joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60ddcc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
push ebx
mov dword [eax], ebx
push ebx
mov dword [ebp - 0x3c], eax
xor eax, eax
push ebx
mov word [edi], ax
push esi
mov dword [ebp - 0x40], ecx
mov dword [ecx], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
jne 0x60de6e
push ebx
lea eax, [ebp - 0x34]
push eax
push 0x20
lea eax, [ebp - 0x30]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x60de6e
cmp dword [ebp - 0x34], 0x20
jne 0x60de6e
cmp dword [ebp - 0x30], 0x504d444d
jne 0x60de6e
push ebx
push ebx
push dword [ebp - 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp - 0x24]
jne 0x60de6e
cmp dword [ebp - 0x28], ebx
jbe 0x60de6e
push 0
lea eax, [ebp - 0x34]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x60de6e
cmp dword [ebp - 0x34], 0xc
jne 0x60de6e
cmp dword [ebp - 0x10], 7
je 0x60de81
inc ebx
cmp ebx, dword [ebp - 0x28]
jb 0x60de45
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 0x10
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x60de6e
push 0
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, ebx
jne 0x60de6e
push 0
lea eax, [ebp - 0x34]
push eax
push 2
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x60de6e
cmp dword [ebp - 0x34], 2
jne 0x60de6e
movzx eax, word [ebp - 0x38]
push 5
pop ecx
sub eax, 0
je 0x60dee4
sub eax, ecx
je 0x60dedd
sub eax, 1
je 0x60ded6
sub eax, 3
jne 0x60de6e
mov eax, 0x8664
jmp 0x60dee9
mov eax, 0x200
jmp 0x60dee9
mov eax, 0x1c4
jmp 0x60dee9
mov eax, 0x14c
mov word [edi], ax
mov eax, dword [ebp - 0x3c]
mov dword [eax], ecx
xor eax, eax
mov ecx, dword [ebp - 0x40]
inc eax
mov dword [ecx], eax
jmp 0x60de70
Function at 0x60e852
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
mov edi, 0x104
push edi
push esi
call fcn.00437d78
mov ebx, eax
test ebx, ebx
jne 0x60e8db
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x60e8db
and dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
call fcn.0060e916
test eax, eax
js 0x60e8db
mov edi, dword [ebp - 4]
cmp edi, 0xff
jae 0x60e8db
push 0x60e8e4
push 0x104
push esi
call fcn.00495bc2
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x60e8db
push 0x443a90
push 5
lea edi, [esi + edi*2]
push edi
call fcn.00437d78
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x60e8db
xor eax, eax
mov word [edi], ax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x60f617
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x7211a8], 0
push edi
mov edi, 0x7211b0
jne 0x60f65a
push 0x105
push edi
push 0x60f6d4
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x60f646
cmp eax, 0x104
jbe 0x60f65a
xor eax, eax
mov dword [0x7211a8], 1
mov word [0x7211b0], ax
jmp 0x60f6ce
cmp word [0x7211b0], 0
je 0x60f6ce
push esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test esi, esi
jne 0x60f672
inc esi
cmp dword [0x7211a8], 0
jne 0x60f681
mov dword [0x7211a8], esi
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0x489d4c
push edi
push eax
call fcn.00574562
add esp, 0xc
test eax, eax
jne 0x60f6cd
push dword [ebp + 8]
mov ecx, dword [0x7211a8]
mov eax, esi
sub eax, ecx
push eax
movzx eax, cx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 0x60f6f8
push dword [ebp - 4]
call fcn.005047aa
push dword [ebp - 4]
call fcn.0057461f
add esp, 0x20
pop esi
pop edi
leave
ret 4
Function at 0x610b65
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push 0x14
mov eax, 0x6e7dc0
call fcn.00401167
mov ebx, ecx
and dword [ebp - 0x10], 0
xor edi, edi
inc edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x10]
push eax
push 0x610c6c
push edi
push 0
push 0x610c5c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x610ba4
cmp eax, 0x80040154
jne 0x610bfa
jmp 0x610c39
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x7244d4]
call esi
test eax, eax
js 0x610bfa
test byte [ebp - 0x14], 7
je 0x610c39
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp - 0x10]
call fcn.00610adc
test eax, eax
js 0x610bfa
lea eax, [ebp - 0x1c]
push eax
push 2
push dword [ebp - 0x10]
call fcn.00610adc
test eax, eax
js 0x610bfa
lea eax, [ebp - 0x20]
push eax
push 4
push dword [ebp - 0x10]
call fcn.00610adc
test eax, eax
jns 0x610bfe
mov edi, eax
jmp 0x610c39
cmp dword [ebp - 0x18], 0
jne 0x610c10
cmp dword [ebp - 0x1c], 0
jne 0x610c10
cmp dword [ebp - 0x20], 0
je 0x610c39
mov eax, dword [ebp - 0x10]
mov ecx, ebx
and dword [ebp - 0x10], 0
push eax
call fcn.006105db
mov eax, dword [ebp - 0x14]
xor edi, edi
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x18]
mov byte [ebx + 8], al
mov eax, dword [ebp - 0x1c]
mov byte [ebx + 9], al
mov eax, dword [ebp - 0x20]
mov byte [ebx + 0xa], al
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x610c54
mov edx, dword [ecx]
push ecx
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x7244d4]
call esi
mov eax, edi
call fcn.004026a3
ret
Function at 0x612df3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
xor edx, edx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 0x10], edx
mov esi, edi
mov dword [eax], edx
mov dword [ebp - 4], edx
push edx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x612ecd
add ebx, eax
lea ecx, [esi + 2]
mov dword [ebp - 8], ebx
xor edx, edx
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x612e2b
mov eax, dword [ebp - 4]
sub esi, ecx
sar esi, 1
inc eax
add eax, esi
mov dword [ebp - 4], eax
lea esi, [edi + eax*2]
cmp word [esi], dx
jne 0x612e10
push ebx
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
jne 0x612e60
mov eax, 0x8007000e
jmp 0x612ed9
mov edx, dword [ebp + 8]
xor eax, eax
mov ecx, eax
mov ebx, eax
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 8]
lea esi, [edx + ecx*2]
cmp eax, ebx
jbe 0x612e98
sub eax, ebx
push eax
mov dword [ebp - 0xc], eax
lea eax, [edi + ebx*2]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x612ec6
cmp eax, dword [ebp - 0xc]
ja 0x612ec6
mov ecx, dword [ebp - 4]
add ebx, eax
mov edx, dword [ebp + 8]
lea eax, [esi + 2]
mov dword [ebp - 0xc], eax
mov ax, word [esi]
add esi, 2
cmp ax, word [ebp - 0x10]
jne 0x612e9e
sub esi, dword [ebp - 0xc]
inc ecx
sar esi, 1
xor eax, eax
add ecx, esi
mov dword [ebp - 4], ecx
cmp word [edx + ecx*2], ax
jne 0x612e6c
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
xor eax, eax
jmp 0x612ed9
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x613ad0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0060fb63
test al, al
jne 0x613b3e
mov esi, 0x105
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x613b3e
push 0x613b50
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.005746be
add esp, 0xc
test eax, eax
jne 0x613b3e
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x613b3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x613b3e
xor al, al
jmp 0x613b40
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040548e
leave
ret
Function at 0x62079c
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
and dword [esi + 0x10], 0
mov byte [esi + 0xc], al
mov dword [esi], ecx
test ecx, ecx
je 0x6207bb
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ecx
test ecx, ecx
je 0x6207cb
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov ecx, dword [ebp + 0x10]
mov dword [esi + 8], ecx
test ecx, ecx
je 0x6207db
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
push esi
mov dword [esi + 0x18], eax
push dword [0x6fe230]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x62080c
Capabilities:
Set thread local storage value

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi]
test ecx, ecx
je 0x62081b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x620828
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x620835
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [esi + 0xc]
call fcn.00621fc8
push 0
push dword [0x6fe230]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
ret
Function at 0x63b9c9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x47de84
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x63b9f9
mov eax, 0x80004005
jmp 0x63ba4d
push esi
push 0x47e004
push 0x47dff4
xor eax, eax
push eax
push eax
push eax
call fcn.004915a7
mov esi, eax
test esi, esi
jns 0x63ba3f
push 0xffffffffffffffff
push esi
push 0x63ba60
lea eax, [ebp - 0x104]
push 0x80
push eax
call fcn.0048cbc6
add esp, 0x14
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x63ba44
cmp esi, 1
jne 0x63ba4b
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040548e
leave
ret 4

Function at 0x6510c9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6eb751
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6fe1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0x448a78
mov dword [edi + 8], 0x448a88
mov dword [edi + 0xc], 0x448a98
mov dword [ebp - 4], 3
xor ebx, ebx
mov ecx, dword [edi + 0x2c]
test ecx, ecx
je 0x651121
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [edi + 0x2c], ebx
mov byte [ebp - 4], 2
lea esi, [edi + 0x38]
push esi
call fcn.00650f1b
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov byte [ebp - 4], 1
lea esi, [edi + 0x30]
push esi
call fcn.00650f1b
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov byte [ebp - 4], bl
lea eax, [edi + 0x10]
push eax
mov dword [edi + 0xc], 0x4416b4
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
or dword [ebp - 4], 0xffffffff
mov dword [edi], fcn.005953a9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
sub ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
pop edi
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
test eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
test eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
test eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x402580
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add edx, 7
shr edx, 3
dec edx
mov dword [ebp - 0xc], edx
js 0x402645
push ebx
push esi
push edi
jmp 0x4025a3
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*8 - 8]
test edx, edx
jne 0x4025ae
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
bswap ecx
bswap eax
mov edx, 0xc6ef3720
mov dword [ebp - 4], 0x20
mov edi, dword [ebp + 0x10]
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0x10]
sub eax, esi
add edx, 0x61c88647
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
sub ecx, esi
dec dword [ebp - 4]
jne 0x4025c8
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
bswap ecx
mov dword [esi + edx*8], ecx
lea ecx, [esi + edx*8 + 4]
bswap eax
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax]
xor dword [esi + edx*8], edi
mov eax, dword [eax + 4]
xor dword [ecx], eax
dec edx
mov dword [ebp - 0xc], edx
jns 0x4025a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319f], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319f]
mov dword [ebp - 0x48], eax
mov eax, 0x401b7b
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319f]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret
Function at 0x3000778a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0x4ff
push esi
push ebx
lea eax, [ebp + 8]
push eax
push 1
call dword [sym.imp.MSO.dll_Ordinal_7900]
cmp eax, 1
mov dword [ebp + 0xc], eax
jne 0x3000781f
jmp 0x300077f1
cmp dword [ebp + 0x10], ebx
je 0x300077dd
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x300077f1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
jne 0x300077c7
cmp esi, 0xffffffff
je 0x300077aa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, esi
ja 0x30007818
sub esi, ecx
jmp 0x300077a7
mov dword [ebp + 0xc], 0x102
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call fcn.300076ae
test al, al
pop edi
pop esi
pop ebx
je 0x3000783f
mov eax, dword [ebp + 0xc]
jmp 0x30007878
mov eax, 0x80
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.300076ae
test al, al
jne 0x3000783a
cmp dword [ebp + 0xc], 0xffffffff
jne 0x30007873
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.30003af0
jmp 0x30007878
mov eax, 0x800705b4
leave
ret 0xc
Function at 0x403604
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push sym.Momen.exe_procGetList
xor esi, esi
xor edi, edi
mov ecx, 0x52
push esi
dec ecx
jne 0x40361b
mov ebx, dword [ebp + 8]
mov eax, 2
call fcn.004681f4
mov ebx, dword [ebp + 8]
push 0
push 0
push 0x128
push 0x1280008
push 0
call fcn.00467eb6
mov dword [ebp - 0x88], 0
mov dword [0x46e548], 0
push 0
push 0xf
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
call fcn.0046d0ef
mov edi, eax
mov eax, 0x128
mov dword [ebp - 0x1bc], eax
lea ebx, [ebp - 0x1bc]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
call fcn.0046d0ef
mov esi, eax
cmp esi, 0
jmp loc.004a1c88

Function at 0x40373d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.0040373d
xor esi, esi
xor edi, edi
mov ecx, 0x54
push esi
dec ecx
jne 0x403754
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
call fcn.0046d0ef
mov edi, eax
cmp edi, 0xffffffff
je 0x40386f
mov edx, dword [ebp + 8]
call fcn.0046d792
call fcn.00469255
call fcn.0046bcb4
call fcn.0046bd05
lea ebx, [ebp + 8]
call fcn.0046cdad
mov eax, 0x128
mov dword [ebp - 0x1bc], eax
lea ebx, [ebp - 0x1bc]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32First]
call fcn.0046d0ef
mov esi, eax
cmp esi, 0
je 0x403861
lea ebx, [ebp - 0x198]
call fcn.0046d62c
call fcn.00469255
call fcn.0046bcb4
call fcn.0046bd05
lea ebx, [ebp - 0x1c4]
call fcn.0046cdad
mov edx, dword [ebp - 0x1c4]
call fcn.0046d792
mov edx, 0x473f00
call fcn.0046d7a6
call fcn.0046c1f2
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp - 0x1c4]
call fcn.0046d792
mov edx, 0x473f00
call fcn.0046d7a6
mov eax, dword [ebp - 0x1c0]
call fcn.0046c279
mov edx, dword [ebp + 8]
call fcn.0046d792
call fcn.0046d04d
jne 0x403845
mov eax, dword [ebp - 0x1b4]
jmp loc.004a0e78
lea ebx, [ebp - 0x1bc]
push ebx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_Process32Next]
call fcn.0046d0ef
mov esi, eax
jmp 0x4037b3
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.0046d0ef
call fcn.0046d6c2
mov eax, dword [ebp - 0x88]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x403891
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.00403891
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
call fcn.0046d0ef
mov esi, eax
mov eax, esi
test eax, eax
je 0x4038ed
push 0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
call fcn.0046d0ef
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call fcn.0046d0ef
mov dword [ebp - 0x88], 0xffffffff
mov eax, dword [ebp - 0x88]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4421eb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
sub esp, 0x64
push fcn.004421eb
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov word [0x470a74], 1
mov ebx, dword [ebp + 0xc]
fild word [ebx]
fstp qword [ebp - 0x94]
fld1
fstp qword [ebp - 0x8c]
fldz
fstp qword [0x470a60]
jmp 0x4423a7
fld qword [0x470a60]
fiadd word [0x4836c8]
fistp qword [ebp - 0x5c]
push dword [ebp - 0x5c]
mov ebx, 0x46f020
push ebx
fld qword [0x470a60]
fiadd word [0x4836c8]
fistp qword [ebp - 0x5c]
push dword [ebp - 0x5c]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.USER32.DLL_GetDlgItem]
call fcn.0046d0ef
push eax
call dword [sym.imp.USER32.DLL_GetWindowTextA]
call fcn.0046d0ef
mov ebx, 0x46f020
call fcn.0046d62c
fld qword [0x470a60]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
shl eax, 2
add eax, dword [0x471ad4]
mov ebx, eax
call fcn.0046cdad
fld qword [0x470a60]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ebx, dword [0x471ad4]
push dword [ebx + eax*4]
fld qword [0x470a60]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ebx, dword [0x4731f0]
mov edx, dword [ebx + eax*4]
call fcn.0046d088
je 0x442395
mov eax, 0x34
add eax, dword [0x471d18]
mov edx, dword [eax]
call fcn.0046d792
mov edx, str.nderung_von_Vollzeit_auf_Teilzeit
call fcn.0046d7a6
call fcn.0046d04d
jne 0x442395
xor eax, eax
movsx ecx, word [0x4715d8]
cmp ecx, eax
jne 0x442395
fld qword [0x470a60]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov ebx, dword [0x471ad4]
mov edx, dword [ebx + eax*4]
call fcn.0046d792
fld qword [0x470a60]
fistp qword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
shl eax, 2
add eax, dword [0x4731f0]
mov ebx, eax
call fcn.0046cdad
jmp 0x4a4f50
fld qword [ebp - 0x8c]
fadd qword [0x470a60]
fstp qword [0x470a60]
fld qword [0x470a60]
fcomp qword [ebp - 0x94]
fnstsw ax
sahf
jbe 0x44222c
mov word [0x470a74], 0
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8