joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa61f70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov dword [ebp - 0x244], 0xffffffff
mov dword [ebp - 0x23c], 0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0xffffffff
jne 0xa61fad
xor eax, eax
jmp 0xa62084
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0xa61fe3
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0xa62084
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0xa62055
mov edx, dword [ebp - 0x230]
push edx
push 0
push 0xc50
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0xa62035
mov eax, dword [ebp - 0x230]
push eax
push 0
push 0x450
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0xa62055
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x23c], 0
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0xa61fe3
mov ecx, dword [ebp - 0x244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
mov esp, ebp
pop ebp
ret
Function at 0xa62850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea eax, [ebp - 0x5c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x10], 0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x58], 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 4]
mov dword [ebp - 0x68], eax
cmp dword [ebp + 0xc], 0
je 0xa628c5
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x68]
lea eax, [edx + eax*2]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
push ecx
call fcn.00a63770
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0xa6295f
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0xc], 0
je 0xa6290f
push 0xa6507c
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0x4000000
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0xa62938
jmp 0xa62953
mov dword [ebp - 0x64], 1
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
push eax
call fcn.00a63970
add esp, 4
mov eax, dword [ebp - 0x64]
mov esp, ebp
pop ebp
ret
Function at 0xa62d00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x10
call fcn.00a63570
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0xa62d43
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
add ecx, 8
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0xa62c90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0xa632d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.00a551d0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0xa632ed
jmp 0xa63344
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
lea edx, [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.00a631c0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0
je 0xa6333a
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00a63970
add esp, 4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esp, ebp
pop ebp
ret

Function at 0xa63350
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x41c], 0
mov dword [ebp - 0x420], 0
cmp dword [ebp + 8], 0
je 0xa633f7
push 0x104
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClassNameW]
push 0x104
lea edx, [ebp - 0x418]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0xa633d1
push 0xafa95768
push 4
push 0xa650f0
call fcn.00a517f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0xfffffffffffffff0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x41c], eax
push 0xffffffffffffffec
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x420], eax
jmp 0xa6343b
push 0xafa95768
push 4
push 0xa650f0
call fcn.00a517f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0xafa95768
push 4
push 0xa650f0
call fcn.00a517f0
add esp, 0xc
push eax
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x418]
push eax
mov ecx, dword [ebp - 0x420]
push ecx
mov edx, dword [ebp - 0x41c]
push edx
lea eax, [ebp - 0x208]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x1e4d4e17
push 0x11
push 0xa650f8
call fcn.00a517f0
add esp, 0xc
push eax
call fcn.00a632d0
add esp, 0x18
mov edx, dword [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esp, ebp
pop ebp
ret
Function at 0xa63490
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.00a551d0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0xa634b5
xor eax, eax
jmp 0xa63566
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathSkipRootW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xa634d5
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0xa634e0
mov ecx, dword [ebp - 4]
add ecx, 2
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5c
je 0xa63500
mov ecx, dword [ebp - 4]
movzx edx, word [ecx]
cmp edx, 0x2f
je 0xa63500
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
test ecx, ecx
jne 0xa6355e
mov edx, dword [ebp - 4]
mov ax, word [edx]
mov word [ebp - 0xc], ax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov word [edx], cx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0xa63539
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0xa63537
jmp 0xa63563
jmp 0xa63543
mov edx, dword [ebp - 0x10]
and edx, 0x10
jne 0xa63543
jmp 0xa63563
movzx eax, word [ebp - 0xc]
test eax, eax
jne 0xa63554
mov dword [ebp - 8], 1
jmp 0xa63563
mov ecx, dword [ebp - 4]
mov dx, word [ebp - 0xc]
mov word [ecx], dx
jmp 0xa634d7
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0xa63c15
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0xa63c46
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0xa63c4d
cmp ebx, dword [ebp + 8]
jae 0xa63c4d
xor eax, eax
jmp 0xa63e33
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0xa63c5e
xor eax, eax
inc eax
jmp 0xa63e32
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0xa63c70
cmp ecx, edx
jae 0xa63cd4
cmp dword [eax + 4], 0
je 0xa63c79
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0xa63c65
cmp dword [ebp + 8], 0
je 0xa63c93
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0xa63cd4
cmp eax, esi
jae 0xa63cd4
mov ecx, dword [0xa67790]
mov esi, ebx
and esi, 0xfffff000
xor eax, eax
test ecx, ecx
jle 0xa63cb5
cmp dword [eax*4 + 0xa67798], esi
je 0xa63cdb
inc eax
cmp eax, ecx
jl 0xa63ca7
lea eax, [ebp + 8]
push eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 0
push ebx
or edi, 0xffffffff
push edi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
jl 0xa63d4b
mov eax, dword [ebp + 8]
jmp 0xa63d4d
xor eax, eax
jmp 0xa63e32
test eax, eax
jle 0xa63c56
xor edx, edx
mov ebx, 0xa677d8
inc edx
mov edi, ebx
xchg dword [edi], edx
test edx, edx
jne 0xa63c56
cmp dword [eax*4 + 0xa67798], esi
je 0xa63d2a
lea eax, [ecx - 1]
test eax, eax
jl 0xa63d17
cmp dword [eax*4 + 0xa67798], esi
je 0xa63d13
dec eax
jns 0xa63d07
test eax, eax
jge 0xa63d28
cmp ecx, 0x10
jge 0xa63d23
inc ecx
mov dword [0xa67790], ecx
lea eax, [ecx - 1]
jmp 0xa63d2a
je 0xa63d42
xor edx, edx
test eax, eax
jl 0xa63d42
lea ecx, [edx*4 + 0xa67798]
mov edi, dword [ecx]
inc edx
cmp edx, eax
mov dword [ecx], esi
mov esi, edi
jle 0xa63d30
xor eax, eax
xchg dword [ebx], eax
jmp 0xa63c56
xor eax, eax
test eax, eax
je 0xa63e30
cmp dword [ebp - 8], 0x1000000
jne 0xa63e30
test byte [ebp - 0xc], 0xcc
je 0xa63dc2
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0xa63e30
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0xa63e30
cmp word [eax + 0x18], 0x10b
jne 0xa63e30
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0xa63e30
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0xa63dc2
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0xa63dc2
test byte [ecx + 0x27], 0x80
jne 0xa63cd4
xor eax, eax
inc eax
mov ecx, eax
mov edx, 0xa677d8
xchg dword [edx], ecx
test ecx, ecx
jne 0xa63e32
mov ecx, dword [0xa67790]
test ecx, ecx
mov edx, ecx
jle 0xa63df1
lea eax, [ecx*4 + 0xa67794]
cmp dword [eax], esi
je 0xa63df1
dec edx
sub eax, 4
test edx, edx
jg 0xa63de5
test edx, edx
jne 0xa63e22
push 0xf
pop ebx
cmp ecx, ebx
jg 0xa63dfe
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0xa63e16
lea eax, [edx*4 + 0xa67798]
mov edi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], esi
mov esi, edi
jle 0xa63e04
cmp ecx, 0x10
jge 0xa63e22
inc ecx
mov dword [0xa67790], ecx
xor eax, eax
mov ecx, 0xa677d8
xchg dword [ecx], eax
jmp 0xa63c56
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
mov eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401038
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40106a
mov ecx, dword [ebp + 8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x401066
cmp esi, eax
jae 0x40106a
dec edi
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401058
cmp esi, eax
jb 0x401070
pop esi
xor eax, eax
pop edi
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x401080
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
mov ecx, 0x42e6c0
call fcn.0041060c
mov ebx, eax
mov dword [ebp - 4], 1
test ebx, ebx
je 0x401134
test esi, esi
jne 0x401134
mov eax, dword [ebp + 8]
shr eax, 4
inc eax
push esi
movzx ecx, ax
push ecx
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
je 0x401118
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401112
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401112
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
add eax, esi
and ecx, 0xf
jbe 0x401101
cmp esi, eax
jae 0x401105
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4010f3
cmp esi, eax
jb 0x401109
xor eax, eax
jmp 0x401112
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
mov esi, eax
test eax, eax
jne 0x40113d
mov edi, dword [ebp - 4]
push edi
mov ecx, 0x42e6c0
call fcn.0041060c
mov ebx, eax
inc edi
mov dword [ebp - 4], edi
test ebx, ebx
jne 0x4010a5
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4072b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
push ebx
push esi
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov ecx, dword [sym.imp.ole32.dll_CoUninitialize]
lea eax, [esp + 0x10]
call fcn.004073d0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
push ecx
lea ecx, [esp + 0x20]
call fcn.00402b30
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x18]
call fcn.00403170
lea ebx, [esp + 0x18]
mov esi, eax
call fcn.00407330
cmp byte [esp + 0x10], 0
jne 0x40731d
call dword [esp + 0x14]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4074c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423398
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x42d210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
push ecx
mov byte [ebp - 4], 1
mov eax, esp
mov dword [ebp - 0x18], 0x200000
mov dword [eax], 0x200000
lea eax, [ebp - 0x40]
mov dword [ebp - 0x30], esp
push eax
call fcn.00407c10
lea esi, [ebp - 0x20]
call fcn.0040a3b0
mov eax, esi
lea esi, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0040a400
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x40]
lea esp, [esp]
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x24]
call fcn.00407eb0
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x18]
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4075f4
mov eax, dword [ebp - 0x18]
cmp ebx, eax
je 0x4075f4
cmp eax, edi
je 0x407595
cmp eax, dword [ebp - 0x38]
jbe 0x407590
mov cl, byte [ebp - 0x13]
push 0x42abf4
lea edx, [ebp - 0x11]
push edx
mov byte [ebp - 0x11], cl
call fcn.00411f68
mov edi, eax
mov dword [ebp - 0x3c], edi
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x28]
call fcn.00407eb0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x38]
lea eax, [ebp - 0x30]
call fcn.00407eb0
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x2c]
call fcn.00407eb0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], ecx
cmp eax, ecx
jbe 0x4075e3
mov cl, byte [ebp - 0x13]
push 0x42abf4
lea edx, [ebp - 0x12]
push edx
mov byte [ebp - 0x12], cl
call fcn.00411f68
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x4c]
call fcn.0040a450
jmp 0x407540
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
call fcn.0040a4a0
lea eax, [ebp - 0x1c]
call fcn.0040a440
lea eax, [ebp - 0x20]
call fcn.0040a3f0
test esi, esi
je 0x40761c
push esi
call fcn.00411259
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4076a0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x42d210]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
je 0x40771e
lea ecx, [ebp - 0x54]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x4076df
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
xor al, al
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004109a7
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
test eax, eax
jg 0x407703
jl 0x4076ef
test ecx, ecx
jae 0x407703
mov dl, byte [ebp - 0x45]
push 0x42abf4
lea eax, [ebp - 0x45]
push eax
mov byte [ebp - 0x45], dl
call fcn.00411f68
mov dword [esi + 4], eax
mov dword [esi], ecx
mov dword [edi], 0
mov al, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004109a7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ecx]
lea edx, [ebp - 0x44]
push edx
push ecx
call fcn.004116c3
add esp, 8
test eax, eax
jne 0x407755
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
test eax, eax
jg 0x407703
jl 0x407741
test ecx, ecx
jae 0x407703
mov al, byte [ebp - 0x45]
push 0x42abf4
lea ecx, [ebp - 0x45]
push ecx
mov byte [ebp - 0x45], al
call fcn.00411f68
call fcn.0041157d
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov dword [edi], edx
xor al, al
call fcn.004109a7
mov esp, ebp
pop ebp
ret
Function at 0x407d70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422c70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x42d210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
xor ebx, ebx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp + 8], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x18]
call fcn.00407eb0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
push ebx
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x407e00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], ebx
mov edx, dword [esi + 4]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], ebx
mov ebx, dword [esi]
mov ecx, ebx
add ecx, edi
mov eax, edx
adc eax, dword [ebp - 0x24]
cmp eax, edx
ja 0x407e35
jb 0x407e21
cmp ecx, ebx
jae 0x407e35
mov al, byte [ebp + 0xb]
push 0x42abf4
lea ecx, [ebp - 0x11]
push ecx
mov byte [ebp - 0x11], al
call fcn.00411f68
mov dword [esi], ecx
mov dword [esi + 4], eax
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x1c]
call fcn.00407eb0
mov eax, dword [ebp - 0x1c]
cmp edi, eax
jbe 0x407e60
mov dl, byte [ebp + 0xb]
push 0x42abf4
lea eax, [ebp - 0x12]
push eax
mov byte [ebp - 0x12], dl
call fcn.00411f68
add dword [ebp - 0x34], edi
sub eax, edi
mov dword [ebp - 0x2c], eax
xor ebx, ebx
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00407eb0
cmp dword [ebp - 0x20], ebx
ja 0x407dbb
mov ecx, dword [ebp + 0x10]
mov dword [ecx], ebx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408a40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423548
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42d210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp + 0xc]
push esi
push esi
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
call ebx
cmp eax, esi
jne 0x408abc
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x408ad7
mov dl, byte [ebp - 0x12]
push 0x42abf4
lea eax, [ebp - 0x11]
push eax
mov byte [ebp - 0x11], dl
call fcn.00411f68
push ecx
mov eax, esp
mov dword [eax], ecx
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], esp
call fcn.00408bd0
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp + 0xc]
push edi
push esi
push ecx
call ebx
test eax, eax
je 0x408b1a
cmp eax, edi
ja 0x408b1a
cmp eax, dword [ebp - 0x20]
je 0x408b0d
lea edx, [ebp - 0x24]
mov dword [ebp - 0x20], eax
call fcn.0040a090
mov edi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.004047f0
jmp 0x408b32
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
test esi, esi
je 0x408b3f
push esi
call fcn.00411259
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409a00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422c10
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x42d210]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ecx, dword [esi + 8]
cmp ecx, 0x7fffffff
jbe 0x409a54
mov al, byte [ebp + 0xf]
push 0x42abf4
lea ecx, [ebp - 0x11]
push ecx
mov byte [ebp - 0x11], al
call fcn.00411f68
mov eax, dword [esi]
mov edx, dword [ebp + 8]
push ecx
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jns 0x409a7a
mov al, byte [ebp + 0xf]
push 0x42abf4
lea ecx, [ebp - 0x12]
push ecx
mov byte [ebp - 0x12], al
call fcn.00411f68
cmp eax, dword [esi + 4]
je 0x409aa2
cmp eax, dword [esi + 8]
jbe 0x409a98
mov dl, byte [ebp + 0xf]
push 0x42abf4
lea eax, [ebp - 0x13]
push eax
mov byte [ebp - 0x13], dl
call fcn.00411f68
mov edx, esi
mov dword [esi + 4], eax
call fcn.0040a090
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409b50
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42348b
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x42d210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
push 0
mov dword [ebp - 0x220], 0
push 0x410
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x409bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x409c51
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
lea eax, [ebp - 0x22c]
call fcn.0040a290
lea eax, [ebp - 0x230]
push eax
push 4
lea ecx, [ebp - 0x220]
push ecx
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x409c34
mov ecx, dword [ebp - 0x220]
push 0x104
lea eax, [ebp - 0x21c]
push eax
push ecx
xor edx, edx
push esi
mov word [ebp - 0x14], dx
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x409c34
push ebx
lea ecx, [ebp - 0x21c]
call fcn.004047f0
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x22c], 0
jne 0x409c66
mov edx, dword [ebp - 0x228]
push edx
call dword [ebp - 0x224]
jmp 0x409c66
mov dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x22c], 0
jne 0x409c51
mov eax, dword [ebp - 0x228]
push eax
call dword [ebp - 0x224]
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
add eax, 0x10
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004109a7
mov esp, ebp
pop ebp
ret