joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f80
Capabilities:
Copy file
Delete file
Query environment variable
Set file attributes

Disassembly:
sub esp, 0x208
push esi
push edi
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x37a
push str.Sujehi__o_twddoNk_
call fcn.00402570
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 8
stosb byte es:[edi], al
lea eax, [esp + 8]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10c]
push 0x104
push ecx
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
xor eax, eax
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0xc]
mov edx, ecx
mov esi, edi
mov edi, str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
pop edi
pop esi
jne 0x40304b
mov eax, 1
add esp, 0x208
ret
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
call fcn.00402c20
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 4
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
call fcn.00402cb0
add esp, 4
push 0x1000
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 4]
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._RqmbzdlDjn_p___oevTEasf_ivk_ohd
call fcn.00402e40
add esp, 4
call fcn.00402e00
call fcn.00402d40
xor eax, eax
add esp, 0x208
ret
Function at 0x404183
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push dword [0x487354]
call fcn.00412732
mov esi, eax
or ebp, 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, dword [esp + 0x28]
mov ecx, eax
movzx edx, word [ecx]
test dx, dx
je 0x4042b6
mov eax, dword [esi]
mov esi, edx
mov edx, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0x20
push 0x22
pop edi
movzx eax, si
cmp si, word [esp + 0x18]
jne 0x4041e9
push 0x20
pop esi
add ecx, 2
movzx eax, word [ecx]
cmp ax, si
je 0x4041de
mov dword [esp + 0x10], 1
cmp ax, di
jne 0x404223
add ecx, 2
mov edi, ecx
movzx eax, word [ecx]
mov esi, eax
test ax, ax
je 0x404281
push 0x22
mov edx, eax
pop ebx
movzx esi, dx
cmp dx, bx
je 0x40427d
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
mov esi, eax
test ax, ax
jne 0x40420a
jmp 0x40427d
test ax, ax
je 0x404291
push 0x22
pop ebx
push 0x20
mov edi, ecx
movzx eax, ax
pop ebp
movzx esi, ax
cmp ax, bp
je 0x404279
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
cmp ax, bx
jne 0x40426e
add ecx, 2
movzx eax, word [ecx]
mov edx, eax
test ax, ax
je 0x40426e
mov esi, eax
movzx edx, si
cmp si, bx
je 0x40426e
add ecx, 2
movzx eax, word [ecx]
mov esi, eax
mov edx, eax
test ax, ax
jne 0x404257
movzx eax, dx
movzx esi, dx
test dx, dx
jne 0x404233
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x28]
mov edx, ecx
test si, si
je 0x40428b
add ecx, 2
mov eax, dword [esp + 0x10]
jmp 0x404295
xor eax, eax
xor edi, edi
cmp dword [esp + 0x1c], ebp
jne 0x40429f
test ebx, ebx
jne 0x4042be
test eax, eax
je 0x4042a8
inc ebp
mov dword [esp + 0x14], ebp
movzx eax, word [ecx]
mov esi, eax
test ax, ax
jne 0x4041ce
test ebx, ebx
jne 0x4042d2
mov eax, ebp
jmp 0x4042d7
test edi, edi
je 0x4042d2
mov eax, dword [esp + 0x20]
sub edx, edi
sar edx, 1
mov dword [ebx], edx
inc dword [eax]
mov eax, edi
jmp 0x4042d7
and dword [ebx], 0
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x405ffc
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
push dword [edi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x406034
push dword [edi]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x10], 1
push dword [edi]
push esi
call fcn.00428b0b
test byte [edi + 0x14], 8
mov dword [esp + 0x14], eax
je 0x406125
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [edi], eax
jne 0x406125
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x406153
test ebp, ebp
jle 0x406153
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x406153
push ebp
push dword [esp + 0x30]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esp + 0x30], eax
test eax, eax
je 0x40611c
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x10], 0
je 0x4060c6
push 4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push dword [edi + 0x10]
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x4060db
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push 2
pop eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
sub dword [esp + 0x20], eax
sub dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0xcc0020
xor eax, eax
push eax
push eax
push ebx
push ebp
push dword [esp + 0x40]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x30]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x406153
cmp dword [edi + 0x10], ebx
je 0x40613f
push 4
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 0x10]
push ebx
push ebx
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x406153
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push dword [esp + 0x14]
push esi
call fcn.00428c15
cmp dword [esp + 0x10], 0
je 0x40616d
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x406185
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push esi
push edi
push 1
call ebx
movzx esi, ax
push 2
shr esi, 0xf
call ebx
mov edi, esi
or edi, 2
bt ax, 0xf
push 4
cmovae edi, esi
call ebx
mov cx, ax
mov eax, edi
or eax, 4
bt cx, 0xf
cmovae eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4061c3
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, dword [esp + 0x20]
mov esi, eax
push 0xfffffffffffffff4
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi]
mov dword [esp + 0x14], eax
call fcn.00427a56
push eax
call fcn.0040bdcc
push dword [0x4874ec]
mov dword [esp + 0x24], eax
call fcn.00427d12
mov ebp, eax
movsx ecx, si
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
push dword [edi]
shr esi, 0x10
movsx ecx, si
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
movzx esi, ax
push 0x12
shr esi, 0xf
call edi
mov ebx, esi
or ebx, 2
bt ax, 0xf
push 0x11
cmovae ebx, esi
call edi
mov ecx, 0x8000
and ax, cx
movzx esi, ax
mov eax, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 4], eax
call fcn.00406185
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [ebp + 0xc], eax
mov eax, ebx
push 0x406175
push ebp
push dword [esp + 0x2c]
or eax, 4
test si, si
push dword [esp + 0x2c]
cmove eax, ebx
push dword [esp + 0x20]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [ebp + 0x14], eax
movzx eax, word [esp + 0x44]
push 0x332c
mov dword [ebp + 0x18], eax
call fcn.00427fd4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x407f78
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x487738]
call fcn.00412ede
mov ebx, eax
test ebx, ebx
je 0x407fdc
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x407fa1
push dword [esp + 0xc]
push ebx
call eax
jmp 0x407fdc
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.00413a40
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call fcn.004132e1
pop ecx
sub edi, eax
push edi
call fcn.00413ae0
pop edi
pop esi
pop ebx
ret 8
Function at 0x40801f
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push dword [0x48773c]
call fcn.00412732
xor ebx, ebx
mov ebp, eax
cmp dword [0x487820], ebx
jne 0x4080b3
mov esi, 0xa8
push esi
push ebx
push 0x487778
call fcn.004012c0
add esp, 0xc
mov dword [0x48777c], esi
mov esi, dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x487778], 0xa
mov dword [0x487780], 0x4084f4
push 0x7f89
push ebx
mov dword [0x4877f0], 0x42a64f
mov dword [0x4877f4], 0x42a6a8
mov dword [0x487784], 0x4084d4
mov dword [0x487808], 0x408513
call esi
mov dword [0x487820], eax
test eax, eax
jne 0x4080b3
push 0x7f00
push ebx
call esi
mov dword [0x487820], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00427985
push ebx
push dword [0x4857e8]
push 0xffffffffffffffff
push dword [ebp]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push 0x40000000
push dword [esp + 0x48]
push str.STATIC
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
je 0x40817f
push edi
push dword [esp + 0x14]
push dword [0x487738]
call fcn.00412e61
mov edi, eax
push 8
or dword [edi + 0x10], 0xffffffff
call dword [sym.imp.USER32.dll_GetSysColor]
push 0x14
push 0
mov dword [edi + 0x14], eax
push dword [0x4857e4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0x487778
push ebx
push edi
push dword [esp + 0x20]
mov dword [esi], ecx
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esi + 0xc], ecx
mov byte [esi + 0x10], 0
mov dword [edi + 0x1c], esi
call fcn.004279da
push 0x408187
push 0xfffffffffffffffc
push dword [edi]
mov ebx, eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 0x20

Function at 0x40cef0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x40cf2c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x40cf40
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
jne 0x40cf59
push dword [0x487dac]
call fcn.00413012
pop edi
ret 4
push esi
push edi
push dword [0x487dac]
call fcn.00412ede
mov esi, eax
test esi, esi
je 0x40cfc3
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x40cfaf
cmp dword [esi + 0x14], 0
mov dword [esp + 0xc], 0
jne 0x40cf9e
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
push dword [esi + 4]
push 0
push dword [0x4857e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [0x487dac]
call fcn.00412f47
pop esi
pop edi
ret 4

Function at 0x40d2b0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x487dac]
call fcn.00412ede
mov esi, eax
test esi, esi
je 0x40d32f
cmp dword [esi + 4], 0
je 0x40d300
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.0042ccb0
test eax, eax
je 0x40d2f4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d33a
cmp dword [esp + 8], 0
je 0x40d33a
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x40d4f0
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x40d5ef
cmp word [edx], 0
je 0x40d5ef
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x40d51e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x40d574
mov ecx, edx
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d530
sub ecx, edi
sar ecx, 1
cmp dword [esi + 4], 0
je 0x40d556
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.0042d2b0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
lea eax, [esp + 0x14]
push eax
xor eax, eax
cmp ecx, 2
push edx
setne al
dec eax
and eax, 0xfde9
push eax
call fcn.0042d3d0
mov edi, eax
test edi, edi
je 0x40d56a
cmp dword [esi + 4], 0
je 0x40d5c2
push dword [esp + 0x14]
push edi
push esi
call fcn.0042d2b0
push edi
push 0
push dword [0x4857e4]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x4857e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x40edea
Capabilities:
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
test esi, esi
je 0x40ee47
push esi
call dword [esi + 0x58]
mov ecx, dword [esi + 0x80]
mov edi, eax
mov dword [esi + 0x94], ecx
mov ecx, dword [esi + 0x84]
mov dword [esi + 0x98], ecx
test edi, edi
jne 0x40ee47
mov eax, dword [esi + 0x70]
test eax, eax
je 0x40ee26
push ebx
push esi
call eax
push esi
push ebx
push dword [0x4857e4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [0x487dc8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x487dcc], ebx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x40f929
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebp
xor ebp, ebp
cmp dword [0x487dd8], ebp
je 0x40fb0f
push ebx
mov ebx, dword [esp + 0x60]
push edi
test ebx, ebx
je 0x40f949
mov edi, ebx
jmp 0x40f95b
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x40fb0d
lea eax, [esp + 0x18]
push eax
push 0x18
push dword [esp + 0x68]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x40fb02
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0x30]
push esi
mov esi, dword [esp + 0x24]
push 0x2c
push 0
push eax
mov dword [esp + 0x20], ebp
call fcn.004012c0
add esp, 0xc
mov dword [esp + 0x34], 0x28
xor eax, eax
mov dword [esp + 0x38], ebp
inc eax
mov dword [esp + 0x3c], esi
mov word [esp + 0x40], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [esp + 0x4a], ax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x44]
mov dword [esp + 0x54], ecx
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
je 0x40fb01
push 0
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x18]
push esi
push 0
push dword [esp + 0x78]
push edi
call dword [sym.imp.GDI32.dll_GetDIBits]
imul esi, dword [esp + 0x14]
test esi, esi
jle 0x40fb01
cmp dword [esp + 0x6c], 0
je 0x40faae
mov ebp, dword [esp + 0x10]
push 0xa
pop ebx
movzx ecx, byte [ebp + 1]
xor edx, edx
movzx eax, byte [ebp + 2]
lea eax, [eax + ecx*2]
movzx ecx, byte [ebp]
imul eax, eax, 3
add eax, ecx
div ebx
mov cl, al
cmp cl, 0x40
jae 0x40fa42
movzx eax, cl
sub eax, 0x40
imul eax, eax, 7
cdq
idiv ebx
lea ecx, [eax + 0x40]
jmp 0x40fa58
cmp cl, 0xc0
jbe 0x40fa58
movzx eax, cl
sub eax, 0xc0
imul eax, eax, 7
cdq
idiv ebx
lea ecx, [eax - 0x40]
movzx eax, byte [ebp + 3]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
movzx eax, cl
movd xmm0, eax
divss xmm1, dword [0x45e078]
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm0
cvttss2si ecx, xmm1
mov byte [ebp], cl
mov eax, dword [esp + 0x10]
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
mov byte [ecx + 2], al
mov ebp, dword [esp + 0x10]
add ebp, 4
mov dword [esp + 0x10], ebp
sub esi, 1
jne 0x40fa12
mov ebx, dword [esp + 0x68]
mov ebp, dword [esp + 0x18]
jmp 0x40fb01
mov edx, dword [esp + 0x10]
mov al, byte [edx + 3]
cmp al, 0xff
jae 0x40faf5
movzx ecx, al
movzx eax, byte [edx]
imul ecx, eax
shr ecx, 8
mov byte [edx], cl
mov edx, dword [esp + 0x10]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 3]
imul ecx, eax
shr ecx, 8
mov byte [edx + 1], cl
mov edx, dword [esp + 0x10]
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
imul ecx, eax
shr ecx, 8
mov byte [edx + 2], cl
mov edx, dword [esp + 0x10]
add edx, 4
mov dword [esp + 0x10], edx
sub esi, 1
jne 0x40fab2
pop esi
test ebx, ebx
jne 0x40fb0d
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
pop ebx
mov eax, ebp
pop ebp
add esp, 0x50
ret 0xc
Function at 0x413890
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x4138e5
push dword [esp + 0x10]
push 0x413944
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [0x487f08]
test edi, edi
je 0x41393e
xor esi, esi
mov ebx, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x4138dd
cmp byte [edi + 0x10], 0
je 0x4138dd
push 3
push esi
push esi
push esi
push esi
push 0xfffffffffffffffe
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, ebx
test ebx, ebx
jne 0x4138b9
jmp 0x41393e
mov edi, dword [0x487f08]
test edi, edi
je 0x41393e
xor esi, esi
push ebp
mov ebp, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi + 8], eax
jne 0x413937
cmp byte [edi + 0x11], 0
je 0x413910
push 1
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [edi + 0x10], 0
je 0x413927
push 3
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [edi + 8]
push eax
push 0x487f08
call fcn.00413b8e
pop ecx
pop ecx
mov edi, ebp
test ebp, ebp
jne 0x4138f2
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x422700
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x422720
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x422720
mov eax, dword [eax + 0x44]
test eax, eax
je 0x422720
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x428d06
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x188
push 8
push dword [0x4857e4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x487dc8]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x487dcc], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.00443889
mov dword [esi + 0x58], 0x429f34
mov eax, esi
mov dword [esi + 0x5c], 0x429f80
mov dword [esi + 0x10], fcn.00428e6d
mov dword [esi + 0x30], 0x428ff9
mov dword [esi + 0x64], 0x429210
mov dword [esi + 0x60], 0x429268
mov dword [esi + 0x34], 0x4298a2
mov dword [esi + 0x24], 0x429754
mov dword [esi + 0x28], 0x42977d
mov dword [esi + 0x2c], 0x4297a8
mov dword [esi + 0x44], 0x429d29
mov dword [esi + 0x68], 0x428df8
mov dword [esi + 0x6c], 0x428e57
pop esi
ret 4

Function at 0x42b071
Capabilities:
Check os version

Disassembly:
sub esp, 0x34c
push ebp
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
mov esi, 0xc8
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42b1f5
mov eax, dword [esp + 0x1c]
sub eax, 1
je 0x42b1d8
sub eax, 1
jne 0x42b1f5
lea eax, [esp + 0x120]
xor edi, edi
push eax
call fcn.0042b201
pop ecx
test eax, eax
je 0x42b0e5
mov ecx, dword [esp + 0x124]
mov eax, dword [esp + 0x128]
mov ebp, dword [esp + 0x12c]
cmp byte [esp + 0x23a], 1
jmp 0x42b116
lea eax, [esp + 0x23c]
mov dword [esp + 0x23c], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42b1f5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp byte [esp + 0x356], 1
jne 0x42b11b
xor edi, edi
inc edi
sub ecx, 3
je 0x42b1d4
sub ecx, 1
je 0x42b1d0
sub ecx, 1
je 0x42b1ab
sub ecx, 1
je 0x42b15b
sub ecx, 4
jne 0x42b1f5
test eax, eax
jne 0x42b1f5
cmp ebp, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x42b1f5
sub eax, 0
je 0x42b19d
sub eax, 1
je 0x42b18f
sub eax, 1
je 0x42b181
sub eax, 1
jne 0x42b1f5
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x42b1f5
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x42b1f5
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x42b1f5
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x42b1f5
sub eax, 0
je 0x42b1cc
sub eax, 1
je 0x42b1c8
sub eax, 1
jne 0x42b1f5
mov esi, edi
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x42b1f5
push 0x3c
jmp 0x42b1f4
push 0x32
jmp 0x42b1f4
push 0x14
jmp 0x42b1f4
push 5
jmp 0x42b1f4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42b1f2
cmp eax, 0xa
je 0x42b1ee
cmp eax, 0x5a
jne 0x42b1f5
push 0x28
jmp 0x42b1f4
push 0x1e
jmp 0x42b1f4
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
add esp, 0x34c
ret