joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cec0
Capabilities:
Get file version info

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40cedd
mov eax, 0x470aa4
lea ecx, [esp + 0x10]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x40cef6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
call fcn.0045b2eb
mov ecx, esi
mov ebx, eax
mov edx, ecx
xor eax, eax
mov edi, ebx
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
xor edi, edi
cmp eax, edi
jne 0x40cf23
mov eax, 0x470aa4
mov ecx, dword [esp + 0x10]
push ebx
push esi
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40cf3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push str.VarFileInfoTranslation
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x14]
shr eax, 2
cmp eax, edi
jle 0x40cf8a
mov edi, eax
xor esi, esi
mov ecx, dword [esp + 0x18]
mov edx, dword [ecx]
mov ecx, ebp
push edx
push ebx
push esi
call fcn.0040cfa0
inc esi
cmp esi, 0xc
jl 0x40cf68
push ebx
call fcn.0045b314
add esp, 4
dec edi
jne 0x40cf66
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x410eb0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x7a
xor eax, eax
lea edi, [esi + 0x3c]
mov dword [esp + 0xc], 0x94
rep stosd dword es:[edi], eax
mov ecx, 0x24
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
mov dword [esi + 0x224], ebx
mov dword [esi + 0x228], 1
mov dword [esi + 0x22c], 1
mov dword [esi + 0x26c], ebx
mov dword [esi + 0x270], 1
mov dword [esi + 0x230], ebx
mov dword [esi + 0x250], ebx
mov dword [esi + 0x268], ebx
mov dword [esi + 0x238], ebx
mov dword [esi + 0x274], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x410f52
cmp dword [esp + 0x10], 5
jb 0x410f52
mov eax, 1
pop edi
mov dword [esi + 0x234], eax
pop esi
pop ebx
add esp, 0x94
ret
mov dword [esi + 0x234], ebx
pop edi
pop esi
pop ebx
add esp, 0x94
ret
Function at 0x412290
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
push 0x40
push eax
push 0x48f2b0
call fcn.004125d0
push 0x40
push 0x470ef0
push 0x48f2b0
push 0x48f2b0
call fcn.004124f0
mov al, byte [esp + 0x3c]
add esp, 0x1c
test al, al
jne 0x41231b
mov ebx, dword [esp + 0x1c]
mov ebp, 0x10
mov eax, dword [0x488ed4]
mov ecx, 8
mov esi, eax
mov edi, 0x48f290
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00412430
mov ecx, dword [0x488ed0]
mov edx, dword [0x488ed4]
push 0x20
push ecx
push edx
call fcn.00412540
mov edi, dword [0x488ed0]
add esp, 0x14
mov ecx, 8
mov esi, 0x48f290
add ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x4122cf
jmp 0x412374
mov eax, dword [esp + 0x1c]
mov ebp, 0x10
lea ebx, [eax + 0x2d0]
mov eax, dword [0x488ed0]
mov ecx, 8
mov esi, eax
mov edi, 0x48f290
push ebx
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00412430
mov ecx, dword [0x488ed4]
mov edx, dword [0x488ed0]
push 0x20
push ecx
push edx
call fcn.00412540
mov edi, dword [0x488ed4]
add esp, 0x14
mov ecx, 8
mov esi, 0x48f290
sub ebx, 0x30
dec ebp
rep movsd dword es:[edi], dword [esi]
jne 0x41232a
push 0x40
push 0x470f30
push 0x48f2b0
push 0x48f2b0
call fcn.004124f0
mov eax, dword [esp + 0x24]
push 0x40
push 0x48f2b0
push eax
call fcn.00412610
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4123b0
Capabilities:
Encrypt data using des

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0x40
push eax
push 0x48f250
call fcn.004125d0
push 0x38
push str.91__
push 0x48f250
push 0x48f250
call fcn.004124f0
mov edi, dword [esp + 0x28]
add esp, 0x1c
xor esi, esi
movsx ecx, byte [esi + 0x471028]
mov edx, dword [0x488ed8]
push ecx
push 0x1c
push edx
call fcn.00412570
movsx eax, byte [esi + 0x471028]
mov ecx, dword [0x488edc]
push eax
push 0x1c
push ecx
call fcn.00412570
push 0x30
push 0x470ff8
push 0x48f250
push edi
call fcn.004124f0
add esp, 0x28
inc esi
add edi, 0x30
cmp esi, 0x10
jl 0x4123e2
pop edi
pop esi
ret

Function at 0x412430
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x30
push 0x470f70
push esi
push 0x48f220
call fcn.004124f0
mov eax, dword [esp + 0x1c]
push 0x30
push eax
push 0x48f220
call fcn.00412540
push 0x48f220
push esi
call fcn.00412480
push 0x20
push 0x470fa0
push esi
push esi
call fcn.004124f0
add esp, 0x34
pop esi
ret

Function at 0x412540
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x412562
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x412554
pop ebx
pop esi
ret
Function at 0x415f10
Capabilities:
Enumerate process modules
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x46b731
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x358
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push edi
mov dword [esp + 0x24], 0x128
call sub.KERNEL32.dll_Process32First
mov esi, dword [esp + 0x378]
or ebp, 0xffffffff
test eax, eax
je 0x415feb
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x18]
call fcn.0045b618
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
push eax
push edx
call fcn.0043e755
add esp, 8
test eax, eax
je 0x415fc2
lea ecx, [esp + 0x14]
mov dword [esp + 0x370], ebp
call fcn.0045b5aa
lea eax, [esp + 0x1c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x415fe4
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x18]
call fcn.0045b618
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
push eax
push edx
call fcn.0043e755
add esp, 8
test eax, eax
jne 0x415f81
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x14]
mov dword [esp + 0x370], ebp
call fcn.0045b5aa
mov eax, esi
jmp 0x416139
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x144]
push eax
push edi
mov dword [esp + 0x14c], 0x224
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x416137
lea ecx, [esp + 0x264]
push ecx
lea ecx, [esp + 0x14]
call fcn.0045b618
mov edx, dword [esi]
mov ebx, 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x370], ebx
mov eax, dword [edx - 8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004593cf
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x374], 2
call fcn.0045b6e3
lea ecx, [esp + 0x18]
mov byte [esp + 0x370], bl
call fcn.0045b5aa
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.0043e755
add esp, 8
test eax, eax
je 0x41610e
lea ecx, [esp + 0x10]
mov dword [esp + 0x370], ebp
call fcn.0045b5aa
lea edx, [esp + 0x144]
push edx
push edi
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x416130
lea eax, [esp + 0x264]
lea ecx, [esp + 0x10]
push eax
call fcn.0045b618
mov ecx, dword [esi]
lea edx, [esp + 0x18]
mov dword [esp + 0x370], ebx
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x10]
push eax
push edx
call fcn.004593cf
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x374], 2
call fcn.0045b6e3
lea ecx, [esp + 0x18]
mov byte [esp + 0x370], bl
call fcn.0045b5aa
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0043e755
add esp, 8
test eax, eax
jne 0x416082
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x14c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x370], ebp
call fcn.0045b5aa
mov eax, esi
jmp 0x416139
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [esp + 0x368]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x364
ret
Function at 0x419d50
Capabilities:
Get file version info

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46c03d
push eax
mov eax, 0x2014
mov dword fs:[0], esp
call fcn.0043e5d0
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov al, byte [0x48edd8]
mov ecx, 0x7ff
mov byte [esp + 0x20], al
xor eax, eax
lea edi, [esp + 0x21]
mov ebx, 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2028], ebx
push ecx
lea ecx, [esp + 0x2038]
stosb byte es:[edi], al
call fcn.0045baa4
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
lea ecx, [esp + 0x2034]
mov esi, eax
call fcn.0045bab6
test esi, esi
jne 0x419de4
mov esi, dword [esp + 0x2030]
push 0x48edd8
mov ecx, esi
call fcn.0045b618
mov dword [esp + 0x10], ebx
jmp 0x419e9f
mov edx, dword [0x48a8c4]
mov dword [esp + 0xc], edx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2034]
push eax
push esi
push 0
mov byte [esp + 0x2034], 2
call fcn.0045baa4
push eax
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x2034]
mov esi, eax
call fcn.0045bab6
test esi, esi
je 0x419e78
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x28]
push 0x48855c
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x419e78
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, dword [eax + 8]
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
lea eax, [esp + 0x14]
push str._d._d
push eax
call fcn.0045986b
mov esi, dword [esp + 0x2040]
add esp, 0x10
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0045b31f
jmp 0x419e8b
mov esi, dword [esp + 0x2030]
push 0x48edd8
mov ecx, esi
call fcn.0045b618
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x2028], bl
call fcn.0045b5aa
lea ecx, [esp + 0x2034]
mov byte [esp + 0x2028], 0
call fcn.0045b5aa
mov ecx, dword [esp + 0x2020]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2020
ret
Function at 0x41c500
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c6c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x48a8c4]
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 2
call fcn.0045bb06
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.0045b31f
lea ecx, [esp + 0x18]
push ecx
call fcn.0041c630
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 3
call fcn.0045b6e3
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call fcn.0045b5aa
mov edi, dword [esp + 0x28]
xor esi, esi
mov eax, dword [edi + 0xc]
cmp eax, ebp
jle 0x41c5ea
push esi
mov ecx, edi
call fcn.0045a698
