joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bd6a
Capabilities:
Set registry value

Disassembly:
mov eax, 0x46bd80
call fcn.0045b030
sub esp, 0xc
push ebx
push esi
mov esi, ecx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40bda7
push 0xc414
lea ecx, [ebp - 0x10]
call fcn.004028d8
push dword [eax]
and dword [ebp - 4], 0
call fcn.00407385
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x10]
jmp 0x40bdfb
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
pop ebx
cmp eax, ebx
je 0x40bdbb
cmp eax, 2
jne 0x40be02
push 0xc414
lea ecx, [ebp - 0x14]
call fcn.004028d8
mov esi, dword [eax]
push 0xc3ba
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004028d8
mov eax, dword [eax]
push esi
push eax
mov byte [ebp - 4], 2
call fcn.004074d5
pop ecx
mov byte [ebp - 4], bl
pop ecx
lea ecx, [ebp - 0x10]
call fcn.00403037
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00403037
jmp 0x40be70
mov ecx, esi
call fcn.0040b720
cmp eax, ebx
jne 0x40be30
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0x480960
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x40be68
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push 0x480960
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [esi + 4]
call fcn.004084aa
pop ecx
push ebx
push 3
push 0x1411
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov ecx, esi
call fcn.0040b85e
mov ecx, dword [ebp - 0xc]
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10

Function at 0x40c5be
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 5
jne 0x40c5f5
cmp dword [ebp - 0x10c], 2
jne 0x40c5f5
push 1
pop eax
leave
ret
xor eax, eax
leave
ret
Function at 0x40c721
Capabilities:
Create process on windows
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471f80
push 0x45b0b2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x834
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor esi, esi
mov word [ebp - 0x818], si
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push dword [ebp + 8]
push str.__s_
push 0x400
lea eax, [ebp - 0x818]
push eax
call fcn.0040ea7b
add esp, 0x10
push 5
push esi
lea eax, [ebp - 0x818]
push eax
push str.Explorer
push 0x489444
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x40c896
mov dword [ebp - 4], esi
mov dword [ebp - 0x81c], esi
lea eax, [ebp - 0x81c]
push eax
push 0x474598
push 5
push esi
push 0x474588
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40c8a2
mov eax, dword [ebp - 0x81c]
cmp eax, esi
je 0x40c892
mov dword [ebp - 0x830], esi
mov ecx, dword [eax]
lea edx, [ebp - 0x830]
push edx
push eax
call dword [ecx + 0x94]
cmp dword [ebp - 0x830], esi
je 0x40c815
push dword [ebp - 0x830]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 3
push dword [ebp - 0x830]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
test eax, eax
jbe 0x40c886
mov word [ebp - 0x82c], si
mov word [ebp - 0x840], 8
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x82c]
push edx
lea edx, [ebp - 0x840]
push edx
push eax
call dword [ecx + 0xd0]
mov dword [ebp - 0x844], eax
push dword [ebp - 0x838]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x81c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
push 1
pop eax
jmp 0x40c8a8
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c8b7
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0045b070
mov al, byte [0x489aa8]
push edi
mov byte [ebp - 0x2008], al
mov ecx, 0x7ff
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
pop edi
je 0x40c972
cmp eax, 0x1fff
ja 0x40c972
lea ecx, [ebp - 0x2008]
push ecx
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40c972
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2008]
push 0x480a24
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40c972
push esi
mov esi, dword [ebp + 0x10]
push esi
push 0
push dword [ebp + 0xc]
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
movzx ecx, word [eax + 0xc]
push ecx
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
push ecx
movzx ecx, word [eax + 8]
mov eax, dword [eax + 8]
push ecx
shr eax, 0x10
push eax
dec esi
push str._d._d._d._d
push esi
push dword [ebp + 0xc]
call fcn.0040ea54
add esp, 0x1c
push 1
pop eax
pop esi
leave
ret
xor eax, eax
leave
ret

Function at 0x40c976
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2008
call fcn.0045b070
mov al, byte [0x489aa8]
push edi
mov byte [ebp - 0x2008], al
mov ecx, 0x7ff
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
pop edi
je 0x40ca04
cmp eax, 0x1fff
ja 0x40ca04
lea ecx, [ebp - 0x2008]
push ecx
push eax
push 0
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40ca04
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2008]
push 0x480a24
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40ca04
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push 1
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
pop eax
leave
ret
xor eax, eax
leave
ret

Function at 0x40cb11
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov al, byte [0x489aa8]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
push 0x1f
mov byte [ebp - 0x80], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x7f]
push dword [ebx + 8]
rep stosd dword es:[edi], eax
push dword [ebx + 4]
mov ecx, ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040ec14
lea eax, [ebp - 0x80]
push 0x100
push eax
call sub.WS2_32.dll_gethostname
lea eax, [ebp - 0x80]
push eax
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
jne 0x40cb63
xor al, al
jmp 0x40cb85
mov eax, dword [esi + 0xc]
mov eax, dword [eax]
test eax, eax
je 0x40cb83
xor edi, edi
push eax
mov ecx, ebx
call fcn.0044435c
mov eax, dword [esi + 0xc]
add edi, 4
mov eax, dword [edi + eax]
test eax, eax
jne 0x40cb6e
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cc1d
Capabilities:
Get networking parameters

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, 0x248
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push 0x40
call edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
mov dword [ebp - 4], esi
call sub.iphlpapi.dll_GetNetworkParams
cmp eax, 0x6f
jne 0x40cc5c
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
push 0x40
call edi
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
call sub.iphlpapi.dll_GetNetworkParams
test eax, eax
jne 0x40cc94
lea esi, [ebx + 0x10c]
test esi, esi
je 0x40cc94
lea eax, [esi + 4]
push eax
call fcn.0040cb8a
test al, al
pop ecx
jne 0x40cc86
mov esi, dword [esi]
jmp 0x40cc70
mov ecx, dword [ebp + 8]
add esi, 4
push esi
call fcn.0040e91c
jmp 0x40cca1
mov ecx, dword [ebp + 8]
push 0x489444
call fcn.004028d8
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cca9
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
lea eax, [ebp - 0x130]
push esi
push eax
mov dword [ebp - 0x130], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor esi, esi
cmp dword [ebp - 0x120], 2
jne 0x40cd23
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 4]
push ecx
push 0x20
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0xc]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0xc]
push esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x1c]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret
Function at 0x40cd30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x40ce2b
cmp dword [ebp + 0xc], 0
je 0x40ce2b
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x40ce2b
push 4
push 0x480ac4
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x40cd98
cmp ebx, 0x7fffffff
jbe 0x40cd7d
mov eax, 0x80070057
jmp 0x40cd8a
add esi, 8
push esi
push ebx
push dword [ebp + 0xc]
call fcn.0040eadd
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
jmp 0x40ce2d
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
push 0xc
push str._systemroot_
push esi
call edi
test eax, eax
jne 0x40cdf6
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40ce2b
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test eax, eax
je 0x40ce2b
add esi, 0x18
lea eax, [ebp - 0x208]
push esi
push eax
push str._s_s
push ebx
push dword [ebp + 0xc]
call fcn.0040ea7b
add esp, 0x14
neg eax
sbb eax, eax
inc eax
jmp 0x40ce2d
push 9
push str.system32_
push esi
call edi
test eax, eax
jne 0x40ce2b
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40ce2b
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
test eax, eax
jne 0x40cdd6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40ce32
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0x24
lea eax, [ebp - 0x24]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.GetNativeSystemInfo
push 0x480ad0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ce6b
lea ecx, [ebp - 0x24]
push ecx
call eax
jmp 0x40ce75
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x24], 9
je 0x40ce87
cmp word [ebp - 0x24], 6
je 0x40ce87
xor eax, eax
leave
ret
push 1
pop eax
leave
ret
Function at 0x40e2ca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
cmp eax, ecx
je 0x40e300
lea edx, [ebp - 4]
push 0
sub eax, ecx
push edx
push eax
push ecx
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e305
mov eax, dword [esi]
mov ecx, dword [esi + 4]
sub ecx, eax
cmp dword [ebp - 4], ecx
jne 0x40e305
mov dword [esi + 4], eax
push 1
pop eax
jmp 0x40e30c
mov eax, dword [esi]
mov dword [esi + 4], eax
xor eax, eax
pop esi
leave
ret

