joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458544
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4586ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4586d0
mov dl, 1
mov eax, dword [0x415f68]
call fcn.004038c4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404720
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4586bf
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044b4c0
test al, al
je 0x4586b2
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x458700
lea eax, [ebp - 0x254]
call fcn.00409b80
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4586b2
xor eax, eax
push ebp
push 0x4586ab
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x458738
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x458694
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404990
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x458694
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404990
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4586b2
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4585b5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00419c48
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4586f6
lea eax, [ebp - 0x260]
call fcn.00404720
ret

Function at 0x459068
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46d580]
cmp byte [eax + 0xad], 0
jne 0x4590d9
cmp dword [0x46d598], 0
jne 0x45909a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x459024
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46d598], eax
cmp dword [0x46d594], 0
jne 0x4590b5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46d594], eax
cmp dword [0x46d59c], 0
jne 0x4590d9
push esp
push 0
push 0
push 0x458fc8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46d59c], eax
pop edx
ret
Function at 0x4592ac
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4592c3
add esp, 0xfffffff0
call fcn.00403c18
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041dd48
mov eax, dword [0x469ab8]
cmp word [eax + 2], 0
jne 0x4592eb
mov eax, dword [0x469ab8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045adec
mov eax, dword [0x469b68]
cmp word [eax + 2], 0
jne 0x459305
mov eax, dword [0x469b68]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045aff8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415b44]
call fcn.004038c4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415b44]
call fcn.004038c4
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x415b44]
call fcn.004038c4
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x42242c]
call fcn.0042a004
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4594bc
mov eax, dword [0x4699d8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042a3d8
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45b6b8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4699d8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040d3b0
test eax, eax
je 0x45940c
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040951c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040d3e4
test eax, eax
je 0x459420
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404990
mov byte [ebx + 0xd4], 0
push ebx
push 0x45a94c
call fcn.0041eec4
mov dword [ebx + 0xc8], eax
mov eax, dword [0x4698b4]
cmp byte [eax], 0
jne 0x459471
mov eax, ebx
call fcn.00459600
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045b894
mov eax, ebx
call fcn.0045c3f4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4594b1
call fcn.00403c70
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459880
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46d580]
cmp dword [eax + 0x30], 0
je 0x45992a
cmp dword [ebx + 0x94], 0
jne 0x459924
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x459810
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x459924
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4598ea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x459924
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417ef0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4598f9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45a644
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45a679
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404810
jmp 0x45a686
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404774
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45ba78
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45bae6
mov eax, esi
call fcn.004461a0
test al, al
je 0x45bae6
mov eax, dword [ebx + 0x84]
call fcn.00445e00
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45bae6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45bada
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445e00
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043e1a0
jmp 0x45bae6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045b8b4
pop esi
pop ebx
ret
Function at 0x45d19c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x4074b8]
call fcn.00405190
xor eax, eax
push ebp
push 0x45d33d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x469760], 0
jne 0x45d1f7
mov ecx, dword [0x4698c4]
mov dl, 1
mov eax, dword [0x407a84]
call fcn.0040c62c
call fcn.00404168
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.00403230
mov eax, ebx
call fcn.00405060
mov dword [ebp - 0x24], eax
mov esi, 0x45d34c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.00406124
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.00405070
test eax, eax
jle 0x45d2e0
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45d2cc
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404990
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x45d272
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.004049a8
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x45d288
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.004049a8
mov eax, dword [ebp - 0x54]
call fcn.00404be4
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404990
mov eax, dword [ebp - 0x58]
call fcn.00404be4
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x45d2ce
xor eax, eax
test al, al
je 0x45d2d9
mov ebx, 0x15
jmp 0x45d2e5
mov ebx, 0x10
jmp 0x45d2e5
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x469760]
call fcn.0045d020
mov eax, dword [ebp - 4]
call fcn.0045d020
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040613c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45d344
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00404744
lea eax, [ebp - 0xc]
mov edx, dword [0x4074b8]
call fcn.00405260
ret
Function at 0x40105b
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x401670], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x401674], eax
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x401678], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x40167c], eax
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [0x401680], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [0x401684], eax
call 0x40105b
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x10
push dword [0x40167c]
push dword [0x401678]
push 0x401340
push 0x4011d3
call fcn.00401141
push 0x28
push dword [0x401680]
call fcn.00401290
mov dword [ebp - 4], eax
push 0x28
push dword [0x401684]
call fcn.00401290
mov dword [ebp - 8], eax
push dword [0x401680]
push dword [ebp - 4]
call fcn.00401279
mov dword [ebp - 0xc], eax
push dword [0x401684]
push dword [ebp - 8]
call fcn.00401279
mov dword [ebp - 0x10], eax
push 0
push dword [0x401670]
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0xcf0000
push 0x401350
push 0x401340
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x401688], eax
push 0xa0000
push 0x1f4
push dword [0x401688]
call sub.user32.dll_AnimateWindow
push dword [0x401688]
call sub.user32.dll_SetFocus
push 5
push dword [0x401688]
call sub.user32.dll_ShowWindow
push dword [0x401688]
call sub.user32.dll_UpdateWindow
push 1
push 0
push dword [0x401688]
call sub.user32.dll_InvalidateRect
call fcn.004011a4
leave
ret
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5cb153e1
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x2b7d2db6
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401fe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4027d0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov word [ebp - 0x42], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jae 0x40217f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [esp], eax
call fcn.00402830
sub esp, 4
cmp dword [ebp + 8], 0
jbe 0x402144
cmp dword [ebp + 0xc], 3
jbe 0x402144
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
mov eax, esp
lea ecx, [ebp - 0x68]
mov dword [eax], ecx
mov dword [eax + 4], 0x14d
call fcn.00401e50
mov dword [ebp - 0x74], eax
jmp 0x4020e3
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40213f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp + 0xc]
jne 0x40213a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x24]
mov ecx, dword [ebp - 0x48]
shl ecx, 1
add eax, ecx
mov ax, word [eax]
mov word [ebp - 0x42], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x1c]
movzx ecx, word [ebp - 0x42]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x70], 2
jmp 0x402154
jmp 0x40213f
jmp 0x402144
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x68]
call fcn.004028f0
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x402171
jmp 0x40216c
jmp 0x40217f
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x402078
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x38]
add eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4021c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x45fc00], eax
pop esi
pop edi
pop ebp
ret
Function at 0x40244d
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
cmp dword [ebp + 8], 0
push esi
push edi
je 0x40250e
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x40250e
push 0x41e3f0
push str.WH_GEngine
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40250e
lea eax, [ebp + 0xc]
push ebx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp + 0xc]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x224]
push eax
push ebx
mov dword [ebp - 0x224], 0x224
call sub.KERNEL32.dll_Module32First
mov esi, eax
test esi, esi
je 0x4024fc
cmp dword [ebp - 0x210], 0x400000
je 0x4024de
lea eax, [ebp - 0x224]
push eax
push ebx
call sub.KERNEL32.dll_Module32Next
jmp 0x4024bd
lea eax, [edi - 1]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00411630
mov eax, dword [ebp + 8]
add esp, 0xc
and byte [eax + edi - 1], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
test esi, esi
setne al
dec eax
jmp 0x402511
or eax, 0xffffffff
pop edi
pop esi
leave
ret 8
Function at 0x402517
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x710
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x2f0], bl
lea eax, [esi + 0x2f0]
jne 0x40253c
or eax, 0xffffffff
jmp 0x402694
lea ecx, [ebp - 0x610]
push edi
push ecx
lea ecx, [ebp - 0x710]
push ecx
lea ecx, [ebp - 0x510]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.004119e8
push ebx
lea eax, [ebp - 0x510]
push ebx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.00411957
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00411780
lea eax, [ebp - 0x108]
push str.data_
push eax
call fcn.00411790
add esp, 0x38
lea eax, [ebp - 0x20c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.00411930
mov byte [eax + 1], bl
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00402142
add esp, 0x10
mov edi, 0x45f6f8
test eax, eax
jne 0x40261b
push ebx
push edi
push 0x41e418
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp + 8], ebx
je 0x402625
mov edi, str._U__C
lea eax, [ebp - 0x410]
push edi
push eax
call fcn.00411780
pop ecx
pop ecx
push 0x3f6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
pop edi
je 0x40266d
push ebx
push ebx
push 0xf0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 1
jne 0x40266d
lea eax, [ebp - 0x410]
push 0x41e40c
push eax
call fcn.00411790
pop ecx
pop ecx
lea eax, [ebp - 0x310]
push 1
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [esi + 0x2f0]
push eax
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
pop esi
pop ebx
leave
ret 4

Function at 0x40288b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x402945
cmp dword [ebp + 0xc], 0x10
jl 0x402945
lea eax, [ecx + 0x2f0]
test eax, eax
je 0x4028fb
lea ecx, [ebp - 0x104]
test ecx, ecx
je 0x4028fb
lea ecx, [ebp - 0x508]
push ecx
lea ecx, [ebp - 0x408]
push ecx
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.004119e8
push 0
lea eax, [ebp - 0x204]
push 0
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00411957
add esp, 0x28
lea eax, [ebp - 0x104]
push 0x41e470
push eax
lea eax, [ebp - 0x308]
push 0x41e468
push eax
call fcn.0041172e
add esp, 0x10
lea eax, [ebp - 0x308]
push eax
push dword [ebp + 0xc]
push esi
push 0x45f6f8
push 0x41e45c
push 0x41e454
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor eax, eax
cmp byte [esi], al
setne al
dec eax
jmp 0x402948
or eax, 0xffffffff
pop esi
leave
ret 8
Function at 0x40294d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x708
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x402a66
cmp dword [ebp + 0xc], edi
je 0x402a66
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
jle 0x402a66
lea eax, [ecx + 0x2f0]
cmp eax, edi
je 0x4029c7
lea ecx, [ebp - 0x104]
test ecx, ecx
je 0x4029c7
lea ecx, [ebp - 0x608]
push ecx
lea ecx, [ebp - 0x708]
push ecx
lea ecx, [ebp - 0x404]
push ecx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.004119e8
push edi
lea eax, [ebp - 0x404]
push edi
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00411957
add esp, 0x28
lea eax, [ebp - 0x104]
push 0x41e48c
push eax
lea eax, [ebp - 0x508]
push 0x41e468
push eax
call fcn.0041172e
add esp, 0x10
mov esi, 0x400
push edi
lea eax, [ebp - 0x204]
push 0x41e484
push eax
call fcn.0041172e
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x304]
push 0x100
push eax
push 0x45f6f8
lea eax, [ebp - 0x204]
push 0x41e45c
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push dword [ebp + 8]
lea eax, [ebp - 0x304]
push eax
call fcn.00411b30
pop ecx
test eax, eax
pop ecx
je 0x402a45
inc edi
cmp edi, esi
jl 0x4029ec
cmp edi, esi
jge 0x402a66
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push ebx
push eax
push esi
call fcn.00411630
and byte [esi + ebx - 1], 0
add esp, 0xc
xor eax, eax
jmp 0x402a69
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0xc