joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0c10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x94
xor eax, eax
mov edx, dword [esp + 0x98]
mov dword [esp + 9], eax
push ebx
mov dword [esp + 0x11], eax
mov ebx, ecx
mov ecx, dword [esp + 0xa8]
mov word [esp + 0x15], ax
mov byte [esp + 0x17], al
mov dword [esp + 8], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], ecx
test eax, eax
mov dword [esp + 0x14], edx
je 0x4b0d56
mov eax, dword [str.EPIPEMAGQQ]
mov ecx, dword [0x4d8bdc]
mov dx, word [0x4d8be0]
mov dword [esp + 0x18], eax
mov al, byte [0x4d8be2]
push ebp
push esi
push edi
mov dword [esp + 0x28], ecx
mov byte [esp + 0x2e], al
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x2f]
mov word [esp + 0x2c], dx
rep stosd dword es:[edi], eax
mov edx, dword [ebx + 0x24]
lea esi, [ebx + 0x24]
stosb byte es:[edi], al
mov edi, dword [esp + 0xac]
mov ecx, esi
push edi
call dword [edx]
push eax
mov dword [esp + 0x14], eax
call sub.MFC42.DLL_operatornew
add esp, 4
lea ecx, [esp + 0x10]
mov ebp, eax
mov eax, dword [esi]
push ecx
mov ecx, dword [esp + 0xb4]
lea edx, [esp + 0x28]
push ebp
push edx
push edi
push ecx
mov ecx, esi
call dword [eax + 4]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [ebx + 0x10]
lea eax, [esp + 0x14]
push esi
mov dword [esp + 0x20], edx
mov edx, dword [ebx + 8]
push eax
lea ecx, [esp + 0x20]
push 0xc
push ecx
push edx
call edi
test eax, eax
jne 0x4b0d2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc
push eax
mov ecx, ebx
call fcn.004b0d90
cmp eax, 1
jne 0x4b0d4a
mov ecx, dword [esp + 0x10]
mov edx, dword [ebx + 8]
lea eax, [esp + 0x14]
push esi
push eax
push ecx
push ebp
push edx
call edi
test eax, eax
jne 0x4b0d37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x10]
push ecx
push eax
mov ecx, ebx
call fcn.004b0d90
jmp 0x4b0d4a
cmp dword [esp + 0x14], 0xc
je 0x4b0d03
jmp 0x4b0d43
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp edx, eax
je 0x4b0d4a
mov ecx, ebx
call fcn.004b0de0
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret 0x10

Function at 0x4b0e80
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], eax
mov dword [0x51b1bc], ecx
mov ecx, esi
call fcn.004b11c0
mov eax, dword [esi + 4]
lea edx, [esp + 8]
push edx
push 0
push eax
push 0x4b0ed0
push 0
push 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret 8
Function at 0x4b1530
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [edi + 4]
mov esi, eax
push ecx
call sub.WSOCK32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov edi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x4b1566
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov edx, edi
sub eax, 0x61c88647
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
add esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x4b158d
push esi
call sub.WSOCK32.dll_htonl
mov esi, dword [esp + 0x2c]
push edi
mov dword [esi], eax
call sub.WSOCK32.dll_htonl
mov dword [esi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x4b1600
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov eax, dword [esi]
push eax
call sub.WSOCK32.dll_ntohl
mov ecx, dword [esi + 4]
mov edi, eax
push ecx
call sub.WSOCK32.dll_ntohl
mov ebp, dword [esp + 0x28]
lea edx, [esp + 0x10]
mov esi, eax
lea ebx, [esp + 0x10]
sub ebp, edx
mov dword [esp + 0x24], 4
mov eax, dword [ebx + ebp]
push eax
call sub.WSOCK32.dll_ntohl
mov dword [ebx], eax
mov eax, dword [esp + 0x24]
add ebx, 4
dec eax
mov dword [esp + 0x24], eax
jne 0x4b1636
mov ecx, dword [esp + 0x14]
mov eax, 0xe3779b90
mov dword [esp + 0x24], 0x10
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, edi
shr edx, 5
add edx, ebx
mov ebx, edi
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x10]
xor edx, ebx
lea ebx, [eax + edi]
xor edx, ebx
sub esi, edx
mov edx, esi
mov ebx, esi
shr edx, 5
shl ebx, 4
add edx, ecx
add ebx, ebp
xor edx, ebx
lea ebx, [eax + esi]
xor edx, ebx
add eax, 0x61c88647
sub edi, edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x24], edx
jne 0x4b1660
push edi
call sub.WSOCK32.dll_htonl
mov edi, dword [esp + 0x2c]
push esi
mov dword [edi], eax
call sub.WSOCK32.dll_htonl
mov dword [edi + 4], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x5a0611
Capabilities:
Parse pe header

Disassembly:
push edi
jmp 0x5a060b
push esi
jmp 0x5a043e
jne 0x5a0684
jmp 0x5a0a5e
call 0x5a0509
inc ebx
xchg dword [esp], ebx
lea ebx, [ebx + 0x792]
xchg dword [esp], ebx
jmp 0x5a0c9a
add eax, 0x10000
jmp 0x5a0684
push edi
call 0x5a05ed
jbe 0x5a05e5
xchg dword [esp], edx
lea edx, [edx + 0x22d]
xchg dword [esp], edx
jmp 0x5a0b9b
call 0x5a0611
fiadd word [edi - 0x4972dbcc]
and eax, dword [ecx]
add byte [eax], al
xchg dword [esp], esi
jmp 0x5a06fe
shr eax, 0x10
jmp 0x5a0a19
call 0x5a0705
and esp, esi
xchg dword [esp], esi
lea esi, [esi + 0x509]
xchg dword [esp], esi
jmp 0x5a0c0c
shl eax, 0x10
jmp 0x5a09da
jne 0x5a089e
jmp 0x5a0c36
jmp 0x5a0bd0
jmp 0x5a0503
jne 0x5a0684
jmp 0x5a0baa
sub eax, 0x10000
jmp 0x5a094c
mov eax, dword [esp + 0x10]
jmp 0x5a0c87
cmp dword [0x5a0240], 0
jmp 0x5a07b9
cmp word [eax], 0x5a4d
jmp 0x5a04ed
ret
shl eax, 0x10
jmp 0x5a0889
add eax, dword [eax + 0x3c]
jmp 0x5a0ad9
push ebp
jmp 0x5a04db
cmp dword [eax], 0x4550
jmp 0x5a085a
push esp
jmp 0x5a05e6
call dword [0x5a0244]
jmp 0x5a0bd0
sub esp, 0xc
jmp 0x5a08f5
shr eax, 0x10
jmp 0x5a07a3
push ebx
jmp 0x5a0a94
pop eax
jmp 0x5a0558
mov dword [0x5a0240], 1
jmp 0x5a0813
push eax
jmp 0x5a0b24
pushal
jmp 0x5a0b1b

Function at 0x5a0705
Capabilities:
Parse pe header

Disassembly:
push edi
jmp 0x5a060b
push esi
jmp 0x5a043e
jne 0x5a0684
jmp 0x5a0a5e
call 0x5a0509
inc ebx
xchg dword [esp], ebx
lea ebx, [ebx + 0x792]
xchg dword [esp], ebx
jmp 0x5a0c9a
add eax, 0x10000
jmp 0x5a0684
push edi
call 0x5a05ed
jbe 0x5a05e5
xchg dword [esp], edx
lea edx, [edx + 0x22d]
xchg dword [esp], edx
jmp 0x5a0b9b
call 0x5a0611
fiadd word [edi - 0x4972dbcc]
and eax, dword [ecx]
add byte [eax], al
xchg dword [esp], esi
jmp 0x5a06fe
shr eax, 0x10
jmp 0x5a0a19
call 0x5a0705
and esp, esi
xchg dword [esp], esi
lea esi, [esi + 0x509]
xchg dword [esp], esi
jmp 0x5a0c0c
shl eax, 0x10
jmp 0x5a09da
jne 0x5a089e
jmp 0x5a0c36
jmp 0x5a0bd0
jmp 0x5a0503
jne 0x5a0684
jmp 0x5a0baa
sub eax, 0x10000
jmp 0x5a094c
mov eax, dword [esp + 0x10]
jmp 0x5a0c87
cmp dword [0x5a0240], 0
jmp 0x5a07b9
cmp word [eax], 0x5a4d
jmp 0x5a04ed
ret
shl eax, 0x10
jmp 0x5a0889
add eax, dword [eax + 0x3c]
jmp 0x5a0ad9
push ebp
jmp 0x5a04db
cmp dword [eax], 0x4550
jmp 0x5a085a
push esp
jmp 0x5a05e6
call dword [0x5a0244]
jmp 0x5a0bd0
sub esp, 0xc
jmp 0x5a08f5
shr eax, 0x10
jmp 0x5a07a3
push ebx
jmp 0x5a0a94
pop eax
jmp 0x5a0558
mov dword [0x5a0240], 1
jmp 0x5a0813
push eax
jmp 0x5a0b24
pushal
jmp 0x5a0b1b
Function at 0x1006277
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push 0x1001318
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10062cf
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x1001354
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10062c2
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10062d1
xor eax, eax
pop esi
leave
ret 4

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x4f5b5b0d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x56e91eef
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
mov ecx, 0x1ae55cee
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x3fc663eb
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4184b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x10
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0xa
push 0x4a86d0
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
call edi
mov esi, eax
test esi, esi
jne 0x4184f1
push 0xa
push str._AHK_WITH_ICON_
push eax
call edi
mov esi, eax
test esi, esi
je 0x418555
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [esp + 0x10], eax
test eax, eax
je 0x418555
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x418555
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0xc], eax
test eax, eax
je 0x418555
mov ecx, dword [esp + 0x20]
push 0xc
mov eax, 0xfde9
lea edx, [esp + 0x10]
call fcn.004741f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0xac8]
inc dword [0x4cb484]
mov dword [0x4c94ac], ecx
mov eax, 3
pop edi
pop esi
add esp, 0x10
ret 0xc
fldz
mov edx, dword [esp + 0x24]
sub esp, 8
fstp qword [esp]
push 0
push edx
push 0
push str.Could_not_extract_script_from_EXE.
call fcn.0047b3a0
add esp, 0x18
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 0xc
Function at 0x45fb2e
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0045fbad
jae 0x45fb3a
xor ecx, ecx
call fcn.0045fbad
jae 0x45fb64
xor eax, eax
call fcn.0045fbad
jae 0x45fb75
mov al, 0x10
call fcn.0045fbad
adc al, al
jae 0x45fb56
jne 0x45fba2
stosb byte es:[edi], al
jmp 0x45fb3b
call fcn.0045fbb9
dec ecx
loop 0x45fb81
mov eax, ebp
call fcn.0045fbb7
jmp 0x45fba3
lodsb al, byte [esi]
shr eax, 1
je 0x45fbc9
adc ecx, 2
mov ebp, eax
jmp 0x45fba3
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0045fbb7
cmp eax, 0x7d00
jae 0x45fba1
cmp eax, 0x500
jae 0x45fba2
cmp eax, 0x7f
ja 0x45fba3
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x45fb3b
pop ebp
ret 8

Function at 0x483b2e
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00483bad
jae 0x483b3a
xor ecx, ecx
call fcn.00483bad
jae 0x483b64
xor eax, eax
call fcn.00483bad
jae 0x483b75
mov al, 0x10
call fcn.00483bad
adc al, al
jae 0x483b56
jne 0x483ba2
stosb byte es:[edi], al
jmp 0x483b3b
call fcn.00483bb9
dec ecx
loop 0x483b81
mov eax, ebp
call fcn.00483bb7
jmp 0x483ba3
lodsb al, byte [esi]
shr eax, 1
je 0x483bc9
adc ecx, 2
mov ebp, eax
jmp 0x483ba3
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00483bb7
cmp eax, 0x7d00
jae 0x483ba1
cmp eax, 0x500
jae 0x483ba2
cmp eax, 0x7f
ja 0x483ba3
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x483b3b
pop ebp
ret 8
Function at 0x4013ba
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
xor ecx, ecx
push edi
test esi, esi
mov edi, edx
je 0x4013e9
xor eax, eax
test edi, edi
jle 0x4013e9
mov edx, eax
and edx, 0xf
mov dl, byte [edx + section..data]
add dl, cl
mov cl, byte [esi + eax]
xor cl, dl
mov byte [esi + eax], cl
inc eax
cmp eax, edi
movsx ecx, cl
jl 0x4013cc
pop edi
pop esi
ret

Function at 0x4013ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov ebp, edx
mov esi, ecx
xor edx, edx
test esi, esi
je 0x401421
xor eax, eax
test ebp, ebp
jle 0x401421
push ebx
push edi
mov cl, byte [esi + eax]
mov ebx, eax
and ebx, 0xf
movsx edi, cl
mov bl, byte [ebx + section..data]
add bl, dl
mov edx, edi
xor bl, cl
mov byte [esi + eax], bl
inc eax
cmp eax, ebp
jl 0x401400
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x401424
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x401f9d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x401023
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0x1e
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 0x2710
mov dword [ebp - 8], 0x405054
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push 0x401023
push 0
push 0x3e8
push dword [0x4064cc]
call sub.user32.dll_CreateDialogParamA
push 1
push dword [0x4064d4]
call sub.user32.dll_ShowWindow
push dword [0x4064d4]
call sub.user32.dll_UpdateWindow
push 0
mov eax, dword [sym.imp.msvcrt.dll_time]
call eax
add esp, 4
mov eax, 0x44d58bc6
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x402074
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x40204d
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x408230
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
push edi
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edx, dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x18]
call fcn.00408410
lea ecx, [esp + 0x20]
call fcn.00401920
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [section..data]
mov ecx, section..data
mov esi, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push esi
push dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
call fcn.0040c410
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
jne 0x4082c0
cmp dword [0x43bb1c], 1
jl 0x4082b9
lea ecx, [esp + 0x10]
call fcn.00408420
mov esi, 1
jmp 0x4082e2
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00403e10
lea ecx, [esp + 0x38]
call fcn.00404050
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.00408360
mov edi, dword [esp + 0x10]
add edi, 0xfffffff0
or edx, 0xffffffff
lea ecx, [edi + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408300
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x20]
call fcn.004026c0
lea ecx, [esp + 0x2c]
call fcn.004021e0
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40833b
push eax
call fcn.00415ed5
add esp, 4
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
cmp byte [esp + 0x18], 0
jne 0x408346
call dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b750
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42a291
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x4392c0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
mov eax, dword [0x4392c0]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, ebx
call fcn.00401aa0
mov ecx, dword [esi]
cmp dword [ecx - 0xc], 0
jne 0x40b7b2
push esi
mov ecx, ebx
call fcn.00401440
jmp 0x40b96a
add ecx, 0xfffffff0
call fcn.004023e0
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov dword [esp + 0x248], 0
cmp dword [esi - 0xc], 0
jle 0x40b835
push 0x25
push esi
call fcn.00416fbf
add esp, 8
test eax, eax
je 0x40b831
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x40b831
mov edx, esi
lea ecx, [esp + 0x18]
call fcn.0040fb30
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x24c], 1
call fcn.00401440
mov byte [esp + 0x248], 0
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b82d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], 0
jl 0x40b883
push 0x434988
push esi
call fcn.0041706d
mov edi, eax
add esp, 8
test edi, edi
je 0x40b883
sub edi, esi
sar edi, 1
cmp edi, 0xffffffff
je 0x40b883
cmp dword [esi - 0xc], 0
jl 0x40b8c7
push 0x434988
push esi
call fcn.0041706d
add esp, 8
test eax, eax
je 0x40b8c7
sub eax, esi
sar eax, 1
test eax, eax
jle 0x40b8c7
dec edi
js 0x40b8bd
cmp edi, dword [esi - 0xc]
jg 0x40b8bd
cmp word [esi + edi*2], 0x3a
je 0x40b8c7
lea ecx, [esp + 0x1c]
call fcn.00405c60
push dword [esp + 0x1c]
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, dword [esp + 0x20]
je 0x40b8e6
cmp eax, dword [esp + 0x24]
jbe 0x40b8d9
mov al, byte [esp + 0x13]
mov byte [esp + 0x13], al
push 0x436504
lea eax, [esp + 0x17]
push eax
call fcn.0041877b
push 0x80070057
call fcn.00401010
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.00401440
mov esi, dword [esp + 0x14]
jmp 0x40b945
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
call fcn.00405eb0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00406970
mov edi, eax
push 1
push 0x434988
mov ecx, edi
mov byte [esp + 0x250], 2
call fcn.00402580
push dword [esi - 0xc]
mov ecx, edi
push esi
call fcn.00402580
push edi
mov ecx, ebx
call fcn.00401440
mov byte [esp + 0x248], 0
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b945
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [esp + 0x248], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40b96a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00415eda
mov esp, ebp
pop ebp
ret 8
Function at 0x40de00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4392c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp eax, 0x7fffffff
jbe 0x40de55
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x11], al
push 0x436504
lea eax, [ebp - 0x11]
push eax
call fcn.0041877b
push eax
push dword [esi]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jns 0x40de77
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x12], al
push 0x436504
lea eax, [ebp - 0x12]
push eax
call fcn.0041877b
cmp eax, dword [esi + 4]
je 0x40de9f
cmp eax, dword [esi + 8]
jbe 0x40de95
mov al, byte [ebp - 0x14]
mov byte [ebp - 0x13], al
push 0x436504
lea eax, [ebp - 0x13]
push eax
call fcn.0041877b
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00405eb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40df50
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a76b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4392c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
push edx
push 0
push 0x410
mov dword [ebp - 0x234], 0
mov dword [ebx], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
jne 0x40dfb4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], eax
jmp 0x40e057
push dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, edi
lea ecx, [ebp - 0x228]
call fcn.0040e650
add esp, 4
lea eax, [ebp - 0x230]
push eax
push 4
lea eax, [ebp - 0x22c]
push eax
push edi
mov dword [ebp - 4], 0
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40e03b
xor eax, eax
push 0x104
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x22c]
push edi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x40e03b
lea eax, [ebp - 0x21c]
push eax
mov ecx, esi
call fcn.004057d0
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x228], 0
jne 0x40e069
push dword [ebp - 0x224]
call dword [ebp - 0x220]
jmp 0x40e069
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x228], 0
jne 0x40e057
push dword [ebp - 0x224]
call dword [ebp - 0x220]
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00415eda
mov esp, ebp
pop ebp
ret
Function at 0x40e240
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a738
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4392c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x1c]
push eax
push 0x40e090
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
cmp esi, edx
je 0x40e2cc
mov eax, dword [esi + 4]
test eax, eax
je 0x40e2f8
push eax
push dword [ebx]
call fcn.00416af4
add esp, 8
test eax, eax
jne 0x40e2bf
push esi
mov ecx, edi
call fcn.0040e3d0
mov edx, dword [ebp - 0x18]
add esi, 0x14
cmp esi, edx
jne 0x40e2a1
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x40e2e6
push dword [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00407ac0
push dword [ebp - 0x1c]
call fcn.00415ed5
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00401010
int3

Function at 0x40eb80
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push esi
push 0
push 0
push 0x8004
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40eba6
mov eax, esi
pop esi
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
push 0x4364e4
lea eax, [ebp + 8]
push eax
call fcn.0041877b
int3