Function at 0x40e449
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x1c]
call fcn.0044288f
push str.iphlpapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateIpNetEntry
push eax
mov dword [esi], eax
call edi
push str.SendARP
mov dword [esi + 4], eax
push dword [esi]
call edi
push str.EnableRouter
mov dword [esi + 8], eax
push dword [esi]
call edi
push str.UnenableRouter
mov dword [esi + 0xc], eax
push dword [esi]
call edi
push str.GetAdaptersInfo
mov dword [esi + 0x10], eax
push dword [esi]
call edi
and dword [esi + 0x4c], 0
or dword [esi + 0x48], 0xffffffff
or dword [esi + 0x18], 0xffffffff
mov dword [esi + 0x14], eax
mov eax, esi
pop edi
pop esi
ret

Function at 0x40e4e8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
push ebx
push esi
mov esi, 0x114
lea eax, [ebp - 0x11c]
push esi
push 0
mov ebx, ecx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x118], 8
jb 0x40e52f
push 1
jmp 0x40e5f0
mov ax, word [0x489444]
push edi
mov word [ebp - 0x324], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x322]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 4]
push eax
push str.Test
push str.SYSTEMCurrentControlSetServicesPacketParameters
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
pop edi
jne 0x40e5aa
push str.Hello
call sub.MSVCRT.dll_strlen
shl eax, 1
push eax
lea eax, [ebp - 0x324]
push 0x480ebc
push eax
call sub.MSVCRT.dll_memcmp
add esp, 0x10
test eax, eax
je 0x40e5bd
call fcn.00442830
mov ecx, ebx
call fcn.0040e733
mov ecx, ebx
call fcn.0040e5f5
call fcn.004427a7
test eax, eax
jne 0x40e5ee
mov ecx, ebx
call fcn.0040e5f5
call fcn.004427a7
xor esi, esi
call fcn.004427a7
test eax, eax
jne 0x40e5ee
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x40e5d4
push 3
pop eax
pop esi
pop ebx
leave
ret
Function at 0x40e5f5
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x46c074
call fcn.0045b030
sub esp, 0x474
mov eax, dword [0x4802e0]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x480]
xor ebx, ebx
push 0x104
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str..._antiarp
lea ecx, [ebp - 0x14]
call fcn.00403305
lea eax, [ebp - 0x18]
push ebx
push eax
mov byte [ebp - 4], 1
call fcn.00406112
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.00408184
mov eax, dword [eax]
cmp eax, ebx
je 0x40e661
mov eax, dword [eax]
jmp 0x40e663
xor eax, eax
push eax
lea eax, [ebp - 0x278]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x40e680
call fcn.004033a0
mov dword [ebp - 0x1c], ebx
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x40e68f
call fcn.004033a0
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x40e6a1
call fcn.004033a0
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x10]
push str.__s_snetcfg.exe___v__l___spacket.inf___c_p__i_ms_packet
push eax
call fcn.00402b82
add esp, 0x10
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 1
lea ecx, [ebp - 0x2c]
pop eax
mov word [ebp - 0x40], bx
push ecx
lea ecx, [ebp - 0x70]
push ecx
push ebx
push ebx
push 0x20
push eax
push ebx
push ebx
mov dword [ebp - 0x44], eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, ebx
mov edi, 0x3e8
je 0x40e715
push 0xffffffffffffffff
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e718
push edi
call esi
push edi
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403037
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40e733
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x46c088
call fcn.0045b030
sub esp, 0x260
mov eax, dword [0x4802e0]
push esi
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x26c]
xor esi, esi
push 0x104
push eax
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x10]
push str.__s_snetcfg.exe___v__u_ms_packet
push eax
call fcn.00402b82
add esp, 0xc
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 1
lea ecx, [ebp - 0x20]
pop eax
mov word [ebp - 0x34], si
push ecx
lea ecx, [ebp - 0x64]
push ecx
push esi
push esi
push 0x20
push eax
push esi
push esi
mov dword [ebp - 0x38], eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
pop esi
je 0x40e7ce
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e7ce
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00403037
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x40e7e6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
je 0x40e82e
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp eax, esi
je 0x40e82e
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push 0x40e832
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x40e82e
cmp dword [ebp + 0xc], esi
je 0x40e827
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
ret
Function at 0x410fa7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
add ecx, 0xffffffe4
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], 1
neg esi
sbb esi, esi
and esi, ecx
cmp dword [ebp + 0x14], 0
je 0x411031
push ebx
push dword [ebp + 8]
push dword [esi + 4]
call edi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ecx, dword [ebp + 0xc]
or dword [ebp + 0x14], 0xffffffff
mov ebx, eax
push ebx
call fcn.00402f9c
test eax, eax
mov eax, dword [ebp + 0xc]
je 0x411025
mov ecx, dword [eax]
mov dword [ecx - 8], ebx
mov ecx, dword [eax]
and word [ecx + ebx*2], 0
mov ecx, dword [eax]
test ecx, ecx
je 0x411025
lea eax, [ebx + 1]
push eax
push ecx
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
mov dword [ebp + 0x14], eax
call fcn.0040300e
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x14], ebx
pop ebx
jge 0x411070
and dword [ebp - 4], 0
jmp 0x411049
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
test eax, eax
mov dword [ebp - 4], eax
jne 0x4110a9
push 0xffffffffffffffff
add esi, 0x1c
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebp + 8]
mov eax, esi
add esi, 0xffffffe4
neg eax
sbb eax, eax
and eax, esi
push dword [eax + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4110a9
cmp dword [ebp + 0x18], 0
je 0x4110a9
mov eax, dword [eax]
mov eax, dword [eax - 8]
cmp eax, dword [ebp + 0x1c]
jle 0x4110a9
push 0xffffffffffffffff
add esi, 0x1c
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebp + 8]
mov eax, esi
add esi, 0xffffffe4
neg eax
sbb eax, eax
and eax, esi
push dword [eax + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 0x18

Function at 0x411f88
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
mov eax, dword [esi]
test eax, eax
je 0x411fa3
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
and dword [esi], 0
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jne 0x411fb6
push 0x489444
jmp 0x411fdc
lea edi, [eax + 1]
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0045b070
mov dword [ebp + 8], esp
push edi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x411fed
push dword [ebp + 8]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor ecx, ecx
mov dword [esi], eax
test eax, eax
setne cl
mov eax, ecx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4129ab
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov esi, ecx
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x4129d5
push 1
push 0
push 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4129d9
xor eax, eax
jmp 0x4129e2
xor ecx, ecx
cmp edi, eax
sete cl
mov eax, ecx
pop edi
pop esi
ret

Function at 0x412a6d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
mov edi, dword [esi + 8]
sub edi, eax
je 0x412a8b
push edi
push eax
push dword [esi]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [esi]
lea ecx, [ebp - 4]
push 0
push ecx
mov ecx, 0x1000
and dword [ebp - 4], 0
mov dword [esi + 4], eax
sub ecx, edi
add eax, edi
push ecx
push eax
mov dword [esi + 8], eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov eax, dword [ebp - 4]
je 0x412ac7
test eax, eax
je 0x412ac7
add dword [esi + 8], eax
cmp eax, dword [ebp + 8]
sbb eax, eax
inc eax
jmp 0x412acc
add dword [esi + 8], eax
xor eax, eax
pop edi
pop esi
leave
ret 4