joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012a7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x1012a8e1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x1012a8c5
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x1012a817
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x1012a7f5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x1012b329
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1012b380
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1012b380
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x1012b380
xor eax, eax
inc eax
jmp 0x1012b382
xor eax, eax
leave
ret 0x10
Function at 0x1012b3ab
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1012b419
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x101b9db4
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1012b410
cmp dword [ebp - 0xc], 4
jne 0x1012b410
cmp dword [ebp - 0x10], edi
je 0x1012b410
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101e5bc8], edi
xor eax, eax
jmp 0x1012b458
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x101e5bc8], edi
jge 0x1012b453
lea eax, [ebp - 0x34]
push eax
mov dword [0x101e5bc8], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x1012b453
cmp word [ebp - 0x14], 5
jb 0x1012b453
call fcn.1012b386
test eax, eax
je 0x1012b453
emms
mov dword [0x101e5bc8], 1
mov eax, dword [0x101e5bc8]
pop edi
leave
ret

Function at 0x1014e278
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1014e2b0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1014c305
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1014c2dd
jmp 0x1014e2bc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1014f969
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1014f9ab
call fcn.10155484
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1014f9ab
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1014f9a2
xor eax, eax
jmp 0x1014f9b3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1014f9b9
pop edi
pop esi
pop ebx
ret 4
Function at 0x401030
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403028], eax
push 0xa
push 0
push 0
push dword [0x403028]
call 0x401030
push eax
call sub.kernel32.dll_ExitProcess
lea esp, [esp]
lea ebx, [ebx]
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x2003
mov dword [ebp - 0x28], 0x401120
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], str.Menu1
mov dword [ebp - 8], str.WndClass
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [ebp + 8]
push 0
push 0
push 0x15e
push 0x1f4
push 0x64
push 0x8c
push 0xa0000
push str.PopUp_5
push str.WndClass
push 0x300
call sub.user32.dll_CreateWindowExA
mov dword [0x403024], eax
push 1
push dword [0x403024]
call sub.user32.dll_ShowWindow
push dword [0x403024]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
cmp eax, 0
je 0x401112
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4010ea
mov eax, 0
leave
ret 0x10
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
mov dword [ebp - 0x50], 1
cmp dword [ebp + 8], 0
jne 0x40101d
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [ebp + 8], eax
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x3000
push dword [ebp - 0x2c]
pop dword [0x40b9e6]
push 0x401160
pop dword [ebp - 0x28]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
push 0x1f4
push dword [ebp + 8]
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x4c], eax
mov dword [0x40ba02], eax
push dword [ebp - 0x4c]
pop dword [ebp - 0x18]
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
pop dword [ebp - 0x14]
mov dword [0x40ba0e], eax
push 0x10
pop dword [ebp - 0x10]
mov dword [ebp - 0xc], str.MAINMENU
mov dword [ebp - 8], str.Classeur_Projet
push dword [ebp - 0x4c]
pop dword [ebp - 4]
push dword [ebp - 0x4c]
pop dword [0x40ba06]
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassExA
mov dword [0x40ba0a], eax
push 0
lea eax, [ebp - 0x40]
push eax
push 0
push 0x30
call sub.USER32.dll_SystemParametersInfoA
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x58], edx
push dword [ebp + 0x1c]
push dword [ebp - 0x54]
call fcn.004019af
mov dword [ebp - 0x54], eax
push dword [ebp + 0x18]
push dword [ebp - 0x58]
call fcn.004019af
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x54]
shr edx, 1
mov dword [ebp - 0x48], edx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x58]
shr edx, 1
mov dword [ebp - 0x44], edx
mov dword [0x40b9ea], 0
mov dword [0x40b9ee], 0x2cf0000
push 0
push dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x48]
push dword [ebp - 0x44]
push dword [0x40b9ee]
push str.Archiver_for_asm_or_c_projects
push str.Classeur_Projet
push dword [0x40b9ea]
call sub.USER32.dll_CreateWindowExA
push 1
push dword [0x40b9f2]
call sub.USER32.dll_ShowWindow
push dword [0x40b9f2]
call sub.USER32.dll_UpdateWindow
mov eax, dword [ebp - 0x50]
leave
ret 0x18
Function at 0x401d4b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov dword [ebp - 4], 1
cmp byte [0x40a812], 0
jne 0x401db7
push 0x40a916
push 0x40a812
call sub.KERNEL32.dll_lstrcpyA
push 0x40a812
call sub.KERNEL32.dll_lstrlenA
lea edx, [0x40a812]
add edx, eax
cmp byte [edx], 0x5c
je 0x401d8a
dec edx
jmp 0x401d82
inc edx
push 0x40bc12
push edx
call sub.KERNEL32.dll_lstrcpyA
push 0x40a07e
push 0x40a812
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
jne 0x401db1
jmp 0x401e40
push eax
call sub.KERNEL32.dll_FindClose
push 0x40a812
push 0x40aa1a
call sub.KERNEL32.dll_lstrcpyA
push 0x40bc1b
push 0x40aa1a
call sub.KERNEL32.dll_lstrcatA
lea edx, [0x40aa1a]
push 0x40ba2a
push 0x40aa1a
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
jne 0x401df8
mov eax, 1
jmp 0x401e40
mov dword [0x40ba26], eax
push 0x40ba2a
push dword [0x40ba26]
call sub.KERNEL32.dll_FindNextFileA
or eax, eax
jne 0x401e1e
push dword [0x40ba26]
call sub.KERNEL32.dll_FindClose
jmp 0x401e40
cmp byte [0x40ba56], 0x2e
je 0x401e3e
push 0x40ba56
push 0
push 0x180
push dword [0x40ba16]
call sub.USER32.dll_SendMessageA
jmp 0x401dfd
mov eax, dword [ebp - 4]
leave
ret 4
Function at 0x4053b1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
mov dword [ebp - 0x5c], 0
cmp dword [ebp + 8], 0
jne 0x4053ce
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [ebp + 8], eax
cmp dword [ebp + 0xc], 0
jne 0x4053d9
jmp 0x405567
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 0x3000
push dword [ebp - 0x2c]
pop dword [0x40c1f4]
push 0x40556e
pop dword [ebp - 0x28]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
push 0x1f4
push dword [ebp + 8]
call sub.USER32.dll_LoadIconA
mov dword [ebp - 0x58], eax
mov dword [0x40c210], eax
push dword [ebp - 0x58]
pop dword [ebp - 0x18]
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
pop dword [ebp - 0x14]
mov dword [0x40c21c], eax
push 0x10
pop dword [ebp - 0x10]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x40c1c0
push dword [ebp - 0x58]
pop dword [ebp - 4]
push dword [ebp - 0x58]
pop dword [0x40c214]
lea eax, [ebp - 0x30]
push eax
call sub.USER32.dll_RegisterClassExA
mov dword [0x40c218], eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp + 0xc]
call sub.USER32.dll_GetClientRect
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], edx
push dword [ebp + 0x1c]
push dword [ebp - 0x38]
call fcn.004019af
mov dword [ebp - 0x38], eax
push dword [ebp + 0x18]
push dword [ebp - 0x3c]
call fcn.004019af
mov dword [ebp - 0x3c], eax
cmp dword [ebp + 0x10], 0
je 0x4054b6
push dword [ebp + 0x10]
push dword [ebp - 0x3c]
call fcn.004019af
mov dword [ebp - 0x50], eax
jmp 0x4054bd
mov dword [ebp - 0x50], 0
cmp dword [ebp + 0x14], 0
je 0x4054d3
push dword [ebp + 0x14]
push dword [ebp - 0x38]
call fcn.004019af
mov dword [ebp - 0x54], eax
jmp 0x4054da
mov dword [ebp - 0x54], 0
mov dword [0x40c1f8], 0
mov dword [0x40c1fc], 0x44c80000
push 0
push dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push dword [0x40c1fc]
push str.Entrer_le_nouveau_nom_de_larchive
push 0x40c1c0
push dword [0x40c1f8]
call sub.USER32.dll_CreateWindowExA
mov dword [ebp - 0x5c], eax
push 1
push dword [0x40c200]
call sub.USER32.dll_ShowWindow
push dword [0x40c200]
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0x50]
pop dword [0x40c224]
push dword [ebp - 0x54]
pop dword [0x40c228]
push dword [ebp - 0x3c]
pop dword [0x40c22c]
push dword [ebp - 0x38]
pop dword [0x40c230]
push dword [ebp + 0xc]
pop dword [0x40c220]
mov eax, dword [ebp - 0x5c]
leave
ret 0x18
Function at 0x406276
Capabilities:
Write file on windows

Disassembly:
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov ecx, 4
mov edx, 0
div ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edx
lea edi, [ebp - 0x250]
mov al, 9
stosb byte es:[edi], al
mov dword [ebp - 0x48], 0x20
cmp dword [ebp - 0x40], 0
je 0x406310
lodsd eax, dword [esi]
mov edx, eax
lea eax, [ebp - 0x25a]
push eax
push edx
call fcn.0040725b
mov ecx, 8
sub ecx, eax
push eax
mov al, 0x30
or ecx, ecx
je 0x4062c6
stosb byte es:[edi], al
dec ecx
jmp 0x4062be
pop ecx
push esi
lea esi, [ebp - 0x25a]
rep movsb byte es:[edi], byte [esi]
pop esi
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0
jne 0x40630b
mov al, 0xd
stosb byte es:[edi], al
mov al, 0xa
stosb byte es:[edi], al
mov al, 0
stosb byte es:[edi], al
dec edi
mov ecx, edi
lea edi, [ebp - 0x250]
sub ecx, edi
push 0
lea eax, [ebp - 0x268]
push eax
push ecx
push edi
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
mov al, 9
stosb byte es:[edi], al
mov dword [ebp - 0x48], 0x20
dec dword [ebp - 0x40]
jmp 0x40629e
cmp dword [ebp - 0x44], 0
je 0x40635a
mov dword [ebp - 0x260], 0
push edi
lea edi, [ebp - 0x260]
mov ecx, dword [ebp - 0x44]
rep movsb byte es:[edi], byte [esi]
pop edi
lea eax, [ebp - 0x25a]
push eax
push dword [ebp - 0x260]
call fcn.0040725b
mov ecx, 8
sub ecx, eax
push eax
mov al, 0x30
or ecx, ecx
je 0x406351
stosb byte es:[edi], al
dec ecx
jmp 0x406349
pop ecx
lea esi, [ebp - 0x25a]
rep movsb byte es:[edi], byte [esi]
mov al, 0xd
stosb byte es:[edi], al
mov al, 0xa
stosb byte es:[edi], al
mov ecx, edi
lea edi, [ebp - 0x250]
sub ecx, edi
cmp ecx, 3
jbe 0x406388
push 0
lea eax, [ebp - 0x268]
push eax
push ecx
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_WriteFile
mov dword [ebp - 0x26c], 1
ret

Function at 0x406745
Capabilities:
Write file on windows

Disassembly:
inc dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
push eax
call fcn.004078d0
or eax, eax
jne 0x40675c
jmp 0x406837
cmp byte [esi], 9
je 0x406768
jmp 0x406837
cmp ecx, 1
jne 0x40678a
push 0
lea eax, [ebp - 0x35c]
push eax
push 2
push 0x40b232
push dword [ebp - 0x350]
call sub.KERNEL32.dll_WriteFile
jmp fcn.00406745
inc esi
inc ecx
mov dword [ebp - 0x360], ecx
push 0x40b739
push 0x40b76e
push 1
lea eax, [ebp - 0x46c]
push eax
push esi
push 1
call fcn.00407714
or eax, eax
jne 0x4067cf
mov ecx, dword [ebp - 0x360]
push 0
lea eax, [ebp - 0x35c]
push eax
push ecx
push esi
push dword [ebp - 0x350]
call sub.KERNEL32.dll_WriteFile
jmp 0x406832
lea edi, [0x40ae2a]
mov ecx, eax
dec ecx
or ecx, ecx
je 0x4067de
rep movsb byte es:[edi], byte [esi]
push esi
lea esi, [0x40bbb6]
cmp byte [esi], 0
je 0x4067ed
movsb byte es:[edi], byte [esi]
jmp 0x4067e5
pop esi
cmp byte [esi], 0x2e
je 0x4067f6
inc esi
jmp 0x4067ee
cmp byte [esi], 0xd
je 0x406803
cmp byte [esi], 0
je 0x406803
movsb byte es:[edi], byte [esi]
jmp 0x4067f6
mov al, 0xd
stosb byte es:[edi], al
mov al, 0xa
stosb byte es:[edi], al
mov al, 0
stosb byte es:[edi], al
push 0x40ae2a
call sub.KERNEL32.dll_lstrlenA
mov ecx, eax
push 0
lea eax, [ebp - 0x35c]
push eax
push ecx
push 0x40ae2a
push dword [ebp - 0x350]
call sub.KERNEL32.dll_WriteFile
jmp fcn.00406745
ret
Function at 0x406838
Capabilities:
Write file on windows

Disassembly:
inc dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
push eax
call fcn.004078d0
or eax, eax
jne 0x40684c
jmp 0x406891
cmp byte [esi], 9
je 0x406855
jmp 0x406891
cmp ecx, 1
jne 0x406877
push 0
lea eax, [ebp - 0x35c]
push eax
push 2
push 0x40b232
push dword [ebp - 0x350]
call sub.KERNEL32.dll_WriteFile
jmp fcn.00406838
inc esi
inc ecx
push 0
lea eax, [ebp - 0x35c]
push eax
push ecx
push esi
push dword [ebp - 0x350]
call sub.KERNEL32.dll_WriteFile
jmp fcn.00406838
ret

Function at 0x40691d
Capabilities:
Write file on windows

Disassembly:
inc dword [ebp - 0x1c]
lea eax, [ebp - 0x3c]
push eax
call fcn.004078d0
or eax, eax
je 0x406936
or ecx, ecx
je 0x406936
cmp ecx, 1
jne 0x406938
jmp 0x4069a5
cmp byte [esi], 9
je 0x40693f
jmp 0x4069a5
inc esi
dec ecx
shr ecx, 3
mov dword [ebp - 0x364], ecx
shl ecx, 2
mov dword [ebp - 0x360], ecx
mov ebx, 0
lea edi, [ebp - 0x481]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x481]
push eax
call fcn.004072b4
mov dword ss:[ebx + ebp - 0x140], eax
add ebx, 4
dec dword [ebp - 0x364]
jne 0x406958
push 0
lea eax, [ebp - 0x35c]
push eax
push dword [ebp - 0x360]
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x350]
call sub.KERNEL32.dll_WriteFile
jmp fcn.0040691d
ret

Function at 0x4069a6
Capabilities:
Create directory

Disassembly:
push edi
push esi
push 0x40a506
lea eax, [ebp - 0x348]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea edi, [ebp - 0x348]
cmp byte [edi], 0
je 0x4069c7
inc edi
jmp 0x4069bf
mov al, 0x5c
stosb byte es:[edi], al
lea esi, [ebp - 0x140]
add esi, dword [ebp - 0x358]
inc esi
mov edx, esi
cmp byte [edx], 0x5c
je 0x4069e6
cmp byte [edx], 0
je 0x4069e6
inc edx
jmp 0x4069d9
cmp byte [edx], 0
jne 0x4069ed
jmp 0x406a0a
mov ecx, edx
sub ecx, esi
rep movsb byte es:[edi], byte [esi]
mov byte [edi], 0
push 0
lea eax, [ebp - 0x348]
push eax
call sub.KERNEL32.dll_CreateDirectoryA
mov al, 0x5c
stosb byte es:[edi], al
inc esi
jmp 0x4069d7
pop esi
pop edi
ret
Function at 0x406adb
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x406b2b
push 0
push 0
push 0x188
push dword [0x40ba16]
call sub.USER32.dll_SendMessageA
mov edx, eax
push 0x40ab1e
push edx
push 0x189
push dword [0x40ba16]
call sub.USER32.dll_SendMessageA
cmp eax, 0xffffffff
je 0x406b26
cmp eax, 0
jbe 0x406b26
jmp 0x406b2b
jmp 0x406bee
push 0x40a916
push 0x40ac22
call sub.KERNEL32.dll_lstrcpyA
push 0x40a916
call sub.KERNEL32.dll_lstrlenA
lea edi, [0x40ac22]
add edi, eax
cmp byte [edi], 0x5c
je 0x406b54
dec edi
jmp 0x406b4c
inc edi
push str.classeur_
push edi
call sub.KERNEL32.dll_lstrcpyA
cmp byte [edi], 0
je 0x406b68
inc edi
jmp 0x406b60
push 0x40ab1e
push edi
call sub.KERNEL32.dll_lstrcpyA
cmp dword [0x40bbb2], 0
je 0x406bbf
push 0x40bbb6
push 0x14
push 0xd
push dword [0x40bbb2]
call sub.USER32.dll_SendMessageA
cmp byte [0x40bbb6], 0
je 0x406bbf
push 0x40bbb6
call fcn.00407d80
or eax, eax
je 0x406bb8
or ecx, ecx
je 0x406bb8
push eax
push 0x40bbb6
call sub.KERNEL32.dll_lstrcpyA
jmp 0x406bbf
mov byte [0x40bbb6], 0
lea edx, [0x40ac22]
push dword [ebp + 8]
call fcn.00406393
cmp byte [0x40b772], 0
je 0x406bee
push 0
push str.EditMasm
call sub.USER32.dll_FindWindowA
or eax, eax
je 0x406bee
push dword [ebp + 8]
call fcn.0040716c
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x406c5e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov edx, edi
mov ecx, ebp
lea edi, [ebp - 0x28]
sub ecx, edi
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov edi, edx
mov dword [ebp - 0x24], 0
lea eax, [ebp - 0x28]
push eax
push 0x11
push dword [ebp + 8]
call sub.SHELL32.dll_SHGetSpecialFolderLocation
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
call sub.SHELL32.dll_SHBrowseForFolderA
or eax, eax
jne 0x406ca7
jmp 0x406cbe
mov ebx, eax
push dword [ebp + 0xc]
push ebx
call sub.SHELL32.dll_SHGetPathFromIDListA
cmp eax, 1
jne 0x406cbe
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x24]
pop ebx
leave
ret 0xc
Function at 0x40737d
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe7c
push esi
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov dword [ebp - 4], eax
xor ecx, ecx
mov esi, dword [ebp - 4]
lodsb al, byte [esi]
cmp al, 0
je 0x4073a1
cmp al, 0x22
jne 0x407395
inc ecx
jmp 0x407395
push ecx
shr ecx, 1
shl ecx, 1
pop eax
cmp eax, ecx
je 0x4073b6
pop edi
pop esi
mov eax, 3
leave
ret 8
mov esi, dword [ebp - 4]
lea edi, [ebp - 0xc4]
lodsb al, byte [esi]
cmp al, 0
je 0x4073cd
cmp al, 9
jne 0x4073ca
mov al, 0x20
stosb byte es:[edi], al
jmp 0x4073bf
stosb byte es:[edi], al
lea eax, [ebp - 0xc4]
mov esi, eax
mov edi, eax
lodsb al, byte [esi]
cmp al, 0
jne 0x4073df
jmp 0x4073fa
cmp al, 0x22
jne 0x4073e6
stosb byte es:[edi], al
jmp 0x4073e9
stosb byte es:[edi], al
jmp 0x4073d8
lodsb al, byte [esi]
cmp al, 0x20
jne 0x4073f0
mov al, 0xfe
cmp al, 0x22
jne 0x4073f7
stosb byte es:[edi], al
jmp 0x4073d8
stosb byte es:[edi], al
jmp 0x4073e9
stosb byte es:[edi], al
lea eax, [ebp - 0xc4]
mov esi, eax
lea edi, [ebp - 0x184]
mov ecx, 0
lodsb al, byte [esi]
cmp al, 0x20
je 0x40740e
cmp ecx, dword [ebp + 8]
je 0x40742d
lodsb al, byte [esi]
cmp al, 0
je 0x40743a
cmp al, 0x20
jne 0x40742b
lodsb al, byte [esi]
cmp al, 0x20
je 0x407421
inc ecx
cmp al, 0
je 0x40743a
jmp 0x407413
stosb byte es:[edi], al
lodsb al, byte [esi]
cmp al, 0x20
je 0x40743a
cmp al, 0
je 0x40743a
stosb byte es:[edi], al
jmp 0x40742e
mov al, 0
stosb byte es:[edi], al
cmp ecx, dword [ebp + 8]
jae 0x407453
mov edi, dword [ebp + 0xc]
mov al, 0
stosb byte es:[edi], al
mov eax, 2
pop edi
pop esi
leave
ret 8
lea eax, [ebp - 0x184]
mov esi, eax
mov edi, dword [ebp + 0xc]
lodsb al, byte [esi]
cmp al, 0
je 0x407470
cmp al, 0x22
je 0x40745e
cmp al, 0xfe
jne 0x40746d
mov al, 0x20
stosb byte es:[edi], al
jmp 0x40745e
stosb byte es:[edi], al
mov esi, dword [ebp + 0xc]
lodsb al, byte [esi]
cmp al, 0
jne 0x407484
pop edi
pop esi
mov eax, 4
leave
ret 8
mov eax, 1
pop edi
pop esi
leave
ret 8
Function at 0x407634
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, dword [ebp + 0xc]
push 0x13e
push 0x40c3e6
call sub.KERNEL32.dll_RtlZeroMemory
push 0x40c3e6
push dword [ebp + 8]
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
jne 0x40766d
mov dword [ebp - 4], 0
jmp 0x40770a
mov edx, eax
push edx
call sub.KERNEL32.dll_FindClose
mov dword [ebp - 4], 1
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4076a4
mov dword [ebp - 4], 0
jmp 0x40770a
mov dword [ebp - 0x14], eax
mov ecx, dword [0x40c406]
mov dword [ebx + 8], ecx
inc ecx
add ecx, 0x20
and ecx, 0xfffffff0
push ecx
push 0x42
call sub.KERNEL32.dll_GlobalAlloc
or eax, eax
jne 0x4076cc
mov dword [ebp - 4], 0
jmp 0x40770a
mov dword [ebp - 0xc], eax
mov dword [ebx], eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0x10], eax
mov dword [ebx + 4], eax
mov eax, dword [0x40c406]
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call sub.KERNEL32.dll_ReadFile
push dword [ebp - 0x14]
call sub.KERNEL32.dll_CloseHandle
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop ebx
leave
ret 8

Function at 0x407f48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [0x40c940], 0x44
push 0x40c940
call sub.KERNEL32.dll_GetStartupInfoA
push 0x40c984
push 0x40c940
push 0
push 0
push 0x20
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.dll_CreateProcessA
or eax, eax
jne 0x407f85
jmp 0x407faf
push dword [0x40c984]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x40c984], 0
push dword [0x40c988]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x40c988], 0
leave
ret 4

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x3e25773f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x42e1d0
nop
mov ecx, 0x3de31d37
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219