joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ff18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
call fcn.00404980
mov esi, eax
call fcn.00404960
mov edi, eax
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
push ebx
push dword [ebp + 8]
call fcn.0040e120
add esp, 8
test eax, eax
mov dword [ebp - 8], eax
jne 0x40ff9e
push edi
push esi
push ebx
call fcn.00410150
add esp, 0xc
test eax, eax
mov dword [ebp - 8], eax
jne 0x40ff9e
push edi
push esi
push ebx
push dword [ebp + 8]
call fcn.004103b7
add esp, 0x10
test eax, eax
mov dword [ebp - 8], eax
jne 0x40ff9e
push edi
push esi
push ebx
push dword [ebp + 8]
call fcn.004107d0
add esp, 0x10
test eax, eax
mov dword [ebp - 8], eax
jne 0x40ff9e
push edi
push esi
push ebx
push dword [ebp + 8]
call fcn.004109d8
add esp, 0x10
test eax, eax
mov dword [ebp - 8], eax
je 0x40ffaa
mov ebx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x50
jne 0x40ffc5
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.0042f878
add esp, 0x10
jmp 0x410049
cmp ebx, 0x54
jne 0x40ffd8
push ebx
push dword [ebp + 8]
call fcn.0040dfd1
add esp, 8
jmp 0x410049
cmp ebx, 0x49
jne 0x40ffeb
push ebx
push dword [ebp + 8]
call fcn.0040e120
add esp, 8
jmp 0x410049
cmp ebx, 0x51
jne 0x410049
mov ecx, dword [edi + 0x70c]
mov dword [ebp - 0x14], ecx
push dword [ecx + 0x24]
call fcn.00451248
add esp, 4
test eax, eax
mov dword [ebp - 0x10], eax
je 0x410018
mov edx, dword [ebp - 0x10]
fild dword [edx]
fstp qword [esi + 0x2e70]
jmp 0x410024
fld qword [0x46c34c]
fstp qword [esi + 0x2e70]
push edi
push esi
call fcn.00407935
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
fild dword [ebp - 0x24]
fstp qword [esi + 0x2e78]
fild dword [ecx + 0xc0]
fstp qword [esi + 0x2e80]
add esp, 8
mov edx, dword [esi + 0x20fc]
cmp edx, dword [ebp + 8]
jne 0x4100fa
xor eax, eax
cmp ebx, 0x41
jne 0x410066
mov eax, 0x3b7
jmp 0x4100b8
cmp ebx, 0x42
jne 0x410072
mov eax, 0x3b8
jmp 0x4100b8
cmp ebx, 0x43
jne 0x41007e
mov eax, 0x3b9
jmp 0x4100b8
cmp ebx, 0x44
jne 0x41008a
mov eax, 0x3ba
jmp 0x4100b8
cmp ebx, 0x45
jne 0x410096
mov eax, 0x3bb
jmp 0x4100b8
cmp ebx, 0x46
jne 0x4100a2
mov eax, 0x3bc
jmp 0x4100b8
cmp ebx, 0x47
jne 0x4100ae
mov eax, 0x3bd
jmp 0x4100b8
cmp ebx, 0x48
jne 0x4100b8
mov eax, 0x3be
test eax, eax
je 0x4100d2
push 0
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
push 0
call fcn.0040d9a2
add esp, 0x10
jmp 0x4100fa
cmp ebx, 0x7a
jne 0x4100fa
mov ecx, 1
cmp dword [edi + 8], ecx
jne 0x4100ea
mov dword [edi + 4], 3
jmp 0x4100ed
mov dword [edi + 4], ecx
push edi
push esi
push dword [ebp + 8]
call fcn.0045ff1a
add esp, 0xc
cmp dword [esi + reloc.USER32.DLL_CreateWindowExA], 0
je 0x410144
cmp ebx, 9
jne 0x410144
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
mov ebx, eax
test ax, ax
movsx ebx, bx
js 0x410123
mov dword [ebp - 0xc], 0xa29
jmp 0x41012e
test ebx, ebx
jns 0x41012e
mov dword [ebp - 0xc], 0xa2a
push 0
push dword [ebp - 0xc]
push 0x111
push dword [esi + reloc.USER32.DLL_CreateWindowExA]
call dword [sym.imp.USER32.DLL_SendMessageA]
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4107d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x24d4]
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
cmp edx, 5
je 0x4107f5
cmp edx, 0x24
jne 0x4109d0
push esi
push dword [ebp + 8]
call fcn.0040dfd1
add esp, 8
test ax, ax
je 0x410811
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x38c]
lea edx, [ecx - 0x81]
mov eax, 2
cmp edx, eax
ja 0x4108af
cmp esi, 0x28
jne 0x41083b
or dword [ebx + 0x6d0], 4
jmp 0x41085f
cmp esi, 0x26
jne 0x41084c
or dword [ebx + 0x6d0], 8
jmp 0x41085f
cmp esi, 0x55
jne 0x4109d0
or dword [ebx + 0x6d0], 0x100
push 3
mov edx, dword [ebx + 0x6d0]
and edx, 1
and dword [ebx + 0x6d0], 0xfffffffe
push dword [ebp + 0x10]
mov dword [ebp - 8], edx
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetDC]
mov esi, eax
push eax
call fcn.0041d584
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ReleaseDC]
mov ecx, dword [ebp - 8]
mov eax, 1
or dword [ebx + 0x6d0], ecx
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ecx - 0xc1]
cmp ecx, eax
ja 0x4109d0
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + 0x2df4]
cmp ecx, 0x162
je 0x4108e2
cmp ecx, 0x163
je 0x4108e2
cmp ecx, 0x164
jne 0x4109d0
push 0x10
call dword [sym.imp.USER32.DLL_GetKeyState]
mov word [ebp - 4], ax
push 0x11
call dword [sym.imp.USER32.DLL_GetKeyState]
test ax, ax
js 0x410930
cmp esi, 0x28
jne 0x41090c
or dword [ebx + 0x6d0], 0x10
jmp 0x410930
cmp esi, 0x26
jne 0x41091d
or dword [ebx + 0x6d0], 0x20
jmp 0x410930
cmp esi, 0x55
jne 0x4109d0
or dword [ebx + 0x6d0], 0x100
cmp word [ebp - 4], 0
js 0x410968
cmp esi, 0x28
jne 0x410948
or dword [ebx + 0x6d0], 0x40
jmp 0x410968
cmp esi, 0x26
jne 0x410959
or dword [ebx + 0x6d0], 0x80
jmp 0x410968
cmp esi, 0x55
jne 0x4109d0
or dword [ebx + 0x6d0], 0x100
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebx + 0x2df4]
mov eax, 0x162
cmp esi, eax
je 0x41098a
cmp esi, 0x163
je 0x41098a
cmp esi, 0x164
jne 0x4109d0
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_GetDC]
mov esi, eax
cmp dword [ebx + 0x2df4], 0x162
jne 0x4109af
push 3
push ebx
push esi
call fcn.0041deb7
add esp, 0xc
jmp 0x4109bb
push 3
push ebx
push esi
call fcn.0041f457
add esp, 0xc
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.DLL_ReleaseDC]
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410d84
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
call fcn.00404980
mov esi, eax
call fcn.00404960
mov dword [ebp - 8], eax
cmp dword [eax + 0x688], 0
je 0x410e0a
mov eax, dword [ebp - 8]
mov esi, dword [eax + 0x688]
cmp esi, 0x578
jne 0x410dbf
mov eax, 3
jmp 0x410dee
cmp esi, 0x5dc
jne 0x410dce
mov eax, 4
jmp 0x410dee
cmp esi, 0x640
jne 0x410ddd
mov eax, 5
jmp 0x410dee
cmp esi, 0x6a4
jne 0x410dec
mov eax, 6
jmp 0x410dee
xor eax, eax
mov dword [ebp - 4], eax
push dword [ebp - 4]
push ebx
call fcn.0045e2ea
push 4
push ebx
call fcn.0045e31a
add esp, 0x10
jmp 0x410e90
push ebx
call fcn.0045e364
add esp, 4
push 1
call dword [sym.imp.USER32.DLL_GetKeyState]
test ax, ax
jns 0x410e2d
push 7
push ebx
call fcn.0045e2ea
add esp, 8
jmp 0x410e41
cmp dword [esi + 0x2508], 0
je 0x410e41
push 2
push ebx
call fcn.0045e31a
add esp, 8
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x690]
cmp edx, 0x89a
jne 0x410e7d
fld qword [esi + 0x2660]
ftst
fnstsw ax
fstp st(0)
sahf
je 0x410e70
fld qword [esi + reloc.USER32.DLL_GetForegroundWindow]
ftst
fnstsw ax
fstp st(0)
sahf
jne 0x410e7d
push 3
push ebx
call fcn.0045e378
add esp, 8
jmp 0x410e90
cmp edx, 0x89d
jne 0x410e90
push 6
push ebx
call fcn.0045e378
add esp, 8
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410ebb
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
call fcn.00404960
mov edi, eax
call fcn.00404970
mov dword [ebp - 0x18], eax
cmp dword [esi + 0x20f8], 0
jne 0x411031
xor ecx, ecx
mov ebx, ecx
mov dword [edi + 0x688], ecx
push ebx
push edi
push esi
call fcn.0041104b
add esp, 0xc
test eax, eax
mov dword [ebp - 0x14], eax
je 0x410f1b
mov ecx, dword [ebp - 0x14]
mov eax, ecx
mov dword [0x47a004], ecx
mov dword [0x47a008], 0x46c4e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
inc ebx
cmp ebx, 7
jbe 0x410eed
call fcn.0041d218
push 0x200
push 0xffffffffffffffe6
push dword [esi + 0x20f8]
call dword [sym.imp.USER32.DLL_SetClassLongA]
lea edx, [ebp - 0x10]
lea ecx, [edi + 0x394]
push edx
push ecx
push dword [esi + 0x20f8]
call fcn.00450d23
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [esi + 0x20f8]
call dword [sym.imp.USER32.DLL_MoveWindow]
push 0x101
push 0xffffffffffffffec
push dword [esi + 0x20f8]
call dword [sym.imp.USER32.DLL_SetWindowLongA]
push 0x27
push 0
push 0
push 0
push 0
push 0
push dword [esi + 0x20f8]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push 0xffffffffffffffff
push esi
call fcn.00411d39
mov ebx, dword [edi + 0x680]
cmp ebx, 1
jg 0x410fac
mov ebx, 1
mov edx, 7
cmp ebx, edx
jl 0x410fb7
mov ebx, edx
mov edx, dword [ebp - 0x18]
mov dword [esi + 0x3258], 0
mov dword [edi + 0x680], 0
push ebx
mov ecx, dword [edi + 0x58]
push edi
mov dword [edx + 0x58], ecx
push esi
call fcn.0041174c
push 5
push dword [esi + 0x20f8]
call dword [sym.imp.USER32.DLL_ShowWindow]
push 0
push 0
push esi
mov dword [edi + 0x14], 1
push dword [esi + 0x20fc]
call fcn.0045d5f4
add esp, 0x30
cmp dword [esi + 0x24d8], 0x836
jne 0x411042
cmp dword [edi + 0x680], 1
jne 0x411042
cmp dword [edi + 0x754], 0xe5
je 0x411042
push 9
call fcn.004147a8
add esp, 4
jmp 0x411042
push edi
push esi
call fcn.00407060
push edi
push esi
call fcn.00411b88
add esp, 0x10
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41174c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 1
jl 0x411768
cmp edi, 7
jle 0x411774
pop edi
mov eax, 0xffffffff
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x680]
cmp eax, edi
jne 0x411787
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x41183a
cmp dword [ebx + 0x32c0], 0
je 0x4117ab
push esi
push ebx
call fcn.004116af
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
lea edx, [ecx + 0x3e8]
push edx
push dword [ebx + 0x20f8]
call dword [sym.imp.USER32.DLL_GetDlgItem]
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.USER32.DLL_GetDC]
lea ecx, [ebp - 0x38]
push ecx
mov dword [ebp - 0x20], eax
push dword [ebp - 0x24]
call dword [sym.imp.USER32.DLL_GetClientRect]
lea edx, [ebp - 0x38]
push 0
push 0xffffffffffffffff
push edx
push dword [ebp - 0x20]
call fcn.0041be68
lea ecx, [ebp - 0x18]
push 0x18
push ecx
mov edx, dword [ebp - 0x1c]
lea eax, [edx + 0x3fc]
push eax
push dword [esi + 0x58]
call dword [sym.imp.USER32.DLL_LoadStringA]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x38]
push ecx
push edx
push dword [ebp - 0x20]
call fcn.0041c748
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.USER32.DLL_ReleaseDC]
push 0
mov ecx, dword [ebp - 0x1c]
lea edx, [ebx + ecx*4]
push dword [edx + 0x2104]
call dword [sym.imp.USER32.DLL_ShowWindow]
add esp, 0x1c
push 5
lea ecx, [ebx + edi*4]
mov edx, dword [ecx + 0x2104]
push 0
push 0
push 0x2e
push 8
push 0
mov dword [ebp - 0x28], edx
push edx
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push esi
push ebx
call fcn.00411fd8
push 5
push dword [ebp - 0x28]
call dword [sym.imp.USER32.DLL_ShowWindow]
mov dword [esi + 0x680], edi
push esi
call fcn.00411a58
push esi
push ebx
call fcn.00407060
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x419aee
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edi + 0x28], 0
je 0x419b72
call fcn.00404980
mov ebx, eax
cmp dword [eax + 0x2de4], 0
je 0x419b1e
push 0
push dword [ebx + 0x2de4]
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
mov dword [ebx + 0x2de4], 0
call fcn.00404960
mov esi, eax
call fcn.00404970
push 0x12e
push edi
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call fcn.00462298
mov edx, dword [ebp - 4]
mov ecx, dword [esi + 0x698]
mov dword [ebp - 8], eax
cmp ecx, dword [edx + 0x698]
setne cl
movzx ecx, cl
or dword [ebp - 8], ecx
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x419b72
cmp dword [esi + 0x688], 0
je 0x419b7b
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x24]
test edx, edx
jle 0x419b95
push edx
call fcn.00451248
add esp, 4
test eax, eax
je 0x419b95
mov ecx, dword [edi + 0x50]
mov dword [eax + 0x10], ecx
push 4
xor edx, edx
mov dword [ebx + 0x2508], edx
push dword [ebx + 0x20fc]
call fcn.0045e31a
add esp, 8
mov edx, dword [ebp - 4]
mov ecx, dword [esi + 0x698]
mov edx, dword [edx + 0x698]
cmp ecx, edx
je 0x419c0e
mov dword [esi + 0x698], edx
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x698], 0
jne 0x419be5
mov ecx, dword [ebp - 4]
xor edx, edx
mov dword [ecx + 0x69c], edx
mov dword [esi + 0x69c], edx
jmp 0x419bf1
push 5
push esi
push ebx
call fcn.0041194a
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call fcn.00419c5e
push 1
push esi
push dword [ebx + 0x20f8]
call fcn.0041d40c
add esp, 0x18
push dword [ebp - 4]
push esi
push ebx
call fcn.00404c30
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 0x24]
cmp edx, dword [ecx + 0x24]
jne 0x419c2e
mov edx, dword [edi + 0x64]
cmp edx, dword [ecx + 0x64]
je 0x419c39
push 0xffffffffffffffff
push ebx
call fcn.0043eaf3
add esp, 8
push 0x12e
push edi
push dword [ebp + 0xc]
call fcn.00460310
push 5
push ebx
call fcn.00411ed8
add esp, 0x14
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b1a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword [ebp + 0xc]
add eax, 0x11b4
push esi
mov ebx, dword [ebp + 8]
push eax
call fcn.0042de88
add esp, 4
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x42b1cf
pop esi
mov eax, 0x73
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [ebx + 0x2040]
test ecx, ecx
mov dword [ebp - 8], eax
je 0x42b1f4
push ecx
push 0
push dword [ebx + 0x2124]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push dword [ebp - 8]
push 0
push dword [ebx + 0x2124]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
mov dword [ebx + 0x2040], eax
jne 0x42b223
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 0xffffff9f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x10]
push edx
push dword [ebp - 8]
push dword [ebx + 0x2040]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x10], 0
jne 0x42b255
pop esi
mov eax, 0x92
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 8]
cmp esi, dword [ebp - 0x10]
je 0x42b264
mov eax, 0x90
jmp 0x42b276
push dword [ebp + 0xc]
push ebx
call fcn.0042b2ba
mov dword [ebp - 0xc], eax
add esp, 8
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x42b29a
push dword [ebx + 0x2040]
push 0
push dword [ebx + 0x2124]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [ebx + 0x2040], 0
jmp 0x42b2b2
mov ecx, dword [ebx + 0x2040]
fld qword [ecx + 0x1c]
fstp qword [ebx + 0x216a]
fld qword [ecx + 0x24]
fstp qword [ebx + 0x2172]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b3df
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword [ebp + 0xc]
add eax, 0x12b4
push esi
mov ebx, dword [ebp + 8]
push eax
call fcn.0042de88
add esp, 4
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x42b40e
pop esi
mov eax, 0x73
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ecx, dword [ebx + 0x2044]
test ecx, ecx
mov dword [ebp - 8], eax
je 0x42b433
push ecx
push 0
push dword [ebx + 0x2124]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push dword [ebp - 8]
push 0
push dword [ebx + 0x2124]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
mov dword [ebx + 0x2044], eax
jne 0x42b462
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, 0xffffff9f
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0x10]
push edx
push dword [ebp - 8]
push dword [ebx + 0x2044]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x10], 0
jne 0x42b494
pop esi
mov eax, 0x92
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 8]
cmp esi, dword [ebp - 0x10]
je 0x42b4a5
mov dword [ebp - 0xc], 0x90
jmp 0x42b4b4
push dword [ebp + 0xc]
push ebx
call fcn.0042b4e8
mov dword [ebp - 0xc], eax
add esp, 8
cmp dword [ebp - 0xc], 0
je 0x42b4d8
push dword [ebx + 0x2044]
push 0
push dword [ebx + 0x2124]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov dword [ebx + 0x2044], 0
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42b6f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
call fcn.00404960
mov edi, eax
cmp byte [eax + 0x10b4], 0
jne 0x42b724
lea ecx, [edi + 0x10b4]
push ecx
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
push 0x80
mov edx, 0x475ec8
push edx
mov byte [0x475e48], 0
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [edi + 0x58]
call dword [sym.imp.USER32.DLL_LoadStringA]
mov cl, byte [eax + 0x475ec7]
xor esi, esi
mov byte [ebp - 4], cl
mov ebx, esi
cmp byte [esi + 0x475ec8], 0
je 0x42b784
mov dl, byte [ebx + 0x475ec8]
cmp dl, byte [ebp - 4]
jne 0x42b77a
mov byte [ebx + 0x475ec8], 0
mov ecx, ebx
inc esi
inc cx
mov word [esi*2 + 0x475f48], cx
inc ebx
cmp byte [ebx + 0x475ec8], 0
jne 0x42b75b
push 0x4c
mov ebx, dword [ebp + 0x10]
or ebx, 0x80024
push 0
mov edx, 0x475f68
or ebx, 0x2800000
push edx
call fcn.0046071c
mov ecx, dword [ebp + 8]
mov edx, 0x80
mov dword [0x475f6c], ecx
lea ecx, [edi + 0x10b4]
mov dword [0x475f88], edx
mov eax, 0x475f68
mov dword [0x475f90], edx
mov edx, 0x42b828
mov dword [0x475f68], 0x4c
mov dword [0x475f74], 0x475ec8
mov dword [0x475f80], 1
mov dword [0x475f84], 0x475e48
mov dword [0x475f8c], 0x475fb4
mov dword [0x475f94], ecx
mov dword [0x475f9c], ebx
mov dword [0x475fa8], 0x475f48
mov dword [0x475fac], edx
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c228
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
call fcn.00404980
push dword [ebp + 8]
call fcn.0042de38
add esp, 4
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x42c282
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 3
mov dword [ebp - 0xc], eax
jne 0x42c266
mov dword [0x47a008], 0x46f0a0
jmp 0x42c270
mov dword [0x47a008], 0x46f0bc
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword [0x47a004], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x46f000
push dword [ebp + 8]
call fcn.0042c158
add esp, 4
push eax
call fcn.004604a0
add esp, 8
test eax, eax
jne 0x42c315
push ebx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 8]
push dword [eax + 0x18]
push dword [ebp + 0x10]
push ecx
call fcn.0042c498
add esp, 0x10
mov ebx, eax
cmp eax, 0xffffff9f
je 0x42c35f
test ebx, ebx
jne 0x42c2e1
mov dword [0x47a008], 0x46f0f0
mov dword [0x47a004], 1
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 0xc]
push edx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
lea esi, [ebp - 8]
push 0
push 0
push 0
push esi
call fcn.0042c498
mov dword [ebp - 0x10], 0x4c
add esp, 0x10
jmp 0x42c349
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 0x18]
imul ecx, dword [edi + 0x14]
imul ecx, ebx
lea eax, [ebp - 0x10]
push 0
mov ebx, ecx
push eax
push 0x4c
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea edx, [ebp - 0xc]
push 0
push edx
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov esi, dword [ebp - 0x10]
lea edi, [ebx + 0x4c]
add esi, dword [ebp - 0xc]
cmp esi, edi
je 0x42c37c
mov dword [0x47a008], 0x46f0d0
mov dword [0x47a004], 1
pop edi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42d4f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xf2c]
push esi
test ecx, ecx
je 0x42d514
push ecx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x2c
mov ebx, dword [ebp + 0xc]
xor edx, edx
push edx
mov esi, dword [ebp + 0xc]
add esi, 0xf00
mov dword [ebx + 0xf2c], edx
push esi
call fcn.0046071c
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x15b4
push eax
mov dword [ebp - 0xc], eax
call fcn.00460634
add esp, 4
cmp eax, 5
jae 0x42d558
pop esi
mov eax, 0x73
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0042de38
add esp, 4
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x42d577
pop esi
mov eax, 0x74
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edx, [ebp - 8]
push edx
push 0x2c
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x42d591
cmp dword [ebp - 8], 0x2c
je 0x42d59c
pop esi
mov eax, 0x77
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
xor eax, eax
mov dword [esi + 0xf2c], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42da10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0xf2c]
mov dword [ebp - 8], ecx
lea edx, [esi + 0x15b4]
lea ebx, [esi + 0xf00]
push edx
call fcn.00460634
mov dword [ebp - 0xc], eax
add esp, 4
cmp eax, 5
jae 0x42da4c
pop esi
mov eax, 0x73
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 8], 0
jne 0x42da5d
pop esi
mov eax, 0x72
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp + 0xc], esi
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 0x35d4]
mov dword [ebp - 4], ebx
xor ebx, ebx
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
cmp dword [esi + 0xc0], 1
jle 0x42da85
inc ebx
cmp ebx, 0x64
jb 0x42da6e
push 0
push 0
push 0
mov ebx, dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
jne 0x42daa7
pop esi
mov eax, 0x79
pop ebx
mov esp, ebp
pop ebp
ret
push 0x46f2c8
push ebx
call fcn.004605d0
lea edx, [ebx + 8]
push 0x46f2d0
push edx
call fcn.004605d0
lea ecx, [ebx + 0xc]
push 0x46f2d8
push ecx
call fcn.004605d0
lea edx, [ebx + 0x24]
push 0x46f2e0
push edx
call fcn.004605d0
mov dword [ebx + 0x10], 0x10
mov word [ebx + 0x14], 1
mov dword [ebp - 0xc], 0
add esp, 0x20
mov ecx, dword [ebp + 0xc]
test dword [ecx + 0x740], 1
je 0x42db05
inc dword [ebp - 0xc]
mov edx, dword [ebp + 0xc]
test dword [edx + 0x740], 2
je 0x42db17
inc dword [ebp - 0xc]
mov cx, word [ebp - 0xc]
mov word [ebx + 0x16], cx
shl dword [ebp - 0xc], 2
mov dx, word [ebp - 0xc]
mov word [ebx + 0x20], dx
fild dword [esi + 0x64]
fistp dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebx + 0x18], ecx
imul ecx, dword [ebp - 0xc]
lea edx, [ebp - 0xc]
push 0
push edx
push 0x2c
push ebx
mov dword [ebx + 0x1c], ecx
mov word [ebx + 0x22], 0x20
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x42db60
cmp dword [ebp - 0xc], 0x2c
je 0x42db6b
pop esi
mov eax, 0x77
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov esi, dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ebx, eax
cmp ebx, 1
sbb eax, eax
and eax, 0x75
mov dword [esi + 0xf2c], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret