joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d230
Capabilities:
Load windows common language runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003e637
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x1006e024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 1
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
push 4
cmovae eax, dword [ebp + 8]
push 0x10044884
push eax
call fcn.10008698
add esp, 0xc
test eax, eax
setns bl
push 0x10044890
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x1003d2d9
lea edx, [eax + 0x72]
push eax
test bl, bl
je 0x1003d2c0
push 0x8c
lea ecx, [edx + 0x19]
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d393
push 0x73
mov ecx, 0x71
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d393
push str.CLRCreateInstance
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1003d318
test bl, bl
je 0x1003d30e
push eax
mov edx, 0x8d
push 0x8c
mov ecx, 0x8b
call fcn.1003c090
add esp, 8
mov esi, 0x80004005
jmp 0x1003d38c
mov ecx, dword [ebp - 0x14]
call fcn.1003cfa0
jmp 0x1003d38a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003d325
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0x10044cec
push 0x10044cfc
call esi
test eax, eax
jns 0x1003d34c
test bl, bl
je 0x1003d30e
push eax
mov edx, 0x8e
jmp 0x1003d2f5
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x1003d369
mov eax, dword [ecx]
jmp 0x1003d36b
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp + 8]
push edx
push eax
call fcn.10001a20
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
call fcn.1003d100
add esp, 0x18
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003d3a4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x1c]
cmp eax, 8
jb 0x1003d3b6
inc eax
push eax
push dword [ebp + 8]
call fcn.100011f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003dcf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1003dd03
test al, 0x10
jne 0x1003dd03
mov al, 1
ret
xor al, al
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6f87cef
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x7d300e33
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x403e58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403ebe
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403374
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402824
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403ea8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ec5
lea eax, [ebp - 0x10]
call fcn.00403208
ret

Function at 0x404b68
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404c2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403208
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x404c19
mov eax, ebx
mov edx, 0x73
add byte [eax], al

Function at 0x404c54
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404cfc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0x94]
push eax
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_OpenFile
mov esi, eax
cmp esi, 0xffffffff
je 0x404ce1
lea eax, [ebp - 8]
mov edx, 0x186a0
call fcn.0040366c
push 0
lea eax, [ebp - 0xc]
push eax
push 0x186a0
lea eax, [ebp - 8]
call fcn.004035dc
push eax
push esi
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x404ce1
push esi
call sub.kernel32.dll_CloseHandle
mov edx, dword [ebp - 8]
mov eax, 0x404d14
call fcn.00403624
test eax, eax
jle 0x404ce1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404d03
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret

Function at 0x404d2c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404dae
push dword fs:[eax]
mov dword fs:[eax], esp
xor bl, 1
neg bl
sbb eax, eax
push eax
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test byte [ebp + 0x10], bl
je 0x404d93
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.0040526c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404db5
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret
Function at 0x404e0c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x404f9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040338c
cmp eax, 2
jl 0x404f71
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x404fb4
mov edx, dword [ebp - 4]
call fcn.004033d8
mov eax, dword [ebp - 0x150]
call fcn.0040358c
push eax
call sub.kernel32.dll_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404f49
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403374
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004033d8
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x120]
mov ecx, 0x104
call fcn.00403374
test byte [ebp - 0x14c], 0x10
je 0x404f12
mov eax, dword [ebp - 0xc]
mov edx, 0x404fc0
call fcn.004034d8
je 0x404f34
mov eax, dword [ebp - 0xc]
mov edx, 0x404fcc
call fcn.004034d8
je 0x404f34
lea eax, [ebp - 0x158]
mov ecx, 0x404fd8
mov edx, dword [ebp - 8]
call fcn.004033d8
mov eax, dword [ebp - 0x158]
call fcn.00404e0c
jmp 0x404f34
mov eax, dword [ebp - 8]
call fcn.0040358c
mov esi, eax
push esi
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x404f34
push 0x20
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x14c]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x404e91
push ebx
call sub.kernel32.dll_FindClose
mov eax, dword [ebp - 4]
call fcn.0040358c
mov ebx, eax
push ebx
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x404f71
push 0x20
push ebx
call sub.kernel32.dll_SetFileAttributesA
push ebx
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404fa3
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.0040322c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040322c
ret
Function at 0x405d8c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x405e2f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x41a6b4
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41a6b8], eax
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
invalid
invalid

Function at 0x405e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x405f04
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x41a6b4
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [0x41a6b8], eax
mov eax, ebx
mov edx, dword [ebp + 0xc]
call fcn.0040366c
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebx]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [0x41a6b8], eax
cmp dword [0x41a6b8], 0
jne 0x405ed7
mov eax, dword [ebx]
call fcn.0040358c
mov edx, eax
mov eax, ebx
call fcn.00403338
jmp 0x405ede
mov eax, ebx
call fcn.00403208
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405f0b
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret

Function at 0x405f14
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov eax, dword [ebp - 8]
call fcn.0040357c
mov eax, dword [ebp + 8]
call fcn.0040357c
xor eax, eax
push ebp
push 0x405fe8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x41a6b4
push 0
push 2
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
push ebx
call sub.advapi32.dll_RegCreateKeyExA
mov dword [0x41a6b8], eax
cmp dword [ebp + 8], 0
jne 0x405f81
lea eax, [ebp + 8]
mov edx, 0x406000
call fcn.004032a0
mov eax, dword [ebp + 8]
call fcn.0040338c
push eax
lea eax, [ebp + 8]
call fcn.004035dc
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.0040358c
push eax
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [0x41a6b8], eax
cmp dword [0x41a6b8], 0
sete bl
mov eax, dword [0x41a6b4]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405fef
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
lea eax, [ebp + 8]
call fcn.00403208
ret
Function at 0x407a88
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x407a90
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
mov edi, 0x41acc0
xor eax, eax
push ebp
push 0x4087b1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004073e4
mov eax, dword [ebp - 8]
call fcn.00403208
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040338c
cmp eax, 0x7f
jge 0x407b01
push 0
push 0x41ac34
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_OpenFile
mov dword [0x41abe0], eax
cmp dword [0x41abe0], 0xffffffff
jne 0x407b34
mov ebx, 1
jmp 0x407b34
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040358c
push eax
call sub.kernel32.dll_CreateFileA
mov dword [0x41abe0], eax
cmp dword [0x41abe0], 0xffffffff
jne 0x407b34
mov ebx, 2
test ebx, ebx
jbe 0x407b98
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
cmp eax, 0xcf
ja 0x407b4f
bt dword [0x4087c0], eax
jb 0x407b88
cmp ebx, 0x4cf
je 0x407b88
push 0x4087e4
push dword [ebp - 4]
push 0x4087f4
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004057d8
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040344c
mov eax, dword [ebp - 0xc]
call fcn.0040ffd8
mov eax, dword [0x41abe0]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x40878e
mov eax, 0x41ac10
call fcn.00403208
mov eax, 0x41ac14
call fcn.00403208
mov eax, 0x41ac18
call fcn.00403208
xor eax, eax
mov dword [0x41ac04], eax
xor eax, eax
mov dword [0x41ac08], eax
mov eax, 0x41ab68
mov edx, 0x408800
call fcn.0040325c
xor eax, eax
mov dword [0x41ac0c], eax
xor eax, eax
mov dword [0x41ac00], eax
mov eax, 0x41ac1c
mov edx, 0x12
call fcn.0040366c
mov eax, 0x41ac20
mov edx, 0x20
call fcn.0040366c
mov eax, 0x41ac24
mov edx, 0x1a
call fcn.0040366c
mov eax, 0x41ac28
mov edx, 0x2f
call fcn.0040366c
mov eax, 0x41ac2c
mov edx, 0x12
call fcn.0040366c
mov eax, 0x41ab68
mov edx, 0x4088c4
call fcn.0040325c
mov eax, 0x41ac30
mov edx, 0x20
call fcn.0040366c
mov eax, dword [edi]
mov byte [eax], 0
jmp 0x4086a1
Function at 0x4095b8
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x30
push 0
push 0
dec ecx
jne 0x4095c0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040357c
xor eax, eax
push ebp
push 0x409bb6
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004073e4
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x154]
mov ecx, 0x409bcc
mov edx, dword [ebp - 4]
call fcn.004033d8
mov eax, dword [ebp - 0x154]
call fcn.0040358c
push eax
call sub.kernel32.dll_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x409b67
Function at 0x409fac
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x409fb4
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x40a200
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x41ab68
mov edx, 0x40a218
call fcn.0040325c
lea eax, [ebp - 4]
push eax
push ebx
push 0x13
push 1
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40a1e5
mov eax, 0x41ab68
mov edx, 0x40a23c
call fcn.0040325c
mov dword [ebp - 0xc], 0x7e0
mov eax, dword [ebp - 0xc]
call fcn.00402490
mov esi, eax
mov eax, esi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004027e8
mov dword [ebp - 8], 0x3f
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x40a049
cmp eax, 0xea
jne 0x40a1bf
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x40a021
inc eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov edi, ebx
shl edi, 2
test byte [esi + edi*8 + 0xc], 2
je 0x40a06b
lea eax, [esi + edi*8]
call fcn.00409fac
cmp dword [esi + edi*8 + 8], 3
jne 0x40a1b0
lea eax, [ebp - 0x14]
mov edx, dword [esi + edi*8 + 0x14]
call fcn.00403338
mov edx, dword [ebp - 0x14]
mov eax, 0x41ab50
mov ecx, 0x40a2fc
call fcn.004033d8
inc dword [0x41ab90]
mov eax, dword [0x41ab90]
cmp eax, dword [0x41ab94]
jl 0x40a1b0
mov eax, dword [0x41ab90]
push eax
mov ecx, dword [0x41ad1c]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00406004
mov eax, dword [0x41ab50]
push eax
mov ecx, dword [0x41ad18]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405f14
xor eax, eax
mov dword [0x41ab8c], eax
mov word [0x4191f4], 0
mov eax, 0x41ab68
mov edx, 0x40a308
call fcn.0040325c
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x41ab30]
call fcn.0040338c
mov ecx, eax
mov edx, 3
mov eax, dword [0x41ab50]
call fcn.004035e4
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00404928
mov eax, dword [ebp - 0x18]
mov edx, dword [0x41ab30]
call fcn.004034d8
jne 0x40a159
lea eax, [ebp - 0x20]
mov ecx, dword [0x41ab50]
mov edx, 0x40a334
call fcn.004033d8
mov eax, dword [ebp - 0x20]
call fcn.0040ffd8
jmp 0x40a17e
mov eax, dword [0x41ab50]
call fcn.004095b8
lea eax, [ebp - 0x24]
mov ecx, dword [0x41ab50]
mov edx, 0x40a348
call fcn.004033d8
mov eax, dword [ebp - 0x24]
call fcn.0040ffd8
mov eax, 0x41ab68
mov edx, 0x40a358
call fcn.0040325c
xor eax, eax
mov dword [0x41ab88], eax
mov eax, dword [0x41ab88]
push eax
mov ecx, dword [0x41ad20]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00406004
inc ebx
dec dword [ebp - 0x10]
jne 0x40a057
jmp 0x40a021
mov eax, esi
call fcn.004024b0
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
test eax, eax
je 0x40a1e5
lea edx, [ebp - 0x28]
xor eax, eax
call fcn.004057d8
mov eax, dword [ebp - 0x28]
call fcn.0040ffd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a207
lea eax, [ebp - 0x28]
mov edx, 6
call fcn.0040322c
ret
Function at 0x40b3a4
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x41ab68
mov edx, 0x40b438
call fcn.0040325c
push 0
push 0
mov eax, dword [0x41ade8]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41ab68
mov edx, 0x40b480
call fcn.0040325c
push 0
push 0
mov eax, dword [0x41adec]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41ab68
mov edx, 0x40b520
call fcn.0040325c
push 0
push 0
mov eax, dword [0x41adf0]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
push eax
call sub.user32.dll_ShowWindow
mov eax, 0x41ab68
mov edx, 0x40b550
call fcn.0040325c
ret
Function at 0x40b7ba
Capabilities:
Check for foreground window switch
Hide graphical window

Disassembly:
call fcn.0040b3a4
mov eax, dword [0x41adf4]
call fcn.0040358c
push eax
push 0
mov eax, dword [0x4192c4]
mov eax, dword [eax]
call eax
mov ebx, eax
test ebx, ebx
je 0x40b6e2
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.user32.dll_GetClientRect
mov eax, dword [ebp - 0xc]
cmp eax, 0x14a
je 0x40b646
cmp eax, 0x15f
jne 0x40b6da
cmp dword [ebp - 8], 0xc1
jne 0x40b6da
push 0x40b930
push 0
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x40b69d
push 0
push 0
push 0x201
push edi
mov eax, dword [0x4192b8]
mov eax, dword [eax]
call eax
push 0
push 0
push 0x202
push edi
mov eax, dword [0x4192b8]
mov eax, dword [eax]
call eax
mov eax, 0x41ab68
mov edx, 0x40b940
call fcn.0040325c
push ebx
call sub.user32.dll_SetForegroundWindow
test eax, eax
je 0x40b6e2
push 0
push 0
push 0
push 0xd
mov eax, dword [0x4192dc]
mov eax, dword [eax]
call eax
push 0
push 2
push 0
push 0xd
mov eax, dword [0x4192dc]
mov eax, dword [eax]
call eax
mov eax, 0x41ab68
mov edx, 0x40b9b0
call fcn.0040325c
jmp 0x40b6e2
push 0
push ebx
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
mov eax, 0x41ab68
mov edx, 0x40ba80
call fcn.0040325c
push 0x1e
lea eax, [ebp - 0x33]
push eax
push ebx
mov eax, dword [0x4192a8]
mov eax, dword [eax]
call eax
lea eax, [ebp - 4]
lea edx, [ebp - 0x33]
mov ecx, 0x1f
call fcn.00403374
mov eax, 0x41ab68
mov edx, 0x40bae0
call fcn.0040325c
mov eax, dword [ebp - 4]
call fcn.0040338c
test eax, eax
jle 0x40b7f1
mov edx, dword [ebp - 4]
mov eax, 0x40bb04
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, dword [0x41adf8]
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, dword [0x41adfc]
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, dword [0x41ae00]
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, 0x40bb14
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, 0x40bb24
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, 0x40bb34
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, 0x40bb44
inc esp
mov ebx, 0x61e80040
jle 0x40b7c1
invalid
test eax, eax
jne 0x40b7e9
inc esp
mov ebx, 0x61e80040
jle 0x40b7c1
invalid
inc dword [ebp - 0x74dd8a40]
push ebp
cld
mov edx, dword [ebp - 4]
mov eax, 0x40bb54
call fcn.00403624
test eax, eax
jne 0x40b7e9
mov edx, dword [ebp - 4]
mov eax, dword [0x41ae04]
call fcn.00403624
test eax, eax
je 0x40b7f1
push 0
push ebx
call sub.user32.dll_ShowWindow
push 0x320
call sub.kernel32.dll_Sleep
inc esi
cmp dword [0x41aba0], 0x1d9e2
je 0x40b811
cmp esi, 0x4b
jl 0x40b5f8
push 0x927c0
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x38]
mov ecx, 0x40bb60
mov edx, dword [0x41ae08]
call fcn.004033d8
mov eax, dword [ebp - 0x38]
call fcn.00405130
mov eax, 0x41ab68
mov edx, 0x40bb70
call fcn.0040325c
invalid
Function at 0x40d0f4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov edi, 0x41ab68
xor eax, eax
push ebp
push 0x40d2fc
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.004026c0
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00404964
mov edx, dword [ebp - 4]
mov eax, 0x41ab40
call fcn.0040325c
mov eax, edi
mov edx, 0x40d314
call fcn.0040325c
cmp byte [0x41aba9], 0
jne 0x40d164
mov eax, dword [0x41ab40]
push eax
mov ecx, dword [0x41ace8]
mov edx, dword [0x41ad14]
mov eax, 0x80000002
call fcn.00405f14
mov eax, edi
mov edx, 0x40d3d0
call fcn.0040325c
cmp byte [0x41aba9], 0
je 0x40d183
call fcn.0040d848
jmp 0x40d2e1
mov eax, edi
mov edx, 0x40d4a4
call fcn.0040325c
xor ebx, ebx
push 0
mov eax, dword [0x41ae1c]
call fcn.0040358c
push eax
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x40d1b5
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x40d191
mov eax, edi
mov edx, 0x40d4c0
call fcn.0040325c
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x40d558
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
mov eax, edi
mov edx, 0x40d568
call fcn.0040325c
mov eax, dword [0x41acfc]
call fcn.0040358c
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x40d210
mov eax, dword [0x41ad04]
call fcn.0040358c
push eax
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x40d2a0
mov eax, dword [0x41ae20]
call fcn.0040358c
push eax
push esi
call sub.kernel32.dll_GetProcAddress
mov esi, eax
mov eax, edi
mov edx, 0x40d588
call fcn.0040325c
test esi, esi
je 0x40d2a0
call esi
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
mov eax, edi
mov edx, 0x40d60c
call fcn.0040325c
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
push ebx
call sub.user32.dll_SendMessageA
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x4191c8
mov edx, 5
call fcn.00416554
mov eax, edi
mov edx, 0x40d6a8
call fcn.0040325c
mov eax, dword [0x41ad10]
call fcn.0040358c
mov edx, eax
mov eax, 0x41abbc
mov ecx, 0xbb8
call fcn.00405c88
test al, al
je 0x40d2e1
call fcn.0040d848
mov eax, edi
mov edx, 0x40d728
call fcn.0040325c
call fcn.00410194
mov eax, edi
mov edx, 0x40d7d4
call fcn.0040325c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d303
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040322c
ret