joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x409fcd
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov ebx, 0x10
test edi, edi
jne 0x409ea5
or ebx, 0x8000000
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00405744
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], di
mov dword [ebp - 0x2c], 1
cmp dword [ebp + 8], 0
je 0x409ed1
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x409ee7
mov eax, dword [ebp - 8]
call fcn.00403fa8
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00403ba4
cmp dword [ebp - 0x14], 0
je 0x409f2b
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0x22
je 0x409f2b
mov edx, dword [ebp - 0x14]
mov eax, 0x409fe8
call fcn.00404048
test eax, eax
jle 0x409f2b
push 0x409ff4
push dword [ebp - 0x14]
push 0x409ff4
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403e68
cmp dword [ebp - 0x14], 0
je 0x409f42
test esi, esi
je 0x409f42
lea eax, [ebp - 0x14]
mov edx, 0x409fe8
call fcn.00403db0
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
push 0
push 0
push 0
lea eax, [ebp - 0x6c]
mov ecx, esi
mov edx, dword [ebp - 0x14]
call fcn.00403df4
mov eax, dword [ebp - 0x6c]
call fcn.00403fa8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x409faf
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x409f98
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle
mov byte [ebp - 9], 1
jmp 0x409fa6
cmp dword [ebp + 8], 0
je 0x409fa6
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x68]
mov dword [eax], edx
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409fd4
lea eax, [ebp - 0x6c]
call fcn.00403b0c
lea eax, [ebp - 0x14]
call fcn.00403b0c
ret

Function at 0x40b818
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x40b824
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x40b83d
push eax
je 0x40b83e
call dword [0x43c118]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x43c118]
ret
Function at 0x40ce3c
Capabilities:
Get file attributes

Disassembly:
call fcn.00405c18
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40ce50
dec eax
and al, 0x10
sete al
ret

Function at 0x40ce8c
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00403ce8
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00406670
ret

Function at 0x40d670
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, eax
push esp
call sub.kernel32.dll_QueryPerformanceFrequency
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
push 0
mov eax, dword [0x4489d4]
push eax
mov eax, dword [0x4489cc]
push eax
push 8
call dword [0x448934]
push ebp
call sub.kernel32.dll_Sleep
push 0
mov eax, dword [0x4489d4]
push eax
mov eax, dword [0x4489d0]
push eax
push 8
call dword [0x448934]
lea eax, [esp + 0x10]
push eax
call sub.kernel32.dll_QueryPerformanceCounter
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0xc]
jne 0x40d6db
cmp eax, dword [esp + 8]
jbe 0x40d6f7
jmp 0x40d6dd
jle 0x40d6f7
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esp + 8]
sbb edx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
jmp 0x40d721
mov eax, dword [esp]
mov edx, dword [esp + 4]
push edx
push eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub eax, dword [esp + 0x18]
sbb edx, dword [esp + 0x1c]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
push 0
push 0x186a0
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00404654
push edx
push eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
call fcn.00404654
mov ebp, eax
xor esi, esi
mov al, byte [0x448910]
dec eax
test al, al
jb 0x40d79b
inc eax
mov byte [esp + 0x20], al
mov bl, 0
mov eax, ebp
xor edx, edx
push edx
push eax
xor eax, eax
mov al, bl
mov edi, eax
add edi, edi
lea edi, [edi + edi*2]
mov eax, dword [0x4489d0]
mov edx, dword [eax + edi*8 + 4]
mov eax, dword [eax + edi*8]
push edx
push eax
mov eax, dword [0x4489cc]
mov edx, dword [eax + edi*8 + 4]
mov eax, dword [eax + edi*8]
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
call fcn.00404654
add esi, eax
inc ebx
dec byte [esp + 0x20]
jne 0x40d759
xor eax, eax
mov al, byte [0x448910]
push eax
mov eax, esi
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov esi, eax
cmp esi, 0x64
jbe 0x40d7b8
mov esi, 0x64
mov eax, esi
push eax
mov al, 0x64
pop edx
sub al, dl
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d7c8
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov al, byte [esp + 0x14]
mov byte [0x448910], al
mov eax, dword [esp + 4]
mov dword [0x448914], eax
add esp, 0x24
ret
Function at 0x40e6f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00403f98
xor eax, eax
push ebp
push 0x40e823
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x40e7f7
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x40e6cc]
call fcn.004048a4
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x40e838
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e7f7
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 8]
mov dword [ebp - 4], esi
lea eax, [ebp - 0x20]
push eax
mov eax, esi
call fcn.00405740
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, word [ebx + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebx + 0xc]
call fcn.00405740
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [ebx + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x40e844
call fcn.0040ce04
mov edx, dword [ebp - 0x20]
mov eax, edi
call fcn.00403b60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e82a
lea eax, [ebp - 0x20]
call fcn.00403b0c
lea eax, [ebp - 0x18]
mov edx, dword [0x40e6cc]
call fcn.004048b0
lea eax, [ebp - 0xc]
call fcn.00403b0c
ret

Function at 0x40e95c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov bl, 1
mov eax, dword [0x448a00]
call fcn.00403fa8
push eax
push 0xffffffffffffffff
push 4
call sub.kernel32.dll_OpenFileMappingA
mov esi, eax
test esi, esi
je 0x40e9de
push 4
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [esp], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [esp + 4], eax
push 0
push 0
push 0x10
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
push 0xbb8
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x40e9de
xor ebx, ebx
mov eax, ebx
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x40e9e8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x40ea5a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x448a28], 0
je 0x40ea0f
mov eax, dword [0x448a28]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0
lea eax, [ebp - 4]
mov ecx, dword [0x448a00]
mov edx, 0x40ea6c
call fcn.00403df4
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 0x40ea7c
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x40f110
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f343
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x40f358
mov eax, dword [0x4489f0]
call fcn.00406828
mov edx, dword [ebp - 4]
mov eax, 0x448a18
call fcn.00403b60
mov edx, 0x4489f8
mov eax, dword [0x448a18]
call fcn.0040e6f0
cmp edx, dword [0x448a20]
jne 0x40f16c
cmp eax, dword [0x448a1c]
jb 0x40f1b3
jmp 0x40f16e
jl 0x40f1b3
push 0x50040
push dword [0x448a10]
push 0x40f374
push 0x40f384
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 8]
call fcn.00403fa8
push eax
push 0x40f390
mov eax, dword [0x4488a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [0x448a08], 0
je 0x40f1c2
call dword [0x448a08]
call fcn.0040e95c
test al, al
jne 0x40f1d2
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
mov eax, dword [0x448a18]
call fcn.00403fa8
push eax
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004064c8
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x40f261
push 0x50030
push dword [0x448a10]
push 0x40f374
push 0x40f3cc
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x18]
call fcn.00405c48
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x40f3e0
call fcn.00403df4
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
mov eax, dword [0x4488a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x80
mov eax, dword [0x448a18]
call fcn.00403fa8
push eax
call sub.kernel32.dll_SetFileAttributesA
push dword [0x448a24]
push 0x40f408
push 0x40f41c
push dword [0x448a00]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00403e68
mov edx, dword [ebp - 0x1c]
mov eax, 0x80000002
call fcn.00406758
mov ebx, eax
push 0
push 0x400
mov eax, dword [0x448a18]
call fcn.0040661c
call fcn.00404654
mov ecx, eax
mov edx, 0x40f428
mov eax, ebx
call fcn.0040688c
mov ecx, dword [0x4489f4]
mov edx, 0x40f440
mov eax, ebx
call fcn.004068c4
mov eax, ebx
call fcn.00406904
push 0x50040
push dword [0x448a10]
push 0x40f374
push 0x40f384
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x20]
call fcn.00403fa8
push eax
push 0x40f450
mov eax, dword [0x4488a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.0040e9e8
Function at 0x40f474
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f5f5
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040e95c
test al, al
jne 0x40f49f
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
push 0
push 0x40f60c
push dword [0x448a00]
push 0x40f624
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 0x40f628
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 8]
mov ecx, dword [0x448a00]
mov edx, 0x40f63c
call fcn.00403df4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.0040ddc0
push dword [0x448a24]
push 0x40f650
push 0x40f664
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e68
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.00406728
mov ebx, eax
mov edx, dword [0x448a00]
mov eax, ebx
call fcn.00406910
mov eax, ebx
call fcn.00406904
push 0x50040
push dword [0x448a10]
push 0x40f670
push 0x40f680
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
push 0x40f68c
mov eax, dword [0x4488a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
push 0
push 0x40f6c0
push dword [0x4489fc]
push 0x40f6d8
lea edx, [ebp - 0x18]
mov eax, dword [0x4489fc]
call fcn.00406684
push dword [ebp - 0x18]
push 0x40f6ec
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403e68
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x40f6f8
call fcn.0040e640
mov eax, dword [ebp - 0x1c]
call fcn.00403fa8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1

Function at 0x40f700
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40f7b1
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x40f7c4
mov eax, dword [0x4489f0]
call fcn.00406828
mov edx, dword [ebp - 8]
mov eax, 0x448a18
call fcn.00403b60
mov eax, dword [0x448a00]
call fcn.00403fa8
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x448a28], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x40f76a
push 0
call sub.kernel32.dll_ExitProcess_1
push 4
push 0
push 0
push 0xf001f
mov eax, dword [0x448a28]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
mov eax, dword [0x4488a8]
call fcn.0040d070
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f7b8
lea eax, [ebp - 8]
call fcn.00403b0c
ret
Function at 0x411a34
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411a6d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403bfc
jmp 0x411a76
mov eax, ebx
mov edx, esi
call fcn.00403b60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411a80
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411aa1
mov al, byte [esp]
jmp 0x411aa3
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x412138
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x411fa0
mov eax, dword [0x44746c]
cmp byte [eax], 0
je 0x4121b4
mov eax, dword [0x4473c8]
call fcn.00402ab4
call fcn.0040298c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00410f08
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4121fc
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4121ea
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4473a8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x448660]
call fcn.0040495c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x412bd8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x412c3c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403d60
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00410dd0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412c43
lea eax, [ebp - 0xc]
call fcn.00403b0c
ret
Function at 0x4264e0
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
push 4
push 0x1000
mov eax, dword [ebx + 0x50]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp], eax
push 0
push 0
call fcn.00402b74
fild qword [ebx + 0x58]
fmulp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0x18]
call fcn.00406208
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edx
push eax
mov eax, dword [ebx + 0x50]
dec eax
xor edx, edx
not eax
not edx
and eax, dword [esp]
and edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_SetFilePointerEx
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_ReadFile
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_VirtualFree_1
add esp, 0x10
pop ebx
ret
Function at 0x430934
Capabilities:
Create process on windows

Disassembly:
push ebx
mov bl, byte [0x448c74]
xor bl, 1
test bl, bl
je 0x43097e
push 0x50044
mov eax, dword [0x448c80]
call fcn.00403fa8
push eax
push 0x430984
mov eax, dword [0x4488a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
cmp eax, 6
jne 0x43097e
push 5
push 0
push 0
push 0x4309e8
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
pop ebx
ret
Function at 0x4019db
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x58ced85
jg 0x401a01
inc edi
cmp edi, 0x1f6502b1
jl 0x4019e7
cmp dword [0x282941c], 0x400
jne 0x401a41
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
call dword [sym.imp.KERNEL32.dll_CancelIo]
push esi
call fcn.00401e41
push esi
call fcn.00401f83
push esi
call fcn.00401f92
add esp, 0xc
xor edi, edi
cmp edi, 0xd036
jge 0x401a52
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x401a78
inc edi
cmp edi, 0x263ff
jl 0x401a43
mov eax, dword [0x43b564]
mov dword [0x282941c], eax
call fcn.00401746
mov edi, 0x3078f
cmp dword [0x282941c], 0x51f
jne 0x401aa4
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a8c
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10
Function at 0x40408b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x421310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403012
and dword [ebp - 0x14], 0
cmp dword [0x4460c0], 0
mov dword [ebp - 0x18], eax
jne 0x40413e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4041e6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4041e6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4460c0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4460c4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4460c8], eax
call edi
push eax
call esi
mov dword [0x4460d0], eax
test eax, eax
je 0x40413e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4460cc], eax
mov eax, dword [0x4460cc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404197
cmp dword [0x4460d0], ecx
je 0x404197
push eax
call esi
push dword [0x4460d0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404197
test ebx, ebx
je 0x404197
call edi
test eax, eax
je 0x40418e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40418e
test byte [ebp - 8], 1
jne 0x404197
or dword [ebp + 0x10], 0x200000
jmp 0x4041ca
mov eax, dword [0x4460c4]
cmp eax, dword [ebp - 0x18]
je 0x4041ca
push eax
call esi
test eax, eax
je 0x4041ca
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4041ca
mov eax, dword [0x4460c8]
cmp eax, dword [ebp - 0x18]
je 0x4041ca
push eax
call esi
test eax, eax
je 0x4041ca
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4460c0]
call esi
test eax, eax
je 0x4041e6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4041e8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004043f6
leave
ret

Function at 0x4043f6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x421310]
jne 0x404400
repz ret
jmp fcn.004052c9