joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403830
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and edx, 0xc8
and edx, 0x30
rcl edx, 0x9f
and eax, 0xbf
sbb eax, 0xfe
or edi, 0x63
sbb edi, 0xb7
ror eax, 0x86
rol esi, 0x33
bswap eax
ror edx, 0xc4
not edi
neg esi
sub ebx, 0x1b
sub eax, 0xc6
sub eax, 0x54
rcl edi, 0xac
bswap eax
or edx, 0xfd
bswap esi
mov ebx, 0x76
dec edx
bswap eax
bswap ebx
bswap eax
and esi, 0x96
dec eax
and edi, 0x2e
mov eax, 0x98
imul eax
add ebx, 0x89
not edi
imul edi
sbb esi, 0x48
rcr ebx, 0x13
not esi
neg edx
imul edi
neg eax
not eax
neg esi
bswap edx
rol esi, 0xe4
rol edi, 0x81
inc ebx
sub esi, 0x4e
not edi
imul eax
imul esi
neg edx
xor ecx, ecx
xor edi, edi
ror esi, 0x37
dec ebx
mov ebx, 0x43
rcr edx, 3
rol edi, 0xb
rcr edi, 0x74
inc edi
or edx, 0xd8
inc ebx
dec edi
neg eax
or esi, 0xcf
neg edi
ror esi, 0x38
rcr edx, 0x98
imul esi
bswap eax
or ebx, 0xee
sub edx, 0x58
ror esi, 0x22
imul ebx
ror esi, 0x74
neg eax
add edx, 0x35
neg ebx
dec eax
rol ebx, 0x29
inc eax
inc edi
inc eax
rol ebx, 0x90
inc eax
rol edi, 0x96
sub edx, 0x59
bswap ebx
mov edi, 0x98
rcr eax, 0xff
bswap eax
and edi, 0xdd
rcl ebx, 0x9b
sub edi, 0x2c
bswap esi
mov esi, 0xe
neg eax
mov ebx, 0x68
neg esi
and ebx, 0xed
not edx
imul edx
or edx, 0xe
mov ecx, dword [ebp + 0xc]
not edx
mov eax, 0x96
ror eax, 0x7e
imul ebx
mov ebx, 0xcb
or ebx, 0x33
inc edi
rcl edx, 0x42
sub esi, 0xed
bswap edi
mov edx, 0xdf
not esi
sbb edx, 0x72
imul ebx
not edi
inc edx
bswap eax
neg ebx
not esi
not edi
imul edx
sub esi, 0xdf
neg edx
dec ebx
not edx
ror eax, 0xc8
inc eax
mov edx, 0xdb
ror esi, 0xeb
or ebx, 0xcc
imul ebx
add edi, 0x97
rcr eax, 0x73
rol esi, 0x3f
ror eax, 0xdf
mov ebx, 0x67
mov edx, 0xce
bswap esi
or edi, 0xe7
sbb eax, 0xdf
inc edx
not edi
ror esi, 0x5e
ror esi, 0x59
bswap edx
rol ebx, 7
dec edi
not esi
neg edx
imul ebx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ebx, ebx
mov esi, ebx
xor eax, ebx
xor eax, esi
xor eax, eax
mov esi, ebx
xor esi, ebx
mov ebx, eax
xor esi, esi
mov ebx, esi
xor eax, eax
not byte [edi]
xor ebx, ebx
mov eax, eax
xor ebx, eax
xor eax, eax
xor esi, esi
mov eax, eax
xor ebx, eax
xor ebx, ebx
xor eax, eax
sub byte [edi], 0x98
mov eax, esi
mov esi, esi
mov esi, ebx
xor esi, eax
mov ebx, esi
xor eax, esi
mov ebx, eax
mov eax, eax
xor esi, esi
add byte [edi], 0x53
xor esi, ebx
mov ebx, ebx
mov esi, ebx
xor esi, eax
mov ebx, ebx
xor ebx, esi
xor ebx, ebx
xor esi, esi
xor ebx, ebx
imul byte [edi]
inc edi
loop 0x4039ff
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43e15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x43e168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x43e14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x43e145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x43e145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x43e1d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x43e1c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
rol eax, 1
ror eax, 1
push eax
xor eax, eax
pop eax
xor dword [esi + edx], eax
add edx, 6
sub edx, 2
cmp edx, ecx
jl 0x43e1f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
rol eax, 1
ror eax, 1
push eax
xor eax, eax
pop eax
xor dword [esi + edx], eax
add edx, 6
sub edx, 2
cmp edx, ecx
jl 0x43e285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx
Function at 0x1392f05
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
jmp 0x1392f47
push si
mov dword [esp], edi

Function at 0x1392f1b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf13842c8
jmp 0x1392f2f
mov word [esp], cx
pop word [esp]
lea esp, [esp + 2]
mov dword [esp], esi
call fcn.01392f05
bts bp, bx
jne 0x139313b
mov si, cx
call fcn.01393072
xchg edi, eax
dec cl
push 0x8956668b
cmp al, 0x24
pushfd
jmp 0x1392daa
lea esi, reloc.mscoree.dll__CorExeMain
clc
lea edi, [edi*4]
push dword [esp]
ret 4
setp bh
mov cl, dl
btr di, cx
xchg bl, dl
bsr edx, esi
xchg dword [esp], eax
jmp 0x1392f52
inc ebx
jmp 0x1392fa3
mov esi, eax
sub ah, bh
je 0x1392f80
inc ebx
jmp 0x1392fa3
lea esi, [esp]
mov ecx, 0xb67de82b
dec dh
ja 0x1392ff3
jbe 0x1392fdd
jbe 0x1392f98
cmp dword [esi - 0x40], reloc.mscoree.dll__CorExeMain
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
fiadd dword [edi]
mov word [edx], es
xchg esp, eax
sub bl, byte [ecx - 0x48727b4e]
or edx, dword [edx - reloc.mscoree.dll__CorExeMain]
int 0x66
mov ebx, 0xd08a5181
lea eax, reloc.mscoree.dll__CorExeMain
jmp 0x1392f6d
rdtsc
bswap ebx
jmp 0x1392ff7
rdtsc
bswap ebx
sub esp, 0xc0
jmp 0x139302c
neg dh
sbb ax, cx
jmp 0x1392fff
mov edi, esp
mov ebx, dword [esp]
neg edx
jg 0x1393015
sbb ax, cx
neg dh
jmp fcn.01393001
mov si, cx
mov ebp, dword [esp + 0x2c]
mov cx, bx
jmp 0x1392f96
jmp 0x13930cb

Function at 0x1397a16
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf13842c8
jmp 0x1397a82
mov byte [esp + 2], ch
push dword [esp + 2]
jge 0x1397a4e
pop word [esp + 1]
jmp 0x1397a50
pop word [esp + 1]
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp], ebx
pushfd
jmp 0x1397a9e
jmp 0x1397a38
lea esp, [esp]
lea esp, [esp + 2]
mov dword [esp], ebx
jmp 0x1397ad0
pushfd
jmp 0x1396e74
cmp bl, cl
je 0x1397b05
inc ch
jmp 0x1397ae9
pushfd
mov dword [esp + 2], esi
push si
lea esp, [esp + 2]
mov dword [esp + 4], esp
mov dword [esp], ebp
call fcn.01397a7a
pop word [esp]
lea esp, [esp]
lea esp, [esp + 2]
push esi
push edi
jmp 0x1397a7c
pushfd
jmp 0x1397a9e
lea ebp, [esp]
bswap eax
bswap ecx
mov edi, 0xe3309eb0
jmp 0x1397b1f
mov esi, dword [esp + 0x2c]
bswap edi
mov edx, dword [esp]
mov cl, ch
jmp 0x1397ad3
inc ch
jmp 0x1397ae9
bsr cx, bp
js 0x1397b30
xchg edx, ebx
inc bx
jmp fcn.01397b5d
mov bx, 0xa610
sub esp, 0xc0
mov edi, esp
setbe ah
jmp 0x1397b09
xchg edx, ebx
inc bx
jmp fcn.01397b5d

Function at 0x13a2abf
Capabilities:
Check for trap flag exception

Disassembly:
push ebx
jmp 0x1387e86
pushfd
or dword [esp], reloc.mscoree.dll__CorExeMain
popfd
cpuid
nop
jmp 0x1387e9d
pop ebx
ret
lea esp, [esp + 4]
jmp 0x1387e7a
jmp 0x13a2a39
Function at 0x13a32c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x13875fb
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x1387615
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x1387604
pop esi
jmp 0x1387620
ret 4
call 0x13a32aa
push ecx
mov word [esp + 1], dx
bswap esi
lea esp, [esp + 2]
not si
jmp 0x13a331b
mov ebp, 0xf4f5bbfc
mov si, word [esp]
pop eax
lea esi, [ebx*4]
jmp 0x13a3342
lea esp, [esp + 2]
push eax
mov ah, 0xaa
lea esi, [ebx + edi]
mov ax, dx
mov esi, eax
jmp 0x13a3303
pop ebp
lea esi, reloc.mscoree.dll__CorExeMain
lea esi, [ecx + edx]
mov esi, dword [esp]
pop esi
jmp 0x13875ee
mov si, bp
lea ebp, [ecx + edi]
xchg esi, ebp
bswap ebp
mov si, word [esp]
mov ebp, dword [esp]
jmp 0x13a332c

Function at 0x143a207
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.0143a044
lea esp, [esp + 1]
mov dword [esp + 0x3c], ebx
push esp
jmp 0x143a239
mov byte [esp], bl
pop word [esp]
lea esp, [esp + 2]
mov dword [esp + 0x38], esp
mov dword [esp + 0x34], ebp
push cx
jmp 0x143a856
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x143a03f
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x143a439
lea esp, [esp]
mov word [esp], sp
lea esp, [esp + 2]
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
lea esp, [esp + 0x2c]
jmp 0x143a695
Function at 0x402857
Capabilities:
Get disk information

Disassembly:
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40285d
mov eax, dword [esp + 0x34]
mov dword [0x6ca8d8], eax
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00406000
push 1
mov eax, str.DeviceLanmanRedirector
push eax
push dword [esp + 8]
call fcn.00410430
and eax, eax
je 0x4028d8
push dword [0x6ca8d8]
push dword [0x6ca8d8]
mov eax, str.DeviceLanmanRedirector
push eax
push dword [esp + 0xc]
call fcn.004106f0
lea eax, [esp + 0x24]
push eax
call fcn.00414020
mov edx, dword [esp + 0x20]
push dword [0x6ca8d8]
push edx
call fcn.004140a0
pop eax
add eax, dword [0x6c8664]
jmp 0x402a53
push 0x208
call fcn.00411300
mov dword [esp + 4], eax
mov dword [esp + 8], 0
jmp 0x4028f0
push dword [esp + 4]
push 0x208
call sub.KERNEL32.dll_GetLogicalDriveStringsW
cmp eax, dword [esp + 8]
jl 0x40295a
mov ebx, dword [esp + 4]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.004060e0
mov dword [esp + 0xc], eax
mov ebx, dword [esp + 0xc]
and ebx, ebx
je 0x402954
push dword [0x6ca8d8]
push dword [0x6ca8d8]
push dword [esp + 0x1c]
call fcn.004103c0
push dword [0x6ca8d8]
push dword [0x6ca8d8]
push dword [esp + 0x18]
call fcn.00410710
pop eax
lea eax, [esp + 0x18]
push eax
call fcn.00414020
inc dword [esp + 8]
jno 0x4028f0
push dword [0x6ca8d8]
push dword [0x6ca8d8]
push 0x208
call fcn.00410730
lea eax, [esp + 0x20]
push eax
call fcn.00414020
mov eax, 0x4171de
push eax
push dword [esp + 0x18]
call fcn.00410780
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], 1
jmp 0x402997
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x24]
jl 0x402a2a
push dword [0x6ca8d8]
push dword [0x6ca8d8]
mov eax, 0x4171de
push eax
push dword [esp + 0x30]
push dword [esp + 0x24]
call fcn.00410810
lea eax, [esp + 0x1c]
push eax
call fcn.00414020
push 0x208
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
call sub.KERNEL32.dll_QueryDosDeviceW
push 1
push dword [esp + 0x20]
push dword [esp + 8]
call fcn.00410430
and eax, eax
je 0x402a20
push dword [0x6ca8d8]
push dword [0x6ca8d8]
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [esp + 0x10]
call fcn.00410c80
lea eax, [esp + 0x24]
push eax
call fcn.00414020
jmp 0x402a2a
inc dword [esp + 0x24]
jno 0x402997
mov edx, dword [esp + 0x20]
push dword [0x6ca8d8]
push edx
call fcn.004140a0
pop eax
add eax, dword [0x6c8664]
jmp 0x402a53
push dword [esp + 0x14]
call fcn.00414100
push dword [esp + 0x20]
call fcn.00414100
push dword [esp]
call fcn.00414100
push dword [esp + 0x1c]
call fcn.00414100
push dword [esp + 0x18]
call fcn.00414100
add esp, 0x28
pop ebx
ret 4
Function at 0x404634
Capabilities:
Terminate process

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push dword [esp + 0x10]
push 0
push 1
call sub.KERNEL32.dll_OpenProcess
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
je 0x404678
push 1
push dword [esp + 4]
call sub.KERNEL32.dll_TerminateProcess
and eax, eax
je 0x404670
mov dword [esp + 4], 1
push dword [esp]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [esp + 4]
jmp 0x404680
add esp, 8
pop ebx
ret 4

Function at 0x40578e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405794
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.00406000
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 4]
call fcn.00406000
mov edx, dword [esp + 0x40]
lea ecx, [esp + 8]
call fcn.00406000
push dword [esp]
call fcn.00403760
mov edx, 0x417028
lea ecx, [esp + 0xc]
call fcn.00406008
push dword [esp + 8]
mov edx, 0x417154
pop ecx
call fcn.00406100
je 0x405841
cmp dword [0x6ca0b4], 0
je 0x405825
lea eax, [esp + 0x14]
push eax
mov ebx, dword [0x6ca0c8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x6ca070]
push dword [0x6ca0a4]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0x10], eax
jmp 0x40583f
lea eax, [esp + 0x14]
push eax
push dword [0x6ca070]
push dword [0x6ca0a4]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0x10], eax
jmp 0x4058a6
lea eax, [esp + 0x1c]
push eax
push dword [0x6ca0a4]
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegConnectRegistryW
mov dword [esp + 0x18], eax
cmp dword [0x6ca0b4], 0
je 0x40588e
lea eax, [esp + 0x14]
push eax
mov ebx, dword [0x6ca0c8]
or ebx, 0xf003f
push ebx
push 0
push dword [0x6ca070]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegOpenKeyExW
mov dword [esp + 0x10], eax
jmp 0x4058a6
lea eax, [esp + 0x14]
push eax
push dword [0x6ca070]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegOpenKeyW
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x405913
mov dword [esp + 0x24], 0xff
push dword [0x6ca8d8]
push dword [0x6ca8d8]
push 0xff
call fcn.00410730
lea eax, [esp + 0x2c]
push eax
call fcn.00414020
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x28]
call sub.ADVAPI32.dll_RegQueryValueExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x405913
mov dword [esp + 0x20], 1
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0x20]
jmp 0x405924
push dword [esp + 8]
call fcn.00414100
push dword [esp + 0x28]
call fcn.00414100
push dword [esp]
call fcn.00414100
push dword [esp + 4]
call fcn.00414100
push dword [esp + 0xc]
call fcn.00414100
add esp, 0x30
pop ebx
ret 0xc
Function at 0x406d2d
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x406d82
push dword [esp + 0x10]
push 0x406cac
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x6ca1f0]
test esi, esi
je 0x406ddb
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x406d7a
cmp byte [esi + 0x10], 0
je 0x406d7a
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x406d56
jmp 0x406ddb
mov esi, dword [0x6ca1f0]
test esi, esi
je 0x406ddb
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x406dd4
cmp byte [esi + 0x11], 0
je 0x406db0
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x406dc7
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x6ca1f0
call fcn.00413f22
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x406d8f
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4084d7
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x6caa58]
call fcn.00413859
mov ebx, eax
test ebx, ebx
je 0x40853b
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x408500
push dword [esp + 0xc]
push ebx
call eax
jmp 0x40853b
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00414230
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.00414300
pop edi
pop esi
pop ebx
ret 8

Function at 0x40ab17
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40ac8d
mov eax, dword [esp + 0x24]
dec eax
je 0x40ac70
dec eax
jne 0x40ac8d
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.0040aad0
pop ecx
test eax, eax
je 0x40abce
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x40ab91
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x40ac6c
dec ebx
je 0x40ac68
dec ebx
je 0x40ac47
dec ebx
je 0x40ac01
sub ebx, 4
jne 0x40ac8d
test edi, edi
jne 0x40ac8d
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x40ac8d
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x40ab91
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x40ab8c
sub edi, 0
je 0x40ac39
dec edi
je 0x40ac2b
dec edi
je 0x40ac1d
dec edi
jne 0x40ac8d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x40ac8d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x40ac8d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x40ac8d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x40ac8d
sub edi, 0
je 0x40ac64
dec edi
je 0x40ac60
dec edi
jne 0x40ac8d
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40ac8d
push 0x3c
jmp 0x40ac8c
push 0x32
jmp 0x40ac8c
push 0x14
jmp 0x40ac8c
push 5
jmp 0x40ac8c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40ac8a
cmp eax, 0xa
je 0x40ac86
cmp eax, 0x5a
jne 0x40ac8d
push 0x28
jmp 0x40ac8c
push 0x1e
jmp 0x40ac8c
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x40b279
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x6caa64]
call fcn.00413859
mov esi, eax
test esi, esi
je 0x40b353
cmp dword [ebp + 0xc], 0
je 0x40b2c5
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40b2b6
cmp dword [esi + 0x1c], 0
jne 0x40b2b6
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40b353
test byte [ebp + 0x10], 3
je 0x40b2e0
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0040be8d
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x40b305
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x40b319
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x40b336
test ebx, ebx
je 0x40b32a
push 8
jmp 0x40b33c
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x40b349
test ebx, ebx
je 0x40b33f
push 3
pop ecx
jmp 0x40b349
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x40b427
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, eax
test ebx, ebx
je 0x40b4ba
push 9
call esi
test al, al
jns 0x40b4ba
push 0x11
call esi
test al, al
js 0x40b4ba
push 0x10
call esi
test al, al
js 0x40b4ba
push 0x12
call esi
test al, al
js 0x40b4ba
push 0x10
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
push 5
lea eax, [ebp - 0x24]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40b49c
push 4
lea eax, [ebp - 0x24]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x40b4ba
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
jne 0x40b4ba
xor eax, eax
jmp 0x40b53b
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40b4e2
push 0x11
call esi
test al, al
js 0x40b4da
push 0x10
call esi
test al, al
js 0x40b4da
push 0x12
call esi
test al, al
jns 0x40b4e2
push 1
push edi
call fcn.0040b543
mov esi, dword [sym.imp.USER32.dll_GetPropW]
test ebx, ebx
je 0x40b4f8
push str.PB_Hotkey
push ebx
call esi
test eax, eax
jne 0x40b538
push str.PB_WindowID
push edi
call esi
mov esi, eax
test esi, esi
je 0x40b538
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x40b538
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 4], eax
jne 0x40b538
lea eax, [esi - 1]
push eax
push dword [0x6caa64]
call fcn.00413859
test eax, eax
je 0x40b538
mov eax, dword [eax + 8]
jmp 0x40b53a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40ca5c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x6ca7c4], eax
test eax, eax
je 0x40ca8a
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x6ca7c0], eax
lea eax, [ebp - 0x114]
mov dword [0x6ca7c8], 1
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40caec
cmp dword [ebp - 0x104], 1
jne 0x40cac1
and dword [0x6ca7c8], 0
jmp 0x40cb04
cmp dword [ebp - 0x104], 2
jne 0x40caec
cmp dword [ebp - 0x110], 5
jb 0x40cab8
jne 0x40caec
mov eax, dword [ebp - 0x10c]
neg eax
sbb eax, eax
and eax, dword [0x6ca7c8]
mov dword [0x6ca7c8], eax
jmp 0x40caf1
mov eax, dword [0x6ca7c8]
test eax, eax
je 0x40cb04
call fcn.0040c75f
neg eax
sbb eax, eax
and dword [0x6ca7c8], eax
mov esp, ebp
pop ebp
ret

Function at 0x40e080
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40e0b2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e0ad
cmp dword [esp + 0xc], esi
je 0x40e0c9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret