joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc35dae0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0xc3706fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
mov esi, dword [esp + 0x144]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.0c36aa72
mov eax, dword [esp + 0x148]
test eax, eax
jne 0xc35dbb2
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0xc35db4a
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.0c36aa48
xor eax, eax
jmp 0xc35dc02
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0xc35db65
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0xc35dbb6
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0xc35dbb6
mov ecx, dword [esp + 4]
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.0c35fc5c
add esp, 8
test eax, eax
je 0xc35dbae
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0xc35db87
jmp 0xc35dbb6
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
test eax, eax
jne 0xc35dbd6
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.0c36aa48
xor eax, eax
jmp 0xc35dc02
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x13c], 0xffffffff
call fcn.0c36aa48
mov eax, esi
mov ecx, dword [esp + 0x134]
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x404c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004181c0
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x200c]
mov dword [ebp - 0x200c], 0
push eax
push 0xf003f
push 0
push 0x42a530
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2008], 0x1000
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404d13
lea eax, [ebp - 0x200c]
push eax
push 0xf003f
push 0
push 0x42a530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x404d13
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004112f8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 0x2004]
push eax
push 0
push 0
push str.UserId
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404d85
cmp word [ebp - 0x2004], ax
jne 0x404d59
xor ecx, ecx
lea eax, [ebp - 0x2004]
push ecx
push eax
mov ecx, 0x431ad0
call fcn.00401d00
jmp 0x404d87
lea ecx, [ebp - 0x2004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404d62
sub ecx, edx
lea eax, [ebp - 0x2004]
sar ecx, 1
push ecx
push eax
mov ecx, 0x431ad0
call fcn.00401d00
jmp 0x404d87
xor bl, bl
push dword [ebp - 0x200c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004112f8
mov esp, ebp
pop ebp
ret

Function at 0x404db0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3068
call fcn.004181c0
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x3068]
mov dword [ebp - 0x3068], 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x42a530
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x404e9f
mov eax, dword [0x431ae0]
mov ecx, 0x431ad0
cmp dword [0x431ae4], 8
cmovae ecx, dword [0x431ad0]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0
push str.UserId
push dword [ebp - 0x3068]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1830
lea eax, [ebp - 0x3064]
push eax
push 0xffffffffffffffff
push str.utm_sourceoffergatecpiutm_campaign6utm_mediummlutm_site1379utm_clickidproductid_253D46_2526sourceid_253D1379_2526partnerid_253D6_2526landingid_253D229_2526site_253D10torrent.net_2526country_253DUA_2526version_253D2utm_term10torrent.netutm_experimentexpextv14_search_onlyutm_ntbpack16landing14dld_br5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x3064]
lea edx, [eax + 2]
jmp 0x404e60
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x404e60
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x3064]
push eax
push 1
push 0
push 0x428ef4
push dword [ebp - 0x3068]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3068]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004112f8
mov esp, ebp
pop ebp
ret
Function at 0x407640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004181c0
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x100c], 0x1000
push eax
push 0x2011f
push 0
push str.SOFTWAREElements_Browser
push SysReAllocString
mov dword [ebp - 0x1010], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4077f1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push str.utmstr
push dword [ebp - 0x1010]
call esi
test eax, eax
jne 0x4076eb
cmp byte [ebp - 0x1008], al
jne 0x4076c7
xor ecx, ecx
jmp 0x4076d9
lea ecx, [ebp - 0x1008]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4076d0
sub ecx, edx
push ecx
lea eax, [ebp - 0x1008]
mov ecx, 0x431b18
push eax
call fcn.00401b50
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push str.userid
push dword [ebp - 0x1010]
call esi
test eax, eax
jne 0x40775d
cmp byte [ebp - 0x1008], al
jne 0x407736
xor ecx, ecx
lea eax, [ebp - 0x1008]
push ecx
push eax
mov ecx, 0x431ae8
call fcn.00401b50
jmp 0x407762
lea ecx, [ebp - 0x1008]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407740
sub ecx, edx
lea eax, [ebp - 0x1008]
push ecx
push eax
mov ecx, 0x431ae8
call fcn.00401b50
jmp 0x407762
call fcn.004078a0
lea eax, [ebp - 0x100c]
mov dword [ebp - 0x100c], 0x1000
push eax
lea eax, [ebp - 0x1008]
push eax
push 0
push 0
push str.ElementsBrowser_ver
push dword [ebp - 0x1010]
call esi
test eax, eax
jne 0x4077c3
cmp byte [ebp - 0x1008], al
jne 0x4077a3
xor ecx, ecx
lea eax, [ebp - 0x1008]
push ecx
push eax
jmp 0x4077ca
lea ecx, [ebp - 0x1008]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4077b0
sub ecx, edx
lea eax, [ebp - 0x1008]
push ecx
push eax
jmp 0x4077ca
push 3
push 0x42a6c0
mov ecx, 0x431b00
call fcn.00401b50
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004112f8
mov esp, ebp
pop ebp
ret
call fcn.004078a0
push 3
push 0x42a6c0
mov ecx, 0x431b00
call fcn.00401b50
push 0x10
push str.sourceidbrowser
mov ecx, 0x431b18
call fcn.00401b50
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004112f8
mov esp, ebp
pop ebp
ret
Function at 0x4087d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421ba0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
push 0
push 0x20206
push 0
push 0
push 0
push str.SOFTWAREGoogleChromeExtensions
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [0x4338cc]
test eax, eax
je 0x408887
mov edi, dword [0x4338d0]
cmp esi, edi
je 0x40887c
mov ecx, esi
call fcn.00408180
add esi, 0x64
cmp esi, edi
jne 0x408868
mov esi, dword [0x4338cc]
mov dword [0x4338d0], esi
jmp 0x408997
mov ecx, dword [0x4338d0]
mov eax, 0x51eb851f
sub ecx, esi
xor ebx, ebx
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40898e
xor edi, edi
lea ebx, [ebx]
lea eax, [esi + 0x18]
add eax, edi
lea ecx, [ebp - 0x40]
cmp ecx, eax
je 0x4088c6
push 0xffffffffffffffff
push 0
push eax
call fcn.00401930
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x44]
push 0
push ecx
push 0
push 0x20206
push 0
push 0
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push 0
push eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x408963
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x2f
push str.http:__clients2.google.com_service_update2_crx
push 1
push 0
push str.update_url
push eax
call esi
push 0xa
push str.client_id
lea ecx, [ebp - 0x28]
call fcn.00401b50
mov eax, dword [0x4338cc]
lea ecx, [ebp - 0x28]
push 0xffffffffffffffff
add eax, 0x30
push 0
add eax, edi
push eax
call fcn.004079d0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
inc eax
push eax
push ecx
push 1
push 0
push str.install_parameter
push dword [ebp - 0x44]
call esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x44], 0
mov ecx, dword [0x4338d0]
mov eax, 0x51eb851f
mov esi, dword [0x4338cc]
inc ebx
sub ecx, esi
add edi, 0x64
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x4088b0
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0x10
jb 0x4089a8
push dword [ebp - 0x28]
call fcn.00411307
add esp, 4
cmp dword [ebp - 0x2c], 0x10
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
jb 0x4089cb
push dword [ebp - 0x40]
call fcn.00411307
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004112f8
mov esp, ebp
pop ebp
ret
Function at 0x40b0d0
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push 0
push 0
push 0x42a670
mov dword [ebp - 0x20c], edx
mov edi, ecx
call dword [sym.imp.WININET.dll_InternetOpenW]
push 0x100
mov ebx, eax
mov byte [ebp - 0x205], 1
lea eax, [ebp - 0x204]
push eax
push 0x68
push dword [0x432fd0]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp byte [0x432ff2], 0
jne 0x40b17e
push 0
push 0
push 0x465
push esi
mov dword [edi], 0
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x20c]
mov ecx, ebx
push esi
push edi
call fcn.0040b2b0
add esp, 8
test al, al
jne 0x40b17e
push 0x2021
push 0x42a670
push 0x4330d8
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
je 0x40b127
mov byte [ebp - 0x205], 0
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
push 0
push 0x466
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x205]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004112f8
mov esp, ebp
pop ebp
ret

Function at 0x40b1b0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004181c0
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov word [ebp - 0x2004], ax
mov esi, ecx
lea eax, [ebp - 0x2004]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp word [ebp - 0x2004], 0
jne 0x40b1f3
xor ecx, ecx
jmp 0x40b20f
lea ecx, [ebp - 0x2004]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b200
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x2004]
mov ecx, esi
push eax
call fcn.00401d00
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x40b247
cmp dword [esi + 0x14], 8
jb 0x40b22f
mov eax, dword [esi]
jmp 0x40b231
mov eax, esi
cmp word [eax + ecx*2 - 2], 0x5c
je 0x40b247
push 1
push 0x42a438
mov ecx, esi
call fcn.00403660
push 0x11
push str.Elements_Browser_
mov ecx, esi
call fcn.00403660
cmp dword [esi + 0x14], 8
jb 0x40b25f
mov eax, dword [esi]
jmp 0x40b261
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0xc
push str.elements.bin
mov ecx, esi
call fcn.00403660
cmp dword [esi + 0x14], 8
jb 0x40b280
mov esi, dword [esi]
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004112f8
mov esp, ebp
pop ebp
ret
Function at 0x40bf00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x64], 0x67452301
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0xefcdab89
lea ecx, [ebp - 0x6c]
movlpd qword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
call fcn.0040be50
mov edx, dword [ebp - 0x6c]
add esp, 4
mov ecx, dword [ebp - 0x68]
mov eax, edx
shld ecx, eax, 3
and edx, 0x3f
shl eax, 3
mov dword [ebp - 0x14], eax
mov eax, 0x38
mov dword [ebp - 0x10], ecx
cmp edx, 0x38
jb 0x40bf6c
mov eax, 0x78
sub eax, edx
lea ecx, [ebp - 0x6c]
push eax
mov edx, 0x42a388
call fcn.0040be50
add esp, 4
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x6c]
push 8
call fcn.0040be50
movdqu xmm0, xmmword [ebp - 0x64]
mov ecx, dword [ebp - 8]
add esp, 4
xor ecx, ebp
movdqu xmmword [esi], xmm0
pop esi
call fcn.004112f8
mov esp, ebp
pop ebp
ret
Function at 0x40cfe0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421ecb
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x11c], 0xf
mov dword [ebp - 0x120], 0
mov byte [ebp - 0x130], 0
mov dword [ebp - 4], 0
call fcn.0040ebb0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
mov dword [ebp - 0x364], ebx
cmp ebx, 0xffffffff
je 0x40d216
lea eax, [ebp - 0x360]
mov dword [ebp - 0x360], 0x22c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
push 0
push 0
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0x104
lea eax, [ebp - 0x33c]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x118], 0
jne 0x40d0a6
xor ecx, ecx
jmp 0x40d0b9
lea ecx, [ebp - 0x118]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d0b0
sub ecx, edx
push ecx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x130]
call fcn.00401b50
mov edi, dword [ebp - 0x120]
xor eax, eax
mov edx, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x130]
test edi, edi
je 0x40d175
jmp 0x40d0f0
cmp edx, 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, esi
cmp byte [ecx + eax], 0x5b
je 0x40d14a
cmp edx, 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, esi
cmp byte [ecx + eax], 0x5d
je 0x40d14a
cmp edx, 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, esi
cmp byte [ecx + eax], 0x7b
je 0x40d14a
cmp edx, 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, esi
cmp byte [ecx + eax], 0x7d
je 0x40d14a
cmp edx, 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, esi
cmp byte [ecx + eax], 0x22
jne 0x40d16c
cmp edx, 0x10
lea ecx, [ebp - 0x130]
cmovae ecx, esi
mov byte [ecx + eax], 0x78
mov edx, dword [ebp - 0x11c]
mov edi, dword [ebp - 0x120]
mov esi, dword [ebp - 0x130]
inc eax
cmp eax, edi
jb 0x40d0f0
cmp edx, 0x10
lea eax, [ebp - 0x130]
lea ebx, [ebp - 0x130]
cmovae eax, esi
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x130]
cmovae eax, esi
add eax, edi
cmp edx, 0x10
cmovae ebx, esi
cmp ebx, eax
je 0x40d1ce
mov edi, eax
xor ecx, ecx
sub edi, ebx
xor esi, esi
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x40d1ce
movsx eax, byte [esi + ebx]
push eax
call fcn.00411e55
mov ecx, dword [ebp - 0x368]
add esp, 4
mov byte [esi + ecx], al
inc esi
cmp esi, edi
jne 0x40d1b3
mov ebx, dword [ebp - 0x36c]
lea edx, [ebp - 0x130]
mov ecx, ebx
call fcn.0040cee0
test al, al
jne 0x40d1f3
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
call fcn.00407300
mov ebx, dword [ebp - 0x364]
lea eax, [ebp - 0x360]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40d070
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x11c], 0x10
jb 0x40d22d
push dword [ebp - 0x130]
call fcn.00411307
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004112f8
mov esp, ebp
pop ebp
ret
Function at 0x40ed00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x202c
call fcn.004181c0
mov eax, dword [0x42e460]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x58]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push dword [edi + 4]
mov dword [ebp - 0x2018], eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x40ed41
mov esi, dword [edi + 0x34]
jmp 0x40ed44
mov esi, dword [edi + 0x38]
mov eax, dword [ebp - 0x2018]
test eax, eax
je 0x40ee96
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xfffffffffffffff0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
mov ecx, 0x2005
mov eax, 0x2004
cmovne eax, ecx
push 0x2000
mov dword [ebp - 0x2024], eax
lea eax, [ebp - 0x2004]
push 0
push eax
call fcn.004181f0
add esp, 0xc
lea eax, [ebp - 0x2014]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
push esi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push esi
push 1
push 0
mov dword [ebp - 0x2020], eax
call dword [sym.imp.GDI32.dll_CreatePen]
push dword [ebp - 0x2020]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
mov dword [ebp - 0x201c], eax
call esi
push dword [ebp - 0x201c]
mov dword [ebp - 0x202c], eax
push ebx
call esi
mov esi, dword [ebp - 0x2018]
push esi
push ebx
mov dword [ebp - 0x2028], eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [ebp - 0x2004]
mov dword [ebp - 0x2018], eax
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ee20
mov eax, dword [ebp - 0x2024]
sub ecx, edx
push eax
lea eax, [ebp - 0x2014]
sar ecx, 1
push eax
push ecx
lea eax, [ebp - 0x2004]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x2028]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x202c]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x2018]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp - 0x2020]
call esi
push dword [ebp - 0x201c]
call esi
push dword [edi + 0x24]
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004112f8
mov esp, ebp
pop ebp
ret 4
Function at 0x410960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, edx
mov dword [ebp - 4], edx
add esi, 0xdeadbeef
add esi, ecx
mov edx, esi
mov dword [ebp + 8], edx
push edi
mov edi, esi
cmp ecx, 0xc
jbe switch.0x00410a62
add ecx, 0xfffffff3
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 8], eax
mov edi, edi
movzx ecx, byte [ebx + 7]
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 5]
add edx, esi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 4]
shl ecx, 8
add edi, eax
movzx eax, byte [ebx + 0xa]
add edi, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov esi, edx
add ecx, eax
rol esi, 4
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ebx, 0xc
add ecx, eax
sub ecx, edx
add edx, edi
add ecx, dword [ebp + 8]
xor esi, ecx
sub edi, esi
mov eax, esi
add esi, edx
rol eax, 6
xor eax, edi
sub edx, eax
mov ecx, eax
rol ecx, 8
add eax, esi
xor ecx, edx
sub esi, ecx
mov edx, ecx
rol edx, 0x10
add ecx, eax
xor edx, esi
mov edi, edx
sub eax, edx
ror edi, 0xd
add edx, ecx
xor edi, eax
mov dword [ebp + 8], edx
sub ecx, edi
mov esi, edi
rol esi, 4
add edi, edx
xor esi, ecx
mov ecx, dword [ebp - 4]
sub ecx, 0xc
dec dword [ebp - 8]
mov dword [ebp - 4], ecx
jne 0x4109a0
cmp ecx, 0xc
ja 0x410ace
jmp dword [ecx*4 + 0x410b1c]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 8]
add esi, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edx, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add edx, eax
movzx eax, byte [ebx]
add edx, eax
mov dword [ebp + 8], edx
xor esi, edi
mov eax, edi
rol eax, 0xe
sub esi, eax
mov eax, esi
mov edx, esi
xor edx, dword [ebp + 8]
rol eax, 0xb
sub edx, eax
xor edi, edx
mov eax, edx
ror eax, 7
sub edi, eax
mov eax, edi
xor esi, edi
rol eax, 0x10
sub esi, eax
mov eax, esi
mov ecx, esi
rol eax, 4
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor edi, ecx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor esi, edi
ror eax, 8
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret