joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df0bf
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4df0f7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004dd0ac
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004dd084
jmp 0x4df103
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4e07b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4e07f3
call fcn.004e64de
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4e07f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4e07ea
xor eax, eax
jmp 0x4e07fb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004e0801
pop edi
pop esi
pop ebx
ret 4

Function at 0x4e6a0e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e6a3c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e6a5a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e6974
jmp 0x4e6a5a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e6a5a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e6974
test edi, edi
mov eax, edi
jne 0x4e6a44
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4069ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 1
mov edi, ecx
mov dword [ebp - 0x5c], ebx
push dword [esi]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x58], ebx
mov byte [ebp - 0x54], bl
call fcn.00404f3d
test eax, eax
je 0x43e45a
push 2
push dword [esi]
lea ecx, [ebp - 0x68]
call fcn.00404f3d
test eax, eax
je 0x43e45a
mov eax, dword [ebp + 0x10]
cmp dword [eax], 4
je 0x43e47b
push ebx
push 0x48f910
push esi
push dword [ebp + 0xc]
mov ecx, edi
mov dword [eax], 2
push esi
call fcn.00406bec
mov bl, al
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0xc
sub al, 0x53
push esi
push edi
push 0x2000
mov edi, ecx
call fcn.00420ff6
pop ecx
push eax
lea ecx, [ebp - 8]
call fcn.0040538e
mov esi, dword [ebp + 8]
cmp word [esi], 0x23
je 0x406a89
push 3
pop ebx
mov eax, dword [ebp - 4]
dec dword [eax]
jne 0x406a7e
push eax
call fcn.0042106c
pop ecx
push dword [ebp - 8]
clc
call fcn.0042106c
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xf
push 0x492624
push esi
call fcn.00423a0b
add esp, 0xc
test eax, eax
je 0x406bd2
push 0xb
push 0x49267c
push esi
call fcn.00423a0b
add esp, 0xc
test eax, eax
je 0x406bda
push 0xd
invalid
Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
sar byte [eax + 0x1505], cl
test edx, edx
jle 0x415e80
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4

Function at 0x41710e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, edx
mov dword [ebp - 0x120], ecx
mov ecx, dword [ecx]
mov dword [ebp - 0x140], eax
push ebx
mov edx, dword [eax]
mov eax, ecx
shr eax, 0xb
and eax, 1
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x3c], eax
mov eax, ecx
shr eax, 9
push esi
mov esi, dword [ebp + 8]
and eax, 1
mov dword [ebp - 0xdc], eax
xor eax, 1
push edi
xor edi, edi
mov dword [ebp - 0xe8], eax
mov esi, dword [esi]
mov ebx, edi
push 0xfffffffffffffffe
pop eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c], eax
movsx eax, cl
and eax, dword [ebp - 0xc]
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x84], edi
mov dword [ebp - 8], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x98], edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0xb4], 0xff
mov dword [ebp - 0x12c], 0xfc00
mov dword [ebp - 0x148], 0xdc00
mov dword [ebp - 0x158], 0x2b
mov dword [ebp - 0x128], 0x7b
mov dword [ebp - 0xe4], 0x30
mov dword [ebp - 0x118], 0x29
mov dword [ebp - 0x90], 0x39
mov dword [ebp - 0x110], 0x3c
mov dword [ebp - 0x144], 0x52
mov dword [ebp - 0xe0], 0x27
mov dword [ebp - 0x154], 0x2d
mov dword [ebp - 0x100], 0x10
mov dword [ebp - 0x114], 0x17
mov dword [ebp - 0x14c], 0x20
mov dword [ebp - 0x104], 0x1d
mov dword [ebp - 0x134], 0x1e
mov dword [ebp - 0x10c], 0x1f
mov dword [ebp - 0x13c], 0x6e
mov dword [ebp - 0x11c], 0x6f
mov dword [ebp - 0x150], 0x70
mov dword [ebp - 0x124], 0x71
mov dword [ebp - 0xfc], 0x73
mov dword [ebp - 0x108], 0xf
Function at 0x418d01
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
push 0x1e
movzx ecx, word [esi]
add esi, 2
mov eax, ecx
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], eax
lea eax, [ecx - 0x21]
pop edx
cmp ax, 0x40
jbe 0x418def
movzx eax, cx
cmp eax, edx
jle 0x418d92
cmp eax, 0x1f
je 0x418dc8
cmp eax, 0x20
je 0x4559b4
add eax, 0xffffff92
cmp eax, 2
ja 0x418e94
cmp cx, 0x70
je 0x455992
lea edx, [esi + 0x20]
movzx eax, word [edx]
add eax, 0xffffff9e
cmp eax, 0xb
ja case.default.0x418d71
movzx eax, byte [eax + 0x418ea9]
jmp dword [eax*4 + 0x418e9d]
invalid

Function at 0x418eb5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, edx
mov dword [ebp - 4], 0x7d
push edi
xor edi, edi
mov dword [ebp - 0xc], eax
or esi, 0xffffffff
mov ebx, ecx
mov dword [eax], esi
movzx eax, word [ebx]
mov edx, 0x86
lea ecx, [edx - 1]
cmp ax, cx
je 0x418f5f
add ecx, 5
cmp ax, cx
je 0x418f5f
cmp ax, dx
je 0x418f5f
lea ecx, [edx + 5]
cmp ax, cx
je 0x418f5f
xor eax, eax
lea eax, [eax + 2]
xor edx, edx
lea ecx, [ebx + eax*2]
inc edx
call fcn.00418673
mov ecx, eax
movzx edx, word [ecx]
invalid

Function at 0x42aa80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.0042a97e
rol byte [eax], 0xcc
scasb al, byte es:[edi]
pop esp
and al, 0x24
and al, 0x24
and al, 0x24
push esi
add byte [eax], al
add byte [ebx], cl
sal byte [ebp + 0x28], 0x8b
dec esp
and al, 0x10
mov byte [ebx - 0xaff020], 0x75
or byte [esi - 0x18], dl
add byte [eax], al
or byte [ebp + 8], dh
push esi
invalid

Function at 0x4532fc
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov eax, edx
jne 0x453302
mov eax, ebx
movzx ecx, byte [ecx + 0x4a5750]
add ecx, eax
mov eax, dword [ebp - 0x44]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x44]
sub edi, ecx
sar edi, 1
test edi, edi
jle 0x417c22
movzx eax, word [ecx]
push 0x76
pop ebx
cmp eax, ebx
jae 0x45333e
mov al, byte [eax + 0x4b8920]
test byte [ebp - 0x3c87a18], dh
invalid
push dword [ebp + 0x7ff978]
mov ebx, dword [ebp - 8]
xor eax, eax
push dword [ebp + 0x28]
push edx
push 2
pop esi
mov word [ebx], ax
mov edx, esi
mov ecx, dword [ebp - 0x44]
call 0xe94186b1
push cs
les ecx, [ecx*4 - 0x74afc0fc]
inc ebp
mov esp, 0x4c08350
push eax
call 0xe9428030
push cs
add byte [eax], al
lea ecx, [esi + 0x7f]
add edi, esi
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0x44]
push 0x78
mov word [eax], cx
pop eax
mov word [ebx], ax
add ebx, esi
mov word [ebx], di
add ebx, esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], ebx
mov word [eax + 2], di
Function at 0x468a81
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
dec dword [0x4c4190]
jne 0x468a93
call 0x83468b23
mov eax, dword [0x4c7ef0]
mov ecx, dword [eax]
add eax, 4
mov dword [0x4c7ef0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xff7fdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
jns 0x468ad6
fadd qword [0x4bbac8]
fstp qword [ebp - 8]
fld qword [ebp - 8]
fmul qword [0x4bbaa0]
mov esp, ebp
pop ebp
ret

Function at 0x468ae6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
mov dword [0x4c7530], ecx
inc esi
mov ecx, 0x4c7530
mov edx, esi
mov eax, dword [ecx]
shr eax, 0x1e
xor eax, dword [ecx]
imul eax, eax, 0x6c078965
add eax, edx
inc edx
mov dword [ecx + 4], eax
add ecx, 4
cmp ecx, 0x4c7eec
jl 0x468af7
mov dword [0x4c4190], esi
mov dword [0x4c7518], esi
pop esi
ret

Function at 0x4693a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf70dc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.004691f9
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call 0xc6923f
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x4693e7
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.00469377
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x4693d1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x10390058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.103901a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1039007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1039006a
add dl, dl
jne 0x10390089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x103900dc
xor eax, eax
add dl, dl
jne 0x10390096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1039017d
add dl, dl
jne 0x103900a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103900b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103900bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103900c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x103900d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10390075
mov eax, 1
add dl, dl
jne 0x103900ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x103900f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x103900e1
sub eax, ebx
mov ebx, 1
jne 0x10390128
mov ecx, 1
add dl, dl
jne 0x1039010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10390119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10390105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10390075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1039013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1039014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10390136
cmp eax, 0x7d00
jae 0x1039016d
cmp eax, 0x500
jb 0x10390168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10390075
cmp eax, 0x7f
ja 0x10390170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10390075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1039019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10390075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x100137df
Capabilities:
Generate random numbers via winapi

Disassembly:
call fcn.100b0a27
sub byte [eax], al
add byte [eax - 0x64846fe], al
sub esp, dword [ebx + 0x14]
xchg esp, eax
or esi, dword [ebp + 0xd508a03]
sbb eax, 0x6e64b0a0
dec ebx
jae 0x1001385c
dec edi
lds esi, [edx - 0x7b1f398d]
out dx, al
out dx, eax
ljmp 0xfdb3
mov ebp, esp
push esi
xor esi, esi
cmp dword [0x10120740], 1
je 0x10013871
mov esi, 0x8000ffff
jmp 0x10013899
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [0x10120730]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x100138be
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call fcn.1008c61a
mov esi, eax
test esi, esi
jge 0x100138be
mov eax, dword [0x1011faf4]
cmp eax, 0x1011faf4
je 0x100138be
test byte [eax + 0x3c], 2
je 0x100138be
push esi
push 0x100034d8
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.1008c61a
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x420e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x420e8f
pop dword [ebp - 0x40]
mov eax, 0x420e8f
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x940f029e
add dword [ebp - 0x50], 0xba4342ad
mov dword [ebp - 0x4c], 0x15c98bb4
sub dword [ebp - 0x4c], 0xe3963f6f
mov dword [ebp - 0x48], 0x5f221f3a
sub dword [ebp - 0x48], 0x12d5db0c
mov dword [ebp - 0x44], 0xadcd054
sub dword [ebp - 0x44], 0xadcd054
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x22b47a2
add dword [ebp - 0x50], 0x724721b4
mov dword [ebp - 0x4c], 0x9a2f77b1
add dword [ebp - 0x4c], 0xa73ce9c4
mov dword [ebp - 0x48], 0x59c54326
add dword [ebp - 0x48], 0x9aa2946
mov dword [ebp - 0x44], 0x52711c56
sub dword [ebp - 0x44], 0x52711c56
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba4d
push 0
call eax
mov ecx, 0x2e45ad22
add ecx, 0xd1ba9c0a
xor esi, esi
add esi, eax
mov edi, 0x5b3cc53f
sub edi, 0x5af89f3f
add edi, dword [ebp - 0x40]
mov edx, 0xd70a74a9
xor dword [ebp - 0x14], 0x8db45dc7
mov ebx, dword [edi]
xor dword [ebp - 0x1c], 0x90c92f17
sub ebx, edx
sub dword [ebp - 0x14], 0xff5646cf
mov dword [esi], ebx
add esi, 0x9e29c147
add esi, 0x61d63ebd
add edi, 0x71855969
add edi, 0x8e7aa69b
loop 0x420f9e
add eax, 0x68d89b20
add eax, 0x97287c63
xor ebx, ebx
add ebx, eax
add eax, 0xa297876b
add eax, 0x5d68789a
mov ecx, 0x840faaf1
sub ecx, 0x83cfaaf1
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x422370
Capabilities:
Hash data using sha1

Disassembly:
call fcn.004193b0
add eax, 0xfffffffd
cmp eax, 0x25
ja case.0x422384.8
movzx eax, byte [eax + 0x42240c]
jmp dword [eax*4 + 0x4223f8]
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x4275a8
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x426470
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x4253c0
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x422340
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x415ef0
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x403d17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
push 0x4e2dbc
lea eax, [ebp - 0x38]
push eax
call sub.cw3220.DLL__strcpy
add esp, 8
push 0x4c707a
push 0x4e2dbc
call sub.cw3220.DLL__strcpy
add esp, 8
push 0x4e2dbc
lea edx, [ebp - 0x74]
push edx
call sub.cw3220.DLL__strcpy
add esp, 8
push 0x4c7080
lea ecx, [ebp - 0x74]
push ecx
call sub.cw3220.DLL__strcat
add esp, 8
push 0x4c7085
lea eax, [ebp - 0x74]
push eax
call sub.cw3220.DLL__fopen
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403d9e
push 0x4e3700
push 0x280
call fcn.0048e144
add esp, 8
call fcn.00491684
jmp 0x403fa7
push 0
mov edx, dword [0x4e2d20]
push dword [edx + 0x13]
push dword [ebp - 4]
call fcn.004a771b
add esp, 0xc
inc eax
je 0x403fa7
push dword [ebp - 4]
call sub.cw3220.DLL__fclose
pop ecx
push 0x4e2dbc
lea ecx, [ebp - 0x74]
push ecx
call sub.cw3220.DLL__strcpy
add esp, 8
push 0x4c7087
lea eax, [ebp - 0x74]
push eax
call sub.cw3220.DLL__strcat
add esp, 8
push 0x4c708c
lea edx, [ebp - 0x74]
push edx
call sub.cw3220.DLL__fopen
add esp, 8
mov dword [ebp - 4], eax
call fcn.00411419
push 0x4e3ff0
call fcn.0042f0f7
pop ecx
push 0x4e3ff0
call fcn.0042ed9b
pop ecx
xor edi, edi
push dword [0x4e2dac]
call fcn.00404052
pop ecx
mov ebx, eax
mov esi, dword [0x4e2d20]
jmp 0x403e55
push edi
push ebx
call fcn.00404067
add esp, 8
push ebx
call fcn.00404052
pop ecx
mov ebx, eax
test ebx, ebx
je 0x403e51
push ebx
call fcn.0040405c
pop ecx
cmp esi, eax
je 0x403e2f
mov esi, dword [esi + 0x13]
inc edi
test esi, esi
je 0x403e74
test ebx, ebx
jne 0x403e46
jmp 0x403e74
push 0x4c709c
push dword [ebp - 4]
call sub.cw3220.DLL__fprintf
add esp, 8
mov esi, 0x320
jmp 0x403e90
push dword [0x4e2dac]
call fcn.00404052
pop ecx
mov ebx, eax
test ebx, ebx
je 0x403ebc
push esi
push dword [ebp - 4]
push ebx
call fcn.004bbff4
add esp, 0xc
push ebx
call fcn.00404052
pop ecx
mov ebx, eax
test ebx, ebx
jne 0x403ea2
push dword [0x4d9f6c]
push 0xffffffffffffffff
push 0x4c70aa
push dword [ebp - 4]
call sub.cw3220.DLL__fprintf
add esp, 0x10
push dword [ebp - 4]
call sub.cw3220.DLL__fclose
pop ecx
push 0x4e2dbc
push 0
push dword [0x4e2d20]
push 0
push 0
call fcn.004a6480
add esp, 0x14
lea eax, [ebp - 0x14c]
push eax
call fcn.00404075
pop ecx
push 0x4e2dbc
push 0x4e3700
call sub.cw3220.DLL__strcpy
add esp, 8
push 0x4c70b2
push 0x4e3700
call sub.cw3220.DLL__strcat
add esp, 8
push 0x4c70b7
push 0x4e3700
call sub.cw3220.DLL__fopen
add esp, 8
mov dword [ebp - 4], eax
lea edx, [ebp - 0x14c]
push edx
call fcn.00462e6e
pop ecx
push dword [ebp - 4]
push 1
push 0xd6
lea ecx, [ebp - 0x14c]
push ecx
call sub.cw3220.DLL__fwrite
add esp, 0x10
push dword [ebp - 4]
call sub.cw3220.DLL__fclose
pop ecx
push dword [ebp - 4]
push 4
push 1
push 0x4c9c9c
call sub.cw3220.DLL__fwrite
add esp, 0x10
push dword [ebp - 4]
push 1
push 0x400
push 0x4e2f00
call sub.cw3220.DLL__fwrite
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
push 0x4e2dbc
call sub.cw3220.DLL__strcpy
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407f97
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
jmp 0x407f9f
push 0x4c73f7
push 0
push 0
call sub.KERNEL32.dll_CreateMutexA
mov ebx, eax
jmp 0x407fb2
test ebx, ebx
jne 0x407fc0
mov eax, 0xea60
jmp 0x408045
jmp 0x407fc3
push 0x3e8
push ebx
call sub.KERNEL32.dll_WaitForSingleObject
sub eax, 1
jb 0x407fe8
sub eax, 0x7f
je 0x407fe8
sub eax, 0x82
je 0x40802d
nop
nop
nop
nop
jmp 0x408035
jmp 0x407feb
push 0
push 0x4000000
push 0
push 0
push 0
push 0
push 0x4c73dc
call sub.KERNEL32.dll_CreateFileA
jmp 0x408007
cmp eax, 0xffffffff
jne 0x408016
jmp 0x40800f
mov esi, 0x7530
jmp 0x408035
jmp 0x408019
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x408021
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x408029
xor esi, esi
jmp 0x408035
jmp 0x408030
mov esi, 0xc350
test esi, esi
je 0x408040
push ebx
call fcn.00407f81
pop ecx
jmp 0x408043
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x411983
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0xc]
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0x4c7b0c
push esi
call sub.cw3220.DLL__sscanf
add esp, 0x10
push 0x4c7b19
push 0x4c7b12
call sub.cw3220.DLL__fopen
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x411a0e
push ebx
push 1
push 4
lea eax, [ebp - 8]
push eax
call sub.cw3220.DLL__fread
add esp, 0x10
cmp eax, 1
jb 0x411a0e
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jne 0x4119fb
push ebx
push 1
push 4
push edi
call sub.cw3220.DLL__fread
add esp, 0x10
cmp eax, 1
jb 0x411a0e
cmp dword [edi], 0
jne 0x411a97
jmp 0x411a0e
push ebx
push 1
push 4
push edi
call sub.cw3220.DLL__fread
add esp, 0x10
cmp eax, 1
jae 0x4119bf
push esi
push 0x4c7b1d
lea ecx, [ebp - 0x70]
push ecx
call sub.cw3220.DLL__sprintf
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
call sub.cw3220.DLL__system
pop ecx
test ebx, ebx
je 0x411a97
push ebx
call sub.cw3220.DLL__rewind
pop ecx
xor esi, esi
push ebx
push 1
push 4
lea eax, [ebp - 8]
push eax
call sub.cw3220.DLL__fread
add esp, 0x10
cmp eax, 1
jb 0x411a97
add esi, 4
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 4]
jne 0x411a7f
push 0
push esi
push ebx
call sub.cw3220.DLL__fseek
add esp, 0xc
mov dword [edi], 1
push ebx
push 1
push 4
push edi
call sub.cw3220.DLL__fwrite
add esp, 0x10
cmp eax, 1
jae 0x411a97
jmp 0x411a97
push ebx
push 1
push 4
push edi
call sub.cw3220.DLL__fread
add esp, 0x10
cmp eax, 1
jb 0x411a97
add esi, 4
jmp 0x411a37
push ebx
call sub.cw3220.DLL__fclose
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x411aa7
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff64
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
push 0x4c7b29
call sub.cw3220.DLL__unlink
pop ecx
push 0x4c7b30
call sub.cw3220.DLL__system
pop ecx
push 0x4c7b40
push 0x4c7b39
call sub.cw3220.DLL__fopen
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x411aeb
xor eax, eax
jmp 0x411c85
push 0x4c7b4a
push 0x4c7b43
call sub.cw3220.DLL__fopen
add esp, 8
mov esi, eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
push ebx
push 1
push 2
lea edx, [ebp - 0x12]
push edx
call sub.cw3220.DLL__fread
add esp, 0x10
cmp eax, 1
jb 0x411c70
push ebx
push 1
push 0x28
lea ecx, [ebp - 0x60]
push ecx
call sub.cw3220.DLL__fread
add esp, 0x10
cmp eax, 1
jb 0x411c70
mov al, byte [ebp - 0x5e]
mov byte [edi], al
mov dl, byte [ebp - 0x5d]
mov byte [edi + 1], dl
mov cl, byte [ebp - 0x5c]
mov byte [edi + 2], cl
mov al, byte [ebp - 0x5b]
mov byte [edi + 3], al
xor edx, edx
mov dl, byte [edi + 3]
sar edx, 5
and dl, 7
mov byte [ebp - 0x10], dl
mov cl, byte [edi + 3]
shl ecx, 3
and cl, 0xf8
xor eax, eax
mov al, byte [edi + 2]
sar eax, 5
and al, 7
or cl, al
mov byte [ebp - 0xf], cl
mov dl, byte [edi + 2]
shl edx, 3
and dl, 0xf8
xor ecx, ecx
mov cl, byte [edi + 1]
sar ecx, 5
and cl, 7
or dl, cl
mov byte [ebp - 0xe], dl
mov al, byte [edi + 1]
shl eax, 3
and al, 0xf8
xor edx, edx
mov dl, byte [edi]
sar edx, 5
and dl, 7
or al, dl
mov byte [ebp - 0xd], al
mov byte [ebp - 0x42], 0
xor ecx, ecx
mov cl, byte [ebp - 0xd]
xor eax, eax
mov al, byte [ebp - 0xe]
shl eax, 8
add ecx, eax
xor edx, edx
mov dl, byte [ebp - 0xf]
shl edx, 0x10
add ecx, edx
xor eax, eax
mov al, byte [ebp - 0x10]
shl eax, 0x18
add ecx, eax
push ecx
push 0x4c7b4d
lea edx, [ebp - 0x38]
push edx
call sub.cw3220.DLL__sprintf
add esp, 0xc
lea ecx, [ebp - 0x5a]
push ecx
mov al, byte [edi]
and eax, 0x1f
push eax
lea edx, [ebp - 0x38]
push edx
push dword [ebp - 8]
push 0x4c7b50
lea ecx, [ebp - 0x9c]
push ecx
call sub.cw3220.DLL__sprintf
add esp, 0x18
cmp dword [ebp - 8], 1
jne 0x411c26
push 1
lea eax, [ebp - 0x9c]
push eax
push dword [ebp + 0xc]
call sub.OWL50f.dll__TListBoxData_AddString_qpxc4bool
add esp, 0xc
jmp 0x411c3a
push 0
lea edx, [ebp - 0x9c]
push edx
push dword [ebp + 0xc]
call sub.OWL50f.dll__TListBoxData_AddString_qpxc4bool
add esp, 0xc
test esi, esi
je 0x411c65
push esi
push 1
push 4
lea ecx, [ebp - 8]
push ecx
call sub.cw3220.DLL__fwrite
add esp, 0x10
xor eax, eax
mov dword [ebp - 0x18], eax
push esi
push 1
push 4
lea edx, [ebp - 0x18]
push edx
call sub.cw3220.DLL__fwrite
add esp, 0x10
inc dword [ebp - 4]
inc dword [ebp - 8]
jmp 0x411b0b
test esi, esi
je 0x411c7b
push esi
call sub.cw3220.DLL__fclose
pop ecx
push ebx
call sub.cw3220.DLL__fclose
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret