joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7164c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x70], 0
jne 0x7164d8
mov eax, ebx
call fcn.007162ac
cmp dword [ebx + 0x58], 0
jne 0x7164e5
mov eax, ebx
call fcn.00716204
mov esi, dword [ebx + 0x70]
test esi, esi
je 0x71667b
cmp dword [ebx + 0x58], 0
je 0x71667b
mov edx, esp
mov eax, esi
call fcn.007414f4
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00716188
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x71654c
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x716534
adc ecx, 0
lea edi, [esp + 0x14]
push edi
sub eax, edx
add eax, esi
sar eax, 1
jns 0x716544
adc eax, 0
mov edx, eax
pop eax
call fcn.00413b54
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0xdc]
test eax, eax
je 0x716562
call fcn.00565c34
mov esi, eax
jmp 0x716565
mov esi, dword [ebx + 0x74]
mov edx, 0xffffffec
mov eax, esi
call fcn.00416be8
test al, 8
je 0x71657a
or esi, 0xffffffff
jmp 0x716584
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov eax, dword [ebx + 0x58]
mov edx, dword [esp + 0x14]
call fcn.0064dedc
mov eax, dword [ebx + 0x58]
mov edx, dword [esp + 0x18]
call fcn.0064df18
mov eax, dword [ebx + 0x58]
mov edx, dword [esp]
call fcn.0055bdf8
mov eax, dword [ebx + 0x58]
mov edx, dword [esp + 4]
call fcn.0055be2c
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00741534
mov edx, ebp
lea eax, [esp + 0x10]
call fcn.00741c80
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x58]
call fcn.00565c34
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebx + 0x58]
call fcn.00565c34
mov edx, 0xffffffec
call fcn.00416be8
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
mov eax, dword [ebx + 0x58]
call fcn.00565c34
mov edx, 0xffffffec
pop ecx
call fcn.00416edc
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x70]
call fcn.00535ff0
call fcn.0052fb1c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x58]
call fcn.00565c34
push eax
mov eax, dword [0x801558]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x58]
call fcn.00565c34
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x71b5b4
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x71b5c4
call sub.user32.dll_FindWindowW
ret
Function at 0x73d93c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0x58], 0
jne 0x73d953
mov eax, ebx
call fcn.0073d2ac
cmp dword [ebx + 0x5c], 0
jne 0x73d960
mov eax, ebx
call fcn.0073d224
mov esi, dword [ebx + 0x58]
test esi, esi
je 0x73daf9
cmp dword [ebx + 0x5c], 0
je 0x73daf9
mov edx, esp
mov eax, esi
call fcn.007414f4
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.0073d104
lea eax, [esp + 0x14]
xor edx, edx
call fcn.00741598
cmp eax, dword [esp]
je 0x73d9d4
lea eax, [esp + 0x14]
xor edx, edx
call fcn.007415ac
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x73d9b1
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.00741598
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x73d9ca
adc edx, 0
lea eax, [esp + 0x18]
pop ecx
call fcn.00413b54
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x73d9e7
mov eax, dword [eax + 0x2c]
call fcn.00565c34
mov esi, eax
jmp 0x73d9ea
mov esi, dword [ebx + 0x74]
mov edx, 0xffffffec
mov eax, esi
call fcn.00416be8
test al, 8
je 0x73d9ff
or esi, 0xffffffff
jmp 0x73da09
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov eax, dword [ebx + 0x5c]
mov edx, dword [esp + 0x14]
call fcn.0064dedc
mov eax, dword [ebx + 0x5c]
mov edx, dword [esp + 0x18]
call fcn.0064df18
mov eax, dword [ebx + 0x5c]
mov edx, dword [esp]
call fcn.0055bdf8
mov eax, dword [ebx + 0x5c]
mov edx, dword [esp + 4]
call fcn.0055be2c
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00741534
mov edx, edi
lea eax, [esp + 0x10]
call fcn.00741c80
push 0x61b
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x5c]
call fcn.00565c34
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
mov eax, dword [ebx + 0x5c]
call fcn.00565c34
mov edx, 0xffffffec
call fcn.00416be8
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
mov eax, dword [ebx + 0x5c]
call fcn.00565c34
mov edx, 0xffffffec
pop ecx
call fcn.00416edc
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x58]
call fcn.00535ff0
call fcn.0052fb1c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x5c]
call fcn.00565c34
push eax
mov eax, dword [0x801558]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x5c]
call fcn.00565c34
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x7420a8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov byte [ebp - 6], 0
mov eax, dword [ebp - 4]
call fcn.0040b4b4
push eax
call sub.kernel32.dll_GetFileAttributesW
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x742176
test byte [ebp - 0xb], 4
jne 0x7420e6
test byte [ebp - 0xc], 0x10
setne byte [ebp - 6]
jmp 0x7421a3
cmp byte [ebp - 5], 0
je 0x74212c
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040b4b4
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x7421a3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
test byte [ebp - 0xc], 0x10
setne byte [ebp - 6]
jmp 0x7421a3
test byte [ebp - 0xc], 0x10
je 0x742138
mov byte [ebp - 6], 1
jmp 0x7421a3
push 0
push 0x2000000
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.0040b4b4
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x742170
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 6], 0
jmp 0x7421a3
mov byte [ebp - 6], 1
jmp 0x7421a3
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffffe
sub eax, 2
jb 0x74219c
sub eax, 0x11
je 0x74219c
sub eax, 0x20
je 0x74219c
sub eax, 0x46
je 0x74219c
xor eax, eax
jmp 0x74219e
mov al, 1
xor al, 1
mov byte [ebp - 6], al
mov al, byte [ebp - 6]
mov esp, ebp
pop ebp
ret
Function at 0x7753d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x809160
test esi, esi
jne 0x7753ee
xor eax, eax
jmp 0x7754df
cmp dword [ebp], 0
jne 0x7753f9
call fcn.00775364
xor ebx, 0xffffffff
cmp edi, 8
jb 0x7754b9
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
movzx eax, al
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x775405
test edi, edi
jbe 0x7754da
movzx eax, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x7754bd
or eax, 0xffffffff
xor eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x781b74
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetCurrentProcessId
push eax
call sub.kernel32.dll_ProcessIdToSessionId
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 5
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x781bde
xor eax, eax
push ebp
push 0x781bd7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040a92c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x781bde
mov eax, dword [ebp - 8]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x789bd0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd5c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x280]
mov edx, dword [0x41e4dc]
call fcn.0040bc1c
xor eax, eax
push ebp
push 0x78a053
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x78a070
mov al, 1
call fcn.00788554
test al, al
je 0x78a017
mov byte [ebp - 0x291], 1
mov dl, 1
mov eax, dword [0x445944]
call fcn.004702e8
mov dword [ebp - 0x28c], eax
mov dl, 1
mov eax, dword [0x52157c]
call fcn.005226c8
mov dword [ebp - 0x288], eax
xor eax, eax
push ebp
push 0x789cb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 0x288]
call fcn.005227b0
mov cl, 1
mov edx, 0x78a0a0
mov eax, dword [ebp - 0x288]
call fcn.00522908
mov edx, dword [ebp - 0x28c]
mov eax, dword [ebp - 0x288]
call fcn.00522e84
mov eax, dword [ebp - 0x288]
call fcn.00522780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x789cbe
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78a05a
lea eax, [ebp - 0x2a4]
mov edx, 3
call fcn.0040a804
lea eax, [ebp - 0x280]
mov edx, dword [0x41e4dc]
call fcn.0040bcf8
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040a804
ret
Function at 0x78a308
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x364], ebx
mov dword [ebp - 0x36c], ebx
mov dword [ebp - 0x368], ebx
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x35c], ebx
mov dword [ebp - 0x360], ebx
mov esi, edx
lea edi, [ebp - 0x200]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov esi, eax
lea edi, [ebp - 0x100]
push ecx
movzx ecx, byte [esi]
inc ecx
rep movsb byte es:[edi], byte [esi]
pop ecx
mov ebx, ecx
xor eax, eax
push ebp
push 0x78a4c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x78a4e4
lea eax, [ebp - 0x35c]
lea edx, [ebp - 0x100]
mov ecx, 0
call fcn.0040af28
push dword [ebp - 0x35c]
push 0x78a4f4
lea eax, [ebp - 0x360]
lea edx, [ebp - 0x200]
mov ecx, 0
call fcn.0040af28
push dword [ebp - 0x360]
lea eax, [ebp - 0x358]
mov edx, 4
call fcn.0040b074
mov edx, dword [ebp - 0x358]
lea eax, [ebp - 0x354]
mov ecx, 0xff
call fcn.0040af74
lea eax, [ebp - 0x244]
xor ecx, ecx
mov edx, 0x44
call fcn.00407dc4
mov dword [ebp - 0x244], 0x44
mov dword [ebp - 0x218], 1
mov word [ebp - 0x214], bx
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x368]
lea edx, [ebp - 0x100]
call fcn.0040b638
mov eax, dword [ebp - 0x368]
lea edx, [ebp - 0x364]
call fcn.00427a9c
mov eax, dword [ebp - 0x364]
call fcn.0040b4b4
push eax
push 0
push 0x30
push 0
push 0
push 0
lea eax, [ebp - 0x36c]
lea edx, [ebp - 0x354]
call fcn.0040b638
mov eax, dword [ebp - 0x36c]
call fcn.0040b4b4
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x78a499
push 0xffffffffffffffff
mov eax, dword [ebp - 0x254]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x254]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x250]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78a4ce
lea eax, [ebp - 0x36c]
mov edx, 3
call fcn.0040a804
lea eax, [ebp - 0x360]
mov edx, 3
call fcn.0040a834
ret
Function at 0x78c11c
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x78c2a4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48c]
call fcn.005a1104
test eax, eax
jne 0x78c15f
mov dword [0x809410], 0x80000002
jmp 0x78c169
mov dword [0x809410], 0x80000001
mov dl, 1
mov eax, dword [0x445944]
call fcn.004702e8
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x445944]
call fcn.004702e8
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x52157c]
call fcn.005226c8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x78c272
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x809410]
mov eax, dword [ebp - 8]
call fcn.005227b0
xor ecx, ecx
mov edx, 0x78c2c0
mov eax, dword [ebp - 8]
call fcn.00522908
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.005230f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x490]
mov eax, dword [eax + 0x2cc]
call fcn.005a6a28
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x78c254
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x490]
mov eax, dword [eax + 0x2cc]
call fcn.005a6854
mov dword [0x809408], eax
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [0x809408]
call fcn.005a6100
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.005232cc
mov edx, dword [ebp - 0x18]
mov eax, dword [0x809408]
mov eax, dword [eax + 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc ebx
dec esi
jne 0x78c1f2
mov eax, dword [ebp - 8]
call fcn.00522780
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78c279
mov eax, dword [ebp - 8]
call fcn.0040893c
ret
Function at 0x4043ec
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4268ec], 0
push esi
mov esi, edx
jne 0x404421
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.0040326c
mov eax, dword [eax]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00403149
pop ecx
test esi, esi
jmp 0x40442b
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x404431
mov al, 1
jmp 0x404433
xor al, al
pop esi
leave
ret

Function at 0x404436
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4268ec], 0
jne 0x404468
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.0040326c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00403149
pop ecx
test esi, esi
pop esi
jmp 0x404471
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x404477
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x4044ef
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4268ec], 0
jne 0x404524
mov edx, ecx
push esi
lea ecx, [ebp - 0xc]
call fcn.0040326c
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
push dword [ebp - 0xc]
call fcn.00403149
pop ecx
test esi, esi
pop esi
jmp 0x40452f
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x404535
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x40489e
Capabilities:
Get common file path

Disassembly:
mov eax, 0x41dfd8
call fcn.0041cfb0
sub esp, 0x32c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov word [eax], bx
cmp byte [0x4268ec], bl
jne 0x40491c
lea eax, [ebp - 0x12c]
mov byte [ebp - 0x12c], bl
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x18]
call fcn.004032c6
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.004032b1
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00401d2c
push dword [ebp - 0x24]
call fcn.00403149
push dword [ebp - 0x18]
call fcn.00403149
pop ecx
pop ecx
jmp 0x404945
lea eax, [ebp - 0x338]
mov word [ebp - 0x338], bx
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
lea eax, [ebp - 0x338]
push eax
mov ecx, esi
call fcn.00404106
cmp edi, ebx
jbe 0x404956
cmp edi, 0x104
ja 0x404956
push 1
pop eax
jmp 0x404958
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404f3f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x404f65
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x404f65
xor al, al
jmp 0x404f85
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.0041d140
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x405b45
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, ecx
push edi
mov eax, dword [esi]
and dword [esi + 4], 0
and byte [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
jne 0x405b72
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x405ba9
cmp edi, dword [esi + 8]
jl 0x405b7f
push edi
mov ecx, esi
call fcn.00403316
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, esi
mov edi, eax
call fcn.00405abc
test edi, edi
jne 0x405ba7
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x405ba9
mov al, 1
pop edi
pop esi
pop ebx
ret 4

Function at 0x405baf
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x41e1b0
call fcn.0041cfb0
sub esp, 0x18
cmp byte [0x4268ec], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x405c30
mov esi, dword [ebp + 8]
mov eax, dword [esi]
and dword [esi + 4], 0
and word [eax], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
je 0x405c1f
cmp edi, dword [esi + 8]
jl 0x405bf2
push edi
mov ecx, esi
call fcn.0040216b
mov eax, dword [esi]
inc edi
push edi
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi]
xor ebx, ebx
xor edx, edx
cmp word [ecx], bx
je 0x405c14
mov edi, ecx
inc edx
inc edi
inc edi
cmp word [edi], bx
jne 0x405c0c
mov word [ecx + edx*2], bx
cmp eax, ebx
mov dword [esi + 4], edx
jne 0x405c2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
jmp 0x405c81
mov al, 1
jmp 0x405c81
xor esi, esi
push 3
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.00403316
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
mov dword [ebp - 4], esi
call fcn.00405b45
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x24]
mov bl, al
call fcn.004042cc
mov ecx, dword [ebp + 8]
push eax
mov byte [ebp - 4], 1
call fcn.00401d2c
push dword [ebp - 0x24]
call fcn.00403149
push dword [ebp - 0x18]
call fcn.00403149
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x40d395
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get number of processors

Disassembly:
mov eax, 0x41ee5e
call fcn.0041cfb0
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 3
xor ebx, ebx
or eax, 0xffffffff
lea ecx, [esi + 0x38]
pop edi
mov dword [esi + 8], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], eax
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x34], eax
push edi
mov dword [ebp - 0x10], esi
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040216b
lea ecx, [esi + 0x44]
push edi
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040216b
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], 4
mov dword [esi + 0x50], 0x4203dc
lea ecx, [esi + 0x64]
push edi
mov byte [ebp - 4], 2
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040216b
lea ecx, [esi + 0x70]
push edi
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040216b
lea ecx, [esi + 0x7c]
push edi
mov byte [ebp - 4], 4
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040216b
lea ecx, [esi + 0x88]
push edi
mov byte [ebp - 4], 5
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.0040216b
lea ecx, [esi + 0x94]
call fcn.0041bef0
mov eax, esi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret