joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46114c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4612f7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4612d8
mov dl, 1
mov eax, dword [0x4164e8]
call fcn.00403100
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403ec0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4612c7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044e414
test al, al
je 0x4612ba
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x461308
lea eax, [ebp - 0x254]
call fcn.00408df0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4612ba
xor eax, eax
push ebp
push 0x4612b3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x461340
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46129c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404130
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x46129c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4612ba
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4611bd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041ad04
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4612fe
lea eax, [ebp - 0x260]
call fcn.00403ec0
ret

Function at 0x461c2c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x486bf0]
cmp byte [eax + 0xa5], 0
jne 0x461c9d
cmp dword [0x486c08], 0
jne 0x461c5e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x461be8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x486c08], eax
cmp dword [0x486c04], 0
jne 0x461c79
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x486c04], eax
cmp dword [0x486c0c], 0
jne 0x461c9d
push esp
push 0
push 0
push 0x461b8c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x486c0c], eax
pop edx
ret
Function at 0x461df0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x461e07
add esp, 0xfffffff0
call fcn.00403494
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420d04
mov eax, dword [0x4858d0]
cmp word [eax + 2], 0
jne 0x461e2f
mov eax, dword [0x4858d0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004634c8
mov eax, dword [0x4859cc]
cmp word [eax + 2], 0
jne 0x461e49
mov eax, dword [0x4859cc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004636c0
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x415e30]
call fcn.00403100
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x415e30]
call fcn.00403100
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423398]
call fcn.0042ab28
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x461fd0
mov eax, dword [0x4857b0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042aef8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x463c60
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4857b0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c5b0
test eax, eax
je 0x461f3e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004087d0
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c5d8
test eax, eax
je 0x461f52
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404130
mov eax, dword [0x4855e8]
cmp byte [eax], 0
jne 0x461f86
mov eax, ebx
call fcn.004620f8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00463e3c
mov eax, ebx
call fcn.00464800
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x461fc6
call fcn.004034ec
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462378
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x486bf0]
cmp dword [eax + 0x30], 0
je 0x462422
cmp dword [ebx + 0x94], 0
jne 0x46241c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x462308
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x46241c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4623e2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x46241c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004186cc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4623f1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x462f84
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x462fb9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403fb0
jmp 0x462fc6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403f14
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x464018
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x464059
mov eax, esi
call fcn.00449a84
test al, al
je 0x464059
mov eax, dword [ebx + 0x84]
call fcn.00449780
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x464059
push 0
mov eax, dword [ebx + 0x84]
call fcn.00449780
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x47ba50
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x47ba71
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x47ba71
xor eax, eax
ret
mov al, 1
ret
Function at 0x100858d9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100858ea
pop esi
ret
push ebx
push edi
push esi
call fcn.100570c2
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100570c2
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10085912
push ebx
push esi
push edi
call fcn.10067180
add esp, 0xc
push 0
call fcn.100570c2
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x514ad0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4a7015
lea edi, [esi - 0xa6015]
mov dword [edi + 0x101344], 0x30f1751
push edi
or ebp, 0xffffffff
jmp 0x514afa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x514b01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x514af0
mov eax, 1
add ebx, ebx
jne 0x514b13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x514b24
jne 0x514b43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x514b43
dec eax
add ebx, ebx
jne 0x514b30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x514b08
add ebx, ebx
jne 0x514b3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x514b95
xor ecx, ecx
sub eax, 3
jb 0x514b5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x514bca
sar eax, 1
mov ebp, eax
jmp 0x514b66
add ebx, ebx
jne 0x514b66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x514b34
inc ecx
add ebx, ebx
jne 0x514b74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x514b34
add ebx, ebx
jne 0x514b81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x514b76
jne 0x514b92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x514b76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x514bb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x514ba6
jmp 0x514af6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x514bb4
add edi, ecx
jmp 0x514af6
pop esi
mov edi, esi
mov ecx, 0x36c0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x514bd2
cmp byte [edi], 0x13
jne 0x514bd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x514bd7
lea edi, [esi + 0x10e000]
mov eax, dword [edi]
or eax, eax
je 0x514c46
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1144ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x114528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x514c04
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x114530]
or eax, eax
je 0x514c40
mov dword [ebx], eax
add ebx, 4
jmp 0x514c21
call dword [esi + 0x11452c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x514c77
cmp al, 0xef
ja 0x514c6a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x514c4c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x514c59
mov ebp, dword [esi + 0x114534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x114cd2]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x514cc3
sub esp, 0xffffff80
jmp 0x4013f0
Function at 0x403c92
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x409024]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call main
mov ebx, eax
cmp ebx, esi
je 0x403d05
lea ecx, [ebp - 0x74]
call fcn.0040175a
mov eax, ebx
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040426a
add ebp, 0x1a0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x403d1d
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.00403c92
cmp eax, esi
jne 0x403d4f
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x403d0d
lea ecx, [ebp - 0x74]
call fcn.0040175a
push dword [ebp - 0x78]
mov ecx, edi
call fcn.004016eb
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.0040175a
mov eax, esi
jmp 0x403ceb

Function at 0x403fd2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x403fe1
pop dword [ebp - 0x30]
mov eax, 0x403fe1
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x26035c6d
add dword [ebp - 0x40], 0x284ee8de
mov dword [ebp - 0x3c], 0x9b041e5e
add dword [ebp - 0x3c], 0x972f2de7
mov dword [ebp - 0x38], 0x3de132b6
add dword [ebp - 0x38], 0xe6b1178
mov dword [ebp - 0x34], 0x1cfc372a
sub dword [ebp - 0x34], 0x1cfc372a
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xcd1405a8
sub dword [ebp - 0x40], 0x58a19c52
mov dword [ebp - 0x3c], 0x3eeb52e8
sub dword [ebp - 0x3c], 0xfd7ef173
mov dword [ebp - 0x38], 0xb26155ec
sub dword [ebp - 0x38], 0x4ef1e980
mov dword [ebp - 0x34], 0x688a471c
add dword [ebp - 0x34], 0x9775b8e4
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xcf5f115
add eax, 0xf34a6eeb
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x36b13
push 0
call eax
mov ecx, 0x479c
mov edi, eax
mov ebx, 0x38086bb2
add ebx, 0xc838ce4e
add ebx, dword [ebp - 0x30]
mov esi, 0x7cc52bc6
add esi, 0x2f78967c
mov dword [ebp - 0x2c], 0xe7bb966c
mov edx, dword [ebx]
xor dword [ebp - 0xc], 0x2a496b6
add edx, esi
mov dword [edi], edx
mov dword [ebp - 0x24], 0xabfd80d3
add edi, 4
add ebx, 0x8b5a1a2
add ebx, 0xf74a5e62
loop 0x4040f3
add eax, 0x11143
xor ebx, ebx
add ebx, eax
add eax, 0xaaeb9b2f
add eax, 0x551464d6
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x40426a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409024]
jne 0x404274
repz ret
jmp fcn.00404744
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c030]
jne 0x401116
repz ret
jmp fcn.00401b61

Function at 0x409235
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c95
and dword [ebp - 4], 0
cmp dword [0x43e794], 0
mov ebx, eax
jne 0x4092e6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409397
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409397
push eax
call fcn.00404c23
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e794], eax
call esi
push eax
call fcn.00404c23
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e798], eax
call esi
push eax
call fcn.00404c23
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43e79c], eax
call esi
push eax
call fcn.00404c23
pop ecx
mov dword [0x43e7a4], eax
test eax, eax
je 0x4092e6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404c23
pop ecx
mov dword [0x43e7a0], eax
mov eax, dword [0x43e7a0]
cmp eax, ebx
je 0x40933e
cmp dword [0x43e7a4], ebx
je 0x40933e
push eax
call fcn.00404c9e
push dword [0x43e7a4]
mov esi, eax
call fcn.00404c9e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40933e
test edi, edi
je 0x40933e
call esi
test eax, eax
je 0x409335
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409335
test byte [ebp - 0xc], 1
jne 0x40933e
or dword [ebp + 0x10], 0x200000
jmp 0x409377
mov eax, dword [0x43e798]
cmp eax, ebx
je 0x409377
push eax
call fcn.00404c9e
pop ecx
test eax, eax
je 0x409377
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409377
mov eax, dword [0x43e79c]
cmp eax, ebx
je 0x409377
push eax
call fcn.00404c9e
pop ecx
test eax, eax
je 0x409377
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e794]
call fcn.00404c9e
pop ecx
test eax, eax
je 0x409397
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409399
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40b0a0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x43c030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c1c01c]
push ebx
mov ebx, dword [0x2c1be68]
push esi
mov esi, dword [0x43cf60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40b0e1
push str.pecoloniwifuforewuxito
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c1c01c]
mov dword [0x43e8f4], esi
cmp eax, 0x114e
jne 0x40b10b
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.famufinisiban
call dword [sym.imp.KERNEL32.dll_BuildCommDCBA]
mov eax, dword [0x2c1c01c]
cmp eax, 0x2f
jne 0x40b12d
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
call fcn.0040aff0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x406b7c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [ebp - 0x768]
add edx, 1
mov dword [ebp - 0x768], edx
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax + 0x18]
jae 0x406b4a
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1984]
mov ecx, dword [ebp - 0x324]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x76c], ecx
mov edx, dword [ebp - 0x768]
mov eax, dword [ebp - 0x1988]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp - 0x1d10]
mov eax, dword [ebp - 0x324]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x19c], 0
jmp 0x4069ae
mov ecx, dword [ebp - 0x19c]
add ecx, 1
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
test eax, eax
je 0x406a60
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
test edx, edx
je 0x406a60
push esi
push ecx
add esp, 4
call 0x4069ec
add byte [ebx + 0x48], cl
inc eax
xor al, 0x48
add esp, 4
add esi, 0x3542
call 0x406a03
add byte [esi + 0x35], cl
cmp dword [edi], edi
xor al, 0x35
cmp al, 0x83
les eax, [ebx + ebp*8]
add al, 0x33
inc ebp
inc ebx
cmp al, 0x5e
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
cmp ecx, eax
je 0x406a52
mov ecx, dword [ebp - 0x76c]
add ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx]
xor edx, 0x20
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [ebp + eax - 0x878]
cmp edx, ecx
jne 0x406a59
jmp 0x40699f
jmp 0x406a60
push esi
push ebx
add esp, 4
and esi, 0xfe39
pop esi
push ecx
sub ecx, 0xcb1b
call 0x406a7f
add byte [0x423d4f39], dh
dec edi
add esp, 4
jmp 0x406a8b
xor ecx, 0x3d08
pop ecx
mov edx, dword [ebp - 0x76c]
add edx, dword [ebp - 0x19c]
movsx eax, byte [edx]
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ebp + ecx - 0x878]
cmp eax, edx
jne 0x406abf
mov dword [ebp - 0xcb8], 0
jmp 0x406b2e
push edx
and edx, 0x11aeb
sub edx, 0x122a8
and edx, 0x14906
pop edx
push eax
push ebx
add esp, 4
xor eax, 0x846f
pop eax
push ebx
push eax
add esp, 4
add ebx, 0x4742
and ebx, 0x1664b
pop ebx
mov eax, dword [ebp - 0x76c]
add eax, dword [ebp - 0x19c]
movsx ecx, byte [eax]
or ecx, 0x20
mov edx, dword [ebp - 0x19c]
movsx eax, byte [ebp + edx - 0x878]
or eax, 0x20
cmp ecx, eax
jge 0x406b24
mov dword [ebp - 0xcb8], 0xffffffff
jmp 0x406b2e
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0
jne 0x406b45
mov ecx, dword [ebp - 0x198c]
mov dword [ebp - 0x510], ecx
jmp 0x406b56
jmp 0x40692f
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x510], edx
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x79c], eax
push edi
push ebx
add esp, 4
or edi, 0x3e82
pop edi
push ebx
call 0x406b7c
add byte [eax + 0x4d], al
inc eax
xor eax, 0xc4833e3c
add al, 0x81
retf
Function at 0x407920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
add esp, 4
sub eax, 0x119a
pop eax
push esi
push eax
add esp, 4
call 0x407940
add byte [ecx + 0x45], cl
inc ecx
cmp eax, dword [ebx + 0x36]
aas
dec eax
add esp, 4
pop esi
push edx
jmp 0x40794c
jmp 0x407951
pop edx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], edx
lea eax, [ebp - 0x1738]
push eax
call dword [ebp - 0x19b8]
test eax, eax
jne 0x4079b0
push edx
call 0x407980
add byte [esp + ecx*2], bh
inc edi
aas
push eax
cmp esi, dword [ebx]
xor al, 0x4d
inc ebx
add esp, 4
call 0x407992
add byte [eax + 0x3e], dl
inc eax
cmp edi, dword [edi]
xor eax, 0x833d3a35
les eax, [ecx + eax*4]
ret 0x7d68
push eax
push ebx
add esp, 4
sub eax, 0x38a4
pop eax
push edi
sub edi, 0x1193c
pop edi
push edx
push ebx
add esp, 4
sub edx, 0xc060
add edx, 0x116c
sub edx, 0x685d
or edx, 0x1408e
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push ecx
add ecx, 0x158d6
add ecx, 0x718b
or ecx, 0x172e5
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0x7f00
and ecx, 0x15b19
and ecx, 0xa1fb
sub ecx, 0xf5ac
pop ecx
cmp dword [ebp - 0x167c], 0
jne 0x407a54
mov dword [ebp - 0x2fc], 0
jmp 0x407cfb
mov edx, dword [ebp - 0x167c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]

Function at 0x407940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
add esp, 4
sub eax, 0x119a
pop eax
push esi
push eax
add esp, 4
call 0x407940
add byte [ecx + 0x45], cl
inc ecx
cmp eax, dword [ebx + 0x36]
aas
dec eax
add esp, 4
pop esi
push edx
jmp 0x40794c
jmp 0x407951
pop edx
mov edx, dword [ebp - 0x19b4]
mov dword [ebp - 0x19b8], edx
lea eax, [ebp - 0x1738]
push eax
call dword [ebp - 0x19b8]
test eax, eax
jne 0x4079b0
push edx
call 0x407980
add byte [esp + ecx*2], bh
inc edi
aas
push eax
cmp esi, dword [ebx]
xor al, 0x4d
inc ebx
add esp, 4
call 0x407992
add byte [eax + 0x3e], dl
inc eax
cmp edi, dword [edi]
xor eax, 0x833d3a35
les eax, [ecx + eax*4]
ret 0x7d68
push eax
push ebx
add esp, 4
sub eax, 0x38a4
pop eax
push edi
sub edi, 0x1193c
pop edi
push edx
push ebx
add esp, 4
sub edx, 0xc060
add edx, 0x116c
sub edx, 0x685d
or edx, 0x1408e
pop edx
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x19bc], ecx
mov edx, dword [ebp - 0x19bc]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x19c0], eax
mov ecx, dword [ebp - 0x19c0]
mov dword [ebp - 0x167c], ecx
push ecx
add ecx, 0x158d6
add ecx, 0x718b
or ecx, 0x172e5
pop ecx
push ecx
push ecx
add esp, 4
xor ecx, 0x7f00
and ecx, 0x15b19
and ecx, 0xa1fb
sub ecx, 0xf5ac
pop ecx
cmp dword [ebp - 0x167c], 0
jne 0x407a54
mov dword [ebp - 0x2fc], 0
jmp 0x407cfb
mov edx, dword [ebp - 0x167c]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]