add eax, 8
lea ecx, [esp + 0xc]
push eax
call fcn.0045b6e3
push 0x3a
lea ecx, [esp + 0x10]
call fcn.0045bacb
test eax, eax
jle 0x41c5c0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
push edx
push eax
call fcn.0043e755
add esp, 8
test eax, eax
je 0x41c5e5
jmp 0x41c5db
lea ecx, [esp + 0xc]
call fcn.0045bb06
mov ecx, dword [esp + 0xc]
push ecx
lea ecx, [esp + 0x14]
call fcn.004594e5
test eax, eax
jge 0x41c5e5
mov eax, dword [edi + 0xc]
inc esi
cmp esi, eax
jl 0x41c584
jmp 0x41c5ea
mov ebp, 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call fcn.0045b5aa
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 0
call fcn.0045b5aa
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call fcn.0045b5aa
mov ecx, dword [esp + 0x18]
pop edi
mov eax, ebp
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x18
ret
Function at 0x41c9a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46c79f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], 1
mov eax, dword [0x48a8c4]
mov dword [esp + 0xc], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 3
call fcn.0045b535
lea ecx, [esp + 0x30]
call fcn.00459985
lea ecx, [esp + 0x30]
call fcn.004598d1
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x18]
mov edi, dword [ecx - 8]
push 0x489b74
push eax
call fcn.0045b8b3
push 0x488cd4
lea ecx, [esp + 0x14]
mov bl, 4
push eax
push ecx
mov byte [esp + 0x30], bl
call fcn.0045b83f
mov eax, dword [eax]
lea ecx, [esp + 0x30]
push eax
mov byte [esp + 0x28], 5
call fcn.004594e5
lea ecx, [esp + 0x10]
mov esi, eax
mov byte [esp + 0x24], bl
call fcn.0045b5aa
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 3
call fcn.0045b5aa
test esi, esi
jle 0x41ca5d
lea esi, [esi + edi + 3]
jmp 0x41ca91
lea edx, [esp + 0x14]
push edi
push edx
lea ecx, [esp + 0x38]
call fcn.0045944b
mov ecx, dword [esp + 0x34]
mov eax, dword [eax]
push ecx
push eax
call fcn.0043e4c5
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
sete bl
call fcn.0045b5aa
test bl, bl
je 0x41ca91
lea esi, [edi + 1]
test esi, esi
jle 0x41cb00
push esi
push 0x489b74
lea ecx, [esp + 0x38]
call fcn.004594f3
test eax, eax
jle 0x41cad4
sub eax, esi
lea edx, [esp + 0x14]
push eax
push esi
push edx
lea ecx, [esp + 0x3c]
call fcn.00459339
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 6
call fcn.0045b6e3
mov byte [esp + 0x24], 3
lea ecx, [esp + 0x14]
jmp 0x41cafb
lea eax, [esp + 0x14]
push esi
push eax
lea ecx, [esp + 0x38]
call fcn.00459316
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 7
call fcn.0045b6e3
mov byte [esp + 0x24], 3
lea ecx, [esp + 0x14]
call fcn.0045b5aa
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0045b31f
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call fcn.0045b5aa
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 1
call fcn.0045b5aa
lea ecx, [esp + 0x34]
mov byte [esp + 0x24], 0
call fcn.0045b5aa
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
Function at 0x41cfe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46c87f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
push ecx
lea eax, [esp + 0x40]
mov edi, esp
mov dword [esp + 0xc], esp
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov dword [esp + 0x34], 3
call fcn.0045b31f
push ecx
lea edx, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x38], 4
call fcn.0045b31f
push ecx
lea eax, [esp + 0x48]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
mov byte [esp + 0x3c], 5
call fcn.0045b31f
mov ecx, dword [esp + 0x44]
push edi
mov byte [esp + 0x3c], 3
call fcn.0040d8e0
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.0041d3e0
lea ecx, [esp + 8]
mov byte [esp + 0x24], 6
call fcn.00459985
lea ecx, [esp + 8]
call fcn.004598d1
lea edx, [esp + 0x38]
push 0x488cd4
lea eax, [esp + 0x34]
push edx
push eax
call fcn.0045b83f
push ecx
lea edx, [esp + 0xc]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
push eax
push ecx
mov byte [esp + 0x34], 7
call fcn.0045b7d9
mov ecx, esi
call fcn.0041d780
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 6
call fcn.0045b5aa
mov esi, dword [esp + 0x2c]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.0045b31f
mov dword [esp + 0xc], 1
lea ecx, [esp + 8]
mov byte [esp + 0x24], 3
call fcn.0045b5aa
mov byte [esp + 0x24], 2
lea ecx, [esp + 0x34]
call fcn.0045b5aa
lea ecx, [esp + 0x38]
mov byte [esp + 0x24], 1
call fcn.0045b5aa
lea ecx, [esp + 0x3c]
mov byte [esp + 0x24], 0
call fcn.0045b5aa
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0x14
Function at 0x420550
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x46cdd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebp
lea ecx, [esp + 0xc]
call fcn.004361f6
mov ebp, dword [esp + 0x448]
lea eax, [esp + 0x230]
push ebp
push str._s.
push eax
mov dword [esp + 0x44c], 0
call fcn.0043e574
add esp, 0xc
lea ecx, [esp + 0x230]
push 0
push ecx
lea ecx, [esp + 0x14]
call fcn.004362b9
test eax, eax
je 0x420695
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.004364d9
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], eax
call fcn.004364a0
test eax, eax
jne 0x420687
lea edx, [esp + 0x10]
lea ecx, [esp + 0x14]
push edx
call fcn.004366d1
push 0x104
mov ecx, eax
mov byte [esp + 0x44c], 1
call fcn.0045b9da
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x448], 0
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
call fcn.0045b5aa
mov edx, dword [esp + 0x14]
push 0x10
lea ecx, [esp + 0x18]
call dword [edx + 0x38]
test eax, eax
lea eax, [esp + 0x30]
push eax
push ebp
push str._s_s
je 0x420669
lea ecx, [esp + 0x140]
push ecx
call fcn.0043e574
lea edx, [esp + 0x144]
push edx
call fcn.00420550
add esp, 0x14
jmp 0x420687
lea ecx, [esp + 0x348]
push ecx
call fcn.0043e574
add esp, 0x10
lea edx, [esp + 0x33c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4205ba
pop edi
pop esi
lea ecx, [esp + 0xc]
call fcn.0043626f
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
pop ebp
mov dword [esp + 0x43c], 0xffffffff
lea ecx, [esp + 8]
jne 0x4206d5
call fcn.00436233
xor eax, eax
mov ecx, dword [esp + 0x434]
mov dword fs:[0], ecx
add esp, 0x440
ret
call fcn.00436233
mov ecx, dword [esp + 0x434]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x440
ret
Function at 0x421910
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
push ebx
call fcn.00421a80
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
add esp, 4
mov edi, eax
push ebx
push 1
push 0x1f0fff
call ebp
test edi, edi
mov esi, eax
push 0
jne 0x42194b
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
jmp 0x42195c
push 0
push 0x12
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateProcess]
test esi, esi
je 0x421a24
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4219c7
push 0
push esi
call edi
test eax, eax
jne 0x4219c7
push ebx
push 1
push 0x1f0fff
call ebp
mov esi, eax
test esi, esi
je 0x4219db
mov eax, dword [0x492128]
test eax, eax
je 0x42199c
mov eax, dword [eax + 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x489dc4
call fcn.0045b618
mov eax, dword [0x492128]
mov ecx, dword [eax + 0x828]
call fcn.0041d950
push 0
push esi
call edi
test eax, eax
je 0x421980
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x489d9c
call fcn.0045b618
mov esi, dword [esp + 0x14]
mov ecx, esi
call fcn.00424a80
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x421a07
xor eax, eax
jmp 0x421a0a
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0x47c
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x421a30
xor eax, eax
jmp 0x421a33
mov eax, dword [esi + 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x489d7c
call fcn.0045b618
mov ecx, dword [0x492128]
mov ecx, dword [ecx + 0x828]
call fcn.0041d8a0
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x489d9c
call fcn.0045b618
mov ecx, esi
call fcn.00424a80
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x421a80
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
lea ecx, [esp]
push ecx
push 0x421ac0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [esp + 4]
neg eax
sbb eax, eax
and eax, ecx
add esp, 8
ret
Function at 0x421b30
Capabilities:
Capture screenshot

Disassembly:
push 0xffffffffffffffff
push 0x46cfa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x48a8c4]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
mov eax, dword [edx + 0x1c]
mov dword [esp + 0x30], esi
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0x14]
push ecx
mov ecx, edi
call fcn.00462882
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
sub ebp, edx
sub ebx, ecx
cmp edi, esi
mov dword [esp + 0x38], ebx
jne 0x421ba0
mov dword [esp + 0x34], esi
jmp 0x421ba7
mov edx, dword [edi + 0x1c]
mov dword [esp + 0x34], edx
mov eax, dword [edi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.004622f2
cmp eax, esi
je 0x421bbe
mov esi, dword [eax + 4]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
push ebp
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
push 0xcc0020
push ecx
push edx
push esi
push eax
push ebp
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x3c]
push 0
push ebx
mov ecx, dword [ecx]
call fcn.00435790
mov edx, dword [esp + 0x34]
push esi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0045b5aa
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret