joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048ea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
mov edi, 0x3ff
push edi
xor esi, esi
lea eax, [ebp - 0x413]
push esi
push eax
mov byte [ebp - 0x414], 0
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], esi
lea eax, [ebp - 0x414]
push edi
push eax
mov eax, dword [ebp + 8]
jne 0x404930
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x40493c
push dword [ebp + 0xc]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea eax, [ebp - 0x414]
push eax
lea edi, [ebp - 0x14]
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0x100
mov dword [ebp - 0xc], esi
call fcn.004066dd
mov edi, str.usbspeed.nirsoft.net
push edi
lea eax, [ebp - 0x14]
push eax
call fcn.00406785
mov ebx, eax
cmp ebx, esi
jl 0x4049cf
push edi
call sub.msvcrt.dll_strlen
pop ecx
lea ecx, [ebp - 0x14]
push ecx
call fcn.00406840
mov edi, str.usb3speed.nirsoft.net
push edi
call sub.msvcrt.dll_strlen
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x14]
push ecx
call fcn.004068a7
cmp dword [ebp + 0xc], esi
mov eax, dword [ebp - 0x14]
jne 0x4049ba
test eax, eax
jne 0x4049ab
mov eax, 0x4144fe
push eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x4049cf
test eax, eax
jne 0x4049c3
mov eax, 0x4144fe
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
call fcn.004013ac
lea esi, [ebp - 0x14]
call fcn.004066b8
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x404d8b
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push edi
mov edi, dword [esi + 0x1800]
mov eax, edi
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
push eax
push 0x3f9
push dword [esi + 4]
call ebx
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
mov eax, edi
neg eax
sbb eax, eax
and eax, 5
push eax
push 0x3fa
push dword [esi + 4]
call ebx
push eax
call ebp
xor eax, eax
test edi, edi
sete al
push eax
push 1
mov eax, esi
call fcn.004013c0
cmp dword [esi + 0xc], 0
pop edi
pop ebp
pop ebx
je 0x404e17
fldz
fcom qword [esi + 0x17e0]
fnstsw ax
test ah, 0x44
jnp 0x404e15
fcomp qword [esi + 0x17d8]
fnstsw ax
test ah, 0x44
jnp 0x404e17
cmp dword [esi + 0x16cc], 0
jne 0x404e17
xor eax, eax
inc eax
jmp 0x404e19
fstp st(0)
xor eax, eax
push eax
push 0x3fb
mov eax, esi
call fcn.004013c0
ret
Function at 0x405248
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push edi
push 0x20000000
push 3
mov esi, eax
push edi
push 3
push closesocket
lea eax, [esi + 0x20]
push eax
mov dword [esi + 0xc], 0x80000
mov dword [esi + 8], edi
mov dword [esi + 0x10], 0xb4
mov dword [esi + 0x14], 0x2710
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405328
push ebx
push dword [esi + 0xc]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
cmp dword [esi + 0x10], edi
mov dword [esi], eax
jbe 0x40530a
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
mov dword [ebp - 4], edi
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40530a
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
call fcn.004051dd
fst qword [esi + 0x128]
mov eax, dword [esi + 0x10]
shr eax, 1
cmp ebx, eax
jne 0x4052eb
fstp qword [esi + 0x138]
jmp 0x4052ed
fstp st(0)
push edi
mov eax, esi
call fcn.00405223
cmp dword [esi + 0x18], edi
jne 0x40530a
mov eax, dword [esi + 4]
sub eax, dword [esi]
cmp eax, dword [esi + 0x14]
ja 0x40530a
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x4052ae
call fcn.004051dd
fstp qword [esi + 0x128]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40532c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push ebx
push 0xa0000000
push 2
mov esi, eax
push ebx
push 1
push 0x40000000
lea eax, [esi + 0x20]
push eax
mov dword [esi + 0xc], 0x80000
mov dword [esi + 8], ebx
mov dword [esi + 0x10], 0xb4
mov dword [esi + 0x14], 0x3a98
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x405453
push edi
push dword [esi + 0xc]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
push ebx
mov dword [ebp - 0xc], eax
call sub.msvcrt.dll_srand
pop ecx
xor edi, edi
cmp dword [esi + 0xc], ebx
pop ecx
jbe 0x4053b0
call sub.msvcrt.dll_rand
imul eax, eax, 0xff
cdq
mov ecx, 0x7fff
idiv ecx
mov ecx, dword [ebp - 0xc]
mov byte [edi + ecx], al
inc edi
cmp edi, dword [esi + 0xc]
jb 0x405391
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
cmp dword [esi + 0x10], ebx
mov dword [esi], eax
jbe 0x405435
push ebx
lea eax, [ebp - 4]
push eax
push dword [esi + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40542e
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0xc]
jne 0x40542e
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [ebp - 4]
add dword [esi + 8], eax
call fcn.004051dd
fst qword [esi + 0x130]
mov eax, dword [esi + 0x10]
shr eax, 1
cmp edi, eax
jne 0x40540d
fstp qword [esi + 0x140]
jmp 0x40540f
fstp st(0)
push ebx
mov eax, esi
call fcn.00405223
cmp dword [esi + 0x18], ebx
jne 0x405435
mov eax, dword [esi + 4]
sub eax, dword [esi]
cmp eax, dword [esi + 0x14]
ja 0x405435
inc edi
cmp edi, dword [esi + 0x10]
jb 0x4053bf
jmp 0x405435
mov dword [esi + 0x1c], 1
call fcn.004051dd
fstp qword [esi + 0x130]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40549f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
fldz
push edi
xor edi, edi
fst qword [esi + 0x128]
lea eax, [ebp - 4]
fst qword [esi + 0x130]
push eax
fst qword [esi + 0x138]
push edi
fstp qword [esi + 0x140]
push esi
push 0x405457
push edi
push edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
pop edi
je 0x4054f2
push eax
mov dword [esi + 0x150], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret
Function at 0x405764
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.004055a0
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x4057f3
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea eax, [esi + 1]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4057dc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4057dc
push ebx
mov byte [edi + esi], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x4057e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x4057fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x405992
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x405ba3
Capabilities:
Get common file path

Disassembly:
cmp byte [0x419118], 0
push esi
mov esi, 0x419118
jne 0x405bc3
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [0x419220], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_strcpy
mov eax, dword [0x419220]
pop ecx
pop ecx
pop esi
ret

Function at 0x405eb2
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x4144fe
push eax
push eax
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x406428
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x30], str.RunAs
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
leave
ret
Function at 0x4064af
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test ebp, ebp
je 0x40650b
push ebx
push edi
push ebp
call sub.msvcrt.dll_strlen
pop ecx
lea ebx, [eax + 1]
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x406509
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
push ebp
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4067e8
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov esi, eax
call fcn.004055a0
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x406839
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call fcn.004066b8
mov edx, edi
mov eax, esi
call fcn.00406682
push edi
push dword [esi]
push ebx
call fcn.0040601d
mov eax, dword [esi]
add esp, 0xc
mov byte [edi + eax], 0
push ebx
mov dword [esi + 8], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop edi
jmp 0x40683b
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x407154
Capabilities:
Read .ini file

Disassembly:
push 0x418c18
push dword [esp + 0xc]
mov byte [esi], 0
push esi
push 0x4144fe
push dword [esp + 0x14]
push 0x418d20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, esi
ret

Function at 0x407178
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00413a90
push esi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x418c18
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x4144fe
push dword [ebp + 8]
push 0x418d20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
pop esi
je 0x4071e4
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_strcpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x4071e8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.00413a90
push esi
push edi
mov esi, 0x1000
push esi
lea eax, [ebp - 0x1003]
push 0
push eax
mov byte [ebp - 0x1004], 0
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x418c18
push edi
push esi
lea eax, [ebp - 0x1004]
push eax
push 0x4144fe
push dword [ebp + 8]
mov esi, 0x418d20
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x1004], 0
jne 0x407250
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x407252
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x407548
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00405992
test eax, eax
pop ecx
je 0x4075cf
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x418c18
push edi
call sub.msvcrt.dll_strcpy
push str.general
mov esi, 0x418d20
push esi
call sub.msvcrt.dll_strcpy
add esp, 0x10
push edi
push 0
push 0x414dbc
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x418d70
mov dword [0x418d68], eax
call fcn.00407154
push 0x3f
push str.TranslatorName
mov esi, 0x418db0
call fcn.00407154
push 0xff
push str.TranslatorURL
mov esi, 0x418df0
call fcn.00407154
add esp, 0x18
pop edi
pop esi
ret
Function at 0x40a658
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1110
call fcn.00413a90
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x3dc]
cmp dword [eax + 0xb78], 1
jne 0x40a7dc
mov esi, dword [ebp + 8]
mov al, byte [esi + 0xc25]
xor ebx, ebx
cmp al, bl
je 0x40a6bb
mov dword [ebp - 8], 0x5c3a58
mov byte [ebp - 8], al
mov dword [ebp - 0xc], ebx
jmp 0x40a6ac
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xa
jg 0x40a6bb
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
je 0x40a69b
mov eax, dword [edi + 0x3dc]
cmp dword [eax + 0x20], ebx
je 0x40a6cd
mov eax, edi
call fcn.0040cd05
mov eax, dword [edi + 0x3dc]
cmp dword [eax + 0x28], ebx
je 0x40a7a0
cmp dword [eax + 0x1c], ebx
je 0x40a7a0
call fcn.00405ad9
test eax, eax
je 0x40a7a0
push 0xfff
lea eax, [ebp - 0x110b]
push ebx
push eax
mov dword [edi + 0x3a8], 0xa
mov byte [ebp - 0x110c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push 0xff
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, esi
call fcn.0040215e
mov ebx, eax
call fcn.00406c85
mov ebx, eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.00402212
push eax
lea eax, [esi + 0x625]
push eax
push ebx
lea eax, [esi + 0xa0]
push eax
add esi, 0x120
push esi
lea eax, [ebp - 0x110c]
push str._s_r_n_s_r_n_s_r_n_s_r_n_s_r_n
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x1c
push 0x13
pop ebx
call fcn.00406c85
mov esi, dword [edi + 0x18c]
push eax
lea eax, [ebp - 0x110c]
push eax
lea eax, [edi + 0x174]
call fcn.0041051c
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [edi + 0x3dc]
cmp dword [eax + 0x24], ebx
je 0x40a7bd
movzx eax, byte [esi + 0xc25]
cmp al, bl
je 0x40a7bd
push eax
call fcn.00401ba4
pop ecx
mov edi, dword [edi + 0x3dc]
cmp dword [edi + 0x460], ebx
je 0x40a7d6
add edi, 0x60
push edi
mov eax, esi
call fcn.0040a1d9
mov dword [esi + 0xc78], ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40b90e
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40b940
push edi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x104]
push eax
push 0
push 0x415200
lea eax, [ebp - 0x208]
push eax
mov byte [ebp - 0x104], 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 1
push 2
lea eax, [ebp - 0x104]
push eax
call fcn.0040b29f
test eax, eax
je 0x40b9b8
push dword [esi + 0x108]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40b995
lea eax, [ebp - 0x104]
push eax
call fcn.00405764
pop ecx
jmp 0x40b99b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40b9ab
push dword [esi + 0x108]
call fcn.00405616
pop ecx
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
leave
ret
Function at 0x40bf6a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [eax + 0x3b0]
sub esp, 0x884
push ebx
push esi
push edi
lea ecx, [ebp - 4]
push ecx
call fcn.0040817b
test eax, eax
je 0x40c15e
mov eax, dword [ebp - 4]
add eax, 0xba5
xor ebx, ebx
cmp byte [eax], bl
mov dword [ebp - 4], eax
je 0x40c15e
mov esi, 0x104
push esi
lea eax, [ebp - 0x167]
push ebx
push eax
mov byte [ebp - 0x168], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x26f]
push ebx
push eax
mov byte [ebp - 0x270], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x377]
push ebx
push eax
mov byte [ebp - 0x378], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x47f]
push ebx
push eax
mov byte [ebp - 0x480], bl
call sub.msvcrt.dll_memset
push 0x3ff
lea eax, [ebp - 0x87f]
push ebx
push eax
mov byte [ebp - 0x880], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x168]
push eax
call fcn.00405ba3
add esp, 0x40
push str.notepad.exe
call sub.msvcrt.dll_strlen
mov edi, eax
lea eax, [ebp - 0x168]
push eax
call sub.msvcrt.dll_strlen
lea eax, [edi + eax + 1]
cmp eax, esi
pop ecx
pop ecx
jae 0x40c05b
lea eax, [ebp - 0x168]
push str.notepad.exe
push eax
lea eax, [ebp - 0x270]
call fcn.00405b2b
pop ecx
pop ecx
jmp 0x40c061
mov byte [ebp - 0x270], bl
push 0x415220
call sub.msvcrt.dll_strlen
mov edi, eax
lea eax, [ebp - 0x168]
push eax
call sub.msvcrt.dll_strlen
lea eax, [edi + eax + 1]
cmp eax, esi
pop ecx
pop ecx
jae 0x40c09e
lea eax, [ebp - 0x168]
push 0x415220
push eax
lea eax, [ebp - 0x378]
call fcn.00405b2b
pop ecx
pop ecx
jmp 0x40c0a4
mov byte [ebp - 0x378], bl
push dword [ebp - 4]
call sub.msvcrt.dll_strlen
mov edi, eax
lea eax, [ebp - 0x378]
push eax
call sub.msvcrt.dll_strlen
lea eax, [edi + eax + 1]
cmp eax, esi
pop ecx
pop ecx
jae 0x40c0dd
push dword [ebp - 4]
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x480]
call fcn.00405b2b
pop ecx
pop ecx
jmp 0x40c0e3
mov byte [ebp - 0x480], bl
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x270]
push eax
push str._s___s_
lea eax, [ebp - 0x880]
push 0x3ff
push eax
call sub.msvcrt.dll__snprintf
push 0x40
lea eax, [ebp - 0x5c]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
add esp, 0x20
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x270]
push eax
mov dword [ebp - 0x60], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40c15e
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c163
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
mov ebx, eax
cmp dword [ebx + 0x190], 0
jne 0x40c26e
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x108]
push eax
call fcn.004059a7
lea eax, [ebp - 0x108]
push 0x2e
push eax
call sub.msvcrt.dll_strrchr
add esp, 0x18
test eax, eax
je 0x40c1bd
mov byte [eax], 0
lea eax, [ebp - 0x108]
push str..cfg
push eax
call sub.msvcrt.dll_strcat
mov esi, dword [ebx + 0x3d4]
pop ecx
pop ecx
push str._cfg
call fcn.00406ac3
test eax, eax
jl 0x40c1ff
push edi
lea ecx, [ebp - 0x108]
push ecx
mov ecx, dword [ebx + 0x3d4]
inc eax
call fcn.00406ab3
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x318], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x314]
push eax
mov dword [ebp - 0x31c], 0x4157a0
mov byte [ebp - 0x314], 0
mov byte [ebp - 0x20f], 0
call sub.msvcrt.dll_strcpy
lea eax, [ebp - 0x20f]
push str.General
push eax
call sub.msvcrt.dll_strcpy
mov eax, dword [ebx + 0x3dc]
add esp, 0x10
lea esi, [ebp - 0x31c]
call fcn.00401e36
mov eax, ebx
call fcn.0040180f
mov ebx, dword [ebx + 0x3b0]
mov edi, esi
call fcn.00407a48
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40d0ff
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x419330]
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x4f
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x4f
mov byte [ebp - 4], 0x52
mov byte [ebp - 3], 0x53
mov byte [ebp - 2], 0
movsx eax, byte [ebp + eax - 8]
cmp dword [ecx + 8], eax
push esi
jne 0x40d196
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ax, ax
jns 0x40d196
push 0x10
call esi
test ax, ax
jns 0x40d196
push 0x12
call esi
test ax, ax
js 0x40d196
inc dword [0x419330]
mov eax, dword [0x419330]
cmp byte [ebp + eax - 8], 0
jne 0x40d19d
mov eax, dword [edi + 0x3dc]
and dword [0x419330], 0
add eax, 0xbc0
mov ecx, dword [eax]
neg ecx
sbb ecx, ecx
and ecx, 0xfffff830
add ecx, 0x7d0
mov dword [eax], ecx
mov eax, dword [edi + 0x3b0]
call fcn.00409559
jmp 0x40d19d
and dword [0x419330], 0
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x40e5dc
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
push dword [ebp + 8]
mov ebx, eax
xor eax, eax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x10], 2
call sub.WS2_32.dll_htons
test ebx, ebx
mov word [ebp - 0xe], ax
je 0x40e63c
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [esi + 4]
mov dword [ebp - 0xc], ebx
call sub.WS2_32.dll_connect
test eax, eax
jne 0x40e620
xor ebx, ebx
inc ebx
jmp 0x40e638
call fcn.0040e6b4
mov ebx, eax
test ebx, ebx
jne 0x40e638
mov edi, dword [esi]
call sub.WS2_32.dll_WSAGetLastError
push eax
mov ecx, esi
call dword [edi + 0x18]
mov eax, ebx
jmp 0x40e64a
mov eax, dword [esi]
push 0xffff
mov ecx, esi
call dword [eax + 0x18]
xor eax, eax
pop edi
pop ebx
leave
ret 4

Function at 0x40e650
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
push dword [ebp + 8]
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x14], 2
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
jne 0x40e68a
push dword [ebp + 8]
mov eax, esi
mov dword [esi + 0x10], 0x50
call fcn.0040e586
jmp 0x40e6af
push 0x50
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [esi + 4]
call sub.WS2_32.dll_connect
test eax, eax
jne 0x40e6aa
inc eax
jmp 0x40e6af
call fcn.0040e6b4
pop edi
leave
ret 4

Function at 0x40ec54
Capabilities:
Get file size

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
call fcn.00406538
add esi, 0x20
call fcn.0040320b
push dword [esp + 0x14]
call fcn.004055a0
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x40ecbb
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jbe 0x40ecb4
lea eax, [esi + 1]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
push esi
push edi
push ebx
call fcn.0040601d
add esp, 0xc
push edi
push dword [esp + 0x14]
mov byte [edi + esi], 0
call fcn.0040eaba
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret 8