joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cfda0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f1d39
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x5cfeca
mov eax, dword [ecx]
mov edx, dword [eax]
push 0
call edx
mov esi, dword [esi]
test eax, eax
je 0x5cfe86
push 0x40
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], 0
test eax, eax
je 0x5cfe09
mov ecx, eax
call fcn.0050ad30
mov edi, eax
jmp 0x5cfe0b
xor edi, edi
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.00510400
fld qword [esp + 0x20]
fld qword [0x602570]
mov ebx, dword [esi + 0x38]
fmul st(1), st(0)
mov dword [esp + 0x38], 1
fmul qword [esp + 0x18]
call fcn.005c3ce0
mov dword [esp + 0x10], eax
call fcn.005c3ce0
xor ecx, ecx
test ebx, ebx
sete cl
lea edx, [esi + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x10]
add esi, 4
push ecx
push edx
push eax
push esi
mov ecx, edi
call fcn.0050b090
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0xffffffff
call fcn.00440ab0
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
push 0x1c
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], 2
test eax, eax
je 0x5cff0e
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov edi, dword [esi + 8]
mov esi, dword [esi + 4]
push ecx
push edx
push edi
push esi
mov ecx, eax
call fcn.0050a800
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
push 0x1c
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], 3
test eax, eax
je 0x5cff0e
mov edx, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
mov ebx, dword [esi + 0xc]
mov esi, dword [esi + 8]
push edx
push edi
push ebx
push esi
mov ecx, eax
call fcn.0050a800
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
Function at 0x5d22b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f1e76
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov ecx, esi
call fcn.0050ac80
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
test eax, eax
je 0x5d2383
fld qword [esi + 0x28]
fld qword [0x602570]
fmul st(1), st(0)
fxch st(1)
call fcn.005c3ce0
fmul qword [esi + 0x20]
mov edi, eax
call fcn.005c3ce0
push 0x40
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x30], eax
xor edi, edi
mov dword [esp + 0x28], edi
cmp eax, edi
je 0x5d233b
mov ecx, eax
call fcn.0050ad30
mov edi, eax
mov eax, dword [esi + 0x38]
fld qword [esi + 0x30]
fmul qword [0x5f3df0]
push eax
fnstcw word [esp + 0x34]
movzx eax, word [esp + 0x34]
or eax, 0xc00
mov dword [esp + 0x14], eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x2c], 0xffffffff
fldcw word [esp + 0x14]
fistp qword [esp + 0x14]
mov ecx, dword [esp + 0x14]
push ecx
push ebp
fldcw word [esp + 0x3c]
push edx
push ebx
mov ecx, edi
call fcn.0050b390
jmp 0x5d23b4
push 0x1c
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 1
test eax, eax
je 0x5d23a8
push ebp
push ebx
mov ecx, eax
call fcn.0050a7c0
jmp 0x5d23aa
xor eax, eax
mov dword [esp + 0x28], 0xffffffff
mov edi, eax
mov eax, dword [esi + 0xc]
cmp eax, dword [ebx]
jne 0x5d23c3
mov ecx, dword [esi + 0x10]
cmp ecx, dword [ebx + 4]
je 0x5d23cc
mov eax, dword [esp + 0xc]
and eax, 0xfffffffe
jmp 0x5d23d0
mov eax, dword [esp + 0xc]
mov edx, dword [esi + 4]
cmp edx, dword [ebp]
jne 0x5d23e0
mov ecx, dword [esi + 8]
cmp ecx, dword [ebp + 4]
je 0x5d23e3
and eax, 0xfffffffd
mov edx, dword [esi + 0x14]
push eax
mov ecx, edi
mov dword [edi + 0x14], edx
call fcn.0050acb0
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret
Function at 0x5d2af0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x5f1fa6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x638190]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x14]
push edi
push ecx
call fcn.005d1610
lea edx, [esp + 0x1c]
push edx
lea eax, [edi + 0xc]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0057a450
lea edx, [esp + 0x28]
push edx
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.0057a450
push 0x1c
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x28
mov dword [esp + 0x38], eax
xor esi, esi
mov dword [esp + 0x30], esi
cmp eax, esi
je 0x5d2b7d
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call fcn.0050a7c0
mov ebx, eax
jmp 0x5d2b7f
xor ebx, ebx
push 8
mov dword [esp + 0x34], 0xffffffff
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], 1
cmp eax, esi
je 0x5d2baa
mov ecx, eax
call fcn.005145d0
mov esi, eax
push ebx
mov ecx, esi
mov dword [esp + 0x34], 0xffffffff
call fcn.005145f0
mov ebx, dword [edi + 0x14]
mov ecx, edi
call fcn.0050ac80
push ebx
mov ecx, esi
call fcn.005d2a80
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x403a81
Capabilities:
Execute anti-debugging instructions

Disassembly:
out dx, al
jmp 0x403aff
aas
mov ebx, 0x1c38caeb
salc
invalid
and dword [ecx*4 + 0x4f8ad88d], esp
wait
push 0x5f1094cf
call 0xca5cec75
sbb eax, 0x446ad410
in eax, dx
add ecx, dword [ebp - 0x3f5c049d]
xor byte [edx + 0x1e], bh
sub byte [eax - 0x23fe64a], bl
loope 0x403b5d
xor byte [esi - 0x4649a400], dl
sbb al, 0x51
add ebp, dword [eax - 0x77]
and ebx, ecx
xor bl, byte [0x10ea096f]
sub dh, byte [edi - 4]
inc ebx
outsb dx, byte [esi]
mov ebp, 0xc4a8bd13
inc esp
lahf
sbb al, 0
xchg esp, eax
jne 0x403ac0
mov ch, 0xab
inc ebx
mov cx, 0xf4e2
ror dword [ebx - 0x30936bf2], 1
push 0xa3b6428b
outsd dx, dword [esi]
and edx, ebp
sbb al, 0x55
push eax
mov dh, 0xa5
jmp 0x403acb
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [fcn.0040c5b8]
push 0xa
call fcn.0040548b
and dword [ebp + 8], 0
pop ecx
mov esi, eax
lea eax, [ebp + 8]
push eax
push 0x40
push 0xa
push esi
call dword [0x40c5b0]
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push edi
call dword [0x40c5b0]
push 5
mov edx, edi
mov ecx, esi
call fcn.00403bf5
add esi, 5
mov eax, edi
pop ecx
sub eax, esi
xor ecx, ecx
mov byte [esi], 0xe9
mov dword [esi + 1], eax
mov dword [ebp - 4], ecx
rdtsc
mov edx, eax
rdtsc
sub eax, edx
cmp eax, 0x500
ja 0x403bc6
mov dword [ebp - 4], edx
cmp dword [ebp - 4], ecx
jbe 0x403bd2
push ecx
call dword [fcn.0040c5b8]
sub ebx, edi
lea eax, [ebp + 8]
push eax
sub ebx, 5
mov byte [edi], 0xe9
mov dword [edi + 1], ebx
push dword [ebp + 8]
push 5
push edi
call dword [0x40c5b0]
pop edi
lea eax, [esi - 5]
pop esi
pop ebx
leave
ret
Function at 0x403c29
Capabilities:
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
add eax, esi
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ebx
add ecx, esi
push edi
mov edi, dword [eax + 0x1c]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
add edi, esi
add edx, esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
test eax, eax
jbe 0x403ccc
mov ecx, dword [edx + ecx*4]
add ecx, esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov eax, ecx
cmp byte [ecx], bl
je 0x403c70
inc eax
cmp byte [eax], bl
jne 0x403c6b
sub eax, ecx
cmp eax, 2
mov dword [ebp - 4], eax
jle 0x403c97
movzx eax, word [ecx]
mov ebx, 0x775a
cmp ax, bx
je 0x403c91
mov ebx, 0x744e
cmp ax, bx
jne 0x403c97
inc ecx
inc ecx
sub dword [ebp - 4], 2
mov eax, dword [ebp - 4]
test eax, eax
jbe 0x403cb8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
movsx ebx, byte [ecx]
imul eax, eax, 0x1003f
add eax, ebx
inc ecx
dec dword [ebp - 4]
mov dword [ebp - 8], eax
jne 0x403ca1
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
je 0x403cd2
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, dword [ebp - 0x10]
jb 0x403c5b
xor eax, eax
pop edi
pop ebx
leave
ret
xor ecx, ecx
mov dword [ebp - 8], ecx
rdtsc
mov edx, eax
rdtsc
sub eax, edx
cmp eax, 0x500
ja 0x403ce9
mov dword [ebp - 8], edx
cmp dword [ebp - 8], ecx
jbe 0x403cf5
push ecx
call dword [fcn.0040c5b8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
mov edi, dword [edi + eax*4]
add edi, esi
cmp byte [edi], 0xe9
jne 0x403d0f
inc dword [0x40c5c8]
mov eax, edi
jmp 0x403cce

Function at 0x403d3b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 4
push 0x3000
push dword [ebp + 0xc]
xor edi, edi
push edi
call dword [fcn.0040c5bc]
mov ebx, eax
mov dword [ebp - 4], edi
rdtsc
mov edx, eax
rdtsc
sub eax, edx
cmp eax, 0x500
ja 0x403d6b
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edi
jbe 0x403d77
push edi
call dword [fcn.0040c5b8]
xor ecx, ecx
cmp dword [ebp + 0xc], edi
jbe 0x403d9d
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
mov byte [ecx + ebx], al
xor edx, edx
mov eax, ecx
div dword [ebp + 0x10]
inc esi
test edx, edx
jne 0x403d96
add esi, dword [ebp + 0x14]
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x403d82
pop esi
mov dword [ebp + 0xc], edi
rdtsc
mov edx, eax
rdtsc
sub eax, edx
cmp eax, 0x500
ja 0x403db2
mov dword [ebp + 0xc], edx
cmp dword [ebp + 0xc], edi
jbe 0x403dbe
push edi
call dword [fcn.0040c5b8]
pop edi
mov eax, ebx
pop ebx
leave
ret
Function at 0x403f4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 8], 0
xor eax, eax
lea edi, [ebp - 7]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, fcn.0040348c
mov ebx, fcn.00403b56
push 4
mov edx, esi
lea ecx, [ebp - 8]
sub ebx, esi
stosb byte es:[edi], al
call fcn.00403bf5
push 4
mov edx, fcn.00403b56
lea ecx, [ebp - 4]
call fcn.00403bf5
pop ecx
add esi, 4
xor eax, eax
add ebx, 0xfffffff8
pop ecx
je 0x403fa5
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 8]
xor byte [eax + esi], cl
inc eax
cmp eax, ebx
jb 0x403f94
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404042
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 4], ebx
rdtsc
mov edx, eax
rdtsc
sub eax, edx
cmp eax, 0x500
ja 0x404064
mov dword [ebp - 4], edx
cmp dword [ebp - 4], ebx
jbe 0x404070
push ebx
call dword [fcn.0040c5b8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [0x40c5ac]
mov eax, dword [ebp + 0x10]
push 2
mov esi, eax
pop edx
mov cx, word [eax]
add eax, edx
cmp cx, bx
jne 0x4040a8
push edi
sub eax, esi
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, edx
cmp cx, bx
jne 0x4040bd
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push edx
push ebx
push edx
mov ecx, eax
push 0x40000000
lea eax, [ebp - 0x20c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], ebx
call dword [0x40c5cc]
mov esi, eax
pop edi
cmp esi, 0xffffffff
je 0x40411b
push ebx
push ebx
push ebx
push esi
call dword [0x40c59c]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [0x40d078]
push esi
call dword [0x40c5e0]
push 1
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
call dword [0x40c590]
pop esi
pop ebx
leave
ret
Function at 0x404161
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [fcn.0040c5bc]
push esi
push edi
call fcn.00404132
mov ecx, dword [fcn.0040c5b8]
mov esi, eax
call fcn.00404132
mov ecx, dword [0x40c5cc]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40c5a4]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40c5a8]
add esi, eax
call fcn.00404132
xor edi, edi
add esi, eax
mov dword [ebp - 4], edi
rdtsc
mov edx, eax
rdtsc
sub eax, edx
cmp eax, 0x500
ja 0x4041bf
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edi
jbe 0x4041cb
push edi
call dword [fcn.0040c5b8]
mov ecx, dword [0x40d064]
call fcn.00404132
mov ecx, dword [0x40c5b0]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40c590]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40d078]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40c5a0]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40c5d0]
add esi, eax
call fcn.00404132
mov ecx, dword [fcn.0040c5b4]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40d070]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40c5c4]
add esi, eax
call fcn.00404132
mov ecx, dword [fcn.0040c5dc]
add esi, eax
call fcn.00404132
mov ecx, dword [0x40c5a8]
add esi, eax
call fcn.00404132
add esi, eax
mov dword [ebp - 4], edi
rdtsc
mov edx, eax
rdtsc
sub eax, edx
cmp eax, 0x500
ja 0x40426f
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edi
jbe 0x40427b
push edi
call dword [fcn.0040c5b8]
cmp esi, 8
jbe 0x404287
push edi
call dword [fcn.0040c5b8]
pop edi
pop esi
leave
ret

Function at 0x40496a
Capabilities:
Execute anti-debugging instructions
Get session user name

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jbe 0x404979
jmp fcn.0040484c
nop
Function at 0x40497a
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
push ebx
xor ebx, ebx
push 0x117
lea eax, [ebp - 0x2ef]
push ebx
push eax
mov byte [ebp - 0x2f0], bl
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2f0]
push eax
mov dword [ebp - 8], 0x118
nop
adc eax, sym.imp.ADVAPI32.dll_GetUserNameA
test eax, eax
je 0x404b13
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
test eax, eax
je 0x404b12
mov eax, dword [0x40c604]
sub eax, dword [0x40c5fc]
push 0xf0
add dword [0x40c5f8], eax
lea eax, [ebp - 0x1d4]
push ebx
push eax
mov dword [ebp - 0x1d8], ebx
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0x1d8]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
test eax, eax
je 0x404b12
push 0xfffffffffffffff0
nop
adc eax, sym.imp.USER32.dll_GetDesktopWindow
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x404b12
mov eax, dword [0x40c600]
mov ecx, dword [0x40c604]
lea eax, [eax + ecx*2]
mov dword [0x40c600], eax
call dword [sym.imp.USER32.dll_GetCursor]
test eax, eax
je 0x404b12
sub dword [0x40c5f4], 0x7ec6
call esi
test eax, eax
je 0x404b12
mov eax, dword [0x40c600]
mov ecx, dword [0x40c5f8]
add eax, ecx
add dword [0x40c5fc], eax
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push 0x403090
push 0x80000001
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x404b12
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_GetProcessDefaultLayout]
test eax, eax
je 0x404b12
push 0x403048
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
test eax, eax
je 0x404b12
mov eax, dword [0x40c604]
sub eax, dword [0x40c5fc]
push 0xd2
add dword [0x40c5f8], eax
xor eax, eax
mov word [ebp - 0xe4], ax
lea eax, [ebp - 0xe2]
push ebx
push eax
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xe4]
push eax
mov dword [ebp - 4], 0x6a
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x404b12
mov eax, dword [0x40c5f0]
add eax, eax
mov dword [0x40c5f0], eax
pop esi
pop ebx
leave
ret
Function at 0x404b16
Capabilities:
Get common file path
Get graphical window text
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5ec
push ebx
push esi
push edi
xor eax, eax
push 0xf6
mov word [ebp - 0x1d0], ax
xor ebx, ebx
lea eax, [ebp - 0x1ce]
push ebx
push eax
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1d0]
push eax
mov dword [ebp - 0xc], 0x7c
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x404d31
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x403070
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
test eax, eax
je 0x404d31
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404d31
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x404d31
push 0x403094
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
test eax, eax
je 0x404d31
xor eax, eax
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
cmp word [ebp - 0x1c], 0x17
jne 0x404d31
mov edi, dword [sym.imp.USER32.dll_GetForegroundWindow]
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
je 0x404d31
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x4030ac
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404d31
mov eax, dword [0x40c5f0]
add dword [0x40c5f4], eax
push 0xaf
lea eax, [ebp - 0xd7]
push ebx
push eax
mov byte [ebp - 0xd8], bl
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xd8]
push eax
mov dword [ebp - 8], 0xb0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x404d31
call edi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x404d31
mov eax, dword [0x40c5fc]
sub eax, dword [0x40c604]
push 0x206
add dword [0x40c600], eax
xor eax, eax
mov word [ebp - 0x5e8], ax
lea eax, [ebp - 0x5e6]
push ebx
push eax
call fcn.00409b80
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x5e8]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x404d31
lea edi, [esi - 1]
push edi
lea eax, [ebp - 0x2d7]
push ebx
push eax
mov byte [ebp - 0x2d8], bl
call fcn.00409b80
add esp, 0xc
push esi
lea eax, [ebp - 0x2d8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x404d31
mov eax, dword [0x40c5f4]
add dword [0x40c5f8], eax
push edi
lea eax, [ebp - 0x3df]
push ebx
push eax
mov byte [ebp - 0x3e0], bl
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0x3e0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x404d31
push 0x4030d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404d36
Capabilities:
Get hostname
Get session user name
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
push ebx
push esi
xor ebx, ebx
push 0x6b
lea eax, [ebp - 0xe3]
push ebx
push eax
mov byte [ebp - 0xe4], bl
call fcn.00409b80
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xe4]
push eax
mov dword [ebp - 0x14], 0x6c
call esi
test eax, eax
je 0x404ec8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
jne 0x404d91
call fcn.00403b56
call fcn.0040348c
push edi
mov edi, 0xdc
sub dword [0x40c604], edi
push 0x4030ec
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x404ec7
push 0x63
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x10], 0x64
call esi
test eax, eax
je 0x404ec7
sub dword [0x40c600], 0x188
push 0xf0
lea eax, [ebp - 0x268]
push ebx
push eax
mov dword [ebp - 0x26c], ebx
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileW]
test eax, eax
je 0x404eb6
push 0x403140
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], eax
xor eax, eax
push 0x228
mov word [ebp - 0x498], ax
lea eax, [ebp - 0x496]
push ebx
push eax
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x498]
push eax
mov dword [ebp - 8], 0x115
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x404ec7
sub dword [0x40c5f8], edi
push 0x93
lea eax, [ebp - 0x177]
push ebx
push eax
mov byte [ebp - 0x178], bl
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x178]
push eax
mov dword [ebp - 0xc], 0x94
call esi
test eax, eax
je 0x404eab
add dword [0x40c600], edi
jmp 0x404ec7
mov eax, dword [ebp - 4]
add dword [0x40c5f8], eax
jmp 0x404ec7
mov eax, dword [0x40c5f0]
lea eax, [eax + eax + 0xac]
mov dword [0x40c5f0], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404ecc
Capabilities:
Accept command line arguments
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
push ebx
lea eax, [ebp - 8]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x40316c
push 0x80000001
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405027
push 0x403184
push 1
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
je 0x405027
mov eax, dword [0x40c5f8]
add dword [0x40c5f0], eax
push 0x5b
lea eax, [ebp - 0x83]
push ebx
push eax
mov byte [ebp - 0x84], bl
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 4], 0x5c
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x405027
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
je 0x405027
push 0x403194
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
test eax, eax
je 0x405027
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405027
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
test eax, eax
je 0x405027
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x405027
push edi
xor eax, eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
test eax, eax
je 0x405026
cmp dword [0x40c604], ebx
jl 0x405003
xor eax, eax
push 0x144
mov word [ebp - 0x1cc], ax
lea eax, [ebp - 0x1ca]
push ebx
push eax
call fcn.00409b80
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1cc]
push eax
mov dword [ebp - 0xc], 0xa3
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x405026
mov eax, dword [0x40c5fc]
add eax, eax
mov dword [0x40c5fc], eax
pop edi
pop ebx
leave
ret