joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d4d0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ac7d1
push eax
mov dword fs:[0], esp
sub esp, 0xec
push edi
mov edi, ecx
mov eax, dword [edi + 0x5c]
test eax, eax
jne 0x46d50d
xor eax, eax
pop edi
mov ecx, dword [esp + 0xec]
mov dword fs:[0], ecx
add esp, 0xf8
ret
push esi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004a4233
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x10c], 0
call fcn.004a357b
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 1
push ecx
mov ecx, dword [edi + 0x5c]
call fcn.00466450
lea ecx, [esp + 8]
call fcn.004a44a2
lea ecx, [esp + 0x30]
call fcn.004a36df
mov edx, dword [esp + 8]
push 0
push 0
lea ecx, [esp + 0x10]
call dword [edx + 0x28]
push 0
push 0x1000
lea eax, [esp + 0x10]
push 1
push eax
lea ecx, [esp + 0x84]
call fcn.004a357b
lea ecx, [esp + 0x74]
lea esi, [edi + 0x60]
push ecx
mov ecx, esi
mov byte [esp + 0x100], 2
call fcn.004668c0
lea ecx, [esp + 0x74]
call fcn.004a36df
lea ecx, [esp + 8]
call fcn.004a44a3
mov eax, dword [edi + 0x5c]
lea edx, [esp + 0xb8]
push edx
push 0x3c
mov eax, dword [eax + 0xc8]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [esp + 0xb8]
push ecx
mov ecx, esi
call fcn.004640f0
mov edx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [edx + 0xdc]
mov dword [esi + 0xdc], eax
call fcn.004663f0
mov ecx, esi
call fcn.00466f00
mov eax, dword [edi + 0x5c]
push 0xffffffffffffffff
mov ecx, esi
mov eax, dword [eax + 0xe0]
mov dword [esi + 0xe0], eax
call fcn.004663f0
mov ecx, esi
call fcn.00466f00
mov ecx, dword [edi + 0x5c]
push 0xffffffffffffffff
mov eax, dword [ecx + 0xe4]
mov ecx, esi
mov dword [esi + 0xe4], eax
call fcn.004663f0
mov ecx, esi
call fcn.00466f00
mov ecx, dword [edi + 0x5c]
call fcn.004638d0
push eax
mov ecx, esi
call fcn.004638e0
mov ecx, dword [edi + 0x5c]
call fcn.00463e90
push eax
mov ecx, esi
call fcn.00463e30
mov ecx, dword [edi + 0x5c]
call fcn.00463fb0
push eax
mov ecx, esi
call fcn.00463f60
mov ecx, dword [edi + 0x5c]
push 0
call fcn.004631b0
push eax
mov ecx, esi
call fcn.004631c0
mov edx, dword [edi + 0x7c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x74]
mov byte [esp + 0xfc], 1
call fcn.004a3657
lea ecx, [esp + 0x30]
mov byte [esp + 0xfc], 0
call fcn.004a3657
lea ecx, [esp + 8]
mov dword [esp + 0xfc], 0xffffffff
call fcn.004a42bc
mov ecx, dword [esp + 0xf4]
pop esi
mov eax, 1
pop edi
mov dword fs:[0], ecx
add esp, 0xf8
ret
Function at 0x46ed30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ac9f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x158
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0xc], esi
mov dword [esi], method.CMenu.virtual_0
mov dword [esi + 4], ebx
lea ecx, [esi + 0x1c]
mov dword [esp + 0x16c], ebx
call fcn.0049a5e6
lea ecx, [esi + 0x24]
mov byte [esp + 0x16c], 1
call fcn.0049a5e6
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 7
mov byte [esp + 0x170], 2
mov dword [esi], method.CMenu.virtual_0
call edi
push 0xe
mov dword [esi + 0x2c], eax
call edi
push 0xf
mov dword [esi + 0x30], eax
call edi
push 4
mov dword [esi + 0x34], eax
call edi
push 0xd
mov dword [esi + 0x38], eax
call edi
push 0x14
mov dword [esi + 0x3c], eax
call edi
push 0x10
mov dword [esi + 0x40], eax
call edi
push 0x11
mov dword [esi + 0x44], eax
call edi
push 0xf
mov dword [esi + 0x48], eax
call edi
push 0x14
mov dword [esi + 0x4c], eax
call edi
push 0x10
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, 0x14
mov ecx, eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov ecx, 0x55
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push ebx
push eax
push ebx
push 0x29
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x154
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, esi
mov dword [esi + 0x10], eax
mov dword [esi + 8], ebx
call fcn.0046f850
mov eax, esi
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x164
ret
Function at 0x46f8a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4acad0
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004a63d4
mov edi, dword [eax + 0xc]
xor ebp, ebp
cmp edi, ebp
jne 0x46f8d3
xor al, al
jmp 0x46f9ff
mov ebx, dword [esp + 0x28]
push 0xf1
and ebx, 0xffff
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
jne 0x46f8f5
xor al, al
jmp 0x46f9ff
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebp
jne 0x46f908
xor al, al
jmp 0x46f9ff
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebp
jne 0x46f91c
xor al, al
jmp 0x46f9ff
xor eax, eax
xor ecx, ecx
mov ax, word [edi + 2]
push ebp
mov dword [esi + 0x14], eax
xor eax, eax
mov ax, word [edi + 4]
mov edx, dword [esi + 0x14]
mov dword [esi + 0x18], eax
mov cx, word [edi + 6]
push ecx
push 5
push eax
push edx
lea ecx, [esi + 0x1c]
call fcn.0049a6ab
test eax, eax
jne 0x46f950
xor al, al
jmp 0x46f9ff
mov eax, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], 0x5a2dc4
mov dword [esp + 0x20], ebp
call fcn.004a63d4
mov eax, dword [eax + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
lea ecx, [esp + 0x14]
call fcn.004a3230
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x10]
push 0xc0c0c0
neg eax
sbb eax, eax
and eax, edx
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
lea ecx, [esp + 0x10]
call fcn.004a3287
xor ecx, ecx
lea ebx, [edi + 8]
cmp word [edi + 6], cx
jbe 0x46f9e4
mov ax, word [ebx]
test ax, ax
je 0x46f9d6
mov edx, ecx
inc ecx
mov dword [esp + 0x28], ecx
push eax
push edx
mov ecx, esi
call fcn.0046fa20
mov ecx, dword [esp + 0x28]
xor edx, edx
inc ebp
mov dx, word [edi + 6]
add ebx, 2
cmp ebp, edx
jl 0x46f9ba
mov dword [esp + 0x10], method.CGdiObject.virtual_0
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.004a3287
mov al, 1
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x46ff60
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
push edi
push eax
mov ecx, esi
call fcn.004a48e0
mov edi, eax
mov eax, dword [esi]
test eax, eax
je 0x46ffa6
lea ecx, [esp + 8]
push 0x50
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea edx, [esp + 8]
push edx
call fcn.0048aad8
mov ecx, dword [esp + 0x68]
add esp, 4
pop edi
mov dword [ecx], eax
pop esi
add esp, 0x50
ret 0xc
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
mov eax, dword [edx]
push eax
push 0x5c0e1c
push ecx
call fcn.0048c400
add esp, 0xc
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
add esp, 0x50
ret 0xc
Function at 0x471a4d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4acc58
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x40]
test edx, edx
setne bl
inc ebx
test eax, eax
je 0x471a63
or bh, 0x80
lea ecx, [esp + 0xc]
call fcn.00476d80
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x28], 0
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00477040
lea eax, [esp + 0xc]
push ebx
push eax
mov ecx, esi
call fcn.00471ad0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], 0x5a31d8
call fcn.00476f80
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x476950
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x47699c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x47699c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x476986
push eax
call ebp
test ax, ax
jl 0x476994
inc esi
add edi, 4
cmp esi, 6
jb 0x476978
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00476650
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x481de0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ad853
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004a2639
xor eax, eax
mov dword [esi + 0x10], 0x5a458c
mov dword [esp + 0x10], eax
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi], method.CDC.virtual_0
mov byte [esp + 0x10], cl
mov dword [esi + 0x30], ecx
lea ecx, [esi + 0x20]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [ecx], eax
mov edx, dword [esp + 0x24]
mov dword [ecx + 4], eax
push edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
mov ecx, esi
call fcn.00481ee0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x481e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ad87b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], method.CDC.virtual_0
mov eax, dword [esi + 0x30]
mov dword [esp + 0x14], 1
push eax
call fcn.00482b20
lea ecx, [esi + 0x10]
mov dword [esp + 8], ecx
mov dword [ecx], method.CGdiObject.virtual_0
mov byte [esp + 0x14], 2
call fcn.004a3287
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004a276e
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x486570
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4add78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x4865b3
mov eax, dword [esi]
jmp 0x4865b5
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
push eax
push edi
call dword [ecx + 0x6c]
test eax, eax
jge 0x4865d1
push 0x5c7610
push edi
push eax
call fcn.004987d1
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x486631
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x486631
mov eax, dword [esi]
test eax, eax
je 0x486618
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x486628
push eax
call fcn.0049c1a4
add esp, 4
push esi
call fcn.0049c1a4
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8
Function at 0x49e7f0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49e828
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049c895
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0049c86d
jmp 0x49e834
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49ffeb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a002d
call fcn.004a63d4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a002d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a0024
xor eax, eax
jmp 0x4a0035
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a003b
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a6904
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a6932
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a6950
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a686a
jmp 0x4a6950
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a6950
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a686a
test edi, edi
mov eax, edi
jne 0x4a693a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1c3b092a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xc6360eb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
nop
add eax, reloc.comdlg32.dll_CommDlgExtendedError
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401098
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
push 0xa
push dword [ebp + 8]
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4010b8
jmp 0x4010d8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
mov dword [0x405590], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4010d5
jmp 0x4010d8
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x4010e0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
pushal
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x400]
push esi
push ebx
call sub.kernel32.dll_lstrcpyA
xor ecx, ecx
jmp 0x4010ff
inc ecx
cmp byte [ecx + ebx], 0x5c
jne 0x4010fe
mov byte [ecx + ebx], 0
lea esi, [ecx + esi + 1]
mov edi, 0x40333c
push str.HKEY_CLASSES_ROOT
push ebx
call edi
or eax, eax
jne 0x401125
mov eax, 0x80000000
jmp 0x401186
push str.HKEY_CURRENT_CONFIG
push ebx
call edi
or eax, eax
jne 0x401138
mov eax, 0x80000005
jmp 0x401186
push str.HKEY_CURRENT_USER
push ebx
call edi
or eax, eax
jne 0x40114b
mov eax, 0x80000001
jmp 0x401186
push str.HKEY_LOCAL_MACHINE
push ebx
call edi
or eax, eax
jne 0x40115e
mov eax, 0x80000002
jmp 0x401186
push str.HKEY_USERS
push ebx
call edi
or eax, eax
jne 0x401171
mov eax, 0x80000003
jmp 0x401186
push str.HKEY_DYN_DATA
push ebx
call edi
or eax, eax
jne 0x401184
mov eax, 0x80000006
jmp 0x401186
jmp 0x4011a2
mov byte [ebx], 0
push dword [ebp + 0x10]
push esi
push eax
push ebx
call fcn.004034e0
cmp byte [ebx], 0
je 0x4011a2
push ebx
push dword [ebp + 8]
call sub.kernel32.dll_SetEnvironmentVariableA
popal
leave
ret 0xc
Function at 0x401220
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 8], eax
mov ebx, eax
push dword [ebp + 0xc]
push ebx
call sub.user32.dll_LoadBitmapA
test eax, eax
je 0x4013ea
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
push ebx
call sub.user32.dll_LoadBitmapA
test eax, eax
je 0x4013ea
mov dword [ebp - 0x10], eax
push dword [ebp + 0x14]
push ebx
call sub.user32.dll_LoadBitmapA
test eax, eax
je 0x4013ea
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
test eax, eax
je 0x4013ea
mov esi, eax
push ebx
lea ebx, [ebp - 0x3c]
push ebx
push esi
call sub.user32.dll_GetWindowRect
lea edi, [ebp - 0x2c]
push edi
push dword [ebp + 8]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx]
sub eax, dword [edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
sub eax, dword [edi + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00401400
pop ebx
push 0
push esi
call sub.user32.dll_ShowWindow
jmp 0x4012d9
lea esi, [ebp - 0x6c]
mov dword [esi], 0x30
mov dword [esi + 4], 0x2000
mov dword [esi + 8], 0x4014d0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x14
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], 0x10
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0x4012c8
mov dword [esi + 0x18], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], 0
push esi
call sub.user32.dll_RegisterClassExA
push 0
push ebx
push dword [ebp + 0x18]
push dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x50000000
push 0
push 0x4012c8
push 0
call sub.user32.dll_CreateWindowExA
mov ebx, eax
push dword [ebp - 0xc]
push 0
push ebx
call sub.user32.dll_SetWindowLongA
push dword [ebp - 0x10]
push 4
push ebx
call sub.user32.dll_SetWindowLongA
push dword [ebp - 0x14]
push 8
push ebx
call sub.user32.dll_SetWindowLongA
push 0
push dword [ebp - 8]
push dword [ebp + 0x18]
push ebx
push 0
push 0
push 0
push 0
push 0x5000000e
push 0
push str.STATIC
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
push 0
push 0x172
push eax
call sub.user32.dll_SendMessageA
push edi
push dword [ebp - 4]
call sub.user32.dll_GetWindowRect
push dword [ebp - 4]
push 0xc
push ebx
call sub.user32.dll_SetWindowLongA
mov ecx, dword [edi + 0xc]
sub ecx, dword [edi + 4]
mov eax, dword [edi + 8]
sub eax, dword [edi]
push 2
push ecx
push eax
push 0
push 0
push 0
push ebx
call sub.user32.dll_SetWindowPos
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40180c
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x405a1a
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcpyA
push str..BAK
push esi
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401843
push 0
push esi
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
mov al, 0
jmp 0x401845
mov al, 1
mov byte [0x405e32], al
popal
leave
ret 4

Function at 0x40184f
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x405a1a
cmp dword [ebp + 8], 0
jne 0x401885
cmp byte [0x405e32], 0
jne 0x401874
push 0
push 0x40561a
push esi
call sub.kernel32.dll_CopyFileA
cmp byte [0x405e32], 0
jne 0x4018d5
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x4018d5
push 0x6b
push dword [0x4055b5]
call sub.user32.dll_IsDlgButtonChecked
cmp byte [0x405ed8], 1
jne 0x4018b0
cmp byte [0x405ed9], 1
jne 0x4018ab
mov eax, 1
jmp 0x4018b0
mov eax, 0
cmp eax, 1
jne 0x4018d3
push 0x40531d
call fcn.004017cb
push esi
call fcn.004017cb
push dword [0x405e1a]
push esi
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4018d5
jmp 0x401874
popal
leave
ret 4
Function at 0x4018da
Capabilities:
Check if file exists
Get file attributes
Get file size
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
pushal
mov dword [ebp - 0x804], 0
push 0x400
push 0x40561a
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x40561a
call sub.kernel32.dll_GetFileAttributesA
mov dword [0x405e1a], eax
test eax, 1
je 0x401924
xor eax, 1
push eax
push 0x40561a
call sub.kernel32.dll_SetFileAttributesA
push 0x40561a
call fcn.0040180c
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x40561a
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x401a4d
cmp byte [0x405ed8], 0
jne 0x401a48
push 0x40561a
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401a27
push 0x40561a
call fcn.00403480
cmp word [eax], 0x2e2a
je 0x4019aa
cmp word [eax], 0
je 0x4019aa
push 0x34
push 0x40561a
push 0x4050ce
push dword [0x4055b5]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x401a48
lea esi, [ebp - 0x400]
mov edi, 0x40561a
cmp byte [edi + 1], 0x3a
jne 0x4019c3
push edi
call fcn.00403480
mov edi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, 0
jbe 0x4019d6
inc eax
push esi
push eax
add esi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
pop eax
add esi, eax
push 0x2e
push str.Exe
push esi
call sub.kernel32.dll_RtlMoveMemory
pop esi
lea ebx, [ebp - 0x800]
push 0x40561a
push ebx
call sub.kernel32.dll_lstrcpyA
push ebx
call fcn.0040177a
push dword [0x4055b5]
push ebx
push esi
push 0x40561a
call fcn.00403400
cmp eax, 1
jne 0x401a25
jmp 0x401900
jmp 0x401a48
push 0x34
push 0x40561a
push 0x4052a2
push dword [0x4055b5]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x401a48
jmp 0x401900
jmp 0x401af1
push 0x405358
call fcn.004017cb
push 0x40561a
call fcn.004017cb
mov dword [0x405e1e], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x405e22], eax
cmp dword [ebp + 0xc], 0
jne 0x401a7c
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0x10], 1
jne 0x401a9b
add eax, 0x23a
add eax, dword [0x405590]
push 0x100
push eax
call fcn.004034c0
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
pop dword [0x405e2e]
push 0
push dword [0x405e2e]
push 0
push 4
push 0
push dword [0x405e1e]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x401acd
push 0x4050f6
call fcn.004017cb
jmp 0x401af1
mov dword [0x405e2a], eax
push 0
push 0
push 0
push 2
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x401ae6
jmp 0x401ac1
mov dword [0x405e26], eax
mov dword [ebp - 0x804], eax
popal
mov eax, dword [ebp - 0x804]
leave
ret 0xc