joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489578
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4896e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4896ce
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00408fec
mov dl, 1
mov eax, dword [0x464ccc]
call fcn.00464d24
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x4132d8]
call fcn.00403290
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00464da0
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4896cb
mov dl, 1
mov eax, dword [0x465e44]
call fcn.00465eac
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x489700
call fcn.004650ec
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004043a0
xor eax, eax
push ebp
push 0x4896c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004661ac
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00489708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4896cb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.004032c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.004032c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.004032c0
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4896f0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004040b8
ret
Function at 0x48c950
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x48ca0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004047a0
mov eax, dword [0x4b8cac]
cmp byte [eax], 0
je 0x48c9bf
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.00404b00
mov eax, dword [ebx]
call fcn.0040492c
push eax
mov eax, dword [ebx]
call fcn.0040491c
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.0040492c
mov edx, eax
dec edx
mov eax, ebx
call fcn.00404b00
jmp 0x48c9f1
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.00408fec
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.0040490c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ca11
lea eax, [ebp - 0x3f0]
call fcn.00404094
ret

Function at 0x48ca18
Capabilities:
Get graphical window text

Disassembly:
push ebx
add esp, 0xfffffc14
mov ebx, edx
mov edx, esp
push edx
push 0x3e8
push 0xd
push eax
call sub.user32.dll_SendMessageA
mov edx, ebx
mov eax, esp
call fcn.00408fec
add esp, 0x3ec
pop ebx
ret

Function at 0x4a3234
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a3262
mov eax, ebx
call fcn.004a3ce8
cmp dword [ebx + 0x40], 0
je 0x4a325b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a32d3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a32c5
cmp dword [ebx + 8], 0
je 0x4a3284
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a3296
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a32c5
cmp dword [ebx + 8], 0
je 0x4a3277
cmp eax, 3
je 0x4a32a9
dec eax
jne 0x4a3277
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a3277
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a3277
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a32f1
cmp dword [ebx + 0x14], 0xcc
je 0x4a32f1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a32fc
pop ebx
ret
Function at 0x4b4334
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x12c], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x4b440e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.00464270
mov edi, eax
test edi, edi
je 0x4b43f5
mov dword [ebp - 0x128], 0x128
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.00464290
test eax, eax
je 0x4b43ef
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404304
mov eax, dword [ebp - 0x12c]
mov edx, esi
call fcn.00408298
test eax, eax
jne 0x4b43de
mov eax, dword [ebp - 0x120]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x4b43ef
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x4b43ef
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.004642b0
test eax, eax
jne 0x4b438b
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4415
lea eax, [ebp - 0x12c]
call fcn.00404094
ret
Function at 0x41923c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x419274
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419274
xor eax, eax
jmp 0x419277
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x4193a5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4193db
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4193db
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x419704
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
xor eax, eax
mov dword [ebp - 0x6c], eax
call fcn.00426ae0
mov dword [ebp - 0x70], eax
cmp byte [0x4ac63c], 3
je 0x419744
cmp word [ebp + 0xc], 0x56b
jne 0x419744
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
test cx, cx
jne 0x419744
push dword [ebp + 8]
mov ecx, 0x496f38
call fcn.00438fc1
test eax, eax
jne 0x419749
jmp 0x41992a
push 0
call fcn.004759bc
add esp, 4
mov ecx, 0x496f38
call fcn.0045386e
call fcn.0041e5f6
push 0
call fcn.0058c02e
mov eax, dword [ebp + 8]
cmp eax, 3
ja case.default.0x419775
jmp dword [eax*4 + 0x41992e]
push 1
jmp 0x41985f
push 0
call fcn.00461cf6
jmp 0x4198d9
call fcn.00461c8f
nop
nop
jmp case.default.0x419775
push 1
mov ecx, 0x569000
call fcn.0041856a
mov dword [ebp - 0x6c], eax
test eax, eax
je case.default.0x419775
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0042c858
add esp, 4
mov dword [0x4ae4c0], 1
jmp 0x58c05c
mov esp, ebp
pop ebp
ret

Function at 0x41993e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
call fcn.0045386e
mov ecx, 0x500a6e
mov dword [ecx], 0x496f30
mov dword [ecx + 4], 0x496f58
mov dword [ecx + 8], 0x496f5c
mov dword [ecx + 0xc], 0x496f34
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
jmp 0x419989
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 4
jae 0x4199c1
mov ecx, dword [ebp - 0x18]
cmp dword [ecx + eax*4], 0
jne 0x419986
push eax
push 0x4195aa
push dword [0x4b6a68]
push 0x129
push dword [0x4b6a60]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + edx*4], eax
jmp 0x419986
mov dword [ebp - 8], 0x1b8
mov dword [ebp - 0xc], 0x280
call fcn.00437c50
mov byte [ebp - 4], 0
jmp 0x4199dd
jmp 0x5435d7
Function at 0x58f072
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
mov eax, dword [ebp + 8]
cmp eax, 0x40b
jne 0x58f0d3
cmp byte [0x505fa8], 2
jne 0x58f0d3
mov ecx, dword [0x500e28]
cmp byte [ecx + 0x2a], 0
jne 0x58f0d3
push ecx
call fcn.00482715
push eax
call fcn.0041d8fa
add esp, 4
push edx
push 0
jmp 0x58f0ac
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp al, 5
je 0x58f0c1
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.005448b1
jmp 0x58f0a9
add esp, 4
mov eax, dword [0x505f40]
call fcn.00586550
call fcn.00544961
popal
leave
ret 4

Function at 0x401740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0xf11004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x114], edx
push 0
push eax
mov dword [ebp - 0x110], ecx
call fcn.004098a0
mov edx, 0xf11844
add esp, 0xc
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x401780
lea edi, [ebp - 0x108]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401790
mov ecx, edx
lea eax, [ebp - 0x108]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0
push 0x80
push 3
push 0
push 1
mov ecx, edx
and ecx, 3
push 0x80000000
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0xf0903c]
mov edi, eax
mov dword [ebp - 0x11c], edi
cmp edi, 0xffffffff
je 0x4018cd
push ebx
push 0
push edi
call dword [0xf0904c]
mov esi, eax
xor edx, edx
mov ecx, esi
add ecx, 1
setb dl
neg edx
or edx, ecx
push edx
call fcn.0040a92d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x118], ebx
test ebx, ebx
je 0x4018cc
inc esi
push esi
push 0
push ebx
call fcn.004098a0
add esp, 0xc
mov dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push 0
push eax
push esi
push ebx
push edi
call dword [0xf090d8]
cmp dword [ebx], 0
mov esi, ebx
mov edi, ebx
je 0x4018b7
nop dword [eax + eax]
add edi, 0x208
cmp dword [edi], 0
jne 0x401840
nop dword [eax + eax]
xor eax, eax
xor byte [eax + esi + 8], al
lea ecx, [eax + esi]
inc eax
cmp eax, 0x200
jb 0x401852
lea ebx, [esi + 8]
push ebx
push 0xf0eab8
call fcn.0040d12c
add esp, 8
test eax, eax
jne 0x4018a6
push dword [esi]
call fcn.00407665
mov ecx, dword [ebp - 0x110]
mov dword [ecx], eax
mov ecx, dword [ebx - 4]
push dword [esi]
add ecx, 0x208
add ecx, edi
push ecx
push eax
call fcn.00417ae0
mov ecx, dword [ebp - 0x114]
add esp, 0x10
mov eax, dword [esi]
mov dword [ecx], eax
add esi, 0x208
cmp dword [esi], 0
jne 0x401850
mov ebx, dword [ebp - 0x118]
push dword [ebp - 0x11c]
call dword [0xf09048]
push ebx
call fcn.0040a928
add esp, 4
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040752c
mov esp, ebp
pop ebp
ret
Function at 0x1005370
Capabilities:
Execute shellcode via indirect call

Disassembly:
mov eax, dword [0x1008450]
push ebp
push esi
cmp eax, 0xffffffff
push edi
jne 0x1005384
mov ebp, 0x1008440
jmp 0x10053a1
mov eax, dword [0x100aae8]
push 0x2020
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x10054cc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 4
push 0x2000
push 0x400000
push 0
call edi
mov esi, eax
test esi, esi
je 0x10054b5
push 4
push 0x1000
push 0x10000
push esi
call edi
test eax, eax
je 0x10054a7
cmp ebp, 0x1008440
jne 0x1005408
mov eax, dword [0x1008440]
test eax, eax
jne 0x10053f3
mov dword [0x1008440], 0x1008440
mov eax, dword [0x1008444]
mov dword [ebp], 0x1008440
mov ecx, dword [0x1008444]
mov dword [ebp + 4], ecx

Function at 0x1005610
Capabilities:
Allocate or change rwx memory

Disassembly:
add dword [edx], ebx
or bl, byte [esi + 5]
mov edx, edi
inc ebx
mov ecx, 0x993ef0
inc esi
xchg eax, eax
shr esi, 3
sub ebx, dword [0x100867e]
sbb eax, 0x100867e
inc eax
rol esi, 0x19
dec eax
mov dword [0x100bd6a], 0x47ae950
rol esi, 0xe
neg esi
call fcn.010041be
xchg esi, eax
loop 0x10055e1
mov edi, eax
rol eax, 6
dec eax
mov edi, ebp
not eax
mov eax, 0x205d7038
mov edi, dword [0x10092e4]
and esi, edi
test edi, 0xd51e3ea
jo 0x1005681
and esi, edi
test esi, ecx
jo 0x10055d4
shl eax, 0x13
test eax, edi
jo 0x10055ed
xor esi, eax
sub esi, 0x13ab7367
call fcn.01001daf
not esi
call fcn.01004f58
xor esi, eax
add edx, esp
call fcn.01003f47
test edx, eax
jb 0x1005694
jae 0x10055e8
adc ebp, eax
insb byte es:[edi], dx
invalid
xor esi, ebx
mov esi, dword [0x100973a]
neg esi
not eax
dec eax
not ebx
xor edx, 0x9e26d4
dec esi
xor esi, eax
test edx, esp
loop 0x10056e2
invalid
shl esi, 0x15
mov esi, dword [0x100a514]
xor esi, 0x26624e2
inc esi
or esi, edi
push 0x40
xor esi, eax
or dword [0x100bd5e], ecx
ror eax, 5
mov dword [0x100bcbb], esi
dec esi
add al, byte [esi + 9]
invalid
mov ebx, 0x4e0100bc
xor esi, eax
rol eax, 0xd
sub ecx, dword [0x1008408]
call fcn.010020a8
inc esi
ror eax, 9
xor eax, eax
xchg esi, eax
rol ecx, 5
not edi
add esi, eax
ror eax, 0xb
not esi
rol eax, 0x17
call fcn.01001f6a
add dword [0x100bc39], ecx
invalid
invalid
nop
invalid
invalid
Function at 0x1005670
Capabilities:
Allocate or change rwx memory

Disassembly:
add dword [edx], ebx
or bl, byte [esi + 5]
mov edx, edi
inc ebx
mov ecx, 0x993ef0
inc esi
xchg eax, eax
shr esi, 3
sub ebx, dword [0x100867e]
sbb eax, 0x100867e
inc eax
rol esi, 0x19
dec eax
mov dword [0x100bd6a], 0x47ae950
rol esi, 0xe
neg esi
call fcn.010041be
xchg esi, eax
loop 0x10055e1
mov edi, eax
rol eax, 6
dec eax
mov edi, ebp
not eax
mov eax, 0x205d7038
mov edi, dword [0x10092e4]
and esi, edi
test edi, 0xd51e3ea
jo 0x1005681
and esi, edi
test esi, ecx
jo 0x10055d4
shl eax, 0x13
test eax, edi
jo 0x10055ed
xor esi, eax
sub esi, 0x13ab7367
call fcn.01001daf
not esi
call fcn.01004f58
xor esi, eax
add edx, esp
call fcn.01003f47
test edx, eax
jb 0x1005694
jae 0x10055e8
adc ebp, eax
insb byte es:[edi], dx
invalid
xor esi, ebx
mov esi, dword [0x100973a]
neg esi
not eax
dec eax
not ebx
xor edx, 0x9e26d4
dec esi
xor esi, eax
test edx, esp
loop 0x10056e2
invalid
shl esi, 0x15
mov esi, dword [0x100a514]
xor esi, 0x26624e2
inc esi
or esi, edi
push 0x40
xor esi, eax
or dword [0x100bd5e], ecx
ror eax, 5
mov dword [0x100bcbb], esi
dec esi
add al, byte [esi + 9]
invalid
mov ebx, 0x4e0100bc
xor esi, eax
rol eax, 0xd
sub ecx, dword [0x1008408]
call fcn.010020a8
inc esi
ror eax, 9
xor eax, eax
xchg esi, eax
rol ecx, 5
not edi
add esi, eax
ror eax, 0xb
not esi
rol eax, 0x17
call fcn.01001f6a
add dword [0x100bc39], ecx
invalid
invalid
nop
invalid
invalid

Function at 0x1005b60
Capabilities:
Hash data using murmur3

Disassembly:
sal byte [ebx], 1
cld
rol edx, 0x17
sub esi, 0xf9e4e3c
xor esi, dword [0x100befe]
add esi, 0xf9e4e3c
ror edx, 0x17
xor edi, esp
not eax
inc ebx
xor esi, 0xb9a9572
ror esi, 5
xor ebx, esp
add edx, esp
not esi
pop edx
mov dword [0x100bcb4], edi
xor esi, eax
xor ecx, 0xd1ab04
mov dword [0x100bdbe], esi
xor edx, ecx
xor edx, dword [0x100bece]
mov dword [0x100bde2], ecx
sub ecx, dword [0x100be81]
ror esi, 0xf
sub ecx, dword [0x100bf0e]
sub ebx, dword [0x100be4a]
xor ebx, eax
dec ecx
neg edx
neg edx
inc ecx
xor ebx, eax
rol esi, 0xf
mov dword [0x100bd62], ecx
xor edx, ecx
xor ecx, 0xd1ab04
xor esi, eax
add edx, 0x51d

Function at 0x10064d0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x100ac00]
sub esp, 0x41c
Function at 0x4013a0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0xc
mov dword [ebp - 0x7ec], str.SOFTWARE11asses
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x64
mov dword [ebp - 0x28], 0xc
call fcn.00401390
mov ecx, 0x43
mov edx, dword [ebp - 0x7ec]
mov word [edx + 0x12], cx
mov eax, 0x6c
mov ecx, dword [ebp - 0x7ec]
mov word [ecx + 0x14], ax
lea edx, [ebp - 0x34]
push edx
push 1
push 0
mov eax, dword [ebp - 0x7ec]
push eax
push 0x80000002
call dword [0x431328]
test eax, eax
je 0x4014b1
xor eax, eax
jmp 0x401757
lea ecx, [ebp - 0x34]
push ecx
push 1
push 0
push str.clsid083863f1_70de_11d0_bd40_00a0c911ce86instance129d7e40_c10d_11d0_afb9_00aa00b67a42
push 0x80000000
call dword [0x431328]
test eax, eax
je 0x4014d4
xor eax, eax
jmp 0x401757
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x4014ec
xor eax, eax
jmp 0x401757
push 1
mov edx, dword [0x431324]
push edx
call fcn.004019d0
add esp, 8
mov dword [0x431334], eax
mov eax, dword [0x431334]
push eax
jmp section..htext
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4018f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x40196a
cmp dword [ebp - 0x118], 0
je 0x40196a
jmp 0x4019cc
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x4019cc
mov dword [ebp - 0x120], 0x7dc35
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x431314], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x431330], edx
mov dword [ebp - 0x120], 0x7dc35
mov dword [ebp - 0x120], 0x7dc35
call fcn.004011b0
mov eax, dword [ebp + 8]
mov dword [0x43132c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401300
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x40196a
mov esp, ebp
pop ebp
ret
Function at 0x401a60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x431320], 0x24e1
mov eax, dword [0x431320]
sub eax, 0x24e1
mov dword [0x431320], eax
mov ecx, 1
test ecx, ecx
je 0x401b0b
mov edx, dword [0x431320]
cmp edx, dword [ebp + 0xc]
jb 0x401a97
jmp 0x401b0b
cmp dword [0x431320], 0
jne 0x401ab5
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401ab5
xor eax, eax
jmp 0x401b0b
mov eax, dword [ebp + 8]
add eax, dword [0x431320]
mov ecx, dword [eax]
add ecx, dword [0x431320]
mov edx, dword [ebp + 8]
add edx, dword [0x431320]
mov dword [edx], ecx
mov dword [ebp - 4], 0x263fa
mov eax, dword [0x431320]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x431320]
push eax
call fcn.004011c0
add esp, 8
mov ecx, dword [0x431320]
add ecx, 4
mov dword [0x431320], ecx
jmp 0x401a7d
mov esp, ebp
pop ebp
ret
Function at 0x10003480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x100034ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100042a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x100034cd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x100034cf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x10003553
jg 0x100034e4
test esi, esi
je 0x10003553
test ecx, ecx
jl 0x1000352d
jg 0x100034ee
test eax, eax
je 0x1000352d
cmp edi, ecx
jg 0x10003502
jl 0x100034f8
cmp esi, eax
jae 0x10003502
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.1000abb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x10003530
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10003553
jg 0x1000353a
test esi, esi
je 0x10003553
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10003553
push eax
push esi
push 1
push edx
call fcn.10011440
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003570
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x1000359b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10004380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x100035bd
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x100035bf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x1000365e
jg 0x100035dc
test esi, esi
je 0x1000365e
test ecx, ecx
jl 0x10003629
jg 0x100035e6
test eax, eax
je 0x10003629
cmp ebx, ecx
jg 0x100035fa
jl 0x100035f0
cmp esi, eax
jae 0x100035fa
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.1000abb0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x10003630
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x1000365e
jg 0x1000363a
test esi, esi
je 0x1000365e
cmp dword [edi + 0x4c], 0
je 0x1000365e
mov ecx, edi
call fcn.10004d50
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.10012404
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
pop edi
pop esi
sbb edx, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc