joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d834
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
xor edx, edx
push 3
lea eax, [edi + 2]
pop ebx
div ebx
mov ecx, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [ecx], eax
jae 0x1000d85e
push 6
mov dword [ecx], eax
pop eax
jmp 0x1000d940
xor edx, edx
push 3
mov eax, edi
pop ebx
div ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x1000d8dd
dec eax
push ebx
pop edi
div edi
mov edi, eax
inc edi
mov edx, edi
imul edx, edx, 3
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + 0x33714a8]
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + 0x33714a8]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + 0x33714a8]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + 0x33714a8]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec edi
jne 0x1000d880
mov edi, dword [ebp + 8]
cmp edx, edi
jae 0x1000d933
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x1000d8ef
movzx esi, byte [esi + 1]
jmp 0x1000d8f1
xor esi, esi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + 0x33714a8]
mov byte [ecx], bl
shl eax, 4
mov ebx, esi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + 0x33714a8]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, edi
jae 0x1000d929
and esi, 0xf
movsx eax, byte [esi*4 + 0x33714a8]
jmp 0x1000d92c
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000f1b5
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x1000f3fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x337a478]
mov ebx, eax
push edi
mov eax, esi
call fcn.100101ae
test eax, eax
jne 0x1000f4fc
mov ecx, dword [0x337a47c]
cmp ecx, 1
jl 0x1000f4f9
cmp ecx, 0x80
jg 0x1000f4f9
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x1000f4f9
test cl, 3
jne 0x1000f4f9
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x337e728]
test edx, edx
je 0x1000f472
push 0x337a500
push 0x337a480
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x1000f4fc
cmp dword [ebp + 0xc], 0
je 0x1000f4f5
mov edi, 0x337a480
jmp 0x1000f485
mov esi, dword [0x337a478]
xor edx, edx
test ecx, ecx
jle 0x1000f4ac
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x337a480]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x337a47c]
jl 0x1000f490
mov esi, dword [0x337a478]
imul esi, esi, 0x60
push 0x337a500
push ebx
push edi
call dword [esi + 0x337e70c]
add esp, 0xc
test eax, eax
jne 0x1000f4fc
mov ecx, dword [0x337a47c]
xor edx, edx
test ecx, ecx
jle 0x1000f4eb
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x337a480]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x337a47c]
add edx, 4
cmp edx, ecx
jl 0x1000f4d3
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x1000f47f
xor eax, eax
jmp 0x1000f4fc
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000f83b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x3373628]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x337b5a0]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.100101ae
test eax, eax
jne 0x1000f948
mov ecx, dword [0x337b5a4]
cmp ecx, 1
jl 0x1000f945
cmp ecx, 0x80
jg 0x1000f945
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1000f945
test cl, 3
jne 0x1000f945
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x337e72c]
test ecx, ecx
je 0x1000f8c6
push 0x337b628
push 0x337b5a8
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x1000f948
cmp dword [ebp + 8], 0
je 0x1000f941
jmp 0x1000f8d4
mov esi, dword [0x337b5a0]
imul esi, esi, 0x60
push 0x337b628
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x337e710]
add esp, 0xc
test eax, eax
jne 0x1000f948
mov eax, dword [0x337b5a4]
xor edi, edi
test eax, eax
jle 0x1000f931
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x337b5a8
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x337b5a8]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x337b5a4]
add edi, 4
cmp edi, eax
jl 0x1000f90d
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x1000f8ce
xor eax, eax
jmp 0x1000f948
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001eb2e
leave
ret
Function at 0x10010895
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.10010785
test eax, eax
jne 0x100109d5
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x337f7f8]
push dword [esi + 0x337f7fc]
mov dword [ebp - 8], edi
call fcn.10017001
push edi
mov dword [ebp - 4], eax
call fcn.10017001
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x100109c6
test edi, edi
je 0x100109bd
push edi
push ebx
call dword [esi + 0x337f84c]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1001099b
cmp dword [esi + 0x337f7fc], eax
jbe 0x10010921
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x337f7fc]
jb 0x10010906
push ebx
call dword [esi + 0x337f844]
mov edi, eax
pop ecx
test edi, edi
jne 0x1001099b
push dword [esi + 0x337f7fc]
push dword [ebp - 4]
push ebx
call dword [esi + 0x337f848]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1001099b
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x337f848]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1001099b
push dword [ebp - 4]
push ebx
call dword [esi + 0x337f84c]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1001099b
cmp dword [ebp - 8], ecx
jbe 0x10010994
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x10010994
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1001097d
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.10016f24
push dword [ebp - 0xc]
call fcn.10016f24
push dword [ebp - 4]
call fcn.10016f24
add esp, 0xc
mov eax, edi
jmp 0x100109d4
push dword [ebp - 4]
call fcn.10016f24
pop ecx
test edi, edi
je 0x100109d1
push edi
call fcn.10016f24
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x100109d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.10010785
test eax, eax
jne 0x10010a13
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x337f7f8]
push dword [esi + 0x337f7fc]
mov dword [ebp - 4], eax
call fcn.10017001
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x10010a16
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x337f7fc]
call fcn.10017001
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x10010a3c
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.10016f24
pop ecx
mov eax, ebx
jmp 0x10010a12
mov ecx, dword [esi + 0x337f7fc]
cmp ecx, 0x10
jae 0x10010a84
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x337d780
mov eax, ebx
call fcn.1000fa9b
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x10010b04
mov eax, dword [esi + 0x337f7fc]
cmp dword [ebp - 4], eax
jae 0x10010ab4
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x10010aac
push 0x10
push 0x337d780
push eax
call fcn.1001db30
mov eax, dword [esi + 0x337f7fc]
add esp, 0xc
cmp eax, 0x10
jbe 0x10010ab4
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.10010752
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x337f7fc], eax
jbe 0x10010ad9
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x337f7fc]
jb 0x10010abe
push edi
call dword [esi + 0x337f844]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x10010b04
push dword [esi + 0x337f7fc]
push dword [ebp - 8]
push edi
call dword [esi + 0x337f848]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10010a2f
push dword [edi + 0xe8]
call fcn.10016f24
pop ecx
jmp 0x10010a2f
Function at 0x40103d
Capabilities:
Terminate process

Disassembly:
push esi
call fcn.004010c6
mov esi, eax
jmp loc.00404000

Function at 0x4010c6
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
mov dword [0x40301c], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
jne 0x4010fd
xor eax, eax
jmp 0x4011a9
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esi], 0x22
jne 0x401124
inc esi
mov dword [0x40301c], esi
mov al, byte [esi]
cmp al, bl
je 0x40111e
cmp al, 0x22
je 0x40111e
inc esi
jmp 0x401111
cmp byte [esi], bl
jne 0x40113f
jmp 0x4010f6
mov dword [0x40301c], esi
mov al, byte [esi]
cmp al, bl
je 0x40113b
cmp al, 0x20
je 0x40113b
cmp al, 9
je 0x40113b
inc esi
jmp 0x40112a
cmp byte [esi], bl
je 0x401142
mov byte [esi], bl
inc esi
push 1
mov ecx, 0x403020
pop eax
mov dl, byte [esi]
cmp dl, bl
je 0x401155
cmp dl, 0x20
je 0x40115a
cmp dl, 9
jne 0x40115d
inc esi
jmp 0x40114a
mov dl, byte [esi]
cmp dl, bl
je 0x4011a9
cmp dl, 0x22
jne 0x40117f
inc esi
inc eax
mov dword [ecx], esi
add ecx, 4
mov dword [ecx], ebx
mov dl, byte [esi]
cmp dl, bl
je 0x40119a
cmp dl, 0x22
je 0x40119a
inc esi
jmp 0x401171
mov dword [ecx], esi
inc eax
add ecx, 4
mov dword [ecx], ebx
mov dl, byte [esi]
cmp dl, bl
je 0x40119a
cmp dl, 0x20
je 0x40119a
cmp dl, 9
je 0x40119a
inc esi
jmp 0x401187
cmp byte [esi], bl
je 0x4011a9
mov byte [esi], bl
inc esi
cmp ecx, 0x40321c
jl 0x40114a
pop edi
pop esi
pop ebx
ret

Function at 0x401205
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push ebx
push edi
xor ebx, ebx
push ebx
push 2
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x22c
mov edi, eax
lea eax, [ebp - 0x230]
push ebx
push eax
call fcn.00401580
add esp, 0xc
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x401273
push str.explorer.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x401279
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40124f
jmp 0x40127f
mov ebx, dword [ebp - 0x228]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x40129b
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x401430
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401511
push 0x5c
lea ecx, [ebp - 0x220]
push ecx
call fcn.00407a00
add esp, 8
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
je 0x401511
mov dword [ebp - 0x240], 0x47aff0
mov edx, dword [ebp - 0x224]
add edx, 2
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x240]
mov dx, word [ecx]
mov word [ebp - 0x24a], dx
mov eax, dword [ebp - 0x244]
mov cx, word [ebp - 0x24a]
mov word [eax], cx
mov edx, dword [ebp - 0x240]
add edx, 2
mov dword [ebp - 0x240], edx
mov eax, dword [ebp - 0x244]
add eax, 2
mov dword [ebp - 0x244], eax
cmp word [ebp - 0x24a], 0
jne 0x4014b9
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x401525
push str.DBGHELP.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 8], 0
je 0x401612
push str.MiniDumpWriteDump
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
je 0x401612
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0xffffffff
je 0x401612
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], 0
push 0
push 0
lea edx, [ebp - 0x23c]
push edx
push 1
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x228]
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jne 0x401605
push 0
push 0
lea ecx, [ebp - 0x23c]
push ecx
push 0
mov edx, dword [ebp - 0x22c]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x228]
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x404700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x404c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x404cb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x404a40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46de98
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x487b30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004054a0
lea ecx, [ebp + 8]
call fcn.00419850
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0x47c80c
lea ecx, [ebp + 8]
call fcn.00405420
test eax, eax
jl 0x404ab9
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443840
mov eax, dword [ebp - 0x1c]
jmp 0x404c32
push 0
push str.mfcaptureengine.dll
lea ecx, [ebp + 8]
call fcn.00405420
test eax, eax
jl 0x404aea
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443840
mov eax, dword [ebp - 0x20]
jmp 0x404c32
mov dword [ebp - 0x10], 0
jmp 0x404afc
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x14
call fcn.0042bb20
cmp dword [ebp - 0x10], eax
jae 0x404b51
push 0
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x14
call fcn.00405720
mov ecx, eax
call fcn.00419850
push eax
lea ecx, [ebp + 8]
call fcn.00405420
test eax, eax
jl 0x404b4f
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443840
mov eax, dword [ebp - 0x24]
jmp 0x404c32
jmp 0x404af3
mov dword [ebp - 0x14], 0
jmp 0x404b63
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x34]
add ecx, 0x2c
call fcn.0042bb20
cmp dword [ebp - 0x14], eax
jae 0x404bb5
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x2c
call fcn.00405720
mov ecx, eax
call fcn.00419850
push eax
lea ecx, [ebp + 8]
call fcn.00405420
test eax, eax
jl 0x404bb3
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443840
mov eax, dword [ebp - 0x28]
jmp 0x404c32
jmp 0x404b5a
mov dword [ebp - 0x18], 0
jmp 0x404bc7
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x44
call fcn.0042bb20
cmp dword [ebp - 0x18], eax
jae 0x404c19
push 0
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x34]
add ecx, 0x44
call fcn.00405720
mov ecx, eax
call fcn.00419850
push eax
lea ecx, [ebp + 8]
call fcn.00405420
test eax, eax
jl 0x404c17
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443840
mov eax, dword [ebp - 0x2c]
jmp 0x404c32
jmp 0x404bbe
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00443840
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x404d10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa028
call fcn.0045a1f0
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xa018], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa014], eax
mov dword [ebp - 8], 0xc8
mov dword [ebp - 4], 0
mov ecx, dword [0x47c854]
mov dword [ebp - 0xa010], ecx
push 0x9ffc
push 0
lea edx, [ebp - 0xa00c]
push edx
call fcn.00459420
add esp, 0xc
mov eax, 1
test eax, eax
je 0x404e0c
lea ecx, [ebp - 0xa010]
push ecx
push 0x5000
push 0xd
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0xa010]
mov dword [ebp - 0xa01c], eax
mov ecx, dword [ebp - 0xa01c]
add ecx, 2
mov dword [ebp - 0xa020], ecx
mov edx, dword [ebp - 0xa01c]
mov ax, word [edx]
mov word [ebp - 0xa022], ax
add dword [ebp - 0xa01c], 2
cmp word [ebp - 0xa022], 0
jne 0x404daa
mov ecx, dword [ebp - 0xa01c]
sub ecx, dword [ebp - 0xa020]
sar ecx, 1
mov dword [ebp - 0xa028], ecx
je 0x404de3
jmp 0x404e0c
mov edx, dword [ebp - 4]
add edx, 0xc8
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xa014]
jbe 0x404dfc
jmp 0x404e0c
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404d6a
lea ecx, [ebp - 0xa010]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004052f0
mov edx, dword [ebp - 0xa018]
or edx, 1
mov dword [ebp - 0xa018], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0045670b
mov esp, ebp
pop ebp
ret
Function at 0x40c9d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push 0x47ac48
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40ca0c
lea ecx, [ebp - 4]
push ecx
push str.SoftwarePassword_Protect_Video_MasterDT_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push 8
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x40caa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3b8
mov eax, dword [0x487b30]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x3a0], ecx
push 0
push 0
push 0xf0
push 0x3ec
lea eax, [ebp - 0x39c]
push eax
mov ecx, dword [ebp - 0x3a0]
add ecx, 4
call fcn.0040fa80
mov ecx, eax
call fcn.0040fa30
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 0
lea ecx, [ebp - 0x214]
push ecx
push 0x2001f
push 0
push 0x47acf8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40cb40
lea edx, [ebp - 0x214]
push edx
push 0x47ad48
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x40cb40
jmp 0x40ccb9
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov cx, word [0x47ad98]
mov word [ebp - 0x398], cx
push 0x17e
push 0
lea edx, [ebp - 0x396]
push edx
call fcn.00459420
add esp, 0xc
cmp dword [ebp - 0x218], 0
je 0x40cbd0
mov eax, dword [ebp - 0x3a0]
cmp dword [eax + 0xf8], 0
je 0x40cbb1
push 0xc0
lea ecx, [ebp - 0x398]
push ecx
push 0x3eb
mov ecx, dword [ebp - 0x3a0]
add ecx, 4
call fcn.0040f980
jmp 0x40cbd0
push 0xc0
lea edx, [ebp - 0x398]
push edx
push 0x3f0
mov ecx, dword [ebp - 0x3a0]
add ecx, 4
call fcn.0040f980
mov eax, dword [ebp - 0x3a0]
cmp dword [eax + 0xf8], 0
je 0x40cc29
lea ecx, [ebp - 0x210]
add ecx, 0xfffffffe
mov dword [ebp - 0x3a4], ecx
mov edx, dword [ebp - 0x3a4]
mov ax, word [edx + 2]
mov word [ebp - 0x3a6], ax
add dword [ebp - 0x3a4], 2
cmp word [ebp - 0x3a6], 0
jne 0x40cbee
mov edi, dword [ebp - 0x3a4]
mov ecx, dword [0x47ad9c]
mov dword [edi], ecx
mov dx, word [0x47ada0]
mov word [edi + 4], dx
lea eax, [ebp - 0x398]
mov dword [ebp - 0x3ac], eax
mov ecx, dword [ebp - 0x3ac]
add ecx, 2
mov dword [ebp - 0x3b0], ecx
mov edx, dword [ebp - 0x3ac]
mov ax, word [edx]
mov word [ebp - 0x3b2], ax
add dword [ebp - 0x3ac], 2
cmp word [ebp - 0x3b2], 0
jne 0x40cc44
mov ecx, dword [ebp - 0x3ac]
sub ecx, dword [ebp - 0x3b0]
sar ecx, 1
mov dword [ebp - 0x3b8], ecx
mov edx, dword [ebp - 0x3b8]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x398]
push ecx
push 1
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x214], 0
je 0x40ccb9
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045670b
mov esp, ebp
pop ebp
ret