joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fcf
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x4e8
cmp dword [0x41858c], 1
jne 0x404fe6
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
push ebx
push ebp
push esi
push edi
push 9
push 6
pop ebp
mov ebx, str._ni_d__j_d_n
push ebp
push ebx
call fcn.00408453
push 0x12
mov esi, str._nx_d__y_d_n
push ebp
push esi
call fcn.00408453
and dword [esp + 0x28], 0
push 9
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
add esp, 0x30
lea eax, [esp + 0x10]
mov ecx, 0x418528
push eax
call fcn.00407c20
push 9
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
fldz
xor eax, eax
lea edi, [esp + 0x3c]
fstp qword [esp + 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 9
pop edi
push edi
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
add esp, 0x30
lea eax, [esp + 0x1c]
mov ecx, 0x418528
push 0
push eax
call fcn.00407773
push edi
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
fld qword [esp + 0x34]
add esp, 0x18
call fcn.00408af4
and dword [esp + 0x18], 0
push eax
mov eax, dword [esp + 0x14]
push ecx
mov dword [esp + 0x1c], eax
push ecx
fild qword [esp + 0x20]
fmul qword [0x412228]
fstp qword [esp]
push str._.fKb_bps_d__
lea eax, [esp + 0x108]
push eax
call fcn.004082b3
push edi
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
push edi
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
add esp, 0x44
mov dword [esp + 0x2c], 0xa
push edi
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
lea eax, [esp + 0x110]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.00408bd0
push edi
push ebp
push ebx
call fcn.00408453
push 0x12
push ebp
push esi
call fcn.00408453
add esp, 0x38
lea eax, [esp + 0x2c]
push 0
push 0x18
push eax
push dword [0x418574]
call dword [sym.imp.WS2_32.dll_send]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4e8
ret

Function at 0x40578b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ax, word [0x418568]
push esi
push eax
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_htons]
push 0x418554
mov word [ebp - 0xe], ax
call fcn.0040260a
pop ecx
mov dword [ebp - 0xc], eax
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4057e3
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
jmp 0x4057e5
mov eax, esi
pop esi
leave
ret
Function at 0x4066b8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push str.33333333333333333333333333333333333333
push 0x414100
call fcn.00408f00
pop ecx
cmp eax, 1
pop ecx
jne 0x4066f1
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.shutdown__s__t_5
call fcn.00408e60
pop ecx
push 0
call fcn.00408d6d
push esi
push edi
call fcn.0040679f
push 9
mov edi, str._ni_d__j_d_n
test eax, eax
push 6
push edi
je 0x406753
call fcn.00408453
push 0x12
mov esi, str._nx_d__y_d_n
push 6
push esi
call fcn.00408453
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push 9
push 6
push edi
mov dword [ebp - 0x10], str.Fghijkl_Nopqrs
mov dword [ebp - 0xc], 0x4061ea
call fcn.00408453
push 0x12
push 6
push esi
call fcn.00408453
add esp, 0x30
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x406797
call fcn.00408453
push 0x12
mov esi, str._nx_d__y_d_n
push 6
push esi
call fcn.00408453
push str.Fghi_Klmnopq_Stuabcdefg_I
push str.Fghijk_Mnopqrs_Uabcdef_Hijk
push str.Fghijkl_Nopqrs
call fcn.00406903
push 9
push 6
push edi
call fcn.00408453
push 0x12
push 6
push esi
call fcn.00408453
add esp, 0x3c
call fcn.004046a2
pop edi
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x40679f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
and byte [ebp - 0x12c], 0
push ebx
push esi
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 9
push 6
stosb byte es:[edi], al
pop ebx
mov edi, str._ni_d__j_d_n
push ebx
push edi
call fcn.00408453
push 0x12
mov esi, str._nx_d__y_d_n
push ebx
push esi
call fcn.00408453
and byte [ebp - 2], 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x12c]
push eax
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x59
mov byte [ebp - 0x22], 0x53
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0x4d
mov byte [ebp - 0x1e], 0x5c
mov byte [ebp - 0x1d], 0x43
mov byte [ebp - 0x1c], 0x75
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x43
mov byte [ebp - 0x15], 0x6f
mov byte [ebp - 0x14], 0x6e
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x6c
mov byte [ebp - 0xf], 0x53
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x74
mov byte [ebp - 0xc], 0x5c
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x72
mov byte [ebp - 8], 0x76
mov byte [ebp - 7], 0x69
mov byte [ebp - 6], 0x63
mov byte [ebp - 5], 0x65
mov byte [ebp - 4], 0x73
mov byte [ebp - 3], 0x5c
call fcn.00408bd0
push 9
push ebx
push edi
call fcn.00408453
push 0x12
push ebx
push esi
call fcn.00408453
lea eax, [ebp - 0x12c]
push str.Fghijkl_Nopqrs
push eax
call fcn.00408be0
add esp, 0x40
push 9
push ebx
push edi
call fcn.00408453
push 0x12
push ebx
push esi
call fcn.00408453
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
push 0xf003f
lea eax, [ebp - 0x12c]
push 0
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4068fc
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 9
push ebx
push edi
call fcn.00408453
push 0x12
push ebx
push esi
call fcn.00408453
add esp, 0x18
push 1
pop eax
jmp 0x4068fe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407c20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
xor ebx, ebx
push 1
mov edi, ecx
xor esi, esi
push eax
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], ebx
call sub.iphlpapi.dll_GetIfTable
cmp eax, 0x32
je 0x407c6f
cmp eax, 0x7a
jne 0x407c5f
push dword [ebp - 0xc]
call fcn.00409031
pop ecx
mov dword [ebp - 4], eax
mov esi, eax
lea eax, [ebp - 0xc]
push 1
push eax
push esi
call sub.iphlpapi.dll_GetIfTable
test eax, eax
je 0x407c76
xor al, al
jmp 0x407d40
xor edx, edx
xor eax, eax
cmp dword [esi], ebx
jbe 0x407cc4
add esi, 4
mov dword [ebp - 8], esi
mov esi, dword [ebp - 8]
mov ecx, 0xd7
lea edi, [ebp - 0x36c]
add dword [ebp - 8], 0x35c
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x144]
mov esi, dword [ebp - 0x12c]
mov dword [eax*4 + 0x4185b8], ecx
add edx, ecx
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x4185cc], esi
add ebx, esi
inc eax
cmp eax, dword [ecx]
jb 0x407c84
mov edi, dword [ebp - 0x10]
mov ecx, dword [0x4185a8]
mov esi, dword [0x4185ac]
mov eax, edx
sub eax, ecx
mov dword [0x4185b0], eax
mov eax, ebx
sub eax, esi
test ecx, ecx
mov dword [0x4185b4], eax
ja 0x407ced
and dword [0x4185b0], 0
test esi, esi
ja 0x407cf8
xor eax, eax
mov dword [0x4185b4], eax
mov esi, dword [ebp + 8]
mov dword [0x4185a8], edx
mov dword [0x4185ac], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi], eax
cmp dword [edi + 0x24], 0
je 0x407d1b
and dword [edi + 0x24], 0
jmp 0x407d30
call ebx
mov ecx, eax
mov eax, dword [esi]
sub ecx, dword [edi + 0x20]
imul eax, eax, 0x3e8
xor edx, edx
div ecx
mov dword [esi], eax
call ebx
push dword [ebp - 4]
mov dword [edi + 0x20], eax
call fcn.00408205
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40b5a9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b5c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040f5f7
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40b5ea
test byte [esp + 8], 2
je 0x40b5ea
mov dword [0x418608], 0xd
mov dword [0x41860c], 5
jmp 0x40b5c5
xor eax, eax
ret
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1002aaee
pop dword [ebp - 8]
mov eax, 0x7222f0a2
sub eax, 0x622045b4
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x71d7ef7f
add dword [ebp - 0x18], 0xdc7a55cc
mov dword [ebp - 0x14], 0xe00a3503
sub dword [ebp - 0x14], 0xadd6e8be
mov dword [ebp - 0x10], 0x9ed69578
sub dword [ebp - 0x10], 0x528a514a
mov dword [ebp - 0xc], 0xa7ae90c8
add dword [ebp - 0xc], 0x58516f38
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xf5962f84
add dword [ebp - 0x18], 0x7edc39d2
mov dword [ebp - 0x14], 0x227b93e4
sub dword [ebp - 0x14], 0xe10f326f
mov dword [ebp - 0x10], 0x79b49cde
sub dword [ebp - 0x10], 0x16453072
mov dword [ebp - 0xc], 0xa57c8415
add dword [ebp - 0xc], 0x5a837beb
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push memset
push 0
call eax
mov ecx, 0xc77b0c62
sub ecx, 0xc77ad1f2
mov edi, eax
mov esi, 0x3b706467
add esi, 0xd4933199
add esi, dword [ebp - 8]
mov ebx, 0xf63929b8
sub ebx, 0x9ffe0646
sub dword [ebp - 4], ebx
mov edx, dword [esi]
add dword [ebp - 4], 0x6d2d3509
xor edx, ebx
xor dword [ebp - 4], 0xc832a504
mov dword [edi], edx
sub dword [ebp - 4], ebx
add edi, 0xb030ef77
sub edi, 0xb030ef73
add esi, 0x858a28a8
sub esi, 0x858a28a4
loop 0x1002ac06
add eax, 0xf9ddf561
sub eax, 0xf9dd18ce
xor ebx, ebx
add ebx, eax
add eax, 0xe82c11c7
add eax, 0x17d3ee3e
mov ecx, 0x35d911eb
add ecx, 0xda26ee15
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401300
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4952bd
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x4a4e60
lea ecx, [ebp - 0x60]
call fcn.00476bb0
push 0
lea ecx, [ebp - 0x60]
mov dword [ebp - 4], 0
call fcn.00477210
xor edi, edi
cmp dword [str.Options], edi
je 0x40140f
mov ecx, 0x4b0198
xor esi, esi
nop dword [eax]
mov eax, dword [esi + 0x4b01a8]
dec eax
cmp eax, 5
ja case.0x401370.4
jmp dword [eax*4 + 0x4014dc]
push dword [esi + 0x4b01ac]
push dword [esi + 0x4b01a0]
push dword [esi + 0x4b019c]
push dword [ecx]
lea ecx, [ebp - 0x60]
call fcn.00477720
jmp case.0x401370.4
push dword [esi + 0x4b01ac]
push dword [esi + 0x4b01a0]
push dword [esi + 0x4b019c]
push dword [ecx]
lea ecx, [ebp - 0x60]
call fcn.00477760
jmp case.0x401370.4
push dword [esi + 0x4b01a4]
push dword [esi + 0x4b01ac]
push dword [esi + 0x4b01a0]
push dword [esi + 0x4b019c]
push dword [ecx]
lea ecx, [ebp - 0x60]
call fcn.004777a0
jmp case.0x401370.4
push dword [esi + 0x4b01ac]
push dword [esi + 0x4b019c]
push dword [ecx]
lea ecx, [ebp - 0x60]
call fcn.00476f70
mov ecx, dword [esi + 0x4b01a0]
mov dword [ecx], eax
inc edi
lea esi, [edi + edi*2]
shl esi, 3
cmp dword [esi + 0x4b0198], 0
lea ecx, [esi + 0x4b0198]
jne 0x401360
mov eax, dword [0x4b4de4]
cmp eax, 0x80000000
jne 0x401420
mov eax, 0xa0
push 0
push 0x14
and eax, 0x1a0
lea ecx, [ebp - 0x60]
or eax, 0x40
mov edx, 0x4b4e34
push str.File_u
push str.RecentFileList
mov dword [0x4b4de4], eax
call fcn.00401230
push 0x4a4e84
push 0xa
push 0x4a4e88
push str.RecentFileMasks
mov edx, 0x4b4e3c
lea ecx, [ebp - 0x60]
call fcn.00401230
mov eax, dword [0x4b4e44]
add esp, 0x20
cmp eax, 0xe
ja 0x40147d
cmp dword [eax*8 + 0x4b0d34], 0
jne 0x401487
mov dword [0x4b4e44], 6
push 0x20
lea eax, [ebp - 0x50]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [0x4b4e18], 0
mov ax, word [ebp - 0x50]
mov word [0x4b4de8], ax
jne 0x4014b7
mov dword [0x4b4e18], 0x12c
lea ecx, [ebp - 0x60]
call fcn.00476bf0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret

Function at 0x402b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, ecx
push esi
mov bl, 1
call edi
cmp eax, 0xffffffff
je 0x402b87
test al, 0x10
jne 0x402b8d
test bl, bl
je 0x402b87
push esi
call fcn.00401a80
cmp eax, esi
jbe 0x402b87
xor ecx, ecx
xor bl, bl
push esi
mov word [eax - 2], cx
call edi
cmp eax, 0xffffffff
jne 0x402b65
pop edi
pop esi
xor al, al
pop ebx
ret
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x407040
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
mov byte [ebp - 1], 0
push edi
mov edi, dword [ebx]
mov dword [ebp - 0xc], edi
mov eax, dword [edi + 8]
add eax, 0x10
push eax
push 0
push dword [0x4b3a28]
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x4071ef
push 0x1f4
push dword [ebx + 0x101c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4071e0
nop word [eax + eax]
mov eax, dword [0x4b4fa4]
test eax, eax
je 0x4071f8
test byte [eax + 0x40], 1
je 0x4071f8
test dword [ebx + 0x124c], 0x100
lea esi, [ebx + 0x124c]
mov eax, dword [ebx + 0x1230]
mov dword [ebp - 0x10], esi
jne 0x4070ef
push 0x203
push 3
push eax
call fcn.00416020
add esp, 0xc
cmp eax, 6
je 0x407102
cmp byte [ebp - 1], 0
je 0x407114
jmp 0x407106
push dword [ebx + 0x1248]
push 0x76
push 1
push eax
call fcn.00416020
add esp, 0x10
mov byte [ebp - 1], 1
push 3
push dword [ebx + 0x101c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [0x4b4fa4]
test eax, eax
je 0x407124
and dword [eax + 0x40], 0xfffffffe
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 8]
push 0x1f4
push dword [ebx + 0x1020]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40715c
push dword [ebp - 0x18]
push edi
push esi
call fcn.0047ef80
add esp, 0xc
mov dword [edi + 0xc], 0
push dword [ebx + 0x1020]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4071c4
add esi, 0x10
mov dword [ebp - 0x14], 0
lea edi, [eax + esi]
cmp esi, edi
jae 0x4071be
push 6
push str.ERROR:
push esi
call fcn.00485d00
add esp, 0xc
test eax, eax
je 0x407217
lea eax, [ebp - 0x14]
push eax
push 0
push esi
push dword [ebx + 0x1024]
call fcn.00437aa0
test al, al
je 0x4071b3
mov edx, esi
mov ecx, ebx
call fcn.00405890
push dword [ebp - 0x14]
call fcn.00437a40
mov al, byte [esi]
test al, al
je 0x40720e
inc esi
cmp esi, edi
jb 0x4071b3
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
push 0x1f4
push dword [ebx + 0x101c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4070a0
push esi
push 0
push dword [0x4b3a28]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x124c]
mov dword [ebp - 0x10], eax
jmp 0x407127
test al, al
jne 0x407174
inc esi
cmp esi, edi
jae 0x4071be
mov al, byte [esi]
jmp 0x407206
add esi, 6
push esi
call fcn.00486624
mov esi, dword [ebp - 8]
add esp, 4
mov edi, dword [ebp - 0xc]
mov dword [ebx + 0x1248], eax
mov eax, dword [ebp - 0x10]
or dword [eax], 0x100
mov eax, dword [0x4b4fa4]
test eax, eax
je 0x4071c4
or dword [eax + 0x40], 1
jmp 0x4071c4
Function at 0x4085b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 8
push edi
mov dword [ebp - 0x220], edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
mov dword [ebp - 0x21c], ebx
call fcn.0047ee20
add esp, 0xc
push 0
push 0
push 0x1004
push dword [ebx + 0x1238]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebx + 0x1014]
mov dword [ebp - 0x218], eax
test esi, esi
je 0x40865d
mov edx, 0x105
lea ecx, [ebp - 0x210]
nop dword [eax]
lea eax, [edx + 0x7ffffef9]
test eax, eax
je 0x408650
movzx eax, word [esi]
test ax, ax
je 0x408650
mov word [ecx], ax
add esi, 2
add ecx, 2
sub edx, 1
jne 0x408630
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.004081f0
cmp eax, 1
jne 0x408789
push 0
push 0
push 2
push 0
push eax
push 0xc0000000
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4086bd
lea eax, [ebp - 0x210]
push eax
push 0
push 0xdb
push edi
call fcn.0047ab10
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
xor edi, edi
cmp dword [ebp - 0x218], edi
jle 0x408782
nop dword [eax + eax]
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x25c], 4
push eax
mov eax, dword [ebp - 0x21c]
push 0
push 0x104b
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x23c], 0
push dword [eax + 0x1238]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x23c]
test eax, eax
je 0x408760
lea ecx, [eax + 8]
mov esi, ecx
lea edx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x408726
push 0
lea eax, [ebp - 0x214]
sub esi, edx
push eax
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
cmp dword [ebp - 0x214], esi
jne 0x40876f
lea eax, [ebp - 0x214]
push eax
push 2
push 0x4a5e98
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, dword [ebp - 0x218]
jl 0x4086d0
jmp 0x408782
push 0xb3
push dword [ebp - 0x220]
call fcn.0047ab10
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
Function at 0x40a9a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4af480]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0x406
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40aa21
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call esi
mov ecx, 0x4b47c8
lea esi, [ebp - 0x20c]
mov edx, 0x104
sub esi, ecx
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40aa0e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40aa0e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40a9f0
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
push 0x408
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x40aa7d
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call esi
mov ecx, 0x4b45c0
lea esi, [ebp - 0x20c]
mov edx, 0x104
sub esi, ecx
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40aa70
movzx eax, word [esi + ecx]
test ax, ax
je 0x40aa70
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40aa52
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov esi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x41e
push edi
call esi
dec eax
neg eax
push 0x41f
sbb eax, eax
inc eax
push edi
mov dword [0x4b4df0], eax
call esi
dec eax
neg eax
push 0x411
sbb eax, eax
inc eax
push edi
mov dword [0x4b4dfc], eax
call esi
cmp eax, 1
jne 0x40aabf
or dword [0x4b4de4], 0x20
jmp 0x40aac6
and dword [0x4b4de4], 0xffffffdf
push 0x412
push edi
call esi
cmp eax, 1
jne 0x40aadf
or dword [0x4b4de4], 0x80
jmp 0x40aae9
and dword [0x4b4de4], 0xffffff7f
push 0x413
push edi
call esi
cmp eax, 1
jne 0x40ab02
or dword [0x4b4de4], 0x100
jmp 0x40ab0c
and dword [0x4b4de4], 0xfffffeff
push 0x414
push edi
call esi
pop edi
pop esi
cmp eax, 1
jne 0x40ab24
or dword [0x4b4de4], 0x40
jmp 0x40ab2b
and dword [0x4b4de4], 0xffffffbf
call fcn.00401500
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
Function at 0x40c430
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x424
mov eax, dword [0x4af480]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
push edi
push 8
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
push 2
mov ebx, eax
push 0xffffffffffffffff
push 0x100c
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
mov dword [esp + 0x24], esi
cmp esi, 0xffffffff
jne 0x40c4ca
push dword [ebx + 0xc]
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x40c491
push 0
push dword [ebx + 0xc]
call esi
push dword [ebx + 0x10]
call edi
test eax, eax
je 0x40c4a1
push 0
push dword [ebx + 0x10]
call esi
push dword [ebx + 0x14]
call edi
test eax, eax
je 0x40c5bd
push 0
push dword [ebx + 0x14]
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret
push esi
push dword [ebx + 8]
call fcn.00478e50
mov dword [esp + 0x10], eax
test eax, eax
je 0x40c5bd
mov ecx, dword [ebx + 8]
lea eax, [esp + 0x14]
push eax
push 1
mov edx, esi
call fcn.0040bdb0
mov edx, dword [esp + 0x20]
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
sub eax, edx
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 0x14
push eax
mov eax, dword [esp + 0x24]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [ebx + 0xc]
call edi
push 1
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x30]
call fcn.0040bc30
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [esp + 0x30]
add esp, 8
push eax
push dword [ebx + 0xc]
call esi
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x14]
mov ecx, dword [ebx + 8]
push eax
push 2
call fcn.0040bdb0
mov edx, dword [esp + 0x20]
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
sub eax, edx
push 0x14
push eax
mov eax, dword [esp + 0x24]
sub eax, ecx
push eax
push edx
push ecx
push 0
push dword [ebx + 0x10]
call edi
push 2
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x30]
call fcn.0040bc30
add esp, 8
lea eax, [esp + 0x28]
push eax
push dword [ebx + 0x10]
call esi
push dword [ebx + 0xc]
mov edi, dword [sym.imp.USER32.dll_IsWindowVisible]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x40c5ad
push 5
push dword [ebx + 0xc]
call esi
push dword [ebx + 0x10]
call edi
test eax, eax
jne 0x40c5bd
push 5
push dword [ebx + 0x10]
call esi
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047d2db
mov esp, ebp
pop ebp
ret