joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045a05
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10045a3b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x530d
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push 0x3a2f
call fcn.10045a8f
add esp, 0x14
jmp 0x10045a8b
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10045a81
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
shr eax, 1
push eax
mov ecx, dword [ebp - 0x24]
call fcn.1002b4db
jmp 0x10045a8b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x1004b0ce
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004b139
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004b12a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1004b128
push 0x6281
push 0x640d
push 0x443c
push 1
push 1
push 0x2c95
call fcn.100485eb
add esp, 0x18
jmp 0x1004b134
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x1004b1c8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004b17d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1004b17b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1004b1c8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004b1ab
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1004b1c8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.1000f7aa
mov dword [eax], 7
jmp 0x1004b1a0
mov esp, ebp
pop ebp
ret
Function at 0x1004e611
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e9ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push esi
push edi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004e710
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1004e6fa
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x1004e6f8
lea eax, [ebp - 0x74]
push eax
call fcn.10042972
pop ecx
mov esi, eax
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
call fcn.100443c2
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
push dword [eax]
lea eax, [ebp - 0x68]
push eax
call fcn.10048093
add esp, 0x10
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
push dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
call fcn.1004f4f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.1004f527
jmp 0x1004e70e
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1004e70e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1004e724
push 0xdb2
push 0x45a1
push 1
call fcn.1004449b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10069a35
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10073740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005c048
mov dword [ebp - 0x14], eax
cmp dword [0x106168a4], esi
jne 0x10069b28
push 0x800
push esi
push 0x100075b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10069ab5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10069c08
push esi
push esi
push 0x100075b0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10069c08
push 0x100075c8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10069c08
push eax
call ebx
push 0x100075d4
push edi
mov dword [0x106168a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075e4
push edi
mov dword [0x106168a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100075f8
push edi
mov dword [0x106168ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106168b4], eax
test eax, eax
je 0x10069b25
push 0x10007614
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106168b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10069b4d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10069b40
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10069b62
push 4
pop eax
jmp 0x10069c0a
cmp dword [ebp - 0x14], esi
je 0x10069b62
push dword [0x106168a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10069b47
mov eax, dword [0x106168b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10069bc0
cmp dword [0x106168b4], edi
je 0x10069bc0
push eax
call ebx
push dword [0x106168b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10069bc0
test eax, eax
je 0x10069bc0
call ecx
test eax, eax
je 0x10069bb5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10069bb5
test byte [ebp - 8], 1
jne 0x10069bc0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10069bf0
mov eax, dword [0x106168a8]
cmp eax, edi
je 0x10069bed
push eax
call ebx
test eax, eax
je 0x10069bed
call eax
mov esi, eax
test esi, esi
je 0x10069bed
mov eax, dword [0x106168ac]
cmp eax, edi
je 0x10069bed
push eax
call ebx
test eax, eax
je 0x10069bed
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106168a4]
call ebx
test eax, eax
je 0x10069c08
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10069c0a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100592ce
mov esp, ebp
pop ebp
ret
Function at 0x402c40
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x402c81.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x402c81.2
jmp dword [eax*4 + 0x402d0c]
mov word [esp + 0x48], di
jmp 0x402cba
mov word [esp + 0x48], 2
jmp 0x402cba
mov word [esp + 0x48], 3
jmp 0x402cba
mov word [esp + 0x48], 4
jmp 0x402cba
mov word [esp + 0x48], 7
jmp 0x402cba
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x402d04
cmp dword [esp + 0x70], edi
je 0x402cf0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x5ec0bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [ebx]
lea esi, [edx + 0x1000]
mov dword [ebp - 4], 0x10
xor ecx, dword [esi]
mov dword [ebp - 8], ecx
call fcn.005ec08c
xor eax, edi
mov edi, dword [ebp - 8]
add esi, 4
dec dword [ebp - 4]
mov ecx, eax
jne 0x5ec0da
mov eax, dword [edx + 0x1040]
xor eax, ecx
mov ecx, dword [edx + 0x1044]
mov edx, dword [ebp + 8]
xor ecx, edi
pop edi
mov dword [edx], ecx
mov dword [ebx], eax
pop esi
leave
ret

Function at 0x5ec10e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [ebx]
lea esi, [edx + 0x1044]
mov dword [ebp - 4], 0x10
xor ecx, dword [esi]
mov dword [ebp - 8], ecx
call fcn.005ec08c
xor eax, edi
mov edi, dword [ebp - 8]
sub esi, 4
dec dword [ebp - 4]
mov ecx, eax
jne 0x5ec129
mov eax, dword [edx + 0x1004]
xor eax, ecx
mov ecx, dword [edx + 0x1000]
mov edx, dword [ebp + 8]
xor ecx, edi
pop edi
mov dword [edx], ecx
mov dword [ebx], eax
pop esi
leave
ret
Function at 0x60dc70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x60dcd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x60dcc7
mov edx, dword [0x6527e0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x60dcbb
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x60dca0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x60dcc9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x60fa70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x60fadc
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x60fb23
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00627312
add esp, 8
test eax, eax
jne 0x60fb21
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x60fb25
jmp 0x60fad3
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x616920
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
mov eax, dword [0x64dd20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.00611dc0
add esp, 4
movzx edx, al
test edx, edx
je 0x6169b1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea ecx, [ebp - 0x2d8]
push ecx
call fcn.00621020
add esp, 0xc
mov dword [ebp - 0x2d8], 0x10001
lea edx, [ebp - 0x2d8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x6169af
mov edx, dword [ebp - 0x220]
cmp edx, dword [ebp + 0xc]
jne 0x6169af
jmp 0x6169b1
jmp 0x616933
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00621775
mov esp, ebp
pop ebp
ret
Function at 0x619e0a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x619e1a
xor eax, eax
jmp 0x619fe3
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x619f9b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x64f494]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x619e23
cmp dword [ebp + 0x10], 0
je 0x619fdd
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x64f494]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x619fa1
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x621775
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x64dd20]
jne 0x62177f
repz ret
jmp fcn.006243aa

Function at 0x628a41
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00624511
xor ebx, ebx
cmp dword [0x654010], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x628b16
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x628a81
xor eax, eax
jmp 0x628bda
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x650ea4
push edi
call esi
cmp eax, ebx
je 0x628a7a
push eax
call fcn.006244ae
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x654010], eax
call esi
push eax
call fcn.006244ae
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x654014], eax
call esi
push eax
call fcn.006244ae
mov dword [0x654018], eax
lea eax, [ebp - 8]
push eax
call fcn.00623360
test eax, eax
pop ecx
pop ecx
je 0x628ae4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00624d6b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x628b16
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.006244ae
cmp eax, ebx
pop ecx
mov dword [0x654020], eax
je 0x628b16
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.006244ae
pop ecx
mov dword [0x65401c], eax
mov eax, dword [0x65401c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x628b8f
cmp dword [0x654020], esi
je 0x628b8f
push eax
call fcn.0062451a
pop ecx
call eax
cmp eax, ebx
je 0x628b5c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x654020]
call fcn.0062451a
pop ecx
call eax
test eax, eax
je 0x628b5c
test byte [ebp - 0x18], 1
jne 0x628b8f
lea eax, [ebp - 0xc]
push eax
call fcn.00623397
test eax, eax
pop ecx
je 0x628b77
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00624d6b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x628b86
or dword [ebp + 0x10], 0x200000
jmp 0x628bc0
or dword [ebp + 0x10], 0x40000
jmp 0x628bc0
mov eax, dword [0x654014]
cmp eax, esi
je 0x628bc0
push eax
call fcn.0062451a
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x628bc0
mov eax, dword [0x654018]
cmp eax, esi
je 0x628bc0
push dword [ebp - 4]
push eax
call fcn.0062451a
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x654010]
call fcn.0062451a
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019d6
push esp
mov dword [ebp - 0x24], 0x4016fe
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a75
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a56
pop ebp
ret 0x10