joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4388b9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4809a0]
jne 0x4388c3
repz ret
jmp fcn.0044153f

Function at 0x43a6d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x43a6fd
call fcn.0043abc8
mov dword [eax], esi
call fcn.0043abb5
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0043d0b9
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x43a71b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043abdb
pop ecx
jmp 0x43a6f8
test byte [esp + 0xc], 0x80
je 0x43a727
and eax, 0xfffffffe
jmp 0x43a72a
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x43a70c
xor eax, eax
pop esi
ret
Function at 0x44cb76
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00440f26
xor ebx, ebx
cmp dword [0x484bf4], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x44cc4b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x44cbb6
xor eax, eax
jmp 0x44cd0f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x44cbaf
push eax
call fcn.00440ec3
mov dword [esp], 0x462cb0
push edi
mov dword [0x484bf4], eax
call esi
push eax
call fcn.00440ec3
mov dword [esp], 0x462c9c
push edi
mov dword [0x484bf8], eax
call esi
push eax
call fcn.00440ec3
mov dword [0x484bfc], eax
lea eax, [ebp - 8]
push eax
call fcn.0043922a
test eax, eax
pop ecx
pop ecx
je 0x44cc19
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043cfbd
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x44cc4b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00440ec3
cmp eax, ebx
pop ecx
mov dword [0x484c04], eax
je 0x44cc4b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00440ec3
pop ecx
mov dword [0x484c00], eax
mov eax, dword [0x484c00]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x44ccc4
cmp dword [0x484c04], esi
je 0x44ccc4
push eax
call fcn.00440f2f
pop ecx
call eax
cmp eax, ebx
je 0x44cc91
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x484c04]
call fcn.00440f2f
pop ecx
call eax
test eax, eax
je 0x44cc91
test byte [ebp - 0x18], 1
jne 0x44ccc4
lea eax, [ebp - 0xc]
push eax
call fcn.00439261
test eax, eax
pop ecx
je 0x44ccac
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043cfbd
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x44ccbb
or dword [ebp + 0x10], 0x200000
jmp 0x44ccf5
or dword [ebp + 0x10], 0x40000
jmp 0x44ccf5
mov eax, dword [0x484bf8]
cmp eax, esi
je 0x44ccf5
push eax
call fcn.00440f2f
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44ccf5
mov eax, dword [0x484bfc]
cmp eax, esi
je 0x44ccf5
push dword [ebp - 4]
push eax
call fcn.00440f2f
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x484bf4]
call fcn.00440f2f
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x455206
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4809a0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0045519b
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043b970
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x455255
cmp dword [ebp - 0x1c], 5
jb 0x45526d
jmp 0x455269
cmp dword [ebp - 0x10], 1
jne 0x45526d
cmp dword [ebp - 0x1c], 4
ja 0x455269
jne 0x45526d
cmp dword [ebp - 0x18], 0
jbe 0x45526d
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x464da4
call fcn.0045506f
test eax, eax
jge 0x45528e
mov byte [0x484e93], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004388b9
add ebp, 0x78
leave
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
xor eax, eax
mov word [0x4162f6], ax
mov word [0x4164fe], ax
mov dword [0x4162bc], eax
mov byte [0x4161d3], al
mov dword [0x4161be], eax
mov dword [0x4161ba], eax
mov dword [0x4162c8], 0xffffffff
push 0
call fcn.00413196
test eax, eax
je 0x40125a
mov dword [0x4161e3], eax
call sub.COMCTL32.dll_InitCommonControls
push 0x400
push 2
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
je 0x40122b
mov dword [0x416136], eax
push eax
call sub.KERNEL32.dll_GlobalLock
test eax, eax
je 0x40122b
mov dword [0x416146], eax
push 0x400
push 2
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
je 0x40122b
mov dword [0x41613a], eax
push eax
call sub.KERNEL32.dll_GlobalLock
test eax, eax
je 0x40122b
mov dword [0x41614a], eax
push 0x400
push 2
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
je 0x40122b
mov dword [0x41613e], eax
push eax
call sub.KERNEL32.dll_GlobalLock
test eax, eax
je 0x40122b
mov dword [0x41614e], eax
push 0x400
push 2
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
je 0x40122b
mov dword [0x416142], eax
push eax
call sub.KERNEL32.dll_GlobalLock
test eax, eax
je 0x40122b
mov dword [0x416152], eax
push 0x200
push dword [0x416146]
push 0x139
push dword [0x4161e3]
call fcn.004136a0
push dword [0x416146]
call fcn.00413196
test eax, eax
je 0x401150
mov esi, eax
push 0x200
push dword [0x416146]
push 0x13a
push dword [0x4161e3]
call fcn.004136a0
push dword [0x416146]
push esi
call fcn.0041303e
mov dword [0x4161fe], eax
call sub.KERNEL32.dll_GetCommandLineW
mov esi, eax
pushfd
cld
lodsw ax, word [esi]
test ax, ax
je 0x4011a8
mov bx, 0x22
mov dx, 0x20
cmp ax, bx
jne 0x40118c
lodsw ax, word [esi]
test ax, ax
je 0x4011a8
cmp ax, bx
jne 0x401172
lodsw ax, word [esi]
test ax, ax
je 0x4011a8
cmp ax, dx
je 0x40117e
jmp 0x40119a
lodsw ax, word [esi]
test ax, ax
je 0x4011a8
cmp ax, dx
je 0x40117e
jmp 0x40118c
dec esi
dec esi
mov dword [0x4161be], esi
inc byte [0x4161d3]
popfd
call fcn.00408c39
test eax, eax
je 0x40122b
call fcn.0040885b
test eax, eax
je 0x40122b
call fcn.0040b26a
call fcn.00401781
test eax, eax
je 0x40122b
call fcn.00403f98
call fcn.0040c455
test eax, eax
je 0x401244
call sub.USER32.dll_GetDesktopWindow
push 0
push 0x401283
push eax
push 0x64
push dword [0x4161e3]
call fcn.00413548
cmp eax, 0xffffffff
je 0x401270
cmp dword [0x41620a], 0
je 0x401215
push dword [0x41620a]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x41620a]
call sub.KERNEL32.dll_GlobalFree
push dword [0x41601e]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x41601e]
call sub.KERNEL32.dll_GlobalFree
push dword [0x4162bc]
call sub.KERNEL32.dll_ExitProcess
mov eax, dword [0x4162bc]
pop edi
pop esi
pop edx
pop ecx
pop ebx
leave
ret 0x10
push dword [0x41601e]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x41601e]
call sub.KERNEL32.dll_GlobalFree
xor eax, eax
mov al, byte [0x4161d1]
push 0x190
push eax
push 0
call fcn.00408153
jmp 0x40122b
push 0x190
push 0xcd
push 0
call fcn.00408153
jmp 0x401215
Function at 0x403f98
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push esi
push edi
lea eax, [ebp - 0x24]
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov eax, 0x8000
xor edx, edx
div dword [ebp - 0x20]
sub edx, 1
cmc
adc eax, 0
mul dword [ebp - 0x20]
and eax, 0xfffffff8
mov dword [0x4161db], eax
shr eax, 1
mov dword [0x4161df], eax
pop edi
pop esi
leave
ret
Function at 0x4071a2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push edi
mov dword [ebp - 8], 0
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ecx, 0xffffffff
pushfd
cld
repne scasw ax, word es:[edi]
popfd
sub edi, dword [ebp + 0xc]
dec edi
dec edi
je 0x4071e3
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x407213
cmp dword [ebp - 4], edi
jne 0x407213
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40720c
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x416a26
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x407213
cmp dword [ebp - 4], 4
jne 0x407213
dec esi
jne 0x4071ea
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x407c33
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push esi
push edi
mov dword [ebp - 0x5c], 0
mov byte [0x4161d1], 0xcb
push 0x208
push 2
call sub.KERNEL32.dll_GlobalAlloc
test eax, eax
je 0x407d7d
mov dword [ebp - 0x50], eax
mov byte [0x4161d1], 0xcc
push eax
call sub.KERNEL32.dll_GlobalLock
test eax, eax
je 0x407d75
mov dword [ebp - 0x58], eax
xor eax, eax
mov ecx, 0x13
lea edi, [ebp - 0x4c]
pushfd
cld
rep stosd dword es:[edi], eax
popfd
mov dword [ebp - 0x4c], 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], str.QuickMirror_Files
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x30], eax
mov word [eax], 0
mov dword [ebp - 0x2c], 0x104
mov esi, dword [0x41614a]
push esi
push 0
push 0
push 5
push 0
call sub.SHELL32.dll_SHGetFolderPathW
test eax, eax
je 0x407cd2
mov esi, dword [0x41620e]
mov dword [ebp - 0x20], esi
push 0x200
push dword [0x416146]
push 0x148
push dword [0x4161e3]
call fcn.004136a0
mov eax, dword [0x416146]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x81824
mov dword [ebp - 0x10], 0x416fb0
mov dword [ebp - 8], 0x40b339
mov byte [0x4161d1], 0xe0
lea eax, [ebp - 0x4c]
push eax
call fcn.004136cb
test eax, eax
je 0x407dad
movzx esi, word [ebp - 0x14]
shl esi, 1
add esi, dword [ebp - 0x58]
mov byte [0x4161d1], 0xde
push 0
push 0x8000080
push 3
push 0
push 0
push 0x80000000
push esi
call fcn.004132ee
cmp eax, 0xffffffff
je 0x407d6d
mov dword [ebp - 0x54], eax
push dword [ebp - 0x54]
call fcn.00409e0b
test eax, eax
je 0x407d6d
call fcn.00407dc6
mov dword [ebp - 0x5c], 1
push dword [ebp - 0x50]
call sub.KERNEL32.dll_GlobalUnlock
push dword [ebp - 0x50]
call sub.KERNEL32.dll_GlobalFree
cmp dword [ebp - 0x5c], 0
jne 0x407da7
xor ebx, ebx
mov bl, byte [0x4161d1]
push 0x137
push ebx
push dword [ebp + 8]
call fcn.00408153
cmp byte [0x4161d1], 0xde
je 0x407da7
call fcn.00407df2
pop edi
pop esi
leave
ret 4
mov byte [0x4161d1], 0xe0
call sub.comdlg32.dll_CommDlgExtendedError
test eax, eax
jne 0x407d6d
mov dword [ebp - 0x5c], 1
jmp 0x407d6d
Function at 0x407df2
Capabilities:
Get common file path

Disassembly:
push esi
push edi
push dword [0x4169f6]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x4169f6]
call sub.KERNEL32.dll_GlobalFree
push dword [0x4169f2]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x4169f2]
call sub.KERNEL32.dll_GlobalFree
push dword [0x41622a]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x41622a]
call sub.KERNEL32.dll_GlobalFree
push dword [0x416212]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x416212]
call sub.KERNEL32.dll_GlobalFree
push dword [0x416242]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x416242]
call sub.KERNEL32.dll_GlobalFree
call fcn.0040c455
xor eax, eax
mov edi, 0x4162f6
mov ecx, 0x190
pushfd
cld
rep stosd dword es:[edi], eax
popfd
mov esi, dword [0x41621e]
mov edi, dword [0x416236]
mov word [esi], ax
mov word [edi], ax
mov dword [0x416252], eax
mov dword [0x416936], eax
mov dword [0x41693a], eax
mov dword [0x41693e], eax
mov dword [0x416942], eax
inc eax
mov byte [0x416913], al
mov byte [0x416915], al
mov byte [0x416916], al
mov byte [0x416935], al
mov word [0x4162f1], ax
mov word [0x4162f3], ax
mov dword [0x416222], eax
mov dword [0x416226], eax
mov dword [0x41623a], eax
mov dword [0x41623e], eax
mov byte [0x416934], al
mov word [0x416928], 0x1fff
mov edi, dword [0x41614a]
push edi
push 0
push 0
push 5
push 0
call sub.SHELL32.dll_SHGetFolderPathW
test eax, eax
je 0x407f04
mov edi, dword [0x416202]
push edi
call fcn.00413140
mov esi, eax
push 0x200
push dword [0x416146]
push 0x145
push dword [0x4161e3]
call fcn.004136a0
add eax, esi
inc eax
inc eax
cmp eax, 0x104
ja 0x407f5f
push edi
push 0x416706
call fcn.004130ea
mov eax, esi
shl esi, 1
add esi, 0x416706
cmp eax, 3
je 0x407f53
mov word [esi], 0x5c
inc esi
inc esi
push dword [0x416146]
push esi
call fcn.004130ea
call fcn.00407dc6
pop edi
pop esi
ret
Function at 0x407f67
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
cmp dword [0x4161d5], 0xffffffff
je 0x4080ce
cmp dword [ebp + 0x10], 0
je 0x407f94
or dword [0x4162e9], 1
dec dword [ebp + 0x10]
je 0x407f94
inc dword [0x41698e]
cmp byte [0x41690f], 0
jne 0x407fb8
push 0x400
push dword [0x416146]
push dword [ebp + 8]
push dword [0x4161e3]
call sub.USER32.dll_LoadStringA
jmp 0x407fd3
push 0x200
push dword [0x416146]
push dword [ebp + 8]
push dword [0x4161e3]
call fcn.004136a0
shl eax, 1
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [0x416146]
push dword [0x4161d5]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4080d4
cmp dword [ebp - 4], edi
jne 0x4080d4
cmp dword [ebp + 0xc], 0
je 0x408093
push dword [ebp + 0xc]
call fcn.00413140
mov edi, eax
cmp byte [0x41690f], 0
jne 0x408073
mov esi, 0x400
cmp edi, esi
ja 0x408026
mov esi, edi
push 0
push 0x416a22
push 0x400
push dword [0x416146]
push esi
push dword [ebp + 0xc]
push 0
push 0
call fcn.004138fa
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [0x416146]
push dword [0x4161d5]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4080d4
cmp dword [ebp - 4], esi
jne 0x4080d4
mov ebx, esi
shl ebx, 1
add dword [ebp + 0xc], ebx
sub edi, esi
jne 0x408020
jmp 0x408093
shl edi, 1
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 0xc]
push dword [0x4161d5]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4080d4
cmp dword [ebp - 4], edi
jne 0x4080d4
mov esi, 0x416a26
mov edi, 4
cmp byte [0x41690f], 0
jne 0x4080ad
mov esi, 0x416a23
shr edi, 1
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x4161d5]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4080d4
cmp dword [ebp - 4], edi
jne 0x4080d4
mov eax, 1
pop edi
pop esi
leave
ret 0xc
cmp byte [0x4161d3], 0
jne 0x408139
push 0x200
push dword [0x416146]
push 0x175
push dword [0x4161e3]
call fcn.004136a0
push 0x200
push dword [0x41614a]
push 0x137
push dword [0x4161e3]
call fcn.004136a0
push 2
push dword [0x41614a]
push dword [0x416146]
push dword [0x4169e6]
call fcn.0041361f
cmp eax, 4
je 0x407f94
xor eax, eax
jmp 0x4080ce
push dword [0x4161d5]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x4161d5], 0xffffffff
jmp 0x4080ce
Function at 0x40b1a3
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [0x41614a]
push esi
push 0
push 0
push 5
push 0
call sub.SHELL32.dll_SHGetFolderPathW
test eax, eax
jne 0x40b1f7
push esi
call fcn.00412a16
test eax, eax
je 0x40b1f7
push 0
push 0x8000080
push 3
push 0
push 0
push 0x80000000
push str.DEFAULT.MIR
call fcn.004132ee
cmp eax, 0xffffffff
je 0x40b1f7
push eax
call fcn.00409e0b
test eax, eax
jne 0x40b24c
jmp 0x40b231
push dword [0x41620e]
call fcn.00412a16
test eax, eax
je 0x40b257
push 0
push 0x8000080
push 3
push 0
push 0
push 0x80000000
push str.DEFAULT.MIR
call fcn.004132ee
cmp eax, 0xffffffff
je 0x40b257
push eax
call fcn.00409e0b
test eax, eax
jne 0x40b24c
xor ebx, ebx
mov bl, byte [0x4161d1]
push 0x192
push ebx
push dword [ebp + 8]
call fcn.00408153
call fcn.00407df2
call fcn.00407dc6
pop edi
pop esi
leave
ret 4
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
je 0x40b247
mov byte [0x4161d1], 0xe7
jmp 0x40b231

Function at 0x40b369
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push esi
push edi
xor eax, eax
mov ecx, 0x13
lea edi, [ebp - 0x4c]
pushfd
cld
rep stosd dword es:[edi], eax
popfd
push 0x416706
call fcn.00404737
test eax, eax
jne 0x40b3af
mov esi, dword [0x41614a]
push esi
push 0
push 0
push 5
push 0
call sub.SHELL32.dll_SHGetFolderPathW
test eax, eax
je 0x40b3ac
mov esi, dword [0x41620e]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x4c], 0x4c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], str.Text_Files
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], 0x416706
mov dword [ebp - 0x2c], 0x208
push 0x200
push dword [0x416146]
push 0x14a
push dword [0x4161e3]
call fcn.004136a0
mov eax, dword [0x416146]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x80824
mov dword [ebp - 0x10], 0x416f38
mov dword [ebp - 8], 0x40b339
lea eax, [ebp - 0x4c]
push eax
call fcn.004136cb
test eax, eax
je 0x40b428
call fcn.00407dc6
pop edi
pop esi
leave
ret 4
mov byte [0x4161d1], 0xe0
call sub.comdlg32.dll_CommDlgExtendedError
test eax, eax
je 0x40b422
cmp eax, 0x3002
jne 0x40b457
cmp word [0x416706], 0
je 0x40b457
mov word [0x416706], 0
jmp 0x40b371
xor ebx, ebx
mov bl, byte [0x4161d1]
push 0x137
push ebx
push dword [ebp + 8]
call fcn.00408153
mov word [0x416706], 0
jmp 0x40b422
Function at 0x40b478
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
push edi
mov dword [ebp - 4], 0
mov dword [0x4161d5], 0xffffffff
cmp word [0x416706], 0
je 0x40b5ff
mov dword [ebp - 8], 0x14e
push 0x416706
call fcn.00403797
test eax, eax
jne 0x40b55c
push 0
push 0
push 0x130b
push dword [0x4162dc]
call fcn.0041349c
test eax, eax
je 0x40b4e4
push 0
push 0
push 0x1330
push dword [0x4162dc]
call fcn.0041349c
push 0x39
push dword [0x4162e0]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0xffffffffffffffff
push 0
push 0xb1
push 0x39
push dword [0x4162e0]
call fcn.00413573
push 0x200
push dword [0x416146]
push 0x159
push dword [0x4161e3]
call fcn.004136a0
push 0x200
push dword [0x41614a]
push dword [ebp - 8]
push dword [0x4161e3]
call fcn.004136a0
push 0x10
push dword [0x416146]
push dword [0x41614a]
push dword [ebp + 8]
call fcn.0041361f
jmp 0x40b606
mov dword [ebp - 8], 0x14f
push 0x416706
call fcn.00404737
test eax, eax
je 0x40b4b8
mov esi, eax
mov dword [ebp - 8], 0x154
cmp word [esi], 0x20
je 0x40b4b8
mov ebx, 4
cmp byte [0x41690e], 0
jne 0x40b59b
mov ebx, 2
push 0
push 0x80
push ebx
push 0
push 0
push 0x40000000
push esi
call fcn.004132ee
mov dword [0x4161d5], eax
cmp eax, 0xffffffff
je 0x40b60f
cmp byte [0x41690e], 0
jne 0x40b5ee
cmp byte [0x41690f], 0
je 0x40b5ee
push 0
lea eax, [ebp - 0xc]
push eax
push 2
push 0x416a2c
push dword [0x4161d5]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp - 0xc], 2
je 0x40b5ff
jmp 0x40b606
push 2
push 0
push 0
push dword [0x4161d5]
call sub.KERNEL32.dll_SetFilePointer
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 4
push 0x200
push dword [0x416146]
push 0x193
push dword [0x4161e3]
call fcn.004136a0
push 0x200
push dword [0x41614a]
push 0x137
push dword [0x4161e3]
call fcn.004136a0
push 0x34
push dword [0x41614a]
push dword [0x416146]
push dword [ebp + 8]
call fcn.0041361f
cmp eax, 6
je 0x40b5ff
push 0x137
push 0xd0
push dword [ebp + 8]
call fcn.00408153
jmp 0x40b606

Function at 0x40c784
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
call sub.USER32.dll_GetDesktopWindow
push 0
push 0x40c7c1
push eax
push 0x6e
push dword [0x4161e3]
call fcn.00413548
mov esi, eax
push 9
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
mov eax, esi
pop edi
pop esi
leave
ret 4

Function at 0x40da1e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.00412f3e
cmp eax, 0xffffffff
je 0x40da87
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
call sub.KERNEL32.dll_GetFileSize
mov edi, eax
cmp eax, 0xffffffff
je 0x40da77
push esi
call sub.KERNEL32.dll_CloseHandle
mov esi, dword [ebp - 4]
mov ecx, 0xa
shr esi, 1
rcr edi, 1
loop 0x40da60
test esi, esi
jne 0x40da87
mov eax, edi
test edi, edi
jne 0x40da71
inc eax
pop edi
pop esi
leave
ret 4
call sub.KERNEL32.dll_GetLastError
cmp eax, 0
je 0x40da52
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, 0xffffffff
jmp 0x40da71
Function at 0x40dbd4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
call sub.USER32.dll_GetDesktopWindow
push 0
push 0x40dc11
push eax
push 0x70
push dword [0x4161e3]
call fcn.00413548
mov esi, eax
push 9
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x413ba6
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x41730c]
mov dword [ebp - 4], eax
mov eax, dword [0x41771c]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x413bd5
call eax
cmp eax, ebx
mov dword [ebp - 0x528], eax
jne 0x413d62
push dword [0x417270]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x528], eax
je 0x413d62
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x413c0d
mov byte [ebp - 0x41c], bl
push esi
lea eax, [ebp - 0x524]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x413c25
mov byte [ebp - 0x524], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x528]
call edi
test eax, eax
jne 0x413c46
mov byte [ebp - 0x10c], bl
push esi
lea eax, [ebp - 0x214]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
test eax, eax
pop edi
jne 0x413c63
mov byte [ebp - 0x214], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00413b09
lea eax, [ebp - 0x52c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x413c86
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x314]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x413c9a
sub eax, esi
add eax, ecx
mov byte [ebp + eax - 0x213], bl
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00413b09
lea eax, [ebp - 0x52c]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x413ccf
sub eax, ecx
lea ecx, [ebp - 0x314]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x413ce1
sub ecx, esi
add ecx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x524]
push eax
mov byte [ebp + ecx - 0x10b], bl
call fcn.00413a3a
test eax, eax
pop esi
jne 0x413d22
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x524]
push eax
call fcn.00413a3a
test eax, eax
jne 0x413d50
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00413a3a
test eax, eax
jne 0x413d62
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.00413a3a
test eax, eax
je 0x413d62
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x528], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x528]
pop ebx
call fcn.0041435e
leave
ret

Function at 0x41435e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41730c]
jne 0x41436f
test ecx, 0xffff0000
jne 0x41436f
ret
jmp fcn.00414374