joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ecx, 4
push edi
mov edi, 0x4d4400
push esi
push ebx
sub esp, 0xbc
mov eax, dword [esp + 0xd4]
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41b992
mov edi, 0x4d4404
mov ecx, 5
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41b9e0
mov edi, 0x4d4409
mov ecx, 2
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x41ba37
lea ebx, [eax + 2]
movzx edx, byte [eax + 2]
xor esi, esi
jmp 0x41b92b
cmp dl, 0x3a
jne 0x41ba2e
add ebx, 1
movzx edx, byte [ebx]
test dl, dl
je 0x41b982
movzx edi, dl
movsx eax, dl
test byte [edi + edi + 0x509a41], 1
je 0x41b918
movzx edi, byte [ebx + 1]
test byte [edi + edi + 0x509a41], 1
je 0x41b918
call fcn.0041b780
mov edi, dword [esp + 0xdc]
lea ebp, [ebx + 2]
add edi, esi
add esi, 1
mov edx, eax
shl edx, 4
mov byte [edi], dl
movsx eax, byte [ebx + 1]
mov ebx, ebp
mov dword [esp + 0xc], edx
call fcn.0041b780
mov edx, dword [esp + 0xc]
or eax, edx
mov byte [edi], al
movzx edx, byte [ebx]
test dl, dl
jne 0x41b92b
mov eax, 1
add esp, 0xbc
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x10]
mov dword [esp], esi
call fcn.004a9ff0
mov eax, dword [esp + 0xd0]
mov dword [esp + 8], esi
mov dword [esp + 4], fcn.004aa860
mov dword [esp], eax
call dword [esp + 0xd8]
test eax, eax
je 0x41b987
mov eax, dword [esp + 0xdc]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004aa7b0
mov eax, 1
jmp 0x41b987
lea esi, [esp + 0x10]
mov dword [esp], esi
call fcn.004aabc0
mov eax, dword [esp + 0xd0]
mov dword [esp + 8], esi
mov dword [esp + 4], fcn.004ac070
mov dword [esp], eax
call dword [esp + 0xd8]
test eax, eax
je 0x41b987
mov eax, dword [esp + 0xdc]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.004abf70
mov eax, 1
jmp 0x41b987
cmp dl, 0x2d
je 0x41b921
call sub.msvcrt.dll_abort
nop
nop
nop
nop
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], 0xee
mov dword [esp + 4], 1
mov dword [esp], 0x4d4420
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x124
mov dword [esp + 4], 1
mov dword [esp], 0x4d4510
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x12d
mov dword [esp + 4], 1
mov dword [esp], 0x4d4638
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], 0x4d4768
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], 0x4d47a4
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x59
mov dword [esp + 4], 1
mov dword [esp], 0x4d47e0
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x83
mov dword [esp + 4], 1
mov dword [esp], 0x4d483c
call sub.msvcrt.dll_fwrite
add esp, 0x18
pop ebx
ret
Function at 0x44cef0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
test eax, eax
je 0x44cf70
mov edi, str.default
mov ecx, 8
mov esi, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x44cf30
mov eax, dword [0x4bfa0c]
test eax, eax
je 0x44cf60
test ebx, ebx
je 0x44cf26
or byte [ebx + 0x2b], 1
mov dword [ebx + 4], eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
test ebx, ebx
je 0x44cf50
and byte [ebx + 0x2b], 0xfe
call fcn.0044cdf0
test eax, eax
je 0x44cf59
mov dword [ebx + 4], eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
call fcn.0044cdf0
test eax, eax
jne 0x44cf26
xor eax, eax
jmp 0x44cf26
mov eax, dword [0x4bfa14]
mov eax, dword [eax]
jmp 0x44cf1b
mov dword [esp], str.GNUTARGET
call sub.msvcrt.dll_getenv
test eax, eax
je 0x44cf12
jmp 0x44cf02

Function at 0x44e180
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor edx, edx
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x48]
lea ebp, [ebx + 1]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx]
test eax, eax
je 0x44e1cb
nop
mov ecx, eax
add ebp, 1
shl ecx, 0x11
add eax, ecx
add eax, edx
mov edx, eax
shr edx, 2
xor edx, eax
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x44e1b0
sub ebp, ebx
mov ecx, dword [esp + 0x14]
sub ebp, 1
mov eax, ebp
add edx, ebp
shl eax, 0x11
add edx, eax
mov esi, edx
shr esi, 2
xor esi, edx
xor edx, edx
mov eax, esi
div dword [ecx + 0xc]
mov eax, dword [ecx]
mov edi, dword [eax + edx*4]
test edi, edi
jne 0x44e1fc
jmp 0x44e220
mov edi, dword [edi]
test edi, edi
je 0x44e220
cmp dword [edi + 8], esi
nop
jne 0x44e1f6
mov dword [esp + 4], ebx
mov eax, dword [edi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x44e1f6
mov eax, edi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x18]
test edx, edx
je 0x44e2b4
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x44e2b0
mov eax, dword [esp + 0x14]
mov edi, ebp
add edi, 1
mov eax, dword [eax + 8]
jne 0x44e290
mov edx, dword [eax + 4]
mov ebp, 8
cmp edx, ebp
jae 0x44e29f
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004a9d70
mov ebp, eax
test ebp, ebp
je 0x44e2bb
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], ebp
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0044df70
add ebp, 8
and ebp, 0xfffffff8
je 0x44e24e
mov edx, dword [eax + 4]
cmp edx, ebp
jb 0x44e24e
mov ecx, dword [eax]
sub edx, ebp
mov dword [eax + 4], edx
add ecx, ebp
mov dword [eax], ecx
sub ecx, ebp
mov ebp, ecx
jmp 0x44e25c
mov ebp, ebx
jmp 0x44e270
xor eax, eax
jmp 0x44e217
mov dword [esp], 6
call fcn.0044baf0
xor eax, eax
jmp 0x44e217
Function at 0x458960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
movzx eax, byte [ebx + 0x28]
mov edx, eax
and edx, 0x18
cmp dl, 0x10
jne 0x45897c
test byte [ebx + 0x2a], 1
jne 0x458990
mov dword [esp], 5
call fcn.0044baf0
xor eax, eax
add esp, 0x18
pop ebx
ret
mov edx, dword [ebx + 4]
and eax, 7
mov eax, dword [edx + eax*4 + 0x84]
mov dword [esp], ebx
call eax
test eax, eax
jne 0x4589b0
add esp, 0x18
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x94]
mov dword [esp], ebx
call eax
test eax, eax
je 0x4589a6
and byte [ebx + 0x28], 0xf8
and byte [ebx + 0x2b], 0xed
and byte [ebx + 0x2a], 0x7f
or dword [ebx + 0x28], 0x10000
movzx eax, byte [ebx + 0x2b]
mov dword [ebx + 0x84], 0x4fe1a0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
and eax, 0xfffffffb
or eax, 1
mov byte [ebx + 0x2b], al
movzx eax, byte [ebx + 0x28]
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
and eax, 0xffffffe7
or eax, 8
mov byte [ebx + 0x28], al
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0xa4], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0xa0], 0
mov dword [esp], ebx
call fcn.0044d460
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.00454030
mov eax, 1
jmp 0x45898a
Function at 0x4a9cd0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp + 4], 1
jmp fcn.004a9850

Function at 0x4ba380
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.004ba3e0
Function at 0x4bad70
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4bada8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4bad9e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4badaa
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4bad90
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4bb5c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4bb76e
cmp byte [ebx], 0
je 0x4bb738
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4bb750
test al, 0x10
je 0x4bb738
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4bb624
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x4bb75f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x4bb6b3
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x4bb6b3
cmp al, 0x5c
je 0x4bb6b3
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x4bb6b5
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4bb730
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4bb730
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4bb730
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x2ea6cf2
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42f314
mov ecx, 0x65be140a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401120
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a171
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6ed428]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.CAmkProgDlg.0
mov dword [ebp - 4], 2
mov ecx, dword [0x6ef414]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0x6ef414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
add ecx, 0xe4
call fcn.00534e62
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
add ecx, 0xd0
call fcn.00402580
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 0x7c
call fcn.00534ce6
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
call fcn.00534297
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4018d0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a268
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x6ed428]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp + 8]
mov dword [0x6ef42c], eax
cmp dword [0x6ef41c], 0
je 0x401931
cmp dword [0x6ef618], 0
je 0x401931
cmp dword [0x6ef42c], 0
je 0x401927
push 8
mov ecx, dword [ebp - 0x64]
call fcn.0053b057
jmp 0x401931
push 0
mov ecx, dword [ebp - 0x64]
call fcn.0053b057
cmp dword [0x6ef42c], 0
je 0x401a34
mov ecx, dword [0x6ef414]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
call fcn.0042cc40
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 0xdc], eax
mov dword [ecx + 0xe0], edx
mov edx, dword [ebp - 0x64]
add edx, 0xd4
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x64]
add eax, 0xd0
push eax
mov ecx, dword [0x6ef0a8]
add ecx, 0x7c
call fcn.00538a44
lea ecx, [ebp - 0x18]
call fcn.004257f0
mov dword [ebp - 4], 0
push 2
push 0x50
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push str.HK_PauseRun
call fcn.0041d750
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.0041c800
add esp, 0xc
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x18]
call fcn.004025c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.00402580
lea ecx, [ebp - 0x10]
call fcn.004257f0
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x18]
push edx
push str.Paused__Press__s_to_Continue
lea eax, [ebp - 0x10]
push eax
call fcn.00402b40
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.0053afb5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00402580
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00402580
jmp 0x401a95
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd0]
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x7c
call fcn.0053afb5
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0xd8]
push eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx + 0xd4]
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
call fcn.0042cc40
mov ecx, dword [ebp - 0x64]
sub eax, dword [ecx + 0xdc]
sbb edx, dword [ecx + 0xe0]
mov dword [0x6ef6f0], eax
mov dword [0x6ef6f4], edx
mov edx, dword [0x6ef414]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x401ef0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov dword [0x6ef0a8], 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x401f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6ef0a0], eax
cmp dword [0x6ef0a8], 0
jne 0x401f35
push 0x6ef40c
push 0x32
push 0xa
call fcn.00405890
add esp, 0xc
jmp 0x401f19
pop ebp
ret
Function at 0x401fd0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov dword [0x6ef0a8], 0
push 0
mov eax, dword [0x6ef0a0]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x6ef0a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x6ef0a0], 0
pop ebp
ret

Function at 0x403290
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4032fc
lea ecx, [ebp - 0x1c]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4032fc
xor eax, eax
jmp 0x403314
push 0x80020003
mov eax, dword [ebp + 8]
or eax, 0x10
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x404700
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a5c8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x6ed428]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x10]
call fcn.004257f0
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4047d0
mov eax, dword [0x6ef480]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4047ca
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
movsx eax, byte [edx]
test eax, eax
je 0x4047c0
xor ecx, ecx
mov word [ebp - 0x20], cx
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00404340
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x40479e
movzx ecx, word [ebp - 0x20]
test ecx, ecx
jne 0x4047a0
jmp 0x4047c0
mov dx, word [ebp - 0x20]
mov word [ebp - 0x4e], dx
movzx eax, word [ebp - 0x4e]
push eax
lea ecx, [ebp - 0x10]
call fcn.00426170
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
jmp 0x40476d
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0x10]
sub eax, 0x10
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.00402920
add esp, 4
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x58]
add edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp - 0x24]
or ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402580
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40b670
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58af1b
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x6ed428]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
push 0xa4
call fcn.00534214
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x40b6c2
mov ecx, dword [ebp - 0x18]
call fcn.0040b300
mov dword [ebp - 0x70], eax
jmp 0x40b6c9
mov dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x6c]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.0040b740
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x68], eax
push 1
mov ecx, dword [ebp - 0x68]
call fcn.0041e2d0
mov ecx, dword [ebp - 0x68]
mov dword [ecx + 0xc], 0
mov edx, dword [ebp - 0x68]
mov dword [edx + 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0x30
push eax
mov ecx, dword [ebp - 0x6c]
add ecx, 0x30
call fcn.00405790
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret