joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4296f0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60e6f8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x679230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x429748
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0x6c], 0
jne 0x429748
push pe_nt_image_headers32
push 0x6220a0
call fcn.00425be0
test eax, eax
je 0x429748
int3
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + 0x6c], 0
jne 0x42976a
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4297cd
lea ecx, [ebp - 0x10]
call fcn.004021d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x6c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x6c]
mov edx, dword [edx]
mov eax, dword [edx + 0x94]
call eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.004012d0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00416260
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402180
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x42c050
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42c080
push 0x477
push 0x622380
call fcn.00425be0
test eax, eax
je 0x42c080
int3
mov eax, dword [ebp - 8]
cmp dword [eax + 0x6c], 0
jne 0x42c0c6
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00425bb0
push eax
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
call fcn.00414060
jmp 0x42c0e0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x6c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x6c]
mov edx, dword [eax]
mov eax, dword [edx + 0x94]
call eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42c0f0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42c120
push 0x48c
push 0x622380
call fcn.00425be0
test eax, eax
je 0x42c120
int3
push 0x657d63
mov ecx, dword [ebp + 0xc]
call fcn.00401ad0
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x68], 0
jne 0x42c187
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x42c185
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00425bb0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
call fcn.00414060
jmp 0x42c1a8
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00429290
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42c1a8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0042c050
mov ecx, dword [ebp + 0xc]
call fcn.00401b10
mov esp, ebp
pop ebp
ret 8

Function at 0x433a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
je 0x433aa5
call fcn.004163c0
mov dword [ebp - 0x10], eax
push 0xf0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x433aa5
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x433a7e
xor eax, eax
jmp 0x433ad6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x433aa5
push 0x117f
push 0x622380
call fcn.00425be0
test eax, eax
je 0x433aa5
int3
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00433ae0
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x433ad3
cmp dword [ebp - 0xc], 0
je 0x433ad3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00405320
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x43abd0
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
call fcn.00401b20
movzx eax, al
test eax, eax
jne 0x43ac0d
mov ecx, dword [ebp + 8]
call fcn.004012d0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x43ac0d
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
add ecx, 0x90
call fcn.0050d240
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x43e170
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x43e1a4
push str.m_hKey___0
push 0
push 0x1629
push 0x6239e0
push 2
call fcn.005d4d00
add esp, 0x14
cmp eax, 1
jne 0x43e1a4
int3
xor edx, edx
jne 0x43e1a4
xor eax, eax
jne 0x43e17b
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 0
je 0x43e1cc
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 8]
call fcn.0041e870
jmp 0x43e23a
movzx eax, byte [0x67c550]
test eax, eax
jne 0x43e206
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x43e1ff
push str.RegDeleteKeyExA
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x67c54c], eax
mov byte [0x67c550], 1
cmp dword [0x67c54c], 0
je 0x43e22a
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [0x67c54c]
jmp 0x43e23a
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret 4
Function at 0x48ff60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0xc], 0
jne 0x48ff79
call fcn.004163c0
mov dword [ebp + 0xc], eax
mov ecx, 0x67d730
call fcn.004012d0
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x48ff9f
xor eax, eax
jmp 0x49000f
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x48ffba
xor eax, eax
jmp 0x49000f
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x48ffdb
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
jmp 0x49000f
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00491830
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00405320
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x4fa120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x4fa141
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x4fa19c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4fa165
call fcn.00428890
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4fa184
call fcn.00428890
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4fa19c
call fcn.00428890
call fcn.00438550
cmp dword [eax + 0x3c], 0
je 0x4fa1b6
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004fa0c0
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004f9f70
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x7c], 0
je 0x4fa1e6
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x7c], 0
cmp dword [ebp - 4], 0
je 0x4fa1fb
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x52aed0
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x52af02
push str.m_hKey___0
push 0
push 0x164f
push 0x6239e0
push 2
call fcn.005d4d00
add esp, 0x14
cmp eax, 1
jne 0x52af02
int3
xor edx, edx
jne 0x52af02
xor eax, eax
jne 0x52aed9
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret 4
Function at 0x52af20
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jne 0x52af54
push str.m_hKey___0
push 0
push 0x170a
push 0x6239e0
push 2
call fcn.005d4d00
add esp, 0x14
cmp eax, 1
jne 0x52af54
int3
xor edx, edx
jne 0x52af54
xor eax, eax
jne 0x52af2b
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x52af8f
mov eax, dword [ebp - 0xc]
jmp 0x52af9e
cmp dword [ebp - 4], 4
je 0x52af9c
mov eax, 0xd
jmp 0x52af9e
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x52afb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [ebp + 0x10], 0
jne 0x52afe2
push str.pnBytes___0
push 0
push 0x1733
push 0x6239e0
push 2
call fcn.005d4d00
add esp, 0x14
cmp eax, 1
jne 0x52afe2
int3
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], 0
jne 0x52b00b
push str.m_hKey___0
push 0
push 0x1734
push 0x6239e0
push 2
call fcn.005d4d00
add esp, 0x14
cmp eax, 1
jne 0x52b00b
int3
xor eax, eax
jne 0x52b00b
xor ecx, ecx
jne 0x52afe2
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x52b03f
mov eax, dword [ebp - 8]
jmp 0x52b04e
cmp dword [ebp - 4], 3
je 0x52b04c
mov eax, 0xd
jmp 0x52b04e
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x52b060
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x52b092
push str.m_hKey___0
push 0
push 0x1805
push 0x6239e0
push 2
call fcn.005d4d00
add esp, 0x14
cmp eax, 1
jne 0x52b092
int3
xor edx, edx
jne 0x52b092
xor eax, eax
jne 0x52b069
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x52b0c0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x52b0f2
push str.m_hKey___0
push 0
push 0x180d
push 0x6239e0
push 2
call fcn.005d4d00
add esp, 0x14
cmp eax, 1
jne 0x52b0f2
int3
xor edx, edx
jne 0x52b0f2
xor eax, eax
jne 0x52b0c9
push 4
lea ecx, [ebp + 0xc]
push ecx
push 4
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esp, ebp
pop ebp
ret 8
Function at 0x547ee0
Capabilities:
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60fa8e
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x679230]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041a5d0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CMFCToolBarButton.0
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.004021d0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.004021d0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x54
call fcn.006031f0
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.00603080
mov ecx, dword [ebp - 0x10]
call fcn.00548070
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x18]
mov dword [ecx + 0x3c], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0x14]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.00549ec0
cmp dword [ebp + 0x10], 0
jne 0x547f94
mov dword [ebp - 0x14], 0x657d63
jmp 0x547f9a
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x2c
call fcn.00401ad0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x20], 0
je 0x548052
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x3c], 0
jne 0x548052
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
je 0x548010
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x38], 0xffffffff
je 0x547ff3
push 1
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x38]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x20]
push edx
call fcn.0050ef60
mov ecx, eax
call fcn.0050f0e0
jmp 0x54800e
push 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.0050ef60
mov ecx, eax
call fcn.0050f150
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x38], eax
jmp 0x548052
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x34], 0xffffffff
je 0x548037
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x20]
push ecx
call fcn.0050ef60
mov ecx, eax
call fcn.0050f0e0
jmp 0x548052
push 0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x20]
push eax
call fcn.0050ef60
mov ecx, eax
call fcn.0050f150
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x34], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x5a30d0
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.005a2d20
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x5a3126
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.00425bb0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00414060
jmp 0x5a3138
mov ecx, dword [ebp + 0x10]
call fcn.004012d0
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00439640
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5a3220
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
call fcn.00429300
push 0xfffffffffffffff0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 3
cmp eax, 3
je 0x5a325d
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
call fcn.005a2d20
jmp 0x5a3269
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
call fcn.005a2d50
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x5a32cd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x5a32a4
mov edx, dword [ebp - 8]
add edx, 1
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00425bb0
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x5a32c1
push pe_nt_image_headers32
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.00401db0
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.00414060
jmp 0x5a32fe
mov ecx, dword [ebp + 0x10]
call fcn.004012d0
push eax
push 0xffffffffffffffff
push 0x14d
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x5a32fe
mov ecx, dword [ebp + 0x10]
call fcn.004012d0
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00439640
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5d8cf0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x679230]
jne 0x5d8cfa
repz ret
jmp fcn.005ebbf0
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x296a5b20
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x6f34632d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x917218
Capabilities:
Encode data using xor

Disassembly:
jmp 0x917222
pushal
call 0x917228
pop ebp
sub ebp, 0x10
sub ebp, 0x517218
jmp 0x91723e
mov eax, 0x517218
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fe
mov edx, 0x985fd124
xor byte [eax], dl
inc eax
dec ecx
jne 0x917255
jmp 0x917268
scasd eax, dword es:[edi]
jmp 0x24aa201d
Function at 0x10009044
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100267c8]
jne 0x1000904e
repz ret
jmp fcn.1000cc3f

Function at 0x1000eba3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100090df
and dword [ebp - 4], 0
cmp dword [0x10027ce0], 0
mov ebx, eax
jne 0x1000ec54
push 0x1001be80
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000ed05
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001be74
push edi
call esi
test eax, eax
je 0x1000ed05
push eax
call fcn.1000906d
mov dword [esp], 0x1001be64
push edi
mov dword [0x10027ce0], eax
call esi
push eax
call fcn.1000906d
mov dword [esp], 0x1001be50
push edi
mov dword [0x10027ce4], eax
call esi
push eax
call fcn.1000906d
mov dword [esp], 0x1001be34
push edi
mov dword [0x10027ce8], eax
call esi
push eax
call fcn.1000906d
pop ecx
mov dword [0x10027cf0], eax
test eax, eax
je 0x1000ec54
push 0x1001be1c
push edi
call esi
push eax
call fcn.1000906d
pop ecx
mov dword [0x10027cec], eax
mov eax, dword [0x10027cec]
cmp eax, ebx
je 0x1000ecac
cmp dword [0x10027cf0], ebx
je 0x1000ecac
push eax
call fcn.100090e8
push dword [0x10027cf0]
mov esi, eax
call fcn.100090e8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000ecac
test edi, edi
je 0x1000ecac
call esi
test eax, eax
je 0x1000eca3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000eca3
test byte [ebp - 0xc], 1
jne 0x1000ecac
or dword [ebp + 0x10], 0x200000
jmp 0x1000ece5
mov eax, dword [0x10027ce4]
cmp eax, ebx
je 0x1000ece5
push eax
call fcn.100090e8
pop ecx
test eax, eax
je 0x1000ece5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000ece5
mov eax, dword [0x10027ce8]
cmp eax, ebx
je 0x1000ece5
push eax
call fcn.100090e8
pop ecx
test eax, eax
je 0x1000ece5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10027ce0]
call fcn.100090e8
pop ecx
test eax, eax
je 0x1000ed05
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000ed07
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret