joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5eb308
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5eb31f
add esp, 0xfffffff0
call fcn.0040857c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00477cc4
mov eax, dword [0x60ebe0]
cmp byte [eax], 0
jne 0x5eb34c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x60ef54]
cmp word [eax + 2], 0
jne 0x5eb366
mov eax, dword [0x60ef54]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005ed7a0
mov eax, dword [0x60f098]
cmp word [eax + 2], 0
jne 0x5eb380
mov eax, dword [0x60f098]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005ed9a4
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x50a9c4]
call fcn.00510eec
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5edf1c
mov dl, 1
mov eax, dword [0x43ede0]
call fcn.00407e9c
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x43ede0]
call fcn.00407e9c
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x50f760]
call fcn.0051b15c
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5eb570
mov eax, dword [0x60edf8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.0051b678
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5ee204
mov dl, 1
mov eax, dword [0x43ede0]
call fcn.00407e9c
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x60edf8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00425c58
test eax, eax
je 0x5eb49a
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425ab0
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425c3c
test eax, eax
je 0x5eb4b2
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a878
push ebx
push 0x5ed180
call fcn.005e0554
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x60ebe0]
cmp byte [eax], 0
jne 0x5eb503
mov eax, ebx
call fcn.005eb738
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005ee43c
mov eax, ebx
call fcn.005ef0c4
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5eb567
call fcn.004085d4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5eba64
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5ebb06
cmp dword [ebx + 0xac], 0
jne 0x5ebb00
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5eb9a4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5ebb00
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5ebac6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5ebb00
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.00462604
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5ebad5
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5ebdac
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x61618c]
cmp dword [eax + 0x188], 0
je 0x5ebf15
test bl, bl
jne 0x5ebe68
cmp dword [esi + 0xb4], 0
jne 0x5ebe5d
mov eax, esi
call fcn.005eef14
push eax
push 0x5ebcac
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5ebe2e
mov eax, dword [0x61618c]
cmp byte [eax + 0xeb], 0
je 0x5ebe2e
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5ebe0f
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ebe2e
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ebe17
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ebe5d
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00462604
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ebe3d
inc dword [esi + 0xb4]
jmp 0x5ebf15
cmp dword [esi + 0xb4], 0
jle 0x5ebf15
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5ebf15
cmp dword [esi + 0x58], 0
je 0x5ebeca
mov eax, dword [0x61618c]
cmp byte [eax + 0xeb], 0
je 0x5ebeca
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5ebeab
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ebeca
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ebeb3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ebef9
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.00462604
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ebed9
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5dcbc4]
call fcn.0040c53c
pop edi
pop esi
pop ebx
ret
Function at 0x5ecc9c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5eccf9
cmp byte [ebx + 0xeb], 0
jne 0x5eccf9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409eb0
mov eax, dword [esi]
test eax, eax
je 0x5ecce6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5ecd06
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a108
jmp 0x5ecd06
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a108
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5ee650
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5ee6c1
mov eax, esi
call fcn.0053f328
test al, al
je 0x5ee6c1
mov eax, dword [ebx + 0x98]
call fcn.0053ef54
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5ee6c1
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x140]
test al, al
je 0x5ee6b2
push 0
mov eax, dword [ebx + 0x98]
call fcn.0053ef54
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00535b2c
jmp 0x5ee6c1
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005ee45c
pop esi
pop ebx
ret
Function at 0x5f9d7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x214], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x5f9ee9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00409d28
mov eax, esi
mov edx, 0x5f9f04
call fcn.0040abc0
jne 0x5f9dbe
xor ebx, ebx
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5f9f20
call fcn.0040abc0
jne 0x5f9dd6
mov ebx, 0x1a
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5f9f3c
call fcn.0040abc0
jne 0x5f9deb
mov ebx, 0x1c
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5f9f5c
call fcn.0040abc0
jne 0x5f9e00
mov ebx, 0x26
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5f9f84
call fcn.0040abc0
jne 0x5f9e15
mov ebx, 6
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5f9fa4
call fcn.0040abc0
jne 0x5f9e2a
mov ebx, 5
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5f9fcc
call fcn.0040abc0
jne 0x5f9e3f
mov ebx, 0x28
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5fa010
call fcn.0040abc0
jne 0x5f9e54
mov ebx, 0x27
jmp 0x5f9e67
mov eax, esi
mov edx, 0x5fa034
call fcn.0040abc0
jne 0x5f9e67
mov ebx, 0x19
xor edx, edx
push ebp
push 0x5f9ec6
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x5f9ebc
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x5f9ebc
lea eax, [ebp - 0x214]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.0040a878
mov eax, dword [ebp - 0x214]
mov edx, edi
call fcn.005f9cb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5f9ed0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f9ef0
lea eax, [ebp - 0x214]
call fcn.00409d28
ret

Function at 0x5fa164
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x5fa1fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x60f05c]
mov eax, dword [eax]
call fcn.005ed35c
cmp ebx, 1
jne 0x5fa19c
push 1
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fa205
test ebx, ebx
jg 0x5fa1aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fa205
call sub.kernel32.dll_GetTickCount
mov esi, eax
push 1
call sub.kernel32.dll_Sleep
mov eax, dword [0x60f05c]
mov eax, dword [eax]
call fcn.005ed35c
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
mov eax, esi
cdq
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
push edx
push eax
mov eax, ebx
cdq
cmp edx, dword [esp + 4]
jne 0x5fa1ed
cmp eax, dword [esp]
pop edx
pop eax
ja 0x5fa1b1
jmp 0x5fa1f1
pop edx
pop eax
jg 0x5fa1b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fa205
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5fa284
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5fa2b9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5fa2c5
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x6007d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x6009aa
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6008aa
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x60eb88], 0
je 0x6008a0
mov edx, dword [0x60ecf4]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, dword [0x616230]
call fcn.0040aa28
mov eax, dword [ebp - 8]
cmp byte [eax + 0x41c], 0
jne 0x6008a0
cmp byte [0x60eb89], 0
jne 0x60083e
cmp byte [0x60eb8a], 0
je 0x6008a0
cmp dword [0x60eb8c], 0
je 0x6008a0
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00425354
test al, al
jne 0x6008a0
push dword [0x60eba8]
push dword [0x60eb8c]
push dword [0x616230]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.0040aab0
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.005f98b0
push 0
push 0
push 0x6009b8
mov eax, dword [ebp - 4]
call fcn.0040a7d4
push eax
push 0x6009d0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6008b4
xor eax, eax
push ebp
push 0x60097d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0x418], 0xc8
jge 0x600973
cmp byte [0x60eb88], 0
je 0x600930
cmp byte [0x60eb89], 0
jne 0x6008f0
cmp byte [0x60eb8a], 0
je 0x600930
push 0
push 0
push 0x6009dc
mov eax, dword [0x60ecf4]
push dword [eax]
push dword [0x60eb90]
push dword [0x60eb94]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040aab0
mov eax, dword [ebp - 0x14]
call fcn.0040a7d4
push eax
push 0x6009d0
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x600973
cmp byte [0x60eb88], 0
jne 0x600973
push 0
push 0
push 0
mov eax, dword [0x60ecf4]
push dword [eax]
push dword [0x60eb90]
push 0x6009f0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040aab0
mov eax, dword [ebp - 0x18]
call fcn.0040a7d4
push eax
push 0x6009d0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x600987
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6009b1
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00409d88
lea eax, [ebp - 4]
call fcn.00409d28
ret
Function at 0x600a0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x600a14
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x600c6f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x44624c]
call fcn.00469d2c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x600b4d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x60eb98], 0
je 0x600b43
mov eax, dword [0x60ecf4]
push dword [eax]
push dword [0x60eba0]
push dword [0x616234]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040aab0
mov eax, dword [ebp - 0xc]
cmp byte [eax + 0x41c], 0
jne 0x600b43
cmp byte [0x60eb99], 0
jne 0x600aa2
cmp byte [0x60eb9a], 0
je 0x600b43
cmp dword [0x60eb9c], 0
je 0x600b43
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.00425354
test al, al
jne 0x600b43
lea eax, [ebp - 0x18]
mov ecx, dword [0x60eb9c]
mov edx, dword [0x60eba8]
call fcn.0040aa28
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.005f98d0
lea edx, [ebp - 4]
mov eax, dword [ebp - 0x10]
call fcn.0046a010
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.005f97c8
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040a8b4
mov ecx, dword [ebp - 0x1c]
mov edx, dword [0x60ecf4]
mov edx, dword [edx]
lea eax, [ebp - 8]
call fcn.0040aa28
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005f98b0
push 0
push 0
push 0x600c80
mov eax, dword [ebp - 8]
call fcn.0040a7d4
push eax
push 0x600c98
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x600b57
mov eax, dword [ebp - 0x10]
call fcn.00407ecc
xor eax, eax
push ebp
push 0x600c28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x418], 0xc8
jge 0x600c1e
cmp byte [0x60eb98], 0
je 0x600bdb
cmp byte [0x60eb99], 0
jne 0x600b9b
cmp byte [0x60eb9a], 0
je 0x600bdb
push 0
push 0
push 0x600ca4
mov eax, dword [0x60ecf4]
push dword [eax]
push dword [0x60eba0]
push dword [0x616234]
lea eax, [ebp - 0x28]
mov edx, 3
call fcn.0040aab0
mov eax, dword [ebp - 0x28]
call fcn.0040a7d4
push eax
push 0x600c98
push 0
call sub.shell32.dll_ShellExecuteW
jmp 0x600c1e
cmp byte [0x60eb98], 0
jne 0x600c1e
push 0
push 0
push 0
mov eax, dword [0x60ecf4]
push dword [eax]
push dword [0x60eba0]
push 0x600cb8
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.0040aab0
mov eax, dword [ebp - 0x2c]
call fcn.0040a7d4
push eax
push 0x600c98
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x600c32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x600c76
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00409d88
lea eax, [ebp - 0x20]
call fcn.00409d70
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00409d88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409d88
ret
Function at 0x401ab5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45f090]
jne 0x401abf
repz ret
jmp fcn.00402878

Function at 0x40aa9e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407675
and dword [ebp - 4], 0
cmp dword [0x4651f8], 0
mov ebx, eax
jne 0x40ab4f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40ac00
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40ac00
push eax
call fcn.00407603
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4651f8], eax
call esi
push eax
call fcn.00407603
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4651fc], eax
call esi
push eax
call fcn.00407603
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x465200], eax
call esi
push eax
call fcn.00407603
pop ecx
mov dword [0x465208], eax
test eax, eax
je 0x40ab4f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00407603
pop ecx
mov dword [0x465204], eax
mov eax, dword [0x465204]
cmp eax, ebx
je 0x40aba7
cmp dword [0x465208], ebx
je 0x40aba7
push eax
call fcn.0040767e
push dword [0x465208]
mov esi, eax
call fcn.0040767e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40aba7
test edi, edi
je 0x40aba7
call esi
test eax, eax
je 0x40ab9e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ab9e
test byte [ebp - 0xc], 1
jne 0x40aba7
or dword [ebp + 0x10], 0x200000
jmp 0x40abe0
mov eax, dword [0x4651fc]
cmp eax, ebx
je 0x40abe0
push eax
call fcn.0040767e
pop ecx
test eax, eax
je 0x40abe0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40abe0
mov eax, dword [0x465200]
cmp eax, ebx
je 0x40abe0
push eax
call fcn.0040767e
pop ecx
test eax, eax
je 0x40abe0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4651f8]
call fcn.0040767e
pop ecx
test eax, eax
je 0x40ac00
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ac02
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d79b
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [0x1bdb82c], 0x930
jne 0x40d7c2
push str.ridivizujohomalelerijuva_nazogipedijifavave
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
cmp dword [0x1bdb82c], 0x114e
mov eax, dword [ebp + 8]
mov dword [0x1bdb548], eax
jne 0x40d7fa
push str.pasesibuhapijibitemamobumofaceco_bamenolunalazoxeduceh_zijetezudihedavacagobowavawe
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
lea eax, [ebp - 0x1c]
push eax
push str.gijuluzibuxomavifakulaxofaxutirerijasocazitixewecetanazisofosufexejacikicoyaxahowuburokujasulununucexikowuvulanavi
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret
Function at 0x408ef0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408ea4
test al, al
jne 0x408f11
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408f5d
xor eax, eax
push ebp
push 0x408f4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004033e8
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408f54
lea eax, [ebp - 0xc]
call fcn.00408ee0
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409264
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x409353
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406c28
mov edx, dword [ebp - 8]
mov ecx, 0x40936c
xor eax, eax
call fcn.00409158
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x409321
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x409284
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.00408d0c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404bb8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.004071b8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.00408cdc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x404584
call fcn.004057b4
call fcn.00402e88
jmp 0x409284
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00403200
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40935a
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040318c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040318c
ret

Function at 0x40940c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409466
inc esi
xor edi, edi
cmp edi, 1
jne 0x409432
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x409440
cmp edi, 1
jle 0x409440
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408ef0
test eax, eax
jne 0x409466
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409466
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409466
inc edi
dec esi
jne 0x409422
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x409898
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40996b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409984
push ebx
push 0x409990
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409918
mov al, 0x62
call fcn.00409470
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040986c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409921
call fcn.0040986c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409972
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409a24
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ad8
jmp 0x409acd
cmp dword [esi + 0x10], 0x1000
jne 0x409ab9
test byte [esi + 0x15], 1
jne 0x409ab9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a78
cmp eax, 2
je 0x409a78
cmp eax, 0x10
je 0x409a78
cmp eax, 0x20
jne 0x409a8d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a8d
mov bl, 1
xor ebp, ebp
jmp 0x409a9e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a1c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a91
test bl, bl
je 0x409ab9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ad8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a50
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret