joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421460
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00414340
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42152b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42152b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4214de
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4214e9
or bh, 8
and edi, 0x8000000
je 0x421504
mov eax, dword [0x442adc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42152b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x421900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42192b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42194f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42196a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x423b9a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x423bd2
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0042671e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004266f6
jmp 0x423bde
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x42511e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x425160
call fcn.0042b34e
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x425160
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x425157
xor eax, eax
jmp 0x425168
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0042516e
pop edi
pop esi
pop ebx
ret 4

Function at 0x42be40
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42be6e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42be8c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042bda6
jmp 0x42be8c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42be8c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0042bda6
test edi, edi
mov eax, edi
jne 0x42be76
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x43b638
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub edi, edi
sub edi, 0x396df9a5
dec edi
call fcn.0043b675
sub ebx, ebx
sub ebx, edi
add ebx, 0xe93ae99f
xor dword [esi], eax
mov ebx, edi
or edi, edi
add esi, 1
or edi, edi
add ebx, 0x2d241b83
cmp esi, ecx
jne fcn.0043b638
sub edi, ebx
and edi, edi
and ebx, ebx
ret
Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp int.00401219
Function at 0x100012a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x398
mov ecx, dword [esp + 0x39c]
lea eax, [esp + 8]
push eax
push ecx
call fcn.10001260
add esp, 8
lea edx, [esp]
mov dword [esp + 4], 0x378
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001336
lea eax, [esp + 4]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 4]
push ecx
push 0
lea edx, [esp + 0x14]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000130b
mov eax, dword [esp]
jmp 0x1000132b
mov ecx, dword [esp + 0x3a0]
push 0x104
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
mov eax, dword [esp]
jne 0x1000133f
test eax, eax
je 0x10001336
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x398
ret
test eax, eax
je 0x1000134a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x398
ret

Function at 0x10007c66
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x10015bd8
cmp edx, dword [eax]
je 0x10007c88
add eax, 8
inc ecx
cmp eax, 0x10015c68
jl 0x10007c79
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x10015bd8]
jne 0x10007db6
mov eax, dword [0x1001a4bc]
cmp eax, 1
je 0x10007d90
test eax, eax
jne 0x10007cb9
cmp dword [0x1001a4c0], 1
je 0x10007d90
cmp edx, 0xfc
je 0x10007db6
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x10007cf0
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.100098c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.100072f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x10007d33
lea eax, [ebp - 0x1a4]
push eax
call fcn.100072f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x10012438
push edi
call fcn.1000a250
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.100098c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.100098d0
lea eax, [ebp - 0xa0]
push 0x10012418
push eax
call fcn.100098d0
push dword [esi + 0x10015bdc]
lea eax, [ebp - 0xa0]
push eax
call fcn.100098d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1000a628
add esp, 0x2c
pop edi
jmp 0x10007db6
lea eax, [ebp + 8]
lea esi, [esi + 0x10015bdc]
push 0
push eax
push dword [esi]
call fcn.100072f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..00cfg
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0xb300bd6
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x79806a94
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408e84
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1c532ce1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x40652de
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x405f60
Capabilities:
Link function at runtime on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], 0x224
mov dword [ebp - 0x30], 0x31b
mov dword [ebp - 0x1c], 0xa
mov dword [ebp - 0x24], 0x23c
mov dword [ebp - 0x34], 0x182
mov dword [ebp - 0x38], 0x36c
mov dword [ebp - 0x3c], 0x397
mov dword [ebp - 0x40], 0x1ae
mov dword [ebp - 0x44], 0x255
mov dword [ebp - 0x48], 0x17a
mov dword [ebp - 0x4c], 0x346
mov dword [ebp - 0x50], 0x354
mov dword [ebp - 0x54], 0x5c
mov dword [ebp - 0xc], 0x17
mov dword [ebp - 0x58], 0x1d4
mov dword [ebp - 8], 0xc0
mov dword [ebp - 0x10], 0x3c4
mov dword [ebp - 0x5c], 0x1f
mov dword [ebp - 0x28], 0x34b
mov dword [ebp - 0x60], 0x201
mov dword [ebp - 0x64], 0x241
mov dword [ebp - 0x68], 0x2cf
mov dword [ebp - 0x14], 0x1fc
mov dword [ebp - 0x18], 0x399
mov eax, dword [ebp - 0x1c]
add eax, 0x1ff
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x177
push ecx
call fcn.0040c850
add esp, 8
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1e5
push ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x369
push edx
mov eax, dword [ebp - 0x10]
sub eax, 0x131
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x43
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x11f
push edx
call fcn.0041de50
add esp, 0x14
mov dword [ebp - 4], 0
jmp 0x40608a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x189eb
cmp dword [ebp - 4], ecx
jge 0x4060a9
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x406081
mov esp, ebp
pop ebp
ret
Function at 0x40fac0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0x16
mov dword [ebp - 0x58], 0x368
mov dword [ebp - 0x34], 0x140
mov dword [ebp - 8], 0x2f3
mov dword [ebp - 0x5c], 0xe2
mov dword [ebp - 0x4c], 0x145
mov dword [ebp - 0x30], 0xbf
mov dword [ebp - 0x60], 0x78
mov dword [ebp - 4], 0x2e1
mov dword [ebp - 0x64], 0x383
mov dword [ebp - 0x28], 0x3e0
mov dword [ebp - 0x68], 0x198
mov dword [ebp - 0x40], 0x3de
mov dword [ebp - 0x2c], 0x231
mov dword [ebp - 0x20], 0x2c
mov dword [ebp - 0x38], 0xb9
mov dword [ebp - 0x48], 0x3e5
mov dword [ebp - 0x14], 0x1bf
mov dword [ebp - 0x6c], 0x309
mov dword [ebp - 0x70], 0x2ec
mov dword [ebp - 0x74], 0x37a
mov dword [ebp - 0x78], 0x19e
mov dword [ebp - 0x50], 0x281
mov dword [ebp - 0x3c], 0x350
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40fb90
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x188d1
cmp dword [ebp - 0xc], edx
jge 0x40fbaf
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x40fb87
mov dword [ebp - 0x10], 0
jmp 0x40fbc1
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x13f
cmp dword [ebp - 0x10], edx
jge 0x40fc40
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x3c]
jge 0x40fbe0
mov dword [ebp - 0x18], 1
jmp 0x40fbe7
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x28]
jge 0x40fbf8
mov dword [ebp - 0x1c], 1
jmp 0x40fbff
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x1c]
je 0x40fc3b
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0x20]
je 0x40fc3b
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp - 0x20]
jge 0x40fc20
mov dword [ebp - 0x24], 1
jmp 0x40fc27
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 0x44]
or edx, dword [ebp - 0x48]
je 0x40fc3b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x40fbb8
mov ecx, dword [ebp - 8]
sub ecx, 0x33
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x352
push edx
mov eax, dword [ebp - 0x4c]
sub eax, 0x98
push eax
mov ecx, dword [ebp - 0x50]
add ecx, 0x36
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0xee
push edx
mov eax, dword [ebp - 0x30]
add eax, 0xc1
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1cb
push ecx
mov edx, dword [ebp - 0x30]
add edx, 0x13b
push edx
call fcn.0040e310
add esp, 0x20
mov eax, dword [ebp - 4]
add eax, 0x9a
push eax
mov ecx, dword [ebp - 0x54]
add ecx, 0x1c4
push ecx
call fcn.00412230
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41d080
Capabilities:
Find graphical window
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x30], 0x309
mov dword [ebp - 0x28], 0x2c9
mov dword [ebp - 0x34], 0x1ce
mov dword [ebp - 0x10], 0x331
mov dword [ebp - 0x38], 0x2c6
mov dword [ebp - 0x24], 0x2e9
mov dword [ebp - 0x3c], 0xf8
mov dword [ebp - 0x40], 0x18f
mov dword [ebp - 0x1c], 0x1a2
mov dword [ebp - 0x44], 0x2a0
mov dword [ebp - 0x48], 0x37a
mov dword [ebp - 0x20], 0x2df
mov dword [ebp - 0x4c], 0x26b
mov dword [ebp - 0x14], 0xde
mov dword [ebp - 0x50], 0x3ce
mov dword [ebp - 0x54], 0x282
mov dword [ebp - 0x18], 0x115
mov dword [ebp - 0x58], 0x68
mov dword [ebp - 0x5c], 0x33c
mov dword [ebp - 0x60], 0x4f
mov dword [ebp - 0xc], 0x1a2
mov dword [ebp - 0x64], 0x157
mov dword [ebp - 0x68], 0x119
mov dword [ebp - 0x2c], 0x2f6
mov dword [ebp - 4], 0
jmp 0x41d140
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x1877e
cmp dword [ebp - 4], ecx
jge 0x41d15f
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x41d137
mov dword [ebp - 8], 0
jmp 0x41d171
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x18]
sub ecx, 0x187b5
cmp dword [ebp - 8], ecx
jge 0x41d190
call dword [sym.imp.USER32.dll_FindWindowA]
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x41d168
mov eax, dword [ebp - 0x1c]
add eax, 0x11e
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x13
push ecx
mov edx, dword [ebp - 0x10]
sub edx, 0xf8
push edx
mov eax, dword [ebp - 0x10]
add eax, 0x98
push eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf7
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x148
push edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x1aa
push eax
call fcn.0040eea0
add esp, 0x1c
mov ecx, dword [ebp + 0x1c]
add ecx, 1
mov dword [ebp + 0x1c], ecx
mov esp, ebp
pop ebp
ret
Function at 0x472120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x40], 0x164
mov dword [ebp - 0x44], 0x17e
mov dword [ebp - 0x2c], 0x2ec
mov dword [ebp - 0x48], 0x21f
mov dword [ebp - 0x4c], 0x3cb
mov dword [ebp - 0x50], 0x27b
mov dword [ebp - 0x3c], 0x113
mov dword [ebp - 0x18], 0x143
mov dword [ebp - 0x34], 0x30b
mov dword [ebp - 0x54], 0x2f4
mov dword [ebp - 8], 0x33e
mov dword [ebp - 0x58], 0x36f
mov dword [ebp - 0x1c], 0x122
mov dword [ebp - 0x38], 0x2de
mov dword [ebp - 0x5c], 0x1c1
mov dword [ebp - 4], 0x1c0
mov dword [ebp - 0x28], 0x377
mov dword [ebp - 0x60], 0x2f
mov dword [ebp - 0x20], 0x36a
mov dword [ebp - 0x24], 0x26e
mov dword [ebp - 0x14], 0x18d
mov dword [ebp - 0x30], 0x36
mov dword [ebp - 0x64], 0x2cb
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x20]
cmp eax, dword [0x514e7c]
jge 0x4721de
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x115
push edx
mov eax, dword [ebp - 0x24]
add eax, 0x158
push eax
mov ecx, dword [ebp - 8]
sub ecx, 0x28b
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0xb7
push edx
mov eax, dword [ebp - 8]
sub eax, 0xe1
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1bc
push ecx
mov edx, dword [0x514e7c]
sub edx, 0x170
push edx
mov eax, dword [ebp - 0x2c]
add eax, 0xe8
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x39e
push ecx
call fcn.0040cbd0
add esp, 0x24
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x485fec
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x48602b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48602b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48602b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x48602b
cmp dword [ecx + 0x74], 0xe
jbe 0x48602b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4926b7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4926f6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4926f6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4926f6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4926f6
cmp dword [ecx + 0x74], 0xe
jbe 0x4926f6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b2339
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004b220d