joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43f7df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x454560]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x38]
mov ebx, 2
push 0x4569e8
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.00435b84
test esi, esi
je 0x4052f2
push ebp
mov ebp, dword [0x443584]
lea eax, [esp + 0x3c]
push esi
push eax
mov ecx, edi
call fcn.004301a5
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call fcn.00435b34
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.004359fb
mov ecx, dword [edi + 0x1c]
push esi
push 3
push 0x110a
push ecx
call ebp
test eax, eax
jne 0x40529b
lea edx, [esp + 0x1c]
push 3
push edx
lea ecx, [esp + 0x1c]
call fcn.0042ed3d
lea ecx, [esp + 0x18]
push ebx
push ecx
mov ecx, eax
mov byte [esp + 0x38], 4
call fcn.0042edb9
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 5
call fcn.00435b34
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.004359fb
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.004359fb
push 0x4532c4
lea ecx, [esp + 0x18]
call fcn.00435cef
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00435c2a
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.00435b34
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.004359fb
mov edx, dword [edi + 0x1c]
push esi
push 3
push 0x110a
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x405214
pop ebp
push 1
push 0x5c
lea ecx, [esp + 0x1c]
call fcn.0042eaed
lea eax, [esp + 0x1c]
push 1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.0042ed3d
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ecx
push eax
call fcn.0041f8c5
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete byte [esp + 0x38]
call fcn.004359fb
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.004359fb
mov al, byte [esp + 0x38]
test al, al
je 0x40535d
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
dec eax
push eax
call fcn.00435dfe
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00435770
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.004359fb
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.004359fb
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x4063d0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x160
lea eax, [esp]
mov dword [0x456a54], 0
mov dword [0x456a58], 0
push esi
mov esi, dword [esp + 0x168]
push edi
mov edi, dword [0x4433ac]
push 0x101
push 0x160
push eax
push 0
push esi
call edi
test eax, eax
je 0x406425
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [0x456a60], ecx
mov dword [0x456a58], edx
push 0x103
lea eax, [esp + 0xc]
push 0x160
push eax
push 0
push esi
call edi
pop edi
pop esi
test eax, eax
je 0x406453
mov ecx, dword [esp + 4]
mov edx, dword [esp]
mov dword [0x456a5c], ecx
mov dword [0x456a54], edx
add esp, 0x160
ret

Function at 0x406490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43fa30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
push edi
lea ecx, [esp + 0xc]
call fcn.00417603
mov esi, dword [esp + 0x38]
lea ecx, [esp + 8]
push esi
mov dword [esp + 0x34], 0
call fcn.00435a69
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x30], 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jne 0x4064f2
cmp byte [esi + 1], 0x3a
jne 0x4064f2
cmp byte [esi + 2], 0x5c
jne 0x4064f2
push 0x4532c0
jmp 0x4064f7
push str..
lea ecx, [esp + 0xc]
call fcn.00435cef
mov eax, dword [esp + 8]
push 0
push eax
lea ecx, [esp + 0x14]
call fcn.004176c6
test eax, eax
je 0x406541
lea ecx, [esp + 0xc]
call fcn.004178e6
mov edx, dword [esp + 0xc]
push 0x10
lea ecx, [esp + 0x10]
mov esi, eax
call dword [edx + 0x38]
test eax, eax
je 0x40653d
lea ecx, [esp + 0xc]
call fcn.004178ad
test eax, eax
je 0x406575
test esi, esi
jne 0x406514
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.004359fb
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00417640
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
lea ecx, [esp + 8]
mov byte [esp + 0x30], 0
call fcn.004359fb
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00417640
mov ecx, dword [esp + 0x28]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x406b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43fb0f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x454560]
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x38]
mov ebx, 2
push 0x4569e8
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call fcn.00435b84
test esi, esi
je 0x406c6c
push ebp
mov ebp, dword [0x443584]
cmp esi, dword [edi + 0x23c]
je 0x406c6b
lea eax, [esp + 0x3c]
push esi
push eax
lea ecx, [edi + 0xcc]
call fcn.004301a5
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 3
call fcn.00435b34
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], bl
call fcn.004359fb
mov ecx, dword [edi + 0xe8]
push esi
push 3
push 0x110a
push ecx
call ebp
cmp eax, dword [edi + 0x23c]
jne 0x406c12
lea edx, [esp + 0x1c]
push 3
push edx
lea ecx, [esp + 0x1c]
call fcn.0042ed3d
lea ecx, [esp + 0x18]
push ebx
push ecx
mov ecx, eax
mov byte [esp + 0x38], 4
call fcn.0042edb9
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x34], 5
call fcn.00435b34
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 4
call fcn.004359fb
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.004359fb
push 0x4532c4
lea ecx, [esp + 0x18]
call fcn.00435cef
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00435c2a
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 6
call fcn.00435b34
lea ecx, [esp + 0x20]
mov byte [esp + 0x30], bl
call fcn.004359fb
mov edx, dword [edi + 0xe8]
push esi
push 3
push 0x110a
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x406b74
pop ebp
push 1
push 0x5c
lea ecx, [esp + 0x1c]
call fcn.0042eaed
lea eax, [esp + 0x1c]
push 1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 7
call fcn.0042ed3d
mov ecx, dword [esp + 0x14]
mov eax, dword [eax]
push ecx
push eax
call fcn.0041f8c5
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
sete byte [esp + 0x38]
call fcn.004359fb
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], bl
call fcn.004359fb
mov al, byte [esp + 0x38]
test al, al
je 0x406cd7
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x10]
mov eax, dword [edx - 8]
dec eax
push eax
call fcn.00435dfe
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00435770
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.004359fb
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.004359fb
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8
Function at 0x4091d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov edi, 0x4537a4
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x78]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [esp + 0x74]
mov eax, ecx
mov esi, edi
mov edi, ebx
mov dword [esp + 0x10], str.0___
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x14], str.1___Raw
and ecx, 3
mov dword [esp + 0x18], str.2___
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x1c], str.3___
mov dword [esp + 0x20], str.4___
mov dword [esp + 0x24], str.5___
mov dword [esp + 0x28], str.6___
mov dword [esp + 0x2c], str.7___
mov dword [esp + 0x30], str.8___
mov dword [esp + 0x34], str.9___
mov dword [esp + 0x38], str.10__
mov dword [esp + 0x3c], str.11__
mov dword [esp + 0x40], str.12__
mov dword [esp + 0x44], str.13__
mov dword [esp + 0x48], str.192_
mov dword [esp + 0x4c], str.193_
mov dword [esp + 0x50], str.194_
mov dword [esp + 0x54], str.195_
mov dword [esp + 0x58], str.196_
mov dword [esp + 0x5c], str.197_
mov dword [esp + 0x60], str.198_
mov dword [esp + 0x64], str.199_UDMA_
mov dword [esp + 0x68], str.200_
mov dword [esp + 0x6c], 0x4534c0
xor edi, edi
mov esi, dword [esp + edi*4 + 0x10]
push esi
call fcn.0041fe19
mov edx, eax
add esp, 4
cmp edx, ebp
jne 0x4092fb
lea edi, [esi + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or edi, 0xffffffff
jmp 0x4092fc
inc edi
cmp edx, 0xffffffff
je 0x409306
cmp edi, 0xffffffff
jne 0x4092c3
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x409b60
Capabilities:
Get disk information via ioctl

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, 0x4569e8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [str..C:]
mov dx, word [0x453888]
mov al, byte [0x45388a]
mov dword [esp + 0x20], ecx
mov ecx, dword [0x4532bc]
mov word [esp + 0x24], dx
mov byte [esp + 0x26], al
mov dword [esp + 0x10], ecx
call dword [0x443204]
mov edi, dword [0x443200]
mov esi, dword [0x4431fc]
mov ebp, dword [0x4431d8]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x18]
shr edx, cl
test dl, 1
je 0x409c4d
mov bl, cl
lea eax, [esp + 0x10]
add bl, 0x41
push eax
mov byte [esp + 0x14], bl
call edi
cmp eax, 3
jne 0x409c49
push 0
push 0
push eax
push 0
push eax
lea ecx, [esp + 0x34]
push 0xc0000000
push ecx
mov byte [esp + 0x40], bl
call esi
cmp eax, 0xffffffff
je 0x409c49
lea edx, [esp + 0x1c]
push 0
push edx
lea ecx, [esp + 0x30]
push 0xc
push ecx
push 0
push 0
push 0x2d1080
push eax
call ebp
test eax, eax
je 0x409c49
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
cmp edx, eax
jne 0x409c49
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
cmp eax, ecx
je 0x409c66
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, 0x1a
mov dword [esp + 0x14], ecx
jl 0x409bd6
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x40]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x40dcd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x78
mov eax, 0x1111110e
mov edx, 0x101110e
push ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x44], edx
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 0x8800]
push esi
mov esi, 0xe111111
cmp edx, eax
push edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], 0x2020207
mov dword [esp + 0x40], 0x2060202
mov dword [esp + 0x44], 0x408101f
mov dword [esp + 0x48], 0xe110102
mov dword [esp + 0x50], 0xe110106
mov dword [esp + 0x54], 0x121f0202
mov dword [esp + 0x58], 0x2060a0a
mov dword [esp + 0x60], 0x1f10101e
mov dword [esp + 0x68], 0xe11101e
mov dword [esp + 0x6c], 0x4040808
mov dword [esp + 0x70], 0x1f010202
mov dword [esp + 0x78], 0xe11110e
mov dword [esp + 0x7c], 0xf01110e
mov dword [esp + 0x80], esi
jge 0x40dd89
mov eax, dword [ecx + 0x87f8]
mov dword [esp + 0x18], eax
jmp 0x40dd93
mov ecx, dword [ecx + 0x87fc]
mov dword [esp + 0x18], ecx
xor ecx, ecx
cmp edx, 0x63
setg cl
add ecx, 2
mov dword [esp + 0xc], 1
mov dword [esp + 0x24], ecx
lea eax, [ecx - 1]
test eax, eax
jle 0x40ddc1
mov esi, dword [esp + 0xc]
lea esi, [esi + esi*4]
shl esi, 1
dec eax
mov dword [esp + 0xc], esi
jne 0x40ddb1
test ecx, ecx
mov dword [esp + 0x14], 0
jle 0x40dec1
push ebp
mov dword [esp + 0x24], ecx
mov eax, edx
mov ecx, 0xa
cdq
idiv dword [esp + 0x10]
cdq
idiv ecx
mov ecx, 5
mov dword [esp + 0x14], ecx
cmp edx, 1
mov dword [esp + 0x2c], edx
jne 0x40de03
mov dword [esp + 0x14], 3
mov ecx, dword [esp + 0x14]
lea edi, [ecx + 0x37]
mov ebx, 0xb
mov dword [esp + 0x20], edi
xor esi, esi
test ecx, ecx
jle 0x40de76
mov ebp, dword [esp + edx*8 + 0x38]
mov edx, dword [esp + edx*8 + 0x3c]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x34]
mov ecx, edi
mov eax, ebp
call fcn.00420290
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x40de66
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push eax
push ecx
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x34]
mov eax, esi
push ebx
sub eax, edx
lea edx, [eax + ecx + 3]
push edx
call fcn.0040dc60
add esp, 0x14
mov eax, dword [esp + 0x14]
inc esi
dec edi
cmp esi, eax
jl 0x40de21
mov edx, dword [esp + 0x2c]
mov ecx, eax
mov edi, dword [esp + 0x20]
sub edi, 8
dec ebx
cmp ebx, 3
mov dword [esp + 0x20], edi
jg 0x40de0f
mov eax, 0x66666667
imul dword [esp + 0x10]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x18]
lea eax, [edx + ecx + 1]
mov edx, dword [esp + 0x94]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
dec eax
mov dword [esp + 0x24], eax
jne 0x40ddd6
pop ebp
cmp edx, 0x64
jge 0x40df0b
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ebx
push esi
push edi
push 0xb
push 0xf
call fcn.0040dc60
push ebx
push esi
push edi
push 0xc
push 0xe
call fcn.0040dc60
push ebx
push esi
push edi
push 0xa
push 0xe
call fcn.0040dc60
push ebx
push esi
push edi
push 0xb
push 0xd
call fcn.0040dc60
add esp, 0x50
pop edi
pop esi
pop ebx
add esp, 0x78
ret 0xc
Function at 0x413250
Capabilities:
Set registry value

Disassembly:
sub esp, 0x110
lea eax, [esp]
push esi
lea ecx, [esp + 0xc]
push eax
mov esi, dword [0x44300c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.Software
push 0x80000002
call esi
lea edx, [esp + 4]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.MicrosoftWindowsCurrentVersionRun
push ecx
call esi
lea edx, [esp + 0x10]
push 0x104
push edx
push 0
mov dword [esp + 0x10], eax
call dword [0x4431f8]
lea eax, [esp + 0x10]
push 0x104
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [0x443220]
mov eax, dword [esp + 4]
test eax, eax
jne 0x413303
push edi
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x14]
push ecx
push edx
push 1
push eax
mov eax, dword [esp + 0x1c]
push 0x453140
push eax
call dword [0x443008]
mov dword [esp + 8], eax
pop edi
mov ecx, dword [esp + 8]
mov esi, dword [section..rdata]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
mov eax, dword [esp + 4]
pop esi
test eax, eax
sete al
add esp, 0x110
ret

Function at 0x413330
Capabilities:
Delete registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
mov esi, dword [0x443004]
push edi
push eax
push 0x20019
push 0
push str.Software
push 0x80000002
call esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
push 0xf003f
push 0
push str.MicrosoftWindowsCurrentVersionRun
push edx
call esi
mov esi, eax
test esi, esi
jne 0x413383
mov eax, dword [esp + 8]
push 0x453140
push eax
call dword [0x443010]
mov esi, eax
mov ecx, dword [esp + 8]
mov edi, dword [section..rdata]
push ecx
call edi
mov edx, dword [esp + 0xc]
push edx
call edi
test esi, esi
pop edi
pop esi
sete al
add esp, 8
ret

Function at 0x414ae8
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push esi
mov esi, ecx
lea ecx, [esp + 0xc]
push 4
push ecx
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x10]
push 4
push 0
push edx
push eax
call dword [0x443008]
xor ecx, ecx
mov dword [esi + 4], eax
test eax, eax
sete cl
mov dword [esi + 0xc], 4
mov dword [esi + 8], 4
mov eax, ecx
pop esi
ret 8

Function at 0x414b50
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push esi
mov esi, ecx
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x10]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x1c], 4
call dword [0x443014]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 4]
mov dword [esi + 4], eax
mov dword [esi + 8], edx
mov dword [esi + 0xc], ecx
pop esi
test eax, eax
jne 0x414ba9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov dword [edx], eax
mov eax, 1
add esp, 8
ret 8
xor eax, eax
add esp, 8
ret 8
Function at 0x416320
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [0x443584]
push esi
mov esi, ecx
push edi
push 0
mov eax, dword [esi + 0x1c]
push 0
push 0x476
push eax
call ebx
mov edi, eax
push edi
call dword [0x443504]
test eax, eax
je 0x416398
push edi
call dword [0x4434f4]
test eax, eax
je 0x416398
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x14], 0xffffff37
mov dword [esp + 0xc], ecx
mov ecx, esi
call fcn.004347ae
lea edx, [esp + 0xc]
mov dword [esp + 0x10], eax
push edx
push eax
push 0x4e
push edi
mov dword [esp + 0x28], 0
call ebx
test eax, eax
je 0x41638f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0
push edi
call dword [0x4434f8]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x42e230
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [0x4430a4]
mov edi, dword [ebp + 8]
push edi
call dword [0x443484]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0041f680
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42e2fb
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [0x443488]
test eax, eax
je 0x42e2fb
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42e2ae
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x42e2b9
or bh, 8
and edi, 0x8000000
je 0x42e2d4
mov eax, dword [0x45a83c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [0x4430bc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [0x4433f8]
test edi, edi
je 0x42e2fb
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [0x4430bc]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4328d0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x432908
push dword [esi + 0x1c]
call dword [0x443484]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00435dba
push eax
push dword [esi + 0x1c]
call dword [0x443488]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00435d92
jmp 0x432914
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x401090
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push dword [0x66f3c4]
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x401134
push esi
mov esi, dword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
lea eax, [ebp - 4]
push edi
push eax
push 0
push 0
push ebx
call esi
test eax, eax
je 0x401121
mov eax, dword [ebp - 4]
test eax, eax
je 0x401121
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x401121
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push ebx
call esi
test eax, eax
je 0x401107
mov esi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x43506c]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 8
mov edi, eax
call fcn.004107f2
add esp, 4
mov esi, eax
push 2
push 8
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
jne 0x401181
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401193
push 0
push esi
push 0
push 0
push 4
push 6
push edi
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
push esi
call fcn.004105ca
add esp, 4
push 0x432030
call fcn.00401060
add esp, 4
push 0x432030
call fcn.00401060
add esp, 4
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0xae
xor edx, edx
mov al, byte [edx + 0x432048]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x4011e0
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1e
jl 0x4011c3
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x28]
mov byte [esp + 0x46], 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xorps xmm0, xmm0
mov dword [esp + 0x28], 0
push 4
mov esi, eax
movaps xmmword [esp + 0x14], xmm0
movq qword [esp + 0x24], xmm0
mov word [esp + 0x30], 0
mov byte [esp + 0x32], 0
call fcn.0040a3d2
add esp, 4
push 0
push eax
push 0x232000
push 0x435a80
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push dword [0x66f3bc]
mov dword [0x66f3b8], 0xc
push 4
push eax
mov dword [0x66f3c0], 0
call dword [sym.imp.ADVAPI32.dll_SetKernelObjectSecurity]
cmp dword [0x66f3c4], 0
jne 0x40129f
call fcn.00402820
mov dword [0x66f3c4], eax
test eax, eax
je 0x401291
call fcn.00401090
push ecx
call fcn.00402900
mov ecx, dword [esp + 0x40]
add esp, 4
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040a3c1
mov esp, ebp
pop ebp
ret