joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40248c
Capabilities:
Encode data using base64
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
lea ecx, [ebp - 0x208]
push esi
call fcn.004022a9
lea eax, [ebp - 0x208]
mov dword [0x43b4e0], 1
push eax
push 4
push 0x43b4e0
mov edx, str.Config
call fcn.004021e7
lea eax, [ebp - 0x208]
mov edx, str.Column2
push eax
push 8
push 0x439370
call fcn.004021e7
add esp, 0x18
lea eax, [ebp - 0x208]
push eax
push 0x190
lea eax, [ebp - 0x528]
push eax
push 0x42b370
push str.Column
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, eax
test esi, esi
je 0x4025b1
shr esi, 3
push 0x29
pop eax
cmp esi, eax
cmova esi, eax
test esi, esi
jle 0x4025b1
mov eax, esi
shl eax, 2
push edi
push eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x4025b0
mov edx, esi
lea ecx, [ebp - 0x528]
push edi
shl edx, 3
call fcn.00402197
pop ecx
xor ecx, ecx
mov eax, ecx
and dword [eax + 0x439380], 0xffffefff
add eax, 4
cmp eax, 0xa4
jb 0x40254d
test esi, esi
jle 0x4025a8
mov edx, dword [edi + ecx*4]
mov eax, edx
and eax, 0x3f
cmp eax, 0x3c
jne 0x402579
mov eax, 0x439380
jmp 0x4025a1
cmp eax, 0x3d
jne 0x402585
mov eax, 0x439384
jmp 0x4025a1
cmp eax, 0x3e
jne 0x402591
mov eax, 0x439388
jmp 0x4025a1
cmp eax, 0x26
jae 0x4025a3
lea eax, [eax*4 + 0x43938c]
test eax, eax
je 0x4025a3
mov dword [eax], edx
inc ecx
cmp ecx, esi
jl 0x402565
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
pop edi
lea eax, [ebp - 0x208]
mov edx, str.WinPos
push eax
push 0x14
push 0x43b4e4
call fcn.004021e7
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402cc5
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x45c
lea edx, [esp]
sub edx, ecx
push ebx
push ebp
push esi
push edi
push 2
pop ebp
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, ebp
test ax, ax
jne 0x402cd7
lea ecx, [esp + 0x10]
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebp
cmp ax, bx
jne 0x402cee
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
push 0x2a
lea esi, [esp + ecx*2 + 0x12]
add esi, ebp
mov word [esi], ax
add esi, ebp
pop eax
mov word [esi], ax
xor eax, eax
mov word [esi + 2], ax
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x402d78
test byte [esp + 0x218], 0x10
jne 0x402d5e
lea ecx, [esp + 0x244]
mov edx, esi
mov eax, ecx
sub edx, eax
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, ebp
test ax, ax
jne 0x402d47
lea ecx, [esp + 0x10]
call fcn.0040276c
lea eax, [esp + 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402d30
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0x1004
push dword [0x43b568]
call esi
test eax, eax
jle 0x402da1
push ebx
dec eax
push eax
push 0x1013
push dword [0x43b568]
call esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x45c
ret

Function at 0x402dac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402dcf
test al, 0x10
je 0x402dcf
mov ecx, esi
call fcn.00402cc5
jmp 0x402dd6
mov ecx, esi
call fcn.0040276c
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40336a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
push 0
mov edi, edx
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4033c7
push esi
push edi
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4033be
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x4033ca
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403441
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x4033e0
sub edx, ecx
sar edx, 1
push ebx
lea ebx, [edx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x403438
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
ret

Function at 0x403479
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
push edi
push 0x54
xor edi, edi
lea eax, [ebp - 0x5c]
push edi
push eax
mov esi, ecx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x5c], esi
mov word [0x439ca0], ax
add esp, 0xc
mov eax, 0x439ca0
mov dword [ebp - 0x60], 0x58
mov dword [ebp - 0x44], eax
xor esi, esi
mov dword [ebp - 0x34], eax
inc esi
lea eax, [ebp - 0x60]
mov dword [ebp - 0x40], 0x400
push eax
mov dword [ebp - 0x54], 0x42b514
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], 0x880201
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
cmp eax, esi
jne 0x403516
push 0x1c
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [eax], esi
mov ecx, dword [ebp - 0x44]
mov dword [eax + 0x10], ecx
movzx ecx, word [ebp - 0x28]
mov dword [eax + 0x14], ecx
lea ecx, [ebp - 4]
push ecx
push edi
push eax
push 0x402ddb
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x403516
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40357d
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x26c
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov esi, ecx
push ebp
push ebp
push 0x1004
push dword [0x43b568]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x403706
push 0x54
lea eax, [esp + 0x20]
push ebp
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
mov word [esp + 0x70], ax
lea eax, [esp + 0x72]
push 0x206
push ebp
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esp + 0x18], 0x58
lea eax, [esp + 0x70]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x38], 0x104
push eax
mov dword [esp + 0x28], str.Text_Files_.txt_
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x58], str.html
mov dword [esp + 0x50], 0x880001
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x403706
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x403657
push 0x24
push str.Confirm_Save_As
push str.File_already_exists__do_you_want_to_replace_it_
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x403706
push ebp
push 0x80
push 2
push ebp
push 2
push 0x40000000
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403706
lea eax, [esp + 0x70]
mov edi, ebp
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4036ce
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esi, 2
push 0x42b6c8
push esi
call ebp
test eax, eax
jne 0x4036b1
xor edi, edi
inc edi
jmp 0x4036cc
push str.html
push esi
call ebp
test eax, eax
je 0x4036c9
push 0x42b6d0
push esi
call ebp
test eax, eax
jne 0x4036cc
push 2
pop edi
xor ebp, ebp
lea eax, [esp + 0x10]
xor edx, edx
push edi
push eax
call fcn.00402f52
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4036ff
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push ebp
push eax
dec ecx
push ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret
Function at 0x403748
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_MonitorFromRect]
mov ebx, edx
push edi
push 0
push ebx
mov ebp, ecx
call esi
test eax, eax
jne 0x403808
push 9
pop ecx
push 1
mov dword [esp + 0x1c], 0x28
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
push ebx
call esi
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
sub ecx, esi
mov edi, dword [esp + 0x28]
sub edi, dword [esp + 0x20]
mov eax, dword [0x43b588]
cmp ecx, eax
jge 0x4037ce
mov eax, ecx
mov dword [esp + 0x14], 0xa
shl eax, 3
cdq
idiv dword [esp + 0x14]
mov dword [0x43b588], eax
mov eax, edi
shl eax, 3
cdq
idiv dword [esp + 0x14]
mov dword [0x43b58c], eax
mov eax, dword [0x43b588]
sub edi, dword [0x43b58c]
sub ecx, eax
mov eax, ecx
mov ecx, dword [esp + 0x20]
cdq
add ecx, 0xffffffe2
sub eax, edx
sar eax, 1
add esi, eax
mov eax, edi
cdq
sub eax, edx
mov dword [ebx], esi
sar eax, 1
add ecx, eax
mov eax, dword [0x43b588]
add eax, esi
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
mov eax, dword [0x43b58c]
add eax, ecx
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
push 0
push eax
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
push eax
push dword [ebx + 4]
push dword [ebx]
push ebp
call dword [sym.imp.USER32.dll_MoveWindow]
push dword [0x43b4f4]
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x403892
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x130
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea edi, [esp + 0x18]
push 0xa
xor eax, eax
xor esi, esi
test byte [0x43b4e0], 1
pop ecx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x14], 0x2e
mov dword [esp + 0x20], eax
je 0x4038da
lea eax, [esp + 0x10]
mov dword [esp + 0x10], esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_Shell_GetImageLists]
mov eax, dword [esp + 0x10]
jmp 0x4038dc
mov eax, esi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 1
push 0x1003
push ebp
call ebx
push esi
push esi
push 0x1200
push esi
push esi
push 0x101f
push ebp
call ebx
push eax
call ebx
mov edi, eax
jmp 0x40390e
push edi
push 0x101c
push ebp
call ebx
dec edi
push esi
jns 0x403905
mov eax, dword [0x43b4e0]
not eax
and eax, 1
push eax
push 0x109d
push ebp
call ebx
test byte [0x43b4e0], 1
je 0x40398d
mov ecx, dword [esi*4 + 0x439380]
test ecx, 0x1000
je 0x403985
push 0x80
and ecx, 0x3f
lea edx, [esp + 0x44]
call fcn.00403838
pop ecx
mov ecx, dword [esi*4 + 0x439380]
mov eax, ecx
shr eax, 0xd
and eax, 0x1ffff
mov dword [esp + 0x1c], eax
mov eax, ecx
and eax, 0x3f
shr ecx, 6
mov dword [esp + 0x28], eax
and ecx, 0x3f
lea eax, [esp + 0x14]
mov dword [esp + 0x30], ecx
push eax
push esi
push 0x1061
push ebp
call ebx
inc esi
cmp esi, 0x29
jb 0x40392e
jmp 0x4039f1
test byte [esi*4 + 0x439370], 0x3f
lea eax, [esp + 0x40]
push 0x80
push eax
push 0
pop eax
setne al
add eax, 4
push eax
push dword [0x43b4c4]
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi*4 + 0x439370]
mov eax, ecx
shr eax, 0xd
and eax, 0x1ffff
mov dword [esp + 0x1c], eax
mov eax, ecx
and eax, 0x3f
shr ecx, 6
mov dword [esp + 0x28], eax
and ecx, 0x3f
lea eax, [esp + 0x14]
mov dword [esp + 0x30], ecx
push eax
push esi
push 0x1061
push ebp
call ebx
inc esi
cmp esi, 2
jb 0x40398d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret
Function at 0x4039fc
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x42c
push ebx
mov ebx, ecx
lea ecx, [esp + 0x228]
push ebp
push esi
mov dword [esp + 0x10], ebx
call fcn.004022a9
push 9
pop ebp
lea eax, [esp + 0x230]
push eax
push 0x100
lea eax, [esp + 0x38]
push eax
push 0x42b370
push str.Font
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor esi, esi
test eax, eax
je 0x403b73
push edi
xor eax, eax
mov dword [esp + 0x1c], esi
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x34]
mov edi, esi
mov dword [esp + edi*4 + 0x1c], eax
inc edi
cmp edi, 6
jae 0x403a86
push 0x2c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x403a86
xor ecx, ecx
mov word [eax], cx
add eax, 2
test eax, eax
jne 0x403a61
xor eax, eax
inc eax
cmp edi, eax
jle 0x403b72
mov ecx, dword [esp + 0x1c]
mov edx, 0x43b51c
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x403a9c
push dword [esp + 0x20]
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 2
pop ebx
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp edi, ebx
jle 0x403b6e
mov cl, byte [0x43b514]
mov dword [esp + 0x10], ecx
mov edx, dword [esp + ebx*4 + 0x1c]
mov ecx, str.bold
mov eax, edx
mov bp, word [eax]
cmp bp, word [ecx]
jne 0x403b05
test bp, bp
je 0x403afe
mov bp, word [eax + 2]
cmp bp, word [ecx + 2]
jne 0x403b05
add eax, 4
add ecx, 4
test bp, bp
jne 0x403adc
xor ebp, ebp
mov eax, esi
inc ebp
jmp 0x403b0c
sbb eax, eax
xor ebp, ebp
inc ebp
or eax, ebp
test eax, eax
jne 0x403b1c
mov dword [0x43b510], 0x2bc
jmp 0x403b61
mov eax, str.italic
mov cx, word [edx]
cmp cx, word [eax]
jne 0x403b47
test cx, cx
je 0x403b43
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x403b47
add edx, 4
add eax, 4
test cx, cx
jne 0x403b21
mov eax, esi
jmp 0x403b4b
sbb eax, eax
or eax, ebp
mov ecx, dword [esp + 0x10]
test eax, eax
movzx ecx, cl
cmove ecx, ebp
mov dword [esp + 0x10], ecx
mov byte [0x43b514], cl
inc ebx
cmp ebx, edi
jl 0x403ad1
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
pop edi
cmp word [0x43b51c], si
jne 0x403b92
movzx eax, word [esi + str.Consolas]
lea esi, [esi + 2]
mov word [esi + 0x43b51a], ax
test ax, ax
jne 0x403b7c
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0x48
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_MulDiv]
push esi
neg eax
push ebx
mov dword [0x43b500], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0x43b500
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
pop esi
pop ebp
pop ebx
add esp, 0x42c
ret
Function at 0x4042e0
Capabilities:
Hide graphical window

Disassembly:
push esi
push dword [0x43b56c]
mov esi, ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x404303
push 0
push dword [0x43b56c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
test esi, esi
je 0x404321
push 5
push dword [0x43b56c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x43b56c]
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
ret

Function at 0x404ccd
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x404d1d
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
je 0x404d1d
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x40000000
push 0x437400
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove eax, ecx
test eax, eax
mov dword [0x43b4c0], eax
setne cl
jmp 0x404d21
xor ebx, ebx
mov ecx, ebx
xor edi, edi
inc edi
test ecx, ecx
je 0x404d6f
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x404d6f
cmp dword [esp + 0xc], edi
je 0x404d6f
call fcn.0040248c
call fcn.00416f05
cmp dword [esp + 0xc], edi
jle 0x404d65
mov ecx, dword [esi + edi*4]
call fcn.00402dac
inc edi
cmp edi, dword [esp + 0xc]
jl 0x404d56
call fcn.00404e1a
jmp 0x404e0f
mov esi, dword [esp + 0x34]
lea eax, [esp + 0xc]
push ebp
push eax
mov dword [0x43b4c4], esi
mov dword [esp + 0x14], 8
mov dword [esp + 0x18], 0x8000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.00416f05
push 0xd
push 0x439320
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
push ebx
push 0x4047e9
push ebx
push edi
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
mov esi, eax
jmp 0x404e00
lea eax, [esp + 0x18]
push eax
push ebp
push esi
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x404e00
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x404e00
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
jne 0x404dc9
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x24
ret 0x10
Function at 0x404e77
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
cmp dword [0x43b4c0], 0
je 0x404ef3
push esi
xor esi, esi
cmp word [ecx], si
jne 0x404ea7
push 0xa
pop eax
mov word [ebp - 0x410], ax
xor eax, eax
mov word [ebp - 0x40e], ax
inc eax
jmp 0x404ed4
lea eax, [ebp - 0x410]
test edx, edx
jne 0x404ec3
push ecx
push 0x437410
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x404ed4
push edx
push ecx
push str.__10s:__s_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push esi
lea ecx, [eax + eax]
push ecx
lea ecx, [ebp - 0x410]
push ecx
push dword [0x43b4c0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
inc eax
pop esi
jmp 0x404ef5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4055f0
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push str.https:__www.yubsoft.com_hash.html
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x4059b2
Capabilities:
Hash data using sha256

Disassembly:
push esi
push 0xd0
mov esi, ecx
push 0
push esi
call sub.msvcrt.dll_memset
and dword [esi + 0xc8], 0
add esp, 0xc
and dword [esi + 0xcc], 0
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
ret
Function at 0x40b03c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.004059b2
push 0x3f
lea eax, [ebp - 0x43]
push 0
push eax
call sub.msvcrt.dll_memset
and dword [ebp - 0x38], 0
lea ecx, [ebp - 0x44]
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x44], 0x2040040
sub ecx, edi
mov dword [ebp - 0x3c], esi
mov byte [ebp - 0x34], al
push 8
mov byte [ebp - 0x33], 0x40
pop edx
mov eax, dword [ecx + edi]
xor dword [edi], eax
lea edi, [edi + 8]
mov eax, dword [ecx + edi - 4]
xor dword [edi - 4], eax
dec edx
jne 0x40b07d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x419292
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
push ebx
mov ebx, dword [esp + 0x40]
mov eax, ecx
push ebp
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], eax
lea edi, [esp + 0x18]
mov ecx, ebx
push 0x10
pop ebp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, ebx
lea edi, [esp + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, eax
mov esi, ebp
sub edi, ebx
lea eax, [esp + 0x38]
sub eax, ebx
mov ebx, eax
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [ebx + ecx], al
inc ecx
dec esi
jne 0x4192ca
mov ebx, dword [esp + 0x4c]
xor eax, eax
xor edi, edi
movzx ecx, byte [eax + 0x42c740]
movzx eax, byte [esp + edi + 0x18]
xor ecx, eax
mov byte [esp + edi + 0x18], cl
inc edi
movzx eax, cl
cmp edi, 0x30
jb 0x4192de
add eax, esi
and eax, 0xff
inc esi
cmp esi, 0x12
jb 0x4192dc
mov edi, dword [esp + 0x14]
lea esi, [esp + 0x18]
sub ebx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movzx ecx, byte [edx + 0xf]
movzx eax, byte [ebx + edx]
xor eax, ecx
movzx ecx, byte [eax + 0x42c740]
movzx eax, byte [edx]
xor ecx, eax
mov byte [edx], cl
inc edx
movzx ecx, cl
dec ebp
jne 0x419318
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x423a69
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push edi
mov edi, ecx
test ebx, ebx
je 0x423b03
push esi
mov eax, dword [edi + 0x188]
mov esi, ebx
sub eax, dword [edi + 0x18c]
cmp ebx, eax
cmova esi, eax
mov eax, dword [edi + 0x18c]
push esi
add eax, 0xc8
add eax, edi
push ebp
push eax
call sub.msvcrt.dll_memcpy
add dword [edi + 0x18c], esi
add esp, 0xc
mov eax, dword [edi + 0x188]
add ebp, esi
sub ebx, esi
cmp dword [edi + 0x18c], eax
jne 0x423afa
xor ecx, ecx
test eax, 0xfffffff8
jbe 0x423aec
mov eax, dword [edi + ecx*8 + 0xc8]
xor dword [edi + ecx*8], eax
mov eax, dword [edi + ecx*8 + 0xcc]
xor dword [edi + ecx*8 + 4], eax
inc ecx
mov eax, dword [edi + 0x188]
shr eax, 3
cmp ecx, eax
jb 0x423ac9
mov ecx, edi
call fcn.00423c46
and dword [edi + 0x18c], 0
test ebx, ebx
jne 0x423a7d
pop esi
pop edi
pop ebp
pop ebx
ret

Function at 0x423b07
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
mov edx, dword [esi + 0x18c]
mov eax, dword [esi + 0x188]
sub eax, edx
push eax
lea eax, [esi + 0xc8]
add eax, edx
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x18c]
add esp, 0xc
mov ecx, edi
or byte [esi + eax + 0xc8], 6
mov eax, dword [esi + 0x188]
or byte [eax + esi + 0xc7], 0x80
test dword [esi + 0x188], 0xfffffff8
jbe 0x423b7b
mov eax, dword [esi + ecx*8 + 0xc8]
xor dword [esi + ecx*8], eax
mov eax, dword [esi + ecx*8 + 0xcc]
xor dword [esi + ecx*8 + 4], eax
inc ecx
mov eax, dword [esi + 0x188]
shr eax, 3
cmp ecx, eax
jb 0x423b58
mov ecx, esi
call fcn.00423c46
test dword [esi + 0x188], 0xfffffff8
jbe 0x423b9c
mov eax, dword [esi + 0x188]
inc edi
shr eax, 3
cmp edi, eax
jb 0x423b8e
mov eax, dword [esi + 0x188]
pop edi
mov dword [esi + 0x18c], eax
pop esi
ret

Function at 0x423c46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov esi, ecx
xor edi, edi
mov ecx, esi
call fcn.00422bdf
mov ecx, esi
call fcn.004231f5
mov ecx, esi
call fcn.00423539
call fcn.004236c8
mov eax, dword [edi + 0x42d200]
xor dword [esi], eax
mov eax, dword [edi + 0x42d204]
add edi, 8
xor dword [esi + 4], eax
cmp edi, 0xc0
jb 0x423c52
pop edi
pop esi
mov esp, ebp
pop ebp
ret