joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41093e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20000
call fcn.00415e60
cmp dword [ebp + 8], 0
je 0x4109a3
test esi, esi
je 0x410991
push 0x22
push esi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x410991
and word [ebp - 0x20000], 0
push esi
push str.__s_
lea eax, [ebp - 0x20000]
push 0xfffe
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20000]
push eax
jmp 0x410995
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
leave
ret

Function at 0x4109bb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.00415e60
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x410a1a
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.004053ca
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
mov esi, eax
jmp 0x410a5b
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x41752c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.00405453
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x410a61
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x410a7f
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004108f1
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret
Function at 0x411225
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x10], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x4113b7
push ebx
mov eax, edi
call fcn.00407597
push dword [ebp - 4]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov ebx, eax
push ebx
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x417d10
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4112a8
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
mov dword [edi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edi], ecx
mov ecx, dword [eax + 0x14]
mov dword [edi + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [edi + 8], ecx
mov ecx, dword [eax + 0x24]
mov dword [edi + 0x10], ecx
mov eax, dword [eax + 0x28]
mov dword [edi + 0x14], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4112f7
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
push str._4.4X_4.4X
lea eax, [ebp - 0x38]
push 0x14
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x14
push 0x41752c
lea eax, [ebp - 0x38]
push eax
push ebx
lea esi, [ebp - 0x238]
call fcn.00411196
test eax, eax
jne 0x411307
lea eax, [ebp - 0x38]
push str.040904E4
push eax
call sub.msvcrt.dll_wcscpy
pop ecx
pop ecx
push 0x419eac
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x18]
push ebx
call fcn.00411196
push 0x419ec4
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x218]
push ebx
call fcn.00411196
push 0x419ee4
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x418]
push ebx
call fcn.00411196
push 0x419efc
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x618]
push ebx
call fcn.00411196
push 0x419f1c
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0x818]
push ebx
call fcn.00411196
push 0x419f34
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xa18]
push ebx
call fcn.00411196
push 0x419f50
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xc18]
push ebx
call fcn.00411196
push str.OriginalFileName
lea eax, [ebp - 0x38]
push eax
lea esi, [edi + 0xe18]
push ebx
call fcn.00411196
xor esi, esi
push ebx
inc esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov eax, esi
pop esi
leave
ret 4
Function at 0x411535
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
je 0x41153f
or eax, 0xffffffff
ret
cmp dword [esi + 4], 0
jne 0x411588
call sub.msvcrt.dll__errno
and dword [eax], 0
push dword [esi + 0x40]
push 0x4000
push 1
push dword [esi + 0x44]
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x411583
push dword [esi + 0x40]
mov dword [esi + 0x3c], 1
call sub.msvcrt.dll_ferror
test eax, eax
pop ecx
je 0x41153b
or dword [esi + 0x38], 0xffffffff
jmp 0x41153b
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
dec dword [esi + 4]
mov cl, byte [eax]
inc eax
mov dword [esi], eax
movzx eax, cl
ret

Function at 0x411596
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
push edi
mov edi, dword [esi + 4]
inc ebx
cmp edi, 2
jae 0x411606
test edi, edi
je 0x4115b3
mov eax, dword [esi]
mov ecx, dword [esi + 0x44]
mov al, byte [eax]
mov byte [ecx], al
call sub.msvcrt.dll__errno
and dword [eax], 0
push dword [esi + 0x40]
mov ecx, edi
mov eax, 0x4000
sar eax, cl
push eax
mov eax, dword [esi + 0x44]
add eax, edi
push ebx
push eax
call sub.msvcrt.dll_fread
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4115ee
push dword [esi + 0x40]
call sub.msvcrt.dll_ferror
test eax, eax
pop ecx
je 0x4115ee
or dword [esi + 0x38], 0xffffffff
add dword [esi + 4], edi
mov eax, dword [esi + 4]
cmp eax, 2
mov ecx, dword [esi + 0x44]
mov dword [esi], ecx
jae 0x411606
mov dword [esi + 0x58], eax
jmp 0x4116bf
mov eax, dword [esi]
cmp byte [eax], 0x1f
jne 0x4116bc
cmp byte [eax + 1], 0x8b
jne 0x4116bc
add dword [esi + 4], 0xfffffffe
add eax, 2
mov dword [esi], eax
call fcn.00411535
mov edi, eax
call fcn.00411535
cmp edi, 8
mov ebx, eax
jne 0x4116b3
test bl, 0xe0
jne 0x4116b3
push 6
pop edi
call fcn.00411535
dec edi
jne 0x41163f
test bl, 4
je 0x41166e
call fcn.00411535
mov edi, eax
call fcn.00411535
shl eax, 8
add edi, eax
mov eax, edi
dec edi
test eax, eax
je 0x41166e
call fcn.00411535
cmp eax, 0xffffffff
jne 0x41165d
test bl, 8
je 0x411681
call fcn.00411535
test eax, eax
je 0x411681
cmp eax, 0xffffffff
jne 0x411673
test bl, 0x10
je 0x411694
call fcn.00411535
test eax, eax
je 0x411694
cmp eax, 0xffffffff
jne 0x411686
test bl, 2
je 0x4116a4
push 2
pop edi
call fcn.00411535
dec edi
jne 0x41169c
mov eax, dword [esi + 0x3c]
neg eax
sbb eax, eax
and eax, 0xfffffffd
mov dword [esi + 0x38], eax
jmp 0x4116bf
mov dword [esi + 0x38], 0xfffffffd
jmp 0x4116bf
mov dword [esi + 0x58], ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4119dd
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [0x41c04c]
test eax, eax
je 0x411add
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x41c04c], 0
xor eax, eax
movzx edx, byte [eax + 0x4193b0]
push 0x1f
pop ecx
sub ecx, edx
xor edx, edx
inc edx
shl edx, cl
or esi, edx
inc eax
cmp eax, 0xe
jb 0x4119fd
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x411a27
shr eax, 1
xor eax, esi
jmp 0x411a29
shr eax, 1
dec edx
jne 0x411a1d
mov dword [ecx*4 + 0x41cdd8], eax
inc ecx
cmp ecx, 0x100
jl 0x411a18
mov edi, 0x41ddd8
mov ecx, 0xff00
mov eax, dword [edi - 0x1000]
mov esi, eax
and esi, ecx
mov ebx, eax
shl ebx, 0x10
add esi, ebx
mov edx, eax
shr edx, 8
shl esi, 8
mov ebx, edx
and ebx, ecx
add esi, ebx
mov ebx, eax
shr ebx, 0x18
add esi, ebx
mov dword [edi], esi
lea esi, [edi + 0x400]
mov dword [esp + 0x10], 3
and eax, 0xff
mov eax, dword [eax*4 + 0x41cdd8]
xor eax, edx
mov ebx, eax
and ebx, ecx
mov ebp, eax
shl ebp, 0x10
add ebx, ebp
mov edx, eax
shr edx, 8
shl ebx, 8
mov ebp, edx
and ebp, ecx
add ebx, ebp
mov ebp, eax
shr ebp, 0x18
add ebx, ebp
mov dword [esi - 0x1000], eax
mov dword [esi], ebx
add esi, 0x400
dec dword [esp + 0x10]
jne 0x411a7c
add edi, 4
cmp edi, 0x41e1d8
jl 0x411a46
pop edi
pop esi
pop ebp
mov dword [0x41c048], 0
pop ebx
pop ecx
ret
mov eax, dword [0x41c048]
test eax, eax
jne 0x411add
pop ecx
ret
Function at 0x41338a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x413417
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4133d7
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x4133f9
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x4134d6
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x41343f
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x41344a
xor eax, eax
jmp 0x413497
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x413468
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
push edx
call fcn.00414053
pop ecx
jmp 0x41347b
cmp ecx, 2
jne 0x413481
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00411ae8
add esp, 0xc
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
push dword [ebp - 4]
push dword [edi]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x4134c2
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x4134d6
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x413395
pop edi
pop ebx
leave
ret
Function at 0x415b6a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x4174d0
call fcn.00415d78
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x415ba5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415ba5
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x415bbd
cmp eax, 0x20b
je 0x415baa
mov dword [ebp - 0x1c], edi
jmp 0x415bd1
cmp dword [ecx + 0x84], 0xe
jbe 0x415ba5
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x415bcb
cmp dword [ecx + 0x74], 0xe
jbe 0x415ba5
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x420714], 0xffffffff
or dword [0x420718], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x41c64c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x41c648]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x420710], eax
call fcn.00402d70
cmp dword [section..data], edi
jne 0x415c2e
push fcn.00402d70
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00415d66
push 0x4174a0
push 0x41749c
call sub.msvcrt.dll__initterm
mov eax, dword [0x41c644]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x41c640]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x30], eax
push 0x417498
push 0x41744c
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x415c94
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x415d4e
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x415ce2
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x415cb0
cmp ax, 0x22
jne 0x415c9d
cmp word [esi], 0x22
jne 0x415cbb
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x415cc9
cmp ax, 0x20
jbe 0x415cb6
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoW]
test byte [ebp - 0x4c], 1
je 0x415cef
movzx eax, word [ebp - 0x48]
jmp 0x415cf2
cmp word [esi], 0x20
jbe 0x415cbb
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x415ce2
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x415d13
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x415d48
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00415db1
ret
Function at 0x402973
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4029b5
xor eax, eax
jmp 0x402a7c
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4029d3
xor eax, eax
jmp 0x402a7c
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4029ed
xor eax, eax
jmp 0x402a7c
push 0
push 0x20
push 0x20
push 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
mov dword [ebp - 4], eax
push 3
mov eax, dword [ebp - 4]
and eax, 0xffff
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x402a24
xor eax, eax
jmp 0x402a7c
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x402a3f
xor eax, eax
jmp 0x402a7c
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x402a56
xor eax, eax
jmp 0x402a7c
push 0x30000
push 1
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_CreateIconFromResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x405d6f
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x20
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 8]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x18], 1
cmp dword [ebp + 8], 0
je 0x405daf
mov dword [ebp - 0xc], 2
jmp 0x405db6
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x40671d
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x40c4c0], 0
jne 0x406731
jmp 0x406814
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
push 0
push str.TrayNotifyWnd
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 8], eax
push 0
push str.SysPager
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x406779
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
push 0
push str.ToolbarWindow32
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40679b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x406814
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 0
push 0xf
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x1c], 5
jmp 0x4067d1
mov edx, dword [ebp - 0x1c]
add edx, 5
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x10]
jge 0x406814
mov dword [ebp - 0x20], 5
jmp 0x4067eb
mov ecx, dword [ebp - 0x20]
add ecx, 5
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0xc]
jge 0x406812
mov eax, dword [ebp - 0x20]
shl eax, 0x10
mov ecx, dword [ebp - 0x1c]
or ecx, eax
push ecx
push 0
push 0x200
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4067e2
jmp 0x4067c8
mov esp, ebp
pop ebp
ret
Function at 0x406dd2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
push 0x64
mov eax, dword [0x40c604]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
jmp 0x406e17
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
cmp edx, dword [0x415a68]
jge 0x406eeb
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x3c
mov ecx, dword [eax + 0x411e68]
cmp ecx, dword [ebp - 0xc]
je 0x406ee6
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x3c
mov eax, dword [edx + 0x411e68]
cmp eax, dword [ebp + 8]
jne 0x406ec0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x3c
mov eax, dword [edx + 0x411e68]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x406e80
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x406eb4
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
jne 0x406e9b
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x406eb4
push 0
push 0
push 0xf
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x3c
mov edx, dword [ecx + 0x411e98]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x406ee6
mov ecx, dword [ebp - 0x14]
imul ecx, ecx, 0x3c
mov edx, dword [ecx + 0x411e9c]
cmp edx, dword [ebp + 8]
jne 0x406ee6
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x3c
mov ecx, dword [eax + 0x411e68]
push ecx
call fcn.00406dd2
add esp, 4
jmp 0x406e0e
cmp dword [ebp - 4], 0
je 0x406efe
mov edx, dword [0x40c604]
push edx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
cmp dword [ebp - 0x10], 0
je 0x406f34
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0x40bf1c
lea edx, [ebp - 0x7c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
call fcn.004066e8
push 0x7d0
lea eax, [ebp - 0x7c]
push eax
call fcn.00406f38
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x406f6c
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
cmp dword [0x40c3a4], 0
jne 0x406f9a
push 0x1f4
push str.WinME_2000_XP_required_
call fcn.00406f38
add esp, 8
call fcn.004066e8
jmp 0x407158
push 0x64
mov eax, dword [0x40c604]
push eax
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x3c
mov edx, dword [ecx + 0x411ea0]
mov dword [ebp - 0x68], edx
mov eax, dword [ebp + 8]
imul eax, eax, 0x3c
mov ecx, dword [eax + 0x411e68]
mov dword [ebp - 0x7c], ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
cmp dword [ebp - 0x7c], eax
jne 0x406ff5
push 0x1f4
push str.Its_bad_idea...___
call fcn.00406f38
add esp, 8
call fcn.004066e8
jmp 0x407156
push 0
push 4
call dword [0x40c3c8]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xa0], 0x1c
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x70], 0
lea edx, [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0x74]
push eax
call dword [0x40c3bc]
mov ecx, dword [ebp - 0x94]
cmp ecx, dword [ebp - 0x7c]
jne 0x4070a8
mov edx, dword [ebp - 0x70]
add edx, 1
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0x98]
push eax
push 0
push 2
call dword [0x40c3a4]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x40709f
cmp dword [ebp - 0x68], 0
je 0x407071
mov ecx, dword [ebp - 0x80]
push ecx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
mov dword [ebp - 0x84], eax
jmp 0x407081
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.DLL_SuspendThread]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffff
jne 0x407093
mov eax, dword [ebp - 0x78]
add eax, 1
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x80]
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4070a8
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x74]
push ecx
call dword [0x40c3b8]
test eax, eax
jne 0x40702b
mov edx, dword [ebp - 0x74]
push edx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 8]
imul eax, eax, 0x3c
xor ecx, ecx
cmp dword [eax + 0x411ea0], 0
sete cl
mov edx, dword [ebp + 8]
imul edx, edx, 0x3c
mov dword [edx + 0x411ea0], ecx
cmp dword [ebp - 0x78], 0
je 0x407141
cmp dword [ebp - 0x68], 0
je 0x407111
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
push str.Cant_resume__u_of__u_threads
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x40712b
mov eax, dword [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x78]
push ecx
push str.Cant_suspend__u_of__u_threads
lea edx, [ebp - 0x64]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
call fcn.004066e8
push 0x7d0
lea eax, [ebp - 0x64]
push eax
call fcn.00406f38
add esp, 8
cmp dword [ebp - 0x6c], 0
je 0x407154
mov ecx, dword [0x40c604]
push ecx
call dword [sym.imp.KERNEL32.DLL_ReleaseMutex]
jmp 0x407158
jmp 0x407141
mov esp, ebp
pop ebp
ret