joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408040
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x49ece8]
push esi
mov esi, dword [ebp + 8]
test ecx, ecx
jne 0x40821f
push 0x208
push ecx
lea eax, [ebp - 0x414]
push eax
call fcn.0044f9d0
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0044f9d0
push 0xffffffffffffffff
push 0x489344
lea eax, [ebp - 0x414]
push eax
push str._s_s
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.004082b0
add esp, 0x24
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x408101
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408189
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x408189
push edi
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x408188
push pe_nt_image_headers32
lea eax, [ebp - 0x640]
push 0
push eax
call fcn.0044f9d0
add esp, 0xc
mov dword [ebp - 0x644], 0x114
lea eax, [ebp - 0x644]
push eax
call edi
mov eax, dword [ebp - 0x640]
test eax, eax
je 0x408188
mov dword [0x49ece8], eax
mov eax, dword [ebp - 0x63c]
mov dword [0x49ecd8], eax
mov eax, dword [ebp - 0x638]
mov dword [0x49ece0], eax
mov eax, dword [ebp - 0x634]
mov dword [0x49ece4], eax
lea eax, [ebp - 0x630]
push 0xffffffffffffffff
push eax
push 0x104
push 0x49ead0
call fcn.0045b791
add esp, 0x10
pop edi
push 0x118
lea eax, [ebp - 0x52c]
push 0
push eax
call fcn.0044f9d0
add esp, 0xc
mov dword [ebp - 0x530], 0x11c
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [0x49ece8]
test eax, eax
je 0x40821f
test ecx, ecx
jne 0x4081f1
mov eax, dword [ebp - 0x528]
mov ecx, dword [ebp - 0x52c]
mov dword [0x49ecd8], eax
mov eax, dword [ebp - 0x524]
mov dword [0x49ece0], eax
mov eax, dword [ebp - 0x520]
mov dword [0x49ece8], ecx
mov dword [0x49ece4], eax
cmp byte [0x49ecde], 0
jne 0x40821f
movzx eax, word [ebp - 0x41a]
mov word [0x49eacc], ax
movzx eax, word [ebp - 0x41c]
mov word [0x49ecdc], ax
mov al, byte [ebp - 0x416]
mov byte [0x49ecde], al
test esi, esi
je 0x408225
mov dword [esi], ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004363c8
mov esp, ebp
pop ebp
ret 0x24
Function at 0x40b9e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4735dc
mov eax, dword fs:[0]
push eax
mov eax, dword [0x498070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x49eddc]
cmp eax, dword [ecx + 4]
jle 0x40ba72
push 0x49eddc
call fcn.004367cf
add esp, 4
cmp dword [0x49eddc], 0xffffffff
jne 0x40ba72
push 0xa4
push 0
push 0x49ed38
mov dword [ebp - 4], 0
call fcn.0044f9d0
add esp, 0xc
mov ecx, 0x49ed38
push 0
call fcn.004054d0
push 0x478e60
call fcn.0043665f
push 0x49eddc
mov dword [ebp - 4], 0xffffffff
call fcn.00436790
add esp, 8
push 0x49e128
push 0x40bac0
push 0x4894e0
mov ecx, 0x49ed38
call fcn.00405820
push 0
push 0
push 0x49ed38
push 0x405d80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x49ed3c], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x40ded0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64c
mov eax, dword [0x498070]
xor eax, esp
mov dword [esp + 0x648], eax
push esi
push 0x208
lea eax, [esp + 0x34]
mov esi, ecx
push 0
push eax
call fcn.0044f9d0
add esp, 0xc
lea eax, [esp + 0x30]
push 0x208
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
je 0x40df93
mov ecx, str.WorkerW
lea eax, [esp + 0x30]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40df46
test dx, dx
je 0x40df42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40df46
add eax, 4
add ecx, 4
test dx, dx
jne 0x40df20
xor eax, eax
jmp 0x40df4b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e065
mov ecx, str.CabinetWClass
lea eax, [esp + 0x30]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40df86
test dx, dx
je 0x40df82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40df86
add eax, 4
add ecx, 4
test dx, dx
jne 0x40df60
xor eax, eax
jmp 0x40df8b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e065
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x40e065
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp esi, eax
je 0x40e065
mov ecx, esi
call fcn.0040e2d0
test eax, eax
je 0x40e065
push 2
push esi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [esp + 8]
mov dword [esp + 8], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [esp + 0x18]
mov ecx, esi
mov edx, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
sub edx, dword [esp + 0xc]
push eax
call fcn.0040de70
add esp, 4
test al, al
je 0x40e065
push 0x208
lea eax, [esp + 0x444]
push 0
push eax
call fcn.0044f9d0
add esp, 0xc
lea eax, [esp + 0x238]
push 0x208
push 0
push eax
call fcn.0044f9d0
add esp, 0xc
lea eax, [esp + 0x238]
push 0x104
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x104
lea eax, [esp + 0x444]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov al, 1
pop esi
mov ecx, dword [esp + 0x648]
xor ecx, esp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x64c]
xor al, al
pop esi
xor ecx, esp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x40e110
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x24
push eax
push 4
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
cmp eax, 1
jne 0x40e155
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
push str.TopGuide
push str.Qt5QWindowToolSaveBits
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x40e143
mov dword [ebp - 0x118], eax
xor bl, bl
lea eax, [ebp - 0x118]
push eax
push 0x40e080
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x118], 0
jne 0x40e2af
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x40e2b1
call dword [sym.imp.USER32.dll_GetShellWindow]
cmp edi, eax
je 0x40e2b1
lea eax, [ebp - 0xe0]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0xf0]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0xf0]
jg 0x40e2b1
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xec]
jg 0x40e2b1
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0xe8]
jl 0x40e2b1
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xe4]
jl 0x40e2b1
push 0xc8
lea eax, [ebp - 0xd0]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jle 0x40e2af
mov ecx, str.WorkerW
lea eax, [ebp - 0xd0]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e266
test dx, dx
je 0x40e262
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e266
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e240
xor eax, eax
jmp 0x40e26b
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e2b1
mov ecx, str.CabinetWClass
lea eax, [ebp - 0xd0]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40e2a6
test dx, dx
je 0x40e2a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40e2a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x40e280
xor eax, eax
jmp 0x40e2ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x40e2b1
mov bl, 1
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
xor ecx, ebp
pop ebx
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x40e330
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
mov dword [ebp - 0x238], 0
push 2
mov ebx, edx
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e3a8
xor eax, eax
mov dword [esi + 0x14], 7
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x488060
mov word [esi], ax
call fcn.00402db0
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x40e3da
nop word [eax + eax]
cmp dword [ebp - 0x228], ebx
je 0x40e400
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40e3c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x488060
mov ecx, esi
call fcn.00402c30
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004363c8
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x20c]
push eax
jmp 0x40e3e6
Function at 0x40e410
Capabilities:
Get process image filename
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47392b
mov eax, dword fs:[0]
push eax
sub esp, 0x288
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov eax, ecx
mov dword [ebp - 0x290], eax
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x40
mov esi, eax
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.0044f9d0
push 0xa
push 0x20
lea eax, [ebp - 0x54]
push eax
push esi
call fcn.0045ba53
add esp, 0x1c
test ebx, ebx
je 0x40e58e
push 0x208
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.0044f9d0
add esp, 0xc
lea eax, [ebp - 0x25c]
push 0x104
push eax
push 0
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
test eax, eax
je 0x40e4e2
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x104
push eax
push 0x104
push edi
call fcn.0045b791
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e5fb
push 0x104
push edi
push ebx
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
push edi
lea ecx, [ebp - 0x28c]
call fcn.00402c30
push 1
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28c]
call fcn.004121d0
cmp eax, 0xffffffff
je 0x40e567
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.00410ef0
push eax
lea ecx, [ebp - 0x28c]
call fcn.00409040
lea ecx, [ebp - 0x274]
call fcn.00402bf0
cmp dword [ebp - 0x278], 8
lea eax, [ebp - 0x28c]
cmovae eax, dword [ebp - 0x28c]
push eax
push 0x104
push edi
call fcn.0045ba88
add esp, 0xc
mov eax, dword [ebp - 0x278]
cmp eax, 8
jb 0x40e585
inc eax
lea ecx, [ebp - 0x28c]
push eax
push dword [ebp - 0x28c]
call fcn.00403140
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e5fb
mov edx, dword [ebp - 0x290]
lea ecx, [ebp - 0x274]
call fcn.0040e330
cmp dword [ebp - 0x260], 8
lea eax, [ebp - 0x274]
cmovae eax, dword [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x260], 8
lea eax, [ebp - 0x274]
cmovae eax, dword [ebp - 0x274]
push eax
push 0x104
push edi
call fcn.0045ba88
mov eax, dword [ebp - 0x260]
add esp, 0xc
cmp eax, 8
jb 0x40e5fb
inc eax
lea ecx, [ebp - 0x274]
push eax
push dword [ebp - 0x274]
call fcn.00403140
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x40e760
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov edi, edx
cmp dword [esi + 0x14], 8
jb 0x40e776
mov eax, dword [esi]
jmp 0x40e778
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40e793
push str.MicrosoftEdge.exe
mov ecx, esi
call fcn.0040cbc0
test eax, eax
jne 0x40e7e2
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], 0
jb 0x40e7a4
mov eax, dword [esi]
jmp 0x40e7a6
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea edx, [ebp - 4]
mov ecx, eax
call fcn.004131b0
test al, al
je 0x40e7e2
push str.MicrosoftEdge.exe
mov ecx, esi
call fcn.0040cbc0
test eax, eax
jne 0x40e7d8
mov ecx, edi
call fcn.0040f160
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov edx, edi
call fcn.0040f0e0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40e8e0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x49cca4]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], eax
push edi
mov edi, edx
cmp dword [esi + 0x14], 8
jb 0x40e8ff
mov eax, dword [esi]
jmp 0x40e901
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, eax
mov ecx, ebx
call fcn.0040e6c0
test al, al
jne 0x40e973
cmp dword [esi + 0x14], 8
jb 0x40e91f
mov ecx, dword [esi]
jmp 0x40e921
mov ecx, esi
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e973
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
mov ecx, ebx
call fcn.004131b0
test al, al
je 0x40e950
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.0040ed00
test al, al
jne 0x40e973
cmp dword [edi + 0x14], 8
jb 0x40e958
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x40e960
mov esi, dword [esi]
push 5
push 0
push edi
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e980
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x268
mov eax, dword [0x498070]
xor eax, esp
mov dword [esp + 0x264], eax
push ebx
push esi
push 0x208
lea eax, [esp + 0x64]
mov esi, ecx
push 0
push eax
call fcn.0044f9d0
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x40e9ba
mov esi, dword [esi]
push esi
lea eax, [esp + 0x64]
push str.microsoft_edge:_s
push eax
call fcn.004128f0
add esp, 0xc
push str.TopGuide
push str.Qt5QWindowToolSaveBits
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40e9ef
cmp dword [0x49cc74], 0
mov eax, 3
je 0x40e9f4
mov eax, 5
xor ebx, ebx
cmp eax, 3
push 0x38
setne bl
lea eax, [esp + 0x14]
push 0
push eax
lea ebx, [ebx*2 + 3]
call fcn.0044f9d0
add esp, 0xc
mov dword [esp + 0xc], 0x3c
lea eax, [esp + 0x60]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x11
xor eax, eax
mov dword [esp + 0x60], 7
push str.MicrosoftEdge.exe
lea ecx, [esp + 0x50]
mov dword [esp + 0x60], 0
mov word [esp + 0x50], ax
call fcn.00402db0
mov edx, ebx
lea ecx, [esp + 0x48]
call fcn.0040e760
mov eax, dword [esp + 0x5c]
cmp eax, 8
jb 0x40ea7d
inc eax
lea ecx, [esp + 0x48]
push eax
push dword [esp + 0x4c]
call fcn.00403140
mov ecx, dword [esp + 0x26c]
pop esi
pop ebx
xor ecx, esp
call fcn.004363c8
mov esp, ebp
pop ebp
ret

Function at 0x40f0e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
xor esi, esi
push 0x32
call ebx
mov eax, esi
inc esi
cmp eax, 0x3c
jg 0x40f13b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], 0
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x40f030
mov dword [ebp - 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x40f103
jmp 0x40f13f
test edi, edi
je 0x40f149
push dword [ebp - 0x14]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004363c8
mov esp, ebp
pop ebp
ret

Function at 0x40f160
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], ecx
xor esi, esi
push 0x32
call ebx
mov eax, esi
inc esi
cmp eax, 0x28
jg 0x40f1b9
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
push 0x40eec0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [ebp - 0xc]
test edi, edi
je 0x40f180
jmp 0x40f1bd
test edi, edi
je 0x40f1c7
push dword [ebp - 0x10]
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x40f1e0
Capabilities:
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xc
push 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x20001
push eax
mov dword [ebp - 0x18], 0x100
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0x60001
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x410c90
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.a86320b968ba47d39e2d6d8caa4c8573
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410d02
cmp dword [0x49dd4c], 8
lea edx, [ebp - 4]
mov ecx, 0x49dd38
cmovae ecx, dword [0x49dd38]
call fcn.00426980
test al, al
je 0x410d02
push dword [ebp - 4]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x410d02
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4126b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4737c6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x498070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.004363d9
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043436f
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4737c6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x498070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004363d9
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0043436f
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4131b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov edi, ecx
mov dword [ebp - 0x230], 0x22c
push 2
mov ebx, edx
mov dword [ebp - 0x234], edi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4132c4
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
lea ecx, [ebp - 0x20c]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41322b
test dx, dx
je 0x413227
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41322b
add eax, 4
add ecx, 4
test dx, dx
jne 0x413205
xor eax, eax
jmp 0x413230
sbb eax, eax
or eax, 1
test eax, eax
jne 0x413253
test ebx, ebx
je 0x413240
mov eax, dword [ebp - 0x228]
mov dword [ebx], eax
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
je 0x4132bd
nop word [eax + eax]
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x20c]
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x4132a6
test dx, dx
je 0x4132a2
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x4132a6
add ecx, 4
add eax, 4
test dx, dx
jne 0x413280
xor eax, eax
jmp 0x4132ab
sbb eax, eax
or eax, 1
test eax, eax
je 0x413234
lea eax, [ebp - 0x230]
push eax
push esi
call edi
test eax, eax
jne 0x413270
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004363c8
mov esp, ebp
pop ebp
ret
Function at 0x4132e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x473e08
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x498070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push 0x40
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x70], 0x44
push 0
push eax
call fcn.0044f9d0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], 0
add esp, 0xc
mov word [ebp - 0x28], ax
movups xmmword [ebp - 0x80], xmm0
push 1
push 0x489b74
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
call fcn.00413840
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.00413970
push 1
push 0x489b74
lea ecx, [ebp - 0x28]
call fcn.00413840
push 1
push 0x489b78
lea ecx, [ebp - 0x28]
call fcn.00413840
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x28]
call fcn.00413970
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4133c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x4133c3
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x4133d8
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00403140
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004363c8
mov esp, ebp
pop ebp
ret