joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459590
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x56741c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45962b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x56741c]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.004620a7
lea ecx, [sym.runtime.callers.func1]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call sym.runtime.systemstack
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call sym.runtime.morestack_noctxt
jmp sym.runtime.callers
Function at 0x45ec80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x56741c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45ee13
sub esp, 0x24
mov eax, dword [esp + 0x28]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x20], ecx
nop
mov dword [esp], ecx
call sym.runtime.lock2
mov eax, dword [esp + 0x28]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x45edfc
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call sym.runtime._pollDesc_.publishInfo
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], ecx
call sym.runtime.netpollunblock
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x28]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
lea edx, [esp + 0x14]
mov dword [esp + 0xc], edx
call sym.runtime.netpollunblock
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
test ecx, ecx
je 0x45ed68
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x5674b8]
test eax, eax
jne 0x45ed4f
mov eax, dword [esp + 0x28]
jmp 0x45ed5d
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x3c]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x45ed9f
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call sym.runtime.deltimer
mov eax, dword [0x5674b8]
test eax, eax
jne 0x45ed8a
mov eax, dword [esp + 0x28]
jmp 0x45ed98
mov eax, dword [esp + 0x28]
mov ecx, dword [eax + 0x78]
call sym.runtime.gcWriteBarrier1
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.runtime.unlock2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x45edc5
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x18]
test eax, eax
je 0x45eddd
mov dword [esp], eax
mov dword [esp + 4], 3
call sym.runtime.netpollgoready
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45edf8
nop
lea ecx, [0x56737c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call sym.runtime_internal_atomic.Xadd
add esp, 0x24
ret
lea eax, [0x4a48b1]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call sym.runtime.throw
nop
call sym.runtime.morestack_noctxt
jmp sym.internal_poll.runtime_pollUnblock

Function at 0x461da0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x567306], 0
je 0x461dba
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x461dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x567306], 0
je 0x461ddb
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback
Function at 0x462c00
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x462c1a
mov ecx, 0x14
jmp 0x462c23
shl ecx, 2
add ecx, 0xe10
mov dword [0x56741c], ecx
ret
Function at 0x487740
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x56741c]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4877e1
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [esp + 0x18]
cmp dword [edx], ecx
jne 0x4877d7
movzx ecx, byte [eax + 4]
cmp byte [edx + 4], cl
jne 0x4877d7
movzx ecx, byte [eax + 5]
cmp byte [edx + 5], cl
jne 0x4877d7
movzx ecx, byte [eax + 6]
cmp byte [edx + 6], cl
jne 0x4877d7
movzx ecx, byte [eax + 7]
cmp byte [edx + 7], cl
jne 0x4877d7
movzx ecx, byte [eax + 8]
cmp byte [edx + 8], cl
jne 0x4877d7
movzx ecx, byte [eax + 9]
cmp byte [edx + 9], cl
jne 0x4877d7
movzx ecx, byte [eax + 0xa]
cmp byte [edx + 0xa], cl
jne 0x4877d7
movzx ecx, byte [eax + 0xb]
cmp byte [edx + 0xb], cl
jne 0x4877d7
movzx ecx, byte [eax + 0xc]
cmp byte [edx + 0xc], cl
jne 0x4877d7
add eax, 0x10
mov dword [esp], eax
lea eax, [edx + 0x10]
mov dword [esp + 4], eax
mov dword [esp + 8], 0x4c
call sym.runtime.memequal
movzx eax, byte [esp + 0xc]
jmp 0x4877d9
xor eax, eax
mov byte [esp + 0x1c], al
add esp, 0x10
ret
call sym.runtime.morestack_noctxt
jmp sym.type:.eq.fmt.fmt
Function at 0x41728a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x4172b9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
call fcn.00417387
add esp, 0xc
jmp 0x417383
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41731f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x417313
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
and dword [eax], 0
jmp 0x41731d
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x417383
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 1
push 0x2132
push 0
push 0x629
push 0x2bab
push 0x39e4
push 0x1522
push 0xfa5
push 1
push 1
push 0x43ba
push 0x36ab
push 0x2ad8
push 0x59ae
push 0x5dac
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push dword [eax]
push dword [ebp - 0x3c]
call fcn.00412958
add esp, 0x48
mov esp, ebp
pop ebp
ret
Function at 0x41e48c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x41e56d
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x41e4ee
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x41e4e4
push 0x1617
push 0x1561
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x41e4ec
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x41e56b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x41e526
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x41e524
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
jmp 0x41e56b
push 0xd4b
push 0x948
push 0x1dee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x2504
push 0x23b7
push 0x617
push 0x248b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x41e5a0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x92
push 0x32f3
push 0x5104
push 0
push 0x3f83
push 0x3b16
push 1
push 0x2bd1
call fcn.0042a81d
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x437e89
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x437fd0
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x437f6e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x437f4e
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x437f2f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x437f4c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.00432e3a
mov dword [eax], 7
jmp 0x437f24
jmp 0x437f6c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x437f6c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x437fce
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
push 0
push 0x5dc3
push 0x2c70
push 0x3a0b
push 0x6d9e
push 0x21e0
push dword [ebp - 0x50]
push 0x7126
push 0x4777
push 0x469f
push 0x3ba8
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 0x4880
call fcn.00438df1
add esp, 0x3c
jmp 0x43800d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x64], eax
push 0x7ca4
push dword [ebp - 0x60]
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x68]
push 0x5370
push 0xb91
push 0x3f78
push 0
call fcn.004483b0
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x44fb5b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x44fc5d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44fbcc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
push 0x48ca
push 0x6906
call fcn.0044fc8e
add esp, 0x14
jmp 0x44fc5b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x44fc3b
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44fc1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x44fc39
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.00432e3a
mov dword [eax], 0x21dd
jmp 0x44fc11
jmp 0x44fc5b
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x44fc5b
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x44fc8a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
push 0x44d8
push 0x7bbd
push dword [ebp - 0x50]
push 0
push dword [ebp - 0x54]
push 1
push 0x7e73
call fcn.0044272e
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x4660e9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 0x18], 0
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0xc], 0
xor esi, esi
mov dword [ebp - 0x1c], ebx
inc esi
jmp 0x466114
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10], 0xc0ae9714
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x466106
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x466130
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [ebp - 0x10], 0xfffffffb
jmp 0x466158
mov dword [ebp - 0x18], esi
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x46614e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x18], 0xbf5cd53b
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff3
jle 0x466139
push esi
push 0x5477
push esi
push 0x4d94
push 0x2e79
push 0x1633
push esi
push 0x2345
push esi
push 0x43d5
push esi
push 0x3799
push 0x7d3d
push ebx
push 0x7d56
call fcn.0045a286
add esp, 0x3c
lea ecx, [ebp - 0x28]
push 3
call fcn.00432d4c
mov dword [ebp - 8], 0xd8a87013
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], 0
jmp 0x4661ca
push dword [ebp - 0xc]
lea ecx, [ebp - 0x28]
call fcn.00432e3a
mov dword [eax], 0x7f82
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4661b6
mov dword [ebp - 8], 2
cmp dword [ebp - 8], 0
jl 0x4662e8
push edi
mov dword [ebp - 0xc], 0x5b3b9da4
mov dword [ebp - 0xc], 0
jmp 0x4662bc
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0x758b39d2
mov dword [ebp - 0x14], 0xffffffff
push dword [ebp - 8]
call fcn.00432e3a
cmp dword [eax], 0
jne 0x4662c6
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
push esi
call fcn.00432e3a
push dword [ebp - 8]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.00432e3a
mov ecx, dword [ebp - 0x14]
mov ebx, dword [esi]
push 0
mov edi, dword [eax]
add edi, ecx
lea ecx, [ebp - 0x28]
imul edi, dword [esi]
call fcn.00432e3a
push 2
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], eax
call fcn.00432e3a
mov ecx, dword [ebp - 0x18]
xor edx, edx
add ecx, edi
mov esi, eax
cmp ecx, ebx
push 1
setl dl
xor ecx, ecx
sub edx, ebx
mov ebx, dword [ebp - 0x14]
cmp edx, dword [ebx]
setl cl
xor eax, eax
cmp ecx, dword [esi]
pop esi
setg al
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebx]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
setle dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, dword [ebx]
setl al
mov dword [ebp - 0x14], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x4661f5
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x4662db
push 0x163
call dword [sym.imp.USER32.dll_GetSysColor]
dec dword [ebp - 8]
jns 0x4661e2
mov ebx, dword [ebp - 0x1c]
pop edi
lea ecx, [ebp - 0x28]
call fcn.00432e1e
push ebx
call fcn.0042d9f8
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x489413
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4974cf
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4aa484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004872c4
mov dword [ebp - 0x14], eax
cmp dword [0xaa3e30], esi
jne 0x4975c2
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x49754f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4976a2
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4976a2
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4976a2
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xaa3e30], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xaa3e34], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xaa3e38], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa3e40], eax
test eax, eax
je 0x4975bf
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xaa3e3c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4975e7
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4975da
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4975fc
push 4
pop eax
jmp 0x4976a4
cmp dword [ebp - 0x14], esi
je 0x4975fc
push dword [0xaa3e30]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4975e1
mov eax, dword [0xaa3e3c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x49765a
cmp dword [0xaa3e40], edi
je 0x49765a
push eax
call ebx
push dword [0xaa3e40]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x49765a
test eax, eax
je 0x49765a
call ecx
test eax, eax
je 0x49764f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x49764f
test byte [ebp - 8], 1
jne 0x49765a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x49768a
mov eax, dword [0xaa3e34]
cmp eax, edi
je 0x497687
push eax
call ebx
test eax, eax
je 0x497687
call eax
mov esi, eax
test esi, esi
je 0x497687
mov eax, dword [0xaa3e38]
cmp eax, edi
je 0x497687
push eax
call ebx
test eax, eax
je 0x497687
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xaa3e30]
call ebx
test eax, eax
je 0x4976a2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4976a4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048676b
mov esp, ebp
pop ebp
ret
Function at 0x402110
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e52d
mov eax, dword fs:[0]
push eax
mov eax, 0x11e0
call fcn.0041c530
mov eax, dword [0x44e100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x113c], 0
push 1
lea ecx, [ebp - 0x11ec]
call fcn.0040b1a0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1134]
push eax
push 0x1000
lea ecx, [ebp - 0x1114]
push ecx
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x402248
mov edx, dword [ebp - 0x1134]
shr edx, 2
mov dword [ebp - 0x1134], edx
mov dword [ebp - 0x1130], 0
jmp 0x4021a7
mov eax, dword [ebp - 0x1130]
add eax, 1
mov dword [ebp - 0x1130], eax
mov ecx, dword [ebp - 0x1130]
cmp ecx, dword [ebp - 0x1134]
jae 0x402248
mov edx, dword [ebp - 0x1130]
cmp dword [ebp + edx*4 - 0x1114], 0
je 0x402243
mov eax, dword [ebp - 0x1130]
mov ecx, dword [ebp + eax*4 - 0x1114]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1138], eax
cmp dword [ebp - 0x1138], 0
je 0x402243
push 0x104
lea edx, [ebp - 0x114]
push edx
push 0
mov eax, dword [ebp - 0x1138]
push eax
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x402235
push 0x4403c4
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x11dc]
push edx
call fcn.00403bc0
add esp, 8
push eax
call fcn.00403f30
add esp, 8
mov eax, dword [ebp - 0x1138]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x402198
lea ecx, [ebp - 0x112c]
push ecx
lea ecx, [ebp - 0x11ec]
call fcn.004189b0
nop
lea ecx, [ebp - 0x112c]
call fcn.00415690
movzx edx, al
test edx, edx
jne 0x40228c
lea ecx, [ebp - 0x112c]
call fcn.004136f0
movzx eax, word [eax]
cmp eax, 0x26
jne 0x40228c
lea ecx, [ebp - 0x112c]
call fcn.00417260
nop
lea ecx, [ebp - 0x112c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040ae20
mov edx, dword [ebp - 0x113c]
or edx, 1
mov dword [ebp - 0x113c], edx
lea ecx, [ebp - 0x112c]
call fcn.0040cb40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11ec]
call fcn.0040e700
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c2df
mov esp, ebp
pop ebp
ret