joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4084e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x4276d4], 0
mov ebp, esp
push edi
mov ecx, dword [ebp + 0xc]
push esi
push ebx
mov ebx, dword [ebp + 0x10]
jne 0x408525
xor edx, edx
mov eax, edx
mov esi, 8
mov edi, eax
and eax, 1
neg eax
shr edi, 1
and eax, 0xedb88320
xor eax, edi
dec esi
jne 0x408502
mov dword [edx*4 + 0x4276d0], eax
inc edx
cmp edx, 0x100
jne 0x4084fb
mov eax, dword [ebp + 8]
not eax
jmp 0x40853f
mov dl, byte [ecx]
dec ebx
inc ecx
xor edx, eax
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x4276d0]
test ebx, ebx
jne 0x40852c
pop ebx
not eax
pop esi
pop edi
pop ebp
ret 0xc

Function at 0x4004f6
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov al, byte [0x400868]
cmp al, 3
jb 0x400542
mov byte [0x400868], 0
mov ecx, 0x2c
lea edx, [0x400867]
lea ebx, [0x400863]
mov al, byte [ebx]
mov byte [edx], al
dec edx
dec ebx
loop 0x400517
lea eax, [0x4007dc]
push 8
push eax
call sub.ADVAPI32.dll_SystemFunction036
lea edx, [0x4007dc]
mov eax, dword [edx]
add edx, 4
and eax, dword [edx]
lea edx, str.UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
mov dword [edx], eax
inc byte [0x400868]
ret
Function at 0x414828
Capabilities:
Enumerate process modules

Disassembly:
push ebp
push ebx
mov edx, 0x10e
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41482f
call fcn.0042ea90
mov edx, dword [esp + 0x448]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b5001], 0x4000096
mov dword [0x4b5001], 0x400009a
push dword [esp + 0x444]
push 0x18
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 0x42c], eax
mov dword [0x4b5001], 0x400009b
cmp dword [esp + 0x42c], 0
je 0x4149ac
mov dword [0x4b5001], 0x400009c
lea ebp, [esp + 4]
mov dword [ebp], 0x428
mov dword [0x4b5001], 0x400009d
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32FirstW
mov dword [esp + 0x430], eax
mov dword [0x4b5001], 0x400009e
cmp dword [esp + 0x430], 0
je 0x414996
mov dword [0x4b5001], 0x400009f
push edx
call fcn.0042e8f0
pop edx
push eax
push 1
push 1
push dword [esp + 0xc]
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
lea ebp, [esp + 0x1c]
lea eax, [ebp + 0x20]
push eax
call fcn.0042d9a0
call fcn.00419292
add dword [esp], edx
call fcn.0042c9b0
call fcn.004192b0
and eax, eax
je 0x41495b
mov dword [0x4b5001], 0x40000a0
lea ebp, [esp + 4]
push dword [ebp + 0x14]
pop eax
mov dword [esp + 0x434], eax
mov dword [0x4b5001], 0x40000a1
jmp 0x414996
mov dword [0x4b5001], 0x40000a2
mov dword [0x4b5001], 0x40000a3
lea eax, [esp + 4]
push eax
push dword [esp + 0x430]
call sub.KERNEL32.dll_Module32NextW
mov dword [esp + 0x430], eax
mov dword [0x4b5001], 0x40000a4
jmp 0x4148cb
mov dword [0x4b5001], 0x40000a5
push dword [esp + 0x42c]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x40000a6
mov dword [0x4b5001], 0x40000a8
mov eax, dword [esp + 0x434]
jmp 0x4149d5
push dword [esp]
call fcn.0042eaf0
add esp, 0x438
pop ebx
pop ebp
ret 8
Function at 0x41586f
Capabilities:
Get system information on windows

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x415876
call fcn.0042ea90
mov dword [0x4b5001], 0x400007f
mov dword [0x4b5001], 0x4000081
mov dword [esp + 0x30], 0
mov dword [0x4b5001], 0x4000083
lea eax, [esp + 0xc]
push eax
call sub.KERNEL32.dll_GetNativeSystemInfo
mov dword [0x4b5001], 0x4000084
lea ebp, [esp + 0xc]
movsx ebx, word [ebp]
cmp ebx, 9
jne 0x4159a8
mov dword [0x4b5001], 0x4000085
mov eax, str.IsWow64Process
push eax
mov eax, str.kernel32.dll
push eax
call fcn.00415777
mov dword [esp], eax
mov dword [0x4b5001], 0x4000086
cmp dword [esp], 0
je 0x41599e
mov dword [0x4b5001], 0x4000087
push dword [esp + 0x40]
push 0
push 0x400
call sub.KERNEL32.dll_OpenProcess
mov dword [esp + 8], eax
mov dword [0x4b5001], 0x4000088
cmp dword [esp + 8], 0
je 0x415994
mov dword [0x4b5001], 0x4000089
lea eax, [esp + 4]
push eax
push dword [esp + 0xc]
push dword [esp + 8]
call fcn.0041c67d
mov dword [0x4b5001], 0x400008a
push dword [esp + 8]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x400008b
mov ebx, dword [esp + 4]
and ebx, ebx
jne 0x41598a
mov dword [0x4b5001], 0x400008c
mov dword [esp + 0x30], 1
mov dword [0x4b5001], 0x400008d
mov dword [0x4b5001], 0x400008e
mov dword [0x4b5001], 0x400008f
mov dword [0x4b5001], 0x4000090
mov dword [0x4b5001], 0x4000092
mov eax, dword [esp + 0x30]
jmp 0x4159ce
add esp, 0x34
pop ebx
pop ebp
ret 4

Function at 0x415bf9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
push ebx
mov edx, 0xd
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x415c00
call fcn.0042ea90
mov dword [0x4b5001], 0x15c
mov dword [0x4b5001], 0x15d
mov byte [esp], 0
mov dword [0x4b5001], 0x15f
lea eax, [esp + 4]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
and eax, eax
je 0x415d40
mov dword [0x4b5001], 0x160
lea eax, [esp + 8]
mov dword [0x4b5001], 0x162
lea eax, [esp + 8]
push eax
mov eax, str.SeDebugPrivilege
push eax
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueW
and eax, eax
je 0x415d23
mov dword [0x4b5001], 0x163
lea eax, [esp + 0x10]
mov dword [0x4b5001], 0x166
lea ebp, [esp + 0x10]
mov dword [ebp], 1
mov dword [0x4b5001], 0x167
lea ebp, [esp + 8]
push dword [ebp]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 4], eax
mov dword [0x4b5001], 0x168
lea ebp, [esp + 8]
push dword [ebp + 4]
lea ebp, [esp + 0x14]
push ebp
pop ebp
pop eax
mov dword [ebp + 8], eax
mov dword [0x4b5001], 0x169
push ebp
pop ebp
mov dword [ebp + 0xc], 2
mov dword [0x4b5001], 0x16b
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x24]
push eax
push 0x10
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
push eax
pop eax
mov byte [esp], al
mov dword [0x4b5001], 0x16c
mov dword [0x4b5001], 0x16d
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x16e
mov dword [0x4b5001], 0x16f
movsx eax, byte [esp]
movsx eax, al
jmp 0x415d69
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x416b7f
Capabilities:
Get graphical window text

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.0042ea90
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b5001], 0x37e
mov dword [0x4b5001], 0x380
push 5
call sub.USER32.DLL_GetDesktopWindow
push eax
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
mov dword [0x4b5001], 0x381
cmp dword [esp + 4], 0
je 0x416cda
mov dword [0x4b5001], 0x382
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextLengthW
mov ebx, eax
add ebx, 2
push ebx
call fcn.0042d2e0
lea eax, [esp + 0xc]
push eax
call fcn.0042e990
mov dword [0x4b5001], 0x383
push dword [esp + 8]
call fcn.0042ca90
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.USER32.DLL_GetWindowTextW
mov dword [0x4b5001], 0x384
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042d420
call fcn.0042ea20
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push dword [esp + 0x18]
call fcn.0042d420
call fcn.00419292
add dword [esp], edx
call fcn.00419292
add dword [esp + 4], edx
call fcn.0042ca30
call fcn.004192b0
and eax, eax
je 0x416ca5
mov dword [0x4b5001], 0x385
mov eax, 1
jmp 0x416cf4
mov dword [0x4b5001], 0x386
mov dword [0x4b5001], 0x387
push 2
push dword [esp + 8]
call sub.USER32.DLL_GetWindow
mov dword [esp + 4], eax
mov dword [0x4b5001], 0x388
jmp 0x416bbe
mov dword [0x4b5001], 0x389
xor eax, eax
jmp 0x416cf4
push dword [esp]
call fcn.0042eaf0
push dword [esp + 8]
call fcn.0042eaf0
add esp, 0xc
pop ebx
ret 4
Function at 0x416db1
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov edx, 0x10d
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x416db7
call fcn.0042ea90
mov edx, dword [esp + 0x440]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b5001], 0x2000085
mov dword [0x4b5001], 0x2000088
lea ebp, [esp + 8]
mov dword [ebp], 0x428
mov dword [0x4b5001], 0x200008b
push dword [esp + 0x43c]
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 4], eax
mov dword [0x4b5001], 0x200008c
cmp dword [esp + 4], 0
je 0x416f90
mov dword [0x4b5001], 0x200008d
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Module32FirstW
and eax, eax
je 0x416f73
mov dword [0x4b5001], 0x200008e
mov dword [0x4b5001], 0x200008f
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
lea ebp, [esp + 0x10]
lea eax, [ebp + 0x20]
push eax
call fcn.0042d9a0
lea eax, [esp + 0x434]
push eax
call fcn.0042e990
mov dword [0x4b5001], 0x2000090
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
lea eax, [ebp + 0x220]
push eax
call fcn.0042d9a0
lea eax, [0x4fe10c]
push eax
call fcn.0042e990
mov dword [0x4b5001], 0x2000094
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push dword [esp + 0x438]
call fcn.0042cce0
call fcn.0042ea20
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042cce0
call fcn.004192c0
mov edx, eax
pop ecx
push ecx
call fcn.004192c0
mov ecx, eax
call fcn.00419240
je 0x416f3c
mov dword [0x4b5001], 0x2000096
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x2000097
lea ebp, [esp + 8]
mov eax, dword [ebp + 0x14]
jmp 0x416fb4
mov dword [0x4b5001], 0x2000098
mov dword [0x4b5001], 0x2000099
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Module32NextW
and eax, eax
je 0x416f66
xor eax, eax
jmp 0x416f6b
mov eax, 1
and eax, eax
je 0x416e4b
mov dword [0x4b5001], 0x200009a
mov dword [0x4b5001], 0x200009b
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x200009c
mov dword [0x4b5001], 0x200009e
xor eax, eax
jmp 0x416fb4
push dword [esp]
call fcn.0042eaf0
push dword [esp + 0x430]
call fcn.0042eaf0
add esp, 0x434
pop ebp
ret 8
Function at 0x417910
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov edx, 0x8e
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x417916
call fcn.0042ea90
mov edx, dword [esp + 0x240]
lea ecx, [esp]
call fcn.00419000
mov dword [0x4b5001], 0x200006b
mov dword [0x4b5001], 0x200006f
lea ebp, [esp + 8]
mov dword [ebp], 0x22c
mov dword [0x4b5001], 0x2000071
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [esp + 4], eax
mov dword [0x4b5001], 0x2000072
cmp dword [esp + 4], 0
je 0x417ad0
mov dword [0x4b5001], 0x2000073
lea ebp, [esp + 8]
mov dword [ebp], 0x22c
mov dword [0x4b5001], 0x2000074
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32FirstW
and eax, eax
je 0x417ab3
mov dword [0x4b5001], 0x2000075
mov dword [0x4b5001], 0x2000076
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
lea ebp, [esp + 0x10]
lea eax, [ebp + 0x24]
push eax
call fcn.0042d9a0
lea eax, [esp + 0x238]
push eax
call fcn.0042e990
mov dword [0x4b5001], 0x2000078
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push dword [esp + 0x23c]
call fcn.0042cce0
call fcn.0042ea20
push edx
call fcn.0042e8f0
pop edx
push eax
push edx
call fcn.0042e8f0
pop edx
push eax
push dword [esp + 0xc]
call fcn.0042cce0
call fcn.004192c0
mov edx, eax
pop ecx
push ecx
call fcn.004192c0
mov ecx, eax
call fcn.00419240
je 0x417a7c
mov dword [0x4b5001], 0x2000079
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x200007a
lea ebp, [esp + 8]
mov eax, dword [ebp + 8]
jmp 0x417af4
mov dword [0x4b5001], 0x200007b
mov dword [0x4b5001], 0x200007c
lea eax, [esp + 8]
push eax
push dword [esp + 8]
call sub.KERNEL32.dll_Process32NextW
and eax, eax
je 0x417aa6
xor eax, eax
jmp 0x417aab
mov eax, 1
and eax, eax
je 0x4179bd
mov dword [0x4b5001], 0x200007d
mov dword [0x4b5001], 0x200007e
push dword [esp + 4]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4b5001], 0x200007f
mov dword [0x4b5001], 0x2000081
xor eax, eax
jmp 0x417af4
push dword [esp + 0x234]
call fcn.0042eaf0
push dword [esp]
call fcn.0042eaf0
add esp, 0x238
pop ebp
ret 4
Function at 0x419a24
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov edi, ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
mov esi, 0x4fe8b0
cmp dword [0x4fe8ac], edi
jne 0x419a53
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4fe8ac], 1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x4fe8a8]
test esi, esi
je 0x419aae
test edi, edi
jne 0x419bf5
xor eax, eax
lea ecx, [esi + 0x114]
inc eax
cmp ebx, dword [ecx]
je 0x419a84
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x419a75
jmp 0x419aa0
push dword [esp + 0x1c]
add eax, 0x84
push dword [esp + 0x1c]
lea eax, [esi + eax*4]
push eax
call fcn.004199cd
xor edi, edi
add esp, 0xc
inc edi
mov esi, dword [esi]
test esi, esi
jne 0x419a64
test edi, edi
jne 0x419bf5
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [esp + 0x10]
push ebp
push ebp
push 0x100000
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x419bf5
mov esi, dword [0x4fe8a8]
jmp 0x419aef
cmp dword [esi + 0xc], 0x3f
jl 0x419b90
mov esi, dword [esi]
test esi, esi
jne 0x419ae3
push 0x310
push 8
push dword [0x4fdca4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
test esi, esi
je 0x419bef
push ebp
push 1
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov dword [esi + 8], eax
test eax, eax
je 0x419be1
push ebp
push ebp
push esi
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
push 0x419c08
mov dword [esi + 0x114], ebx
lea ebx, [esi + 0x214]
push 0x1000
mov dword [esi + 0x14], eax
mov dword [ebx], ebp
push ebp
mov dword [esi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x419bdc
push eax
call edi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
push ebx
call fcn.004199cd
mov eax, dword [0x4fe8a8]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi], eax
test eax, eax
je 0x419b88
mov dword [eax + 4], esi
mov dword [0x4fe8a8], esi
jmp 0x419bf5
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
mov dword [esi + ecx*4 + 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x110], ebx
mov eax, dword [esi + 0xc]
mov dword [esi + eax*4 + 0x210], ebp
mov eax, dword [esi + 0xc]
add eax, 0x84
lea eax, [esi + eax*4]
push eax
call fcn.004199cd
add esp, 0xc
inc dword [esi + 0xc]
push ebp
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x419bf5
push dword [esi + 8]
call edi
push esi
push ebp
push dword [0x4fdca4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call edi
push 0x4fe8b0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x41a604
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
push ebx
push dword [0x4fe920]
xor ebp, ebp
mov edi, ebp
mov dword [esp + 0x18], ebp
call fcn.0042e052
mov esi, eax
test esi, esi
je 0x41a799
mov ecx, dword [esi]
mov dword [esp + 0x18], ecx
cmp dword [esi + 0x14], ebp
je 0x41a6ae
push ebx
call fcn.0041aa47
jmp 0x41a646
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [esi + 0x1d], 0
jne 0x41a63e
push dword [esi + 0x14]
call fcn.0041aae6
mov eax, dword [esp + 0x1c]
push ebp
push esi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
call fcn.0041a58f
pop ecx
pop ecx
lea eax, [esp + 0x1c]
push eax
push ebp
push esi
push 0x41a7b3
push 0x2000
push ebp
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41a68b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x20], 0xffffffff
je 0x41a69c
push dword [esp + 0x20]
push ebx
call fcn.0041a907
mov eax, dword [esi]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [esi]
push 1
jmp 0x41a74e
test byte [esp + 0x1c], 1
je 0x41a6bd
mov dword [esp + 0x10], 1
test byte [esp + 0x1c], 2
je 0x41a758
push esi
call fcn.0041a526
lea eax, [esi + 4]
push 0x10
push eax
call fcn.0042e84e
pop ecx
pop ecx
mov ecx, dword [0x4fe988]
mov edi, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x1c]
mov edx, dword [ecx]
push ecx
call dword [edx + 0x14]
test eax, eax
jne 0x41a799
mov eax, dword [esp + 0x18]
mov dword [edi], eax
mov eax, dword [esp + 0x10]
mov byte [edi + 5], al
mov byte [edi + 4], 1
mov eax, dword [esp + 0x18]
push dword [esi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [esp + 0x18]
push dword [esi + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
cmp dword [esp + 0x20], 0xffffffff
je 0x41a739
push edi
push dword [esp + 0x24]
push ebx
call fcn.0041a867
jmp 0x41a746
mov eax, dword [esp + 0x18]
push dword [esi + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esp + 0x18]
push dword [esp + 0x10]
mov ecx, dword [eax]
push ebp
push ebp
push eax
call dword [ecx + 0x30]
jmp 0x41a799
mov eax, dword [ecx]
push ecx
call dword [eax + 0x48]
mov eax, dword [esp + 0x18]
push ebp
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
cmp dword [esp + 0x20], 0xffffffff
je 0x41a77a
push dword [esp + 0x20]
push ebx
call fcn.0041a907
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
push ebx
push ebp
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x41a799
xor edi, edi
mov byte [esi + 0x1c], 1
inc edi
mov byte [esi + 0x1e], bl
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x41b1b0
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x41b205
push dword [esp + 0x10]
push 0x41b12f
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x4fe944]
test esi, esi
je 0x41b25e
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x41b1fd
cmp byte [esi + 0x10], 0
je 0x41b1fd
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x41b1d9
jmp 0x41b25e
mov esi, dword [0x4fe944]
test esi, esi
je 0x41b25e
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x41b257
cmp byte [esi + 0x11], 0
je 0x41b233
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x41b24a
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push ebp
push 0x4fe944
call fcn.0042e80e
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x41b212
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x41b916
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x4ff968]
call fcn.0042dee1
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x41ba16
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x41b96c
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x41b964
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x41b9ac
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x41b9ee
push 0x22
pop edx
cmp cx, dx
je 0x41b99e
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x41b98e
xor ecx, ecx
cmp word [eax], cx
je 0x41b9ee
mov ecx, eax
add eax, 2
jmp 0x41b9f0
test dx, dx
je 0x41b9f6
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x41b99e
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x41b9e4
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x41b9ee
cmp cx, dx
je 0x41b9e1
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x41b9d1
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x41b9b6
jmp 0x41b99e
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x41b9f8
xor edx, edx
cmp dword [ebp], ebx
jne 0x41ba01
test edi, edi
jne 0x41ba1e
test edx, edx
je 0x41ba06
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x41b95a
test edi, edi
jne 0x41ba2f
mov eax, ebx
jmp 0x41ba33
test esi, esi
je 0x41ba2f
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x41ba33
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x41bbaa
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, 0x1000
push ebx
push ebp
push esi
push edi
xor edi, edi
mov ebx, eax
cmp dword [esp + 0x24], 0x18
je 0x41bc59
cmp dword [esp + 0x24], 2
je 0x41bc59
push 0x2000
push edi
push dword [0x4fdca4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x41bc2c
cmp dword [esp + 0x18], 2
jne 0x41bc44
test ebx, ebx
jne 0x41bc15
lea eax, [edi*2 + 0x2000]
push eax
push esi
push 8
push dword [0x4fdca4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov ax, word [esp + 0x14]
cmp ax, 0xa
je 0x41bc44
cmp ax, 0xd
je 0x41bc2c
mov word [esi + edi*2], ax
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 2
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x41bbec
push dword [esp + 0x28]
xor eax, eax
push esi
mov word [esi + edi*2], ax
call fcn.0049c580
jmp 0x41bcdf
push eax
push 0
push dword [0x4fdca4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
jmp 0x41bcab
cmp dword [esp + 0x18], 1
jne 0x41bcc3
test ebx, ebx
jne 0x41bc9a
lea eax, [edi + 0x1000]
push eax
push esi
push 8
push dword [0x4fdca4]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov esi, eax
mov ebx, 0x1000
mov al, byte [esp + 0x13]
cmp al, 0xa
je 0x41bcc3
cmp al, 0xd
je 0x41bcab
mov byte [esi + edi], al
inc edi
dec ebx
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x30]
call ebp
test eax, eax
jne 0x41bc72
cmp dword [esp + 0x24], 0x18
push dword [esp + 0x28]
mov byte [esi + edi], 0
push esi
jne 0x41bcda
call fcn.0049c5d0
jmp 0x41bcdf
call fcn.0049c780
push esi
push 0
push dword [0x4fdca4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc

Function at 0x41bfb0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x4fe958], 0
jne 0x41bfbe
call fcn.0041bf50
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
push dword [0x4fe95c]
call esi
test eax, eax
jne 0x41bfe1
call fcn.0041bf50
push dword [0x4fe95c]
call esi
mov edx, dword [esp + 0x14]
lea esi, [eax + 8]
mov edi, 0x11
lea ecx, [ecx]
imul ecx, edx, 0x53a9b4fb
lea esi, [esi + 4]
mov edx, 1
sub edx, ecx
imul ecx, edx, 0x53a9b4fb
mov dword [esi + 0x40], edx
mov edx, 1
sub edx, ecx
mov dword [esi - 4], edx
dec edi
jne 0x41bff0
mov dword [eax], edi
lea ebp, [edi + 0x1f]
mov dword [eax + 4], 0xa
mov ebx, dword [eax]
mov edi, dword [eax + 4]
mov edx, dword [eax + ebx*4 + 8]
mov ecx, dword [eax + ebx*4 + 0x4c]
mov esi, dword [eax + edi*4 + 8]
ror ecx, 0xd
add ecx, dword [eax + edi*4 + 0x4c]
dec edi
ror edx, 5
add edx, esi
mov dword [eax + ebx*4 + 8], ecx
mov dword [eax + ebx*4 + 0x4c], edx
dec ebx
jns 0x41c050
mov ebx, 0x10
test edi, edi
jns 0x41c059
mov edi, 0x10
mov dword [eax], ebx
mov dword [eax + 4], edi
dec ebp
jne 0x41c022
pop edi
pop esi
pop ebp
pop ebx
ret 4