joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40acf0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x100
mov ecx, 0x40
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
push 0x40dc84
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push str._smusic.set
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
push 0x40d6b0
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
push esi
push 1
push 0x104
push 0x40def8
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x28
pop edi
pop esi
add esp, 0x100
ret

Function at 0x40ad60
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push edi
push 0
push 0x100
push 2
push 0
push 0
push 0x40000000
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40ad93
xor eax, eax
pop edi
pop ecx
ret
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebx
push esi
push ecx
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret

Function at 0x40ade0
Capabilities:
Create directory
Delete file
Read file on windows

Disassembly:
sub esp, 0x100
push esi
push 0x40d6bc
push str.music.set
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40ae1d
push esi
push 1
push 0x104
push 0x40def8
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
mov ecx, 0x40def8
call fcn.0040a7a0
mov ecx, 0x40def8
mov esi, eax
call fcn.0040a8c0
test esi, esi
jne 0x40aed2
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 8]
push 0x40dc84
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push str._smusic
push eax
call esi
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 0x10
lea edx, [esp + 8]
push 0x40d894
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_remove]
push str.DefautMusic
lea ecx, [esp + 0x10]
push str.Music
push ecx
call fcn.0040ad60
add esp, 0x10
mov ecx, 0x40
xor eax, eax
mov edi, 0x40def8
push 0x40dc84
push 0x40d868
rep stosd dword es:[edi], eax
push 0x40def8
call esi
add esp, 0xc
mov dword [0x40dff8], 0x3e8
call fcn.0040acf0
pop edi
pop esi
add esp, 0x100
ret
Function at 0x40b0a0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
dec eax
je 0x40b0c7
dec eax
jne 0x40b112
mov eax, dword [esp + 0x104]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0x100
ret
push esi
mov esi, dword [esp + 0x108]
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push 0x100
push ecx
push 0x442
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.004082e0
add esp, 4
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
add esp, 0x100
ret

Function at 0x40b1c0
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc78
add eax, 0xfffffc18
cmp eax, 0x3c
ja case.0x40b1e0.1004
xor ecx, ecx
mov cl, byte [eax + 0x40b370]
jmp dword [ecx*4 + 0x40b35c]
mov edx, dword [esp + 0xc7c]
push edx
call fcn.0040b490
add esp, 4
add esp, 0xc78
ret
push 0
call dword [sym.imp.MSVCRT.dll_time]
mov edx, dword [0x40e1ec]
add esp, 4
sub eax, edx
cmp eax, 0x258
jg 0x40b2f3
cmp eax, 0xfffffda8
jl 0x40b2f3
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_rand]
lea esi, [esp + 0x10c]
mov ebx, 0x1a5
call edi
mov dword [esi], eax
add esi, 4
dec ebx
jne 0x40b23c
lea esi, [esp + 0x7a4]
mov ebx, 0x138
call edi
mov dword [esi], eax
add esi, 4
dec ebx
jne 0x40b252
call fcn.0040b580
mov dword [esp + 0x7a0], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
push 0x40dc84
lea eax, [esp + 0x10]
push str._s_data.regt
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x18]
push 0x40d6b0
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
lea edx, [esp + 0x120]
push esi
push 1
push 0xb78
push edx
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov esi, dword [esp + 0xcb0]
add esp, 0x28
mov dword [0x40dde0], 1
push 0
push 0x40d16c
push 0x40dbb4
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
pop esi
pop ebx
add esp, 0xc78
ret
mov eax, dword [esp + 0xc7c]
push 0
push 0x40d16c
push 0x40db88
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc78
ret
mov ecx, dword [esp + 0xc7c]
push 0
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0xc78
ret
push 1
push 0
push 0
push 0x40d018
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [esp + 0xc7c]
push 0
push edx
call dword [sym.imp.USER32.dll_EndDialog]
add esp, 0xc78
ret
Function at 0x40b3b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 0x40d6bc
push str.D:windows.ini
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
lea eax, [esp + 0x18]
push esi
push 1
push 4
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
push 0
call dword [sym.imp.MSVCRT.dll_time]
mov esi, dword [esp + 0x30]
add esp, 0x20
sub esi, eax
add esi, 0x93a80
jns 0x40b3fb
xor esi, esi
mov eax, 0xc22e4507
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
imul esi
add edx, esi
sar edx, 0x10
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
push edx
lea edx, [esp + 0x18]
push 0x40d07c
push edx
call edi
mov ebx, dword [esp + 0x30]
mov ebp, dword [sym.imp.USER32.dll_SetDlgItemTextA]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x422
push ebx
call ebp
mov eax, esi
mov ecx, 0x15180
cdq
idiv ecx
mov eax, 0x91a2b3c5
mov ecx, edx
imul ecx
add edx, ecx
lea ecx, [esp + 0x14]
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push 0x40d07c
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x14]
push edx
push 0x423
push ebx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x40b490
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x250
push esi
mov esi, dword [esp + 0x258]
push edi
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x54]
lea ecx, [esp + 8]
mov dword [esp + 0x24], eax
xor eax, eax
push ecx
mov dword [esp + 0xc], 0x4c
mov byte [esp + 0x58], al
mov dword [esp + 0x2c], 0x104
mov dword [esp + 0x18], 0x40dbd0
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x40], 0x81800
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
je 0x40b568
lea edx, [esp + 0x54]
push edx
push 0x414
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x158]
push 0x100
rep stosd dword es:[edi], eax
lea eax, [esp + 0x15c]
lea ecx, [esp + 0x58]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x54]
push 0x40d6bc
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
push esi
push 1
push 0x554
push 0x40e000
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x1c
pop edi
pop esi
add esp, 0x250
ret

Function at 0x40b580
Capabilities:
Get disk information

Disassembly:
push ecx
push 0xa
push 0
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0xc
push 0
push 0x40dbe4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [esp]
pop ecx
ret
Function at 0x40b5b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc78
mov ecx, 0x40
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
push 0x40dc84
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push str._s_data.regt
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
push 0x40d6bc
push ecx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x40b631
push esi
push 1
lea edx, [esp + 0x110]
push 0xb78
push edx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
call fcn.0040b580
mov edx, dword [esp + 0x79c]
xor ecx, ecx
cmp edx, eax
pop edi
sete cl
mov eax, ecx
pop esi
add esp, 0xc78
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc78
ret

Function at 0x40b6b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x100
sub eax, 0x3e8
push edi
je 0x40b77b
dec eax
je 0x40b6ea
sub eax, 0x29
jne 0x40b818
mov eax, dword [esp + 0x108]
push eax
call fcn.0040b840
add esp, 4
pop edi
add esp, 0x100
ret
cmp dword [0x40e654], 1
jne 0x40b763
push 0x40d738
push 0x40e554
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40b74b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 4]
push 0x100
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
push 0x40e554
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 4]
push edx
call sub.SkinMagic.dll....._Ordinal_3
mov eax, dword [esp + 0x108]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
add esp, 0x100
ret
push str.SKINMAGIC
push 0x40d71c
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call sub.SkinMagic.dll....._Ordinal_4
mov eax, dword [esp + 0x108]
push 0
push eax
call dword [sym.imp.USER32.dll_EndDialog]
pop edi
add esp, 0x100
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 4]
push esi
rep stosd dword es:[edi], eax
push 0x40dc84
lea ecx, [esp + 0xc]
push str._sSkin.set
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x14]
push 0x40d6b0
push edx
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x14
mov ecx, 0x40
xor eax, eax
mov edi, 0x40e554
push 0x100
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x110]
push 0x40e554
push 0x414
push edi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push esi
push 1
push 0x100
push 0x40e554
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
push 0
push edi
call dword [sym.imp.USER32.dll_EndDialog]
push 0
push 0x40d384
push 0x40db24
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop edi
add esp, 0x100
ret
Function at 0x40c3a0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x49e024]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c44d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword fs:[0x2c]
mov edi, eax
mov edx, dword [ecx]
mov ecx, dword [0x4a0ce4]
cmp ecx, dword [edx + 4]
jle 0x40c43d
push 0x4a0ce4
call fcn.004140ef
add esp, 4
cmp dword [0x4a0ce4], esi
jne 0x40c43d
push 0x47da60
mov dword [0x4a0cf4], 0x4a0cf0
mov dword [0x4a0cf0], 0x498d6c
mov dword [0x4a0cf8], 0x4a0cec
mov dword [0x4a0cec], 0x4991f8
call fcn.00413f6c
add esp, 4
push 0x4a0ce4
call fcn.004140a5
add esp, 4
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x4a0cec
test edi, edi
jne 0x40c460
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00413cef
mov esp, ebp
pop ebp
ret
mov edx, 0x498d50
lea ecx, [esp + 0xc]
call fcn.0040c1e0
int3

Function at 0x40cc20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d180
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x49e024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], 0x47fd80
call fcn.00413d00
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00412a6a
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d2b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d275
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49e024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
lea eax, [ebx + 4]
xorps xmm0, xmm0
mov dword [ebx], 0x47f4d4
push eax
movq qword [eax], xmm0
lea eax, [edi + 4]
push eax
call fcn.0041587a
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebx + 0x14]
mov dword [ebx], 0x4991d8
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
lea eax, [edi + 0x14]
push eax
call fcn.00403350
lea esi, [ebx + 0x2c]
mov dword [ebp - 4], 1
mov dword [esi], 0x4991e4
mov ecx, dword [edi + 0x30]
mov dword [ebp + 8], esi
mov dword [esi + 4], ecx
test ecx, ecx
je 0x40d342
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov dword [esi + 8], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x10], eax
mov eax, ebx
mov dword [ebx], 0x49917c
mov dword [esi], 0x499164
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40d7a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d2ad
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x49e024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 4]
mov dword [edi], 0x47f4d4
xorps xmm0, xmm0
push eax
movq qword [eax], xmm0
lea eax, [esi + 4]
push eax
call fcn.0041587a
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [edi + 0x14]
mov dword [edi], 0x4991d8
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push eax
call fcn.00403350
mov dword [edi + 0x2c], 0x4991e4
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], 0x49917c
mov dword [edi + 0x2c], 0x499164
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40df10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d3d0
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x49e024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x20], esp
push 4
push 0x4992f8
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.00401bf0
xor dl, dl
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0040e460
push 0xc
push 0x499300
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040a2d0
cmp dword [eax + 0x14], 8
jb 0x40df8e
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0040dda0
mov byte [ebp - 4], 2
sub esp, 0x18
mov esi, dword [eax]
mov edx, esp
mov ecx, esi
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
lea edi, [ecx + 1]
mov byte [edx], 0
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40dfc0
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.00401bf0
mov byte [ebp - 4], 4
call fcn.0040eab0
add esp, 0x30
lea ecx, [ebp - 0xbc]
test al, al
mov eax, dword [ebp - 0xc0]
sete bl
cmp eax, ecx
je 0x40dffc
push eax
call fcn.00419866
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x40e039
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e02f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e0a1
push edx
push ecx
call fcn.00413f81
add esp, 8
test bl, bl
je 0x40e085
push 1
call fcn.00413d00
add esp, 4
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 5
push ecx
push 0
push eax
push 0x40e3f0
push 0
push 0
call fcn.0041c874
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x40e0ab
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 6
call fcn.0040dd60
cmp dword [ebp - 0x14], 0
jne 0x40e0a6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413cef
mov esp, ebp
pop ebp
ret
call fcn.0041980a
call fcn.0041f0c5
push 6
mov dword [ebp - 0x14], 0
call fcn.00413061
int3
Function at 0x40e5f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47d44d
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x49e024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], edx
mov ebx, ecx
mov edx, ebx
mov dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
lea ecx, [edx + 2]
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40e640
sub edx, ecx
lea ecx, [ebp - 0x2c]
sar edx, 1
push edx
push ebx
call fcn.00403440
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp - 0x18]
cmp edi, 8
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
cmovae ecx, esi
push 2
sub esp, 8
call fcn.0040f080
add esp, 0xc
cmp eax, 0xffffffff
je 0x40e7c2
push 0
push ebx
call fcn.004246bc
mov edi, dword [ebp - 0x18]
add esp, 8
test eax, eax
jne 0x40e7bf
mov esi, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
cmp edi, 8
mov dword [ebp - 0x58], ebx
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x60], eax
cmovae edx, ebx
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x68], 0x3c
mov dword [ebp - 0x64], 0x40
mov dword [ebp - 0x54], eax
test esi, esi
je 0x40e6f6
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea ecx, [edx + ecx*2]
je 0x40e6f0
cmp ecx, edx
je 0x40e6f6
sub ecx, 2
cmp word [ecx], 0x5c
jne 0x40e6e3
sub ecx, edx
sar ecx, 1
jmp 0x40e6f9
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp - 0x74], 0
cmp esi, ecx
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x70], 7
cmovb ecx, esi
cmp edi, 8
push ecx
cmovae eax, ebx
lea ecx, [ebp - 0x84]
push eax
call fcn.00403440
mov edx, dword [ebp - 0x70]
lea eax, [ebp - 0x84]
mov ecx, dword [ebp - 0x84]
cmp edx, 8
cmovae eax, ecx
mov dword [ebp - 0x50], eax
jb 0x40e774
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e76a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e813
push edx
push ecx
call fcn.00413f81
add esp, 8
lea eax, [ebp - 0x68]
mov dword [ebp - 0x4c], 0
push eax
mov dword [ebp - 0x48], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
jmp 0x40e7c5
mov esi, dword [ebp - 0x2c]
or ebx, 0xffffffff
cmp edi, 8
jb 0x40e7f5
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x40e7eb
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e818
push edi
push esi
call fcn.00413f81
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413cef
mov esp, ebp
pop ebp
ret
call fcn.0041980a
call fcn.0041980a
int3
Function at 0x40e820
Capabilities:
Create process on windows
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x49e024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e8f3
push 0x228
lea eax, [ebp - 0x29c]
push 0
push eax
call fcn.00417910
add esp, 0xc
mov dword [ebp - 0x2a0], 0x22c
lea eax, [ebp - 0x2a0]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_Process32FirstW]
test eax, eax
je 0x40e8ec
mov ebx, dword [sym.imp.KERNEL32.DLL_WinExec]
mov edi, dword [sym.imp.KERNEL32.DLL_Process32NextW]
nop dword [eax]
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp + 8]
call fcn.0040ef70
test eax, eax
jne 0x40e8de
push 0x64
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00417910
add esp, 0xc
lea eax, [ebp - 0x70]
push dword [ebp - 0x298]
push 0x49937c
push 0x64
push eax
call fcn.0040a700
add esp, 0x10
lea eax, [ebp - 0x70]
push 0
push eax
call ebx
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x2a0]
push eax
push esi
call edi
test eax, eax
jne 0x40e890
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x40e929
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e91f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e93a
push edx
push ecx
call fcn.00413f81
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413cef
mov esp, ebp
pop ebp
ret
call fcn.0041980a
int3