joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409371
Capabilities:
Enumerate process modules
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
lea eax, [ebp - 0x90c]
push eax
push 0x400
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
call fcn.00405fc9
xor edi, edi
test dword [ebp - 0x90c], 0xfffffffc
jbe 0x409475
cmp dword [ebp + edi*4 - 0x508], ebx
je 0x409463
push dword [ebp + edi*4 - 0x508]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x409463
lea eax, [ebp - 0x910]
push eax
push 0x400
lea eax, [ebp - 0x908]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x40945c
push 0x80
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x908]
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
lea eax, [ebp - 0x108]
push 0x80
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcslwr_s]
lea eax, [ebp - 0x108]
push str.vksaver.exe
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsstr]
add esp, 0x10
test eax, eax
je 0x40945c
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x90c]
inc edi
shr eax, 2
cmp edi, eax
jb 0x4093bf
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004554d0
leave
ret

Function at 0x409484
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x204]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x240], 0x3c
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x23c], 0x140
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], str.runas
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x238], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x20
mov ecx, eax
pop edi
push 0x22
pop ebx
movzx eax, word [ecx]
mov edx, eax
cmp ax, bx
jne 0x40952f
add ecx, 2
cmp dx, bx
movzx eax, word [ecx]
mov edx, eax
je 0x40951f
mov esi, eax
test ax, ax
jne 0x409509
jmp 0x40952a
cmp ax, di
jne 0x40952a
add ecx, 2
movzx edx, word [ecx]
movzx edx, dx
jmp 0x40954d
test ax, ax
je 0x40954d
add ecx, 2
mov eax, ecx
cmp dx, di
je 0x40954a
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x409534
jmp 0x40954d
movzx edx, word [eax]
xor eax, eax
mov dword [ebp - 0x224], 1
test dx, dx
cmovne eax, ecx
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x220], edi
mov ecx, dword [ebp - 4]
pop edi
seta al
xor ecx, ebp
pop esi
pop ebx
call fcn.004554d0
leave
ret
Function at 0x40958a
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0xa3c], ecx
test edi, edi
je 0x40966f
call fcn.00405fc9
push 0
xor esi, esi
mov dword [ebp - 0x808], edi
push 2
inc esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov ebx, eax
lea eax, [ebp - 0xa34]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0xa38], 0x22c
lea eax, [ebp - 0xa38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40962e
mov eax, dword [ebp - 0xa30]
cmp eax, dword [ebp - 0xa3c]
je 0x409620
cmp edi, dword [ebp - 0xa20]
jne 0x409620
mov dword [ebp + esi*4 - 0x808], eax
inc esi
cmp esi, 0x200
jae 0x409632
lea eax, [ebp - 0xa38]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4095fa
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
test esi, esi
je 0x40966f
push dword [ebp + edi*4 - 0x808]
push 0
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40966a
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, esi
jb 0x40963f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004554d0
leave
ret
Function at 0x40a380
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 2
push 0
mov edi, edx
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [ebp - 4]
push eax
push 0x463b58
push 1
push 0
push 0x463b68
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x40a420
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push eax
push 0x463b78
mov edx, dword [ecx]
push ecx
call dword [edx]
cmp dword [ebp - 8], 0
je 0x40a420
mov eax, dword [ebp - 4]
mov esi, 0x678f80
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov ecx, dword [ebp - 8]
push 1
push dword [ebp + 8]
mov eax, dword [ecx]
push ecx
call dword [eax + 0x18]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40a42c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x460]
mov edi, edx
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
mov dword [ebp - 0x460], ebx
lea eax, [ebp - 0x418]
push 0x10
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0x18
lea eax, [ebp - 0x408]
test edi, edi
je 0x40a492
push edi
push 0x678f80
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x40a4a6
push 0x678f80
push 0x64f32c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x460]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x418], ebx
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop edi
pop ebx
call fcn.004554d0
leave
ret
Function at 0x40ae54
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
xor esi, esi
cmp dword [edx + 0x14], 7
mov dword [ebp - 0x20], ebx
push edi
mov dword [ebp - 0x20], ebx
jbe 0x40ae79
mov edx, dword [edx]
push esi
push esi
push 3
push esi
push 1
push accept
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
jne 0x40aea2
push 0x463c20
mov ecx, ebx
call fcn.0040418a
jmp 0x40aef5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
call fcn.00455aa5
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push esi
push edi
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov edx, edi
lea ecx, [ebp - 0x1c]
call fcn.00406ea0
pop ecx
push edi
call fcn.00455aae
pop ecx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.00404163
lea ecx, [ebp - 0x1c]
call fcn.00404106
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004554d0
leave
ret
Function at 0x40b3f1
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20
lea eax, [ebp - 0x40]
push 0
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
mov dword [ebp - 0x34], 0x11
lea ecx, [ebp - 0x1c]
push 2
pop eax
push str.ya.ru
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
call fcn.00403fc1
cmp dword [ebp - 8], 7
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push 0x64fcd8
push eax
call dword [sym.imp.WS2_32.dll_GetAddrInfoW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.004044f6
test esi, esi
je 0x40b461
mov al, 1
jmp 0x40b46c
push dword [ebp - 0x20]
call dword [sym.imp.WS2_32.dll_FreeAddrInfoW]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004554d0
leave
ret

Function at 0x40b479
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push esi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
push 0x228
mov edi, eax
lea eax, [ebp - 0x22c]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x40b4e3
cmp dword [ebp - 0x228], ebx
je 0x40b4e9
lea eax, [ebp - 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x40b4cd
jmp 0x40b4ef
mov esi, dword [ebp - 0x218]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004554d0
leave
ret

Function at 0x40b507
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov ebx, ecx
push eax
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
lea edx, [esi + 4]
push edx
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
pop ecx
pop ecx
mov edi, eax
push edi
push esi
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
and dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0x463ee4
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
cmp dword [ebp - 4], 0
mov edx, dword [ebp - 8]
cmovne edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [edx + 8]
mov ecx, eax
shr ecx, 0x10
mov dword [ebp - 0xc], ecx
mov dword [0x658840], ecx
mov ecx, dword [edx + 0xc]
mov esi, ecx
movzx ebx, ax
mov edi, ecx
shr esi, 0x19
mov edx, ecx
imul eax, esi, 0x64
shr edi, 0x15
and edi, 0xf
shr edx, 0x10
and edx, 0x1f
movzx ecx, cx
mov dword [0x658844], ebx
add eax, edi
mov dword [0x65884c], ecx
imul eax, eax, 0x64
add eax, edx
mov dword [0x658848], eax
lea eax, [esi + 0x7d0]
push eax
push edi
push edx
push ecx
push ebx
push dword [ebp - 0xc]
push 0x64fce0
push 0x678c80
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp - 8]
add esp, 0x20
movzx eax, word [eax + 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b616
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x679380
push esi
push 0x23
push ebx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, ebx
call fcn.004068e2
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x64f888
push 0x100
push ebx
call edi
add esp, 0xc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push ebx
push 0x100
mov ebx, 0x679180
push ebx
call esi
push 0x463ee4
push 0x100
push ebx
call edi
push ebx
push 0x100
push 0x678f80
call esi
push ebx
push 0x100
mov ebx, 0x678d80
push ebx
call esi
push str.vksaver3.dll
mov esi, 0x100
push esi
push 0x679180
call edi
push str.VKSaver.exe
push esi
push 0x678f80
call edi
add esp, 0x48
push str.config.dat
push esi
push ebx
call edi
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x40b868
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push 0x10
push 1
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push 0xb
push 0x64feb0
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
mov edi, 0x679580
test eax, eax
je 0x40b8bd
sub ebx, 2
add esi, 2
cmp ebx, 0xa
ja 0x40b896
jmp 0x40b909
add esi, 0x1a
mov ecx, 0x678c80
mov edx, edi
movzx eax, word [esi]
test ax, ax
je 0x40b902
push 0x2e
mov ebx, eax
pop eax
cmp bx, 0x2c
jne 0x40b8df
mov word [ecx], ax
jmp 0x40b8ec
movzx eax, word [esi]
cmp eax, 0x20
je 0x40b8f2
mov word [ecx], ax
mov al, byte [esi]
add ecx, 2
mov byte [edx], al
inc edx
add esi, 2
push 0x2e
movzx eax, word [esi]
mov ebx, eax
test ax, ax
pop eax
jne 0x40b8d4
xor eax, eax
mov word [ecx], ax
mov byte [edx], al
mov al, byte [0x679580]
test al, al
je 0x40b93d
mov edx, 0x658840
cmp al, 0x2e
jne 0x40b920
add edx, 4
jmp 0x40b936
mov bl, byte [edi]
lea eax, [ebx - 0x30]
cmp al, 9
ja 0x40b936
imul ecx, dword [edx], 0xa
movsx eax, bl
add eax, 0xffffffd0
add eax, ecx
mov dword [edx], eax
inc edi
mov al, byte [edi]
test al, al
jne 0x40b917
pop edi
pop esi
pop ebx
ret
Function at 0x40b941
Capabilities:
Accept command line arguments
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5b4
mov eax, dword [0x657340]
xor eax, esp
mov dword [esp + 0x5b0], eax
push ebx
push esi
push edi
mov esi, str.VKSaverInstallerMtx
xor edi, edi
push esi
push edi
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x6795c8], eax
test eax, eax
je 0x40b9ac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push str.VKSaverInstallWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x40b9a4
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
inc eax
jmp 0x40bb14
push esi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x6795c8], eax
lea eax, [esp + 0x28]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40b9d6
push 4
jmp 0x40bb13
call fcn.0040b3f1
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40ba00
push 0x25
push 0x64fec8
push 0x64ff00
push edi
call esi
cmp eax, 2
je 0x40bacb
call fcn.0040b3f1
test al, al
jne 0x40b9e3
mov eax, dword [ebp + 8]
mov dword [0x6795cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x678850], eax
call fcn.0040b868
lea ecx, [esp + 0x10]
call fcn.0040b794
push eax
mov ecx, 0x657428
call fcn.00404129
lea ecx, [esp + 0x10]
call fcn.00404106
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov ecx, ebx
call fcn.0040b479
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1b8]
push 0x200
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x1b8]
call fcn.0040b507
lea ecx, [esp + 0x1b8]
call fcn.0040b5d7
mov ecx, dword [esp + 0xc]
mov edi, eax
call fcn.0040af06
test al, al
je 0x40bacf
push str.vksaver_install
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x40baa1
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
call fcn.0040b616
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
call fcn.0040b6be
test eax, eax
jne 0x40bb14
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x40bb14
push 2
jmp 0x40bb13
push 0x679620
mov edx, 0x64ffd8
lea ecx, [esp + 0x14]
call fcn.00407cf1
cmp dword [esp + 0x28], 7
lea eax, [esp + 0x14]
pop ecx
cmova eax, dword [esp + 0x10]
push 0x30
push 0x650198
push eax
push 0
call esi
mov edx, dword [esp + 0xc]
mov ecx, ebx
call fcn.0040958a
lea ecx, [esp + 0x10]
call fcn.004044f6
push 5
pop eax
mov ecx, dword [esp + 0x5bc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004554d0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cc59
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
je 0x40ccd2
cmp ebx, dword [0x6795d0]
je 0x40ccd2
push esi
push edi
mov edi, dword [0x679710]
mov dword [0x6795d0], ebx
mov esi, dword [edi]
cmp esi, edi
je 0x40cc93
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi]
cmp esi, edi
jne 0x40cc7c
mov ebx, dword [0x6795d0]
mov edi, dword [ebx + 0x80]
mov esi, dword [edi]
jmp 0x40ccaa
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [esi]
cmp esi, edi
jne 0x40cc9d
mov ecx, dword [ebx + 0x2c]
pop edi
pop esi
test ecx, ecx
je 0x40ccbc
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [0x6795c4]
test eax, eax
je 0x40ccd2
push 5
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop ebx
ret

Function at 0x40e4fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, ecx
xor ebx, ebx
push ebx
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x651410
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp - 8]
mov byte [0x65883a], 1
push eax
push ebx
push 0x657400
push 0x4032aa
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [edi + 8]
mov ecx, 0x679950
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00406f4d
push 5
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
movsd xmm1, qword [0x6573f0]
movsd xmm2, qword [0x6573f8]
movaps xmm0, xmm1
mulsd xmm0, qword [0x6518e8]
push 1
mulsd xmm1, qword [0x651910]
cvttsd2si eax, xmm0
movaps xmm0, xmm2
mulsd xmm2, qword [0x651840]
push eax
mulsd xmm0, qword [0x651a30]
mulsd xmm2, qword [0x651850]
cvttsd2si eax, xmm0
push eax
cvttsd2si eax, xmm1
push eax
cvttsd2si eax, xmm2
push eax
push dword [edi]
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
xor eax, eax
pop ebx
leave
ret 8

Function at 0x40ebd6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push edi
mov byte [0x658832], bl
mov edi, ecx
mov byte [0x658831], bl
call fcn.00402110
mov ecx, dword [0x658834]
call fcn.004092ef
call fcn.00409371
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push 0x40a7d8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push dword [edi + 4]
mov byte [0x658839], bl
mov byte [0x658833], bl
call dword [sym.imp.USER32.dll_EnableWindow]
push ebx
push dword [edi + 8]
call dword [sym.imp.USER32.dll_EnableWindow]
pop edi
pop ebx
leave
ret

Function at 0x40ecca
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
push esi
mov esi, ecx
call fcn.00401f8f
mov edx, dword [esi + 4]
pop esi
jmp fcn.00408f26
Function at 0x416aa0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x416b2c
push esi
call fcn.00422e40
add esp, 4
test al, al
jne 0x416b2c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x416ac3
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.00428e70
add esp, 0xc
test eax, eax
je 0x416af7
sub eax, esi
push eax
push 0x2e
push esi
call fcn.00428e70
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x416af9
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x416b25
mov al, byte [esi]
push eax
call fcn.00420360
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x416b07
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x41b2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov eax, 0x180
mov edx, 0x140
push esi
push edi
cmp dword [ebp], 0x657050
mov ecx, dword [ebp + 8]
cmovne eax, edx
mov dword [esp + 0x20], ecx
add eax, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41b328
mov byte [eax], 0
mov ebx, dword [esp + 0x30]
mov esi, dword [ebx + 0x8d8]
test esi, esi
je 0x41b4dc
push dword [ecx + 8]
mov edi, dword [esi + 0x14]
call dword [0x65700c]
add esp, 4
mov dword [esp + 0x30], eax
test eax, eax
je 0x41b381
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x1c9], 0
je 0x41b38e
push dword [eax + 0x64]
call dword [0x65700c]
mov ecx, eax
add esp, 4
mov dword [esp + 0x10], ecx
test ecx, ecx
jne 0x41b396
mov edi, dword [esp + 0x30]
push edi
call dword [0x657004]
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
cmp byte [eax + 0x1ca], 0
je 0x41b3ae
mov ecx, dword [eax + 0x43c]
mov dword [esp + 0x14], ecx
jmp 0x41b3b6
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x41b3cc
test byte [eax + 4], 0x10
je 0x41b3cc
lea edx, [eax + 0x78]
mov dword [esp + 0x2c], edx
jmp 0x41b3d6
lea eax, [ebx + 0x8dc]
mov dword [esp + 0x2c], eax
mov eax, dword [ebx + 0x4a4]
mov ecx, 1
cmp eax, ecx
jbe 0x41b423
mov eax, dword [ebx + 0x8d8]
add eax, 0x74
nop
cmp dword [eax - 8], 0
mov edx, edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edi
je 0x41b41d
mov edi, dword [eax]
lea esi, [eax - 0x14]
cmp edi, edx
cmovge esi, dword [esp + 0x1c]
inc ecx
add eax, 0x60
cmp edi, edx
cmovge edi, edx
cmp ecx, dword [ebx + 0x4a4]
jb 0x41b3f0
mov eax, dword [ebx + 0x4a4]
cmp ecx, eax
jne 0x41b432
push esi
call fcn.0041bd00
add esp, 4
jmp 0x41b43e
lea esi, [ecx + ecx*2]
shl esi, 5
add esi, dword [ebx + 0x8d8]
mov eax, dword [esp + 0x34]
push dword [esi]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov dword [esi + 0x14], eax
call dword [0x657004]
push dword [esi + 4]
call dword [0x657004]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x28]
mov dword [esi], edi
mov dword [esi + 4], ebx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0xc]
lea ebp, [esi + 0x20]
push ebp
push dword [esp + 0x30]
mov eax, dword [eax + 0x1e0]
mov eax, dword [eax]
mov dword [esi + 8], eax
call fcn.0041ab30
add esp, 0x10
test al, al
jne 0x41b4d1
push ebp
call fcn.0041adb0
push edi
mov dword [esi + 0xc], 0
call dword [0x657004]
push ebx
call dword [0x657004]
add esp, 0xc
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x41b4dc
mov byte [eax], 1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret