joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b9f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov ebx, dword [ebp + 8]
push 0x70
push 0
push ebx
call sub.msvcrt.dll_memset
mov dword [ebx], 0x6a09e667
mov dword [ebx + 4], 0xbb67ae85
mov dword [ebx + 8], 0x3c6ef372
mov dword [ebx + 0xc], 0xa54ff53a
mov dword [ebx + 0x10], 0x510e527f
mov dword [ebx + 0x14], 0x9b05688c
mov dword [ebx + 0x18], 0x1f83d9ab
mov dword [ebx + 0x1c], 0x5be0cd19
mov dword [ebx + 0x6c], 0x20
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46ba50
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 8
mov ebx, dword [ebp + 8]
push 0x70
push 0
push ebx
call sub.msvcrt.dll_memset
mov dword [ebx], 0xc1059ed8
mov dword [ebx + 4], 0x367cd507
mov dword [ebx + 8], 0x3070dd17
mov dword [ebx + 0xc], 0xf70e5939
mov dword [ebx + 0x10], 0xffc00b31
mov dword [ebx + 0x14], 0x68581511
mov dword [ebx + 0x18], 0x64f98fa7
mov dword [ebx + 0x1c], 0xbefa4fa4
mov dword [ebx + 0x6c], 0x1c
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x46bc90
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x30
mov eax, 1
pop ebp
ret

Function at 0x46bd40
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x479c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi + 4]
mov edx, dword [ecx + 4]
cmp eax, edx
jl 0x479d22
mov edx, dword [ebp + 8]
mov ebx, esi
mov edi, ecx
cmp dword [edx + 8], eax
jl 0x479d34
mov eax, dword [edi + 4]
xor esi, esi
test eax, eax
jle 0x479cab
mov ecx, dword [ebp + 8]
lea edx, [esi*4]
inc esi
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebx]
mov ecx, dword [edi]
mov eax, dword [eax + edx]
xor eax, dword [ecx + edx]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + edx], eax
cmp dword [edi + 4], esi
jg 0x479c86
mov edx, dword [ebx + 4]
cmp esi, edx
jge 0x479cd8
lea ecx, [esi*4]
lea esi, [esi]
mov edx, dword [ebp + 8]
inc esi
mov eax, dword [edx]
mov edx, dword [ebx]
mov edx, dword [edx + ecx]
mov dword [eax + ecx], edx
add ecx, 4
mov edx, dword [ebx + 4]
cmp edx, esi
jg 0x479cc0
mov ecx, dword [ebp + 8]
test edx, edx
mov dword [ecx + 4], edx
mov ecx, 1
jle 0x479d18
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
sub eax, 4
lea eax, [eax + edx*4]
mov ecx, eax
mov eax, dword [eax]
test eax, eax
je 0x479d0a
jmp 0x479d0d
mov eax, dword [ecx - 4]
sub ecx, 4
test eax, eax
jne 0x479d0d
dec edx
jne 0x479d00
mov eax, dword [ebp + 8]
mov ecx, 1
mov dword [eax + 4], edx
lea esp, [ebp - 0xc]
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, edx
mov edx, dword [ebp + 8]
mov ebx, ecx
mov edi, esi
cmp dword [edx + 8], eax
jge 0x479c7d
push ecx
push ecx
push eax
push edx
call fcn.0041c690
add esp, 0x10
xor ecx, ecx
test eax, eax
jne 0x479c7d
jmp 0x479d18
Function at 0x47c390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x138
mov ecx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x20]
push ecx
call fcn.0043a2b0
mov dword [ebp - 0x134], eax
add esp, 0x10
mov edx, dword [ebp - 0x134]
xor eax, eax
test edx, edx
js 0x47c555
sub esp, 0xc
lea eax, [ebp - 0x120]
push eax
call fcn.0048f4f0
mov edi, dword [ebp + 8]
add esp, 0x10
test edi, edi
je 0x47c579
cmp dword [ebp + 0xc], 0xffffffff
je 0x47c585
test ebx, ebx
je 0x47c53e
mov esi, dword [ebp + 0x24]
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x130], 1
mov eax, dword [ebp - 0x130]
sub esp, 0xc
shr eax, 0x18
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0x130]
shr eax, 0x10
mov byte [ebp - 0xf], al
mov eax, dword [ebp - 0x130]
shr eax, 8
mov byte [ebp - 0xe], al
mov al, byte [ebp - 0x130]
mov byte [ebp - 0xd], al
push 0
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0048f5c0
add esp, 0x20
test eax, eax
je 0x47c55d
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0048f5a0
add esp, 0x10
test eax, eax
je 0x47c55d
push eax
lea eax, [ebp - 0x10]
push 4
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0048f5a0
add esp, 0x10
test eax, eax
je 0x47c55d
push eax
lea eax, [ebp - 0x50]
push 0
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.0048f520
add esp, 0x10
test eax, eax
je 0x47c55d
mov ebx, dword [ebp - 0x138]
cmp ebx, dword [ebp - 0x134]
jle 0x47c4c8
mov ebx, dword [ebp - 0x134]
lea eax, [ebp - 0x50]
push edi
push ebx
push eax
push esi
call sub.msvcrt.dll_memcpy
add esp, 0x10
cmp dword [ebp + 0x18], 1
jle 0x47c522
mov edi, 1
lea eax, [ebp - 0x50]
push ecx
push 0
push eax
mov edx, dword [ebp - 0x134]
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
call fcn.0048f860
add esp, 0x20
test ebx, ebx
jle 0x47c51c
xor edx, edx
nop
lea esi, [esi]
mov al, byte [edx + ebp - 0x50]
xor byte [edx + esi], al
inc edx
cmp edx, ebx
jne 0x47c510
inc edi
cmp edi, dword [ebp + 0x18]
jne 0x47c4e2
sub dword [ebp - 0x138], ebx
je 0x47c53e
mov eax, dword [ebp - 0x130]
add esi, ebx
inc eax
mov dword [ebp - 0x130], eax
jmp 0x47c403
sub esp, 0xc
lea eax, [ebp - 0x120]
push eax
call fcn.0048f410
mov eax, 1
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
lea eax, [ebp - 0x120]
push eax
call fcn.0048f410
xor eax, eax
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp + 0xc], 0
jmp 0x47c3e8
sub esp, 0xc
mov esi, dword [ebp + 8]
push esi
call sub.msvcrt.dll_strlen
add esp, 0x10
mov dword [ebp + 0xc], eax
jmp 0x47c3e8
Function at 0x4874e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xc
push str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x487512
sub esp, 0xc
push eax
call fcn.0042afb0
add esp, 0x10
mov ebx, eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
call fcn.00493130
sub esp, 0xc
push eax
call sub.msvcrt.dll_strlen
add esp, 0xc
lea esi, [eax + 0xd]
push 0x231
push str.external_openssl_crypto_conf_conf_mod.c
push esi
call fcn.00424910
add esp, 0x10
test eax, eax
je 0x487509
mov ebx, eax
call fcn.00493130
push edx
push esi
push eax
push ebx
call fcn.0042aea0
add esp, 0xc
push esi
push 0x4c6940
push ebx
call fcn.0042af00
add esp, 0xc
push esi
push str.openssl.cnf
push ebx
call fcn.0042af00
add esp, 0x10
jmp 0x487509
Function at 0x4943b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x494430
mov eax, dword [ebp + 8]
test eax, eax
je 0x49443a
test esi, esi
je 0x494409
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
push eax
push eax
lea eax, [ebp - 0x18]
push eax
mov edi, dword [ebp + 8]
mov edi, dword [edi + 8]
push edi
call fcn.0043b4b0
add esp, 0x10
test eax, eax
je 0x4943f8
mov eax, dword [eax + 8]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x4c80f3
mov ecx, 4
cld
mov edi, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x494448
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.default
mov dword [ebp - 0x14], ebx
push ecx
push ecx
push eax
mov edi, dword [ebp + 8]
mov edx, dword [edi + 8]
push edx
call fcn.0043b4b0
add esp, 0x10
test eax, eax
jne 0x4943ed
lea esi, [esi]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push ebx
call sub.msvcrt.dll_getenv
add esp, 0x10
jmp 0x4943f0
sub esp, 0xc
push ebx
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
jne 0x4943f0
jmp 0x494409
Function at 0x496780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x11c
mov ebx, dword [esp + 0x130]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x49693e
cmp byte [ebx], 0
je 0x496900
sub esp, 0xc
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x49692c
test al, 0x10
je 0x496900
push eax
push 0x104
push ebx
lea edi, [esp + 0x24]
push edi
call sub.msvcrt.dll__fullpath
pop eax
mov ecx, edi
mov eax, dword [ecx]
add ecx, 4
lea edx, [eax - 0x1010101]
xor eax, 0xffffffff
and edx, eax
and edx, 0x80808080
je 0x4967de
test edx, 0x8080
je 0x4968f2
add dl, dl
sbb ecx, 3
sub ecx, edi
lea eax, [ecx + 0x233]
push eax
call sub.msvcrt.dll_malloc
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x49691a
lea esi, [eax + 0x22c]
mov ebp, eax
push eax
push eax
push edi
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
cmp byte [ebx + 0x22c], 0
jne 0x4968a4
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0xc
mov word [eax + esi], 0x2a
lea eax, [ebx + 0x120]
mov dword [ebx + 0x224], 0xffffffff
mov dword [ebx + 0x228], 0
mov dword [ebx + 0x118], 0
mov word [ebx + 0x11c], 0
mov word [ebx + 0x11e], 0
push 0x104
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
pop edx
pop ecx
push 0x2f
lea edi, [esi + eax - 1]
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
cmp eax, edi
je 0x49683f
push eax
push eax
push 0x5c
push esi
call sub.msvcrt.dll_strrchr
add esp, 0x10
cmp edi, eax
je 0x49683f
sub esp, 0xc
push esi
call sub.msvcrt.dll_strlen
add esp, 0x10
mov word [eax + esi], 0x5c
jmp 0x49683f
shr edx, 0x10
add ecx, 2
jmp 0x496802
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0x14
add esp, 0x11c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0xc
jmp 0x496897
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 2
jmp 0x496897
call sub.msvcrt.dll__errno
xor ebp, ebp
mov dword [eax], 0xe
jmp 0x496897
Function at 0x10a6bce8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10a6bcf2
pushal
call 0x10a6bcf8
pop ebp
sub ebp, 0x10
sub ebp, 0xa6bce8
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10a6bd1c
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10a6bd25
mov eax, 0xa6bce8
add eax, ebp
add eax, 0x63
mov ecx, 0x5ab
mov edx, 0x781e576d
xor byte [eax], dl
inc eax
dec ecx
jne 0x10a6bd3c
jmp 0x10a6bd4f
out 0xa0, al
out 0xe4, al
push ecx
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
in al, dx
lodsb al, byte [esi]
xchg ebp, eax
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
outsb dx, byte [esi]
mov al, byte [0x6d6d6bd5]
insd dword es:[edi], dx
xlatb
inc ebp
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
lcall 0x61ec, 0xe6a56e8f
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
outsb dx, byte [esi]
test al, 0xe0
or dword [ecx - 0x6f], ecx
in al, 0x69
dec ecx
cmp eax, 0x4cb0cd05
insd dword es:[edi], dx
add eax, 0x6de9b22a
insb byte es:[edi], dx
inc ecx
dec ecx
add eax, 0x4cdc73fb
test dword [eax + 0x6d], ebp
insd dword es:[edi], dx
insd dword es:[edi], dx
test byte [ebx + 0x6d], al
insd dword es:[edi], dx
insd dword es:[edi], dx
loopne 0x10a6bda4
dec ecx
xchg ecx, eax
in al, 0x41
dec ecx
cmp dword [eax], esi
out 0xe8, al
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
out 0xf8, al
popal
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
out 0xe0, al
jge 0x10a6be1f
insd dword es:[edi], dx
insd dword es:[edi], dx
lodsb al, byte [esi]
test byte [edi + 0x5c], ch
outsd dx, dword [esi]
out dx, al
scasd eax, dword es:[edi]
imul esp, dword [edx], 0x929299e8
xchg edx, eax
xor byte [edi - 0x1e19929f], ch
dec ecx
imul ebp, dword [ebp + 0x6d], 0xb0cd056d
dec esp
insd dword es:[edi], dx
add eax, 0x6de9b22a
insb byte es:[edi], dx
inc ecx
dec ecx
cmp al, 0x85
push 0x846d6d6d
pop eax
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
cmp al, ah
add dword [ecx + 0x6d], ecx
xchg edx, eax
sbb byte [ecx - 0x6e], ah
sbb byte [ebp - 0x7b], ah
or ebp, dword [ebp + 0x6d]
insd dword es:[edi], dx
out 0xd0, al
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
pop esi
movsb byte es:[edi], byte [esi]
pop esi
mov edi, 0x256885ee
invalid
test byte [edx - 0x17], ah
jl 0x10a6be91
insd dword es:[edi], dx
insd dword es:[edi], dx
or ebp, esp
xchg esi, eax
xchg edx, eax
dec eax
invalid
xchg edx, eax
xchg edx, eax
outsd dx, dword [esi]
mov edi, 0x6d68e862
insd dword es:[edi], dx
insd dword es:[edi], dx
out 0x7b, eax
sub edi, dword [edi - 0x41]
