joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b14c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ec680
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004e5365
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x4b14f3
xor al, al
jmp 0x4b161f
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x4b1515
xor al, al
jmp 0x4b161f
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x4b1528
xor al, al
jmp 0x4b161f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x4b153c
xor al, al
jmp 0x4b161f
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.004d9239
test eax, eax
jne 0x4b1570
xor al, al
jmp 0x4b161f
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x504074
mov dword [esp + 0x20], ebp
call fcn.004e5365
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004e1e42
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004e1e99
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x4b1604
mov ax, word [ebx]
test ax, ax
je 0x4b15f6
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.004b1640
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x4b15da
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004e1e99
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x4b1b40
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004e34f2
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x4b1b86
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004b7488
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x529664
push ecx
call fcn.004b91c5
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x4d0450
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ed430
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004c5532
mov eax, dword [0x5080a8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004c5464
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004d0f50
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4d04f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4d04ee
cmp al, 0xff
je 0x4d04ee
dec al
mov byte [ecx], al
jmp 0x4d04f7
push ecx
call fcn.004dadb6
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4d0528
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4d051f
cmp al, 0xff
je 0x4d051f
dec al
mov byte [ecx], al
jmp 0x4d0528
push ecx
call fcn.004dadb6
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4dd405
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4dd43d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004db4a7
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004db47f
jmp 0x4dd449
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4debfc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4dec3e
call fcn.004e5365
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4dec3e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4dec35
xor eax, eax
jmp 0x4dec46
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004dec4c
pop edi
pop esi
pop ebx
ret 4

Function at 0x4e5895
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e58c3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e58e1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e57fb
jmp 0x4e58e1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e58e1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e57fb
test edi, edi
mov eax, edi
jne 0x4e58cb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b2438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x533e00]
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
xor edi, edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], edi
call fcn.004a55c6
push 1
push 0x4fe3b4
mov byte [esp + 0x38], 1
call fcn.0045fb60
add esp, 8
add esi, 0xc
lea ecx, [esp + 0x10]
push 0x4fe3a0
push esi
push ecx
call fcn.004a521e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 2
call fcn.004a50c2
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.004a4f89
mov edx, dword [esp + 0xc]
push edi
push 0x10
push edx
lea ecx, [esp + 0x24]
call fcn.004a56d8
test eax, eax
jne 0x4016f9
push 1
push 0x4fe384
jmp 0x40185e
push ebx
push ebp
lea ecx, [esp + 0x20]
call fcn.004a59d2
mov esi, eax
lea eax, [esi + 0x10]
push eax
call fcn.0048d322
mov ebp, eax
add esp, 4
lea ecx, [esp + 0x20]
lea eax, [ebp + 0xc]
push esi
push eax
call fcn.004a57f5
lea ecx, [esp + 0x20]
call fcn.004a58f3
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x1b]
push 1
push ecx
mov ecx, 0x56f7f0
mov byte [esp + 0x23], 0x6a
call fcn.00418570
push edi
push ebp
call fcn.0041e0a0
lea edx, [ebp + 4]
push 0x40000000
push edx
call fcn.0041e0f0
lea eax, [ebp + 8]
push esi
push eax
call fcn.0041e0f0
add esp, 0x18
mov ecx, 0x56f7f0
push 0xffffffffffffffff
push edi
push 0xc
push ebp
call fcn.00418570
mov ebx, esi
and esi, 0x7f
shr ebx, 7
push edi
push ebx
mov dword [esp + 0x24], esi
call fcn.0045fea0
add esp, 8
lea esi, [ebp + 0xc]
push 0xffffffffffffffff
push 0
push 0x80
push esi
mov ecx, 0x56f7f0
call fcn.00418570
push edi
call fcn.0045ff80
add esp, 4
inc edi
add esi, 0x80
cmp edi, ebx
jl 0x40178f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4017d6
shl edi, 7
push 0xffffffffffffffff
push 0
lea ecx, [edi + ebp + 0xc]
push eax
push ecx
mov ecx, 0x56f7f0
call fcn.00418570
push 0
call fcn.0045ff80
push ebp
call fcn.0048d2da
add esp, 8
mov ecx, 0x56f7f0
call fcn.00418830
push 1
push 0x4fe364
call fcn.0045fb60
add esp, 8
mov ecx, 0x56f7f0
push 0x3e8
push 0x21
call fcn.00418980
pop ebp
pop ebx
test al, al
push 1
je 0x401859
push 0x4fe34c
call fcn.0045fb60
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.004a561b
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004a4f89
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
push 0x4fe32c
call fcn.0045fb60
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.004a561b
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004a4f89
mov ecx, dword [esp + 0x28]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4017f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b2438
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [0x533e00]
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
xor edi, edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], edi
call fcn.004a55c6
push 1
push 0x4fe3b4
mov byte [esp + 0x38], 1
call fcn.0045fb60
add esp, 8
add esi, 0xc
lea ecx, [esp + 0x10]
push 0x4fe3a0
push esi
push ecx
call fcn.004a521e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 2
call fcn.004a50c2
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 1
call fcn.004a4f89
mov edx, dword [esp + 0xc]
push edi
push 0x10
push edx
lea ecx, [esp + 0x24]
call fcn.004a56d8
test eax, eax
jne 0x4016f9
push 1
push 0x4fe384
jmp 0x40185e
push ebx
push ebp
lea ecx, [esp + 0x20]
call fcn.004a59d2
mov esi, eax
lea eax, [esi + 0x10]
push eax
call fcn.0048d322
mov ebp, eax
add esp, 4
lea ecx, [esp + 0x20]
lea eax, [ebp + 0xc]
push esi
push eax
call fcn.004a57f5
lea ecx, [esp + 0x20]
call fcn.004a58f3
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x1b]
push 1
push ecx
mov ecx, 0x56f7f0
mov byte [esp + 0x23], 0x6a
call fcn.00418570
push edi
push ebp
call fcn.0041e0a0
lea edx, [ebp + 4]
push 0x40000000
push edx
call fcn.0041e0f0
lea eax, [ebp + 8]
push esi
push eax
call fcn.0041e0f0
add esp, 0x18
mov ecx, 0x56f7f0
push 0xffffffffffffffff
push edi
push 0xc
push ebp
call fcn.00418570
mov ebx, esi
and esi, 0x7f
shr ebx, 7
push edi
push ebx
mov dword [esp + 0x24], esi
call fcn.0045fea0
add esp, 8
lea esi, [ebp + 0xc]
push 0xffffffffffffffff
push 0
push 0x80
push esi
mov ecx, 0x56f7f0
call fcn.00418570
push edi
call fcn.0045ff80
add esp, 4
inc edi
add esi, 0x80
cmp edi, ebx
jl 0x40178f
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4017d6
shl edi, 7
push 0xffffffffffffffff
push 0
lea ecx, [edi + ebp + 0xc]
push eax
push ecx
mov ecx, 0x56f7f0
call fcn.00418570
push 0
call fcn.0045ff80
push ebp
call fcn.0048d2da
add esp, 8
mov ecx, 0x56f7f0
call fcn.00418830
push 1
push 0x4fe364
call fcn.0045fb60
add esp, 8
mov ecx, 0x56f7f0
push 0x3e8
push 0x21
call fcn.00418980
pop ebp
pop ebx
test al, al
push 1
je 0x401859
push 0x4fe34c
call fcn.0045fb60
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.004a561b
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004a4f89
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
push 0x4fe32c
call fcn.0045fb60
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 0
call fcn.004a561b
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004a4f89
mov ecx, dword [esp + 0x28]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4024c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b248c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
mov eax, dword [0x533e00]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0xc]
mov dword [edi], eax
mov ecx, dword [0x533e00]
mov dword [esp + 0x94], 0
mov dword [esi + 0x18], ecx
mov edx, dword [0x533e00]
mov dword [esi + 0x24], edx
mov eax, dword [0x533e00]
mov dword [esi + 0x28], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x94], 1
push ecx
push 0x80
mov dword [esi], 0x4fe298
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0xc]
push edx
push 0x4fe6d4
push edi
call fcn.0049e5b4
add esp, 0xc
mov ecx, esi
push 1
call fcn.004025b0
mov ecx, dword [esp + 0x8c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x90
ret
mov ecx, 0x5702c8
jmp 0x4024a0

Function at 0x404130
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b279c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
mov eax, dword [0x533e00]
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea edi, [esi + 0xc]
mov dword [edi], eax
mov ecx, dword [0x533e00]
mov dword [esp + 0x94], 0
mov dword [esi + 0x18], ecx
mov edx, dword [0x533e00]
mov dword [esi + 0x20], edx
mov eax, dword [0x533e00]
mov dword [esi + 0x24], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x94], 1
push ecx
push 0x80
mov dword [esi], 0x4fe810
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0xc]
push edx
push 0x4fe6d4
push edi
call fcn.0049e5b4
add esp, 0xc
mov ecx, esi
push 1
call fcn.00404220
mov ecx, dword [esp + 0x8c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x90
ret
mov ecx, 0x570268
jmp 0x404110
Function at 0x404fb0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b2998
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
cmp dword [esi], eax
je 0x4050da
mov edi, dword [esp + 0x20]
cmp dword [esi + edi*4 + 0x22c], eax
je 0x4050da
mov eax, dword [esi + 0x25c]
push eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esi + edi*4 + 0x22c]
lea ebx, [esi + 0x24c]
push ebx
push ecx
push ebp
push edx
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x4050d8
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x405035
or eax, 0xffffffff
jmp 0x4050da
mov ecx, dword [esi + 0x25c]
push 0x3e8
push ecx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x4050b9
cmp eax, 0x102
je 0x40505a
or eax, 0xffffffff
jmp 0x4050da
mov edx, dword [esp + 0x24]
push 0
push ebp
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.0041e400
add esp, 0x10
push 0x4fece0
push 0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0
call fcn.0049de3b
push 0x4feca0
lea ecx, [esp + 0x28]
call fcn.004a5365
mov ecx, dword [esi + edi*4 + 0x22c]
push ecx
call dword [sym.imp.kernel32.dll_CancelIo]
lea ecx, [esp + 0x24]
mov dword [esp + 0x18], 0xffffffff
call fcn.004a4f89
or eax, 0xffffffff
jmp 0x4050da
mov edx, dword [esp + 0x2c]
mov eax, dword [esi + edi*4 + 0x22c]
push 1
push edx
push ebx
push eax
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x4050d8
or eax, 0xffffffff
jmp 0x4050da
xor eax, eax
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x10

Function at 0x4050f0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
or eax, 0xffffffff
push edi
cmp dword [esi], eax
je 0x4051b5
mov edi, dword [esp + 0x14]
cmp dword [esi + edi*4 + 0x22c], eax
je 0x4051b5
mov eax, dword [esi + 0x25c]
push eax
call dword [sym.imp.kernel32.dll_ResetEvent]
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esi + edi*4 + 0x22c]
lea ebx, [esi + 0x24c]
push ebx
push ebp
push ecx
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x4051b3
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x3e5
je 0x40515e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x25c]
push ecx
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x405193
cmp eax, 0x102
jne 0x405189
mov eax, dword [esi + edi*4 + 0x22c]
push eax
call dword [sym.imp.kernel32.dll_CancelIo]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0x14
mov ecx, dword [esi + edi*4 + 0x22c]
push 1
push ebp
push ebx
push ecx
call dword [sym.imp.kernel32.dll_GetOverlappedResult]
test eax, eax
jne 0x4051b3
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x405800
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b2a13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4eab74
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.004a0205
mov dword [ebx], 0x4bcb64
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.004a0205
or eax, 0xffffffff
push 0x536128
mov dword [ebx], 0x4bcb38
push edi
mov dword [esi], 0x4bcb44
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x18
mov dword [esi + 0x34], 0x17
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc04000
mov dword [esi + 0x3c], edi
call dword [sym.imp.kernel32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x408b70
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b2d98
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebp
push edi
mov edi, ecx
xor ebp, ebp
cmp dword [edi + 0x58], ebp
jne 0x408ba6
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov eax, dword [0x533e00]
push ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x30], ebp
mov dword [esp + 0x10], eax
mov ecx, dword [edi + 4]
mov eax, dword [edi + 0x10]
or ebx, 0xffffffff
push ecx
mov byte [esp + 0x34], 1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], eax
call dword [fcn.004bc664]
cmp eax, ebp
mov dword [esp + 0x24], eax
jle 0x408caa
push esi
cmp ebx, 0xffffffff
jne 0x408c93
push 0x400
push 0x100
push 0x100
lea ecx, [esp + 0x1c]
call fcn.004a53b9
mov edx, dword [edi + 4]
push eax
push ebp
push edx
call dword [fcn.004bc67c]
push ebx
lea ecx, [esp + 0x14]
call fcn.004a5408
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x408c86
mov eax, dword [esp + 0x18]
xor esi, esi
test eax, eax
jle 0x408c86
mov edx, dword [edi + 0xc]
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [edx + esi*4]
call fcn.004056c0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
call fcn.004a50c2
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 1
call fcn.004a4f89
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0048d5d9
add esp, 8
test eax, eax
je 0x408c80
mov eax, dword [esp + 0x18]
inc esi
cmp esi, eax
jl 0x408c32
jmp 0x408c86
mov ebx, ebp
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x28]
inc ebp
cmp ebp, eax
jl 0x408be6
test ebx, ebx
pop esi
jl 0x408caa
mov eax, dword [esp + 0x18]
test eax, eax
jl 0x408caa
cmp ebx, eax
jl 0x408caa
sub ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 0
call fcn.004a4f89
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004a4f89
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x409520
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4b2f20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0x4eaffc
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.gdi32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.004a82cf
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004a79e0
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.004a7de0
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call fcn.004a7e2c
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004a7de0
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call fcn.004a7e2c
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.004a7de0
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call fcn.004a7e2c
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.004a7de0
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call fcn.004a7e2c
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.004a7de0
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call fcn.004a7e2c
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call fcn.004a7de0
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call fcn.004a7e2c
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call fcn.004a7de0
push ebp
push ebx
mov ecx, esi
call fcn.004a7e2c
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
call fcn.004a79e0
lea ecx, [esp + 0x10]
call fcn.004a8326
mov dword [esp + 0x10], 0x4ea884
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 1
call fcn.004a8326
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10