joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d990
Capabilities:
Terminate process

Disassembly:
push 8
push 0x428c00
call fcn.0041abd0
push 8
call fcn.0041b578
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x42eb20], esi
jne 0x41d9c4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x42eb1c], esi
mov al, byte [ebp + 0x10]
mov byte [0x42eb18], al
cmp dword [ebp + 0xc], edi
jne 0x41da0e
cmp dword [0x43026c], edi
je 0x41d9fe
mov eax, dword [0x430268]
sub eax, 4
mov dword [0x430268], eax
cmp eax, dword [0x43026c]
jb 0x41d9fe
mov eax, dword [eax]
cmp eax, edi
je 0x41d9df
call eax
jmp 0x41d9df
push 0x42d054
mov eax, 0x42d04c
call fcn.0041d90e
pop ecx
push 0x42d060
mov eax, 0x42d058
call fcn.0041d90e
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x41da3f
cmp dword [ebp + 0x10], edi
jne 0x41da4d
mov dword [0x42eb20], esi
push dword [ebp + 8]
call fcn.0041d8cc
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x41da4c
push 8
call fcn.0041b4c3
pop ecx
ret
call fcn.0041ac0b
ret

Function at 0x41fc5b
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x42d5a0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x42dea8]
je 0x41fc90
inc eax
cmp eax, 0x13
jb 0x41fc81
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x42dea8]
jne 0x41fdb6
mov eax, dword [0x42e908]
cmp eax, 1
je 0x41fd8e
cmp eax, edx
jne 0x41fcc0
cmp dword [0x42d604], 1
je 0x41fd8e
cmp ecx, 0xfc
je 0x41fdb6
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41fcf6
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.0041ed20
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.0041ac40
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41fd2a
mov eax, edi
push eax
call fcn.0041ac40
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x428c54
push edi
call fcn.00420d50
add esp, 0x10
push edi
call fcn.0041ac40
push dword [esi + 0x42deac]
mov ebx, eax
call fcn.0041ac40
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00419c10
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.0041ed20
push edi
push ebx
call fcn.0041ed30
push 0x428c50
push ebx
call fcn.0041ed30
push dword [esi + 0x42deac]
push ebx
call fcn.0041ed30
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0042169f
add esp, 0x2c
jmp 0x41fdb6
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x42deac]
push dword [esi]
call fcn.0041ac40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00419c7e
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x42011a
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x42ee24]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x420163
call ebp
mov esi, eax
cmp esi, ebx
je 0x420149
mov dword [0x42ee24], 1
jmp 0x420168
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x42015e
push 2
pop eax
mov dword [0x42ee24], eax
jmp 0x420163
mov eax, dword [0x42ee24]
cmp eax, 1
jne 0x4201c0
cmp esi, ebx
jne 0x42017b
call ebp
mov esi, eax
cmp esi, ebx
jne 0x42017b
xor eax, eax
jmp 0x420267
cmp word [esi], bx
mov eax, esi
je 0x420190
inc eax
inc eax
cmp word [eax], bx
jne 0x420182
inc eax
inc eax
cmp word [eax], bx
jne 0x420182
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.00419b11
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x4201b3
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x420267
push ebp
push esi
push edi
call fcn.0041acd0
add esp, 0xc
jmp 0x4201a5
cmp eax, 2
je 0x4201c9
cmp eax, ebx
jne 0x420174
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x420174
cmp byte [ebp], bl
mov esi, ebp
je 0x4201ff
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x420174
push esi
add edi, eax
call fcn.0041ac40
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x4201dc
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.00419b11
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x420278
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x420259
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x42026e
push edi
call fcn.0041ac40
push esi
lea edi, [edi + eax + 1]
call fcn.00419e1e
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x42021f
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.004191e6
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x420174
Function at 0x420284
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x42ee28]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x4202c4
call esi
test eax, eax
je 0x4202a9
mov dword [0x42ee28], 1
jmp 0x4202c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4202c0
mov dword [0x42ee28], 2
jmp 0x4202d2
xor eax, eax
jmp 0x420320
cmp eax, 1
jne 0x4202cd
call esi
jmp 0x420320
cmp eax, 2
jne 0x4202c0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x420318
lea eax, [esi + esi]
push eax
call fcn.00419b11
mov ebp, eax
test ebp, ebp
pop ecx
je 0x420318
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x42031c
push ebp
call fcn.004191e6
pop ecx
xor eax, eax
jmp 0x42031e
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x42169f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x42eec4], ebx
push esi
push edi
jne 0x42171f
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42175a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x42eec4], eax
je 0x42175a
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x42eec8], eax
call esi
cmp dword [0x42eae0], 2
mov dword [0x42eecc], eax
jne 0x42171f
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x42eed4], eax
je 0x42171f
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x42eed0], eax
mov eax, dword [0x42eed0]
test eax, eax
je 0x421764
call eax
test eax, eax
je 0x42174b
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x42eed4]
test eax, eax
je 0x42174b
test byte [ebp - 8], 1
jne 0x421764
cmp dword [0x42eaec], 4
jb 0x42175e
or byte [ebp + 0x12], 0x20
jmp 0x421783
xor eax, eax
jmp 0x421793
or byte [ebp + 0x12], 4
jmp 0x421783
mov eax, dword [0x42eec8]
test eax, eax
je 0x421783
call eax
mov ebx, eax
test ebx, ebx
je 0x421783
mov eax, dword [0x42eecc]
test eax, eax
je 0x421783
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x42eec4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4218b7
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x42d5a0]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x4218e8
xor eax, eax
jmp 0x421a71
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x42f140]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x421924
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.00422b50
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4219ff
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x421a3d
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x421988
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x421979
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x421959
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4219c8
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x4219d1
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x42194a
jmp 0x4219d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x421a6c
cmp dword [ebp - 0x6c], edi
je 0x421a3d
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x421a32
call fcn.0041b775
mov dword [eax], 9
call fcn.0041b77e
mov dword [eax], esi
jmp 0x421a67
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x421a27
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x4219d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x4219d3
push dword [ebp - 0x6c]
call fcn.0041b787
pop ecx
jmp 0x421a67
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x421a55
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x421a55
xor eax, eax
jmp 0x421a6f
call fcn.0041b775
mov dword [eax], 0x1c
call fcn.0041b77e
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x421a6f
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.00419c7e
add ebp, 0x3a0
leave
ret
Function at 0x423df7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x423e10
or eax, 0xffffffff
jmp 0x423e71
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x423e6d
push 0x3d
push esi
call fcn.00424140
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x423e6d
cmp esi, eax
je 0x423e6d
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x42eb00]
sete cl
cmp eax, dword [0x42eb04]
mov dword [ebp - 8], ecx
jne 0x423e53
mov edi, eax
call fcn.00423d96
mov dword [0x42eb00], eax
cmp eax, ebx
jne 0x423eac
cmp dword [ebp + 0xc], ebx
je 0x423e75
cmp dword [0x42eb08], ebx
je 0x423e75
call fcn.0042349b
test eax, eax
je 0x423eac
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x423e7e
xor eax, eax
jmp 0x423e70
push 4
call fcn.00419b11
cmp eax, ebx
pop ecx
mov dword [0x42eb00], eax
je 0x423e6d
mov dword [eax], ebx
cmp dword [0x42eb08], ebx
jne 0x423eac
push 4
call fcn.00419b11
cmp eax, ebx
pop ecx
mov dword [0x42eb08], eax
je 0x423e6d
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x42eb00]
call fcn.00423d49
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x423f0d
cmp dword [esi], ebx
je 0x423f0d
lea esi, [esi + edi*4]
push dword [esi]
call fcn.004191e6
cmp dword [ebp - 8], ebx
pop ecx
jne 0x423ef0
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x423f4e
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x423ee7
mov eax, edi
shl eax, 2
push eax
push dword [0x42eb00]
call fcn.0041a057
cmp eax, ebx
pop ecx
pop ecx
je 0x423f4e
jmp 0x423f49
cmp dword [ebp - 8], ebx
jne 0x423fb9
cmp edi, ebx
jge 0x423f1c
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x42eb00]
call fcn.0041a057
cmp eax, ebx
pop ecx
pop ecx
je 0x423e6d
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x42eb00], eax
cmp dword [ebp + 0xc], ebx
je 0x423fa3
push dword [ebp - 4]
call fcn.0041ac40
inc eax
inc eax
push eax
call fcn.00419b11
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x423fa3
push dword [ebp - 4]
push esi
call fcn.0041ed20
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x423f9c
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.004191e6
pop ecx
cmp dword [ebp - 8], ebx
je 0x423fb1
push dword [ebp - 4]
call fcn.004191e6
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x423e70
push dword [ebp - 4]
call fcn.004191e6
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x423e7a
Function at 0x1001153e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001154d
pop dword [ebp - 0x44]
mov eax, 0x1001154d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xae0624c7
sub dword [ebp - 0x54], 0x5fb3df7c
mov dword [ebp - 0x50], 0x5da8af57
sub dword [ebp - 0x50], 0x2b756312
mov dword [ebp - 0x4c], 0xef53fe56
sub dword [ebp - 0x4c], 0xa307ba28
mov dword [ebp - 0x48], 0x7d8a4390
sub dword [ebp - 0x48], 0x7d8a4390
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xbcb399ec
sub dword [ebp - 0x54], 0x48413096
mov dword [ebp - 0x50], 0xbc97d365
add dword [ebp - 0x50], 0x84d48e10
mov dword [ebp - 0x4c], 0x60a59458
sub dword [ebp - 0x4c], 0xfd3627ec
mov dword [ebp - 0x48], 0x4135e27
add dword [ebp - 0x48], 0xfbeca1d9
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0xa65bc5d3
add eax, 0x69a5ca41
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3a5f2
push 0
call eax
mov ecx, 0x43a3
xor edi, edi
add edi, eax
mov edx, 0x1002be00
add edx, dword [ebp - 0x44]
mov esi, 0xd4b58e12
add esi, 0x6bb81ff4
sub dword [ebp - 0xc], 0x7ea9f016
mov ebx, dword [edx]
sub dword [ebp - 0x40], edx
sub ebx, esi
mov dword [ebp - 0x34], 0xcdc6b122
mov dword [edi], ebx
xor dword [ebp - 0x18], 0x55ee3f3f
add edi, 0x9b1d14ad
add edi, 0x64e2eb57
add edx, 0xc463d431
sub edx, 0xc463d42d
loop 0x1001165b
add eax, 0x6fae2d3
add eax, 0xf9061e8c
mov ebx, eax
add eax, 0x57809d1
sub eax, 0x57809cc
mov ecx, 0xd1c69bf5
add ecx, 0x3e39640b
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40a0c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x40a0d7
pop dword [ebp - 0x44]
mov eax, 0x40a0d7
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3f9f3
push 0
mov eax, 0xdf18ac4b
add eax, 0x2129a5cd
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x270751a3
add ecx, 0xd8f8fdcf
xor edi, edi
add edi, eax
mov esi, 0x469ef291
add esi, 0xb9a4616f
add esi, dword [ebp - 0x44]
mov ebx, 0x88a35854
sub ebx, 0xfe07db7f
mov edx, dword [esi]
add dword [ebp - 0x30], edx
add edx, ebx
sub dword [ebp - 0x24], eax
mov dword [edi], edx
xor dword [ebp - 0x1c], edi
add edi, 0x7c774237
sub edi, 0x7c774233
add esi, 0x64be3be9
add esi, 0x9b41c41b
loop 0x40a133
add eax, 0xd00acfac
add eax, 0x2ff660ef
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6fd111b2
add ecx, 0x906eee4e
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x40dc20
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
mov ecx, 0x11
push esi
push edi
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x64]
lea ecx, [esp + 8]
lea edx, [esp + 0x18]
push ecx
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], 0x44
mov eax, dword [esp + 0x68]
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40dcc5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
cmp eax, 0x10b
jne 0x40dca2
call fcn.0043dd10
push eax
mov eax, dword [0x4493b0]
add eax, 0x101
push eax
push 0
push 0
push 0x26
push 0
call fcn.0043cd20
add esp, 0x18
xor eax, eax
pop edi
pop esi
add esp, 0x54
ret 8
call fcn.0043dd10
push eax
push 0
push 0
push 0x123
push 0
call fcn.0043cd20
add esp, 0x14
xor eax, eax
pop edi
pop esi
add esp, 0x54
ret 8
mov eax, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call esi
mov eax, 1
pop edi
pop esi
add esp, 0x54
ret 8

Function at 0x40dd10
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x40dd29
mov eax, 1
pop esi
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0043dd10
push eax
push esi
push 0
push 0
push 0x26
push 0
call fcn.0043cd20
add esp, 0x18
xor eax, eax
pop esi
ret 4

Function at 0x40f7a0
Capabilities:
Delete file

Disassembly:
sub esp, 0x80
push esi
push edi
mov edi, dword [esp + 0x90]
test edi, edi
je 0x40f7eb
push 4
call fcn.00407f80
mov ax, word [eax + 0x24]
mov esi, dword [esp + 0x8c]
mov word [edi + 0xe60], ax
push esi
or byte [edi + 0xe60], 1
lea ecx, [edi + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x94]
push ecx
push 1
push edi
jmp 0x40f85e
lea eax, [esp + 8]
push pe_nt_image_headers32
push eax
mov ecx, dword [0x448d48]
push 0xbd
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + eax + 8]
inc dword [0x44884c]
mov ecx, dword [0x44884c]
push ecx
push 0x44b538
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x14]
add esp, 0xc
mov esi, dword [esp + 0x8c]
push 0
push 0
push 1
push 0
push 4
push ecx
push esi
call fcn.00410e40
test eax, eax
je 0x40f863
mov eax, dword [esp + 0x94]
mov ecx, dword [0x448dd0]
push eax
push 0
mov edx, dword [ecx + 0x6a8]
push edx
call fcn.0041c780
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
add esp, 0x80
ret 0xc
Function at 0x426240
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x44
lea eax, [esp]
push ebx
push esi
push edi
mov esi, dword [esp + 0x54]
push ebp
push 0x41
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push 0x1134
push esi
call ebx
push eax
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
call ebp
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x5c]
push eax
push edi
push 0x1135
push esi
call ebx
push eax
call ebp
mov al, byte [edi]
inc edi
movsx edx, al
sub edx, 0x22
cmp edx, 0x3b
ja case.0x426294.40
xor ecx, ecx
mov cl, byte [edx + 0x426314]
jmp dword [ecx*4 + 0x4262f8]
test al, al
jne 0x42627e
mov eax, dword [esp + 0x64]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
push esi
call fcn.004266d0
pop ebp
cmp eax, 1
sbb eax, eax
pop edi
inc eax
pop esi
pop ebx
add esp, 0x44
ret 0x10
push 0
push 0x30
push 0x2e5
push 0
push esi
call fcn.0043ce50
add esp, 0x14
push 1
push 0x1135
push esi
call ebx
push eax
push 0x28
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x44
ret 0x10
Function at 0x43a940
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, dword [0x448dd0]
push 0
mov eax, dword [esi + 0x920]
add esi, 0x920
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov ax, word [esp + 0xc]
mov ecx, dword [0x448dd0]
mov dword [ecx + 0x348c], 0
mov ecx, dword [0x448dd0]
mov word [ecx + 0x3490], ax
xor ecx, ecx
mov edx, dword [0x448dd0]
mov cx, word [edx + 0x3490]
cmp ecx, 0x10
je 0x43a99a
mov eax, dword [esi + 4]
jmp 0x43a99d
mov eax, dword [esi + 8]
cmp dword [esp + 0x10], 0
mov dword [esi], eax
je 0x43a9bc
mov eax, dword [0x448dd0]
push 8
mov dword [eax + 0x348c], 1
mov ecx, dword [esi]
push ecx
call edi
call fcn.004140d0
call fcn.0043acc0
pop edi
pop esi
ret 8

Function at 0x43d960
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43d97c
test al, 0x10
je 0x43d97c
mov eax, 1
ret 4
xor eax, eax
ret 4

Function at 0x43d990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x43d9ac
test al, 0x10
jne 0x43d9ac
mov eax, 1
ret 4
xor eax, eax
ret 4

Function at 0x43de60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
lea eax, [esp]
push esi
push edi
push eax
push 0x20019
push 0
push str.Keyboard_Layout
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43de8d
xor eax, eax
pop edi
pop esi
add esp, 0x2c
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov dword [esp + 0x18], 0x20
push edx
push 0
push str.Active
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43deeb
cmp dword [esp + 0xc], 1
jne 0x43deeb
lea esi, [esp + 0x14]
mov edi, str.00000409
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
jne 0x43deeb
mov eax, 1
pop edi
pop esi
add esp, 0x2c
ret
xor eax, eax
pop edi
pop esi
add esp, 0x2c
ret