joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x10]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x418
push eax
call ebp
test eax, eax
jbe 0x4026e3
push edi
mov edi, eax
lea ecx, [ecx]
mov ecx, dword [esi + 0x10]
push 0
dec edi
push edi
push 0x416
push ecx
call ebp
test edi, edi
ja 0x4026c0
mov edx, dword [esi + 0x10]
push 0
push 0
push 0x418
push edx
call ebp
pop edi
mov eax, dword [esi + 8]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
jbe 0x40277d
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
push ecx
push eax
push 0x444
push edx
call ebp
mov eax, dword [esi + 0x10]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x10]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp byte [0x461b34], 0
je 0x402733
or eax, 0x800
jmp 0x402738
and eax, 0xfffff7ff
mov edx, dword [esi + 0x10]
push eax
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [esi + 0x20]
mov dl, byte [0x461b34]
test ecx, ecx
jne 0x402765
mov eax, dword [esi + 0x2c]
add eax, 2
mov dword [esi + 0x1c], eax
test dl, dl
jne 0x402765
add eax, 3
mov dword [esi + 0x1c], eax
cmp ecx, 1
jne 0x40277d
mov eax, dword [esi + 0x28]
add eax, 2
mov dword [esi + 0x18], eax
test dl, dl
jne 0x40277d
add eax, 2
mov dword [esi + 0x18], eax
pop ebp
ret

Function at 0x403b60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x84
push ebx
push ebp
mov ebp, dword [esp + 0x90]
push esi
push 0x41af80
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.MSVCR90.dll__wfopen]
mov esi, eax
xor ecx, ecx
add esp, 8
mov word [ebp], cx
cmp esi, ebx
je 0x403c2c
push edi
push 0x80
lea edx, [esp + 0x18]
push ebx
push edx
call sub.MSVCR90.dll_memset
mov edi, dword [sym.imp.MSVCR90.dll_fread]
push esi
push 1
lea eax, [esp + 0x28]
push 0x10
push eax
call edi
add esp, 0x1c
cmp eax, 1
jne 0x403c21
push 5
lea ecx, [esp + 0x18]
push str.LCLNG
push ecx
call dword [sym.imp.MSVCR90.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x403c21
push esi
push 1
lea edx, [esp + 0x18]
push 2
push edx
call edi
movsx eax, word [esp + 0x20]
push esi
push 1
add eax, eax
push eax
lea ecx, [esp + 0x30]
push ecx
call edi
movsx edx, word [esp + 0x30]
xor eax, eax
mov word [esp + edx*2 + 0x34], ax
lea eax, [esp + 0x34]
mov edx, ebp
mov ecx, eax
add esp, 0x20
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403c10
mov bl, 1
push esi
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x84
ret
Function at 0x405220
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1008
call fcn.00413cd0
mov eax, dword [esp + 0x100c]
push ebx
push ebp
push edi
push eax
mov edx, esi
call fcn.004051a0
push 0x1004
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, eax
call sub.MSVCR90.dll_memset
mov ebx, dword [esp + 0x1028]
mov ecx, dword [esi + 0x38]
mov edx, dword [edi]
mov edx, dword [edx + 4]
add esp, 0xc
lea ebp, [ebx + ebx*4]
push 0x7ff
add ebp, ebp
lea eax, [esp + 0x10]
push eax
add ebp, ebp
mov eax, dword [ecx + ebp]
push eax
push esi
mov ecx, edi
call edx
mov ecx, dword [esi + 8]
xor eax, eax
lea edi, [esi + 0x28]
mov word [esp + 0x100a], ax
test edi, edi
je 0x405298
mov dword [edi], eax
mov dword [edi + 4], ebx
mov eax, edi
jmp 0x40529a
xor eax, eax
mov edx, dword [esp + 0x1018]
push eax
push edx
push 0x1038
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x38]
mov edi, dword [edi]
mov ebx, dword [esi + 0x2c]
add ecx, ebp
add edi, 2
add ebx, 2
call fcn.00401170
mov ebp, eax
push esi
push 1
sub ebp, 4
call fcn.004065e0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add esp, 8
push 0
push eax
push 0x66
push ecx
push 0xf
push ebp
push ebx
push edi
push 0x50000080
lea edx, [esp + 0x30]
push edx
push str.EDIT
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0x10], eax
test eax, eax
je 0x40536b
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
push 1
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov eax, dword [esi + 0x10]
push 0x30
push eax
call edi
mov ecx, dword [esi + 0x10]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x10]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x1018]
mov edx, dword [esp + 0x101c]
push 0
push 0x64
push 0x66
push eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop ebp
pop ebx
add esp, 0x1008
ret 8
Function at 0x405380
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1008
call fcn.00413cd0
mov eax, dword [esi + 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
test eax, eax
je 0x405437
mov ecx, dword [esi + 4]
push 0x66
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0
call fcn.004065e0
add esp, 8
cmp byte [esp + 0x1010], 0
je 0x40541c
push 0x1004
lea edx, [esp + 8]
push 0
push edx
call sub.MSVCR90.dll_memset
mov ecx, dword [esi + 0x10]
add esp, 0xc
lea eax, [esp + 4]
push eax
push 0x7ff
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x20]
xor edx, edx
mov word [esp + 0x1002], dx
push eax
mov edx, esi
call fcn.004051a0
mov edi, dword [esi + 0x38]
mov edx, dword [eax]
mov edx, dword [edx + 8]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esi + 0x24]
lea ecx, [ecx + ecx*4]
mov ecx, dword [edi + ecx*4]
push ecx
push esi
mov ecx, eax
call edx
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [esi + 8]
push 1
push 0
mov dword [esi + 0x10], 0
push ecx
jmp 0x405472
mov edx, dword [esi + 0x14]
push edx
call edi
test eax, eax
je 0x405481
push 0
push 0
call fcn.004065e0
mov eax, dword [esi + 8]
add esp, 8
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esi + 0x14]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [esi + 8]
push 1
push 0
mov dword [esi + 0x14], 0
push edx
or eax, 0xffffffff
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
add esp, 0x1008
ret 4
Function at 0x4054b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x1020
call fcn.00413cd0
mov eax, dword [esi + 0x14]
push ebx
push ebp
mov ebp, dword [esi + 0x70]
push edi
mov edi, dword [esi + 0x6c]
push eax
mov dword [esp + 0x1c], edi
mov byte [esp + 0x13], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4056a1
cmp dword [esi + 0x6c], eax
mov dword [esi + 0x14], eax
jl 0x4056a1
cmp dword [esi + 0x70], eax
jl 0x4056a1
push edi
mov edx, esi
call fcn.004051a0
push 0x1004
lea ecx, [esp + 0x28]
mov ebx, eax
push 0
push ecx
mov dword [esp + 0x2c], ebx
call sub.MSVCR90.dll_memset
mov edx, dword [esi + 0x38]
add esp, 0xc
lea edi, [ebp + ebp*4]
push 0x7ff
add edi, edi
lea ecx, [esp + 0x28]
push ecx
add edi, edi
mov eax, dword [edi + edx]
mov edx, dword [ebx]
mov edx, dword [edx + 4]
push eax
push esi
mov ecx, ebx
mov dword [esp + 0x20], eax
call edx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x18]
xor eax, eax
mov word [esp + 0x1022], ax
lea ebx, [esi + 0x28]
push ecx
mov eax, ebx
mov ecx, ebp
call fcn.00406660
mov ecx, dword [esi + 0x38]
mov ebp, dword [esi + 0x2c]
mov ebx, dword [ebx]
add esp, 4
add ecx, edi
inc ebp
call fcn.00401170
push esi
push 1
mov edi, eax
call fcn.004065e0
mov edx, dword [esi]
mov eax, dword [esi + 4]
add esp, 8
push 0
push edx
push 0x67
push eax
push 0x12c
push edi
dec ebp
push ebp
push ebx
push 0x50200013
push 0x41aecc
push str.COMBOBOX
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
xor edi, edi
mov dword [esi + 0x14], eax
cmp eax, edi
je 0x4056a1
mov eax, dword [esi + 0xd4]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x14], edi
cmp eax, edi
je 0x4055cd
lea ecx, [esp + 0x14]
push ecx
push ebp
push esi
call eax
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x10], edi
cmp dword [esp + 0x14], edi
jbe 0x405633
lea ecx, [ecx]
mov eax, dword [esi + 0xd8]
test eax, eax
je 0x40562c
lea edx, [esp + 0xf]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x20]
push ecx
push edi
push ebp
push edx
push esi
call eax
cmp byte [esp + 0xf], 0
je 0x405609
mov dword [esp + 0x10], edi
mov eax, dword [esi + 0x14]
push 0x41afec
push 0
push 0x143
push eax
call ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x14]
push ecx
push edi
push 0x151
push edx
call ebx
inc edi
cmp edi, dword [esp + 0x14]
jb 0x4055e0
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x14]
push 0
push eax
push 0x14e
push ecx
call ebx
push 1
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [esi + 0x14]
push eax
push 0x30
push edx
call ebx
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esi + 0x14]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x14]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
cmp byte [esp + 0x1030], 0
je 0x405693
mov eax, dword [esi + 0x14]
push 0
push 1
push 0x14f
push eax
call ebx
mov ecx, dword [esi + 0x14]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop ebp
pop ebx
add esp, 0x1020
ret 4
Function at 0x4062e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10a8
call fcn.00413cd0
push ebx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
push edi
mov dword [esp + 0x3c], 0xe
mov dword [esp + 0x88], 2
jle 0x4063b8
mov dword [esp + 0xc], ebx
mov eax, dword [esi + 0x38]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + eax + 4]
add ecx, eax
test edx, edx
je 0x406343
lea edi, [esp + 0xa8]
lea esp, [esp]
movzx eax, word [edx]
mov word [edi], ax
add edx, 2
add edi, 2
test ax, ax
jne 0x406330
jmp 0x40634d
xor edx, edx
mov word [esp + 0xa8], dx
lea eax, [esp + 0xa8]
mov dword [esp + 0x48], eax
call fcn.00401170
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x88]
push ecx
push ebx
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 8]
push 0x105f
push eax
mov dword [esp + 0x60], 0
call edi
test eax, eax
je 0x406398
mov eax, dword [esi + 8]
lea edx, [esp + 0x3c]
push edx
push ebx
push 0x1060
push eax
jmp 0x4063a7
mov edx, dword [esi + 8]
lea ecx, [esp + 0x3c]
push ecx
push ebx
push 0x1061
push edx
call edi
add dword [esp + 0xc], 0x14
inc ebx
cmp ebx, dword [esi + 0x3c]
jl 0x406314
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x20
push 0
push 0x1036
push eax
call edi
mov ecx, dword [esi + 8]
xor eax, eax
push eax
push eax
push 0x1009
push ecx
xor ebx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
call edi
mov ecx, esi
call fcn.00401230
mov dword [esp + 0xc], eax
test eax, eax
je 0x4064b0
jmp 0x406424
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 0
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 8]
lea ecx, [ebx + 1]
push 0x104d
push eax
mov dword [esp + 0x24], 5
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x38], 0x41afec
call edi
xor edi, edi
cmp dword [esi + 0x3c], edi
jle 0x40648e
mov edx, dword [esi + 8]
lea ecx, [esp + 0x5c]
push ecx
push ebx
push 0x1074
push edx
mov dword [esp + 0x74], edi
mov dword [esp + 0x80], 0x41afec
call dword [sym.imp.USER32.dll_SendMessageW]
inc edi
cmp edi, dword [esi + 0x3c]
jl 0x406464
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.00401250
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x406420
cmp dword [esi + 0x74], 0
jl 0x4064c7
mov ecx, dword [esi + 8]
push 0x405740
push esi
push 0x1030
push ecx
call edi
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x406508
mov eax, dword [esi + 0x74]
test eax, eax
jl 0x406508
cmp byte [esi + 0x78], 0
mov dword [esp + 0x5c], 0x14
mov dword [esp + 0x70], 0x7000
je 0x4064f3
mov edx, dword [esi + 0x80]
jmp 0x4064f6
mov edx, dword [esi + 0x7c]
mov dword [esp + 0x68], edx
lea edx, [esp + 0x5c]
push edx
push eax
push 0x120c
push ecx
call edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4065e0
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp dword [esp + 4], 0
push edi
mov edi, dword [esp + 0xc]
mov dword [0x4666a4], edi
mov dword [0x4666a8], 0
je 0x40662e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov eax, dword [0x4666a0]
test eax, eax
je 0x406615
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [edi]
push esi
push eax
push 0x406510
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
pop esi
mov dword [0x4666a0], eax
pop edi
ret
mov eax, dword [0x4666a0]
test eax, eax
je 0x406652
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x4666a0], 0
mov dword [0x4666a4], 0
pop edi
ret

Function at 0x406ac1
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x41d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406b96
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406b85
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x406b6f
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x406b85
push eax
push edi
push dword [ebp - 0x110]
call fcn.00406a5e
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x406b98
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00406c5c
leave
ret 4

Function at 0x406c5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41d018]
jne 0x406c66
repz ret
jmp fcn.004070a6
Function at 0x408f40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x408f63
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
jmp 0x409131
push 0x200
push 0
push 0x462350
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 0xc]
call fcn.00408e80
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x50000000
push 0
mov ecx, 0x4667b8
call fcn.004014d0
push eax
push 0
mov edx, dword [ebp + 8]
push edx
push 0x64
push 0x64
push 0
push 0
mov eax, dword [ebp - 4]
push eax
push 0x415514
mov ecx, dword [str.LcStatusBar]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
je 0x40912f
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0x64
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 8], 0x64
mov edx, dword [ebp - 0xc]
push edx
push 0xffffffffffffffeb
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, 0x4667b8
call fcn.004014d0
push eax
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000003
push 0
push str.tooltips_class32
push 8
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x3a0], eax
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x3a0]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x3a4], 0x2c
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3a8], 0x10
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [eax + 0x3ac], edx
mov ecx, 0x4667b8
call fcn.004014d0
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x3c4], eax
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x3b0], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x3c8], 0xffffffff
mov ecx, dword [ebp - 0xc]
add ecx, 0x3a4
push ecx
push 0
push 0x432
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x3a0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x1f4
push 3
push 0x403
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x3a0]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x401
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3a0]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
jmp 0x409131
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4097a0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6f8
mov eax, dword [0x41d018]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x6f4], ecx
mov eax, dword [ebp - 0x6f4]
mov dword [eax + 0x1bec], 0
mov ecx, dword [ebp - 0x6f4]
mov dword [ecx + 0x1bf0], 0xffffffff
push 0xe
push 0
call sub.LiteCAD.dll_lcPropGetStr
push eax
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.MSVCR90.dll_wcscpy]
add esp, 8
lea eax, [ebp - 0x420]
push eax
push str._s.lng
lea ecx, [ebp - 0x210]
push ecx
call fcn.00401000
add esp, 0xc
lea edx, [ebp - 0x670]
push edx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
je 0x409933
mov ecx, 1
test ecx, ecx
je 0x409926
lea edx, [ebp - 0x644]
push edx
push 0x4155e8
call dword [sym.imp.MSVCR90.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x409907
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x420]
push ecx
push 0x415600
lea edx, [ebp - 0x210]
push edx
call fcn.00401000
add esp, 0x10
lea eax, [ebp - 0x6f0]
push eax
lea eax, [ebp - 0x210]
call fcn.00403b60
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x409907
mov edx, dword [ebp - 0x6f4]
mov eax, dword [edx + 0x1bec]
imul eax, eax, 0x84
mov ecx, dword [ebp - 0x6f4]
lea edx, [ecx + eax + 0xc74]
mov dword [ebp - 0x6f8], edx
mov eax, dword [ebp - 0x6f4]
mov ecx, dword [eax + 0x1bec]
add ecx, 1
mov edx, dword [ebp - 0x6f4]
mov dword [edx + 0x1bec], ecx
lea eax, [ebp - 0x6f0]
push eax
lea ecx, [ebp - 0x644]
push ecx
mov ecx, dword [ebp - 0x6f8]
call fcn.004091a0
mov edx, dword [ebp - 0x6f4]
cmp dword [edx + 0x1bec], 0x1e
jl 0x409907
jmp 0x409926
lea eax, [ebp - 0x670]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409921
jmp 0x409926
jmp 0x409835
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406c5c
mov esp, ebp
pop ebp
ret
Function at 0x40ad80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c0
mov eax, dword [0x41d018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov dword [ebp - 0x9bc], ecx
mov dword [ebp - 0x524], str.LiteCAD_language_file___.lng_.lng
mov dword [ebp - 0x28c], 0x4156b4
mov dword [ebp - 0x290], 0
mov byte [ebp - 0x526], 1
push 0xe
push 0
call sub.LiteCAD.dll_lcPropGetStr
push eax
lea eax, [ebp - 0x4a0]
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy]
add esp, 8
push 0x208
push 0
lea ecx, [ebp - 0x9b8]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
lea edx, [ebp - 0x9b8]
push edx
mov eax, dword [ebp - 0x28c]
push eax
mov ecx, dword [ebp - 0x524]
push ecx
mov edx, dword [ebp - 0x9bc]
mov eax, dword [edx + 8]
push eax
mov ebx, dword [ebp - 0x290]
call fcn.004016f0
add esp, 0x14
mov byte [ebp - 0x525], al
movzx ecx, byte [ebp - 0x525]
test ecx, ecx
je 0x40afe8
mov bl, 1
lea eax, [ebp - 0x9b8]
call fcn.004032f0
push eax
lea edx, [ebp - 0x520]
push edx
call dword [sym.imp.MSVCR90.dll_wcscpy]
add esp, 8
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x9b8]
call fcn.00403b60
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x40afe8
mov edx, dword [ebp - 0x9bc]
cmp dword [edx + 0x1bec], 0x1e
jge 0x40afe8
lea eax, [ebp - 0x520]
push eax
lea ecx, [ebp - 0x4a0]
push ecx
push 0x4156bc
lea edx, [ebp - 0x7b0]
push edx
call fcn.00401000
add esp, 0x10
movzx eax, byte [ebp - 0x526]
push eax
lea ecx, [ebp - 0x7b0]
push ecx
lea edx, [ebp - 0x9b8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40af33
mov eax, dword [ebp - 0x9bc]
mov ecx, dword [eax + 0x1bec]
imul ecx, ecx, 0x84
mov edx, dword [ebp - 0x9bc]
lea eax, [edx + ecx + 0xc74]
mov dword [ebp - 0x9c0], eax
mov ecx, dword [ebp - 0x9bc]
mov edx, dword [ecx + 0x1bec]
add edx, 1
mov eax, dword [ebp - 0x9bc]
mov dword [eax + 0x1bec], edx
lea ecx, [ebp - 0x5a8]
push ecx
lea edx, [ebp - 0x520]
push edx
mov ecx, dword [ebp - 0x9c0]
call fcn.004091a0
push 0
push 1
mov ecx, dword [ebp - 0x9bc]
call fcn.0040ad10
jmp 0x40afe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x50
jne 0x40af9a
lea eax, [ebp - 0x5a8]
push eax
push 0x4156c8
call sub.LiteCAD.dll_lcStrGet
push eax
lea ecx, [ebp - 0x288]
push ecx
call fcn.00401000
add esp, 0xc
push 0x24
push 0x4156e4
lea edx, [ebp - 0x288]
push edx
mov eax, dword [ebp - 0x9bc]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40af98
mov byte [ebp - 0x526], 0
jmp 0x40aea6
jmp 0x40afd9
mov edx, dword [ebp - 0x294]
push edx
push 0x4156f4
call sub.LiteCAD.dll_lcStrGet
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.00401000
add esp, 0xc
push 0x10
push 0x41570c
lea ecx, [ebp - 0x288]
push ecx
mov edx, dword [ebp - 0x9bc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x9bc]
mov edx, dword [ecx + 0x24]
push edx
call sub.LiteCAD.dll_lcWndSetFocus
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406c5c
mov esp, ebp
pop ebp
ret
Function at 0x40ccc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [0x461f78]
test eax, eax
je 0x40cce8
push 1
push 0
push 0
push str.http:__kolbasoft.com_litecad.html
push str.open
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret