joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4066e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x60], 0xe
mov dword [ebp - 0x54], 0x53
mov dword [ebp - 0x64], 0x1e
mov dword [ebp - 0x68], 0x10
mov dword [ebp - 0x30], 0x40
mov dword [ebp - 0x6c], 0x31
mov dword [ebp - 4], 0x49
mov dword [ebp - 0x5c], 0x2a
mov dword [ebp - 0x70], 0x60
mov dword [ebp - 0x48], 0x5a
mov dword [ebp - 0x14], 0xd
mov dword [ebp - 0x18], 0x58
mov dword [ebp - 0x44], 0x3d
mov dword [ebp - 0x58], 0x10
mov dword [ebp - 0x40], 0x22
mov dword [ebp - 0x74], 0x4c
mov dword [ebp - 0x78], 0x43
mov dword [ebp - 0x28], 0x42
mov dword [ebp - 0x7c], 0x43
mov dword [ebp - 0x80], 0x4c
mov dword [ebp - 0x4c], 0x5c
mov dword [ebp - 8], 0x1c
mov dword [ebp - 0x50], 0x16
mov dword [ebp - 0x2c], 0x4b
mov dword [ebp - 0xc], 0
jmp 0x4067a3
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1b
cmp dword [ebp - 0xc], ecx
jge 0x4067b9
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
jmp 0x40679a
mov dword [ebp - 0x10], 0
jmp 0x4067cb
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x44]
sub ecx, 0x3c
cmp dword [ebp - 0x10], ecx
jge 0x40687c
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 4]
jge 0x4067eb
mov dword [ebp - 0x24], 1
jmp 0x4067f2
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x40]
or eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x14]
jge 0x406806
mov dword [ebp - 0x1c], 1
jmp 0x40680d
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x4c]
jge 0x40681e
mov dword [ebp - 0x20], 1
jmp 0x406825
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x20]
or edx, dword [ebp - 0x24]
je 0x406877
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x14]
jne 0x406877
push 0x837d
push 0x10721
push 0xf59
push 0xf301
push 0x99ca
push 0x1261e
push 0x4b4d
push 0x3e8a
push 0x16b19
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
add esp, 0x24
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x4067c2
mov edx, dword [ebp - 8]
sub edx, 6
push edx
mov eax, dword [ebp - 0x28]
sub eax, 0x12
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0xa
push ecx
call fcn.00421360
add esp, 0xc
mov edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x2c]
jge 0x4068aa
mov dword [ebp - 0x3c], 1
jmp 0x4068b1
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 4]
jge 0x4068c2
mov dword [ebp - 0x34], 1
jmp 0x4068c9
mov dword [ebp - 0x34], 0
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x58]
jge 0x4068dd
mov dword [ebp - 0x38], 1
jmp 0x4068e4
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x34]
and edx, dword [ebp - 0x38]
or edx, dword [ebp - 0x3c]
je 0x406927
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x40]
jne 0x406927
push 0xd53
push 0x2b29
push 0x1237c
push 0xb0d6
push 0x13a06
push 0x3a63
call dword [sym.imp.USER32.dll_GetWindowTextA]
add esp, 0x18
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov esp, ebp
pop ebp
ret
Function at 0x409590
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x3c], 0x44
mov dword [ebp - 0x40], 0x4c
mov dword [ebp - 0x30], 0x60
mov dword [ebp - 0x44], 0x27
mov dword [ebp - 0x1c], 0x35
mov dword [ebp - 0x48], 0x2e
mov dword [ebp - 0x4c], 0x38
mov dword [ebp - 0x14], 0x1c
mov dword [ebp - 0x28], 0xb
mov dword [ebp - 0x50], 0x26
mov dword [ebp - 0x54], 0x1b
mov dword [ebp - 0x34], 0x5e
mov dword [ebp - 0x58], 0x48
mov dword [ebp - 4], 0x63
mov dword [ebp - 0x38], 0x3c
mov dword [ebp - 0x2c], 0x62
mov dword [ebp - 0x5c], 0x59
mov dword [ebp - 0x24], 0x32
mov dword [ebp - 0x18], 0xb
mov dword [ebp - 0x60], 9
mov dword [ebp - 0x64], 0x63
mov dword [ebp - 0x20], 0x38
mov eax, dword [ebp - 0x18]
add eax, 6
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x26
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x24
push edx
mov eax, dword [ebp + 0x10]
add eax, 8
push eax
mov ecx, dword [ebp - 4]
sub ecx, 0x4f
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x21
push edx
call fcn.00418090
add esp, 0x18
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jge 0x409673
mov dword [ebp - 8], 1
jmp 0x40967a
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jge 0x40968b
mov dword [ebp - 0xc], 1
jmp 0x409692
mov dword [ebp - 0xc], 0
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x30]
jge 0x4096ac
mov dword [ebp - 0x10], 1
jmp 0x4096b3
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 8]
and ecx, dword [ebp - 0xc]
and ecx, dword [ebp - 0x10]
je 0x4096e7
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 0x38]
jne 0x4096e7
push 0xb54
push 0x183a9
push 0x725a
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0xc
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov esp, ebp
pop ebp
ret
Function at 0x40bed0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x24], 0x24
mov dword [ebp - 0x20], 0x4e
mov dword [ebp - 0x38], 0x28
mov dword [ebp - 0x14], 0x1f
mov dword [ebp - 0x3c], 0x62
mov dword [ebp - 0x40], 0x59
mov dword [ebp - 0x44], 0x49
mov dword [ebp - 0x48], 0x54
mov dword [ebp - 0x28], 0x1a
mov dword [ebp - 0x4c], 0x56
mov dword [ebp - 0x2c], 0x35
mov dword [ebp - 0x50], 0x20
mov dword [ebp - 0x54], 0x2d
mov dword [ebp - 0x10], 0x1d
mov dword [ebp - 0x58], 5
mov dword [ebp - 0xc], 0x62
mov dword [ebp - 0x30], 0x42
mov dword [ebp - 4], 0x49
mov dword [ebp - 0x5c], 0x4d
mov dword [ebp - 0x1c], 0x41
mov dword [ebp - 0x34], 0x33
mov dword [ebp - 0x60], 0x20
mov dword [ebp - 0x64], 0x38
mov dword [ebp - 8], 0
jmp 0x40bf90
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x1c]
sub ecx, 0xc
cmp dword [ebp - 8], ecx
jge 0x40c00d
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x20]
jge 0x40c008
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x18]
jne 0x40c008
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jge 0x40bfd7
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x18]
jne 0x40bfd7
push 0x4c65
push 0xecef
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
add esp, 8
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
push 0x1292e
push 0x10f88
push 0x1068e
push 0x16042
push 0x116b0
push 0x15bea
push 0x12844
push 0x84f7
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
add esp, 0x20
jmp 0x40bf87
mov ecx, dword [ebp - 0x14]
sub ecx, 0x12
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x14
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0x12
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x3a
push ecx
mov edx, dword [ebp - 0x30]
sub edx, 0x33
push edx
call fcn.004200f0
add esp, 0x14
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x12
push ecx
mov edx, dword [ebp + 0x18]
sub edx, 0x51
push edx
mov eax, dword [ebp - 0x18]
add eax, 0x46
push eax
mov ecx, dword [ebp - 4]
add ecx, 0xf
push ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x24
push edx
call fcn.004200f0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x40c070
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x3c], 0x29
mov dword [ebp - 0x40], 0xa
mov dword [ebp - 0x44], 0xa
mov dword [ebp - 0x2c], 0x4b
mov dword [ebp - 0x48], 0x18
mov dword [ebp - 0x4c], 0x36
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x54], 0x5b
mov dword [ebp - 0x58], 0x1d
mov dword [ebp - 0x5c], 0x45
mov dword [ebp - 0x60], 0x52
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x64], 0x56
mov dword [ebp - 0x68], 0x1a
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x14], 0x17
mov dword [ebp - 0x6c], 0x63
mov dword [ebp - 0x10], 0x13
mov dword [ebp - 0x70], 0x58
mov dword [ebp - 0x28], 0x5f
mov dword [ebp - 0x74], 8
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x78], 0x16
mov dword [ebp - 8], 0
jmp 0x40c129
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x1c
cmp dword [ebp - 8], ecx
jge 0x40c13f
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x40c120
mov dword [ebp - 0xc], 0
jmp 0x40c151
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x5e
cmp dword [ebp - 0xc], ecx
jge 0x40c1e5
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x30]
cmp edx, dword [ebp - 0x34]
jge 0x40c186
mov dword [ebp - 0x1c], 1
jmp 0x40c18d
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 4]
jge 0x40c19e
mov dword [ebp - 0x20], 1
jmp 0x40c1a5
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x1c]
or ecx, dword [ebp - 0x20]
je 0x40c1e0
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x24]
jne 0x40c1e0
push 0x13f10
push 0xe800
push 0x34be
push 0x564e
push 0x42a0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
add esp, 0x14
mov eax, dword [ebp + 8]
sub eax, 1
mov dword [ebp + 8], eax
jmp 0x40c148
mov dword [ebp - 0x18], 0
jmp 0x40c1f7
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x3f
cmp dword [ebp - 0x18], edx
jge 0x40c20d
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x40c1ee
mov esp, ebp
pop ebp
ret
Function at 0x40cb80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov dword [ebp - 0x58], 0x51
mov dword [ebp - 0x5c], 7
mov dword [ebp - 8], 0x2d
mov dword [ebp - 0x18], 0x4e
mov dword [ebp - 0x60], 0x59
mov dword [ebp - 0x1c], 0x47
mov dword [ebp - 0x64], 0x21
mov dword [ebp - 0x68], 0x5c
mov dword [ebp - 0x50], 0x47
mov dword [ebp - 0x10], 0x44
mov dword [ebp - 0x6c], 8
mov dword [ebp - 0x70], 0x20
mov dword [ebp - 0x74], 0x20
mov dword [ebp - 0x78], 0x4c
mov dword [ebp - 0x7c], 0x59
mov dword [ebp - 0x80], 0x25
mov dword [ebp - 0x14], 0x40
mov dword [ebp - 0x20], 0x43
mov dword [ebp - 4], 0x4b
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x84], 0x54
mov dword [ebp - 0x34], 0x5c
mov dword [ebp - 0xc], 0x35
mov dword [ebp - 0x38], 0x11
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x2b
push edx
mov eax, dword [ebp + 8]
add eax, 0x17
push eax
call fcn.00410730
add esp, 8
mov ecx, dword [ebp + 8]
or ecx, dword [ebp - 0x20]
je 0x40cd6c
mov edx, dword [ebp + 8]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x30]
jge 0x40cc8e
mov dword [ebp - 0x28], 1
jmp 0x40cc95
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0x18]
sub eax, 1
mov dword [ebp + 0x18], eax
mov ecx, dword [ebp + 0x18]
add ecx, dword [ebp - 0x34]
cmp ecx, dword [ebp - 8]
jge 0x40ccb2
mov dword [ebp - 0x24], 1
jmp 0x40ccb9
mov dword [ebp - 0x24], 0
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0x38]
and edx, dword [ebp - 0x24]
or edx, dword [ebp - 0x28]
je 0x40cd6c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x44]
jge 0x40cd6c
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x10]
jne 0x40cd6c
mov edx, dword [ebp + 0x14]
add edx, 1
mov dword [ebp + 0x14], edx
mov eax, dword [ebp + 0x14]
or eax, dword [ebp - 4]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x4c]
jge 0x40cd6c
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
and eax, dword [ebp - 0x1c]
and eax, dword [ebp - 8]
and eax, dword [ebp - 0x50]
je 0x40cd5e
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 0x54], 0
je 0x40cd5e
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
push 0xfd54
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x40daf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0x60], 0x5f
mov dword [ebp - 0x58], 6
mov dword [ebp - 0x64], 0x45
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x68], 0x2d
mov dword [ebp - 0x6c], 0x53
mov dword [ebp - 0x5c], 6
mov dword [ebp - 0x28], 0x4e
mov dword [ebp - 0x10], 0x25
mov dword [ebp - 0x70], 0xc
mov dword [ebp - 0x44], 0x24
mov dword [ebp - 0x50], 0x2e
mov dword [ebp - 0x74], 0x26
mov dword [ebp - 0x78], 0x60
mov dword [ebp - 0x7c], 0x37
mov dword [ebp - 0x54], 0x32
mov dword [ebp - 0x18], 0x13
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x80], 0x1e
mov dword [ebp - 0x14], 0x3d
mov dword [ebp - 0x84], 4
mov dword [ebp - 0x88], 0x53
mov dword [ebp - 8], 0x39
mov dword [ebp - 0x40], 8
mov dword [ebp - 0xc], 0x5a
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x40]
jge 0x40dbbf
mov dword [ebp - 0x2c], 1
jmp 0x40dbc6
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0xc]
jge 0x40dbd7
mov dword [ebp - 0x30], 1
jmp 0x40dbde
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x48]
cmp edx, dword [ebp - 0x4c]
jge 0x40dc04
mov dword [ebp - 0x34], 1
jmp 0x40dc0b
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x30]
or eax, dword [ebp - 0x34]
je 0x40dcb7
mov ecx, dword [ebp - 0x50]
cmp ecx, dword [ebp - 0x14]
jne 0x40dcb7
mov edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 4]
jge 0x40dc37
mov dword [ebp - 0x3c], 1
jmp 0x40dc3e
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x14]
jge 0x40dc52
mov dword [ebp - 0x38], 1
jmp 0x40dc59
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0x14]
xor ecx, dword [ebp - 0x58]
and ecx, dword [ebp - 0x38]
or ecx, dword [ebp - 0x3c]
je 0x40dcb7
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x20]
jne 0x40dcb7
push 0xf370
push 0x15d22
push 0x4014
push 0x2934
push 0xfe84
push 0x11486
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x18
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
push 0xb52
push 0x7d5d
push 0x1665e
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
add esp, 0xc
mov dword [ebp - 0x1c], 0
jmp 0x40dcc9
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x5c]
sub edx, 5
cmp dword [ebp - 0x1c], edx
jge 0x40dcf0
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0xc]
jge 0x40dcee
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x20], edx
jmp 0x40dcc0
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x24], 0
jmp 0x40dd14
mov edx, dword [ebp - 0x24]
add edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x23
cmp dword [ebp - 0x24], eax
jge 0x40dd2a
mov ecx, dword [ebp - 0x28]
add ecx, 1
mov dword [ebp - 0x28], ecx
jmp 0x40dd0b
mov esp, ebp
pop ebp
ret
Function at 0x40ec50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x40], 0x3b
mov dword [ebp - 0x44], 0x57
mov dword [ebp - 0xc], 0x16
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x48], 0x43
mov dword [ebp - 0x18], 0xe
mov dword [ebp - 0x4c], 0x60
mov dword [ebp - 0x50], 0x11
mov dword [ebp - 0x54], 0x52
mov dword [ebp - 0x58], 0x5c
mov dword [ebp - 0x20], 0x30
mov dword [ebp - 0x24], 0x53
mov dword [ebp - 0x2c], 0x17
mov dword [ebp - 0x1c], 0x60
mov dword [ebp - 8], 0x46
mov dword [ebp - 0x5c], 0x1d
mov dword [ebp - 0x60], 0x3b
mov dword [ebp - 0x64], 0xb
mov dword [ebp - 0x28], 0x44
mov dword [ebp - 0x38], 0xa
mov dword [ebp - 0x10], 0x51
mov dword [ebp - 0x68], 0x37
mov dword [ebp - 0x6c], 0x5e
mov dword [ebp - 0x3c], 0x61
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x18]
jge 0x40ed0f
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
sub edx, 0x14
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x2b
push ecx
mov edx, dword [ebp + 0x10]
sub edx, 0xf
push edx
mov eax, dword [ebp - 8]
sub eax, 0x31
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x3a
push ecx
mov edx, dword [ebp - 8]
sub edx, 0x20
push edx
call fcn.004125c0
add esp, 0x1c
mov eax, dword [ebp + 0x14]
add eax, 6
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x29
push ecx
call fcn.004216b0
add esp, 8
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0xc]
test edx, edx
je 0x40eddb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x34]
jge 0x40ed8c
mov dword [ebp - 0x14], 1
jmp 0x40ed93
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 0x14]
or ecx, dword [ebp - 0x14]
je 0x40eddb
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 0x3c]
jne 0x40eddb
push 0x1bdc
push 0x38f
push 0x10ac3
push 0x2268
push 0x1450d
push 0x12890
push 0x16652
call dword [sym.imp.USER32.dll_GetWindowTextA]
add esp, 0x1c
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x411010
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 8], 0x46
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x44], 0x3d
mov dword [ebp - 0x18], 0x23
mov dword [ebp - 0x4c], 0x38
mov dword [ebp - 0x20], 0x26
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x34], 0x5f
mov dword [ebp - 0x54], 0x58
mov dword [ebp - 0x30], 0x42
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x38], 0x10
mov dword [ebp - 0x5c], 0x50
mov dword [ebp - 0x60], 0x3b
mov dword [ebp - 0xc], 0x31
mov dword [ebp - 0x64], 0x5b
mov dword [ebp - 0x68], 0x45
mov dword [ebp - 0x3c], 0x60
mov dword [ebp - 0x14], 0x17
mov dword [ebp - 0x40], 0x5b
mov dword [ebp - 0x48], 0x54
mov dword [ebp - 4], 0x5b
mov dword [ebp - 0x6c], 0x5f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x1c]
jge 0x4110db
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x30]
sub eax, 0x20
push eax
mov ecx, dword [ebp + 0x10]
sub ecx, 9
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0xd
push edx
mov eax, dword [ebp + 0x20]
push eax
mov ecx, dword [ebp + 0x10]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x20]
add edx, 0xd
push edx
mov eax, dword [ebp - 0xc]
sub eax, 0x17
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x1b
push edx
call fcn.004197d0
add esp, 0x24
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
imul ecx, dword [ebp + 0x24]
cmp ecx, dword [ebp - 0xc]
jge 0x411171
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp + 8]
jne 0x411171
push 0x16541
push 0x14346
push 0x87b5
push 0x9e7a
push 0x17ff3
push 0xf4c4
push 0x1db3
call dword [sym.imp.KERNEL32.dll_AttachConsole]
add esp, 0x1c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0xc]
jge 0x41121d
mov edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x40]
je 0x41121d
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp + 0x10]
jne 0x41121d
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp + 0x14]
jge 0x4111a6
mov dword [ebp - 0x24], 1
jmp 0x4111ad
mov dword [ebp - 0x24], 0
mov edx, dword [ebp + 0x24]
cmp edx, dword [ebp - 0x10]
jge 0x4111be
mov dword [ebp - 0x28], 1
jmp 0x4111c5
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x48]
jge 0x4111d6
mov dword [ebp - 0x2c], 1
jmp 0x4111dd
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x24]
or ecx, dword [ebp - 0x28]
or ecx, dword [ebp - 0x2c]
je 0x41121d
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
push 0x8894
push 0x103b3
push 0x1451c
push 0x476
push 0x21b
push 0x16b51
push 0x3b89
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x418090
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x4c], 0x60
mov dword [ebp - 0x50], 0x26
mov dword [ebp - 0x54], 0x3b
mov dword [ebp - 0x14], 0x27
mov dword [ebp - 0x58], 0x16
mov dword [ebp - 0x44], 0x18
mov dword [ebp - 8], 0x2a
mov dword [ebp - 0x5c], 0x61
mov dword [ebp - 0x60], 0x14
mov dword [ebp - 0x2c], 0x47
mov dword [ebp - 0x3c], 2
mov dword [ebp - 0x38], 0x52
mov dword [ebp - 0x34], 0xb
mov dword [ebp - 0x64], 0x4e
mov dword [ebp - 0x48], 0x1e
mov dword [ebp - 0xc], 0x61
mov dword [ebp - 0x68], 0x13
mov dword [ebp - 0x20], 0x2d
mov dword [ebp - 0x6c], 0x2f
mov dword [ebp - 0x24], 0x39
mov dword [ebp - 0x28], 0x1c
mov dword [ebp - 0x70], 0x34
mov dword [ebp - 0x40], 0x16
mov dword [ebp - 0x1c], 0x3c
mov dword [ebp - 0x18], 0x1b
mov dword [ebp - 4], 0
jmp 0x418157
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
sub ecx, 0x51
cmp dword [ebp - 4], ecx
jge 0x4181a9
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x18]
jge 0x4181a7
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x34]
jne 0x4181a7
push 0xf256
push 0xdf32
push 0x17955
push 0xb9d1
push 0xb354
push 0x15874
push 0x9cc4
call dword [sym.imp.WS2_32.dll_getaddrinfo]
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x41814e
mov edx, dword [ebp - 8]
add edx, 0x2f
push edx
mov eax, dword [ebp + 0x10]
sub eax, 0x51
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x23
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x1c
push edx
mov eax, dword [ebp - 8]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x29
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 9
push edx
mov eax, dword [ebp - 0x40]
sub eax, 6
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x2a
push ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x1b
push edx
call fcn.004071e0
add esp, 0x28
mov dword [ebp - 0x10], 0
jmp 0x418209
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x5f
cmp dword [ebp - 0x10], ecx
jge 0x418248
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x1c]
jge 0x418225
mov dword [ebp - 0x30], 1
jmp 0x41822c
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
xor ecx, dword [ebp - 0x30]
or eax, ecx
je 0x418246
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x418200
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x55
push ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x1f
push edx
mov eax, dword [ebp - 0x18]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x18]
sub ecx, 6
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x25
push edx
mov eax, dword [ebp - 0x48]
add eax, 8
push eax
call fcn.004125c0
add esp, 0x1c
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov esp, ebp
pop ebp
ret