joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413448
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x413536
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xbff00000
cmp byte [0x427bc4], 0xff
jne 0x41349e
mov byte [0x427bc4], 0
mov edx, 0x413550
mov eax, 0x41356c
call fcn.0040b320
test eax, eax
je 0x41349e
mov byte [0x427bc4], 1
cmp byte [0x427bc4], 0
sete dl
lea eax, [ebp - 4]
call fcn.004133b8
mov ebx, eax
cmp byte [0x427bc4], 1
jne 0x4134dc
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
mov eax, dword [0x427e00]
mov eax, dword [eax]
call eax
test eax, eax
je 0x413520
fild qword [ebp - 0x20]
fstp qword [ebp - 0x10]
wait
jmp 0x413520
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x413520
mov eax, dword [ebp - 0x24]
imul dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fstp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fmul qword [ebp - 0x10]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41353d
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x413a10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x413b13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404188
mov edx, dword [ebp - 4]
mov eax, 0x413b2c
call fcn.00404770
cmp eax, 2
jne 0x413aa2
lea eax, [ebp - 8]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x413a86
cmp eax, dword [esp]
pop edx
pop eax
jne 0x413af8
mov eax, dword [ebp - 4]
call fcn.00406f14
test al, al
je 0x413af8
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.004041dc
jmp 0x413af8
mov bl, 0x43
inc ebx
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404354
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov ecx, 0x413b2c
call fcn.00404478
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x413add
cmp eax, dword [esp]
pop edx
pop eax
jne 0x413aee
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00413824
cmp bl, 0x5a
je 0x413af8
cmp dword [esi], 0
je 0x413aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413b1a
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004041ac
ret
Function at 0x413b30
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 0x160]
mov edx, dword [0x4060e4]
call fcn.0040497c
xor eax, eax
push ebp
push 0x413c98
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004072c0
cmp dword [ebp - 8], 0
je 0x413b92
lea eax, [ebp - 8]
mov edx, 0x413cb4
call fcn.00404434
lea ecx, [ebp - 0x160]
mov edx, 0x27
mov eax, ebx
call fcn.004070dc
test eax, eax
jne 0x413c56
xor eax, eax
push ebp
push 0x413bf4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x413bea
push 0x80
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.00404478
mov eax, dword [ebp - 0x164]
call fcn.0040462c
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413bfe
xor eax, eax
push ebp
push 0x413c39
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x168]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.00404478
mov eax, dword [ebp - 0x168]
call fcn.0040716c
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x413c43
lea eax, [ebp - 0x160]
call fcn.0040712c
test eax, eax
je 0x413bac
lea eax, [ebp - 0x160]
call fcn.00407150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413c9f
lea eax, [ebp - 0x168]
mov edx, 2
call fcn.004041ac
lea eax, [ebp - 0x160]
mov edx, dword [0x4060e4]
call fcn.00404a40
lea eax, [ebp - 8]
call fcn.00404188
ret
Function at 0x413ed0
Capabilities:
Create process on windows
Self delete
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x413ed8
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4140b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
call fcn.00404188
lea edx, [ebp - 0x20]
mov al, 1
call fcn.0040cf6c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov ecx, 0x4140d0
call fcn.00404478
lea eax, [ebp - 0x18]
mov edx, 0x4140e8
call fcn.00404220
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404220
lea eax, [ebp - 0x10]
call fcn.0040cde8
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040cdf8
cmp byte [ebp - 1], 0
je 0x413faa
push 0
push 0
xor ecx, ecx
mov edx, 0x4140f4
mov eax, dword [ebp - 8]
call fcn.004130a0
lea eax, [ebp - 0x18]
call fcn.00404188
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00407388
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.00404220
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.00407388
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00404220
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
call fcn.00407388
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
call fcn.00404220
mov eax, dword [ebp - 8]
call fcn.0040716c
push dword [ebp - 0x1c]
push 0x414104
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004044ec
push dword [ebp - 0x1c]
push 0x414120
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004044ec
push dword [ebp - 0x1c]
push 0x414130
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push 0x414144
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004044ec
test bl, bl
je 0x414036
push dword [ebp - 0x1c]
push 0x414158
push dword [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004044ec
push dword [ebp - 0x1c]
push 0x414120
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x18]
push 0x414114
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.004044ec
lea edx, [ebp - 0x30]
xor eax, eax
call fcn.0040cf6c
mov eax, dword [ebp - 0x30]
call fcn.0040462c
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
cmp dword [ebp - 0x1c], 0
je 0x414088
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.004130a0
cmp dword [ebp - 0x1c], 0
je 0x41409e
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4140c0
lea eax, [ebp - 0x30]
mov edx, 0xb
call fcn.004041ac
ret
Function at 0x41415c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x414317
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x4142ea
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00406b70
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x414330
call fcn.00404478
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
add al, 0xbf
sub al, 0x1a
jae 0x4142e0
mov eax, dword [ebp - 0x10]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4142e0
push 0x41433c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
call fcn.00404354
push dword [ebp - 0x1c]
push 0x41434c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004044ec
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 0x10]
call fcn.0040462c
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x427db8]
mov edx, 0x414358
call fcn.00404848
mov edx, dword [ebp - 0x10]
call fcn.00404848
mov dl, 0x20
call fcn.00402fb0
call fcn.00404d84
call fcn.004030b0
cmp ebx, 0xffffffff
jne 0x414285
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x427db8]
mov edx, 0x41436c
call fcn.00404848
mov edx, dword [ebp - 0x10]
call fcn.00404848
mov dl, 0x20
call fcn.00402fb0
call fcn.00404d84
call fcn.004030b0
cmp ebx, 0xffffffff
je 0x4142e0
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0x2d4808
push ebx
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4142f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41431e
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004041ac
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x414f64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x4150f7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004028c4
mov eax, 0x1869f
call fcn.00402d4c
mov edx, dword [ebp - 8]
call fcn.00406c48
mov eax, dword [ebp - 4]
call fcn.0040442c
mov ebx, eax
test ebx, ebx
jle 0x414fcf
mov esi, 1
lea eax, [ebp - 4]
call fcn.00404684
sub byte [eax + esi - 1], 0x32
inc esi
dec ebx
jne 0x414fbe
lea eax, [ebp - 0x10]
call fcn.00404188
lea eax, [ebp - 0x18]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
call fcn.0040d78c
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00404354
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404434
lea eax, [ebp - 4]
mov ecx, 2
mov edx, 1
call fcn.004046cc
cmp dword [ebp - 4], 0
jne 0x414fd7
mov eax, dword [ebp - 0x10]
call fcn.0040442c
mov edi, eax
cmp edi, 4
jle 0x4150d4
mov eax, dword [ebp - 0x10]
mov al, byte [eax + edi - 2]
mov byte [ebp - 0xa], al
xor eax, eax
mov ebx, edi
test ebx, ebx
jle 0x41505e
mov esi, 1
mov edx, edi
dec edx
cmp esi, edx
je 0x41505a
mov edx, dword [ebp - 0x10]
add al, byte [edx + esi - 1]
inc esi
dec ebx
jne 0x41504c
cmp al, byte [ebp - 0xa]
jne 0x4150d4
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + edi - 1]
xor al, dl
mov byte [ebp - 9], al
mov ebx, edi
dec ebx
sub ebx, 2
jl 0x41509c
inc ebx
mov esi, 2
lea eax, [ebp - 0x10]
call fcn.00404684
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + esi - 1]
xor dl, byte [ebp - 9]
mov byte [eax + esi - 1], dl
inc esi
dec ebx
jne 0x415082
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + 2]
mov esi, eax
and esi, 0xff
add esi, 3
inc esi
and eax, 0xff
sub edi, eax
xor eax, eax
mov al, dl
sub edi, eax
sub edi, 4
mov eax, dword [ebp - 8]
push eax
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.0040468c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4150fe
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041ac
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x415108
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x4151d5
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x41513f
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00406dc0
mov esi, eax
push 0
push 0
xor edx, edx
mov eax, esi
call fcn.00412d9c
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
cmp byte [ebp - 5], 0x4d
jne 0x4151b2
cmp byte [ebp - 6], 0x5a
jne 0x4151b2
push 0
push pe_nt_image_headers32
xor edx, edx
mov eax, esi
call fcn.00412d9c
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e3c
cmp byte [ebp - 5], 0x50
jne 0x4151b2
cmp byte [ebp - 6], 0x45
jne 0x4151b2
mov bl, 1
cmp dword [ebp - 4], 0
je 0x4151bf
mov eax, esi
call fcn.00406e94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4151dc
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x415388
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41540c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040468c
mov eax, dword [ebp - 0x18]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x4153ee
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415413
lea eax, [ebp - 0x18]
call fcn.00404188
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x419c08
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x419c93
mov ebx, 1
mov eax, esi
xor edx, edx
push edx
push eax
push 0
push 0x10000
call fcn.0040b384
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.00404684
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x419c60
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.0040bf18
cmp ebp, 0xffffffff
je 0x419c7f
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x419c21
mov eax, dword [edi]
call fcn.0040442c
cmp ebx, eax
jle 0x419c93
mov eax, dword [edi]
call fcn.0040442c
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41aac4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x41aca5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x427ca0], 0
jne 0x41ac73
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402d2c
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404354
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x41acbc
call fcn.00404478
mov eax, dword [ebp - 0x18]
call fcn.0040462c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x41abdc
lea eax, [ebp - 0x10]
mov ecx, 0x41acc8
mov edx, dword [ebp - 0x18]
call fcn.00404478
mov eax, dword [ebp - 0x10]
call fcn.00406f14
test al, al
je 0x41ab90
push dword [ebp - 0x10]
push 0x41acd8
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.0040b464
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.004044ec
mov eax, dword [ebp - 0x10]
call fcn.00406f38
lea eax, [ebp - 0x14]
mov ecx, 0x41ace8
mov edx, dword [ebp - 0x10]
call fcn.00404478
push 0
push 0
xor ecx, ecx
mov edx, 0x41acfc
mov eax, dword [ebp - 0x14]
call fcn.004130a0
mov eax, dword [ebp - 0x14]
call fcn.00406f04
test al, al
je 0x41abd2
mov eax, dword [ebp - 0x10]
call fcn.00413448
fstp qword [esi]
wait
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.00413cb8
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x41ab15
lea edx, [ebp - 0x60]
mov al, 1
call fcn.0040cf6c
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00406b70
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x41ac2b
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x41ac13
cmp dl, byte [ebp - 9]
je 0x41ac73
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.00404354
mov edx, dword [ebp - 0x64]
mov eax, 0x427ca0
mov ecx, 0x41ad08
call fcn.00404478
mov eax, dword [0x427ca0]
call fcn.00406f14
test al, al
je 0x41ac73
mov eax, 0x427ca0
mov edx, 0x41acd8
call fcn.00404434
cmp dword [0x427ca0], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41acac
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004041ac
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041ac
ret
Function at 0x41ef84
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41f005
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.0040cd0c
test al, al
je 0x41efc0
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041e5f8
jmp 0x41efcb
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041e314
test eax, eax
je 0x41efef
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f00c
lea eax, [ebp - 4]
call fcn.00404188
ret

Function at 0x41f608
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040461c
xor eax, eax
push ebp
push 0x41f695
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402d2c
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], si
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040462c
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x41f67f
mov ebx, dword [ebp - 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41f69c
lea eax, [ebp - 4]
call fcn.00404188
ret
Function at 0x422f28
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x423022
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x423038
call fcn.00414508
mov eax, dword [0x427e50]
cmp dword [eax], 0
jg 0x422ffd
lea eax, [ebp - 0xc]
call fcn.0041bc78
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x423064
call fcn.00404478
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0040728c
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x427df4]
mov eax, dword [eax]
call fcn.00415a2c
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.004044ec
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x42308c
call fcn.00404478
mov eax, dword [ebp - 0x1c]
call fcn.00414508
push 0
mov eax, dword [ebp - 8]
call fcn.0040462c
push eax
call sub.kernel32.dll_WinExec
xor edx, edx
mov eax, 0x3e8
call fcn.0040bf50
mov eax, 0x4230a4
call fcn.00414508
push 0
push 0
push 2
mov eax, dword [0x427d8c]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x4230c8
call fcn.00414508
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423029
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.004041ac
ret
Function at 0x423f50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4240e9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0040cde8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x414ea4]
call fcn.00415688
call fcn.00415dfc
mov dword [ebp - 0xc], eax
mov ebx, 0x46
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x423fa3
add ebx, 0x34
mov esi, 0x14
mov edi, 0x154
mov dword [ebp - 8], 0x12
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x428660]
push eax
push 0
mov edx, 0x4240f8
mov eax, 0x4240fc
mov ecx, 0x50000000
call fcn.00405d74
mov edx, dword [0x427ecc]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov dword [ebp - 8], 0xd
push 0x50000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x428660]
push eax
push 0
mov edx, 0x424104
xor ecx, ecx
xor eax, eax
call fcn.00405d1c
mov edx, dword [0x427e0c]
mov dword [edx], eax
mov ebx, 0x1a0
mov eax, dword [ebp - 0xc]
add eax, 0xffffff4f
sub eax, 2
jae 0x424042
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x2e
mov dword [ebp - 8], 0xd
push 0x40000000
push ebx
push esi
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x428660]
push eax
push 0
mov edx, 0x424104
xor ecx, ecx
xor eax, eax
call fcn.00405d1c
mov edx, dword [0x427dac]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x427ddc]
mov dword [edx], eax
push 0x424118
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x427ecc]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4240f0
lea eax, [ebp - 0x10]
call fcn.00404188
ret