joyce8/EMBER2024-capa huggingface dataset:
Function at 0x513580
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.004077a0
ret

Function at 0x515b08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004040a4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x515b21
test al, 0x10
jne 0x515b25
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x516040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004040a4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
setne al
pop ebx
ret
Function at 0x519cbc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x519cc4
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x519ede
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x519eb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
test eax, eax
jne 0x519d09
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519ec3
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 4]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
call fcn.004090f8
test al, al
jne 0x519e1b
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0xc]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00408920
mov edx, dword [ebp - 8]
mov eax, 0x519ef4
call fcn.004041cc
test eax, eax
jg 0x519e1b
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x14]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00408920
mov edx, dword [ebp - 0x10]
mov eax, 0x519f00
call fcn.004041cc
test eax, eax
jg 0x519e1b
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x1c]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408920
mov edx, dword [ebp - 0x18]
mov eax, 0x519f10
call fcn.004041cc
mov esi, eax
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x20]
xor edx, edx
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00403ee0
cmp esi, eax
je 0x519e1b
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x24]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x24]
call fcn.00515b08
test al, al
je 0x519e9c
push 1
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x2c]
xor edx, edx
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004091a0
mov eax, dword [ebp - 0x28]
call fcn.004040a4
push eax
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x30]
mov edx, 1
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x30]
call fcn.004040a4
push eax
mov eax, dword [ebx + 0x300]
call fcn.004ca3c8
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x34]
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x34]
call fcn.004040a4
push eax
push 0x519f14
push 0
call sub.shell32.dll_ShellExecuteA
jmp 0x519eaf
push 0x40
push 0x519f1c
push 0x519f24
push 0
call sub.user32.dll_MessageBoxA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x519ec3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519ee5
lea eax, [ebp - 0x34]
mov edx, 0xd
call fcn.00403c84
ret
Function at 0x51bcb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51bdc6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x51bda6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00523488
mov eax, dword [ebp - 4]
mov edx, 0x51bddc
call fcn.00403ff0
je 0x51bd02
mov eax, dword [ebp - 4]
mov edx, 0x51bdf0
call fcn.00403ff0
jne 0x51bd13
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x61
call sub.user32.dll_SystemParametersInfoA
jmp 0x51bd61
mov eax, dword [0x5286a8]
cmp byte [eax], 0
je 0x51bd55
call sub.kernel32.dll_GetTickCount
mov esi, eax
jmp 0x51bd32
mov eax, dword [0x528430]
mov eax, dword [eax]
call fcn.0044f940
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x51bd53
cmp eax, 0x64
jb 0x51bd26
jmp 0x51bd55
jl 0x51bd26
mov eax, ebx
call fcn.0051ad30
call sub.mpkb.dll_StopHook
mov eax, dword [0x5286c8]
mov eax, dword [eax]
call fcn.0044d8bc
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x5286c8]
mov eax, dword [eax]
call fcn.0044d8c8
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.00410954
lea eax, [ebp - 0x18]
push eax
call sub.user32.dll_ClipCursor
mov eax, 1
call fcn.00522c6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x51bdb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51bdcd
lea eax, [ebp - 4]
call fcn.00403c60
ret
Function at 0x522c6c
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebx
add esp, 0xffffffcc
mov ebx, eax
mov eax, esp
mov edx, 0x522cb4
call fcn.004093e8
push 0
lea eax, [esp + 4]
push eax
call sub.user32.dll_FindWindowA
sub ebx, 1
jb 0x522c93
je 0x522c9d
jmp 0x522ca5
push 0
push eax
call sub.user32.dll_ShowWindow
jmp 0x522ca5
push 5
push eax
call sub.user32.dll_ShowWindow
add esp, 0x34
pop ebx
ret

Function at 0x52311c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov eax, dword [0x5286dc]
mov eax, dword [eax]
call fcn.00437844
push eax
call sub.user32.dll_SetForegroundWindow
call sub.kernel32.dll_GetTickCount
mov esi, eax
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
cmp edx, 0
jne 0x523158
cmp eax, 0x64
jb 0x523137
jmp 0x52315a
jl 0x523137
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x523160
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x523318
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x50]
mov edx, 0x20
call fcn.004077a0
mov dword [ebp - 0x50], 0x20
lea eax, [ebp - 0x50]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov esi, dword [ebp - 0x4c]
mov edi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
mov edx, 0x24
call fcn.004077a0
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo
push 0x523330
lea edx, [ebp - 0x58]
mov eax, edi
test eax, eax
jns 0x5231f7
add eax, 0x3ff
sar eax, 0xa
call fcn.00408e4c
push dword [ebp - 0x58]
push 0x523348
lea eax, [ebp - 0x54]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x54]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x523354
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 4]
test eax, eax
jns 0x523232
add eax, 0x3ff
sar eax, 0xa
call fcn.00408e4c
push dword [ebp - 0x60]
push 0x523348
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x523370
lea edx, [ebp - 0x68]
mov eax, esi
call fcn.00408e4c
push dword [ebp - 0x68]
push 0x523390
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x64]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x52339c
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 8]
test eax, eax
jns 0x52329b
add eax, 0x3ff
sar eax, 0xa
call fcn.00408e4c
push dword [ebp - 0x70]
push 0x523348
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push 0x5233b4
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0xc]
test eax, eax
jns 0x5232d6
add eax, 0x3ff
sar eax, 0xa
call fcn.00408e4c
push dword [ebp - 0x78]
push 0x523348
lea eax, [ebp - 0x74]
mov edx, 3
call fcn.00403fa0
mov edx, dword [ebp - 0x74]
mov eax, dword [ebx]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52331f
lea eax, [ebp - 0x78]
mov edx, 0xa
call fcn.00403c84
ret
Function at 0x523540
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x52373e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x523709
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10c]
xor eax, eax
call fcn.0040294c
mov eax, dword [ebp - 0x10c]
lea edx, [ebp - 4]
call fcn.00409230
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403ee0
mov ecx, eax
sub ecx, 4
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004040e8
push 0
mov eax, dword [0x52801c]
mov eax, dword [eax]
call fcn.00437844
push eax
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
je 0x5236ff
push 0xff
lea eax, [ebp - 0x107]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x5236ed
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5236ed
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x107]
call fcn.0040950c
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.0040895c
mov eax, dword [ebp - 0x110]
mov edx, 0x523754
call fcn.00403ff0
je 0x5236ed
lea edx, [ebp - 0x11c]
lea eax, [ebp - 0x107]
call fcn.0040950c
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0040895c
mov eax, dword [ebp - 0x118]
mov edx, 0x523768
call fcn.00403ff0
je 0x5236ed
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x107]
call fcn.0040950c
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.00408920
mov eax, dword [ebp - 0x120]
push eax
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 8]
call fcn.00408920
mov edx, dword [ebp - 0x128]
pop eax
call fcn.00403ff0
je 0x5236ed
push 4
push ebx
call sub.user32.dll_GetWindow
test eax, eax
jne 0x5236ed
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_PostMessageA
push 9
push ebx
call sub.user32.dll_ShowWindow
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x5235f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x523713
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523745
lea eax, [ebp - 0x128]
mov edx, 8
call fcn.00403c84
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403c84
ret
Function at 0x523778
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x12c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x130], edx
mov ebx, eax
lea edi, [ebp - 0x128]
xor eax, eax
push ebp
push 0x523975
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x52394d
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov eax, 2
call fcn.00451014
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00451034
neg eax
sbb eax, eax
neg eax
jmp 0x52393b
test ebx, ebx
je 0x52387d
lea edx, [ebp - 0x130]
lea eax, [edi + 0x24]
call fcn.0040950c
mov eax, dword [ebp - 0x130]
lea edx, [ebp - 0x12c]
call fcn.00408920
mov eax, dword [ebp - 0x12c]
push eax
lea edx, [ebp - 0x134]
mov eax, ebx
call fcn.00408920
mov eax, dword [ebp - 0x134]
pop edx
call fcn.004041cc
test eax, eax
jle 0x52392c
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
test eax, eax
jbe 0x52392c
push 0
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x523957
lea edx, [ebp - 0x13c]
lea eax, [edi + 0x24]
call fcn.0040950c
mov eax, dword [ebp - 0x13c]
lea edx, [ebp - 0x138]
call fcn.00408920
mov eax, dword [ebp - 0x138]
push eax
lea edx, [ebp - 0x144]
xor eax, eax
call fcn.0040294c
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408920
mov edx, dword [ebp - 0x140]
pop eax
call fcn.00403ff0
je 0x52392c
lea edx, [ebp - 0x14c]
lea eax, [edi + 0x24]
call fcn.0040950c
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00408920
mov edx, dword [ebp - 0x148]
mov eax, 0x52398c
call fcn.004041cc
test eax, eax
jne 0x52392c
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
test eax, eax
jbe 0x52392c
push 0
push eax
call sub.kernel32.dll_TerminateProcess
xor eax, eax
call fcn.00523778
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x523957
mov edx, edi
mov eax, esi
call fcn.00451054
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x523808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x523957
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52397c
lea eax, [ebp - 0x14c]
mov edx, 9
call fcn.00403c84
ret
Function at 0x523a94
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], edx
mov edi, eax
xor eax, eax
push ebp
push 0x523b53
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0xff
lea eax, [ebp - 0x100]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x523b35
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.0040950c
mov edx, dword [ebp - 0x104]
mov eax, 0x523b6c
call fcn.004041cc
test eax, eax
jle 0x523b0a
mov esi, ebx
mov dword [edi], 1
lea edx, [ebp - 0x108]
lea eax, [ebp - 0x100]
call fcn.0040950c
mov edx, dword [ebp - 0x108]
mov eax, 0x523b90
call fcn.004041cc
test eax, eax
jle 0x523b35
mov esi, ebx
xor eax, eax
mov dword [edi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523b5a
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.00403c84
ret

Function at 0x523c48
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
add esp, 0xfffffe08
mov esi, eax
mov eax, esi
call fcn.00403c60
lea eax, [esp + 0x68]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x523caa
push 0x65
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
mov ebx, eax
test ebx, ebx
jne 0x523c92
mov eax, esi
mov edx, 0x523cbc
call fcn.00403cb4
jmp 0x523ca5
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
push dword [eax]
call sub.wsock32.dll_inet_ntoa
mov edx, esi
call fcn.0040950c
call sub.wsock32.dll_WSACleanup
add esp, 0x1f8
pop esi
pop ebx
ret
Function at 0x523cc8
Capabilities:
Find taskbar
Hide graphical window
Hide the windows taskbar

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x134], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x523e7d
push dword fs:[eax]
mov dword fs:[eax], esp
xor esi, esi
push 0
push 0x523e90
call sub.user32.dll_FindWindowA
push 0
push 0x523ea0
push 0
push eax
call sub.user32.dll_FindWindowExA
push 5
push eax
call sub.user32.dll_GetWindow
mov edi, eax
push 0xff
lea eax, [ebp - 0x101]
push eax
push edi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x134]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403e90
mov eax, dword [ebp - 0x134]
mov edx, 0x523eb8
call fcn.00403ff0
jne 0x523d67
mov dword [ebp + esi*4 - 0x130], edi
inc esi
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403e90
mov eax, dword [ebp - 0x138]
mov edx, 0x523ecc
call fcn.00403ff0
jne 0x523d97
mov dword [ebp + esi*4 - 0x130], edi
inc esi
test edi, edi
je 0x523e1f
push 2
push edi
call sub.user32.dll_GetWindow
mov edi, eax
push 0xff
lea eax, [ebp - 0x101]
push eax
push edi
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0x13c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403e90
mov eax, dword [ebp - 0x13c]
mov edx, 0x523eb8
call fcn.00403ff0
jne 0x523deb
mov dword [ebp + esi*4 - 0x130], edi
inc esi
lea eax, [ebp - 0x140]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403e90
mov eax, dword [ebp - 0x140]
mov edx, 0x523ecc
call fcn.00403ff0
jne 0x523e1b
mov dword [ebp + esi*4 - 0x130], edi
inc esi
test edi, edi
jne 0x523d9f
test bl, bl
je 0x523e42
mov ebx, esi
test ebx, ebx
jl 0x523e5f
inc ebx
lea esi, [ebp - 0x130]
push 0
mov eax, dword [esi]
push eax
call sub.user32.dll_ShowWindow
add esi, 4
dec ebx
jne 0x523e30
jmp 0x523e5f
mov ebx, esi
test ebx, ebx
jl 0x523e5f
inc ebx
lea esi, [ebp - 0x130]
push 5
mov eax, dword [esi]
push eax
call sub.user32.dll_ShowWindow
add esi, 4
dec ebx
jne 0x523e4f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x523e84
lea eax, [ebp - 0x140]
mov edx, 4
call fcn.00403c84
ret
Function at 0x40527e
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040542e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40537c
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40531f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x405362
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x405336
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x405351
test al, 0x40
je 0x405348
mov ecx, dword [edi + 0x20]
jmp 0x40534f
test al, 0x80
je 0x405362
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x405362
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x4052ee
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x436350
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e2ccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004d2e1f
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4363d2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004d007a
mov eax, dword [eax]
push 0x66e264
push eax
call fcn.004b5e04
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004d30aa
test bl, bl
je 0x4363d2
push 0x66e264
lea ecx, [esp + 0xc]
call fcn.004d3486
push 0x671e44
lea ecx, [esp + 0xc]
call fcn.004d3486
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x43640e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004d30aa
jmp 0x4364d9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x436492
lea edx, [esp + 0x7c]
push 0x671e40
push edx
call fcn.004b5e04
add esp, 8
test eax, eax
je 0x436492
lea eax, [esp + 0x7c]
push 0x671e3c
push eax
call fcn.004b5e04
add esp, 8
test eax, eax
je 0x436492
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x436422
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004d30aa
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x436cd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x436d32
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc