joyce8/EMBER2024-capa huggingface dataset:
Function at 0x552340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
mov ebx, esi
and ebx, 0x100
mov eax, esi
and eax, 0xfffffeff
push ebx
push esi
push eax
push ebx
push eax
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
imul ebx, esi
xor ecx, ecx
cmp ebx, esi
je 0x552383
or ebx, esi
mov eax, ebx
imul eax, esi
imul ebx, eax
or ebx, eax
movsx ecx, bl
mov ebx, eax
mov edi, ecx
xor edi, esi
push ebx
mov esi, ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
imul esi, edi
mov dword [ebp - 0x10], esi
mov ecx, esi
mov esi, dword [ebp + 8]
movsx ecx, cl
sub ecx, esi
cmp esi, 0xaec9ea02
jne 0x5523db
cmp ebx, 0xaec9ea02
je 0x5523db
mov eax, edi
imul ecx, ebx
lea edx, [ecx + edi - 0x513615fe]
add ecx, 0xaec9ea02
mov dword [ebp - 0x14], edx
imul eax, edx
mov dword [ebp - 0x18], eax
mov edx, eax
add dl, 0xc9
mov eax, edx
mul bl
mov ebx, edx
mov dword [ebp - 0x10], eax
jmp 0x5523db
movsx edi, bl
xor eax, eax
cmp edi, esi
jl 0x552412
cmp ecx, esi
je 0x552412
push esi
push ecx
push esi
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [ebp - 0x10]
add al, bl
movzx eax, al
imul eax, eax, 0xffffffe3
mov ecx, dword [ebp - 0x18]
xor ecx, eax
shl ecx, 0x18
add ecx, 0x2a000000
sar ecx, 0x18
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x554210
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, ecx
shl esi, 0x18
add esi, 0xac000000
mov edx, esi
sar edx, 0x18
and edx, ecx
cmp edx, eax
jl 0x55424b
imul esi, edx
sar esi, 0x18
lea edi, [esi + ecx]
push eax
push edi
push ecx
push eax
push edi
push ecx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
imul esi, edi
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x559f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1ec
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0x10
push dword [ebp + 8]
push eax
call fcn.0055e930
add esp, 0xc
mov esi, dword [ebp - 0x1c]
push 0xfa10ba15
push edi
call fcn.005520a0
add esp, 8
xor eax, esi
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
mov esi, ebx
not esi
push 0x1881
call fcn.00559ba0
add esp, 4
and eax, esi
and ebx, 0xffffe7d2
mov esi, edi
or ebx, eax
not esi
push 0x1881
call fcn.00559ba0
add esp, 4
push eax
push esi
call fcn.00554ec0
add esp, 8
mov ecx, edi
and ecx, 0xffffe7d2
push ecx
push eax
call fcn.00556720
add esp, 8
xor eax, ebx
shr edi, 0x10
xor ebx, ebx
xor esi, esi
mov word [ebp - 0x18], ax
xor word [ebp - 0x16], di
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebp + ebx + 0x10]
xor byte [ebp + esi - 0x14], al
push 0x6acce6e1
call fcn.00559d50
add esp, 4
sub ebx, eax
add ebx, 0xeb8e64e
cmp ebx, 4
cmove ebx, edi
inc esi
push 0x647400a4
call fcn.00559d50
add esp, 4
cmp esi, eax
jne 0x55a000
mov eax, dword [ebp + 0x18]
lea ebx, [ebp - 0x1c]
test eax, eax
je 0x55a061
lea esi, [ebp - 0x1f8]
push 0x102
push eax
push esi
call fcn.0055e930
add esp, 0xc
push esi
push 0x10
push ebx
call fcn.0056d1d0
add esp, 0xc
mov al, byte [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
cmp al, 2
je 0x55a07b
cmp al, 1
jne 0x55a0a3
mov esi, 6
mov eax, 0x571088
jmp 0x55a085
mov esi, 7
mov eax, str.__v_9A
lea ecx, [ebp - 0xf4]
push ecx
push eax
call fcn.00557200
add esp, 8
push esi
push eax
push edi
call fcn.00567700
add esp, 0xc
lea edi, [edi + esi*2]
push 0xd3a1832
push 0xc
call fcn.0055bf50
add esp, 8
push 0x28
push edi
push ebx
call eax
add esp, 0x1ec
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5676c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
push 0xc6d154
push 0
call fcn.0055bf50
add esp, 8
call eax
mov esi, eax
push dword [0x573674]
push eax
call fcn.005555c0
add esp, 8
test al, 1
jne 0x5676f9
mov dword [0x573674], esi
push esi
call fcn.0056d4a0
add esp, 4
pop esi
pop ebp
jmp fcn.00565bf0
Function at 0x569420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
xor esi, esi
xor ebx, ebx
mov word [eax + 0x100], 0
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 0x10]
mov byte [eax + esi], bl
push 0x3aab9f03
call fcn.00559d50
add esp, 4
lea eax, [esi + eax + 1]
push 0x5edf9faf
push eax
call fcn.005522e0
add esp, 8
mov edi, eax
push 1
push esi
call fcn.00551460
add esp, 8
push 0x5f1f
call fcn.00559ba0
add esp, 4
sub ebx, eax
add ebx, 0x5fb4
push 0x647401ac
call fcn.00559d50
add esp, 4
cmp edi, eax
mov esi, edi
jne 0x569440
movzx eax, word [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edx, 0xffffff00
xor ebx, ebx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
movzx ecx, bl
mov dword [ebp - 0x18], edx
movzx edx, byte [esi + edx + 0x100]
mov dword [ebp - 0x20], ecx
movzx eax, byte [eax + ecx]
mov dword [ebp - 0x14], edx
push eax
push 0
call fcn.005522e0
add esp, 8
mov esi, dword [ebp - 0x10]
sub esi, eax
push 0x8702cf33
call fcn.00559d50
add esp, 4
push eax
push esi
call fcn.00551460
add esp, 8
mov esi, eax
add esi, dword [ebp - 0x14]
push 0x8702cf33
call fcn.00559d50
add esp, 4
sub esi, eax
push 0x8cba519
call fcn.00559d50
add esp, 4
or eax, 0xb5
xor eax, 0x4a
and eax, esi
movzx edi, al
push 0x64740053
call fcn.00559d50
add esp, 4
push eax
push esi
mov esi, dword [ebp + 0x10]
call fcn.00553750
add esp, 8
movzx eax, byte [esi + edi]
mov ecx, dword [ebp - 0x18]
inc bl
mov dword [ebp - 0x10], edi
mov byte [esi + ecx + 0x100], al
mov eax, dword [ebp - 0x14]
mov byte [esi + edi], al
push 1
push dword [ebp - 0x20]
call fcn.00554f40
mov edx, dword [ebp - 0x18]
add esp, 8
movzx ebx, bl
mov eax, 0
cmp ebx, dword [ebp - 0x1c]
cmove ebx, eax
inc edx
jne 0x5694c0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x56cc50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov eax, dword [ebp + 0xc]
push 0
push eax
call fcn.005555c0
add esp, 8
test al, 1
jne 0x56cd06
mov edi, 0xffffffff
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push 0x647400a4
call fcn.00559d50
add esp, 4
mov ecx, eax
mov eax, dword [ebp + 8]
mov ebx, edi
shr ebx, cl
movzx eax, byte [eax + esi]
mov dword [ebp - 0x10], eax
push 0x64740053
call fcn.00559d50
add esp, 4
not eax
push eax
push edi
call fcn.005520a0
add esp, 8
and eax, edi
mov edi, ebx
mov ecx, dword [ebp + 0xc]
xor eax, dword [ebp - 0x10]
mov ebx, ecx
xor edi, dword [eax*4 + 0x572204]
push 0x276ea34
push esi
call fcn.00551460
add esp, 8
push 1
push eax
call fcn.00551460
add esp, 8
mov esi, eax
add esi, 0xfd8915cc
cmp esi, ebx
jne 0x56cc80
push 0xffffffffffffffff
push edi
call fcn.005520a0
add esp, 8
push eax
push 0xffffffffffffffff
call fcn.00553750
add esp, 0xc
jmp 0x56cd0b
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x56cea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 2
jb 0x56cec8
mov ecx, dword [esp + 4]
dec eax
mov dl, byte [ecx]
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor dl, byte [ecx]
mov byte [ecx], dl
inc ecx
dec eax
jne 0x56cec0
ret

Function at 0x56d1d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov cl, byte [esi + 0x100]
mov bl, byte [esi + 0x101]
test eax, eax
je 0x56d292
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, cl
inc cl
mov dword [ebp - 0x18], edi
mov byte [ebp - 0xd], cl
push 1
push eax
call fcn.00554f40
add esp, 8
movzx edi, byte [ebp - 0xd]
movzx eax, bl
movzx ecx, byte [esi + edi]
mov bh, cl
mov dword [ebp - 0x14], ecx
add bh, bl
push eax
push ecx
call fcn.00554f40
add esp, 8
movzx eax, bh
movzx ecx, byte [esi + eax]
mov byte [esi + edi], cl
mov ecx, dword [ebp - 0x14]
mov byte [esi + eax], cl
movzx eax, byte [esi + edi]
mov edi, dword [ebp - 0x18]
push ecx
push eax
call fcn.00551460
add esp, 8
push 0xff
push eax
call fcn.00553750
add esp, 8
movzx eax, byte [esi + eax]
mov ecx, dword [ebp + 8]
xor byte [ecx + edi], al
push 0x2f385aaa
call fcn.00559d50
movzx ecx, byte [ebp - 0xd]
add esp, 4
mov edx, dword [ebp + 0xc]
lea edi, [edi + eax - 0x4b4c5a05]
mov bl, bh
cmp edi, edx
jne 0x56d200
jmp 0x56d294
mov bh, bl
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], bh
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x56d4a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 8]
mov esi, 1
mov dword [0x574194], 1
mov dword [0x5737d4], edi
nop
nop
mov ebx, edi
shr ebx, 0x1e
mov eax, ebx
not eax
push eax
push edi
call fcn.00553750
add esp, 8
not edi
and edi, ebx
or edi, eax
imul edi, edi, 0x6c078965
push esi
push edi
add edi, esi
call fcn.00551460
add esp, 8
mov dword [esi*4 + 0x5737d4], edi
push 0xcaf2d6c5
push esi
call fcn.00551460
add esp, 8
push 1
push eax
call fcn.00551460
add esp, 8
mov esi, eax
add esi, 0x350d293b
cmp esi, 0x270
jne 0x56d4c0
mov dword [0x574194], 0x270
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x56d770
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
lea eax, [ebp - 0x12]
push eax
push 0x5705f8
call fcn.00557200
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x14
pop ebp
jmp dword [sym.imp.USER32.dll_GetCapture]
Function at 0x56d7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
test eax, eax
setne dl
test esi, esi
setne ch
test edi, edi
setne cl
and ch, dl
mov edx, ecx
xor dl, ch
jne 0x56d8a5
or cl, ch
je 0x56d8a5
test edi, edi
jle 0x56d8a3
mov edi, dword [0x572004]
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [eax + ecx]
mov dword [ebp - 0x10], ecx
push edi
push ebx
xor ebx, edi
call fcn.00552fe0
add esp, 8
mov eax, dword [ebp - 0x10]
mov byte [esi + eax], bl
push 0x647400a4
call fcn.00559d50
add esp, 4
mov ecx, eax
mov ebx, edi
shl ebx, cl
push 0x647400b4
call fcn.00559d50
add esp, 4
mov ecx, eax
shr edi, cl
mov eax, edi
and eax, ebx
mov dword [ebp - 0x14], eax
push edi
push ebx
call fcn.005520a0
add esp, 8
mov esi, eax
or esi, dword [ebp - 0x14]
push edi
push ebx
mov eax, dword [ebp + 0xc]
mov edi, eax
call fcn.00552dc0
mov ecx, dword [ebp - 0x10]
add esp, 8
inc esi
inc ecx
mov eax, dword [ebp + 8]
cmp edi, ecx
mov edi, esi
mov esi, dword [ebp + 0x10]
jne 0x56d830
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4026f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40278c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40276c
xor eax, eax
push ebp
push 0x402765
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4027a8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40276c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404578
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404730
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4045d9
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40474c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404646
xor eax, eax
push ebp
push 0x40463f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404628
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40476c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404646
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404727
cmp byte [ebp - 0xd], 0
jne 0x404688
cmp byte [ebp - 0x12], 0
je 0x404727
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4046a1
dec ebx
cmp byte [ebx], 0x2e
je 0x4046b0
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4046a0
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404727
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4046dd
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404727
cmp byte [ebp - 0xd], 0
je 0x404727
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404727
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40691c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406a26
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40696f
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.0040321c
jmp 0x406a0d
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.004068d0
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004068f0
mov ebx, eax
test esi, esi
je 0x406997
dec esi
test esi, esi
jl 0x406997
cmp edi, ebx
jne 0x406976
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004032ec
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.0040354c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403348
cmp eax, 2
jl 0x406a0d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406a0d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403348
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406a0d
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403348
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.0040354c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2d
lea eax, [ebp - 0x110]
call fcn.00403138
ret

Function at 0x406a84
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406b1c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x406ad1
mov eax, dword [ebx + 0x19]
call fcn.0040350c
push eax
push esi
mov eax, edi
call fcn.0040350c
push eax
mov eax, dword [ebx + 0x1d]
call fcn.0040350c
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x406b06
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.0040350c
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406790
mov eax, dword [ebp - 8]
call fcn.0040350c
push eax
mov eax, edi
call fcn.0040350c
push eax
mov eax, dword [ebx + 0x1d]
call fcn.0040350c
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406b23
lea eax, [ebp - 8]
call fcn.00403138
ret
Function at 0x407bb4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
call fcn.004097fc
test eax, eax
je 0x407bd0
cmp dword [eax + 0x155], ebx
jne 0x407bd0
xor edx, edx
mov dword [eax + 0x155], edx
mov ecx, dword [ebx + 0x18]
jecxz 0x407bdd
push 0
push ecx
call sub.user32.dll_ShowWindow
mov eax, ebx
call fcn.00405914
mov eax, ebx
call fcn.004093a4
xor ecx, ecx
cmp byte [ebx + 0x8a], cl
jne 0x407d4b
xchg byte [ebx + 0xfb], cl
jecxz 0x407c0c
mov eax, dword [ebx + 0xf6]
call fcn.00402534
inc byte [ebx + 0x8a]
mov eax, dword [ebx + 0x10a]
call fcn.004058f8
mov eax, dword [ebx + 0x112]
call fcn.004058f8
mov eax, dword [ebx + 0x40]
call fcn.004058f8
xor ecx, ecx
mov dword [ebx + 0x10a], ecx
mov dword [ebx + 0x112], ecx
mov dword [ebx + 0x40], ecx
xchg dword [ebx + 0x52b], ecx
jecxz 0x407c4f
xchg ecx, eax
call fcn.00402534
mov eax, dword [ebx + 0x52f]
call fcn.004058f8
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x407ccc
xor ecx, ecx
xchg dword [ebx + 0x93], ecx
jecxz 0x407c71
push ecx
call sub.user32.dll_DestroyAcceleratorTable
mov eax, dword [ebx + 0x8f]
call fcn.004058f8
mov eax, dword [ebx + 0x97]
test eax, eax
je 0x407c8d
call fcn.004058f8
jmp 0x407c7c
push dword [ebx + 0x18]
call sub.user32.dll_IsWindow
test eax, eax
je 0x407cc7
push eax
push 1
push 0x80
push dword [ebx + 0x18]
call sub.user32.dll_SendMessageA
test eax, eax
je 0x407cb9
cmp byte [ebx + 0x35], 0
jne 0x407cb9
push eax
call sub.user32.dll_DestroyIcon
cmp byte [ebx + 0x48], 0
jne 0x407cc7
push dword [ebx + 0x18]
call sub.user32.dll_DestroyWindow
xor eax, eax
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x36]
test eax, eax
je 0x407cd8
call fcn.00402534
mov eax, dword [ebx + 0x26d]
test eax, eax
je 0x407ce7
call fcn.00402534
mov ecx, dword [ebx + 0x49]
jecxz 0x407d06
cmp dword [ecx + 0x155], ebx
jne 0x407cfc
xor eax, eax
mov dword [ecx + 0x155], eax
mov eax, dword [ecx + 0x60]
mov edx, ebx
call fcn.00405a60
mov ecx, dword [ebx + 0x79]
jecxz 0x407d11
push ecx
call sub.gdi32.dll_DeleteObject
push ebx
push dword [ebx + 0x60]
push dword [ebx + 0x568]
push dword [ebx + 0x56c]
push dword [ebx + 0x2f5]
push dword [ebx + 0xcb]
mov bl, 5
pop eax
call fcn.004058f8
dec bl
jne 0x407d2f
pop ebx
lea eax, [ebx + 0x4fb]
call fcn.00403138
xchg ebx, eax
call fcn.00405904
pop ebx
ret
Function at 0x408d6c
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x408d7b
mov edx, dword [edx + 0x36]
jmp fcn.004032ec
mov ecx, dword [edx + 0x18]
jecxz 0x408d73
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.0040361c
pop edx
mov ecx, dword [ebx]
jecxz 0x408da3
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret
Function at 0x4010fa
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp word [eax], 0x5a4d
jne 0x401209
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
jne 0x401209
mov edi, 0x2000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push edi
push dword [esi + 0x50]
push dword [esi + 0x34]
call ebx
test eax, eax
mov dword [ebp - 4], eax
jne 0x401152
push 4
push edi
push dword [esi + 0x50]
push eax
call ebx
test eax, eax
mov dword [ebp - 4], eax
je 0x401209
push 0x14
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov eax, dword [ebp - 4]
xor ecx, ecx
push 4
push 0x1000
mov dword [edi + 4], eax
mov dword [edi + 0xc], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x10], ecx
push dword [esi + 0x50]
push eax
call ebx
push 4
push 0x1000
push dword [esi + 0x54]
push dword [ebp - 4]
call ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebx + 0x3c]
add ecx, dword [esi + 0x54]
push ecx
push ebx
push eax
call fcn.004010d2
mov eax, dword [ebx + 0x3c]
mov ecx, dword [ebp - 8]
add eax, ecx
mov ecx, dword [ebp - 4]
push edi
push esi
mov dword [edi], eax
push ebx
mov dword [eax + 0x34], ecx
call fcn.00401217
mov ebx, dword [ebp - 4]
add esp, 0x18
mov eax, ebx
sub eax, dword [esi + 0x34]
je 0x4011d4
push eax
push edi
call fcn.00401399
pop ecx
pop ecx
push edi
call fcn.00401413
test eax, eax
pop ecx
je 0x401202
push edi
call fcn.004012c4
mov eax, dword [edi]
pop ecx
mov eax, dword [eax + 0x28]
test eax, eax
je 0x401210
add eax, ebx
test eax, eax
je 0x401202
push 0
push 1
pop esi
push esi
push ebx
call eax
test eax, eax
jne 0x40120d
push edi
call fcn.00401599
pop ecx
xor eax, eax
jmp 0x401212
mov dword [edi + 0x10], esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401217
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push esi
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 8], ecx
movzx ecx, word [eax + 0x14]
cmp word [eax + 6], 0
lea esi, [ecx + eax + 0x18]
jbe 0x4012c1
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
add esi, 0x10
mov ebx, 0x1000
cmp dword [esi], 0
jne 0x401282
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x38]
test eax, eax
mov dword [ebp - 0xc], eax
jle 0x4012ab
push 4
push ebx
push eax
mov eax, dword [esi - 4]
add eax, dword [ebp - 8]
push eax
call edi
push dword [ebp - 0xc]
mov dword [esi - 8], eax
push 0
push eax
call fcn.0040e4b0
add esp, 0xc
jmp 0x4012ab
mov eax, dword [esi - 4]
push 4
add eax, dword [ebp - 8]
push ebx
push dword [esi]
push eax
call edi
mov ecx, dword [esi + 4]
push dword [esi]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push ecx
push eax
call fcn.004010d2
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov dword [esi - 8], eax
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
add esi, 0x28
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 4], eax
jl 0x401250
pop edi
pop ebx
pop esi
leave
ret