invalid
Function at 0x401611
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
mov eax, 0x54e2ec
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004017ec
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40165f
push ebx
call fcn.00530341
add esp, 4
mov dword [ebp - 0x1c], esp
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40166c
add eax, 8
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x401693
push 0x48
push 0x40378bc
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4016a6
push ebx
call fcn.00530341
add esp, 4
mov eax, str.GetNativeSystemInfo
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call fcn.00401998
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x4016ca
push ebx
call fcn.00530341
add esp, 4
mov dword [ebp - 0x2c], esp
push dword [ebp - 0x28]
push dword [ebp - 0x20]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x4016f9
push 0x6e
push 0x40378bc
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x401710
mov eax, 0
jmp 0x4017ae
push 0x80000301
push 0
push 0x2c
push 1
mov ebx, 0x1bc
call fcn.005339f0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401745
push ebx
call fcn.00530341
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.004019b4
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x401781
push 0x128
push 0x40378bc
push 6
call fcn.0053034d
add esp, 0xc
push dword [ebp - 8]
call fcn.004019db
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 6
je 0x4017a4
cmp dword [ebp - 0xc], 9
je 0x4017a4
xor eax, eax
jmp 0x4017a9
mov eax, 1
jmp 0x4017ae
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4017bf
push ebx
call fcn.00530341
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x402882
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x402936
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x412c9b
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
xor eax, eax
call dword [0x634be3]
nop
nop
cmp dword [ebp - 4], esp
je 0x412cd3
push 0x24
push 0x40378be
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x412d30
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
push dword [ebp + 8]
xor eax, eax
call dword [0x634beb]
nop
nop
cmp dword [ebp - 4], esp
je 0x412d0f
push 0x74
push 0x40378be
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x412d30
pushal
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
rep movsb byte es:[edi], byte [esi]
popal
mov eax, dword [ebp + 0x10]
leave
ret 0xc
mov eax, 0
jmp 0x412d3a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x418124
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jle 0x418159
push dword [ebp + 8]
call fcn.00412ba5
mov dword [ebp - 0x10], eax
cmp word [ebp - 0x10], 0x5a4d
jne 0x418159
xor eax, eax
jmp 0x41815e
mov eax, 1
test eax, eax
je 0x418170
mov eax, 0
jmp 0x418339
fild dword [ebp + 8]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x564f5c]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.004017c4
push eax
call fcn.004019db
mov dword [ebp - 0x18], eax
fild dword [ebp + 8]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild dword [ebp - 0x18]
fstp qword [ebp - 0x28]
fadd qword [ebp - 0x28]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
call fcn.004017c4
mov dword [ebp - 4], eax
push dword [ebp - 4]
call fcn.004019db
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x4550
jne 0x418229
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x564f74]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.004017c4
push eax
call fcn.00412ba5
mov dword [ebp - 0x24], eax
push 0x80000301
push 0
push 0x2000
mov eax, dword [ebp - 0x24]
cwde
push 0x80000301
push 0
push eax
push 2
mov ebx, 0xc4
call fcn.00534140
add esp, 0x1c
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x418229
xor eax, eax
jmp 0x41822e
mov eax, 1
test eax, eax
je 0x418240
mov eax, 0
jmp 0x418339
fild dword [ebp - 4]
fstp qword [ebp - 0xc]
fld qword [ebp - 0xc]
fadd qword [0x564f84]
fstp qword [ebp - 0x14]
fld qword [ebp - 0x14]
call fcn.004017c4
push eax
call fcn.004019db
mov dword [ebp - 0x18], eax
fild dword [ebp + 8]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fild dword [ebp - 0x18]
fstp qword [ebp - 0x28]
fadd qword [ebp - 0x28]
fstp qword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
mov dword [ebp - 0x54], 0
push 0
push dword [ebp - 0x54]
mov dword [ebp - 0x58], 0
push 0
push dword [ebp - 0x58]
mov dword [ebp - 0x5c], 0
push 0
push dword [ebp - 0x5c]
mov dword [ebp - 0x60], 0
push 0
push dword [ebp - 0x60]
push 1
push 0
push 1
push 0
push 1
push 0
fld qword [ebp - 0x30]
call fcn.004017c4
push eax
call fcn.00413579
lea eax, [ebp + 8]
push eax
call fcn.00412dc1
jmp 0x418339
mov esp, ebp
pop ebp
ret 4
Function at 0x420430
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x420459
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x420455
imul eax, dword [ebx]
jmp 0x42044a
mov ecx, eax
test ecx, ecx
je 0x42049c
push ecx
push ebx
mov ebx, dword [ebx]
push ebx
add ebx, 0xc
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x420477
push ebx
call fcn.00530341
add esp, 4
pop ebx
add ebx, 4
push ebx
mov ebx, dword [ebx]
test ebx, ebx
je 0x42048b
push ebx
call fcn.00530341
add esp, 4
pop ebx
call fcn.00530341
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x42045f
call fcn.00530341
add esp, 4
mov eax, 0x54e350
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push dword [ebp + 8]
call fcn.004204ff
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0x42102e
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 8], esp
je 0x4204ea
push 0x31
push 0x402d752
push 6
call fcn.0053034d
add esp, 0xc
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
call fcn.00402a6c
jmp 0x4204f9
mov esp, ebp
pop ebp
ret 8

Function at 0x420a6c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x420aaf
push 0x19
push 0x402e2df
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x420ac6
mov eax, 0x54e350
jmp 0x420b75
inc dword [ebp - 4]
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x54e31c]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004017c4
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x1bc
call fcn.005339f0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x420b14
push ebx
call fcn.00530341
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004019b4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x420b56
push 0x136
push 0x402e2df
push 6
call fcn.0053034d
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x420b70
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.00530347
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x420b75
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x420b86
push ebx
call fcn.00530341
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x423c18
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x423c6a
mov dword [ebp - 0xc], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x423c62
push 0x4f
push 0x402d771
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 4], eax
jmp 0x423ca3
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
push 0
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x423ca0
push 0x7d
push 0x402d771
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x423cb7
mov eax, 0
jmp 0x423d1f
mov dword [ebp - 0xc], esp
push 0
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x423ce8
push 0x10b
push 0x402d771
push 6
call fcn.0053034d
add esp, 0xc
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x423d17
push 0x12f
push 0x402d771
push 6
call fcn.0053034d
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x423d1f
mov esp, ebp
pop ebp
ret 8