joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102513cf
Capabilities:
Authenticate hmac

Disassembly:
mov ebx, dword [esp + ebp - 0x5fac94fb]
add dword [esp + 8], 0xf4d9b
mov dword [esp + ebp - 0x5fac94fb], 0x31819228
not ebx
add dword [esp + ebp - 0x5fac9507], 0xefe8fbff
mov ebx, dword [esp + ebp - 0x5fac94fb]
or dword [esp + ebp - 0x5fac94fb], 0x2798001c
shr bp, 0x67
mov esi, dword [esp + ebp - 0x5fac0122]
mov esi, dword [esi + ebx - 0x31819228]
not word [esp + ebp - 0x5fac011e]
call fcn.101b7772

Function at 0x10256d43
Capabilities:
Authenticate hmac

Disassembly:
lea esi, [esi + esi*2 - 0x436b0ae9]
xor dword [esp + esi + 0x39d98922], 0x8f165104
shr word [esp + esi*2 + 0x73b3124c], 0xce
mov ebp, dword [esp + esi + 0x39d98932]
lea eax, [eax + 0x7507b7be]
xor word [esp + esi*2 + 0x73b3124c], bp
call fcn.101a59db

Function at 0x10256d78
Capabilities:
Authenticate hmac

Disassembly:
mov dword [esp + ebp + 0x7af20edc], ebp
cmp dword [esp + edi - 0x164f10a], 0x2f362d83
add dword [esp + 0xc], 0xfffa8e29
push ebp
mov ebp, edi
push 0xda01eb3b
add edi, ebp
neg dword [esp + ebp*4 - 0x593c478]
test dword [esp + edi*8 - 0x164f11e0], 0x1f934291
jae 0x102376b3
push 0xd906ae21
jmp 0x102719a9
xchg dword [esp + 0x34], ecx
mov edi, dword [esp + 0xc]
jb 0x100fbf49
call fcn.101712ab
mov ecx, dword [esp + ebp*8 - 0xb2788dc]
mov ecx, dword [ecx + edi*4 - 0xb2788f0]
mov dword [esp + ebp - 0x164f10a], edi
jno 0x1026990b
add di, di
bswap edi
lea ecx, [ecx + edi*2 - 0x7001ffff]
xor edi, dword [esp + edi - 0x3800ffec]
not byte [esp + edi*2 - 0x62660056]
not edi
xlatb
not edi
mov dword [esp + edi*2 - 0x62660056], edi
sub edi, 0x7eba710b
mov dword [esp + 0x1c], ecx
shr edi, 0x27
jns 0x101ac717
je 0x10256d93
call 0x254443bd
jmp 0x10256e04
out dx, eax
ja 0x10256e20
into
test dword [eax - 0x6e], esi
insd dword es:[edi], dx
sub al, 0x1d
enter 0xffffffffffff8e31, 0x33
mov al, byte [0x44fcb698]
fild word [ecx]
imul ebp, dword [eax + ebx*2 + 0x5d219252], 0xc378cba7
push dword [eax - 0x70]
outsd dx, dword [esi]
insb byte es:[edi], dx
cmpsd dword [esi], dword es:[edi]
sti
in al, 0x59
dec edx
movsd dword es:[edi], dword [esi]
les esi, [esi]
cmpsd dword [esi], dword es:[edi]
retf
jae 0x1026e1f9
neg edi
call fcn.10277044
mov edi, 0xb612d285
jne 0x10223d3f
mov dword [edi], edx
lea esp, [esp + 4]
jmp fcn.10172b38
Function at 0x10258b04
Capabilities:
Encode data using xor

Disassembly:
not al
and dl, al
pushfd
pop eax
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
call fcn.10157b87
rcl dword [edi + edi], 0x75
pop edi
test dword [edi], esi
out dx, eax
in eax, dx
mov eax, 0x3ee53cf1
xor esi, dword [ecx + 0x73]
movsd dword es:[edi], dword [esi]
or ecx, esi
lds ebp, [eax - 0x34]
das
mov ebx, 0x94ca0ff6
pop esi
clc
add eax, 0xbb8434bd
retf
pop edi
push edx
mov edx, 0x3399db1f
bswap edx
pushfd
or edx, 0xc7aeda22
push ecx
jno 0x101fc285
jbe fcn.100d93c9
xchg dword [esp + 0xc], edi
mov ecx, 0x6c9067aa
bswap ecx
jo 0x10258b04
and ecx, 0xb8250000
call fcn.10133d2e
not ebp
mov ebp, dword [esp + 0xc]
test dword [esp + 0x24], 0xd8b87287
call fcn.101271aa
mov eax, 0xdc226c9d
movzx edx, al
mov dl, byte [esi + edx - 0x9d]
inc eax
mov al, byte [esi + 2]
push 0x2b80d383
sub esi, 2
add dword [esp], 0x57a76eab
push 0xc92f4fa7
not dl
ror byte [esp + 5], 0x62
push 0x69c652b
js 0x100de20a

Function at 0x1025b3df
Capabilities:
Encode data using xor

Disassembly:
sub cl, ch
mov edx, dword [esp + 0xc]
not cx
bswap ecx
or ecx, 0xf5bd3ab6
call fcn.100a65ae
mov dword [esp + 0x14], esi
not dword [esp + 8]
sub esi, edx
shl dword [esp + 8], 0x7d
shl si, 0x1b
xchg dword [esp + esi*2 - 0x5c6fffdc], eax
mov edx, dword [esp + 0x18]
call fcn.101717f8
mov dword [esp + ebp + 0x5010081f], ebp
call fcn.1010c747
cmp al, 0x96
dec ecx
retf
lea esi, [esi + 0x39933429]
mov ebp, 0x15878b05
call fcn.102201dd
call fcn.10129916
sub eax, 0xcd81cd0f
xor eax, 0xf8a8776
sahf
test byte [ebx + edx], ch
or byte [eax], dl
push eax
shr dword [esp + ebp + 0x50100813], 0x83
ja 0x10161fe9
cmp ebp, 0xa3127b0c
not ebp
mov ebp, dword [esp + 0x38]
jle 0x101db54a
jb 0x1012cbf9
call fcn.1018c616
xor eax, 0xcbc86885
xor al, 0x84
dec esi
jno 0x1025b3b3
loop 0x1025b40f
add eax, 0x636ac8d1
mov fs, word [eax + ebx*8 + 0x49]
jecxz 0x1025b415
fmul dword [ecx - 0x1d]
add bl, byte [ebx + 0x60e06fd5]
wait
aad 0x6f
outsd dx, dword [esi]
loopne 0x1025b478
ret
or dl, ch
cli
movsb byte es:[edi], byte [esi]
xor al, 0xfb
outsb dx, byte [esi]
lodsd eax, dword [esi]
outsb dx, byte [esi]
leave
clc
push edi
adc al, 0xd4
retf

Function at 0x1025bc53
Capabilities:
Encode data using xor

Disassembly:
pushfd
add dword [esp + 4], 0xffee3c6f
mov ecx, 0x2081df16
neg cx
and ecx, 0x65b69c23
push edi
ja 0x101e5e17
Function at 0x1025f865
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [esp + esi + 0x60000018]
mov dword [esp + 0x18], ebx
and dword [esp + 8], 0xc5b6f021
mov dword [esp], 0xc0116893
add word [esp], 0xa7b6
call fcn.100d05db
hlt
dec byte [ecx + 0x246c893c]
add byte [ebp + 0x1a4d2ebf], cl
mov bl, 0xe8
dec esp
invalid
dec esp
jp 0x1025f808
jmp dword [esi - 9]
neg word [esp + esi + 0x60000004]
push 0xe30161af
jno 0x100d1bf9
out dx, al
and eax, 0x8e402878
pop eax
add byte [edx - 0x1dec2927], 0x21
push esp
pop es
pushal
xchg ecx, eax
push edx
outsd dx, dword [esi]
inc esp
jecxz 0x1025f81b
jp 0x1025f7f4
and dword [edx], 0x4c5e8a77
mov ch, 0x10
test eax, 0x1efd1a87
mov dword [0x1c7af372], eax
sub dword [edx + 0x39], ecx
sub al, 0x45
or byte [ecx], ah
out 0x9c, eax
pushfd
push ebp
mov ebp, 0x50b709a2
test bp, 0x8ead
xchg dword [esp + ebp - 0x50b70996], ecx
jne 0x1021f86f

Function at 0x1026993f
Capabilities:
Packed with generic packer

Disassembly:
shr cx, 0xfd
not dword [esp + ebp*2 + 0x408c070a]
call fcn.1022b16e
jmp 0x1025e1b9
lea esp, [esp + 0xc]
jmp fcn.101d6d95
neg dword [esp + ebp + 0x20460389]
jge 0x1011b444

Function at 0x1026994c
Capabilities:
Packed with generic packer

Disassembly:
and cl, 0xa8
add dword [esp], 0xfffcd984
call fcn.100cea54

Function at 0x1026995c
Capabilities:
Packed with generic packer

Disassembly:
pop ebx
push ecx
mov ecx, 0x1d8f752a
call fcn.100fb464
add bh, dl
mov dword [edi - 0x39], ebp
xor eax, 0xde2ee620
mov ebp, 0x5c51ab6f
xchg esp, eax
pop esi
pushfd
cdq
push edi
out 0xee, eax
bound edx, qword [edi + ebx*8 - 0x48]
and dword [ecx - 0x22030a10], edi
mov al, byte [0xd7e50423]
mov esp, dword [edi + ebx*8]
xlatb
js fcn.1026993f
add byte [ebx], cl
mov bl, 0xc
popal
push ebp
invalid

Function at 0x10273732
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + ebx - 0x28026b17], esi
cmp ebx, dword [esp + ebx - 0x28026b2b]
call fcn.1019f776
xchg ebx, eax
jbe 0x102737bc
ficom dword [ecx]
xchg ebp, eax
and dh, byte [ebp - 0x37ff9673]
ret
jnp 0x102737e0
arpl word [ebx - 0x78f104a5], di
mov word [esi - 0x5c], ds
into
or ebp, dword [esi + 0x6b]
popfd
pop ds
jo 0x10273814
invalid
sahf
mov es, word [edx - 0x1a241feb]
xchg eax, edi
push 0x4ba829f9
xlatb
cmp bl, byte [esi]
invalid
mov eax, 0x81bcbdb6
rcl dword [esi + 0x13969dd2]
retf
xchg esi, eax
rcr byte [ebp + 0xacb1396], cl
sbb byte [ebp - 0x619417c8], dh
bound ecx, qword [ebp + 0x32]
and dh, dl
xchg bh, ah
jbe 0x1027380e
push eax
mov ebp, 0xf6ec40aa
je 0x102737ef
xchg edx, eax
and eax, 0x98e5e8c9
in eax, 0x98
push edi
shr dword [edx + 0x2c], 1
xchg edi, eax
adc al, 0x3c
xor eax, ebp
inc edi
nop
outsb dx, byte [esi]
jle 0x10273836
sbb eax, 0xc691186a
dec ebp
scasb al, byte es:[edi]
or dh, ah
in al, 0x16
popfd
jle 0x102738b3
je 0x10273830
dec ecx
fld xword [edi - 1]
push edi
imul ecx, dword [ecx + 0x45b7a9d9], 0xc3b346d4
invalid
int1
invalid
Function at 0x1027a085
Capabilities:
Packed with generic packer

Disassembly:
add dword [esp + 0x18], 0xffee7c8e
mov ebp, esi
mov dword [esp + esi + 0x6af7fbbc], esi
movzx esi, bp
mov ebp, dword [esp + ebp + 0x6af7fbd0]
mov ebp, dword [ebp]
call fcn.1024e33b
test bx, 0x301d
mov dword [esp + ebx*2 - 0xe8e], ebx
setno byte [esp + ebx - 0x745]
xor dword [esp + ebx - 0x745], ebx
add dword [esp + ebx*2 - 0xe92], 0xffff4da5
nop
neg ebx
call fcn.10232f7a

Function at 0x10280790
Capabilities:
Encode data using base64

Disassembly:
jns 0x103bc7d1
adc ebp, 5
mov byte ss:[edx], al
lea esp, [esp + 4]
jmp fcn.10392eee

Function at 0x10286655
Capabilities:
Encode data using base64

Disassembly:
jmp 0x102f2e42
mov word [edi], cx
call fcn.10298dcc

Function at 0x103adaea
Capabilities:
Encode data using xor

Disassembly:
push 0xb7a03f97
push 0xfdbec123
add ebp, 2
sal byte [esp + 4], 0xa5
push 0x7eaf378c
ror word [esp + 7], 0x28
shl dl, cl
call fcn.1036a3f2
jae 0x102dec24
dec ebx
lea esp, [esp + 4]
jne 0x1035ab8a
Function at 0x401a60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414b50
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xc
mov eax, dword [0x44a1d8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0
mov byte [ebp - 0x15], 0
mov eax, dword fs:[0x30]
mov al, byte [eax + 2]
mov byte [ebp - 0x15], al
movsx eax, byte [ebp - 0x15]
test eax, eax
je 0x401ab7
mov byte [ebp - 0x16], 1
jmp 0x401abb
mov byte [ebp - 0x16], 0
mov al, byte [ebp - 0x16]
jmp 0x401ae3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a32c
mov esp, ebp
pop ebp
ret

Function at 0x403c40
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414d60
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x868
mov eax, dword [0x44a1d8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x878], str.wFe60XjC6FvMJ6FCcNXM1ePurvQkbHiOuKKrOPQ3pfSmLGdhJxpbFSFi2STU69G62XJS9CIzjkFfK41ADNp3qKslFxirGnx1t0YjRxiOoIeaHerfyRLjk2tH1A9nS8PrmfNdIeaMQqWV39BJkINukkdKmoCm66mYiN2CmNeKAEfrzHonU5mGgHqcDxR23RB95s3bjNCm6NvDvLsipkNzSI96rK3aR4ReEIG61fMxwtczp8du5x1oMmHNX1nz7ddo3LlbLzoAEvKmfzRKjynXu2C15u4cHMrzvwUKNJn8UUDdqNmHBSNHpFKKixi0Vf9zlBONd4X5nUkoGuoODHGAOzcnJJl4wXF24jYPXpCILVkgaftneV1cVzizbRsvzj8niDQWX27Dpz9gpEOv
push str.CREATE_SUSPENDED
mov eax, dword [ebp - 0x85c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x85c]
mov eax, dword [edx + 0x24]
call eax
push 0x400
lea ecx, [ebp - 0x814]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
push 0
lea edx, [ebp - 0x858]
push edx
call fcn.0040a990
add esp, 0xc
mov dword [ebp - 0x870], str.sJYs9WB7MOMdeTXSvRtmsNguY7yfbBnNFpBiG2a7PxsCDN8qe3QAFpCD1eK4UYFzuv8BFBlGbcmqaRAHIkc2ePQ3W7fVh8023s5V8zXUIWSnXX0K
mov dword [ebp - 0x864], str.iwJXtSssVgROCp18od4KGebcTAQx63YcmqpQKaVDKfOYK9rBIhmFp7eewekXHxmrnIX8QEfFX8YGnoqBl70umU42cDIN6FlKky4t23JxtRUfUzUdvlR1rEBDPUCf7WgWctklndqMMgGd6K2vxXOOruvyY92JTtAT9pkVN42sW4Lr0B9BQkD
push 0x44b320
lea eax, [ebp - 0x858]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
lea ecx, [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x403d5d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a32c
mov esp, ebp
pop ebp
ret
Function at 0x4060f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x406114
xor eax, eax
jmp 0x406194
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40612b
xor eax, eax
jmp 0x406194
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x406177
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x406177
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x40614e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x406183
xor eax, eax
jmp 0x406194
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x406191
xor eax, eax
jmp 0x406194
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40ec6d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44a1d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0040be7c
mov dword [ebp - 0x14], eax
cmp dword [0x44c214], edi
jne 0x40ed5e
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40eceb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ee3e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40ee3e
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ee3e
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x44c214], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x44c218], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x44c21c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44c224], eax
test eax, eax
je 0x40ed5b
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x44c220], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ed83
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ed76
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40ed98
push 4
pop eax
jmp 0x40ee40
cmp dword [ebp - 0x14], edi
je 0x40ed98
push dword [0x44c214]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ed7d
mov eax, dword [0x44c220]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40edf6
cmp dword [0x44c224], esi
je 0x40edf6
push eax
call ebx
push dword [0x44c224]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40edf6
test eax, eax
je 0x40edf6
call ecx
test eax, eax
je 0x40edeb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40edeb
test byte [ebp - 8], 1
jne 0x40edf6
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40ee26
mov eax, dword [0x44c218]
cmp eax, esi
je 0x40ee23
push eax
call ebx
test eax, eax
je 0x40ee23
call eax
mov edi, eax
test edi, edi
je 0x40ee23
mov eax, dword [0x44c21c]
cmp eax, esi
je 0x40ee23
push eax
call ebx
test eax, eax
je 0x40ee23
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x44c214]
call ebx
test eax, eax
je 0x40ee3e
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40ee40
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a32c
leave
ret
Function at 0x402250
Capabilities:
Accept command line arguments
Terminate process
Write file on windows

Disassembly:
sub esp, 0x43c
mov eax, dword [str.Error:]
mov ecx, dword [0x4063d0]
mov edx, dword [esp + 0x440]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ecx
mov ecx, 0xfe
xor eax, eax
lea edi, [esp + 0x4c]
mov dword [esp + 8], str.Memory_allocation_failed
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], str._MOV_command_requires_left_and_top_arguments
mov dword [esp + 0x10], str._SIZ_command_requires_width_and_height_arguments
mov dword [esp + 0x14], str._REN_command_requires_a_new_caption_to_be_specified
mov dword [esp + 0x18], str.Unrecognized_argument_s_._Use_CMDOW____for_help
mov dword [esp + 0x1c], str.Incompatible_argument_s_._Use_CMDOW____for_help
mov dword [esp + 0x20], str.Incorrect_argument_s_._Use_CMDOW____for_help
mov dword [esp + 0x24], str.A_window_must_be_specified_by_its_caption_or_handle
mov dword [esp + 0x28], str.The_specified_window_was_not_found
mov dword [esp + 0x2c], str.Unable_to_retrieve_image_names
mov dword [esp + 0x30], str.Too_many_tasks_have_been_specified
mov dword [esp + 0x34], str.Unable_to_execute_open_specified_file
mov dword [esp + 0x38], str.Only_the____and__RUN_commands_are_supported_on_W95_98_ME_platforms
mov dword [esp + 0x3c], str._SLP_command_requires_milliseconds_argument
mov eax, dword [esp + edx*4 + 8]
lea ecx, [esp + 0x44]
push eax
push ecx
call esi
lea edx, [esp + 0x44]
push 0x406150
push edx
call esi
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x40]
push 0
push ecx
lea edx, [esp + 0x4c]
push eax
push edx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x402340
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [esp + 0xc]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
je 0x402382
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add esi, eax
cmp byte [esi], 0x22
jne 0x40236c
inc esi
mov al, byte [esi]
test al, al
je 0x402382
cmp al, 0x20
je 0x40237a
cmp al, 9
jne 0x402382
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x402372
mov eax, esi
pop edi
pop esi
ret
Function at 0x402390
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x140
push ebx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4023b4
mov eax, 1
pop ebx
add esp, 0x140
ret
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x128
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x4023df
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebx
add esp, 0x140
ret
push ebp
mov ebp, dword [esp + 0x14c]
push esi
push edi
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
call fcn.00403020
mov ecx, dword [ebp + 4]
mov dword [esp + 0x10], eax
cmp eax, ecx
je 0x402411
mov edx, dword [esp + 0x30]
mov esi, dword [eax + 0xc]
cmp edx, esi
jb 0x402411
lea eax, [esp + 0x10]
jmp 0x402419
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x14]
mov eax, dword [eax]
cmp eax, ecx
je 0x40242c
mov eax, dword [eax + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.MSVCRT.dll__strdup]
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jle 0x40245e
lea edi, [eax + esi - 4]
push str..exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40245e
mov byte [edi], al
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0
call fcn.004026f0
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
push ebx
mov dword [edx + 0x10], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4023e9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret

Function at 0x403200
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [esp + 4]
push eax
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call fcn.004032a0
add esp, 8
lea eax, [esp + 4]
push eax
push 0x403230
call dword [sym.imp.USER32.dll_EnumWindows]
ret
Function at 0x4032a0
Capabilities:
Get graphical window text

Disassembly:
mov al, byte [0x409e30]
sub esp, 0x18
test al, 1
jne 0x4032be
or al, 1
mov byte [0x409e30], al
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [0x409e1c], eax
push edi
mov edi, dword [esp + 0x20]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4032d3
pop edi
add esp, 0x18
ret
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
mov esi, dword [esp + 0x30]
push 0xfffffffffffffff0
push edi
mov dword [esi], edi
call ebp
push 0xffffffffffffffec
push edi
mov dword [esi + 0xc], eax
call ebp
push 4
push edi
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_GetWindow]
mov ebp, dword [sym.imp.USER32.dll_GetParent]
push edi
mov dword [esi + 4], eax
call ebp
mov dword [esi + 8], eax
mov ecx, dword [0x409e1c]
cmp edi, ecx
jne 0x40331d
mov dword [esi + 0x14], 0
jmp 0x403350
cmp eax, dword [esi + 4]
je 0x403349
cmp eax, ecx
je 0x403349
test eax, eax
mov dword [esi + 0x14], 1
je 0x403350
cmp eax, dword [0x409e1c]
je 0x403350
mov ebx, dword [esi + 0x14]
push eax
inc ebx
mov dword [esi + 0x14], ebx
call ebp
test eax, eax
jne 0x403331
jmp 0x403350
mov dword [esi + 0x14], 1
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub edx, eax
mov dword [esi + 0x28], edx
mov edx, dword [esp + 0x24]
sub edx, ecx
mov dword [esi + 0x34], eax
mov dword [esi + 0x2c], edx
mov edx, dword [esi + 0x14]
cmp edx, 1
mov dword [esi + 0x30], ecx
jle 0x4033a9
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 8]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi + 0x34], edx
mov dword [esi + 0x30], eax
lea ebp, [esi + 0x18]
push ebp
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp]
push ecx
call fcn.004024b0
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
add esp, 4
mov dword [esi + 0x20], eax
push edi
call ebx
test eax, eax
jne 0x4033d5
mov eax, 0x3f
lea ebp, [eax + 1]
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [esi + 0x1c], eax
jne 0x4033f8
push eax
call fcn.00402250
add esp, 4
push edi
call ebx
test eax, eax
push ebp
je 0x403430
mov edx, dword [esi + 0x1c]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [esi + 0x1c]
mov al, byte [esi]
test al, al
je 0x40343b
cmp al, 0xa
jne 0x40341b
mov byte [esi], 0x5f
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x403414
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x18
ret
mov eax, dword [esi + 0x1c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x18
ret