joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f500
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
jne 0x51f52e
jmp 0x51f59c
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jg 0x51f54a
jmp 0x51f59c
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.0051f4e0
push ebp
push 0x4141a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.0051f4e0
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x51fca0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.0051fc80
push ebp
push 0x4141a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x51fcf3
jmp 0x51fd70
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.004adff0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.004adf40
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.004ae700
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.004afbb0
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x51fdc7
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.0051fc60
push ebp
push 0x4141a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0051fc60
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.0051fc80
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5273a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x5c46e0
call fcn.0040e890
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00527390
push ebp
push 0x4141a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408c40
mov eax, dword [ebp - 0xc]
mov edx, fcn.0051c840
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.00409590
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408c40
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.005288e0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00527a30
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x5274a5
jmp 0x5274c4
mov eax, dword [ebp - 4]
call fcn.00463840
test al, al
je 0x5274b3
jmp 0x5274c4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00527390
mov esp, ebp
pop ebp
ret
Function at 0x529270
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00529250
push ebp
push 0x4141a0
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a9c0
cmp dword [ebp - 0xc], 0
jg 0x5292bc
jmp 0x5292dc
mov eax, dword [ebp - 0xc]
lea eax, [eax + 1]
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x5292cf
mov eax, 0x5e92f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
nop
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a9c0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040b100
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x529305
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x529311
mov eax, 0x5e92f0
call fcn.0049e1c0
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00529250
mov esp, ebp
pop ebp
ret
Function at 0x570d90
Capabilities:
Hash data using murmur3

Disassembly:
xchg ecx, edx
push ebp
push edi
lea ebp, [ecx + edx]
push esi
push ebx
sub esp, 8
cmp edx, 0xf
mov ebx, eax
mov dword [esp], edx
lea eax, [ebx + 0x165667b1]
jbe 0x570e38
lea eax, [ebp - 0x10]
lea edi, [ebx + 0x24234428]
lea esi, [ebx - 0x7a143589]
mov dword [esp + 4], ebp
mov edx, eax
lea eax, [ebx + 0x61c8864f]
mov ebp, edx
mov edx, dword [ecx]
imul edx, edx, 0x85ebca77
add edi, edx
rol edi, 0xd
imul edi, edi, 0x9e3779b1
mov edx, dword [ecx + 4]
imul edx, edx, 0x85ebca77
add esi, edx
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov edx, dword [ecx + 8]
imul edx, edx, 0x85ebca77
add ebx, edx
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
mov edx, dword [ecx + 0xc]
lea ecx, [ecx + 0x10]
imul edx, edx, 0x85ebca77
add eax, edx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jae 0x570dcd
rol edi, 1
rol esi, 7
rol ebx, 0xc
add esi, edi
mov ebp, dword [esp + 4]
ror eax, 0xe
add ebx, esi
add eax, ebx
lea esi, [ecx + 4]
add eax, dword [esp]
cmp ebp, esi
jb 0x570e6a
mov ebx, esi
nop
imul edx, dword [ebx - 4], 0xc2b2ae3d
add ebx, 4
add eax, edx
ror eax, 0xf
imul eax, eax, 0x27d4eb2f
cmp ebp, ebx
jae 0x570e45
lea edx, [ebp - 4]
sub edx, ecx
mov ecx, edx
and ecx, 0xfffffffc
add ecx, esi
cmp ebp, ecx
jbe 0x570e8a
movzx edx, byte [ecx]
add ecx, 1
imul edx, edx, 0x165667b1
add eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
cmp ebp, ecx
jne 0x570e6e
nop
mov edx, eax
add esp, 8
shr edx, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
pop ebx
pop esi
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
pop edi
pop ebp
mov edx, eax
shr edx, 0x10
xor eax, edx
ret
Function at 0x571c80
Capabilities:
Hash data using murmur3

Disassembly:
push ebx
push esi
push edi
lea esp, [esp - 0x14]
mov dword [esp + 8], eax
mov dword [esp], edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp]
mov edx, dword [esp + 0xc]
lea eax, [ecx + edx]
mov dword [esp + 4], eax
cmp dword [esp + 0xc], 0x10
jl 0x571d5f
mov edx, dword [esp + 4]
lea ebx, [edx - 0x10]
mov edx, dword [esp + 8]
mov dword [esp + 0x10], edx
sub edx, 0x7a143589
lea eax, [edx - 0x61c8864f]
mov ecx, dword [esp + 0x10]
add ecx, 0x61c8864f
mov edi, dword [esp]
mov esi, dword [edi]
imul esi, esi, 0x85ebca77
add esi, eax
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov eax, esi
mov esi, dword [esp]
mov edi, dword [esi + 4]
imul edi, edi, 0x85ebca77
lea esi, [edi + edx]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov edx, esi
mov edi, dword [esp]
mov esi, dword [edi + 8]
imul esi, esi, 0x85ebca77
add esi, dword [esp + 0x10]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov dword [esp + 0x10], esi
mov esi, dword [esp]
mov edi, dword [esi + 0xc]
imul edi, edi, 0x85ebca77
lea esi, [edi + ecx]
rol esi, 0xd
imul esi, esi, 0x9e3779b1
mov ecx, esi
add dword [esp], 0x10
cmp ebx, dword [esp]
jae 0x571cd0
mov ebx, eax
rol ebx, 1
mov eax, edx
rol eax, 7
add eax, ebx
mov edx, dword [esp + 0x10]
rol edx, 0xc
add edx, eax
mov eax, ecx
rol eax, 0x12
add edx, eax
jmp 0x571d69
mov eax, dword [esp + 8]
lea edx, [eax + 0x165667b1]
add edx, dword [esp + 0xc]
jmp 0x571d8e
mov ecx, dword [esp]
mov eax, dword [ecx]
imul eax, eax, 0xc2b2ae3d
add edx, eax
mov eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
mov edx, eax
add dword [esp], 4
mov eax, dword [esp]
lea ecx, [eax + 4]
cmp ecx, dword [esp + 4]
jbe 0x571d70
jmp 0x571dbf
mov eax, dword [esp]
movzx ecx, byte [eax]
imul ecx, ecx, 0x165667b1
add edx, ecx
mov eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
mov edx, eax
add dword [esp], 1
mov eax, dword [esp + 4]
cmp eax, dword [esp]
ja 0x571da0
mov eax, edx
shr eax, 0xf
xor eax, edx
imul eax, eax, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae3d
mov eax, edx
shr eax, 0x10
xor eax, edx
lea esp, [esp + 0x14]
pop edi
pop esi
pop ebx
ret
Function at 0x1027c0f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x78], eax
not ax
movzx ax, al
lea eax, [esp + 0x720]
push dword [esp]
jmp 0x102a196d
pushfd
mov dword [esp + 0x84], eax
not al
cwde
lea eax, [esp + 0x68]
push 0xf718e8b7
pushfd
push dword [esp]
mov dword [esp + 0x3c], eax
jmp fcn.10275c94

Function at 0x1029f30a
Capabilities:
Enumerate process modules

Disassembly:
lea esp, [esp + 0x10]
call sub.KERNEL32.dll_Module32NextW
Function at 0x845058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.008451a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x84507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84506a
add dl, dl
jne 0x845089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8450dc
xor eax, eax
add dl, dl
jne 0x845096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84517d
add dl, dl
jne 0x8450a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8450d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x845075
mov eax, 1
add dl, dl
jne 0x8450ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8450f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8450e1
sub eax, ebx
mov ebx, 1
jne 0x845128
mov ecx, 1
add dl, dl
jne 0x84510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x845119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x845105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x84513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x84514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x845136
cmp eax, 0x7d00
jae 0x84516d
cmp eax, 0x500
jb 0x845168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
cmp eax, 0x7f
ja 0x845170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x845075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x84519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x845075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x1ef37046
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x67961231
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4011c0
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
test esi, esi
je 0x4011ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401210
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40120a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
pop esi
ret 4
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401230
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
pop esi
ret 4

Function at 0x401270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401289
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4012c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4012c0
lea ebx, [ebx]
cmp esi, eax
jae 0x4012c4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4012b0
cmp esi, eax
jb 0x4012ca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404300
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00418890

Function at 0x406020
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x44a290
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x466910]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
mov eax, dword [0x466910]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
lea esi, [ebx + 2]
call fcn.00406210
mov dword [esp + 0x80], ebx
mov eax, dword [esp + 0x10]
cmp dword [eax - 0xc], ebx
jne 0x40609a
or ebp, 0xffffffff
mov dword [esp + 0x80], ebp
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x406093
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x4061e1
push ebx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x1c], esp
mov esi, esp
push eax
call fcn.00404770
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.004064f0
or ebp, 0xffffffff
cmp eax, ebx
jne 0x406163
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push 0x456ff8
push edx
call fcn.004066e0
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406102
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
call fcn.00406350
cmp eax, ebx
jne 0x40611c
mov dword [esp + 0x80], ebp
mov eax, dword [esp + 0x10]
jmp 0x40607a
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
mov dword [edi + 8], eax
call fcn.00406210
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x84], 1
call fcn.00404340
mov byte [esp + 0x80], bl
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x406163
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x58
lea ecx, [esp + 0x20]
push ebx
push ecx
mov dword [esp + 0x24], ebx
call fcn.00437170
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0x44]
push 0x20
push eax
mov byte [esp + 0x45], bl
mov dword [esp + 0x40], 0x2bc
call fcn.0043349d
mov ecx, dword [esp + 0xa0]
add esp, 0x18
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
mov ecx, edi
call fcn.0041b277
test eax, eax
je 0x4061bb
mov ebx, 1
mov dword [esp + 0x80], ebp
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x4061df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004331c4
add esp, 0x74
ret 4
Function at 0x40cf60
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x466910]
xor eax, esp
mov dword [esp + 0x20c], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov dword [esp + 0xc], 0
mov word [esp + 0x10], ax
call fcn.00437170
mov edx, dword [edi + 0x14]
add esp, 0xc
push edx
push 0x104
lea eax, [esp + 0xc]
push eax
push 0x455c0c
push str.PRODUCT_REG
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004014b0
mov ecx, dword [esp + 0x20c]
xor ecx, esp
mov eax, esi
call fcn.004331c4
add esp, 0x210
ret
Function at 0x40ea40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x44a9a0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x466910]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x20], 2
mov dword [esp + 0x10], 0x104
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 4
mov eax, 0x20019
cmp dword [ecx + 0x10], ebx
je 0x40ea93
mov eax, 0x20119
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [esp + 0x30]
push ebx
push eax
push ecx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40eb93
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push ebx
lea edx, [esp + 0x1c]
push edx
push ebx
push eax
push ecx
call esi
cmp eax, ebx
jne 0x40eb88
mov eax, dword [esp + 0x10]
cmp eax, 0x14
ja 0x40eb88
cmp dword [esp + 0x14], 4
jne 0x40eb63
cmp eax, ebx
je 0x40eb63
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push edi
lea eax, [esp + 0x1c]
push eax
push ebx
push ecx
push edx
call esi
test eax, eax
je 0x40eb30
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
call fcn.00401570
lea ecx, [esp + 0x2c]
call fcn.00401570
jmp 0x40ebdf
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x28]
call fcn.00401570
lea ecx, [esp + 0x2c]
call fcn.00401570
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0xc
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x20], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40ebab
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x20], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ebb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ebdf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret 0xc
Function at 0x40f0c0
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x3c
push ebx
push 0x38
xor ebx, ebx
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00437170
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
add esp, 0xc
mov eax, esi
neg eax
mov dword [esp + 0x14], ecx
sbb eax, eax
lea ecx, [esp + 4]
and eax, 5
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp byte [esp + 0x4c], bl
je 0x40f134
mov edx, dword [esp + 0x3c]
push 0x1d4c0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, ebx
jne 0x40f14f
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x3c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop ebx
test edx, edx
jg 0x40f170
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f190
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f1b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
add esp, 0x3c
ret 0x10