joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40231a
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x40236d
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, ecx
jne 0x402383
push 0x80004005
call fcn.0040109c
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x402386
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x40289a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x47e600]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
push edi
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
call fcn.004022e5
mov edi, eax
cmp edi, esi
je 0x402902
lea ecx, [ebp - 0x70]
call fcn.00402280
mov eax, edi
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448e39
add ebp, 0x98
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40291a
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040289a
cmp eax, esi
jne 0x40294d
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call edi
test eax, eax
je 0x40290a
lea ecx, [ebp - 0x70]
call fcn.00402280
push dword [ebp - 0x78]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00402280
mov eax, esi
jmp 0x4028e8
Function at 0x4084a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
sub esp, 0x404
lea ebp, [esp - 4]
mov eax, dword [0x47e600]
xor eax, ebp
mov dword [ebp + 0x404], eax
push 0x20
mov eax, 0x465443
call fcn.00448e7b
mov edi, ecx
mov eax, dword [ebp + 0x414]
mov esi, dword [ebp + 0x410]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x418]
mov dword [ebp - 0x14], eax
call dword [0x47e5c8]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp], ebx
cmp esi, ebx
mov byte [ebp - 4], 1
je 0x40855c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
call section..text
add esp, 0xc
test eax, eax
jl 0x40855c
mov edi, dword [ebp - 0x24]
cmp edi, 0x400
jg 0x408544
push edi
call fcn.00401368
test al, al
pop ecx
je 0x408544
mov eax, edi
call fcn.00448980
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x40854d
push edi
lea ecx, [ebp - 0x20]
call fcn.0040143d
push dword [ebp - 0x1c]
push edi
push esi
push eax
call fcn.00401064
cmp eax, ebx
jne 0x4085a1
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x40856c
lea ecx, [ebp]
call fcn.0040286b
lea ecx, [ebp - 0x20]
call fcn.00401278
mov eax, 0x8007000e
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00448e39
add ebp, 0x408
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x1c], edi
jne 0x4085c0
call fcn.004021a3
mov esi, eax
jmp 0x40868a
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x4085dd
call fcn.004021a3
jmp 0x40867f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x4085d3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
mov dword [ebp - 0x18], esi
jae 0x408624
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x408610
lea ecx, [ebp]
call fcn.0040286b
mov esi, 0x8007000e
lea ecx, [ebp - 0x20]
call fcn.00401278
mov eax, esi
jmp 0x408579
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 2
call fcn.00403040
mov dword [ebp - 4], 1
jmp 0x40864c
cmp dword [ebp], ebx
jne 0x408658
mov esi, 0x8007000e
jmp 0x408681
push esi
push dword [ebp - 0x14]
push esi
push dword [ebp]
call fcn.0040156b
mov eax, dword [ebp]
add esp, 0x10
push dword [ebp + 0x41c]
mov byte [eax + esi], bl
push dword [ebp]
lea ecx, [ebp - 0x2c]
call fcn.00403d7e
mov esi, eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x408615
lea ecx, [ebp]
call fcn.0040286b
jmp 0x408615
Function at 0x4099ac
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x47e600]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x19c]
lea eax, [ebp + 0x8c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x78]
push eax
xor esi, esi
push esi
push str.wasbase
lea eax, [ebp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x78]
push eax
mov ecx, edi
call fcn.00404335
push str.ENEMIES
push 0xcd
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, dword [edi]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push edi
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x7c]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00448e39
add ebp, 0x194
leave
ret

Function at 0x40a38d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0xc
push ebp
push esi
push edi
call fcn.0040a1c3
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 5
push dword [esp + 0x24]
xor ebp, ebp
push esi
mov dword [esp + 0x1c], ebp
call edi
cmp eax, ebp
mov dword [esp + 0x14], eax
je 0x40a45d
push ebx
push 0xf0
push dword [esp + 0x28]
push esi
call edi
cmp eax, ebp
mov edi, dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, dword [sym.imp.KERNEL32.dll_LockResource]
je 0x40a3e3
push eax
push esi
call edi
push eax
call ebx
mov ebp, eax
push dword [esp + 0x18]
and dword [esp + 0x14], 0
push esi
call edi
test eax, eax
je 0x40a441
push eax
call ebx
mov edi, eax
test edi, edi
je 0x40a441
push ebp
push edi
call fcn.00401850
pop ecx
pop ecx
push dword [esp + 0x30]
mov ebx, eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x40a42d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp ebx, edi
je 0x40a44b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40a44b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
pop ebx
je 0x40a45d
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x40a49a
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x4c
push 0x84
mov eax, 0x4656fe
call fcn.00448e7b
xor esi, esi
mov dword [ebp + 0x14], 0x46a99c
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x24], esi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x2c], esi
lea eax, [ebp + 0x14]
push eax
mov ecx, 0x47fbf0
mov dword [ebp - 4], esi
call fcn.00403be2
push 0x47fe44
lea ecx, [ebp + 0x4c]
call fcn.0040204e
lea eax, [ebp + 0x4c]
push eax
mov byte [ebp - 4], 2
call fcn.004099ac
mov edi, dword [ebp + 0x4c]
pop ecx
push edi
call fcn.004151e0
cmp eax, esi
pop ecx
jge 0x40a508
push eax
call fcn.00447f30
lea ecx, [ebp - 0x90]
call fcn.004090fc
push esi
push esi
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.0040a468
cmp eax, esi
jne 0x40a539
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.00403fe8
jmp 0x40a5b4
push dword [ebp + 0x5c]
push dword [ebp - 0x8c]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp + 0x14]
call fcn.00401ca6
lea ecx, [ebp - 0x90]
call fcn.0041095f
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 2
call fcn.00403fe8
mov dword [ebp - 4], 1
jmp 0x40a5a3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x47fbf0
call fcn.00403ec4
lea ecx, [edi - 0x10]
call fcn.00401741
lea ecx, [ebp + 0x24]
call fcn.00401b51
lea ecx, [ebp + 0x18]
call fcn.00401b51
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x50
leave
ret

Function at 0x40ad2e
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
and dword [edi], 0
push dword [ebp + 8]
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x40ada4
cmp word [ebx + 8], 2
jne 0x40ad84
cmp word [ebx + 0xa], 4
jne 0x40ad84
mov esi, dword [ebx + 0xc]
jmp 0x40ad7e
push dword [eax]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040acc9
test eax, eax
mov dword [edi], eax
je 0x40ad9f
lea edi, [eax + 0x1c]
add esi, 4
mov eax, dword [esi]
test eax, eax
jne 0x40ad62
push 0x400
push dword [ebx]
push 0x401
push dword [ebp + 0x18]
call fcn.0044acea
add esp, 0x10
xor eax, eax
jmp 0x40adca
push 8
pop eax
jmp 0x40adca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
mov eax, 0x2af9
sub ecx, eax
je 0x40adca
dec ecx
je 0x40adc5
dec ecx
je 0x40adbe
dec ecx
jmp 0x40adca
mov eax, 0x2afb
jmp 0x40adca
mov eax, 0x2afa
pop edi
pop esi
pop ebx
pop ebp
ret 0x18
Function at 0x40b3c6
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1b0]
sub esp, 0x230
mov eax, dword [0x47e600]
xor eax, ebp
mov dword [ebp + 0x1ac], eax
cmp dword [0x47fc2c], 0
mov dword [ebp - 0x80], str.getaddrinfo
mov dword [ebp - 0x7c], 0x40af85
mov dword [ebp - 0x78], str.getnameinfo
mov dword [ebp - 0x74], 0x40b20c
mov dword [ebp - 0x70], str.freeaddrinfo
mov dword [ebp - 0x6c], fcn.0040af4c
jne 0x40b52c
push 0x104
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40b522
push ebx
push esi
push edi
lea eax, [ebp - 0x68]
push eax
mov esi, 0x10c
lea eax, [ebp + 0xa0]
push esi
push eax
call fcn.0044ab8e
push str.ws2_32
lea eax, [ebp + 0xa0]
push esi
push eax
call fcn.0044b128
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea eax, [ebp + 0xa0]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x40b48f
push str.getaddrinfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40b48b
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test edi, edi
jne 0x40b4e1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xa0]
push esi
push eax
call fcn.0044ab8e
push str.wship6
lea eax, [ebp + 0xa0]
push esi
push eax
call fcn.0044b128
add esp, 0x18
lea eax, [ebp + 0xa0]
push eax
call ebx
mov edi, eax
test edi, edi
je 0x40b51f
push str.getaddrinfo
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40b4dd
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test edi, edi
je 0x40b51f
xor esi, esi
push dword [ebp + esi*8 - 0x80]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp + esi*8 - 0x7c], eax
je 0x40b4fe
inc esi
cmp esi, 3
jl 0x40b4e3
jmp 0x40b507
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
test edi, edi
je 0x40b51f
xor eax, eax
mov ecx, dword [ebp + eax - 0x7c]
mov dword [eax + 0x47df58], ecx
add eax, 8
cmp eax, 0x18
jl 0x40b50d
pop edi
pop esi
pop ebx
mov dword [0x47fc2c], 1
movzx eax, word [ebp + 0x1b8]
mov ecx, dword [ebp + 0x1ac]
mov eax, dword [eax*8 + 0x47df58]
xor ecx, ebp
call fcn.00448e39
add ebp, 0x1b0
leave
ret 4

Function at 0x40bbe3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
cmp esi, edi
jne 0x40bbfb
push 0x80004005
call fcn.0040109c
mov dword [ebp + 0x14], edi
push esi
lea eax, [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
sub eax, edi
push eax
mov eax, dword [ebp + 0xc]
add eax, edi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40bc30
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
je 0x40bc30
cmp eax, 0x3e5
jne 0x40bc58
push 1
lea eax, [ebp + 0x14]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x40bc58
mov eax, dword [ebp + 0x14]
add dword [esi + 8], eax
add edi, eax
cmp edi, dword [ebp + 0x10]
jl 0x40bbfe
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
xor eax, eax
jmp 0x40bc54
Function at 0x40bc5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
xor esi, esi
cmp ebx, esi
push edi
jne 0x40bc76
push 0x80004005
call fcn.0040109c
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x14], esi
mov dword [ebp - 4], esi
push ebx
lea eax, [ebp + 0x14]
push eax
mov eax, dword [edi]
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40bcba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
mov dword [ebp - 4], eax
je 0x40bcba
cmp eax, 0x3e5
je 0x40bcba
cmp eax, 0x3e4
jne 0x40bced
push 1
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x40bced
mov eax, dword [ebp + 0x14]
add dword [ebx + 8], eax
add esi, eax
cmp esi, dword [edi]
jge 0x40bce3
cmp dword [ebp - 4], 0xea
je 0x40bc7f
xor eax, eax
mov dword [edi], esi
inc eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x40bce8

Function at 0x40bd4b
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x47e600]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x40bd7f
lea eax, [esp + 4]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40bd7c
xor al, al
jmp 0x40bd81
mov byte [esi], 1
mov al, 1
mov ecx, dword [esp + 0x194]
pop esi
xor ecx, esp
call fcn.00448e39
add esp, 0x194
ret
Function at 0x40bf3a
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xbc]
sub esp, 0x13c
mov eax, dword [0x47e600]
xor eax, ebp
mov dword [ebp + 0xb8], eax
mov eax, dword [ebp + 0xc4]
push edi
push str.kernel32.dll
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c02e
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x46b300
push edi
call esi
push 0x46b2f0
push edi
mov ebx, eax
call esi
push 0x46b2e0
push edi
mov dword [ebp - 0x78], eax
call esi
push 0x46b2d0
push edi
mov dword [ebp - 0x74], eax
call esi
push 0x46b2c0
push edi
mov dword [ebp - 0x7c], eax
call esi
xor edi, edi
cmp ebx, edi
je 0x40c02c
cmp dword [ebp - 0x78], edi
je 0x40c02c
cmp dword [ebp - 0x74], edi
je 0x40c02c
cmp dword [ebp - 0x7c], edi
je 0x40c02c
cmp eax, edi
je 0x40c02c
push edi
push 2
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c02c
lea eax, [ebp - 0x70]
push eax
push ebx
mov dword [ebp - 0x70], 0x128
call dword [ebp - 0x78]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c025
cmp dword [ebp - 0x68], edi
je 0x40c01d
push dword [ebp - 0x80]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
test eax, eax
je 0x40c01d
push dword [ebp - 0x68]
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call esi
xor edi, edi
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [ebp - 0x74]
test eax, eax
jne 0x40bfeb
push ebx
call esi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb8]
xor ecx, ebp
pop edi
call fcn.00448e39
add ebp, 0xbc
leave
ret
Function at 0x40c168
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x58], 0
sete al
test al, al
mov byte [edi + 0x58], al
je 0x40c24b
push 5
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push 6
push 0x17f
push 0x14d
xor eax, eax
push eax
push eax
push eax
lea esi, [edi + 4]
push dword [esi]
call ebx
push 0x3f2
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x46b360
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 4
sub eax, 0xcd
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push 0x91
push 0
push 0
push dword [edi + 0x60]
call ebx
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004044fa
push 0x3f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [ebp - 4]
push 5
xor ecx, ecx
push ecx
push ecx
add edx, 9
push edx
mov edx, dword [ebp - 0x10]
add edx, 0xa
push edx
push ecx
push eax
call ebx
push 0x3f7
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c2a1
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x60]
call ebx
push 0x3f7
lea esi, [edi + 4]
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push 6
push 0xc1
push 0x14d
xor eax, eax
push eax
push eax
push eax
push dword [esi]
call ebx
push 0x3f2
push dword [esi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x46b35c
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
lea eax, [ebp - 0x20]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push 4
push 0x14
sub eax, 0x14
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
sub eax, 0x14
push eax
push 0
push 0
push dword [edi + 0x40]
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x40e427
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x47e600]
xor eax, ebp
mov dword [ebp + 0xdc], eax
push esi
push 0x40
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00449160
add esp, 0xc
push 0x47fe44
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x80], 0x44
call fcn.0040204e
push esi
push 0x24
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x28]
push 0x46b5e8
push eax
call fcn.0044ba30
lea eax, [ebp - 0x28]
push str.explorer.exe
push eax
call fcn.0044ba30
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffffff0
call fcn.00401741
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
pop esi
call fcn.00448e39
add ebp, 0xe0
leave
ret

Function at 0x40eaa1
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov esi, ecx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ecx, dword [esp + 0xc]
lea edi, [eax + 1]
push edi
call fcn.00403123
push edi
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 0xc]
mov esi, eax
push esi
call fcn.0040cacd
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x41043d
Capabilities:
Get graphical window text

Disassembly:
push 0x10
mov eax, 0x465c46
call fcn.00448e48
mov edi, ecx
push str.explorer.exe
call fcn.0040bf3a
pop ecx
mov ecx, edi
call fcn.0041020b
mov ecx, 0x47fbec
call fcn.00423880
push 0
push 0
lea esi, [edi + 0x60]
push 0x110a
push dword [esi]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], esi
call dword [sym.imp.USER32.dll_SendMessageA]
and dword [ebp - 0x14], 0
jmp 0x4104a3
push ebx
mov ecx, esi
call fcn.0040c2d7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
push eax
call dword [edx + 0x30]
push ebx
mov ecx, esi
call fcn.0040c32b
inc dword [ebp - 0x14]
mov ebx, eax
test ebx, ebx
jne 0x410487
push 0x47fe44
lea ecx, [ebp - 0x10]
call fcn.0040204e
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
and dword [ebp - 4], ebx
push 0x3ee
push dword [edi + 4]
call esi
mov ebx, 0xff
push ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
call fcn.0040e510
push ebx
push eax
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp - 0x10]
call fcn.0044b45b
mov ecx, dword [ebp - 0x14]
add eax, ecx
push eax
lea eax, [ebp - 0x10]
push 0x46b7c0
push eax
call fcn.0040ec1f
add esp, 0x10
push 0x3ee
push dword [edi + 4]
call esi
mov esi, dword [ebp - 0x10]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 0x1c]
call fcn.0040c316
call fcn.0040e427
lea ecx, [esi - 0x10]
call fcn.00401741
xor eax, eax
call fcn.00448f20
ret 0x10
Function at 0x411fe0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x465dc9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
xor esi, esi
mov dword [esp + 0xc], esi
mov eax, dword [0x47fe44]
mov edx, dword [eax + 0xc]
mov ebp, ecx
push edi
mov ecx, 0x47fe44
mov dword [esp + 0x1c], esi
call edx
mov edi, dword [esp + 0x24]
add eax, 0x10
mov dword [edi], eax
mov ebx, dword [esp + 0x28]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 1
mov esi, 0x100
mov eax, dword [edi]
sub eax, 0x10
add esi, esi
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
lea edx, [esi - 1]
sub eax, edx
or eax, ecx
jge 0x412056
push edx
mov ecx, edi
call fcn.0040207d
mov eax, dword [edi]
push ebp
push esi
push eax
push 0x46b166
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x412033
cmp eax, 0xffffffff
jne 0x41208b
mov eax, dword [edi]
test eax, eax
je 0x41208f
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x412080
sub eax, edx
test eax, eax
jl 0x4120c1
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x4120c1
mov dword [ecx - 0xc], eax
mov edx, dword [edi]
push 0xa
push 0
mov ecx, edi
mov byte [eax + edx], 0
call fcn.00411b60
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
push 0x80070057
call fcn.0040109c
int3

Function at 0x4125a0
Capabilities:
Get session user name

Disassembly:
sub esp, 0x108
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx
mov dword [esp + 8], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x4125ee
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4125c8
mov ecx, dword [esp + 0x10c]
sub eax, edx
push eax
lea edx, [esp + 8]
push edx
call fcn.00403cc5
xor eax, eax
add esp, 0x108
ret
mov ecx, dword [esp + 0x10c]
call fcn.00401fe1
call fcn.004021a3
add esp, 0x108
ret