0x128]
je 0x48173c
mov edx, dword [ebp + 8]
push edx
movzx ecx, word [ebp + 4]
mov edx, dword [0x49fadc]
mov edx, 0xb006
call fcn.0043b38c
xor eax, eax
mov dword [ebp + 0xc], eax
add esp, 0x100
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4876bc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, eax
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebx + 0x80]
xor edx, edx
push edx
push eax
mov eax, dword [ebx + 0x84]
cdq
cmp edx, dword [esp + 4]
jne 0x4876f0
cmp eax, dword [esp]
pop edx
pop eax
jae 0x48772c
jmp 0x4876f4
pop edx
pop eax
jge 0x48772c
mov eax, dword [0x49fbf0]
mov eax, dword [eax]
mov dword [eax + 0x44], 2
call sub.kernel32.dll_GetTickCount
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00482538
mov eax, dword [ebx + 0xf4]
test eax, eax
je 0x487751
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0x40]
jmp 0x487751
cmp dword [ebx + 0x11c], 0
je 0x487751
xor edx, edx
mov eax, dword [ebx + 0x58]
call fcn.0042c568
push 0
push 0
push 0x10
mov eax, dword [ebx + 0x12c]
push eax
call sub.user32.dll_PostMessageA
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x491e28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x491f99
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x491f7e
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00408cd4
mov dl, 1
mov eax, dword [0x46d57c]
call fcn.0046d5d4
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x412ec8]
call fcn.00403238
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.0046d650
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x491f7b
mov dl, 1
mov eax, dword [0x46e6f4]
call fcn.0046e75c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x491fb0
call fcn.0046d99c
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004042c4
xor eax, eax
push ebp
push 0x491f74
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0046ea5c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00491fb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491f7b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00403268
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403268
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403268
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491fa0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403fdc
ret
Function at 0x495200
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4952ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004046c4
mov eax, dword [0x49f7f0]
cmp byte [eax], 0
je 0x49526f
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404a24
mov eax, dword [ebx]
call fcn.00404850
push eax
mov eax, dword [ebx]
call fcn.00404840
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.00404850
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404a24
jmp 0x4952a1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00408cd4
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.00404830
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4952c1
lea eax, [ebp - 0x3f0]
call fcn.00403fb8
ret

Function at 0x4952c8
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00408cd4
add esp, 0x3ec
pop ebx
ret

Function at 0x49b4b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404468
mov eax, dword [ebp - 8]
call fcn.00404468
xor eax, eax
push ebp
push 0x49b56e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a1184], 0
ja 0x49b553
push 0x49b474
mov edx, 0x49b57c
xor ecx, ecx
mov eax, dword [0x4a0664]
call fcn.00406d08
mov dword [0x4a1184], eax
push 1
mov eax, dword [0x4a1184]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
call fcn.00404478
push eax
mov eax, dword [0x4a1184]
push eax
call sub.user32.dll_SetWindowTextA
mov eax, dword [ebp - 8]
call fcn.00404478
push eax
push 0xffff
mov eax, dword [0x4a1184]
push eax
call sub.user32.dll_SetDlgItemTextA
push ebx
push 0
push 0x406
push 0x3e9
mov eax, dword [0x4a1184]
push eax
call sub.user32.dll_SendDlgItemMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49b575
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403fdc
ret
Function at 0x49bf04
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe44
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1bc], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49c03a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403fb8
lea eax, [ebp - 0x1b8]
push eax
push 2
call sub.wsock32.dll_WSAStartup
test eax, eax
je 0x49bf5a
mov eax, 0x49c050
call fcn.0042a9a8
mov eax, 2
call fcn.00403fa0
xor eax, eax
push ebp
push 0x49bf95
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x20
lea eax, [ebp - 0x28]
push eax
call sub.wsock32.dll_gethostname
test eax, eax
je 0x49bf8b
mov eax, 0x49c074
call fcn.0042a9a8
mov eax, 3
call fcn.00403fa0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49bfb3
lea eax, [ebp - 0x28]
push eax
call sub.wsock32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x49bfce
mov eax, 4
call fcn.00403fa0
jmp 0x49c019
mov ebx, 1
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + ebx - 1]
lea edx, [ebp - 0x1bc]
call fcn.00408314
mov edx, dword [ebp - 0x1bc]
lea eax, [ebp - 8]
call fcn.00404280
cmp ebx, 4
jge 0x49c008
lea eax, [ebp - 8]
mov edx, 0x49c090
call fcn.00404280
inc ebx
cmp ebx, 5
jne 0x49bfd3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040400c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c041
lea eax, [ebp - 0x1bc]
call fcn.00403fb8
lea eax, [ebp - 8]
call fcn.00403fb8
ret
Function at 0x405260
Capabilities:
Create pipe

Disassembly:
mov eax, 0x100c
call fcn.0040f3a0
mov eax, dword [0x5e7654]
mov ecx, dword [0x5e70e4]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
je 0x40536d
mov esi, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
mov ebp, dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x5e7654], 0x959
jne 0x405354
push 0
lea eax, [esp + 0x81c]
push eax
push 0
push 0
push 0
push 0
call esi
push 0x404d5c
push 0
call edi
push 0
lea ecx, [esp + 0x1c]
push ecx
call ebx
push 0
push 0
push 0
call ebp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
lea edx, [esp + 0x41c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x10]
push eax
call fcn.00404fd0
add dword [esp + 0x10], 8
dec dword [esp + 0x14]
jne 0x4052a4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100c
ret
Function at 0x40ac03
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441e68]
jne 0x40ac0d
repz ret
jmp fcn.0040dbf8

Function at 0x40d822
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x441e68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407a7e
and dword [ebp - 0x14], 0
cmp dword [0x4593e8], 0
mov dword [ebp - 0x18], eax
jne 0x40d8d5
push 0x40454c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40d97d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x404540
push ebx
call edi
test eax, eax
je 0x40d97d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x404530
push ebx
mov dword [0x4593e8], eax
call edi
push eax
call esi
push 0x40451c
push ebx
mov dword [0x4593ec], eax
call edi
push eax
call esi
push 0x404500
push ebx
mov dword [0x4593f0], eax
call edi
push eax
call esi
mov dword [0x4593f8], eax
test eax, eax
je 0x40d8d5
push 0x4044e8
push ebx
call edi
push eax
call esi
mov dword [0x4593f4], eax
mov eax, dword [0x4593f4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40d92e
cmp dword [0x4593f8], ecx
je 0x40d92e
push eax
call esi
push dword [0x4593f8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40d92e
test ebx, ebx
je 0x40d92e
call edi
test eax, eax
je 0x40d925
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40d925
test byte [ebp - 8], 1
jne 0x40d92e
or dword [ebp + 0x10], 0x200000
jmp 0x40d961
mov eax, dword [0x4593ec]
cmp eax, dword [ebp - 0x18]
je 0x40d961
push eax
call esi
test eax, eax
je 0x40d961
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40d961
mov eax, dword [0x4593f0]
cmp eax, dword [ebp - 0x18]
je 0x40d961
push eax
call esi
test eax, eax
je 0x40d961
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4593e8]
call esi
test eax, eax
je 0x40d97d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40d97f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040ac03
leave
ret
Function at 0x4ce07f
Capabilities:
Execute anti-debugging instructions

Disassembly:
btr edx, esp
lea edx, [ebx*4]
jmp 0x4ce069

Function at 0x4cefb3
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
pushfd
add esp, 2
jno 0x4cf00d
xchg byte [esp + 2], ch
jmp 0x4cf065
jmp 0x4cef97
xchg byte [esp + 2], ch
jmp 0x4ceff7
lea eax, [esi*4]
mov ecx, 0x8ac19063
xchg word [esp + 1], ax
lea esp, [esp + 2]
jmp 0x4cf032
Function at 0x4e68c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x4e690d
jmp 0x4e68f7
lea ecx, [eax + edx]
mov dx, cx
setge ch
jmp 0x4e6941
lea esp, [esp + 0x28]
add ebp, 0x64dd5cd5
rdtsc
clc
jo 0x4e68c7
lea ecx, [eax + edx]
mov dx, cx
setge ch
push dx
lea eax, [esp + edi]
jmp 0x4e6946
push dx
lea eax, [esp + edi]
bsf dx, di
lea esp, [esp + 2]
jmp 0x4e6954
ror ebp, 0
mov cl, byte [esp]
lea eax, [eax*4]
rdtsc
mov ecx, dword [esp]
jmp 0x4e6a80
add ebp, dword [edi]
mov eax, 0xde907f0b
mov cl, 0xf2
not ah
jmp fcn.004e69cb
rol ebp, 0
setp dh
xchg cx, dx
setg ah
mov cx, 0xe765
jmp 0x4e6a1e