joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020f7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov esi, 0x40a44c
push edi
push esi
call ebx
cmp eax, 0x104
ja 0x40228d
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ax, word [ebp - 0x220]
cmp ax, 0x61
jb 0x40213d
cmp ax, 0x7a
jbe 0x402149
cmp ax, 0x41
jb 0x402166
cmp ax, 0x5a
ja 0x402166
cmp word [ebp - 0x21e], 0x3a
jne 0x402166
cmp word [ebp - 0x21c], 0x5c
jne 0x402166
mov dword [ebp - 4], 3
jmp 0x402184
cmp ax, 0x5c
jne 0x40228d
cmp word [ebp - 0x21e], ax
jne 0x40228d
mov dword [ebp - 4], 2
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4021a8
and al, 0x10
neg al
sbb eax, eax
and al, 0x49
add eax, 0xb7
jmp 0x402290
lea ecx, [ebp - 0x220]
call fcn.004020e0
mov esi, eax
test esi, esi
je 0x402289
cmp esi, 0xb7
je 0x402289
lea eax, [ebp - 0x220]
push eax
call ebx
lea ecx, [ebp - 0x220]
mov edi, eax
call fcn.00402295
test eax, eax
jge 0x4021ea
mov eax, esi
jmp 0x402290
cmp eax, dword [ebp - 4]
jb 0x4021e3
lea ecx, [edi - 1]
cmp eax, ecx
jne 0x40220a
cmp edi, 1
je 0x402289
and word [ebp + eax*2 - 0x220], 0
mov edi, eax
lea ecx, [ebp - 0x220]
call fcn.004020e0
mov esi, eax
test esi, esi
je 0x402261
cmp esi, 0xb7
je 0x402244
lea ecx, [ebp - 0x220]
call fcn.00402295
test eax, eax
jl 0x4021e3
je 0x4021e3
cmp eax, dword [ebp - 4]
jb 0x4021e3
and word [ebp + eax*2 - 0x220], 0
jmp 0x40220a
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402261
test al, 0x10
jne 0x402261
mov eax, 0xb7
jmp 0x402290
lea eax, [ebp - 0x220]
push eax
call ebx
cmp eax, edi
jae 0x402289
lea ecx, [ebp - 0x220]
mov word [ebp + eax*2 - 0x220], 0x5c
call fcn.004020e0
test eax, eax
jne 0x402290
jmp 0x402261
xor eax, eax
jmp 0x402290
push 0x7b
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40245b
Capabilities:
Set registry value

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 4
Function at 0x4024a0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x264]
mov dword [ebp - 8], 1
push eax
mov eax, dword [ebp - 4]
dec eax
push ebx
neg eax
sbb eax, eax
push ebx
and al, 0xeb
mov word [ebp - 0x264], bx
add eax, 0x17
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4025b3
lea ecx, [ebp - 0x264]
call fcn.00401448
mov edx, dword [0x408150]
lea ecx, [ebp - 0x264]
call fcn.004013af
cmp dword [ebp - 4], ebx
je 0x402516
lea ecx, [ebp - 0x264]
call fcn.004020e0
lea ecx, [ebp - 0x264]
call fcn.00401448
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
lea esi, [ebp + eax*2 - 0x264]
cmp edi, ebx
mov edx, str.7_Zip_File_Manager.lnk
je 0x402545
mov edx, str.7_Zip_Help.lnk
mov ecx, esi
call fcn.00401312
lea eax, [ebp - 0x4bc]
push 0x40a44c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp edi, ebx
mov edx, str.7zFM.exe
je 0x40256c
mov edx, str.7_zip.chm
lea ecx, [ebp - 0x4bc]
call fcn.004013af
cmp dword [ebp - 4], ebx
jne 0x40258b
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4025a3
lea edx, [ebp - 0x4bc]
lea ecx, [ebp - 0x264]
call fcn.004025c5
test eax, eax
je 0x4025a3
mov dword [ebp - 8], ebx
inc edi
cmp edi, 2
jb 0x402537
cmp dword [ebp - 4], ebx
je 0x4025b3
cmp dword [ebp - 8], ebx
jne 0x4025c0
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jb 0x4024b4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404cb6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x404d0f
mov eax, 0x400000
cmp edi, eax
ja 0x404cd9
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404d07
test ecx, ecx
je 0x404d0f
test edi, edi
jbe 0x404d0f
jmp 0x404cce
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404d11
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x404d18
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x404d71
mov eax, 0x400000
cmp edi, eax
ja 0x404d3b
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404d69
test ecx, ecx
je 0x404d71
test edi, edi
jbe 0x404d71
jmp 0x404d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404d73
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4059fd
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
push esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x405a3d
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x405a3d
push 0xc00
call eax
test eax, eax
jne 0x405aca
lea eax, [ebp - 0x2d0]
push 0x106
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x405aca
cmp eax, 0x104
ja 0x405aca
cmp word [ebp + eax*2 - 0x2d2], 0x5c
je 0x405a70
mov word [ebp + eax*2 - 0x2d0], 0x5c
inc eax
mov esi, dword [str.userenv]
cmp byte [esi], 0
je 0x405aca
push edi
lea edi, [ebp + eax*2 - 0x2d0]
mov eax, edi
mov cl, byte [esi]
inc esi
test cl, cl
je 0x405a97
movzx cx, cl
mov word [eax], cx
inc eax
inc eax
jmp 0x405a85
and word [eax + 8], 0
mov word [eax], 0x2e
mov word [eax + 2], 0x64
mov word [eax + 4], 0x6c
mov word [eax + 6], 0x6c
push 8
lea eax, [ebp - 0x2d0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x405a83
pop edi
pop esi
leave
ret

Function at 0x407179
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edx, 0x40a8e0
mov ecx, 0x40ace0
push 8
mov eax, esi
pop edi
mov ebx, eax
and ebx, 1
neg ebx
and ebx, 0xedb88320
shr eax, 1
xor eax, ebx
dec edi
jne 0x40718d
mov dword [edx], eax
add edx, 4
inc esi
cmp edx, ecx
jb 0x407188
pop edi
pop esi
pop ebx
mov eax, dword [ecx - 0x400]
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x40a8e0]
xor edx, eax
mov dword [ecx], edx
add ecx, 4
cmp ecx, 0x40d8e0
jb 0x4071ae
ret
Function at 0x407430
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, ecx
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
cmp edi, 0x1f
jb 0x4075d0
test edx, 3
je 0x407462
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jmp 0x407447
xor eax, dword [edx]
lea edi, [edx + edi - 0x1b]
sub edx, edi
lea ebx, [ebx]
mov ecx, dword [edi + edx + 0xc]
mov ebx, dword [edi + edx + 8]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x400]
xor ecx, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 4]
movzx esi, bl
xor ecx, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor ecx, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor ecx, dword [ebp + esi*4 + 0x1400]
xor ecx, dword [ebp + ebx*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [ebp + esi*4 + 0x2c00]
xor ecx, dword [ebp + ebx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [ebp + esi*4 + 0x2400]
xor ecx, dword [ebp + eax*4 + 0x2800]
mov eax, dword [edi + edx + 0x18]
mov ebx, dword [edi + edx + 0x14]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0xc00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x400]
xor eax, dword [ebp + ebx*4]
mov ebx, dword [edi + edx + 0x10]
movzx esi, bl
xor eax, dword [ebp + esi*4 + 0x1c00]
movzx esi, bh
shr ebx, 0x10
xor eax, dword [ebp + esi*4 + 0x1800]
movzx esi, bl
shr ebx, 8
xor eax, dword [ebp + esi*4 + 0x1400]
xor eax, dword [ebp + ebx*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [ebp + esi*4 + 0x2c00]
xor eax, dword [ebp + ebx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [ebp + esi*4 + 0x2400]
xor eax, dword [ebp + ecx*4 + 0x2800]
add edx, 0x18
jae 0x407470
add edi, 0x18
sub edx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [ebp + eax*4]
xor eax, dword [ebp + ebx*4 + 0xc00]
xor eax, dword [ebp + ecx*4 + 0x800]
xor eax, dword [ebp + esi*4 + 0x400]
add edx, 4
jb 0x4075c9
xor eax, dword [edi + edx]
jmp 0x407597
add edx, edi
add edi, 3
sub edi, edx
test edi, edi
je 0x4075e7
movzx esi, byte [edx]
movzx ebx, al
inc edx
shr eax, 8
xor esi, ebx
xor eax, dword [ebp + esi*4]
dec edi
jne 0x4075d4
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x40f000
Capabilities:
Encode data using xor

Disassembly:
push 0x3f
pop eax
dec eax
lea edi, [esp]
syscall
dec eax
mov ebx, dword [edi + 0x41]
dec eax
xor ecx, ecx
dec eax
sub ecx, 0xffff9cd6
dec eax
lea eax, [0xffffffef]
dec eax
xor dword [eax + 0x1d], ebx
dec eax
sub eax, 0xfffffff8
loop 0x40f01e
add dl, byte [eax + 0x2b]
cmp al, 0xe3
pop ebp
dec ecx
push 0x6d
daa
clc
sub ebp, dword [edi]
sub dword [esp + ebp*4 + 0x20], ebx
out dx, al
lcall 0xe52d, 0x929ef2a8
push 0xffffffffffffff9c
mov edx, dword [ecx + 0x3054259e]
jb 0x40f088
pop ecx
xchg esi, eax
sahf
xchg edx, eax
lcall 0x5d45, 0x24719b8a
invalid
sti
das
sub ah, byte [ebx]
inc edi
mov bh, 0x3d
sti
cdq
cwde
not dword [ecx + ecx*4 - 0x608007ca]
invalid
Function at 0x4061e0
Capabilities:
Terminate thread
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov eax, dword [0x445b0c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, edi
je 0x406260
push esi
push edi
push edi
push 3
push edi
push edi
push 0x40000000
push edi
push 0x445a04
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x1f40
mov dword [esp + 0x3c], edi
call fcn.00406450
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40624d
lea eax, [esp + 0xc]
push edi
push eax
lea ecx, [esp + 0x18]
push 0x10
push ecx
push esi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call ebx
push 0x3e8
mov edx, dword [0x445b0c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov eax, dword [0x445b08]
cmp eax, edi
je 0x406281
mov eax, dword [0x445b08]
cmp eax, 0xffffffff
je 0x406281
mov eax, dword [0x445b08]
push eax
call ebx
mov dword [0x445b08], edi
mov eax, dword [0x445b0c]
cmp eax, edi
je 0x4062a9
mov eax, dword [0x445b0c]
cmp eax, 0xffffffff
je 0x4062a9
push 0xffffffffffffffff
mov ecx, dword [0x445b0c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x445b0c], edi
call fcn.004063b0
mov dword [0x445b14], edi
pop edi
pop ebx
add esp, 0x14
ret

Function at 0x100018c2
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x10001907
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], 0
mov dword [ebp - 4], 0xffffffff
popal
mov eax, dword [ebp - 4]
leave
ret 0x18
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
push 0
push dword [ebx]
push 0
push 4
push 0
push dword [eax]
call sub.kernel32.dll_CreateFileMappingA
mov ebx, dword [ebp + 0x18]
mov dword [ebx], eax
push 0
push 0
push 0
push 2
push dword [ebx]
call sub.kernel32.dll_MapViewOfFile
mov ebx, dword [ebp + 0x1c]
mov dword [ebx], eax
popal
mov eax, dword [ebp - 4]
leave
ret 0x18
Function at 0x4022db
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.004e3640
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push 0x1000
mov dword [ebp - 0x1008], eax
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.004e4da0
mov ecx, dword [ebp - 0x1008]
add esp, 0xc
mov dword [ebp - 0x100c], ebx
test ecx, ecx
jne 0x40232a
xor eax, eax
jmp 0x402411
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x400
shr esi, 2
push edi
cmp esi, 0x40000
jbe 0x40239f
mov esi, 0x10000
push 4
push esi
call fcn.004ee464
pop ecx
mov edi, eax
pop ecx
mov ecx, dword [ebp - 0x1008]
test edi, edi
jne 0x402365
mov esi, 0x400
lea edi, [ebp - 0x1004]
mov dword [ebp - 0x1010], ebx
cmp dword [0x56f164], ebx
je 0x4023f8
cmp dword [ebp + 0x10], 0
je 0x4023aa
push 0
lea eax, [ebp - 0x100c]
push eax
mov eax, esi
shl eax, 2
push eax
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x100c]
shr ecx, 2
jmp 0x4023b9
shr esi, 2
cmp esi, eax
ja 0x402344
mov esi, eax
jmp 0x40235f
push ecx
push esi
push 4
push edi
call fcn.004e8bc6
add esp, 0x10
mov ecx, eax
mov dword [ebp - 0x100c], ecx
test ecx, ecx
je 0x4023e6
xor eax, eax
add ebx, dword [edi + eax*4]
inc eax
cmp eax, ecx
jb 0x4023c5
add ebx, ecx
mov dword [ebp - 0x1010], eax
cmp dword [0x56f164], 0
mov ecx, dword [ebp - 0x1008]
jne 0x402377
jmp 0x4023ec
mov eax, dword [ebp - 0x1010]
test ebx, ebx
jne 0x4023f8
xor ecx, ecx
inc ecx
test eax, eax
cmovne ebx, ecx
test edi, edi
je 0x40240d
lea eax, [ebp - 0x1004]
cmp edi, eax
je 0x40240d
push edi
call fcn.004ee46f
pop ecx
pop edi
mov eax, ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x40cfd7
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x40d044
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40d04a
jns 0x40d011
push ebx
call fcn.0040df0f
mov ebx, eax
sub ebx, dword [ebp + 8]
push esi
call fcn.004ee48a
pop ecx
cmp ebx, eax
jge 0x40d007
mov esi, ebx
jmp 0x40d010
push esi
call fcn.004ee48a
pop ecx
mov esi, eax
pop ebx
mov eax, dword [ebp + 8]
mov cx, word [ebp + 0xc]
mov word [ebp - 4], ax
lea eax, [ebp + 0x14]
push eax
mov word [ebp - 2], cx
push dword [ebp - 4]
push esi
push edi
call fcn.0040dd84
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
mov eax, dword [ebp + 0x14]
jne 0x40d04f
cmp eax, esi
jg 0x40d04a
mov byte [eax + edi], 0
xor eax, eax
pop edi
pop esi
leave
ret
mov byte [edi], 0
jmp 0x40d044
cmp eax, esi
jg 0x40d05c
mov byte [eax + edi], 0
mov eax, dword [ebp + 0x14]
jmp 0x40d046
mov byte [edi], 0
jmp 0x40d046

Function at 0x40d184
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push edi
push 0x124
xor edi, edi
push edi
push eax
call fcn.004e4da0
add esp, 0xc
test esi, esi
je 0x40d281
cmp byte [esi], 0
je 0x40d281
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d1ed
push dword [ebp + 0xc]
push esi
push str.CountProcesses__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED_
call fcn.004255b9
add esp, 0xc
or eax, 0xffffffff
jmp 0x40d283
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x128
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x40d230
push dword [ebp + 0xc]
push esi
push str.CountProcesses__s___d__FAILED:_Process32First___FAILED_
call fcn.004255b9
add esp, 0xc
push 0x90c
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_Console.c
push str.CountProcesses
push ebx
call fcn.00426fac
jmp 0x40d1e5
cmp dword [ebp + 0xc], 0
lea eax, [ebp - 0x108]
push esi
push eax
je 0x40d24b
call fcn.004ee718
pop ecx
pop ecx
test eax, eax
jne 0x40d257
jmp 0x40d256
call fcn.004a0f55
pop ecx
pop ecx
test eax, eax
je 0x40d257
inc edi
lea eax, [ebp - 0x12c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40d230
push 0x930
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_Console.c
push str.CountProcesses
push ebx
call fcn.00426fac
mov eax, edi
jmp 0x40d283
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x40de71
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
jne 0x40de98
cmp esi, 0x100
mov eax, 0xff
mov edi, 0x5a0a20
cmovae esi, eax
push edi
call fcn.0049e2d6
pop ecx
test esi, esi
jg 0x40deba
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.:3:GetConsoleText__d___d___d__FAILED:_iCount_is_invalid:__d
call fcn.00425c08
add esp, 0x14
jmp 0x40df09
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov word [ebp + 0x12], ax
lea eax, [ebp - 4]
push eax
mov word [ebp + 0x10], bx
push dword [ebp + 0x10]
push esi
push edi
call fcn.0040dd84
push eax
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
test eax, eax
jne 0x40df08
cmp byte [0x59f124], al
jne 0x40df08
push str._GetLastError_
push esi
push dword [ebp + 0xc]
push ebx
push str.:3:GetConsoleText__d___d___d__FAILED:_ReadConsoleOutputCharacter___FAILED:__s
call fcn.00425c08
add esp, 0x14
mov byte [0x59f124], 1
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x40dfba
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x5a1154], 0
push esi
mov esi, 0x5a1050
jne 0x40e014
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x103
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x40dffa
push esi
call fcn.0049f486
pop ecx
test eax, eax
jne 0x40dffa
mov dword [0x5a1154], 1
jmp 0x40e014
push 0x104
push str.UNKNOWN_USER
push esi
call fcn.004a11a5
add esp, 0xc
and dword [0x5a1154], 0
mov eax, esi
pop esi
leave
ret
Function at 0x40e531
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x208
push 0
push eax
mov dword [ebp - 0x214], esi
call fcn.004e4da0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004e4da0
push esi
call fcn.0049e2d6
push ebx
call fcn.0049f486
add esp, 0x20
test eax, eax
je 0x40e593
xor eax, eax
jmp 0x40e5fd
lea eax, [ebp - 0x210]
mov esi, 0x207
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], esi
push eax
push 0
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
je 0x40e5db
push edi
push str._GetLastError_
push ebx
push str.:4:GetRegString___s___FAILED:_RegQueryValueEx___FAILED:__s_ld
call fcn.00425c08
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x40e58f
cmp dword [ebp + 0x14], 0
lea eax, [ebp - 0x20c]
cmovge esi, dword [ebp + 0x14]
dec esi
push esi
mov esi, dword [ebp - 0x214]
push eax
push esi
call fcn.004a11a5
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x40e70d
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push edi
push dword [ebp + 8]
mov dword [0x59dc0c], eax
call fcn.0040e849
xor ebx, ebx
mov dword [0x59e104], 1
push ebx
mov edi, eax
call fcn.00410aa6
pop ecx
pop ecx
call fcn.0040ecc6
test eax, eax
jne 0x40e74c
push str.:5:InitConsole___encountered_a_problem:_EnableNumLock___FAILED_
call fcn.00425c08
pop ecx
push esi
call fcn.0040e037
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e7b1
push str.PAULA_Initialization...
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov esi, str._GetLastError_
test eax, eax
jne 0x40e77e
push esi
push str.:4:InitConsole___encountered_a_problem:_SetConsoleTitle___FAILED:__s
call fcn.00425c08
pop ecx
pop ecx
push 0x243
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040e037
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
jne 0x40e7a5
push esi
push str.:2:InitConsole___encountered_a_problem:_SetWindowPos___FAILED:__s
call fcn.00425c08
pop ecx
pop ecx
call fcn.0040e037
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 0x80
push eax
push eax
push dword [0x59e0dc]
call fcn.00418336
add esp, 0xc
cmp dword [ebp + 0x10], ebx
je 0x40e7ff
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0x19
mov esi, eax
call fcn.004181bc
pop ecx
test esi, esi
je 0x40e7f7
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xfffaffff
push eax
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x19
call fcn.004181bc
pop ecx
call fcn.004182b0
push 1
call fcn.004191ac
pop ecx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
call fcn.0047d25f
call fcn.0047d25f
pop esi
test eax, eax
jne 0x40e83c
push str.DoNotScrmbErLg.txt
push ebx
call fcn.0047cdb0
push eax
call fcn.0042916f
add esp, 0xc
test eax, eax
je 0x40e843
push ebx
call fcn.004269ad
pop ecx
mov eax, edi
pop edi
pop ebx
pop ebp
ret