joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012500
Capabilities:
Delete file
Get common file path
Set registry value

Disassembly:
call fcn.10012240
test eax, eax
jne 0x1001250e
call fcn.10011d60
call fcn.100123b0
test eax, eax
jne 0x1001251c
jmp fcn.10011f60
ret
Function at 0x10012520
Capabilities:
Contain obfuscated stackstrings
Set file attributes

Disassembly:
sub esp, 0x440
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [esp + 0x18]
push edi
lea ecx, [esp + 0x28]
mov bl, 0x65
push eax
push ecx
mov byte [esp + 0x30], 0x6b
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], 0x72
mov byte [esp + 0x33], 0x6e
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 0x6c
mov byte [esp + 0x36], 0x33
mov byte [esp + 0x37], 0x32
mov byte [esp + 0x38], 0x2e
mov byte [esp + 0x39], 0x64
mov byte [esp + 0x3a], 0x6c
mov byte [esp + 0x3b], 0x6c
mov byte [esp + 0x3c], 0
mov byte [esp + 0x24], 0x43
mov byte [esp + 0x25], 0x72
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x74
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], 0x46
mov byte [esp + 0x2b], 0x69
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], 0x41
mov byte [esp + 0x2f], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ebp, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x40], 0x6b
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], bl
mov byte [esp + 0x45], 0x6c
mov byte [esp + 0x46], 0x33
mov byte [esp + 0x47], 0x32
mov byte [esp + 0x48], 0x2e
mov byte [esp + 0x49], 0x64
mov byte [esp + 0x4a], 0x6c
mov byte [esp + 0x4b], 0x6c
mov byte [esp + 0x4c], 0
mov byte [esp + 0x18], 0x57
mov byte [esp + 0x19], 0x72
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x46
mov byte [esp + 0x1e], 0x69
mov byte [esp + 0x1f], 0x6c
mov byte [esp + 0x20], bl
mov byte [esp + 0x21], 0
call esi
push eax
call edi
mov ecx, dword [esp + 0x454]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push ecx
mov dword [esp + 0x64], eax
call ebp
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1001271a
push 2
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x4c], 0
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0x5005
xor edi, edi
idiv ecx
mov ebp, edx
test ebp, ebp
jle 0x100126f8
mov edx, edi
and edx, 0x800003ff
jns 0x100126bc
dec edx
or edx, 0xfffffc00
inc edx
jne 0x100126dd
xor esi, esi
call dword [sym.imp.MSVCRT.dll_rand]
add eax, esi
mov ecx, 0xff
cdq
idiv ecx
inc esi
cmp esi, 0x400
mov byte [esp + esi + 0x4f], dl
jl 0x100126c0
lea edx, [esp + 0x4c]
push 0
push edx
lea eax, [esp + 0x58]
push 0x400
push eax
push ebx
call dword [esp + 0x5c]
inc edi
cmp edi, ebp
jl 0x100126aa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1001f360]
mov edx, dword [esp + 0x454]
and ecx, 0xffff
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret
Function at 0x5b8a10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x51c015
lea edi, [esi - 0x11b015]
lea eax, [edi + 0x1b0940]
push dword [eax]
mov dword [eax], 0xb0d1fd83
push eax
push edi
or ebp, 0xffffffff
jmp 0x5b8a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5b8a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b8a38
mov eax, 1
add ebx, ebx
jne 0x5b8a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5b8a6c
jne 0x5b8a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b8a8b
dec eax
add ebx, ebx
jne 0x5b8a78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5b8a50
add ebx, ebx
jne 0x5b8a87
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5b8add
xor ecx, ecx
sub eax, 3
jb 0x5b8aa3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5b8b12
sar eax, 1
mov ebp, eax
jmp 0x5b8aae
add ebx, ebx
jne 0x5b8aae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b8a7c
inc ecx
add ebx, ebx
jne 0x5b8abc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b8a7c
add ebx, ebx
jne 0x5b8ac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5b8abe
jne 0x5b8ada
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5b8abe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5b8afc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5b8aee
jmp 0x5b8a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5b8afc
add edi, ecx
jmp 0x5b8a3e
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x740b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5b8b1e
cmp byte [edi], 0x17
jne 0x5b8b1e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5b8b23
lea edi, [esi + 0x1b6000]
mov eax, dword [edi]
or eax, eax
je 0x5b8b92
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1b8000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1b809c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5b8b50
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1b80a4]
or eax, eax
je 0x5b8b8c
mov dword [ebx], eax
add ebx, 4
jmp 0x5b8b6d
call dword [esi + 0x1b80a0]
mov ebp, dword [esi + 0x1b80a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x1b8bed]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5b8bde
sub esp, 0xffffff80
jmp 0x4012a0
Function at 0x402834
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4028cc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4028ac
xor eax, eax
push ebp
push 0x4028a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4028e8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4028ac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x404328
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_2
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4044e0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
je 0x404389
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4044fc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4043f6
xor eax, eax
push ebp
push 0x4043ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4043d8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x40451c
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4043f6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4044d7
cmp byte [ebp - 0xd], 0
jne 0x404438
cmp byte [ebp - 0x12], 0
je 0x4044d7
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404451
dec ebx
cmp byte [ebx], 0x2e
je 0x404460
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404450
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4044d7
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40448d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4044d7
cmp byte [ebp - 0xd], 0
je 0x4044d7
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4044d7
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406fd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4070da
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x407023
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.0040326c
jmp 0x4070c1
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
mov eax, ebx
call fcn.00406f84
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.00406fa4
mov ebx, eax
test esi, esi
je 0x40704b
dec esi
test esi, esi
jl 0x40704b
cmp edi, ebx
jne 0x40702a
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.0040333c
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.004035e4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004033e0
cmp eax, 2
jl 0x4070c1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x4070c1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004033e0
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x4070c1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004033e0
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.004035e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4070e1
lea eax, [ebp - 0x110]
call fcn.00403188
ret

Function at 0x40711c
Capabilities:
Get file attributes

Disassembly:
call fcn.004059fc
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
and al, 0x10
sete al
ret

Function at 0x407260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4072ca
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.0040333c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004071e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4072d1
lea eax, [ebp - 0x10c]
call fcn.00403188
ret

Function at 0x4072d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x407342
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.0040333c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004071e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407349
lea eax, [ebp - 0x10c]
call fcn.00403188
ret
Function at 0x407350
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4073ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.KERNEL32.DLL_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.0040333c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004071e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4073c1
lea eax, [ebp - 0x10c]
call fcn.00403188
ret

Function at 0x4073c8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0xc], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403594
mov eax, dword [ebp - 8]
call fcn.00403594
xor eax, eax
push ebp
push 0x407518
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403188
cmp dword [ebp - 4], 0
je 0x407430
mov eax, dword [ebp - 4]
call fcn.004033e0
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x407430
lea eax, [ebp - 4]
mov edx, 0x407530
call fcn.004033e8
cmp dword [ebp - 8], 0
je 0x40745f
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x40745f
lea ecx, [ebp - 0x150]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00406dac
mov edx, dword [ebp - 0x150]
lea eax, [ebp - 8]
call fcn.00403220
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040342c
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004035a4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
test esi, esi
setne al
jmp 0x4074e8
test dword [ebp - 0x14c], 0x10
ja 0x4074d5
cmp dword [ebx], 0
je 0x4074a8
mov eax, ebx
mov edx, 0x40753c
call fcn.004033e8
push dword [ebx]
push dword [ebp - 4]
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.004033b4
push dword [ebp - 0x150]
mov eax, ebx
mov edx, 3
call fcn.004034a0
lea eax, [ebp - 0x14c]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x40748b
push esi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40751f
lea eax, [ebp - 0x150]
call fcn.00403188
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004031ac
ret
Function at 0x407540
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x24], edx
mov edi, eax
xor eax, eax
push ebp
push 0x407631
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004033e0
mov ebx, eax
lea eax, [ebx + 2]
call fcn.00402504
mov esi, eax
mov eax, edi
call fcn.004035a4
mov edx, eax
mov eax, esi
call fcn.00406cc4
mov byte [esi + ebx + 1], 0
cmp ebx, 0
jl 0x40759b
cmp byte [esi + ebx], 0x3b
jne 0x407595
mov byte [esi + ebx], 0
dec ebx
cmp ebx, 0xffffffff
jne 0x40758b
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.0040270c
cmp dword [0x4584f4], 0
je 0x4075be
mov eax, dword [0x4584f4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
mov dword [ebp - 0x16], esi
mov word [ebp - 0xe], 0x50
mov dword [ebp - 0xc], 0xffffffff
push 0x40764c
push edi
push 0x40765c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.004034a0
mov eax, dword [ebp - 0x24]
call fcn.004035a4
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
test bl, bl
je 0x407614
mov ebx, dword [ebp - 0xc]
cmp ebx, 1
sbb ebx, ebx
neg ebx
mov eax, esi
call fcn.0040251c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407638
lea eax, [ebp - 0x24]
call fcn.00403188
ret

Function at 0x407be8
Capabilities:
Create thread

Disassembly:
push ebx
mov eax, dword [0x457e24]
mov byte [eax], 1
mov edx, dword [0x405894]
xor eax, eax
call fcn.00405b80
mov ebx, eax
mov byte [ebx + 0x18], 1
lea eax, [ebx + 0x1e]
push eax
push 4
push ebx
push 0x407bd8
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
mov dword [ebx + 0x1a], eax
mov eax, ebx
pop ebx
ret

Function at 0x407c78
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov byte [ebx + 0x18], 0
mov eax, dword [ebx + 0x1a]
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
jbe 0x407c93
mov byte [ebx + 0x18], 1
pop ebx
ret
cmp word [ebx + 0x2c], 0
je 0x407ca2
mov edx, ebx
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
ret

Function at 0x408190
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x408228
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x4081dd
mov eax, dword [ebx + 0x19]
call fcn.004035a4
push eax
push esi
mov eax, edi
call fcn.004035a4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004035a4
push eax
call sub.KERNEL32.DLL_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x408212
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.004035a4
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00406bf8
mov eax, dword [ebp - 8]
call fcn.004035a4
push eax
mov eax, edi
call fcn.004035a4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004035a4
push eax
call sub.KERNEL32.DLL_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40822f
lea eax, [ebp - 8]
call fcn.00403188
ret
Function at 0x40823c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x408245
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x4082b3
mov byte [ebp - 0x8000], 0
mov eax, dword [ebx + 0x19]
call fcn.004035a4
push eax
push 0x8000
lea eax, [ebp - 0x8000]
push eax
mov eax, esi
call fcn.004035a4
push eax
mov eax, edi
call fcn.004035a4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004035a4
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x8000]
mov ecx, 0x8000
call fcn.004033b4
jmp 0x4082e4
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.00403220
mov eax, dword [ebx + 0x19]
call fcn.004035a4
push eax
mov eax, esi
call fcn.004035a4
push eax
mov eax, edi
call fcn.004035a4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.004035a4
push eax
call sub.KERNEL32.DLL_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x409f5c
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x409f6b
mov edx, dword [edx + 0x36]
jmp fcn.0040333c
mov ecx, dword [edx + 0x18]
jecxz 0x409f63
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.00403710
pop edx
mov ecx, dword [ebx]
jecxz 0x409f93
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret

Function at 0x40a004
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40a010
or byte [eax + 0x27], 0x10
mov byte [eax + 0x4e], dl
mov ecx, dword [eax + 0x18]
jecxz 0x40a02c
push eax
je 0x40a02d
call dword [0x456134]
pop eax
push 5
push dword [eax + 0x18]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x15a], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x456134]
ret

Function at 0x40c568
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040beb8
je 0x40c5ad
mov eax, ebx
push edx
call fcn.0040c8ac
pop edx
cmp eax, edx
je 0x40c5ad
test edx, edx
mov eax, ebx
jne 0x40c58c
pop ebx
inc edx
jmp fcn.0040c89c
mov byte [ebx + 0x49], dl
cmp dl, 5
jne 0x40c595
dec edx
push edx
xor edx, edx
call fcn.0040c89c
mov eax, dword [ebx + 0x3d]
movzx eax, word [eax + 0xe]
call fcn.0040bb5c
pop edx
cmp al, dl
xchg ebx, eax
pop ebx
jne fcn.0040c5cc
ret
Function at 0x40cfa4
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00403188
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40cff3
push 1
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x40cfee
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x40cfee
push esi
call sub.KERNEL32.DLL_GlobalLock
mov edi, eax
test edi, edi
je 0x40cfee
mov eax, ebx
mov edx, edi
call fcn.0040333c
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret

Function at 0x40cff8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.0040378c
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40d047
push 0xd
call sub.user32.dll_IsClipboardFormatAvailable
test eax, eax
je 0x40d042
push 0xd
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x40d042
push esi
call sub.KERNEL32.DLL_GlobalLock
mov edi, eax
test edi, edi
je 0x40d042
mov eax, ebx
mov edx, edi
call fcn.00403894
push esi
call sub.KERNEL32.DLL_GlobalUnlock
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret

Function at 0x40d0c4
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x40d13f
call sub.user32.dll_EmptyClipboard
mov eax, edi
xor edx, edx
call fcn.004038fc
je 0x40d138
mov eax, edi
call fcn.004038f0
inc eax
add eax, eax
push eax
push 0x2000
call sub.KERNEL32.DLL_GlobalAlloc
mov esi, eax
test esi, esi
je 0x40d13a
push esi
call sub.KERNEL32.DLL_GlobalLock
mov ebx, eax
mov eax, edi
call fcn.004038f0
inc eax
add eax, eax
push eax
mov eax, edi
call fcn.004038e0
mov edx, ebx
pop ecx
call fcn.004025d8
push esi
call sub.KERNEL32.DLL_GlobalUnlock
push esi
push 0xd
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
jmp 0x40d13a
mov bl, 1
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x40d2d4
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
cmp byte [0x4563b8], 0xff
je 0x40d2ea
mov al, byte [0x4563b8]
jmp 0x40d34a
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
mov eax, dword [esp + 0x10]
cmp eax, 2
jne 0x40d323
mov al, 3
mov edx, dword [esp + 4]
cmp edx, 6
jb 0x40d30f
mov al, 6
jmp 0x40d345
cmp edx, 5
jb 0x40d345
cmp dword [esp + 8], 1
jb 0x40d31f
mov al, 5
jmp 0x40d345
mov al, 4
jmp 0x40d345
cmp eax, 1
jne 0x40d343
mov al, 1
cmp dword [esp + 4], 4
ja 0x40d33f
cmp dword [esp + 4], 4
jne 0x40d345
cmp dword [esp + 8], 0xa
jb 0x40d345
mov al, 2
jmp 0x40d345
xor eax, eax
mov byte [0x4563b8], al
add esp, 0x94
ret