joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408930
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
push 0
mov eax, dword [ebp + 8]
push eax
push 0x41223c
call fcn.00411380
add esp, 0xc
test eax, eax
jne 0x408988
lea ecx, [ebp - 0x1c]
push ecx
push 0
push 0x41220c
call fcn.004112e0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x408986
mov edx, dword [ebp - 0xc]
push edx
call fcn.00407a90
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.00411240
add esp, 4
jmp 0x408950
jmp 0x408939
push 0x10000
call fcn.00411210
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408b1f
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x401e10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x408a84
mov eax, dword [ebp - 0x26c]
and eax, 0x10
je 0x408a5c
mov dword [ebp - 8], 0
jmp 0x4089fa
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x22
jae 0x408a22
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x412168]
push eax
lea ecx, [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x408a20
jmp 0x408a5c
jmp 0x4089f1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x401e18
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00408930
add esp, 4
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4089dd
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x408b13
cmp dword [0x41226c], 0
je 0x408b13
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00411210
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
mov edx, dword [ebp + 8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0x401e1c
call fcn.00403030
add esp, 0xc
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00411240
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.00411240
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x408c20
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0x4000
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x13
push 0
push 2
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
jne 0x408cec
mov edx, dword [ebp - 8]
push edx
call fcn.00411210
add esp, 4
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x408ce3
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x408cd7
mov dword [ebp - 4], 0
jmp 0x408c8f
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jae 0x408cd5
mov eax, dword [ebp - 4]
shl eax, 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + eax + 0xc]
and edx, 2
je 0x408cbd
mov eax, dword [ebp - 4]
shl eax, 5
add eax, dword [ebp + 8]
push eax
call fcn.00408c20
add esp, 4
jmp 0x408cd3
mov ecx, dword [ebp - 4]
shl ecx, 5
mov edx, dword [ebp + 8]
mov eax, dword [edx + ecx + 0x14]
push eax
call fcn.00408930
add esp, 4
jmp 0x408c86
jmp 0x408c64
mov ecx, dword [ebp + 8]
push ecx
call fcn.00411240
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call sub.MPR.dll_WNetCloseEnum
mov esp, ebp
pop ebp
ret

Function at 0x408cf0
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call sub.NETAPI32.dll_NetShareEnum
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x408d41
cmp dword [ebp - 0xc], 0xea
jne 0x408e0e
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 1
jmp 0x408d59
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x10]
ja 0x408e05
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
je 0x408d7a
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0x80000000
jne 0x408df7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jle 0x408df7
push 0x401e34
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x408df7
push 0x401e44
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xe4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x401e4c
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0xe4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xe4]
push eax
call fcn.00408930
add esp, 4
mov ecx, dword [ebp - 4]
add ecx, 0xc
mov dword [ebp - 4], ecx
jmp 0x408d50
mov edx, dword [ebp - 0x14]
push edx
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0xc], 0xea
je 0x408d0e
mov esp, ebp
pop ebp
ret
Function at 0x408e20
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0xe
call fcn.00411210
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408e5b
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x401e50
mov edx, dword [ebp - 4]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x408e5f
xor al, al
jmp 0x408e97
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408e95
cmp dword [ebp - 0xc], 0
jl 0x408e95
jg 0x408e8f
cmp dword [ebp - 0x10], 0x1400000
jbe 0x408e95
mov al, 1
jmp 0x408e97
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x408ea0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0xe
call fcn.00411210
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408f95
push 0x401e58
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x401e64
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, 2
shl edx, 2
mov eax, dword [ebp - 4]
mov cx, word [ebp + 8]
mov word [eax + edx], cx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x408f89
cmp dword [ebp - 0xc], 5
je 0x408f89
movzx eax, word [ebp + 8]
push eax
call fcn.00408e20
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x408f89
cmp dword [ebp - 0xc], 4
je 0x408f36
mov edx, dword [ebp - 4]
push edx
call fcn.00408930
add esp, 4
jmp 0x408f89
mov dword [ebp - 0x10], 0x104
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.00411210
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408f89
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, 2
shl eax, 2
add eax, dword [ebp - 4]
push eax
call sub.MPR.dll_WNetGetConnectionW
test eax, eax
jne 0x408f7d
mov ecx, dword [ebp - 8]
push ecx
call fcn.00408930
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.00411240
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.00411240
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4026e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40277c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40275c
xor eax, eax
push ebp
push 0x402755
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402798
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40275c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x403f58
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x404110
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403fb9
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x40412c
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404026
xor eax, eax
push ebp
push 0x40401f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404008
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40414c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404026
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404107
cmp byte [ebp - 0xd], 0
jne 0x404068
cmp byte [ebp - 0x12], 0
je 0x404107
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404081
dec ebx
cmp byte [ebx], 0x2e
je 0x404090
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404080
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404107
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4040bd
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404107
cmp byte [ebp - 0xd], 0
je 0x404107
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404107
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4063a4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4064ae
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x4063f7
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.00403164
jmp 0x406495
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.00406358
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406378
mov ebx, eax
test esi, esi
je 0x40641f
dec esi
test esi, esi
jl 0x40641f
cmp edi, ebx
jne 0x4063fe
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.004031a4
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.004033f0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004031ec
cmp eax, 2
jl 0x406495
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406495
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004031ec
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406495
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004031ec
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.004033f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064b5
lea eax, [ebp - 0x110]
call fcn.00403080
ret

Function at 0x4065c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40662a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031a4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406631
lea eax, [ebp - 0x10c]
call fcn.00403080
ret

Function at 0x406638
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4066a2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031a4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4066a9
lea eax, [ebp - 0x10c]
call fcn.00403080
ret
Function at 0x4066b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40671a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.004031a4
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00406564
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406721
lea eax, [ebp - 0x10c]
call fcn.00403080
ret

Function at 0x406794
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40682c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x4067e1
mov eax, dword [ebx + 0x19]
call fcn.004033b0
push eax
push esi
mov eax, edi
call fcn.004033b0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033b0
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x406816
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.004033b0
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406128
mov eax, dword [ebp - 8]
call fcn.004033b0
push eax
mov eax, edi
call fcn.004033b0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033b0
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406833
lea eax, [ebp - 8]
call fcn.00403080
ret

Function at 0x406840
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x4068a7
mov byte [ebp - 0x800], 0
mov eax, dword [ebx + 0x19]
call fcn.004033b0
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, esi
call fcn.004033b0
push eax
mov eax, edi
call fcn.004033b0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033b0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x800]
mov ecx, 0x800
call fcn.004031d4
jmp 0x4068d8
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.00403118
mov eax, dword [ebx + 0x19]
call fcn.004033b0
push eax
mov eax, esi
call fcn.004033b0
push eax
mov eax, edi
call fcn.004033b0
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004033b0
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407fd0
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x407fdf
mov edx, dword [edx + 0x36]
jmp fcn.004031a4
mov ecx, dword [edx + 0x18]
jecxz 0x407fd7
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.0040351c
pop edx
mov ecx, dword [ebx]
jecxz 0x408007
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40dcfc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x40de12
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040262c
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
xor eax, eax
mov al, byte [edi + 0x3c]
mov word [ebp - 0x1c], ax
xor eax, eax
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov eax, ebx
call fcn.004031ec
test eax, eax
jle 0x40dd6c
mov eax, ebx
call fcn.004033b0
mov esi, eax
jmp 0x40dd6e
xor esi, esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push esi
push 0
push 0x4000000
push 0
push 0
push 0
push dword [ebp - 4]
push 0x40de2c
push dword [ebp - 8]
lea eax, [ebp - 0x64]
mov edx, 3
call fcn.004032ac
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.0040623c
mov eax, dword [ebp - 0x60]
call fcn.004033b0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
neg eax
sbb ebx, ebx
neg ebx
test bl, bl
je 0x40ddf7
mov eax, dword [ebp - 0x54]
mov dword [edi + 0x30], eax
cmp byte [ebp + 8], 0
je 0x40dde5
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WaitForSingleObject
lea eax, [edi + 0x2c]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40de19
lea eax, [ebp - 0x64]
mov edx, 2
call fcn.004030a4
ret

Function at 0x40df9c
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
je 0x40e001
mov byte [ebx + 0x28], 0
push 0
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x14]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x1c]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebx + 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebx + 4], eax
pop ebx
ret
Function at 0x40ec9c
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd8
mov ebx, edx
push esp
push 0xf00ff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov dword [esp + 8], 1
test bl, bl
je 0x40eccb
mov dword [esp + 0x14], 2
jmp 0x40ecd1
xor eax, eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x40ed24
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
xor eax, eax
mov dword [esp + 4], eax
lea esi, [esp + 8]
lea edi, [esp + 0x18]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x10
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle_1
add esp, 0x28
pop edi
pop esi
pop ebx
ret

Function at 0x40ed38
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 1
push esi
call sub.kernel32.dll_TerminateProcess
neg eax
sbb ebx, ebx
neg ebx
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x40fa10
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, 0x200
call fcn.0040351c
push 0x200
mov eax, esi
call fcn.004033bc
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_GetWindowTextA
mov edx, eax
mov eax, esi
call fcn.0040351c
lea eax, [ebx + 4]
mov edx, 0x200
call fcn.0040351c
push 0x200
lea eax, [ebx + 4]
call fcn.004033bc
push eax
mov eax, dword [ebx + 0xc]
push eax
call sub.user32.dll_GetClassNameA
mov edx, eax
lea eax, [ebx + 4]
call fcn.0040351c
pop esi
pop ebx
ret