joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001880
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10002940
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
sub esp, 0x138
push esi
sub eax, 0
je 0x100018b1
sub eax, 1
je 0x100018fc
sub eax, 2
jne 0x100018e6
cmp dword [0x10004014], 0x10
mov eax, section..data
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
cmovae eax, dword [section..data]
push eax
call esi
cmp dword [0x1000402c], 0x10
mov eax, 0x10004018
cmovae eax, dword [0x10004018]
push eax
call esi
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, 1
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
push 0x105
lea eax, [ebp - 0x144]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x144]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x3c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001940
sub ecx, edx
lea eax, [ebp - 0x144]
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.10001790
push 1
push 0x10003174
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.10001630
push 0xa
call fcn.10001120
mov edx, eax
add esp, 4
lea esi, [edx + 1]
nop
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10001980
sub edx, esi
lea ecx, [ebp - 0x3c]
push edx
push eax
call fcn.10001630
push 3
push 0x10003178
lea ecx, [ebp - 0x3c]
call fcn.10001630
cmp dword [ebp - 0x28], 0x10
lea eax, [ebp - 0x3c]
push dword [ebp - 0x2c]
cmovae eax, dword [ebp - 0x3c]
mov ecx, section..data
push eax
call fcn.10001790
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x24], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100019d6
sub ecx, edx
lea eax, [ebp - 0x144]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.10001790
push 1
push 0x10003174
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.10001630
push 8
call fcn.10001120
mov edx, eax
add esp, 4
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10001a11
sub edx, esi
lea ecx, [ebp - 0x24]
push edx
push eax
call fcn.10001630
push 3
push 0x10003178
lea ecx, [ebp - 0x24]
call fcn.10001630
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x24]
push dword [ebp - 0x14]
cmovae eax, dword [ebp - 0x24]
mov ecx, 0x10004018
push eax
call fcn.10001790
sub esp, 0x18
lea eax, [ebp - 0x3c]
mov ecx, esp
push eax
call fcn.10001040
mov esi, dword [ebp + 8]
push 0x65
push esi
call fcn.100011d0
add esp, 8
lea eax, [ebp - 0x24]
mov ecx, esp
push eax
call fcn.10001040
push 0x66
push esi
call fcn.100011d0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x3c]
add esp, 0x20
cmp dword [ebp - 0x28], 0x10
cmovae eax, dword [ebp - 0x3c]
push eax
call esi
cmp dword [ebp - 0x10], 0x10
lea eax, [ebp - 0x24]
cmovae eax, dword [ebp - 0x24]
push eax
call esi
lea ecx, [ebp - 0x24]
call fcn.100010d0
lea ecx, [ebp - 0x3c]
call fcn.100010d0
jmp 0x100018e6
Function at 0x401968
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.0044b40f
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.0044b40f
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.0044b40f
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.0044c190
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x401a21
mov eax, 0
jmp 0x401b8d
cmp dword [ebp + 0xc], 0
jne 0x401a57
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x401a54
push 0xa0
push 0x402073b
push 6
call fcn.0044b415
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x401a7f
mov eax, str.SeDebugPrivilege
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x401a79
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x401ab4
push 0x104
push 0x402073b
push 6
call fcn.0044b415
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x4ab2e2
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x401aea
push 0x12e
push 0x402073b
push 6
call fcn.0044b415
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x401b88
push 0x225
push 0x402073b
push 6
call fcn.0044b415
add esp, 0xc
jmp 0x401b8d
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.0044b409
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.0044b409
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401e39
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x4b2d1a]
push ebx
call fcn.0044b409
add esp, 4
mov eax, 0x4ab2e3
mov dword [0x4b2d1a], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.0044b409
add esp, 4
mov eax, 0x4ab2e3
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x401f94
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x401ea6
push 0x34
push 0x4020799
push 6
call fcn.0044b415
add esp, 0xc
mov eax, dword [0x4b2d1a]
push eax
push eax
mov ebx, eax
call fcn.004011ef
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.0044b40f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x4b2d1a]
call fcn.00401c0a
jmp 0x401eed
mov esp, ebp
pop ebp
ret 8

Function at 0x4020b0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x4021c6
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x4020eb
push 0
push 0x4020d46
push 6
call fcn.0044b415
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x4020f3
mov esp, ebp
pop ebp
ret 4

Function at 0x4022f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.0044c210
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40233d
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x402372
push 0x36
push 0x4020794
push 6
call fcn.0044b415
add esp, 0xc
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x402385
mov eax, 0x4ab2e2
push eax
push 1
mov ebx, 0x170
call fcn.0044c250
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4023a3
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4023b4
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x406dfb
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x406e1d
mov eax, 0xfffffffd
jmp 0x406efd
mov ebx, dword [0x4b2d3a]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x406ecb
mov ebx, dword [0x4b2d3a]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x406e6c
mov ebx, dword [0x4b2d3a]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x406e6c
mov eax, 1
jmp 0x406e71
mov eax, 0
test eax, eax
je 0x406e9d
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x406e86
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x4b2d3a]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x406ef3
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x406efd
mov esp, ebp
pop ebp
ret 4

Function at 0x407265
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x407318
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x407383
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x407436
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x4079a1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.0044c210
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4079e6
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x4ab2e2
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.0040648c
add esp, 8
cmp eax, 0
jne 0x407a61
call fcn.00407ae5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x4b2d4a]
test ebx, ebx
je 0x407a24
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [0x4b2d4a], eax
mov eax, dword [0x4b2d4a]
test eax, eax
je 0x407a48
push eax
mov ebx, eax
call fcn.00402e66
inc eax
push eax
call fcn.0044b40f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x407a5b
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
cmp dword [ebp - 8], esp
je 0x407a9c
push 0x16b
push 0x4020e90
push 6
call fcn.0044b415
add esp, 0xc
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x407aaf
mov eax, 0x4ab2e2
push eax
push 1
mov ebx, 0x170
call fcn.0044c250
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x407acd
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407ade
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x407ae5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.0044c210
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407b2a
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x407b5f
push 0x36
push 0x4020ea6
push 6
call fcn.0044b415
add esp, 0xc
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x407b72
mov eax, 0x4ab2e2
push eax
push 1
mov ebx, 0x170
call fcn.0044c250
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x407b90
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407ba1
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x407ba6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.0044c210
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407beb
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x407c20
push 0x36
push 0x4020e91
push 6
call fcn.0044b415
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x407c3c
push eax
mov ebx, eax
call fcn.00402e66
inc eax
push eax
call fcn.0044b40f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x407c41
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x407c52
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x407fba
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00407383
test eax, eax
je 0x407ffd
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x407ffd
cmp word [eax], 0x5a4d
jne 0x407ffd
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x407ffd
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.00407455
mov eax, dword [ebp + 8]
jmp 0x408016
mov esp, ebp
pop ebp
ret 4
Function at 0x40ba40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x40ba78
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x40ba66
mov al, 1
jmp 0x40bad7
cmp dword [ebx + 0x54], ecx
jne 0x40ba6f
mov al, 2
jmp 0x40bad7
cmp dword [ebx + 0x7c], ecx
jne 0x40bad7
mov al, 3
jmp 0x40bad7
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x40ba8d
mov al, 4
jmp 0x40bad7
cmp ecx, 5
jne 0x40baad
cmp ebx, 0
jne 0x40ba9b
mov al, 5
jmp 0x40bad7
cmp ebx, 1
jne 0x40baa4
mov al, 6
jmp 0x40bad7
cmp ebx, 2
jne 0x40baad
mov al, 7
jmp 0x40bad7
cmp ecx, 6
jne 0x40bad5
cmp ebx, 0
jne 0x40babb
mov al, 8
jmp 0x40bad7
cmp ebx, 1
jne 0x40bac2
mov al, 9
cmp ebx, 2
jne 0x40bac9
mov al, 0xa
cmp ebx, 3
jne 0x40bad0
mov al, 0xb
cmp ebx, 4
jne 0x40bad7
mov al, 0xc
pop ebx
leave
ret

Function at 0x40ccc9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x4b2d62]
push ebx
call fcn.0044b409
add esp, 4
mov eax, 0x4ab2e3
mov dword [0x4b2d62], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.0044b409
add esp, 4
mov eax, 0x4ab2e3
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x40ce24
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x40cd36
push 0x34
push 0x4020eb1
push 6
call fcn.0044b415
add esp, 0xc
mov eax, dword [0x4b2d62]
push eax
push eax
mov ebx, eax
call fcn.004011ef
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.0044b40f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x4b2d62]
call fcn.00401c0a
jmp 0x40cd7d
mov esp, ebp
pop ebp
ret 8

Function at 0x40cf40
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x40d056
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x40cf7b
push 0
push 0x4020eb3
push 6
call fcn.0044b415
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x40cf83
mov esp, ebp
pop ebp
ret 4
Function at 0x40dac4
Capabilities:
Access peb ldr_data

Disassembly:
xor eax, eax
pushal
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov edi, ebx
mov esi, dword [ebx + 0x28]
xor eax, eax
xor edx, edx
mov ecx, dword [esi]
test cx, cx
je 0x40db11
mov al, cl
cmp al, 0x61
jb 0x40daec
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
shr ecx, 0x10
test cx, cx
je 0x40db11
mov al, cl
cmp al, 0x61
jb 0x40db04
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
lea esi, [esi + 4]
jmp 0x40dadd
cmp edx, dword [esp + 0x18]
je 0x40db21
mov ebx, dword [ebx]
cmp edi, dword [ebx]
jne 0x40dad6
xor eax, eax
jmp 0x40db24
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40db2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
pushal
mov ebx, ecx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
test eax, eax
je 0x40dc13
lea esi, [ebx + eax]
test edx, 0xffff0000
je 0x40dc19
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x20]
lea edi, [ebx + edi]
mov ebp, dword [edi + ecx*4 - 4]
lea ebp, [ebx + ebp]
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40db78
cmp al, 0x61
jb 0x40db70
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40db63
cmp edx, dword [esp + 0x14]
je 0x40db88
dec ecx
jne 0x40db58
xor eax, eax
jmp 0x40dc13
mov edx, dword [esi + 0x24]
lea edx, [ebx + edx]
mov edx, dword [edx + ecx*2 - 2]
and edx, 0xffff
mov eax, dword [esi + 0x1c]
lea eax, [ebx + eax]
mov eax, dword [eax + edx*4]
lea eax, [ebx + eax]
cmp eax, esi
jbe 0x40dc13
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ebx + ecx + 0x7c]
add esi, ecx
cmp eax, esi
jae 0x40dc13
mov ebp, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
cmp al, 0x61
jb 0x40dbc4
sub al, 0x20
ror edx, 0xd
add edx, eax
ror edx, 0xd
inc ebp
cmp al, 0x2e
je 0x40dbd3
jmp 0x40dbbb
ror edx, 0xd
add edx, 0x44
ror edx, 0x1a
add edx, 0x4c
ror edx, 0x1a
add edx, 0x4c
ror edx, 0xd
mov ecx, edx
call fcn.0040dac4
test eax, eax
je 0x40dc13
mov ecx, eax
xor eax, eax
xor edx, edx
mov al, byte [ebp]
test al, al
je 0x40dc0e
cmp al, 0x61
jb 0x40dc06
sub al, 0x20
ror edx, 0xd
add edx, eax
inc ebp
jmp 0x40dbf9
call fcn.0040db2c
mov dword [esp + 0x1c], eax
popal
ret
mov ecx, dword [esi + 0x10]
cmp edx, ecx
jb 0x40dc31
mov eax, dword [esi + 0x14]
dec eax
cmp edx, eax
ja 0x40dc31
sub edx, ecx
mov ecx, edx
jmp 0x40db88
xor eax, eax
jmp 0x40dc13
Function at 0x40fcb3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x40fceb
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x40fcd9
mov al, 1
jmp 0x40fd4a
cmp dword [ebx + 0x54], ecx
jne 0x40fce2
mov al, 2
jmp 0x40fd4a
cmp dword [ebx + 0x7c], ecx
jne 0x40fd4a
mov al, 3
jmp 0x40fd4a
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x40fd00
mov al, 4
jmp 0x40fd4a
cmp ecx, 5
jne 0x40fd20
cmp ebx, 0
jne 0x40fd0e
mov al, 5
jmp 0x40fd4a
cmp ebx, 1
jne 0x40fd17
mov al, 6
jmp 0x40fd4a
cmp ebx, 2
jne 0x40fd20
mov al, 7
jmp 0x40fd4a
cmp ecx, 6
jne 0x40fd48
cmp ebx, 0
jne 0x40fd2e
mov al, 8
jmp 0x40fd4a
cmp ebx, 1
jne 0x40fd35
mov al, 9
cmp ebx, 2
jne 0x40fd3c
mov al, 0xa
cmp ebx, 3
jne 0x40fd43
mov al, 0xb
cmp ebx, 4
jne 0x40fd4a
mov al, 0xc
pop ebx
leave
ret

Function at 0x40fd77
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.0044c210
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40fdbc
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x40fdf1
push 0x36
push 0x40214ea
push 6
call fcn.0044b415
add esp, 0xc
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40fe04
mov eax, 0x4ab2e2
push eax
push 1
mov ebx, 0x170
call fcn.0044c250
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40fe22
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40fe33
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4142ea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.0044c210
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41432f
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x4ab2e2
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.0040648c
add esp, 8
cmp eax, 0
jne 0x4143aa
call fcn.0040fd77
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x4b2dca]
test ebx, ebx
je 0x41436d
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [0x4b2dca], eax
mov eax, dword [0x4b2dca]
test eax, eax
je 0x414391
push eax
mov ebx, eax
call fcn.00402e66
inc eax
push eax
call fcn.0044b40f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x4143a4
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
cmp dword [ebp - 8], esp
je 0x4143e5
push 0x16b
push 0x40214d4
push 6
call fcn.0044b415
add esp, 0xc
push SysStringLen
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x4143f8
mov eax, 0x4ab2e2
push eax
push 1
mov ebx, 0x170
call fcn.0044c250
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x414416
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x414427
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41442e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push pe_nt_image_headers32
push 1
mov ebx, 0x184
call fcn.0044c210
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x414473
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x4144a8
push 0x36
push 0x40214d5
push 6
call fcn.0044b415
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x4144c4
push eax
mov ebx, eax
call fcn.00402e66
inc eax
push eax
call fcn.0044b40f
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4144c9
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4144da
push ebx
call fcn.0044b409
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret