joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415930
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x4a63b0]
add eax, 4
imul eax, eax, 0xe8
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push eax
call fcn.00485279
xor ebx, ebx
add esp, 4
mov dword [0x4a88e0], eax
cmp eax, ebx
jne 0x415963
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
mov esi, dword [0x4a6440]
push 0x403910
mov edi, eax
push 0x4ef6d80
mov ecx, 0x3a
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4a9d20]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push 0xe
push ecx
mov dword [0x4a6440], eax
call edi
cmp dword [ebp], ebx
jne 0x4159a4
mov dword [esp + 0x14], 1
jmp 0x415a4e
mov edx, dword [0x4a6440]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [edx + 0xc8], bl
call esi
mov ecx, dword [0x4a6440]
mov dword [ecx + 0xb8], eax
mov dword [ecx + 0xbc], 0x64
cmp byte [0x4a9e74], bl
jne 0x4159f2
mov eax, dword [0x4a9d20]
push 0x403810
push 0x64
push 0xb
push eax
call edi
test eax, eax
setne cl
mov byte [0x4a9e74], cl
mov byte [ebp + 0x601], 1
call esi
mov ecx, dword [ebp]
push ebx
mov esi, 1
add dword [0x4a9e8c], esi
push ebx
push esi
mov dword [ebp + 0x61c], eax
mov dword [ebp + 0x618], eax
call fcn.004250d0
sub dword [0x4a9e8c], esi
mov dword [esp + 0x14], eax
cmp byte [0x4a9e74], bl
je 0x415a48
mov edx, dword [0x4a9d20]
push 0xb
push edx
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x415a48
mov byte [0x4a9e74], bl
mov byte [ebp + 0x601], bl
mov eax, dword [0x4a6440]
cmp dword [eax + 0xdc], ebx
lea ecx, [eax + 0xdc]
je 0x415a7a
mov eax, dword [eax + 0xe0]
push eax
push ecx
call fcn.0042ea30
mov dword [esp + 0x1c], eax
mov eax, dword [0x4a6440]
add esp, 8
push 1
push ebx
mov byte [eax + 0xc8], 1
mov esi, eax
push 0xffffffffffffffff
mov dword [eax + 0x94], ebx
mov dword [eax + 0x98], ebx
mov dword [eax + 0x9c], ebx
mov dword [eax + 0xa0], ebx
mov dword [eax + 0xa4], ebx
mov byte [eax + 0xd4], bl
mov dword [eax + 0x28], ebx
mov dword [eax + 0x4c], ebx
mov byte [eax + 0xc4], bl
mov dword [eax + 0x48], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0xdc], ebx
mov byte [eax + 0xe4], bl
mov ecx, 0x3a
mov edi, 0x4a89d0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4aa51c]
push 0x49887c
push ecx
mov byte [eax + 0xc8], 1
mov dword [eax + 0xbc], ebx
mov word [eax + 0xc9], 1
mov dword [eax + 0x2c], CreateStatusWindowA
call fcn.00474fa0
mov edx, dword [0x4a7554]
cmp word [edx], bx
jne 0x415b59
cmp dword [0x4ab61c], ebx
jne 0x415b59
cmp dword [0x4a9e50], ebx
jne 0x415b59
cmp dword [0x4a9e54], ebx
jne 0x415b59
cmp byte [0x4a9e70], bl
jne 0x415b59
mov edx, dword [esp + 0x14]
neg edx
sbb edx, edx
push ebx
and edx, 7
add edx, 2
push 0x4abd80
xor eax, eax
call fcn.00415ba0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x415f60
Capabilities:
Set current directory

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x5e8]
xor ebx, ebx
mov byte [edi + 0x174], 1
mov word [edi + 0x600], 0
cmp eax, ebx
je 0x41616e
cmp byte [eax], bl
je 0x41616e
cmp dword [0x4abce0], ebx
jne 0x415fa7
call fcn.0046f870
mov dword [0x4abce0], eax
cmp eax, ebx
je 0x415ff3
mov ecx, dword [0x4abce4]
cmp dword [ecx + 8], 0x14
jae 0x415fc5
call fcn.0046f870
mov ecx, dword [0x4abce4]
mov dword [ecx + 0xc], eax
cmp eax, ebx
je 0x415ff3
mov eax, dword [ecx + 4]
add dword [ecx + 8], 0xffffffec
lea edx, [eax + 0x14]
mov dword [0x4abce8], eax
mov dword [ecx + 4], edx
cmp eax, ebx
je 0x415ff3
mov dword [eax], vtable.Label.0
mov dword [eax + 4], 0x498831
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
jmp 0x415ff5
xor eax, eax
mov dword [edi + 0x374], eax
cmp eax, ebx
je 0x41616e
mov ecx, 0x49a750
cmp byte [0x4a9e43], bl
jne 0x416016
mov ecx, dword [edi + 0x5e8]
push edi
call fcn.004162c0
cmp eax, 1
jne 0x41616e
push ebx
push ebx
push ebx
push 0x68
push edi
call fcn.0041bff0
test eax, eax
je 0x41616e
mov eax, dword [edi]
push edi
call fcn.00422660
test eax, eax
je 0x41616e
mov eax, dword [edi]
mov esi, edi
call fcn.00422720
cmp dword [edi + 8], ebx
je 0x41606b
mov ecx, dword [edi]
mov eax, dword [edi + 0xc]
mov dword [eax + 0x14], ecx
mov edx, dword [edi]
mov eax, dword [edi + 0xc]
mov dword [edx + 0x10], eax
mov ecx, dword [edi + 8]
mov dword [edi], ecx
cmp dword [edi + 0x1c], ebx
jle 0x41609e
mov edx, dword [edi + 0x18]
mov ebp, dword [edx + ebx*4]
cmp byte [ebp + 0x3d], 0
jne 0x416096
mov eax, dword [ebp + 0x1c]
push ebp
lea esi, [ebp + 0x28]
push edi
call fcn.0042ef40
mov eax, dword [ebp + 0x20]
push ebp
lea esi, [ebp + 0x30]
push edi
call fcn.0042ef40
inc ebx
cmp ebx, dword [edi + 0x1c]
jl 0x416070
xor ebx, ebx
cmp dword [edi + 0x160], ebx
je 0x4160c7
call fcn.0041f0a0
test eax, eax
je 0x41616e
mov eax, dword [edi + 0x160]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [edi + 0x160], ebx
mov eax, dword [0x4aa624]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
inc dword [edi + 0x170]
push ebx
push ebx
push ebx
push 0x68
push edi
call fcn.0041bff0
test eax, eax
je 0x41616e
push ebx
push ebx
push ebx
push 0x68
push edi
call fcn.0041bff0
test eax, eax
je 0x41616e
mov ecx, dword [edi + 0x374]
mov edx, dword [edi + 4]
push ebx
push ebx
mov dword [ecx + 8], edx
mov eax, dword [edi]
push ebx
push eax
mov ecx, edi
call fcn.00422780
test eax, eax
je 0x41616e
mov ecx, dword [edi]
push ecx
push edi
call fcn.00422a90
test eax, eax
je 0x41616e
push 3
push ebx
push str.ErrorLevel
mov ecx, edi
call fcn.00420b10
mov dword [0x4aa51c], eax
cmp eax, ebx
je 0x41616e
push 1
push ebx
push 0xffffffffffffffff
push 0x49887c
push eax
call fcn.00474fa0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x10]
call fcn.00412670
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
Function at 0x41be20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x4a6367]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov dword [esp + 0x1e], 0x7b3f2e
mov edi, ebp
test ebp, ebp
je 0x41be8a
mov dl, byte [ebp]
test dl, dl
je 0x41be8a
lea ecx, [ecx]
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x41bede
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x41be76
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x41be70
mov eax, ebp
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41be90
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x41beb0
mov al, byte [edi]
cmp al, 0x20
je 0x41beab
cmp al, 9
jne 0x41beb0
dec edi
cmp edi, ebp
ja 0x41bea1
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x41bee5
cmp byte [esp + 0x30], 0
je 0x41bed3
mov ecx, dword [esp + 0x28]
push ebp
push 0x49a9fc
call fcn.0042e860
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x41beb0
dec edi
jmp 0x41be9d
push esi
push ebp
push ebx
call fcn.00488060
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x42b680
Capabilities:
Check for time delay via gettickcount
Set current directory

Disassembly:
mov eax, dword [0x4a9e8c]
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
cmp eax, dword [0x4a63b0]
jl 0x42b6a9
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
mov esi, dword [0x4aa51c]
cmp byte [esi + 0x17], 0
jne 0x42b6b8
mov esi, dword [esi + 0xc]
test byte [esi + 0x15], 8
je 0x42b6c5
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x42b6de
test byte [esi + 0x15], 4
je 0x42b6d9
mov eax, esi
call fcn.0042ede0
mov eax, dword [esi + 8]
jmp 0x42b6ee
cmp al, 2
jne 0x42b6e9
call fcn.00401000
jmp 0x42b6ee
mov eax, 0x4ab626
push 0x7f
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00488060
mov eax, dword [0x4a6440]
inc dword [0x4a9e8c]
add eax, 0xe8
mov edi, eax
mov byte [esp + 0xa3], 0
mov ecx, 0x3a
mov esi, 0x4a89d0
rep movsd dword es:[edi], dword [esi]
add esp, 0xc
mov esi, eax
xor ebx, ebx
mov dword [0x4a6440], eax
push ebx
mov eax, 0x4abd80
mov dword [esi + 0x2c], ebx
call fcn.00415830
mov dword [0x4ac388], ebx
mov dword [0x4ac38c], ebx
cmp dword [0x4a9ebc], ebx
je 0x42b75a
push 0x4aa520
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or eax, 0xffffffff
cmp byte [esi + 0xca], bl
jne 0x42b774
mov byte [esi + 0xca], 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x4ac394], ebx
je 0x42b78a
cmp dword [0x4ac390], ebx
jne 0x42b792
cmp byte [esi + 0xca], bl
je 0x42b7c4
mov byte [esi + 0xc8], bl
cmp byte [esi + 0xca], bl
jne 0x42b7c4
cmp dword [0x4ac394], ebx
jge 0x42b7b0
mov dword [esi + 0xbc], eax
jmp 0x42b7c4
call edi
mov dword [esi + 0xb8], eax
mov edx, dword [0x4ac394]
mov dword [esi + 0xbc], edx
mov eax, dword [0x4ac304]
mov ebx, dword [0x4ac308]
mov ecx, dword [0x4ac35c]
mov edx, dword [0x4ac360]
mov ebp, eax
mov dword [0x4ac308], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [0x4ac360], ecx
mov dword [0x4ac304], eax
call edi
mov esi, dword [esp + 0xa0]
mov ecx, dword [0x4a6440]
mov dword [0x4ac39c], eax
mov dword [0x4ac398], eax
mov dword [0x4ac35c], eax
mov dword [0x4ac0f0], esi
cmp byte [ecx + 0xd5], 0
je 0x42b85e
mov edx, dword [0x4abcc0]
mov dword [edx*4 + 0x4ab680], esi
call edi
mov ecx, dword [0x4abcc0]
mov dword [ecx*4 + 0x4a9628], eax
inc ecx
mov dword [0x4abcc0], ecx
cmp ecx, 0x190
jl 0x42b85e
mov dword [0x4abcc0], 0
push 0
push 0xffffffffffffffff
push 0
push esi
call fcn.004597f0
mov esi, eax
cmp esi, 1
jne 0x42b880
mov eax, dword [esp + 0xa0]
push eax
call fcn.00429dc0
mov esi, eax
mov ecx, dword [0x4a6440]
mov edx, dword [ecx + 0xa0]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [0x4a9eac], edx
lea edx, [esp + 0x18]
push edx
mov dword [0x4ac304], ebp
mov dword [0x4ac35c], eax
mov dword [0x4ac308], ebx
mov dword [0x4ac360], ecx
call fcn.004036c0
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret 8
Function at 0x42ecb0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2000
call fcn.004918e0
cmp dword [esp + 0x2008], 0
push ebx
push ebp
mov ebp, dword [esp + 0x2018]
mov ebx, ecx
je 0x42edcf
test ebx, ebx
jne 0x42ece8
mov eax, dword [esp + 0x200c]
mov ebx, dword [eax + 0x370]
test ebx, ebx
je 0x42ecf2
movzx ecx, word [ebx + 2]
movzx eax, word [ebx + 4]
jmp 0x42ecff
mov ecx, dword [eax + 0x16c]
movzx eax, word [eax + 0x170]
mov edx, dword [esp + 0x2014]
mov ecx, dword [ecx*4 + 0x4a9cb8]
push esi
push edi
push edx
movzx eax, ax
push eax
push ecx
push 0x49c6fc
mov esi, 0x2000
lea edi, [esp + 0x20]
call fcn.00472330
add esp, 0x10
cmp byte [ebp], 0
lea edi, [esp + eax + 0x10]
je 0x42ed4c
push ebp
lea esi, [esp + 0x2014]
push 0x49c52c
sub esi, edi
call fcn.00472330
add esp, 8
mov esi, dword [esp + 0x2018]
cmp esi, 3
jne 0x42ed7b
call fcn.00485787
add eax, 0x20
push eax
lea edx, [esp + 0x14]
push edx
call fcn.0048772f
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 2
jne 0x42edcd
test ebx, ebx
jne 0x42eda0
mov ecx, dword [esp + 0x2014]
mov ebx, dword [ecx + 0x370]
test ebx, ebx
je 0x42edbf
mov ecx, dword [esp + 0x201c]
push ebp
push 1
push ecx
mov ecx, ebx
call fcn.0042e5b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
mov edx, dword [esp + 0x201c]
push ebp
push edx
call fcn.0042e860
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2000
ret 0x10
Function at 0x42f0e0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x1fc
push ebx
push ebp
push esi
push edi
mov edi, eax
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x42f10f
push 0x64
lea ecx, [esp + 0xa4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42f117
mov byte [esp + 0xa0], 0
push 0x7f
lea edx, [esp + 0x25]
push ebp
push edx
mov byte [esp + 0x2c], 0
call fcn.0048e5e0
mov esi, dword [0x4ac340]
add esp, 0xc
cmp esi, ebp
je 0x42f17f
cmp byte [esi + 0x11], 0
je 0x42f178
mov eax, dword [esi]
push eax
call fcn.0046d9c0
add esp, 4
sub eax, ebp
je 0x42f15c
dec eax
je 0x42f155
mov eax, 0x49c108
jmp 0x42f161
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
jmp 0x42f161
mov edx, dword [esi]
mov eax, dword [edx + 4]
push eax
push 0x49c868
mov eax, 0x7d
lea ecx, [esp + 0x28]
call fcn.00472370
add esp, 8
mov esi, dword [esi + 0x14]
cmp esi, ebp
jne 0x42f136
cmp byte [esp + 0x20], 0
je 0x42f1cd
lea eax, [esp + 0x20]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42f190
sub eax, edx
cmp eax, 0x7b
jbe 0x42f1be
mov esi, 0x7f
sub esi, eax
push esi
lea ebx, [esp + eax + 0x24]
push 0x49a2b4
push ebx
call fcn.00488060
add esp, 0xc
mov byte [ebx + esi], 0
jmp 0x42f1cd
cmp byte [esp + eax + 0x1f], 0x20
lea eax, [esp + eax + 0x20]
jne 0x42f1cd
mov byte [eax - 1], 0
mov eax, dword [0x4a88e0]
cmp byte [eax + 0xd4], 0
je 0x42f1ec
cmp byte [0x4ac381], 0
mov dword [esp + 0x14], 1
je 0x42f1f0
mov dword [esp + 0x14], ebp
mov eax, dword [0x4a9e8c]
mov dword [esp + 0x10], 0x49c870
cmp eax, 1
jg 0x42f2fc
mov dword [esp + 0x10], 0x498831
mov dword [esp + 0x18], ebp
cmp dword [0x4a9e54], ebp
mov ebp, 0x499a00
je 0x42f224
mov ebp, 0x4999fc
cmp dword [0x4a9e50], 0
mov esi, 0x499a00
je 0x42f237
mov esi, 0x4999fc
push 1
call fcn.00411590
mov bl, al
add esp, 4
lea eax, [esp + 0x108]
call fcn.00411950
mov ecx, dword [0x4a9e88]
mov edx, dword [0x4a9e8c]
push eax
mov eax, dword [0x4a9e90]
sub eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
mov ecx, dword [0x4ac348]
push edx
mov edx, dword [0x4ac34c]
lea eax, [esp + 0x38]
push eax
push ecx
push edx
push ebp
push esi
lea eax, [esp + 0xcc]
push eax
push 0x49c8b0
mov esi, 0xfffe
call fcn.00472330
mov esi, dword [esp + 0x50]
add edi, eax
mov ecx, esi
sub ecx, edi
add esp, 0x34
add ecx, 0xfffe
push ecx
push edi
call fcn.004091c0
mov eax, edi
add esp, 8
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42f2c0
sub eax, ecx
add edi, eax
cmp dword [0x4aa62c], 0
mov eax, 0x49c434
jne 0x42f2de
mov eax, 0x49c964
sub esi, edi
push eax
add esi, 0xfffe
call fcn.00472330
add esp, 4
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1fc
ret
dec eax
mov dword [esp + 0x18], eax
jmp 0x42f212
Function at 0x4352a0
Capabilities:
Log keystrokes

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
mov eax, dword [esp + 0x28]
call fcn.00442ad0
mov edi, eax
test edi, edi
je 0x4352ce
mov esi, dword [esp + 0x1c]
push edi
call fcn.004769b0
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
jne 0x435319
mov ecx, dword [0x4a6440]
cmp byte [ecx + 0xe4], 0
jne 0x4352fc
mov edx, dword [0x4aa51c]
push 1
push 0
push 0xffffffffffffffff
push 0x499ee0
push edx
call fcn.00474fa0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [esp + 0x18]
push 0x498831
push 0
push 0x499ee0
call fcn.0042e2f0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
push 0
push edi
xor bl, bl
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
test ebp, ebp
je 0x435351
cmp ebp, dword [0x4abd28]
je 0x435351
mov esi, edi
call fcn.00476e70
test al, al
jne 0x435351
mov eax, dword [0x4abd28]
push 1
push ebp
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x43538f
mov edx, dword [0x4aa51c]
push 1
push 0
push 0xffffffffffffffff
push 0x49887c
push edx
call fcn.00474fa0
mov eax, dword [0x4a6440]
mov eax, dword [eax + 0x58]
cmp eax, 0xffffffff
jle 0x43538f
push 1
push eax
call fcn.00401290
add esp, 8
test bl, bl
je 0x4353a3
mov ecx, dword [0x4abd28]
push 0
push ebp
push ecx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0x10
Function at 0x4361d0
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.00430560
mov ebx, eax
test ebx, ebx
jne 0x436203
mov ecx, dword [ebp + 8]
push esi
push eax
push 0x49ac80
call fcn.0042e5b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebx - 1]
cmp eax, 4
ja case.default.0x43620f
jmp dword [eax*4 + 0x436408]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x436229
push eax
call fcn.00453310
add esp, 4
jmp 0x43622f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x18
push 0
push eax
mov eax, dword [0x4aa51c]
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00453310
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4362a7
push ebx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4362a7
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
neg esi
sbb esi, esi
and esi, ebx
mov eax, dword [0x4aa51c]
push 0x18
push 0
push esi
call fcn.004010d0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [0x4aa51c]
push 1
push 0
push 0xffffffffffffffff
push 0x49887c
push ecx
call fcn.00474fa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movsx edx, byte [edi]
push edx
call fcn.00487905
add eax, 0xffffffbf
add esp, 4
cmp eax, 0x11
ja case.0x4362e2.67
movzx eax, byte [eax + 0x436438]
jmp dword [eax*4 + 0x43641c]
mov esi, 0x40
jmp 0x436311
mov esi, 0x4000
jmp 0x436311
mov esi, 0x20
jmp 0x436311
mov esi, 0x8000
jmp 0x436311
mov esi, 0x80
jmp 0x436311
mov esi, 0x100
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x436324
push eax
call fcn.00453310
add esp, 4
jmp 0x43632a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
test ebx, ebx
je 0x4362a7
push ebx
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x4362a7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x43627b
mov edx, dword [0x4aa51c]
push 1
push 0
push 0xffffffffffffffff
push 0x49887c
push edx
call fcn.00474fa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [edi], 0
je 0x4363a3
mov esi, edi
mov byte [esp + 0x13], 0
call fcn.00412c80
fmul qword [0x4a08d8]
call fcn.00493ad0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x14], eax
jmp 0x4363b0
mov byte [esp + 0x13], 1
xor edi, edi
lea ebx, [ebx]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00453310
add esp, 4
mov esi, eax
cmp ebx, 4
jne 0x4363cd
test esi, esi
jne 0x43628a
jmp 0x4363d1
test esi, esi
je case.0x4362e2.67
cmp byte [esp + 0x13], 0
jne 0x4363ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x43628a
push 1
push 0x64
call fcn.00401290
add esp, 8
jmp 0x4363b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x436c60
Capabilities:
Get graphical window text
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [0x4a9c68]
push eax
mov eax, dword [esp + 0x18]
call fcn.00442ad0
mov ebp, eax
test ebp, ebp
je 0x436c86
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ebx, [eax + 1]
jmp 0x436c8b
mov ebx, 1
push 1
push 0
lea ecx, [ebx - 1]
push ecx
push 0
push edi
call fcn.00474fa0
cmp eax, 1
je 0x436ca9
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
test ebp, ebp
je 0x436db2
cmp byte [edi + 0x17], 0
jne 0x436cbc
mov esi, dword [edi + 0xc]
jmp 0x436cbe
mov esi, edi
test byte [esi + 0x15], 8
je 0x436ccb
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436ce4
test byte [esi + 0x15], 4
je 0x436cdf
mov eax, esi
call fcn.0042ede0
mov eax, dword [esi + 8]
jmp 0x436cf4
cmp al, 2
jne 0x436cef
call fcn.00401000
jmp 0x436cf4
mov eax, 0x4ab626
push ebx
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [edi + 0x17], 0
mov ebx, eax
jne 0x436d0a
mov esi, dword [edi + 0xc]
jmp 0x436d0c
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x436d24
test byte [esi + 0x15], 8
je 0x436d1f
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x436d29
mov eax, 0x4ac590
mov dword [eax], ebx
cmp byte [edi + 0x17], 0
jne 0x436d36
mov esi, dword [edi + 0xc]
jmp 0x436d38
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x436d50
test byte [esi + 0x15], 8
je 0x436d4b
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x436d55
mov eax, 0x4ac590
cmp dword [eax], 0
jne 0x436e28
cmp byte [edi + 0x17], 0
jne 0x436d69
mov esi, dword [edi + 0xc]
jmp 0x436d6b
mov esi, edi
test byte [esi + 0x15], 8
je 0x436d78
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436d97
test byte [esi + 0x15], 4
je 0x436d8c
mov eax, esi
call fcn.0042ede0
mov eax, dword [esi + 8]
mov byte [eax], 0
jmp 0x436e28
cmp al, 2
jne 0x436da8
call fcn.00401000
mov byte [eax], 0
jmp 0x436e28
mov eax, 0x4ab626
mov byte [eax], 0
jmp 0x436e28
cmp byte [edi + 0x17], 0
jne 0x436dbd
mov esi, dword [edi + 0xc]
jmp 0x436dbf
mov esi, edi
test byte [esi + 0x15], 8
je 0x436dcc
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x436de5
test byte [esi + 0x15], 4
je 0x436de0
mov eax, esi
call fcn.0042ede0
mov eax, dword [esi + 8]
jmp 0x436df5
cmp al, 2
jne 0x436df0
call fcn.00401000
jmp 0x436df5
mov eax, 0x4ab626
mov byte [eax], 0
cmp byte [edi + 0x17], 0
jne 0x436e03
mov esi, dword [edi + 0xc]
jmp 0x436e05
mov esi, edi
cmp byte [esi + 0x17], 1
jne 0x436e1d
test byte [esi + 0x15], 8
je 0x436e18
mov eax, esi
call fcn.00401150
lea eax, [esi + 0xc]
jmp 0x436e22
mov eax, 0x4ac590
mov dword [eax], 0
cmp byte [edi + 0x17], 0
jne 0x436e31
mov edi, dword [edi + 0xc]
cmp byte [edi + 0x17], 2
jne 0x436e56
cmp dword [0x4ac3ec], 0
je 0x436e56
pop edi
pop esi
pop ebp
pop ebx
mov dword [esp + 4], 1
mov ecx, 0x4ac3e0
jmp fcn.00404420
and byte [edi + 0x15], 0x86
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x437c80
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x8000
call fcn.004918e0
push ebp
mov ebp, dword [0x4a9c68]
push esi
push edi
push 0x7fff
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, eax
cmp edi, 0x7fff
jb 0x437daa
push 1
push 1
lea ecx, [edi - 1]
push ecx
push 0
push ebp
call fcn.00474fa0
test eax, eax
jne 0x437cd0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
cmp byte [ebp + 0x17], 0
jne 0x437cdb
mov esi, dword [ebp + 0xc]
jmp 0x437cdd
mov esi, ebp
test byte [esi + 0x15], 8
je 0x437cea
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x437d03
test byte [esi + 0x15], 4
je 0x437cfe
mov eax, esi
call fcn.0042ede0
mov eax, dword [esi + 8]
jmp 0x437d13
cmp al, 2
jne 0x437d0e
call fcn.00401000
jmp 0x437d13
mov eax, 0x4ab626
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x437d65
cmp byte [ebp + 0x17], al
jne 0x437d2a
mov esi, dword [ebp + 0xc]
jmp 0x437d2c
mov esi, ebp
test byte [esi + 0x15], 8
je 0x437d39
mov eax, esi
call fcn.00401150
mov al, byte [esi + 0x17]
cmp al, 1
jne 0x437d52
test byte [esi + 0x15], 4
je 0x437d4d
mov eax, esi
call fcn.0042ede0
mov eax, dword [esi + 8]
jmp 0x437d62
cmp al, 2
jne 0x437d5d
call fcn.00401000
jmp 0x437d62
mov eax, 0x4ab626
mov byte [eax], 0
cmp byte [ebp + 0x17], 0
jne 0x437d70
mov eax, dword [ebp + 0xc]
jmp 0x437d72
mov eax, ebp
cmp byte [eax + 0x17], 2
jne 0x437d97
cmp dword [0x4ac3ec], 0
je 0x437d97
push 1
mov ecx, 0x4ac3e0
call fcn.00404420
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
and byte [eax + 0x15], 0x86
mov eax, 1
pop edi
pop esi
pop ebp
add esp, 0x8000
ret
lea eax, [esp + 0xc]
test edi, edi
jne 0x437db7
mov eax, 0x498831
push 1
push 0
push edi
push eax
push ebp
call fcn.00474fa0
pop edi
pop esi
pop ebp
add esp, 0x8000
ret