joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41084d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
mov ecx, 0x47f7c8
call fcn.0041de81
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
or eax, 0xffffffff
cmp edi, eax
je 0x4108c7
lea eax, [ebp - 8]
push esi
push eax
mov dword [ebp - 8], esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
push esi
push eax
lea eax, [ebp - 4]
push 2
push eax
push edi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 4], 0xd8ff
jne 0x4108bc
push 2
pop eax
jmp 0x4108c7
xor eax, eax
cmp word [ebp - 4], 0x4d42
sete al
pop edi
pop esi
leave
ret 4

Function at 0x4108cd
Capabilities:
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
mov dword [ebp - 8], ecx
mov esi, 0x47f3f0
push edi
push 0xc
mov ecx, esi
call fcn.0041da60
xor edi, edi
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x410901
mov dword [0x47f280], edi
push 1
pop eax
jmp 0x410a61
lea eax, [ebp - 0x12c]
push str..bmp
push eax
call fcn.0041ee09
mov eax, dword [0x48039c]
pop ecx
pop ecx
cmp eax, edi
push 1
pop ebx
mov dword [0x48032c], ebx
mov dword [0x47f390], ebx
je 0x410933
push eax
call fcn.004260ee
pop ecx
push 4
call fcn.004260f9
cmp eax, edi
pop ecx
mov dword [0x48039c], eax
jne 0x410955
mov ecx, 0x47fa34
call fcn.0041de81
push eax
call fcn.0041ea8b
pop ecx
push 8
mov ecx, esi
call fcn.0041da60
add eax, dword [ebp - 0x14]
mov ecx, dword [0x48039c]
push 0xc
mov dword [ecx], eax
mov ecx, esi
call fcn.0041da60
push eax
push 8
mov ecx, esi
call fcn.0041da60
push eax
lea eax, [ebp - 0x12c]
push eax
mov ecx, 0x47f7c8
call fcn.0041de81
push eax
call fcn.00401ac0
add esp, 0x10
test eax, eax
je 0x4109a2
push 0xffffffffffffff9d
jmp 0x4108fb
push edi
push 0x80
push 3
push edi
push ebx
lea eax, [ebp - 0x12c]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4109cc
push 0xffffffffffffff9c
jmp 0x4108fb
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 8]
push eax
push esi
call fcn.00410cf1
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp ebx, edi
jge 0x410a16
mov eax, ebx
or ah, 1
jmp 0x410a61
push dword [0x47f278]
call dword [sym.imp.USER32.dll_GetDC]
push edi
mov esi, eax
push dword [ebp - 4]
push dword [ebp - 0xc]
push 4
push dword [ebp - 4]
push esi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
push esi
mov dword [0x47f280], eax
push dword [0x47f278]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0x10]
call fcn.004260ee
mov eax, dword [0x47f280]
pop ecx
neg eax
sbb eax, eax
and eax, 0x6a
add eax, 0xffffff97
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410c67
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x410ce9
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 8]
push 0
push eax
lea eax, [ebp - 0x10]
push 0xe
push eax
push edi
call esi
cmp dword [ebp + 8], 0xe
jne 0x410ce2
cmp word [ebp - 0x10], 0x4d42
jne 0x410ce2
lea eax, [ebp + 8]
push 0
push eax
lea eax, [ebp - 0x38]
push 0x28
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], 0x28
jne 0x410ce9
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + 4], ecx
mov al, 1
jmp 0x410ceb
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
leave
ret 8

Function at 0x410cf1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0xe
pop edi
push edi
push 0
push ebx
call fcn.00425820
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp + 0x10]
push 0
push eax
push edi
push ebx
push dword [ebp + 8]
call esi
cmp dword [ebp + 0x10], edi
je 0x410d28
push 0xfffffffffffffff8
jmp 0x410e0c
cmp word [ebx], 0x4d42
je 0x410d36
push 0xfffffffffffffff7
jmp 0x410e0c
mov ebx, dword [ebp + 0xc]
sub ebx, edi
push ebx
call fcn.004260f9
mov edi, dword [ebp + 0x18]
pop ecx
test eax, eax
mov dword [edi], eax
jne 0x410d52
push 0xffffffffffffffe0
jmp 0x410e0c
lea ecx, [ebp + 0x10]
push 0
push ecx
push ebx
push eax
push dword [ebp + 8]
call esi
cmp dword [ebp + 0x10], ebx
je 0x410d68
push 0xffffffffffffffdf
jmp 0x410db7
mov eax, dword [ebp + 0x14]
mov ecx, dword [edi]
push 1
mov dword [eax], ecx
mov ebx, dword [edi]
mov eax, ecx
pop esi
mov dword [ebp + 8], ebx
mov dx, word [eax + 0xe]
mov cl, dl
shl esi, cl
cmp dx, 8
jbe 0x410d8b
xor esi, esi
jmp 0x410d94
mov eax, dword [eax + 0x20]
test eax, eax
je 0x410d94
mov esi, eax
mov ecx, dword [ebp + 0x1c]
lea eax, [ebx + esi*4 + 0x28]
test esi, esi
mov dword [ecx], eax
je 0x410e0a
lea eax, [esi*4 + 8]
push eax
call fcn.004260f9
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x410dc4
push 0xffffffffffffffde
pop esi
push dword [edi]
call fcn.004260ee
pop ecx
mov eax, esi
jmp 0x410e0d
test esi, esi
mov word [ebx], 0x300
mov word [ebx + 2], si
jle 0x410df7
mov ecx, dword [ebp + 8]
lea eax, [ebx + 5]
add ecx, 0x29
mov dl, byte [ecx + 1]
mov byte [eax - 1], dl
mov dl, byte [ecx]
mov byte [eax], dl
mov dl, byte [ecx - 1]
mov byte [eax + 1], dl
and byte [eax + 2], 0
add ecx, 4
add eax, 4
dec esi
jne 0x410dda
push ebx
call dword [sym.imp.GDI32.dll_CreatePalette]
mov ecx, dword [ebp + 0x20]
push ebx
mov dword [ecx], eax
call fcn.004260ee
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x410e88
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x47f438
lea ecx, [ebp - 0xc]
call fcn.0041cffc
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0xc]
dec eax
push eax
call fcn.0041da2a
cmp al, 0x5c
je 0x410eb6
push 0x5c
lea ecx, [ebp - 0xc]
call fcn.0041d146
push esi
push 0
push str.Backup_
lea ecx, [ebp - 0xc]
call fcn.0041d195
push 1
lea ecx, [ebp - 0xc]
call fcn.0041de81
push eax
call fcn.0040e6d2
mov esi, dword [ebp + 8]
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
dec eax
test eax, eax
jle 0x410efc
cmp byte [eax + esi], 0x5c
jne 0x410ee2
lea eax, [eax + esi + 1]
push 0
push eax
lea ecx, [ebp - 0xc]
call fcn.0041d195
push 0
lea ecx, [ebp - 0xc]
call fcn.0041de81
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 9
lea ecx, [ebp - 0xc]
call fcn.0041d146
push 0
push esi
lea ecx, [ebp - 0xc]
call fcn.0041d195
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._t_d_t_d_t_d_t_d
push eax
call fcn.0041d5b5
add esp, 0x18
lea ecx, [ebp - 0xc]
call fcn.0041de81
push eax
mov ecx, 0x47f8a8
call fcn.00422fba
lea ecx, [ebp - 0xc]
call fcn.0041d05e
pop esi
leave
ret 0x14
Function at 0x410f60
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [ebp - 0x14]
mov dword [esi + 4], ebx
mov dword [ebp - 4], ebx
call fcn.0041cf28
push dword [ebp - 4]
mov ecx, 0x47f6bc
call fcn.0041db35
test al, al
je 0x4110f9
lea eax, [ebp - 0x14]
mov ecx, 0x47f6bc
push eax
lea eax, [ebp - 4]
push eax
call fcn.0041da92
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea ecx, [ebp - 0x14]
call fcn.0041de81
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4110ed
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
mov dword [esi], edi
call fcn.0041cffc
mov eax, dword [ebp - 0x20]
push 3
add eax, 0xfffffffd
lea ecx, [ebp - 0x20]
push eax
call fcn.0041d4f7
push ebx
push 0x42d018
lea ecx, [ebp - 0x20]
call fcn.0041d195
cmp byte [0x48038c], bl
jne 0x41105b
mov ecx, 0x47ffb0
call fcn.0041de81
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041cf98
push 0x20
lea ecx, [ebp - 0x2c]
call fcn.0041d146
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push eax
call fcn.0041d213
lea ecx, [ebp - 0x2c]
call fcn.0041de81
push eax
push 0x14
push dword [esi + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [ebp - 0x2c]
call fcn.0041d05e
push 0x416029
push 0x415fde
lea ecx, [ebp - 0x20]
call fcn.0041de81
push eax
lea ecx, [ebp - 0x14]
call fcn.0041de81
push eax
call dword [0x47f3dc]
test eax, eax
lea ecx, [ebp - 0x20]
jle 0x4110e8
call fcn.0041de81
push 0x47f8b4
push eax
mov ecx, 0x47f8a8
call fcn.00422f7e
cmp dword [0x47f710], ebx
je 0x4110c9
push 0xc
call fcn.004260f9
cmp eax, ebx
pop ecx
je 0x4110ba
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0041cffc
jmp 0x4110bc
xor eax, eax
push 0xffffffffffffffff
push eax
mov ecx, 0x47f734
call fcn.0041fb14
lea ecx, [ebp - 0x14]
call fcn.0041de81
push eax
call fcn.0040e321
add dword [esi + 4], edi
pop ecx
lea ecx, [ebp - 0x20]
call fcn.0041d05e
jmp 0x410f7b
call fcn.0041d05e
lea ecx, [ebp - 0x14]
call fcn.0041d05e
xor al, al
jmp 0x411103
lea ecx, [ebp - 0x14]
call fcn.0041d05e
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41138c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
push edi
je 0x4113ed
cmp dword [ebp + 0xc], ebx
je 0x4113ed
mov edi, 0x80
push ebx
push edi
push 3
push ebx
push 1
push 0x80000000
mov ecx, 0x47f7c8
call fcn.0041de81
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4113ed
lea ecx, [ebp - 0x14]
push ebx
push ecx
mov dword [ebp - 0x14], ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4113f6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
push ebx
push edi
push 2
push ebx
push 1
push 0xc0000000
push dword [ebp + 8]
call esi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x4113ed
mov edi, 0x8000
push edi
call fcn.004260f9
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x411443
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
mov ecx, 0x47fa34
call fcn.0041de81
push eax
call fcn.0041ea8b
pop ecx
mov dword [ebp - 8], ebx
cmp byte [ebp + 0x14], bl
je 0x411461
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
call fcn.00411eba
add esp, 0x10
jmp 0x41148c
mov ecx, dword [ebp - 8]
mov eax, edi
lea edx, [ecx + 0x8000]
cmp edx, dword [ebp + 0x10]
jbe 0x411476
mov eax, dword [ebp + 0x10]
sub eax, ecx
lea ecx, [ebp - 0x10]
push ebx
push ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4114c0
lea eax, [ebp - 0xc]
push ebx
push eax
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4114c0
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp byte [ebp + 0x14], bl
je 0x4114b6
push eax
call fcn.00415f4b
pop ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x4114d8
jmp 0x411446
push dword [ebp + 0xc]
call fcn.004260ee
pop ecx
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
jmp 0x4113ed
push dword [ebp + 0xc]
call fcn.004260ee
pop ecx
push dword [ebp - 4]
call esi
push dword [ebp + 8]
call esi
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
sete al
jmp 0x4113ef
Function at 0x411eba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push 1
push eax
push ebx
mov dword [ebp - 4], ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [0x42cfd4]
mov edx, dword [0x48039c]
sub ecx, dword [0x48032c]
mov edi, dword [ebp + 0x10]
mov dword [ebp + 8], ebx
mov dword [ebp + 0x10], edi
mov ecx, dword [edx + ecx*4]
lea edx, [eax + edi]
cmp ecx, edx
jae 0x411f02
sub ecx, eax
mov dword [ebp + 0x10], ecx
lea eax, [ebp + 8]
push ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
test eax, eax
mov dword [ebx], ecx
je 0x411f8b
cmp ecx, edi
jae 0x411f8b
mov eax, dword [0x42cfd4]
mov ecx, dword [0x47f390]
sub eax, dword [0x48032c]
dec ecx
cmp eax, ecx
jge 0x411f8b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [esi], 0xffffffff
push esi
mov ecx, 0x47f9a0
call fcn.004149d3
mov ecx, dword [0x42cfd4]
mov edx, dword [0x48039c]
sub ecx, dword [0x48032c]
mov eax, dword [ebp + 8]
sub edi, eax
mov ecx, dword [edx + ecx*4]
cmp ecx, edi
jae 0x411f71
mov edi, ecx
lea ecx, [ebp + 8]
push 0
push ecx
mov ecx, dword [ebp + 0xc]
add eax, ecx
push edi
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 8]
add dword [ebx], eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 1
push eax
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
mov dword [0x480310], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411fac
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
xor eax, eax
cmp dword [0x47f604], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
jle 0x4121d5
push ebx
push esi
push edi
mov esi, 0x47f0b8
push dword [ebp - 8]
mov ecx, 0x47f5f8
call fcn.0041fafa
mov edi, eax
mov eax, dword [edi + 0x1c]
cmp eax, dword [ebp + 8]
jne 0x4121c0
push dword [edi + 0x20]
call fcn.004139c0
test al, al
pop ecx
je 0x4121c0
lea ebx, [edi + 4]
mov ecx, esi
push ebx
call fcn.004174c1
lea eax, [edi + 0x10]
mov ecx, esi
push eax
call fcn.004174c1
or dword [edi + 0x1c], 0xffffffff
push ebx
mov ecx, esi
call fcn.0041b99b
lea eax, [edi + 0x10]
mov ecx, esi
push eax
call fcn.0041b99b
push 0x7fffffff
push ebx
mov ecx, esi
call fcn.0041c515
lea eax, [edi + 0x10]
push 0x7fffffff
push eax
mov ecx, esi
call fcn.0041c515
mov eax, dword [edi]
cmp eax, 4
jne 0x412060
inc dword [ebp - 4]
mov ecx, ebx
call fcn.0041de81
push eax
call fcn.00425589
jmp 0x4121c0
cmp eax, 5
jne 0x412078
mov ecx, ebx
call fcn.0041de81
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x4121c0
push 0x1e
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.00425820
mov eax, dword [0x47f278]
add esp, 0xc
mov ecx, ebx
mov dword [ebp - 0x38], eax
push 0
mov word [ebp - 0x28], 0x650
call fcn.0041d146
mov ecx, ebx
call fcn.0041de81
mov dword [ebp - 0x30], eax
mov eax, dword [edi]
test eax, eax
je 0x4120b9
cmp eax, 2
je 0x4120b9
cmp eax, 3
jne 0x4120cf
lea ebx, [edi + 0x10]
push 0
mov ecx, ebx
call fcn.0041d146
mov ecx, ebx
call fcn.0041de81
mov dword [ebp - 0x2c], eax
mov eax, dword [edi]
push 1
pop ecx
cmp eax, ecx
jne 0x4120e1
mov dword [ebp - 0x34], 3
jmp 0x4120f7
cmp eax, 2
je 0x4120f4
xor ecx, ecx
cmp eax, 3
setne cl
dec ecx
and ecx, 2
inc ecx
inc ecx
mov dword [ebp - 0x34], ecx
lea ecx, [edi + 0x10]
call fcn.0041de81
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
jne 0x412152
cmp dword [edi], eax
jne 0x412152
cmp dword [ebp - 0xc], 0xffffffff
jne 0x412152
inc dword [ebp - 4]
lea ecx, [edi + 0x10]
call fcn.0041de81
push eax
call ebx
cmp eax, 0xffffffff
je 0x412152
test al, 0x10
jne 0x412152
lea ecx, [edi + 0x10]
call fcn.0041de81
push 0x47f8b4
push eax
mov ecx, 0x47f8a8
call fcn.00422f7e
mov eax, dword [edi + 0x10]
lea ebx, [edi + 0x10]
cmp eax, 4
jbe 0x4121c0
mov edi, dword [edi]
cmp edi, 2
je 0x412168
test edi, edi
jne 0x4121c0
add eax, 0xfffffffb
push 4
push eax
mov ecx, ebx
call fcn.0041ddf8
push eax
lea ecx, [ebp - 0x18]
call fcn.0041cffc
lea ecx, [ebp - 0x18]
call fcn.0041decb
push 1
push str..TTF
lea ecx, [ebp - 0x18]
call fcn.0041d348
test al, al
je 0x4121b8
mov ecx, ebx
call fcn.0041de81
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x18]
call fcn.0041d05e
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [0x47f604]
jl 0x411fce
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x4121dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x47f210]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
je 0x4121fd
mov eax, dword [eax + 4]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x412218
mov eax, dword [0x47f060]
cmp eax, esi
je 0x412210
mov eax, dword [eax + 4]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x412218
mov eax, dword [0x47f278]
mov dword [ebp - 4], eax
push esi
push 0x40581a
push dword [ebp - 4]
push 0x12
push dword [0x47f27c]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], eax
call fcn.0041cf28
push str.___Internal_WaitExternal___
call fcn.0041e684
cmp eax, esi
je 0x412253
push eax
lea ecx, [ebp - 0x14]
call fcn.0041d075
jmp 0x412260
push 0x480154
lea ecx, [ebp - 0x14]
call fcn.0041d0e3
push 1
lea ecx, [ebp - 0x14]
pop edi
push edi
push esi
push esi
push 0x42cd24
push str.__n_
call fcn.0041dd5c
lea ecx, [ebp - 0x14]
call fcn.0041de81
push eax
push 0x422
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, 0x47f970
call fcn.0041de81
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x10
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.00425820
push 0x44
lea eax, [ebp - 0x84]
pop ebx
push ebx
push esi
push eax
call fcn.00425820
add esp, 0x18
lea eax, [ebp - 0x24]
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x58], edi
push eax
lea eax, [ebp - 0x84]
push eax
mov word [ebp - 0x54], di
push dword [ebp + 0xc]
push esi
push 0x4000000
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41236b
mov eax, dword [ebp - 0x24]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp + 0xc], eax
push 0xff
push 0xffffffffffffffff
lea eax, [ebp + 0xc]
push esi
push eax
push edi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
je 0x41235b
cmp eax, edi
jne 0x41235b
push esi
push esi
push esi
lea eax, [ebp - 0x40]
push esi
push eax
call ebx
test eax, eax
je 0x41230b
push esi
push esi
lea eax, [ebp - 0x40]
push esi
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x41230b
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x412326
push dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x20]
call esi
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0x14]
call fcn.0041d05e
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41238d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push dword [esi + 0x34]
mov ecx, 0x47f7c8
mov dword [ebp - 4], edi
push dword [eax]
call fcn.0041de81
mov ebx, dword [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.0041dc28
test eax, eax
jge 0x4123da
push 0
push str.Couldnt_read_filename___skipping_file
push dword [edi + 8]
mov ecx, 0x47f0b8
call fcn.0041c404
xor eax, eax
jmp 0x412505
mov edi, 0x47f0b8
push ebx
mov ecx, edi
call fcn.004174c1
push ebx
mov ecx, edi
call fcn.0041b99b
push 0x7fffffff
push ebx
mov ecx, edi
call fcn.0041c515
mov eax, dword [ebp + 0x14]
mov ecx, ebx
mov byte [eax], 1
mov eax, dword [esi + 0x34]
add dword [0x480310], eax
call fcn.0041de81
push eax
call fcn.0040ea14
test al, al
pop ecx
jne 0x412483
lea ecx, [ebp - 0x10]
call fcn.0041cf28
mov ecx, ebx
call fcn.0041de81
push eax
mov ecx, 0x47ffa4
call fcn.0041de81
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041d5b5
add esp, 0xc
mov ecx, 0x47f800
call fcn.0041de81
mov ecx, dword [ebp - 4]
push 4
push eax
mov esi, dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.0041de81
push eax
push esi
mov ecx, edi
call fcn.0041c428
cmp eax, 7
jne 0x412472
or esi, 0xffffffff
jmp 0x412474
xor esi, esi
lea ecx, [ebp - 0x10]
call fcn.0041d05e
mov eax, esi
jmp 0x412505
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, ebx
call fcn.0041de81
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x412502
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x34], eax
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x18]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esi + 0x24]
mov ecx, ebx
push eax
lea eax, [esi + 0x20]
push eax
call fcn.0041de81
push eax
call fcn.0040e345
add esp, 0xc
add esi, 0x28
mov ecx, ebx
push 0
push esi
call fcn.0041de81
push eax
call fcn.0040e3d9
add esp, 0xc
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4129d4
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push str..DLL
push dword [esp + 0x14]
call fcn.0041ee09
mov edi, dword [esp + 0x1c]
pop ecx
pop ecx
mov esi, 0x47f3f0
push edi
mov ecx, esi
call fcn.0041da60
add edi, 4
mov ecx, esi
push edi
mov ebx, eax
call fcn.0041da60
test ebx, ebx
mov esi, eax
je 0x412a65
test esi, esi
je 0x412a65
push 1
pop eax
mov dword [0x48032c], eax
mov dword [0x47f390], eax
mov eax, dword [0x48039c]
test eax, eax
je 0x412a2c
push eax
call fcn.004260ee
pop ecx
push 4
call fcn.004260f9
pop ecx
mov dword [0x48039c], eax
push esi
lea ecx, [esi + ebx]
push ebx
mov dword [eax], ecx
push dword [esp + 0x18]
mov ecx, 0x47f7c8
call fcn.0041de81
push eax
call fcn.00401ac0
add esp, 0x10
test eax, eax
je 0x412a6d
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor al, al
pop edi
pop esi
pop ebx
ret 8
mov al, 1
jmp 0x412a67

Function at 0x412a71
Capabilities:
Shutdown system
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push ebx
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 1
mov ecx, 0x47f0b8
call fcn.0041c5b9
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor eax, eax
cmp byte [0x4803dd], bl
sete al
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]