joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41304a
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x414c30
push 1
xor ebx, ebx
push ebx
push 0x414ce0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41311b
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x414cd0
push eax
call dword [ecx]
test eax, eax
jl 0x413112
cmp byte [ebp + 8], bl
je 0x41309d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x4130ba
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x4130cc
push 0x41437c
jmp 0x4130cf
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4130e4
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4130f5
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x413109
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x413135
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x40ed75
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push 0x40eae0
pop ecx
dec edx
call fcn.0040ed9b
xor dword [eax], ecx
sub esi, 0x27ac610a
add edx, esi
inc eax
and edx, esi
cmp eax, edi
jne fcn.0040ed75
sub esi, 0x20092529
ret
Function at 0x405510
Capabilities:
Delete registry value

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x12c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
push 0x12c
push ebx
mov byte [ebx], 0
call fcn.00416d90
push 0x41e1bc
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e218
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e210
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x14]
mov ecx, edx
and ecx, 3
cmp eax, 7
rep movsb byte es:[edi], byte [esi]
jg 0x4055d9
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push ebx
push 0x80000002
jmp 0x4055eb
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push 0
push ebx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
push ebx
jne 0x405643
call fcn.00416df0
add esp, 4
test eax, eax
je 0x405607
call fcn.00416db0
push str.B_VTh__l
call fcn.0041bfd0
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
add esp, 4
push eax
push edx
call esi
push 0x41e23c
call fcn.0041bfd0
add esp, 4
push eax
mov eax, dword [esp + 0x10]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x405710
Capabilities:
Delete registry key

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x12c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
push 0x12c
push ebx
mov byte [ebx], 0
call fcn.00416d90
push 0x41e1bc
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00416df0
add esp, 0x14
test eax, eax
je 0x405769
call fcn.00416db0
push str.Lgesgifm
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e150
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push str.Th__l
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebx], 0
je 0x405816
mov eax, ebx
cmp byte [eax], 0x2f
jne 0x40580e
mov byte [eax], 0x5c
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x405806
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push ebx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40584d
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x405dc0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x28]
xor edx, edx
cmp esi, edx
push edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], edx
je 0x405f4d
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
je 0x405f4d
lea eax, [ebx + 1]
push ebp
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x18], ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
test esi, esi
je 0x405f12
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x405f12
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x28]
test esi, esi
je 0x405f16
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x405f16
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push eax
mov dword [esp + 0x18], eax
call fcn.00416df0
add esp, 8
test eax, eax
je 0x405ea8
call fcn.00416db0
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x30]
push ecx
push 0x20006
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405f16
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
push eax
push ebp
push 1
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 1
jmp 0x405f16
mov ebx, dword [esp + 0x1c]
test ebp, ebp
je 0x405f23
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x10]
pop ebp
test eax, eax
je 0x405f35
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
test ebx, ebx
je 0x405f42
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
pop edi
pop esi
mov eax, edx
pop ebx
add esp, 0x10
ret
Function at 0x405f60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x7e0
mov al, byte [0x42c1b8]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x20], al
mov ecx, 0x1f3
xor eax, eax
lea edi, [esp + 0x21]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x800]
mov dword [esp + 0x10], ebx
test eax, eax
mov dword [esp + 0x18], 0x7d0
mov dword [esp + 0x1c], 1
je 0x4060e4
mov esi, dword [esp + 0x7fc]
test esi, esi
je 0x4060e4
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4060e4
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x7f8]
test esi, esi
je 0x4060d7
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4060d7
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov edx, dword [esp + 0x7f4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4060c6
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call fcn.00416db0
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4060c6
lea edi, [esp + 0x20]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], 1
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x800]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
test ebx, ebx
je 0x4060d3
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ebx, dword [esp + 0x10]
test ebp, ebp
je 0x4060e4
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x7e0
ret
Function at 0x4064c0
Capabilities:
Delete registry value

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x12c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
push 0x12c
push ebx
mov byte [ebx], 0
call fcn.00416d90
push 0x41e1bc
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e218
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00416df0
add esp, 0x18
test eax, eax
je 0x40654a
call fcn.00416db0
push 0x41e210
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
mov ecx, edx
push eax
push 0xf003f
and ecx, 3
push 0
push ebx
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4065be
push str.vaecgnr_Ylsg_lo
call fcn.0041bfd0
mov ecx, dword [esp + 0x10]
add esp, 4
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4065d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x130
mov al, byte [0x42c1b8]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x14], al
mov ecx, 0x4a
xor eax, eax
lea edi, [esp + 0x15]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x144]
cmp eax, 3
jl 0x4067d1
cmp eax, 9
jle 0x40670e
cmp eax, 0xa
jne 0x4067d1
push 0x414
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
push ebx
call fcn.004067e0
push str.Adfa
call fcn.0041bfd0
push str.Rg_soXq_
mov ebp, eax
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push 0
push edx
push 0x80000001
call esi
test eax, eax
je 0x4066d9
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 4
push 0
push 0x41e06c
call fcn.0041bfd0
add esp, 4
lea ecx, [esp + 0x28]
push eax
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4067d1
lea edx, [esp + 0x10]
push edx
push 0x20006
push eax
lea eax, [esp + 0x20]
push eax
push 0x80000001
call esi
test eax, eax
jne 0x4067d1
mov ecx, dword [esp + 0x10]
push 0x490
push ebx
push 3
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret
push str.fg_bYngh
call fcn.0041bfd0
push str.Rmemq___q__dk_ff_Cs
mov ebp, eax
call fcn.0041bfd0
push 0x41e1bc
mov ebx, eax
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.LaZqgjnk
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x20006
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4067c6
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x10]
not ecx
dec ecx
push ecx
push ebx
push 1
push eax
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret
Function at 0x40b6d0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x42c890], 1
jne 0x40b6ed
push 0x42c970
call fcn.00413d20
push 0
call fcn.0041c290
add esp, 8
cmp dword [0x42c8d0], 1
jne 0x40b709
push 0
push 0xf
call fcn.0040fa00
push 0
call fcn.0041c290
add esp, 0xc
push esi
push edi
call fcn.0040d8b0
call fcn.0040b7e0
call fcn.0040f960
call fcn.00416db0
mov eax, dword [0x42d120]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push eax
call esi
mov ecx, dword [0x42d124]
push 1
push ecx
call esi
mov edi, 0x42c6b0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40b759
mov edx, dword [0x42d124]
push 0x42c6b0
push edx
jmp 0x40b76d
push 0x41e06c
call fcn.0041bfd0
add esp, 4
push eax
mov eax, dword [0x42d124]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [0x42d0f0]
push 1
push ecx
call esi
mov edx, dword [0x42d0f4]
push 1
push edx
call esi
mov eax, dword [0x42d0f0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call esi
mov ecx, dword [0x42d0f4]
push 5
push ecx
call esi
mov edx, dword [0x42d10c]
push 5
push edx
call esi
mov eax, dword [0x42d110]
push 5
push eax
call esi
push 0
call fcn.0040cb50
add esp, 4
call fcn.0040f550
mov ecx, dword [0x42d0f0]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
ret

Function at 0x40b7e0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov dword [0x42c8cc], 0
call fcn.0040cc40
mov eax, dword [0x42d108]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call esi
mov ecx, dword [0x42c978]
mov edx, dword [0x42d104]
push ecx
push edx
call fcn.00401040
mov eax, dword [0x42d104]
add esp, 8
push 5
push eax
call esi
mov ecx, dword [0x42c978]
mov edx, dword [0x42d0f0]
push ecx
push 7
push edx
call fcn.00401000
mov eax, dword [0x42c978]
mov ecx, dword [0x42d0f4]
push eax
push 8
push ecx
call fcn.00401000
mov edx, dword [0x42c978]
mov eax, dword [0x42d10c]
push edx
push 0x26
push eax
call fcn.00401000
mov ecx, dword [0x42c978]
mov edx, dword [0x42d110]
push ecx
push 0x27
push edx
call fcn.00401000
add esp, 0x30
call fcn.0040c780
call fcn.00410ec0
pop esi
ret
Function at 0x40bd30
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
mov eax, dword [0x42d134]
push 0
push 0
push 0x402
push eax
mov dword [0x42c89c], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x42c978]
mov edx, dword [0x42d144]
push ecx
push 0xc
push edx
call fcn.00401000
mov eax, dword [0x42c978]
mov ecx, dword [0x42d140]
push eax
push 0xe
push ecx
call fcn.00401000
mov edx, dword [0x42c978]
mov eax, dword [0x42d138]
push edx
push 0xd
push eax
call fcn.00401000
mov ecx, dword [0x42c978]
mov edx, dword [0x42d13c]
push ecx
push 0x1a
push edx
call fcn.00401000
mov eax, dword [0x42d180]
add esp, 0x30
test eax, eax
je 0x40bdc7
mov eax, dword [0x42c974]
push 0
push eax
mov dword [0x42d180], 0
call fcn.00411f10
add esp, 8
mov ecx, dword [0x42d144]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push ecx
call edi
mov edx, dword [0x42d140]
push 1
push edx
call edi
mov eax, dword [0x42d138]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call esi
mov ecx, dword [0x42d134]
push 5
push ecx
call esi
mov edx, dword [0x42d13c]
push 5
push edx
call esi
mov eax, dword [0x42d140]
push 5
push eax
call esi
mov ecx, dword [0x42d144]
push 5
push ecx
call esi
mov eax, dword [0x42c8cc]
test eax, eax
jne 0x40be46
mov edx, dword [0x42d148]
push 0
push edx
call esi
push 3
call fcn.0040cb50
add esp, 4
call fcn.0040f550
pop edi
pop esi
ret
cmp dword [0x42c980], 0x2c
je 0x40be64
mov eax, dword [0x42d148]
push 1
push eax
call edi
mov ecx, dword [0x42d148]
push 5
push ecx
call esi
call fcn.0040f550
pop edi
pop esi
ret

Function at 0x40c700
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0xc
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
push esi
push eax
mov dword [esp + 0x14], eax
push 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0xc
call dword [sym.imp.KERNEL32.DLL_OpenMutexA]
test eax, eax
jne 0x40c769
call fcn.00416db0
push 0
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
lea ecx, [esp + 8]
push 1
push ecx
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
mov esi, eax
test esi, esi
je 0x40c769
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x40c770
push esi
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x40d8b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x42d0f0]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
mov ecx, dword [0x42d0f4]
push 0
push ecx
call esi
mov edx, dword [0x42d0f8]
push 0
push edx
call esi
mov eax, dword [0x42d104]
push 0
push eax
call esi
mov ecx, dword [0x42d108]
push 0
push ecx
call esi
mov edx, dword [0x42d10c]
push 0
push edx
call esi
mov eax, dword [0x42d110]
push 0
push eax
call esi
mov ecx, dword [0x42d114]
push 0
push ecx
call esi
mov edx, dword [0x42d118]
push 0
push edx
call esi
mov eax, dword [0x42d11c]
push 0
push eax
call esi
mov ecx, dword [0x42d120]
push 0
push ecx
call esi
mov edx, dword [0x42d124]
push 0
push edx
call esi
mov eax, dword [0x42d128]
push 0
push eax
call esi
mov ecx, dword [0x42d12c]
push 0
push ecx
call esi
mov edx, dword [0x42d130]
push 0
push edx
call esi
mov eax, dword [0x42d134]
push 0
push eax
call esi
mov ecx, dword [0x42d140]
push 0
push ecx
call esi
mov edx, dword [0x42d144]
push 0
push edx
call esi
mov eax, dword [0x42d138]
push 0
push eax
call esi
mov ecx, dword [0x42d13c]
push 0
push ecx
call esi
mov edx, dword [0x42d148]
push 0
push edx
call esi
pop esi
ret