joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427bd4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 4
add esp, 0xfffff004
push eax
dec eax
jne 0x427bdd
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
mov dword [ebp - 8], ecx
mov byte [ebp - 0x19], dl
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004050c8
mov dword [ebp - 0xc], 0x4000
lea eax, [ebp - 0x401a]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.0040b4a8
lea eax, [ebp - 0x401a]
push eax
mov eax, dword [ebp - 0xc]
sar eax, 1
jns 0x427c37
adc eax, 0
push eax
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageW
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x401a]
call fcn.00405274
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x427c69
push 0x64
call sub.kernel32.dll_Sleep_2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x427c05
mov esp, ebp
pop ebp
ret

Function at 0x4289f4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x428a84
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov dl, byte [0x428a94]
mov eax, 0x428aa4
call fcn.0040adb0
mov eax, dword [ebp - 8]
call fcn.0040622c
mov edx, eax
mov ecx, 0x428ad4
mov eax, dword [ebp - 8]
call fcn.0040877c
test eax, eax
setge byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x428a68
push 0xa
call sub.kernel32.dll_Sleep_2
mov eax, 0x428afc
call fcn.00405154
push eax
call sub.kernel32.dll_DeleteFileW
mov eax, 0x428afc
call fcn.0040a8f0
test al, al
jne 0x428a43
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x428a8b
lea eax, [ebp - 8]
mov edx, dword [0x407700]
call fcn.004063f8
ret

Function at 0x429fb4
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x42a05e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x42a078
lea edx, [ebp - 8]
mov eax, dword [0x43a03c]
call fcn.0040a344
push dword [ebp - 8]
push 0x42a0a8
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040559c
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x43a050]
push eax
call sub.kernel32.dll_CopyFileW
push 0x42a0b4
mov eax, dword [0x43a050]
push eax
call sub.kernel32.dll_MoveFileW
mov eax, dword [ebp + 8]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, 0x42a0f0
call fcn.00429e28
pop ecx
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, 0x42a10c
call fcn.00429e28
pop ecx
xor edx, edx
or eax, 0xffffffff
call fcn.0040c6e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a065
lea eax, [ebp - 8]
mov edx, 2
call fcn.004050c0
ret
Function at 0x449ce0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x449cf0
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x449ced
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x449ced
mov edx, 0x10b
cmp word [eax + 0x18], dx
sete al
ret
Function at 0x466db0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
jne 0x466dd0
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call main
add esp, 0xc
mov eax, dword [esi]
lea ecx, [eax + 0x20]
push ecx
push 4
push eax
push 0x466d30
push 0
push 0
call main
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x466df5
pop edi
xor al, al
pop esi
ret
mov edx, dword [esi]
add edx, 4
mov eax, 1
lock xadd dword [edx], eax
cmp dword [esi], 0
jne 0x466e1f
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call main
add esp, 0xc
mov ecx, dword [esi]
push edi
add ecx, 8
call main
cmp dword [esi], 0
jne 0x466e46
push 0xa2
push str.F:CB11X_MainQImportsOpen_boost_boost_smart_ptr_intrusive_ptr.hpp
push 0x4d8134
call main
add esp, 0xc
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.kernel32.dll_ResumeThread]
pop edi
mov al, 1
pop esi
ret

Function at 0x49269f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f2d80]
jne 0x4926a9
repz ret
jmp fcn.0049db2c

Function at 0x4a87e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x4a87f2
pop dword [ebp - 0x30]
mov eax, 0xa0079ea8
sub eax, 0x9fbd16b6
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x41e7abad
sub dword [ebp - 0x40], 0xf3956662
mov dword [ebp - 0x3c], 0x2d6cd625
add dword [ebp - 0x3c], 0x4c67620
mov dword [ebp - 0x38], 0x615e5829
sub dword [ebp - 0x38], 0x151213fb
mov dword [ebp - 0x34], 0x9e69dd38
add dword [ebp - 0x34], 0x619622c8
lea eax, [ebp - 0x40]
push eax
mov eax, 0xaa8eb9c9
add eax, 0x55bd46ab
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xa4109197
sub dword [ebp - 0x40], 0x2f9e2841
mov dword [ebp - 0x3c], 0x1a1f1c0e
sub dword [ebp - 0x3c], 0xd8b2ba99
mov dword [ebp - 0x38], 0x3a6f2889
add dword [ebp - 0x38], 0x290043e3
mov dword [ebp - 0x34], 0x31e4f48f
sub dword [ebp - 0x34], 0x31e4f48f
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x79f6ffe6
add eax, 0x8655008a
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x6e5d3
push 0
call eax
mov ecx, 0xc6c3b29c
add ecx, 0x393c9332
mov edx, eax
mov esi, 0x1c2d47e1
add esi, 0xe423641f
add esi, dword [ebp - 0x30]
mov ebx, 0x333158f9
add ebx, 0xff464081
xor dword [ebp - 4], ebx
mov edi, dword [esi]
mov dword [ebp - 0xc], 0x38c59a0
xor edi, ebx
xor dword [ebp - 8], 0x7d870147
mov dword [edx], edi
add edx, 4
add esi, 0x1bfccbea
add esi, 0xe403341a
loop 0x4a8914
add eax, 0xb3b229ce
sub eax, 0xb3b11fc3
xor ebx, ebx
add ebx, eax
add eax, 0x332f06f2
sub eax, 0x332f06ed
mov ecx, 0xfb57ef92
add ecx, 0x4e8106e
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4012c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
mov dword [ebp - 0x54], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0
push 0
push 0x8000044
push 0
push 0
push 0
push str.explorer.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401311
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
jmp 0x401313
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402670
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4034b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x35c
push esi
push edi
mov dword [ebp - 0x360], ecx
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::CFileFind
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
push str._s.
lea ecx, [ebp - 0xd4]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0
lea edx, [ebp - 0xd4]
push edx
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::FindFile
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x4027fe
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::FindNextFileA
mov dword [ebp - 0xf4], eax
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x4027f9
push 0xc8
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::GetFileName
mov dword [ebp - 0x364], eax
mov ecx, dword [ebp - 0x364]
mov dword [ebp - 0x368], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x368]
call sub.MFC42.DLL_CString::GetBuffer
mov edi, eax
lea edx, [ebp - 0x1bc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x350]
call fcn.00403042
push 0x10
lea ecx, [ebp - 0xf0]
mov edx, dword [ebp - 0xf0]
call dword [edx + 0x40]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
je 0x4027cc
lea eax, [ebp - 0x1bc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s
lea edx, [ebp - 0x284]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x284]
push eax
mov ecx, dword [ebp - 0x360]
call fcn.00402670
jmp 0x4027f9
lea ecx, [ebp - 0x1bc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str._s_s
lea eax, [ebp - 0x34c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x34c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4026db
lea ecx, [ebp - 0xf0]
call sub.MFC42.DLL_CFileFind::Close
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40283b
mov dword [ebp - 0x354], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.00403096
mov eax, dword [ebp - 0x354]
jmp 0x40285d
mov dword [ebp - 0x358], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.00403096
mov eax, dword [ebp - 0x358]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x402b00
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403508
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x214
push edi
mov dword [ebp - 0x220], ecx
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x114]
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
add eax, 0x1e8
push eax
push str._s_setup.ini
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.SETUP
lea ecx, [ebp - 0x114]
call sub.MFC42.DLL_CString::operator_1
push str.Shortcut
lea ecx, [ebp - 0x21c]
call sub.MFC42.DLL_CString::operator_1
lea edx, [ebp - 0x110]
push edx
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x220]
add ecx, 0x2ec
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
push str.Brand
lea ecx, [ebp - 0x21c]
call sub.MFC42.DLL_CString::operator_1
lea edx, [ebp - 0x110]
push edx
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, dword [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x220]
add ecx, 0xe4
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x21c]
call fcn.00403042
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.00403042
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402c70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40355b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push edi
mov dword [ebp - 0x120], ecx
mov dword [ebp - 0x11c], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x118]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x114]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 3
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x120]
add eax, 0x1e8
push eax
push str._sLanSource.ini
lea ecx, [ebp - 0x118]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push str.UNJDVR
lea ecx, [ebp - 0x114]
call sub.MFC42.DLL_CString::operator_1
mov edx, dword [ebp - 0x118]
push edx
push 0x104
lea eax, [ebp - 0x110]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x11c]
or ecx, 1
mov dword [ebp - 0x11c], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x114]
call fcn.00403042
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x118]
call fcn.00403042
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00403042
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x6d6289ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d62e944]
jne 0x6d6289f4
repz ret
jmp fcn.6d629069

Function at 0x6d628cc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x6d628cd5
pop dword [ebp - 0xc]
mov eax, 0x6d628cd5
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xb3a9201c
add dword [ebp - 0x1c], 0x9aa9252f
mov dword [ebp - 0x18], 0x412baffa
add dword [ebp - 0x18], 0xf1079c4b
mov dword [ebp - 0x14], 0x498555a
sub dword [ebp - 0x14], 0xb84c112c
mov dword [ebp - 0x10], 0x69585ede
add dword [ebp - 0x10], 0x96a7a122
lea eax, [ebp - 0x1c]
push eax
mov eax, 0xa048c8d5
add eax, 0xcd19d74f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xfdc1eb9a
add dword [ebp - 0x1c], 0x76b07dbc
mov dword [ebp - 0x18], 0x5789364e
add dword [ebp - 0x18], 0xe9e32b27
mov dword [ebp - 0x14], 0x617eb523
sub dword [ebp - 0x14], 0xfe0f48b7
mov dword [ebp - 0x10], 0x905ae937
sub dword [ebp - 0x10], 0x905ae937
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xab4f713c
add eax, 0xc2132ee4
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x32aef
push 0
call eax
mov ecx, 0x371e
mov edi, eax
mov ebx, 0x6d631400
add ebx, dword [ebp - 0xc]
mov esi, 0x1becd536
mov dword [ebp - 8], 0x624c60c8
mov edx, dword [ebx]
xor dword [ebp - 8], eax
add edx, esi
sub dword [ebp - 8], 0xcac65844
mov dword [edi], edx
xor dword [ebp - 4], 0x908646
add edi, 0x158d658f
sub edi, 0x158d658b
add ebx, 4
loop 0x6d628de0
add eax, 0xb11e7051
add eax, 0x4ee25efa
xor ebx, ebx
add ebx, eax
add eax, 0xf94f70a5
add eax, 0x6b08f60
mov ecx, 0xe4c0bf4f
sub ecx, 0x775ebf4f
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x405b70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4319b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x150
mov dword [ebp - 0x14c], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00405700
mov byte [ebp - 4], 2
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x13c], 0x128
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x405c0f
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.00425978
mov eax, dword [ebp - 0x14c]
or al, 1
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00425c03
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00425c03
mov eax, dword [ebp + 8]
jmp 0x405d5c
mov ecx, 1
test ecx, ecx
je 0x405d1c
mov dword [ebp - 0x13c], 0x128
lea edx, [ebp - 0x13c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405c3f
jmp 0x405d1c
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x140]
call fcn.00425c71
mov byte [ebp - 4], 3
lea ecx, [ebp + 0xc]
call fcn.00405760
push eax
lea ecx, [ebp - 0x140]
call fcn.004091e0
test eax, eax
jne 0x405d08
push 0x440150
lea edx, [ebp + 0xc]
push edx
push 0x440154
lea eax, [ebp - 0x144]
push eax
call fcn.00425f0c
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x154], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x154]
push edx
lea eax, [ebp - 0x148]
push eax
call fcn.00425e98
mov dword [ebp - 0x158], eax
mov ecx, dword [ebp - 0x158]
mov dword [ebp - 0x15c], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x15c]
push edx
lea ecx, [ebp - 0x14]
call fcn.00425d3c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x148]
call fcn.00425c03
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x144]
call fcn.00425c03
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x140]
call fcn.00425c03
jmp 0x405d1c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x140]
call fcn.00425c03
jmp 0x405c0f
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00425978
mov edx, dword [ebp - 0x14c]
or edx, 1
mov dword [ebp - 0x14c], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00425c03
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.00425c03
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4067a6
Capabilities:
Check os version
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431ac9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
call fcn.00405700
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
pushal
mov ebx, dword fs:[0x18]
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xa8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], eax
popal
cmp dword [ebp - 0x10], 5
jne 0x406827
cmp dword [ebp - 0x14], 0
jne 0x406827
push str.Windows_2000
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
cmp dword [ebp - 0x10], 5
jne 0x406845
cmp dword [ebp - 0x14], 1
jne 0x406845
push str.Windows_XP
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
cmp dword [ebp - 0x10], 5
jne 0x406863
cmp dword [ebp - 0x14], 2
jne 0x406863
push str.Windows_2003
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
cmp dword [ebp - 0x10], 6
jne 0x40687e
cmp dword [ebp - 0x14], 0
jne 0x40687e
push str.Windows_Vista
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
cmp dword [ebp - 0x10], 6
jne 0x406899
cmp dword [ebp - 0x14], 1
jne 0x406899
push str.Windows_7
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
cmp dword [ebp - 0x10], 6
jne 0x4068b4
cmp dword [ebp - 0x14], 2
jne 0x4068b4
push str.Windows_8
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
cmp dword [ebp - 0x10], 6
jne 0x4068cf
cmp dword [ebp - 0x14], 3
jne 0x4068cf
push str.Windows_8.1
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
cmp dword [ebp - 0x10], 0xa
jne 0x4068ea
cmp dword [ebp - 0x14], 0
jne 0x4068ea
push str.Windows_10
lea ecx, [ebp - 0x18]
call fcn.00425d8c
jmp 0x4068f7
push 0x4402b4
lea ecx, [ebp - 0x18]
call fcn.00425d8c
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
call fcn.00425978
mov ecx, dword [ebp - 0x1c]
or ecx, 1
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00425c03
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422730
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00410ea0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4227fb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4227fb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4227ae
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4227b9
or bh, 8
and edi, 0x8000000
je 0x4227d4
mov eax, dword [0x44877c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4227fb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x422bd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x422bfb
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x422c1f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x422c3a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x426fdd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x427015
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00426083
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0042605b
jmp 0x427021
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4