joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319b], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319b]
mov dword [ebp - 0x48], eax
mov eax, 0x401bbc
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319b]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret
Function at 0x402300
Capabilities:
Check os version
Get token membership

Disassembly:
sub esp, 0xf0
mov eax, dword [0x4740f4]
xor eax, esp
mov dword [esp + 0xec], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x90
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x28], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0x94
call fcn.00440150
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402415
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402415
cmp dword [esp + 0x24], 6
jb 0x4023bb
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x20]
push ecx
push 0x12
push edx
call esi
test eax, eax
je 0x402415
cmp dword [esp + 0x18], 3
jne 0x4023bb
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x13
push edx
call esi
test eax, eax
je 0x402415
cmp dword [esp + 0xc], ebx
jne 0x4023d7
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x402415
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xb8]
push eax
push ebx
push 0x1a
mov dword [esp + 0x24], 0x44
call dword [sym.imp.ADVAPI32.dll_CreateWellKnownSid]
test eax, eax
je 0x402415
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xb8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x40241d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
je 0x402432
push eax
call esi
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x402441
push eax
call esi
mov dword [esp + 0xc], ebx
cmp edi, ebx
je 0x402458
push 0x46af84
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], edi
call fcn.004401ca
mov ecx, dword [esp + 0xf8]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0043fd57
add esp, 0xf0
ret
Function at 0x402e10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x4574f8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x4740f4]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ebx, ecx
movzx eax, word [esp + 0x48]
push 2
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0x400
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0042535f
mov dword [esp + 0x40], edi
test esi, esi
je 0x402eaa
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea ecx, [esp + 0x1c]
call fcn.004253f0
push 1
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebx
call fcn.00402ce0
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0042542d
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [esp + 0x10]
mov dword [esp + 0x40], 0xffffffff
call fcn.00425751
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x34
ret 4
Function at 0x403190
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x45752b
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x4740f4]
xor eax, esp
mov dword [esp + 0x24c], eax
push esi
push edi
mov eax, dword [0x4740f4]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x26c]
call fcn.00402300
test eax, eax
je 0x403366
call fcn.00402480
test eax, eax
jne 0x403366
push 0x21
push 0xea61
push 0xea66
call fcn.00410a20
add esp, 0xc
cmp eax, 1
jne 0x403366
test esi, esi
je 0x403231
cmp dword [esi + 0x60], 0
je 0x403231
push 0x24
push 0xea61
push 0xea69
call fcn.00410a20
add esp, 0xc
cmp eax, 6
jne 0x403231
mov ecx, esi
call fcn.00406ae0
mov eax, dword [0x4758ac]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea ecx, [esp + 0x50]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x403366
push 0x38
lea edx, [esp + 0x18]
push 0
push edx
mov dword [esp + 0x1c], 0x3c
call fcn.00440150
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.004012f0
lea ecx, [esp + 0x150]
push ecx
lea eax, [esp + 0x50]
push 0x104
mov dword [esp + 0x26c], 0
mov dword [esp + 0x24], str.runas
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0x150]
push 0x463c85
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x30], 1
call fcn.00403110
mov esi, 1
cmp dword [0x479ee4], esi
jl 0x403322
lea ecx, [ecx]
mov eax, dword [0x479ee8]
mov edx, dword [eax + esi*4]
test edx, edx
jne 0x4032f0
xor eax, eax
jmp 0x4032fe
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4032f5
sub eax, edi
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.00402fd0
push 1
push 0x45c2a4
lea ecx, [esp + 0x14]
call fcn.00402fd0
inc esi
cmp esi, dword [0x479ee4]
jle 0x4032e0
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x28], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x403391
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [esi - 0x10]
mov dword [esp + 0x264], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403366
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.0043fd57
add esp, 0x25c
ret
push 0
call fcn.00440882
int3
Function at 0x403cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403cc9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403d04
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x403d00
lea ebx, [ebx]
cmp esi, eax
jae 0x403d04
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403cf0
cmp esi, eax
jb 0x403d0a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x406bf0
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x2c0
mov eax, dword [0x4740f4]
xor eax, esp
mov dword [esp + 0x2bc], eax
push esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
mov esi, ecx
call fcn.00440150
add esp, 0xc
push 0x475698
push 0x104
lea ecx, [esp + 0x1c0]
push ecx
push str.DbgView.exe
push str.debugview
push str.window
mov dword [esp + 0x30], 0x44
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x1b8]
push edx
lea eax, [esp + 0xb4]
push 0x105
push eax
call fcn.00440c6f
add esp, 0xc
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0xb0]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406c80
sub eax, edx
jne 0x406ca6
mov dx, word [0x45ce78]
mov al, byte [0x45ce7a]
mov word [esp + 0xb0], dx
mov byte [esp + 0xb2], al
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0xb8]
push eax
push 0
push 0x4000000
push 0
push 0
push 0
lea ecx, [esp + 0x1d8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x406d1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x60]
push str.Error__d_starting_DebugView
push edx
call fcn.00440071
add esp, 0xc
push 0x10
push 0x45bf7c
lea eax, [esp + 0x64]
push eax
mov ecx, esi
call fcn.00419ce4
pop esi
mov ecx, dword [esp + 0x2bc]
xor ecx, esp
call fcn.0043fd57
add esp, 0x2c0
ret
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
mov ecx, dword [esp + 0x2c0]
pop esi
xor ecx, esp
call fcn.0043fd57
add esp, 0x2c0
ret

Function at 0x406d50
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
sub esp, 0x1c
push ebp
push esi
xor eax, eax
xor esi, esi
push esi
push 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x406d8c
pop esi
xor eax, eax
pop ebp
add esp, 0x1c
ret
lea eax, [esp + 8]
push eax
push ebp
mov dword [esp + 0x10], 0x1c
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x406df5
push ebx
mov bl, byte [esp + 0x30]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
nop
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x1c], ecx
jne 0x406de1
mov edx, dword [esp + 0x18]
push edx
push 0
push 2
call edi
mov esi, eax
push esi
test bl, bl
je 0x406dd4
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x406dda
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x406db0
pop edi
lea esi, [eax + 1]
pop ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x407980
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x88
mov eax, dword [0x4740f4]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x8c]
push esi
push 0x45d210
push eax
call fcn.0044158d
mov esi, eax
add esp, 8
test esi, esi
je 0x407a98
push edi
push esi
call fcn.00441b0d
push esi
push 0x2c
mov edi, eax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.00441953
add esp, 0x14
cmp eax, 0x2c
jne 0x407a8e
jmp 0x4079e0
cmp dword [esp + 8], 0x5f476f42
jne 0x407a12
cmp dword [esp + 0xc], 0x30392a20
jne 0x407a12
cmp dword [esp + 0x10], 0x2126302e
jne 0x407a12
cmp dword [esp + 0x14], 0x59202021
jne 0x407a12
cmp dword [esp + 0x18], 0x3e79
je 0x407a46
push 0
add edi, 4
push edi
push esi
call fcn.0044162e
add esp, 0xc
test eax, eax
jne 0x407a8e
push esi
call fcn.00441b0d
push esi
push 0x2c
lea ecx, [esp + 0x14]
push 1
push ecx
mov edi, eax
call fcn.00441953
add esp, 0x14
cmp eax, 0x2c
je 0x4079e0
jmp 0x407a8e
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test eax, eax
jne 0x407a62
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push edx
push ecx
push eax
lea edx, [esp + 0x44]
push str.Safedisk_version__d._d._d_detected
push edx
call fcn.00440071
add esp, 0x14
push 0x40031
push str.DxWnd_hint
lea eax, [esp + 0x40]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.0044144d
add esp, 4
pop edi
mov ecx, dword [esp + 0x88]
pop esi
xor ecx, esp
call fcn.0043fd57
add esp, 0x88
ret
Function at 0x407ab0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x484
mov eax, dword [0x4740f4]
xor eax, esp
mov dword [esp + 0x480], eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
push 0
push 0x80
push 3
push 0
push 0
mov esi, ecx
push Ordinal_3
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x407c10
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x407b02
mov ecx, dword [str..noshim]
push 0
push 0x80
push 2
push 0
push 0
mov dword [eax], ecx
mov edx, dword [0x45d314]
push 0x40000000
push esi
mov dword [eax + 4], edx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x407bb4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
lea eax, [esp + 0x18]
push str.Creation_of_hidden_copy_of_target_file_with_no_SHIMs_failed_nError_d
push eax
call fcn.00440071
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc
push 0
push str.Warning
lea ecx, [esp + 0x1c]
push ecx
push 0
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x407c10
call esi
push eax
lea edx, [esp + 0x18]
push str.CloseHandle_failed_nError_d
push edx
call fcn.00440071
add esp, 0xc
push 0
push 0x45bf7c
lea eax, [esp + 0x1c]
push eax
push 0
call ebp
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x480]
xor ecx, esp
call fcn.0043fd57
add esp, 0x484
ret
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
lea ebx, [ebx]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x400
lea edx, [esp + 0x98]
push edx
push edi
call ebp
test eax, eax
je 0x407c04
mov ecx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x98]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x407c04
cmp dword [esp + 0xc], 0x400
je 0x407bc0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
mov ecx, dword [esp + 0x48c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0043fd57
add esp, 0x484
ret
Function at 0x409270
Capabilities:
Read .ini file

Disassembly:
push ebp
push esi
xor esi, esi
mov ebp, ecx
cmp dword [0x4721c0], esi
je 0x4092e8
push ebx
push edi
xor edi, edi
mov eax, dword [edi + 0x4721cc]
push 0x475698
push 0
push eax
push str.keymapping
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ebx, eax
test ebx, ebx
je 0x4092d5
push esi
mov ecx, ebp
call fcn.004021b0
push eax
call dword [sym.imp.USER32.dll_UnregisterHotKey]
push ebx
push 7
push esi
mov ecx, ebp
call fcn.004021b0
push eax
call dword [sym.imp.USER32.dll_RegisterHotKey]
test eax, eax
jne 0x4092d5
mov ecx, dword [edi + 0x4721cc]
push ecx
call fcn.00406b90
add esp, 4
inc esi
lea edi, [esi + esi*4]
add edi, edi
add edi, edi
cmp dword [edi + 0x4721c0], 0
jne 0x409282
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x40a390
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x20]
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
push eax
call edi
push eax
call fcn.0041adb7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x6c]
call eax
mov ecx, dword [esi + 0x20]
push ecx
mov ebx, eax
call edi
push eax
call fcn.0041adb7
mov dword [0x475690], eax
cmp dword [esi + 0x41350], 0
jne 0x40a4ab
mov edx, dword [0x4755a4]
push 0xa
push 1
neg edx
push 0x45d7a0
sbb edx, edx
not edx
and edx, str.DxWnd_DirectDraw_windowizer
push edx
push 0
push 0x85
push 0
push 0x45d7a0
push 0x800a
lea edi, [esi + 0x41100]
push 0
mov ecx, edi
call fcn.00412e50
push 0
test eax, eax
jne 0x40a451
push 0xea63
push 0xea78
call fcn.00410a20
add esp, 0xc
cmp dword [0x4755b0], 0
je 0x40a4e2
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x406eb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ecx
ret
mov ecx, dword [ebx + 4]
push 0x801b
push ecx
call dword [sym.imp.USER32.dll_GetMenuState]
xor edx, edx
cmp eax, 8
setne dl
mov ecx, edi
add edx, 0x89
mov eax, edx
push eax
call fcn.00413140
test eax, eax
jne 0x40a494
push eax
push 0xea63
push 0xea79
call fcn.00410a20
add esp, 0xc
pop edi
pop esi
pop ebx
pop ecx
ret
lea eax, [esp + 0xc]
push eax
push 0
push edi
push 0x40a130
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
add esi, 0x41100
mov ecx, esi
call fcn.00413070
push 1
push 0
mov ecx, esi
call fcn.00413240
mov ecx, dword [0x475690]
push ecx
mov ecx, esi
call fcn.00412ba0
mov edx, dword [0x475690]
push 0
push edx
call fcn.00413820
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40b7b0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4579fb
mov eax, dword fs:[0]
push eax
sub esp, 0x598
push ebx
push esi
push edi
mov eax, dword [0x4740f4]
xor eax, esp
push eax
lea eax, [esp + 0x5a8]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [esp + 0x14]
call fcn.00417200
mov eax, dword [edi + 0x20]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x1032
push eax
mov dword [esp + 0x5c0], 0
call ebx
test eax, eax
je 0x40b899
mov ecx, dword [edi + 0x20]
push 2
push 0xffffffffffffffff
push 0x100c
push ecx
call ebx
mov edx, dword [edi + 0x20]
inc eax
push 2
lea esi, [eax - 1]
push esi
push 0x100c
push edx
call ebx
imul esi, esi, 0x264
mov esi, dword [esi + edi + 0x1aec4]
push 0x45d8f8
push str.dxwnd.reg
call fcn.0044158d
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x40b86d
push 0x10
push 0xea63
push 0xea82
call fcn.00410a20
add esp, 0xc
jmp 0x40b899
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b872
push ebx
sub eax, edx
push 1
push eax
push esi
call fcn.0044234c
push ebx
push 0x45d8e8
call fcn.004420db
push ebx
call fcn.0044144d
add esp, 0x1c
lea ecx, [esp + 0x10]
mov dword [esp + 0x5b0], 0xffffffff
call fcn.0040b410
mov ecx, dword [esp + 0x5a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x5a4
ret

Function at 0x40bab0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x457a5b
mov eax, dword fs:[0]
push eax
sub esp, 0x9e8
push ebx
push esi
push edi
mov eax, dword [0x4740f4]
xor eax, esp
push eax
lea eax, [esp + 0x9f8]
mov dword fs:[0], eax
mov edi, ecx
push 0
lea ecx, [esp + 0x464]
call fcn.00417200
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0xa04], 0
call sub.dxwnd.dll_Ordinal_5
add esp, 4
or ebx, 0xffffffff
cmp eax, 2
je 0x40bb25
push 0x30
push 0xea62
push 0xea71
call fcn.00410a20
add esp, 0xc
jmp 0x40bbd7
push 0x62
call fcn.00417d4c
movsx ecx, word [esp + 0x18]
imul ecx, ecx, 0x264
push ebx
lea edx, [ecx + edi + 0x1ac64]
push edx
mov esi, eax
push 0x30
push esi
push 0
call fcn.00441eff
push esi
push 0x24
push 0xea61
push 0xea72
call fcn.00410ad0
add esp, 0x28
cmp eax, 6
jne 0x40bbe2
mov eax, dword [esp + 0x48]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40bb9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x48]
push eax
push ecx
push 0x30
push 0xea63
push 0xea73
call fcn.00410ad0
add esp, 0x14
jmp 0x40bbe2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40bbc8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x30
push 0xea63
push 0xea74
call fcn.00410ad0
add esp, 0x14
jmp 0x40bbe2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.USER32.dll_ClipCursor]
lea esi, [edi + 0x41064]
call fcn.00405520
lea ecx, [esp + 0x460]
mov dword [esp + 0xa00], ebx
call fcn.0040b410
mov ecx, dword [esp + 0x9f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x9f4
ret