joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f244
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x40f2d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403494
mov eax, dword [ebp - 4]
call fcn.004036f0
test al, al
jbe 0x40f2c1
mov byte [ebp - 9], al
mov bl, 1
lea eax, [ebp - 0x10]
xor edx, edx
mov dl, bl
mov ecx, dword [ebp - 4]
mov dl, byte [ecx + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.0040363c
mov edx, dword [ebp - 0x10]
mov eax, edi
call fcn.004036f8
xor eax, eax
mov al, bl
mov edx, dword [edi]
movzx eax, byte [edx + eax - 1]
add esi, eax
imul esi, dword [ebp - 8]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 9]
jne 0x40f283
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f2de
lea eax, [ebp - 0x10]
call fcn.00403494
ret

Function at 0x40f2e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x40f398
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00403494
xor eax, eax
push ebp
push 0x40f378
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004036f0
test al, al
jbe 0x40f36e
mov byte [ebp - 5], al
mov bl, 1
lea eax, [ebp - 0xc]
xor edx, edx
mov dl, bl
mov dl, byte [edi + edx - 1]
mov ecx, esi
shr ecx, 8
xor dl, cl
call fcn.0040363c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call fcn.004036f8
mov eax, dword [ebp + 8]
xor eax, eax
mov al, bl
movzx eax, byte [edi + eax - 1]
add esi, eax
imul esi, dword [ebp - 4]
add esi, dword [ebp + 0xc]
inc ebx
dec byte [ebp - 5]
jne 0x40f331
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40f382
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f39f
lea eax, [ebp - 0xc]
call fcn.00403494
ret
Function at 0x41043c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebp, edx
mov ebx, eax
mov eax, 0x10000
call fcn.004025a8
mov dword [ebx + 0x2bc], eax
mov edi, ebp
test edi, edi
jle 0x410478
mov esi, 1
mov eax, ebp
dec eax
call fcn.004028a8
inc eax
mov edx, dword [ebx + 0x2bc]
mov word [edx + esi*2 - 2], ax
inc esi
dec edi
jne 0x410460
mov esi, ebp
cmp esi, 1
jl 0x4104ec
mov eax, dword [ebx + 0x2bc]
movzx eax, word [eax + esi*2 - 2]
mov ecx, dword [ebx + 0x2b4]
mov al, byte [ecx + eax - 1]
mov edx, dword [ebx + 0x2b4]
cmp al, byte [edx + esi - 1]
je 0x4104e7
mov ecx, dword [ebx + 0x2bc]
movzx ecx, word [ecx + esi*2 - 2]
mov edi, dword [ebx + 0x2b4]
xor byte [edx + esi - 1], al
mov edx, dword [ebx + 0x2bc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2b4]
mov cl, byte [eax + esi - 1]
xor byte [eax + edx - 1], cl
mov edx, dword [ebx + 0x2bc]
movzx edx, word [edx + esi*2 - 2]
mov eax, dword [ebx + 0x2b4]
mov dl, byte [eax + edx - 1]
xor byte [eax + esi - 1], dl
dec esi
test esi, esi
jne 0x41047f
mov edx, 0x10000
mov eax, dword [ebx + 0x2bc]
call fcn.004025c0
mov edi, ebp
test edi, edi
jle 0x410574
mov esi, 1
mov eax, dword [ebx + 0x2b4]
mov dl, byte [eax + esi - 1]
mov byte [eax + esi - 1], dl
mov eax, dword [ebx + 0x2b4]
mov al, byte [eax + esi - 1]
mov byte [esp], al
mov al, byte [ebx + 0x17]
xor al, byte [ebx + 0x16]
xor al, byte [ebx + 0x15]
xor al, byte [ebx + 0x14]
mov byte [esp + 1], al
mov eax, 0xff
call fcn.004028a8
mov edx, dword [ebx + 0x2b4]
mov dl, byte [edx + esi - 1]
xor dl, byte [esp + 1]
xor al, dl
mov edx, dword [ebx + 0x2b4]
mov byte [edx + esi - 1], al
xor eax, eax
mov al, byte [esp]
add eax, dword [ebx + 0x14]
add eax, dword [ebx + 0x10]
imul dword [ebx + 0x2cc]
add eax, dword [ebx + 0x2d0]
mov dword [ebx + 0x14], eax
inc esi
dec edi
jne 0x410507
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x410748
Capabilities:
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x194], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4107de
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x18], 0
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 4], esi
inc esi
jne 0x4107c1
call sub.wsock32.dll_WSAGetLastError
lea edx, [ebp - 0x194]
call fcn.00406da0
mov edx, dword [ebp - 0x194]
lea eax, [ebx + 0x28]
mov ecx, 0x4107f4
call fcn.0040373c
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
jmp 0x4107c5
mov byte [ebx + 0x18], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4107e5
lea eax, [ebp - 0x194]
call fcn.00403494
ret
Function at 0x410808
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x410896
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403494
cmp byte [ebx + 0x18], 0
je 0x410880
xor edx, edx
push ebp
push 0x410876
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.wsock32.dll_gethostbyname
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov ebx, eax
mov eax, esi
mov edx, ebx
call fcn.0040364c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x410880
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41089d
lea eax, [ebp - 4]
call fcn.00403494
ret

Function at 0x4108a4
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41096e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x19], 0
cmp byte [ebx + 0x18], 0
je 0x410958
cmp dword [ebx + 0x20], 0
jne 0x4108d8
cmp dword [ebx + 0x24], 0
je 0x410958
cmp dword [ebx + 0x20], 0
je 0x4108f1
mov eax, dword [ebx + 0x20]
call fcn.004038b4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0xc], eax
jmp 0x410915
cmp dword [ebx + 0x24], 0
je 0x410915
lea ecx, [ebp - 4]
mov edx, dword [ebx + 0x24]
mov eax, ebx
call fcn.00410808
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebx + 0xc], eax
mov word [ebx + 8], 2
mov ax, word [ebx + 0x1c]
push eax
call sub.wsock32.dll_htons
mov word [ebx + 0xa], ax
push 0x10
lea eax, [ebx + 8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
cmp eax, 0xffffffff
jne 0x410950
lea eax, [ebx + 0x28]
mov edx, 0x410984
call fcn.004034e8
mov byte [ebx + 0x19], 0
jmp 0x410958
mov byte [ebx + 0x19], 1
test eax, eax
jne 0x410929
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410975
lea eax, [ebp - 4]
call fcn.00403494
ret
Function at 0x410994
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x410a70
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [edi + 0x18], 0
je 0x410a55
cmp byte [edi + 0x19], 0
je 0x410a55
mov eax, dword [ebp - 4]
call fcn.004036f0
mov esi, eax
test esi, esi
je 0x410a55
cmp esi, 0x7d0
jbe 0x410a30
mov ebx, 1
cmp esi, ebx
jbe 0x410a30
lea eax, [ebp - 8]
call fcn.00403494
lea eax, [ebp - 8]
push eax
mov ecx, 0x7d0
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004038f8
push 0
mov eax, dword [ebp - 8]
call fcn.004036f0
push eax
lea eax, [ebp - 8]
call fcn.004038c0
push eax
mov eax, dword [edi + 4]
push eax
call sub.wsock32.dll_send
add ebx, 0x7d0
jmp 0x4109ec
cmp esi, 0x7d0
ja 0x410a55
push 0
mov eax, dword [ebp - 4]
call fcn.004036f0
push eax
lea eax, [ebp - 4]
call fcn.004038c0
push eax
mov eax, dword [edi + 4]
push eax
call sub.wsock32.dll_send
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410a77
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034b8
ret
Function at 0x411a54
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x64
call fcn.004025a8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x64
xor eax, eax
push ebp
push 0x411aa2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040364c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x411aac
mov eax, dword [ebp - 4]
call fcn.004025c0
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x411edc
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x411fc3
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x411f8d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403494
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x411f4f
pop dword fs:[0]
add esp, 8
jmp 0x411fa2
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x411f77
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.004072b4
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.004036f8
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x411f56
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x411f97
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004034e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411fca
lea eax, [ebp - 0x204]
call fcn.00403494
lea eax, [ebp - 8]
call fcn.00403494
ret
Function at 0x413944
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x41394c
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x413b59
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x417350]
mov edx, dword [0x417348]
mov eax, 0x80000000
call fcn.00411d30
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
call fcn.0040f89c
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.0040352c
mov eax, dword [ebp - 0x18]
call fcn.00406f5c
cmp al, 1
jne 0x4139f3
xor edx, edx
mov eax, dword [ebp - 0x18]
call fcn.00413214
push 0
mov ecx, dword [0x417354]
mov edx, dword [0x417348]
mov eax, 0x80000000
call fcn.00411c60
push 0
mov ecx, dword [0x417350]
mov edx, dword [0x417348]
mov eax, 0x80000000
call fcn.00411c60
push 0
mov ecx, dword [0x41734c]
mov edx, dword [0x417348]
mov eax, 0x80000000
call fcn.00411c60
mov dl, 1
mov eax, dword [0x40b81c]
call fcn.00402af4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
call fcn.00411c28
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 8]
call fcn.00406ffc
lea eax, [ebp - 0x24]
call fcn.00411c28
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0xc]
call fcn.00407058
mov eax, dword [ebp - 8]
call fcn.004036f0
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x413a4c
lea eax, [ebp - 0x10]
mov ecx, 0x413b70
mov edx, dword [ebp - 8]
call fcn.0040373c
jmp 0x413a57
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040352c
mov edx, 0x413b7c
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x413b90
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x413ba0
push dword [ebp - 0xc]
push 0x413bb0
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.004037b0
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x413bc0
push dword [ebp - 0xc]
push 0x413bd4
push 0x413be0
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.004037b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov edx, 0x413bf4
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
push ebp
push 0x413b25
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov ecx, 0x413c14
mov edx, dword [ebp - 0x10]
call fcn.0040373c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
push 0x413c20
mov eax, dword [ebp - 0x14]
call fcn.004038b4
push eax
push 0x413c24
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413b2f
mov eax, dword [ebp - 4]
call fcn.00402b24
xor eax, eax
call fcn.004033f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413b60
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.004034b8
ret
Function at 0x414a5c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x414bd3
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
call sub.user32.dll_GetForegroundWindow
mov edi, eax
push 0xc8
mov eax, dword [ebp - 4]
push eax
push edi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov edx, dword [ebp - 8]
mov eax, dword [0x417364]
call fcn.00403980
test eax, eax
jg 0x414ac0
xor eax, eax
mov dword [esi + 0x30], eax
xor ebx, ebx
cmp bl, 1
jne 0x414b04
mov eax, dword [esi + 0x34]
mov edx, dword [ebp - 8]
call fcn.00403800
je 0x414b04
lea eax, [esi + 0x34]
mov edx, dword [ebp - 8]
call fcn.004034e8
mov eax, dword [0x4173fc]
mov edx, dword [ebp - 8]
call fcn.004034e8
mov eax, dword [0x417444]
mov eax, dword [eax]
mov edx, 0x414bec
call fcn.00403800
je 0x414b04
mov eax, edi
call fcn.00415170
test bl, bl
je 0x414bb0
mov eax, dword [0x417560]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x414bb0
xor eax, eax
push ebp
push 0x414ba6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x417560]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x414b9c
inc ebx
xor esi, esi
lea ecx, [ebp - 0xc]
mov eax, dword [0x417560]
mov eax, dword [eax]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00403980
test eax, eax
jle 0x414b98
mov edx, dword [0x417554]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
call fcn.00403980
test eax, eax
jg 0x414b9c
mov eax, dword [0x417554]
push dword [eax]
push dword [ebp - 0xc]
push 0x414bf8
mov eax, dword [0x417554]
mov edx, 3
call fcn.004037b0
jmp 0x414b9c
inc esi
dec ebx
jne 0x414b44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414bb0
mov eax, dword [ebp - 4]
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414bda
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004034b8
ret
Function at 0x415418
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x415616
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
mov eax, 0xc8
call fcn.004025a8
mov ebx, eax
mov byte [ebp - 0xd], 1
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
mov eax, dword [ebp - 4]
push eax
push esi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov eax, dword [ebp - 0x14]
mov edx, 0x41562c
call fcn.00403800
je 0x415489
mov byte [ebp - 0xd], 0
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.0040364c
mov eax, dword [ebp - 0x18]
mov edx, 0x41563c
call fcn.00403800
je 0x4154b2
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
jne 0x4154d3
cmp dword [edi + 0x4c], 0
je 0x4155df
mov eax, edi
call fcn.0041537c
xor eax, eax
mov dword [edi + 0x4c], eax
jmp 0x4155df
mov dword [edi + 0x4c], esi
push 0
push 0x415648
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x41551c
push ebx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov edx, 0x41565c
call fcn.0040373c
lea eax, [edi + 0x44]
mov edx, dword [ebp - 8]
call fcn.004034e8
push 0
push 0x415664
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x4155df
mov eax, dword [0x417444]
mov eax, dword [eax]
mov edx, 0x415674
call fcn.00403800
jne 0x41557d
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.0040364c
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov edx, 0x415680
call fcn.0040373c
lea eax, [edi + 0x48]
mov edx, dword [ebp - 8]
call fcn.004034e8
jmp 0x4155df
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.0040364c
cmp dword [ebp - 0xc], 0
je 0x4155df
lea eax, [edi + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.004034e8
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov edx, 0x415680
call fcn.0040373c
lea eax, [edi + 0x48]
mov edx, dword [ebp - 8]
call fcn.004034e8
mov eax, dword [ebp - 4]
call fcn.004025c0
mov eax, ebx
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41561d
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.004034b8
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004034b8
ret
Function at 0x41594c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x415b31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 8], eax
mov eax, 0xc8
call fcn.004025a8
mov dword [ebp - 4], eax
mov bl, 1
call sub.user32.dll_GetForegroundWindow
mov edi, eax
push 0xc8
mov eax, dword [ebp - 8]
push eax
push edi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040364c
mov eax, dword [ebp - 0x10]
mov edx, 0x415b48
call fcn.00403800
je 0x4159b7
xor ebx, ebx
push 0xc8
mov eax, dword [ebp - 4]
push eax
push edi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040364c
mov eax, dword [ebp - 0x14]
mov edx, 0x415b58
call fcn.00403800
je 0x4159e2
xor ebx, ebx
test bl, bl
jne 0x415a01
cmp dword [esi + 0x3c], 0
je 0x415b06
mov eax, esi
call fcn.004158c0
xor eax, eax
mov dword [esi + 0x3c], eax
jmp 0x415b06
mov dword [esi + 0x3c], edi
xor edx, edx
push ebp
push 0x415afc
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0x415b64
push 0
push edi
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x415af2
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x30]
mov ecx, dword [ebp - 0xc]
mov edx, 0x415b74
call fcn.0040373c
push 0
push 0x415b64
push ebx
push edi
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x415af2
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x38]
mov ecx, dword [ebp - 0xc]
mov edx, 0x415b88
call fcn.0040373c
push 0
push 0x415b64
push ebx
push edi
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x415af2
mov edx, dword [ebp - 4]
push edx
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040364c
lea eax, [esi + 0x34]
mov edx, 0x415b9c
call fcn.004034e8
mov edx, dword [ebp - 0xc]
mov eax, 0x415bb0
call fcn.00403980
test eax, eax
jg 0x415af2
lea eax, [esi + 0x34]
mov edx, dword [ebp - 0xc]
call fcn.004036f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x415b06
mov eax, dword [ebp - 8]
call fcn.004025c0
mov eax, dword [ebp - 4]
call fcn.004025c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415b38
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004034b8
ret
Function at 0x415e34
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x415fae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40edf4]
call fcn.00402af4
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040352c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040ee48
mov eax, dword [ebp - 0x14c]
mov edx, 0x415fc4
call fcn.00403800
je 0x415ede
push dword [ebp - 4]
push 0x415fc4
push 0x415fd0
lea eax, [ebp - 4]
mov edx, 3
call fcn.004037b0
lea eax, [ebp - 8]
mov ecx, 0x415fc4
mov edx, dword [ebp - 4]
call fcn.0040373c
jmp 0x415eeb
lea eax, [ebp - 4]
mov edx, 0x415fd0
call fcn.004036f8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415f83
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x415f1d
add eax, 0xffffffe8
sub eax, 8
jae 0x415f6c
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x415f6c
lea eax, [ebp - 0x11c]
cmp eax, 0x415fd4
je 0x415f6c
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004036c4
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.0040373c
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x415f07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415fb5
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.004034b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034b8
ret