joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
div ecx
push edi
push 0x27
push 0
mov dword [ebp - 0x3c], esi
imul eax, ecx
mov dword [ebp - 0x30], eax
mov dword [esi], eax
lea eax, [ebp - 0x2b]
push eax
call fcn.00425210
mov esi, dword [ebp + 0x10]
add esp, 0xc
push 7
pop ecx
push dword [ebp - 0x30]
lea edi, [ebp - 0x2c]
push dword [ebp + 0xc]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x34]
movsw word es:[edi], word [esi]
call fcn.00401133
mov edi, dword [ebp - 0x3c]
push dword [edi]
mov dword [ebp - 0x34], eax
call fcn.00412d8a
push dword [ebx + 0xc]
mov dword [ebp - 0x30], eax
call fcn.00412d8a
push dword [ebx + 0xc]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x40]
push eax
call fcn.004277b0
xor esi, esi
add esp, 0x14
cmp dword [edi], esi
jbe 0x401101
mov ecx, dword [ebx + 0xc]
xor eax, eax
test ecx, ecx
jbe 0x4010a8
mov ecx, dword [ebp - 0x34]
add ecx, esi
xor byte [ecx + eax], 0xaa
inc eax
cmp eax, dword [ebx + 0xc]
jb 0x40109e
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebx + 0xc]
lea edi, [esi + eax]
push ecx
mov eax, edi
call fcn.00401671
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
add eax, esi
push ecx
push eax
push dword [ebp - 0x38]
mov eax, ebx
call fcn.00401156
push dword [ebx + 0xc]
mov eax, dword [ebp - 0x30]
add eax, esi
push eax
push dword [ebp - 0x38]
call fcn.004277b0
xor eax, eax
add esp, 0xc
cmp dword [ebx + 0xc], eax
jbe 0x4010f5
xor byte [edi + eax], 0xaa
inc eax
cmp eax, dword [ebx + 0xc]
jb 0x4010eb
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebp - 0x3c]
add esi, ecx
cmp esi, dword [eax]
jb 0x401093
push dword [ebp - 0x38]
call fcn.00412d7f
push dword [ebp - 0x34]
call fcn.00412d7f
pop ecx
pop ecx
push 0x28
pop ecx
pop edi
lea eax, [ebp - 0x2c]
pop esi
mov byte [eax], 0
inc eax
dec ecx
jne 0x40111b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
xor ecx, ebp
call fcn.00421987
leave
ret 0x10

Function at 0x401482
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov eax, dword [edi]
push ebx
push esi
xor esi, esi
test eax, eax
jle 0x4014ae
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [edx]
mov bl, byte [ecx]
add eax, esi
xor byte [eax], bl
mov eax, dword [edi]
inc esi
add ecx, 4
cmp esi, eax
jl 0x40149c
inc dword [ebp - 4]
add edx, 4
cmp dword [ebp - 4], 4
jl 0x40148e
pop esi
pop ebx
leave
ret 4
Function at 0x4014f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 4
call fcn.00412d8a
push 4
mov esi, eax
call fcn.00412d8a
and dword [ebp - 4], 0
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [eax + 4]
shl ecx, 2
test ecx, ecx
jle 0x40153c
mov ecx, dword [ebp + 0xc]
mov edi, ebx
sub ecx, ebx
mov dl, byte [ecx + edi]
inc dword [ebp - 4]
mov byte [edi], dl
mov edx, dword [eax + 4]
shl edx, 2
inc edi
cmp dword [ebp - 4], edx
jl 0x401528
mov edi, dword [eax + 4]
shl edi, 2
jmp 0x401649
mov cl, byte [ebx + edi - 4]
mov byte [esi], cl
mov cl, byte [ebx + edi - 3]
mov byte [esi + 1], cl
mov cl, byte [ebx + edi - 2]
mov byte [esi + 2], cl
mov cl, byte [ebx + edi - 1]
mov byte [esi + 3], cl
mov ecx, dword [eax + 4]
mov eax, edi
cdq
and edx, 3
add eax, edx
sar eax, 2
cdq
idiv ecx
test edx, edx
jne 0x4015e2
mov cl, byte [esi + 1]
mov al, byte [esi]
mov byte [esi], cl
mov cl, byte [esi + 2]
mov byte [esi + 1], cl
mov cl, byte [esi + 3]
push esi
mov byte [esi + 2], cl
mov byte [esi + 3], al
call fcn.004014c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
mov eax, edi
cdq
idiv ecx
mov cl, 1
dec eax
test eax, eax
jle 0x4015b9
mov dl, cl
and dl, 0x80
add cl, cl
test dl, dl
je 0x4015b6
xor cl, 0x1b
dec eax
jne 0x4015a8
mov eax, dword [ebp - 8]
mov byte [eax], cl
mov byte [eax + 3], 0
mov byte [eax + 2], 0
mov byte [eax + 1], 0
mov ecx, esi
sub eax, esi
mov dword [ebp + 0xc], 4
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec dword [ebp + 0xc]
jne 0x4015d5
jmp 0x4015f2
cmp ecx, 6
jle 0x4015f2
cmp edx, 4
jne 0x4015f2
push esi
call fcn.004014c0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 2
mov edx, edi
sub edx, ecx
mov cl, byte [edx + ebx]
xor cl, byte [esi]
mov edx, edi
mov byte [ebx + edi], cl
mov ecx, dword [eax + 4]
shl ecx, 2
sub edx, ecx
mov cl, byte [edx + ebx + 1]
xor cl, byte [esi + 1]
mov edx, edi
mov byte [ebx + edi + 1], cl
mov ecx, dword [eax + 4]
shl ecx, 2
sub edx, ecx
mov cl, byte [edx + ebx + 2]
xor cl, byte [esi + 2]
mov edx, edi
mov byte [ebx + edi + 2], cl
mov ecx, dword [eax + 4]
shl ecx, 2
sub edx, ecx
mov cl, byte [edx + ebx + 3]
xor cl, byte [esi + 3]
add edi, 4
mov byte [ebx + edi - 1], cl
mov ecx, dword [eax + 8]
inc ecx
imul ecx, dword [eax]
shl ecx, 2
cmp edi, ecx
jl 0x401547
push dword [ebp - 8]
call fcn.00412d7f
push esi
call fcn.00412d7f
pop ecx
pop ecx
pop edi
pop esi
leave
ret 8

Function at 0x401671
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, edx
test edi, edi
jbe 0x40168e
push esi
mov esi, dword [esp + 0xc]
sub ecx, eax
sub esi, eax
mov dl, byte [ecx + eax]
xor dl, byte [eax]
mov byte [esi + eax], dl
inc eax
dec edi
jne 0x401681
pop esi
pop edi
ret 4
Function at 0x401692
Capabilities:
Encode data using base64

Disassembly:
push 0x5c
mov eax, 0x4385cb
call fcn.00424c9a
and dword [ebp - 0x68], 0
mov eax, dword [ebp + 8]
push 0x10
pop ecx
mov esi, 0x43fe20
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov dword [ebp - 0x60], eax
call fcn.0040265f
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
xor esi, esi
mov dword [ebp - 0x68], ebx
cmp dword [ebp + 0x10], esi
je 0x4017e8
mov eax, dword [ebp + 0xc]
dec dword [ebp + 0x10]
mov al, byte [eax]
mov byte [ebp + esi - 0x58], al
inc esi
inc dword [ebp + 0xc]
cmp esi, 3
jne 0x40173f
mov al, byte [ebp - 0x58]
mov cl, byte [ebp - 0x57]
shr al, 2
mov byte [ebp - 0x5c], al
mov al, byte [ebp - 0x58]
and al, 3
shl al, 4
shr cl, 4
add al, cl
mov cl, byte [ebp - 0x56]
mov byte [ebp - 0x5b], al
mov al, byte [ebp - 0x57]
and al, 0xf
shl al, 2
shr cl, 6
add al, cl
mov byte [ebp - 0x5a], al
mov al, byte [ebp - 0x56]
and al, 0x3f
mov byte [ebp - 0x59], al
xor esi, esi
movzx eax, byte [ebp + esi - 0x5c]
mov al, byte [ebp + eax - 0x54]
mov edi, dword [ebp - 0x60]
mov byte [ebp - 0x64], al
push dword [ebp - 0x64]
call fcn.00401d5d
inc esi
cmp esi, 4
jl 0x401720
xor esi, esi
cmp dword [ebp + 0x10], 0
jne 0x4016d2
test esi, esi
je 0x4017e8
cmp esi, 3
jge 0x401767
push 3
pop ecx
sub ecx, esi
push ecx
lea eax, [ebp + esi - 0x58]
push 0
push eax
call fcn.00425210
add esp, 0xc
mov cl, byte [ebp - 0x58]
mov al, cl
shr al, 2
mov byte [ebp - 0x5c], al
mov al, byte [ebp - 0x57]
and cl, 3
mov dl, al
shl cl, 4
shr dl, 4
add cl, dl
mov byte [ebp - 0x5b], cl
mov cl, byte [ebp - 0x56]
and dword [ebp - 0x58], 0
and al, 0xf
mov dl, cl
shl al, 2
shr dl, 6
add al, dl
mov byte [ebp - 0x5a], al
and cl, 0x3f
lea eax, [esi + 1]
mov byte [ebp - 0x59], cl
test eax, eax
jle 0x4017cd
mov eax, dword [ebp - 0x58]
movzx eax, byte [ebp + eax - 0x5c]
mov al, byte [ebp + eax - 0x54]
mov edi, dword [ebp - 0x60]
mov byte [ebp - 0x64], al
push dword [ebp - 0x64]
call fcn.00401d5d
inc dword [ebp - 0x58]
lea eax, [esi + 1]
cmp dword [ebp - 0x58], eax
jl 0x4017a8
push 3
pop eax
cmp esi, eax
jge 0x4017e8
sub eax, esi
mov dword [ebp - 0x5c], eax
mov edi, dword [ebp - 0x60]
push 0x3d
call fcn.00401d5d
dec dword [ebp - 0x5c]
jne 0x4017d9
mov eax, dword [ebp - 0x60]
call fcn.00424d1d
ret 0xc
Function at 0x402672
Capabilities:
Contain obfuscated stackstrings
Extract resource via kernel32 functions

Disassembly:
push 0x708
mov eax, 0x43848f
call fcn.00424cd0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x714], eax
movzx eax, word [ebp + 8]
push str.WAVE
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
je 0x4027c0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x4027c0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x4027c0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [ebp - 0x3c]
push ecx
push eax
mov eax, edi
lea ecx, [ebp - 0x704]
mov dword [ebp - 0x70c], ebx
mov dword [ebp - 0x708], ebx
mov byte [ebp - 0x25], 0x66
mov byte [ebp - 0x38], 0x63
mov byte [ebp - 0x29], 0x35
mov byte [ebp - 0x37], 0x37
mov byte [ebp - 0x30], 0x36
mov byte [ebp - 0x1f], 0x32
mov byte [ebp - 0x3b], 0x32
mov byte [ebp - 0x1e], 0x38
mov byte [ebp - 0x1d], 0x36
mov byte [ebp - 0x33], 0x31
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x31], 0x63
mov byte [ebp - 0x32], 0x65
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x2a], 0x66
mov byte [ebp - 0x2c], 0x66
mov byte [ebp - 0x23], 0x37
mov byte [ebp - 0x27], 0x37
mov byte [ebp - 0x26], 0x62
mov byte [ebp - 0x20], 0x35
mov byte [ebp - 0x2e], 0x35
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x22], 0x37
mov byte [ebp - 0x39], 0x35
mov byte [ebp - 0x2b], 0x34
mov byte [ebp - 0x2f], 0x39
mov byte [ebp - 0x21], 0x62
mov byte [ebp - 0x3c], 0x65
mov byte [ebp - 0x34], 0x39
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x2d], 0x39
mov byte [ebp - 0x3a], 0x37
mov dword [ebp - 4], ebx
call fcn.0040c8ad
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x70c]
push eax
lea eax, [ebp - 0x704]
call fcn.0040c943
cmp eax, ebx
jne 0x4027c0
mov eax, dword [ebp - 0x70c]
mov ecx, dword [ebp - 0x710]
mov dword [ecx], eax
mov eax, dword [ebp - 0x708]
mov ecx, dword [ebp - 0x714]
mov dword [ecx], eax
mov al, 1
jmp 0x4027c2
xor al, al
call fcn.00424d2c
ret
Function at 0x402dca
Capabilities:
Delete file
Get common file path
Get program files directory
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x890]
sub esp, 0x910
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp + 0x88c], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp + 0x789]
push ebx
push eax
mov byte [ebp + 0x788], bl
call fcn.00425210
mov esi, 0x3ff
push esi
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.00425210
push esi
lea eax, [ebp + 0x389]
push ebx
push eax
mov byte [ebp + 0x388], bl
call fcn.00425210
lea eax, [ebp - 0x80]
push eax
call fcn.00421f7c
mov eax, dword [ebp - 0x80]
add esp, 0x28
push 5
pop ecx
xor edx, edx
div ecx
lea edi, [ebp - 0x78]
mov ebx, edx
add ebx, ecx
call fcn.004088f1
lea eax, [ebp + 0x788]
push eax
xor esi, esi
push esi
push esi
push 0x2a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov eax, edi
push eax
push eax
lea eax, [ebp + 0x788]
push eax
lea eax, [ebp + 0x388]
push str._s_s_s
push eax
call fcn.00402efa
add esp, 0x14
xor edi, edi
lea eax, [ebp + 0x388]
push esi
push eax
call fcn.0042210d
pop ecx
pop ecx
test eax, eax
je 0x402ee2
push 0x43ffb8
lea eax, [ebp + 0x388]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004221e9
add esp, 0xc
test eax, eax
jne 0x402ecf
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push 0x100
push 1
push eax
call fcn.0042239e
push dword [ebp - 0x7c]
call fcn.00422497
add esp, 0x14
jmp 0x402edc
lea eax, [ebp + 0x388]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc edi
cmp edi, 0xa
jl 0x402e80
mov ecx, dword [ebp + 0x88c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421987
add ebp, 0x890
leave
ret

Function at 0x402f15
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x4040e0
Capabilities:
Encode data using xor

Disassembly:
push 0x1c
mov eax, 0x438963
call fcn.00424c31
cmp dword [esi + 0x34], 0x10
jb 0x4040f7
mov edx, dword [esi + 0x20]
jmp 0x4040fa
lea edx, [esi + 0x20]
lea ecx, [ebp - 0x28]
call fcn.0041136a
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.0040251a
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00402614
cmp dword [esi + 0x14], edi
jbe 0x40413d
mov eax, esi
call fcn.00401cde
mov bl, byte [eax]
mov eax, esi
xor bl, 0xaa
call fcn.00401cde
inc edi
mov byte [eax], bl
cmp edi, dword [esi + 0x14]
jb 0x404122
cmp dword [esi + 0x18], 0x10
jb 0x404148
mov eax, dword [esi + 4]
jmp 0x40414b
lea eax, [esi + 4]
call fcn.00424d09
ret

Function at 0x4041fd
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x344
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.CouncilorAffording.exe
mov esi, 0x104
lea eax, [ebp - 0x218]
push esi
push eax
xor bl, bl
call fcn.00423114
lea eax, [ebp - 0x218]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404238
sub eax, edi
inc eax
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00422d82
pop ecx
pop ecx
xor edi, edi
push edi
push 2
mov dword [ebp - 0x340], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x344], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x344], 0xffffffff
je 0x40434e
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x344]
call sub.KERNEL32.dll_Process32First
jmp 0x404339
push esi
lea eax, [ebp - 0x110]
push edi
push eax
call fcn.00425210
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x110]
push esi
push eax
call fcn.00423114
lea eax, [ebp - 0x110]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4042c3
sub eax, edx
inc eax
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00422d82
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004232a3
add esp, 0x10
test eax, eax
jne 0x404318
push dword [ebp - 0x338]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, edi
je 0x40435f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
dec ebx
neg ebx
sbb bl, bl
inc bl
mov ecx, esi
lea eax, [ebp - 0x110]
mov byte [eax], 0
inc eax
dec ecx
jne 0x404320
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x344]
call sub.KERNEL32.dll_Process32Next
cmp eax, 1
je 0x404295
push dword [ebp - 0x344]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421987
leave
ret
xor al, al
jmp 0x404350
Function at 0x404616
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x452c60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, edx
cmp ebx, 6
jne 0x40465e
mov esi, dword [esi]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffbffff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov al, 1
jmp 0x4046ef
cmp ebx, 7
jne 0x40467e
mov esi, dword [esi]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x40000
jmp 0x40464d
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4046ed
push 0x415
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4046b5
sub eax, edx
cmp eax, 4
jle 0x4046ed
push 0
add bl, 0x30
push esi
mov byte [ebp + eax - 0x406], bl
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextA]
dec eax
neg eax
sbb al, al
inc al
jmp 0x4046ef
xor al, al
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00421987
leave
ret

Function at 0x4046fd
Capabilities:
Get graphical window text

Disassembly:
push 0x14c
mov eax, 0x43909c
call fcn.00424c9a
mov edi, ecx
mov eax, dword [ebp + 8]
imul edi, edi, 0xa
push 0x103
mov dword [ebp - 0x158], eax
lea eax, [ebp - 0x117]
push 0
push eax
mov byte [ebp - 0x118], 0
call fcn.00425210
and dword [ebp - 0x154], 0
add esp, 0xc
test edi, edi
jle 0x4047ed
push 0x440394
lea eax, [ebp - 0x150]
push eax
call fcn.00404040
and dword [ebp - 4], 0
push str.CouncilorAffording
lea esi, [ebp - 0x150]
call fcn.004040e0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov eax, dword [ebp - 0x158]
mov eax, dword [eax]
test eax, eax
je 0x4047c4
push 0x415
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x118]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4047a6
sub eax, ecx
cmp eax, 3
jle 0x4047c4
movsx eax, byte [ebp + eax - 0x11a]
sub eax, 0x30
cmp dword [ebp + 0xc], eax
jle 0x4047f7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x150]
call fcn.004041bd
inc dword [ebp - 0x154]
cmp dword [ebp - 0x154], edi
jl 0x404746
xor al, al
call fcn.00424d1d
ret 8
lea eax, [ebp - 0x150]
call fcn.004041bd
mov al, 1
jmp 0x4047ef
Function at 0x4048b2
Capabilities:
Enumerate processes

Disassembly:
push 0x150
mov eax, 0x438933
call fcn.00424c9a
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x159], bl
mov dword [ebp - 0x14], 0xf
call fcn.004025f8
push ebx
push 2
mov byte [ebp - 4], 1
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x404917
mov byte [ebp - 0x159], bl
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402614
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00402614
mov al, byte [ebp - 0x159]
call fcn.00424d1d
ret
lea eax, [ebp - 0x158]
push eax
push esi
mov dword [ebp - 0x158], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x404983
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040227b
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x40494d
lea eax, [ebp + 0xc]
mov ebx, dword [ebp + 0x1c]
mov edx, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
call fcn.00403e1d
test eax, eax
je 0x404973
lea eax, [ebp - 0x158]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404932
jmp 0x40497a
mov byte [ebp - 0x159], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov al, byte [ebp - 0x159]
mov byte [ebp - 0x159], al
jmp 0x4048f5
Function at 0x4050bb
Capabilities:
Write file on windows

Disassembly:
push 0x460
mov eax, 0x439e6c
call fcn.00424c9a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x440], eax
mov eax, dword [ebp + 0x10]
mov edi, ecx
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x44c], eax
mov byte [ebp - 0x42d], bl
mov dword [ebp - 0x43c], ebx
mov dword [ebp - 0x438], ebx
mov esi, 0x43fecb
lea ecx, [edi + 0x50]
push esi
mov dword [ebp - 4], ebx
call fcn.0040227b
push dword [ebp - 0x434]
lea eax, [ebp - 0x410]
push 0x440578
push eax
call fcn.00402efa
add esp, 0xc
mov dword [ebp - 0x434], ebx
jmp 0x40513a
mov edi, dword [ebp - 0x448]
lea ecx, [ebp - 0x410]
call fcn.00408933
sub esp, 0x1c
lea eax, [ebp - 0x410]
mov ecx, esp
mov dword [ebp - 0x444], esp
push eax
lea ebx, [ebp - 0x43c]
call fcn.0040229e
call fcn.00411d78
test al, al
je 0x405245
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push dword [ebp - 0x440]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405245
push 0
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0x438]
push dword [ebp - 0x43c]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x440]
lea ebx, [ebp - 0x42c]
mov ecx, edi
call fcn.00404f43
push esi
mov eax, ebx
mov byte [ebp - 4], 1
call fcn.00403e68
test eax, eax
je 0x405232
sub esp, 0x1c
mov eax, ebx
mov ecx, esp
mov dword [ebp - 0x444], esp
push eax
call fcn.004025ac
lea ecx, [ebp - 0x46c]
call fcn.00404d43
push 0xffffffffffffffff
push 0
push eax
lea ecx, [edi + 0x50]
mov byte [ebp - 4], 2
call fcn.0040251a
push 0
push 1
lea ecx, [ebp - 0x46c]
mov byte [ebp - 4], 1
call fcn.00402614
mov edx, dword [ebp - 0x44c]
mov ecx, edi
call fcn.00405008
mov byte [ebp - 0x42d], al
push 0
push 1
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 0
call fcn.00402614
xor ecx, ecx
cmp byte [ebp - 0x42d], 1
lea edi, [ebp - 0x46c]
je 0x4052ad
push dword [ebp + 0x18]
push 0x45a178
call fcn.004033b1
push 0
push 1
mov ecx, edi
call fcn.00402614
inc dword [ebp - 0x434]
cmp dword [ebp - 0x434], 3
jl 0x405134
cmp dword [ebp - 0x43c], 0
je 0x40529f
push dword [ebp - 0x43c]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, byte [ebp - 0x42d]
call fcn.00424d1d
ret 0x14
push dword [ebp + 0x14]
push 0x45a178
call fcn.004033b1
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x46c]
call fcn.00402614
cmp dword [ebp - 0x43c], esi
je 0x4052e6
push dword [ebp - 0x43c]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, 1
jmp 0x4052a5
Function at 0x405480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00402672
add esp, 0xc
test al, al
je 0x4054eb
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4054e0
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
push dword [ebp - 4]
call fcn.00412d7f
pop ecx
mov al, bl
pop esi
pop ebx
leave
ret 8

Function at 0x405caf
Capabilities:
Delete file

Disassembly:
push 0x4ac
mov eax, 0x439fae
call fcn.00424c9a
push 0x456f40
lea eax, [ebp - 0x410]
push 0x400
push eax
call fcn.00423114
add esp, 0xc
push 0x440660
lea eax, [ebp - 0x480]
push eax
call fcn.00404040
and dword [ebp - 4], 0
lea esi, [ebp - 0x480]
call fcn.004040e0
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x440670
lea eax, [ebp - 0x448]
push eax
call fcn.00404040
push 0x44067c
lea eax, [ebp - 0x4b8]
push eax
mov byte [ebp - 4], 1
call fcn.00404040
push 0x249
push 0x248
lea esi, [ebp - 0x4b8]
mov byte [ebp - 4], 2
call fcn.004040e0
push eax
lea eax, [ebp - 0x410]
push eax
lea esi, [ebp - 0x448]
call fcn.004040e0
push eax
mov ecx, edi
call fcn.004050bb
test al, al
je 0x405d83
push 1
push 0x440684
lea eax, [ebp - 0x410]
push eax
call fcn.00404994
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x4b8]
call fcn.004041bd
lea eax, [ebp - 0x448]
call fcn.004041bd
lea eax, [ebp - 0x480]
call fcn.004041bd
call fcn.00424d1d
ret