joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3b580
call fcn.00403360
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x3b558], 0
push eax
push eax
push eax
mov word [ebp - 0x3b544], ax
lea eax, [ebp - 0x3b554]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x3b558]
mov dword [ebp - 0x3b554], 0x10001
push eax
mov dword [ebp - 0x3b550], 0x1fa4
mov dword [ebp - 0x3b54c], 0x1fa4
mov dword [ebp - 0x3b548], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0x3b538
lea eax, [ebp - 0x3b540]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x3b57c], edx
nop dword [eax + eax]
mov ecx, edx
mov eax, edx
shr eax, 0xb
mov esi, edx
shr ecx, 0xd
not esi
and cl, al
mov dword [ebp - 0x3b580], esi
movsx ecx, cl
mov eax, esi
shr eax, 9
and al, 3
movsx eax, al
imul ecx, eax
movsx eax, dl
and edx, 0x6000
or edx, 0x8000
shr edx, 0xd
movsx ebx, cl
mov ecx, esi
imul ebx, eax
mov eax, dword [ebp - 0x3b57c]
shr eax, 1
imul edx, eax
shr ecx, 0xb
and ecx, 1
add bl, bl
shr edx, cl
xor bl, dl
mov edx, dword [ebp - 0x3b57c]
mov ecx, edx
mov eax, edx
shr ecx, 0xd
and bl, 0x7f
shr eax, 0xb
and cl, al
mov eax, esi
shr eax, 9
and al, 3
movsx ecx, cl
movsx eax, al
imul ecx, eax
movsx eax, dl
movsx ecx, cl
imul ecx, eax
add cl, cl
xor bl, cl
mov byte [ebp + edx - 0x3b540], bl
inc edx
mov dword [ebp - 0x3b57c], edx
cmp edx, 0x3b538
jb 0x401d60
lea eax, [ebp - 0x3b540]
mov dword [ebp - 0x3b574], 0x3b538
mov dword [ebp - 0x3b578], eax
lea eax, [ebp - 0x3b578]
push 0x20
push eax
push dword [ebp - 0x3b558]
mov dword [ebp - 0x3b570], 0
mov dword [ebp - 0x3b56c], 0
mov dword [ebp - 0x3b568], 0
mov dword [ebp - 0x3b564], 0
mov dword [ebp - 0x3b560], 0
mov dword [ebp - 0x3b55c], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0x3b578]
push eax
push dword [ebp - 0x3b558]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0x3b578]
push eax
push dword [ebp - 0x3b558]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0x3b558]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040275c
mov esp, ebp
pop ebp
ret
Function at 0x402010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xea640
call fcn.00403360
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xea620], 0
push eax
push eax
push eax
mov word [ebp - 0xea60c], ax
lea eax, [ebp - 0xea61c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xea620]
mov dword [ebp - 0xea61c], 0x10001
push eax
mov dword [ebp - 0xea618], 0x7d00
mov dword [ebp - 0xea614], 0x7d00
mov dword [ebp - 0xea610], 0x80001
call dword [sym.imp.WINMM.dll_waveOutOpen]
push 0xea600
lea eax, [ebp - 0xea608]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
mov cl, al
mov edx, eax
xor cl, 0x3f
shr edx, 5
or dl, cl
mov cl, al
shl cl, 2
or dl, cl
mov ecx, eax
shr ecx, 0xb
and dl, cl
movsx ecx, dl
imul ecx, ecx, 0x64
mov byte [ebp + eax - 0xea608], cl
inc eax
cmp eax, 0xea600
jb 0x402093
lea eax, [ebp - 0xea608]
mov dword [ebp - 0xea63c], 0xea600
mov dword [ebp - 0xea640], eax
lea eax, [ebp - 0xea640]
push 0x20
push eax
push dword [ebp - 0xea620]
mov dword [ebp - 0xea638], 0
mov dword [ebp - 0xea634], 0
mov dword [ebp - 0xea630], 0
mov dword [ebp - 0xea62c], 0
mov dword [ebp - 0xea628], 0
mov dword [ebp - 0xea624], 0
call dword [sym.imp.WINMM.dll_waveOutPrepareHeader]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutWrite]
push 0x20
lea eax, [ebp - 0xea640]
push eax
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutUnprepareHeader]
push dword [ebp - 0xea620]
call dword [sym.imp.WINMM.dll_waveOutClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040275c
mov esp, ebp
pop ebp
ret
Function at 0x4024e0
Capabilities:
Create thread
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 4
push 0x404178
push str.Run_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x402511
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push section..text
push 0
push 0
call ebx
call fcn.00401850
push 0x7530
call edi
push 0xc8
call edi
push 0
push 0
push 0
push 0x401180
push 0
push 0
call ebx
mov esi, eax
call fcn.004019b0
push 0x7530
call edi
push 0x12c
call edi
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4011e0
push 0
push 0
call eax
mov esi, eax
call fcn.004019b0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call edi
push esi
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4012f0
push 0
push 0
call esi
mov edi, eax
call fcn.00401b60
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push section..text
push 0
push 0
call esi
push 0x2710
mov esi, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push esi
call edi
push esi
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4013b0
push 0
push 0
call eax
mov esi, eax
call fcn.00401cd0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call edi
push esi
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00401eb0
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call edi
push esi
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x4014e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00402010
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call edi
push esi
call ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0
push 0x401600
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
call fcn.00402170
push 0x7530
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push esi
call edi
push esi
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x4017b0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0x4012f0
push 0
push 0
call ebx
call fcn.00402320
push 0x7530
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401490
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40159a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401593
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x401593
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40158c
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push eax
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401585
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0
push edx
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jl 0x401585
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401585
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push 0x681640
push 0
push ebx
push eax
call dword [sym.imp.OLEPRO32.DLL_OleLoadPicture]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jl 0x40159a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40159a
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 8
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x404960
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x652aab
push eax
mov dword fs:[0], esp
sub esp, 0x218
lea eax, [esp + 0x114]
push ebx
push ebp
push esi
push edi
push eax
mov esi, ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor ebp, ebp
cmp eax, ebp
jne 0x4049ad
lea ecx, [esp + 0x124]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, eax
call fcn.004a2f50
mov eax, dword [esp + 0x10]
mov dword [esp + 0x230], ebp
cmp eax, ebp
mov dword [esp + 0x14], ebp
je 0x4049d9
add eax, 0xc
jmp 0x4049de
mov eax, 0x7427d8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x20]
push ecx
push edx
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, ebp
jne 0x404a0d
mov ebx, dword [esp + 0x238]
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00499cd0
jmp 0x404a2f
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x238]
lea edx, [esp + 0x124]
push ecx
push edx
push 0x6e54a0
push ebx
call fcn.0049a7c0
add esp, 0x10
mov edi, 0x6e549c
mov eax, edi
mov dword [esp + 0x18], edi
test eax, eax
je 0x404a4e
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
jmp 0x404a52
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x18]
push ebp
push ecx
mov ecx, ebx
call fcn.0049aa90
cmp eax, ebp
jle 0x404a6c
push ebp
push eax
mov ecx, ebx
call fcn.0049acd0
mov eax, dword [ebx]
cmp eax, ebp
lea edi, [eax + 0xc]
jne 0x404a7a
mov edi, 0x7427d8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x6e5494
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x20]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00499c60
lea ecx, [esp + 0x10]
mov dword [esp + 0x230], 0xffffffff
call fcn.00499a60
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 4
Function at 0x404b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x652adf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x6e8700]
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x30]
mov edi, 1
mov dword [esp + 0x24], edi
mov ecx, dword [ebp]
mov eax, dword [ecx - 8]
cmp eax, esi
mov dword [esp + 0x10], eax
jle 0x404c5a
push ebx
mov ebx, 2
mov edx, dword [ebp]
cmp byte [edx + esi], 0x25
je 0x404b87
mov eax, esi
inc esi
inc edi
lea ecx, [esp + 0x10]
mov dl, byte [edx + eax]
inc ebx
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
push eax
call fcn.00628c17
jmp 0x404c4f
xor al, al
xor cl, cl
cmp edi, dword [esp + 0x14]
jge 0x404b95
mov al, byte [edx + esi + 1]
cmp ebx, dword [esp + 0x14]
jge 0x404b9f
mov cl, byte [edx + esi + 2]
cmp al, 0x61
jl 0x404ba9
cmp al, 0x7a
jg 0x404ba9
add al, 0xe0
cmp cl, 0x61
jl 0x404bb6
cmp cl, 0x7a
jg 0x404bb6
add cl, 0xe0
cmp al, 0x30
jl 0x404bbe
cmp al, 0x39
jle 0x404bc6
cmp al, 0x41
jl 0x404c41
cmp al, 0x5a
jg 0x404c41
cmp al, 0x30
jl 0x404bd2
cmp al, 0x39
jg 0x404bd2
sub al, 0x30
jmp 0x404bd4
sub al, 0x37
cmp cl, 0x30
mov byte [esp + 0x34], al
jl 0x404be2
cmp cl, 0x39
jle 0x404bec
cmp cl, 0x41
jl 0x404c28
cmp cl, 0x5a
jg 0x404c28
shl al, 4
cmp cl, 0x30
mov dl, al
jl 0x404c03
cmp cl, 0x39
jg 0x404c03
movsx eax, cl
sub eax, 0x30
jmp 0x404c09
movsx eax, cl
sub eax, 0x37
add dl, al
mov byte [esp + 0x34], dl
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x14]
call fcn.00628c17
add esi, 3
add edi, 3
add ebx, 3
jmp 0x404c4f
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push edx
call fcn.00628c17
add esi, 2
add edi, 2
add ebx, 2
jmp 0x404c4f
push 0x25
lea ecx, [esp + 0x14]
call fcn.00628c17
inc esi
inc edi
inc ebx
cmp esi, dword [esp + 0x14]
jl 0x404b5f
pop ebx
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00628589
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.00628814
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x40cb30
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push eax
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.0040b7a0
mov ecx, dword [ebx + 0x98]
mov eax, dword [eax]
test ecx, ecx
mov dword [esp + 0xc], eax
jne 0x40cb69
push eax
mov ecx, ebx
call fcn.0040b840
test eax, eax
jne 0x40cc7e
mov eax, dword [0x742a38]
push esi
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, 4
jne 0x40cba3
mov dword [0x742a38], 3
call fcn.00642d98
call fcn.00642d98
mov eax, dword [eax + 0xc]
push 0x84
push eax
call edi
push eax
call esi
mov eax, dword [0x742a50]
cmp eax, 3
jne 0x40cc05
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x40cbf2
mov dword [0x742a38], 2
call fcn.00642d98
call fcn.00642d98
mov eax, dword [eax + 0xc]
push 0x87
push eax
call edi
push eax
call esi
mov eax, dword [0x742a38]
cmp eax, 1
jne 0x40cc44
mov ecx, ebx
call fcn.00408ed0
jmp 0x40cc50
mov ecx, ebx
mov dword [0x742a38], 1
call fcn.00408ed0
jmp 0x40cc50
cmp eax, 4
jne 0x40cbdf
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
mov dl, ah
test dl, dl
je 0x40cc38
mov dword [0x742a38], 1
call fcn.00642d98
call fcn.00642d98
mov eax, dword [eax + 0xc]
push 0x86
jmp 0x40cbd9
mov dword [0x742a38], 2
jmp 0x40cc49
cmp eax, 2
jne 0x40cc50
mov ecx, ebx
call fcn.00408f20
mov eax, dword [esp + 0x14]
xor ecx, ecx
pop edi
cmp eax, ecx
mov dword [ebx + 0x98], ecx
pop esi
je 0x40cc78
push eax
mov ecx, ebx
mov dword [ebx + 0x94], 1
call fcn.0040b620
pop ebx
ret 0xc
mov dword [ebx + 0x94], ecx
pop ebx
ret 0xc

Function at 0x40ef50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65340b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x14]
mov dword [esi], 0x67259c
mov ecx, ebx
call fcn.00623663
mov dword [ebx], 0x672590
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
xor edi, edi
push 0xffffffffffffffff
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x10], ecx
push edi
mov ecx, ebx
mov dword [esp + 0x30], edi
mov dword [esi], 0x6724d4
mov dword [esi + 4], eax
call fcn.00623e29
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov edx, dword [0x742a38]
push esi
mov dword [esi + 0x40], edx
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x3c], edi
call fcn.0055ae40
mov ecx, eax
call fcn.0055af00
mov eax, edi
mov ecx, edi
mov dword [esi + 0x48], eax
mov edx, edi
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x50], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x40ef69
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x65340b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea ebx, [esi + 0x14]
mov dword [esi], 0x67259c
mov ecx, ebx
call fcn.00623663
mov dword [ebx], 0x672590
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
xor edi, edi
push 0xffffffffffffffff
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x10], ecx
push edi
mov ecx, ebx
mov dword [esp + 0x30], edi
mov dword [esi], 0x6724d4
mov dword [esi + 4], eax
call fcn.00623e29
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov edx, dword [0x742a38]
push esi
mov dword [esi + 0x40], edx
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x3c], edi
call fcn.0055ae40
mov ecx, eax
call fcn.0055af00
mov eax, edi
mov ecx, edi
mov dword [esi + 0x48], eax
mov edx, edi
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x50], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
mov dword [esi + 0x54], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x413230
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x653a78
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, ecx
push esi
call fcn.00413150
test eax, eax
je 0x41333e
push ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x67b334
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
sub eax, ebx
sub ecx, edx
push eax
push ecx
push 0
push 0
mov dword [esp + 0x34], 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esp + 0x10]
call fcn.0062d806
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.0062d21e
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.GDI32.dll_SetViewportOrgEx]
neg ecx
push 0
push ecx
neg edx
push edx
push eax
call ebx
mov ecx, dword [esp + 0x34]
mov eax, dword [edi + 4]
push eax
mov edx, dword [ecx]
call dword [edx + 0x110]
mov ecx, dword [edi + 4]
push 0
push 0
push 0
push ecx
call ebx
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 0xcc0020
mov ecx, dword [esi]
push 0
push 0
push edx
mov edx, dword [esi + 0xc]
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x48]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [esp + 0xc]
call fcn.0062d85d
mov dword [esp + 0xc], 0x67b26c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call fcn.0062d85d
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 8]
call fcn.0062cc19
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], 2
push ecx
lea ecx, [esp + 0xc]
call fcn.0062ccd0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [ecx]
call dword [edx + 0x110]
lea ecx, [esp + 8]
call fcn.0062cd07
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.0062cd4e
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x414400
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x3c
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
jne 0x41441e
mov ecx, dword [0x742984]
mov eax, 0xe8cd
sub eax, ecx
mov ecx, dword [esp + 0x58]
mov dword [ebx + 0xbc], eax
test ecx, ecx
mov ebp, 0x40002810
je 0x414436
mov ebp, 0x50002810
push eax
xor ecx, ecx
sub esp, 0x10
xor edx, edx
mov eax, esp
xor esi, esi
push ebp
push 0x8800
mov dword [eax], ecx
mov ecx, dword [esp + 0x6c]
xor edi, edi
push ecx
mov dword [eax + 4], edx
mov ecx, ebx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
call fcn.00643954
test eax, eax
jne 0x41446f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
mov edx, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x31
push edx
call ebp
push eax
call fcn.0062d7f1
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
push 0x3c
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edi, 0x6e5be0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], 0xd
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0xa8]
mov ecx, esi
call fcn.0062d85d
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, esi
call fcn.0062d806
test esi, esi
je 0x4144ed
mov esi, dword [esi + 4]
mov edx, dword [ebx + 0x1c]
push 1
push esi
push 0x30
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret 0xc
Function at 0x4153e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x653dde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4
push ebx
push ebp
mov ebp, ecx
push esi
xor ebx, ebx
push edi
lea ecx, [esp + 0x48]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
xor esi, esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call fcn.00634584
lea eax, [esp + 0x10]
mov dword [esp + 0xdc], ebx
push eax
push 1
push ebx
push 0x6e5be8
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415566
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
push ebx
push edx
push ebx
push 0x7427d8
push eax
call edi
test eax, eax
jne 0x415566
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x415566
push eax
call fcn.006247b3
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push esi
push edx
push ebx
push 0x7427d8
push eax
call edi
test eax, eax
jne 0x415566
cmp esi, ebx
je 0x415566
push 0x400
lea ecx, [esp + 0x24]
call fcn.00634d90
mov ecx, dword [esp + 0x14]
mov byte [esp + 0xdc], 1
push ecx
push esi
lea ecx, [esp + 0x28]
call fcn.00634f76
mov edx, dword [esp + 0x20]
push ebx
push ebx
lea ecx, [esp + 0x28]
call dword [edx + 0x28]
push ebx
push 0x1000
lea eax, [esp + 0x28]
push 1
push eax
lea ecx, [esp + 0xa0]
call fcn.0062dbb8
lea ecx, [esp + 0x90]
mov byte [esp + 0xdc], 2
push ecx
lea ecx, [esp + 0x4c]
call fcn.00634678
lea ecx, [esp + 0x90]
mov dword [esp + 0x18], 1
mov byte [esp + 0xdc], 1
call fcn.0062dc94
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc], bl
call fcn.00634e18
mov edi, dword [esp + 0xe4]
lea edx, [esp + 0x48]
push edx
push edi
mov ecx, ebp
call fcn.00415390
test eax, eax
je 0x415562
lea eax, [esp + 0x48]
mov ecx, ebp
push eax
push edi
call fcn.004157d0
jmp 0x415566
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x415575
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x415582
push esi
call fcn.006247dc
add esp, 4
lea ecx, [esp + 0x48]
mov dword [esp + 0xdc], 0xffffffff
call fcn.00634617
mov ecx, dword [esp + 0xd4]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xd0
ret 4