joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000de00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005719c
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x820], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x814], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x82c]
push eax
mov eax, dword [ebx + 4]
add eax, 4
push eax
call fcn.10053080
add esp, 0xc
test eax, eax
jne 0x1000e004
push 0x10060560
push dword [ebx + 4]
call fcn.10053080
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000e009
mov eax, dword [ebx + 4]
push 2
push 0
push 0
mov edi, dword [eax + 0x18]
push edi
mov dword [ebp - 0x824], edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x10
test eax, eax
jne 0x1000ded4
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
push 0
push 0
push 0
push edi
mov esi, eax
mov ebx, edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
add esp, 0x14
test eax, eax
je 0x1000deef
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
mov eax, 0x34
jmp 0x1000e00b
push dword [ebp - 0x814]
lea ecx, [ebp - 0x81c]
call fcn.10053080
push 0x10060570
push dword [ebp - 0x818]
mov dword [ebp - 4], 0
call fcn.10053080
mov edi, eax
add esp, 8
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x814], eax
mov eax, esi
or eax, ebx
je 0x1000df99
mov eax, 0x800
nop
push dword [ebp - 0x824]
cmp esi, 0x800
mov edi, esi
push 1
cmova edi, eax
lea eax, [ebp - 0x810]
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
test eax, eax
je 0x1000dffd
push dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push 1
push edi
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x1000dffd
sub esi, edi
mov eax, esi
sbb ebx, 0
or eax, ebx
mov eax, 0x800
jne 0x1000df40
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::File::close_void_
mov edi, eax
test edi, edi
jne 0x1000dfd9
mov eax, dword [ebp - 0x818]
add eax, 4
push eax
call fcn.10053080
push dword [ebp - 0x828]
mov eax, dword [ebp - 0x818]
push dword [ebp - 0x82c]
add eax, 4
push eax
call fcn.10033ac0
add esp, 0x10
mov edi, eax
mov ebx, dword [ebp - 0x820]
mov eax, dword [ebx]
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x1005c2f4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_void___thiscall_ScCore::File::destructor_void_
jmp 0x1000e009
mov edi, 0x34
jmp 0x1000dfd9
mov edi, 0x30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret 4
Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call fcn.10053080
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.10053080
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret
Function at 0x100354a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100354cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call fcn.10053080
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100354f4
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003550a
lea eax, [ebp - 0xc]
push eax
push 0x10035590
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10035551
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10083c98]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083c10]
cmp eax, dword [ecx + 4]
jg 0x10035558
jmp 0x1003552e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10083c0c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x10083c10
call fcn.10053080
add esp, 4
cmp dword [0x10083c10], 0xffffffff
jne 0x1003552b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10083c10
mov dword [0x10083c0c], eax
call fcn.10053080
add esp, 4
jmp 0x1003552b

Function at 0x100356d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac13
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call fcn.10053080
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10035768
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x10083ae8]
test eax, eax
jne 0x1003577c
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035810
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003581f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret
Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call fcn.10053080
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call fcn.10053080
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret

Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call fcn.10053080
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x10053080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1005308f
pop dword [ebp - 0x34]
mov eax, 0xc0c492c6
sub eax, 0xb0bf6237
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x91c30442
sub dword [ebp - 0x44], 0x4370bef7
mov dword [ebp - 0x40], 0x8ddb0bfa
add dword [ebp - 0x40], 0xa458404b
mov dword [ebp - 0x3c], 0x2d52ba57
sub dword [ebp - 0x3c], 0xe1067629
mov dword [ebp - 0x38], 0x41cfc496
add dword [ebp - 0x38], 0xbe303b6a
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xb0086c5d
sub dword [ebp - 0x44], 0x3b960307
mov dword [ebp - 0x40], 0x6da8df5
add dword [ebp - 0x40], 0x3a91d380
mov dword [ebp - 0x3c], 0xb8c059d2
add dword [ebp - 0x3c], 0xaaaf129a
mov dword [ebp - 0x38], 0xc2eda254
add dword [ebp - 0x38], 0x3d125dac
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xb3396d7c
add eax, 0x5ccc52a0
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x54e7a
push 0
call eax
mov ecx, 0x4e91
mov esi, eax
mov edx, 0x4b944389
add edx, 0xc474d877
add edx, dword [ebp - 0x34]
mov ebx, 0x75d96798
sub ebx, 0x1e14599c
xor dword [ebp - 0x10], edx
mov edi, dword [edx]
mov dword [ebp - 0x30], 0xc081af49
xor edi, ebx
sub dword [ebp - 0x2c], esi
mov dword [esi], edi
sub dword [ebp - 0x1c], edx
add esi, 0x625f477d
add esi, 0x9da0b887
add edx, 0x50296632
add edx, 0xafd699d2
loop 0x100531a6
add eax, 0x12d17
xor ebx, ebx
add ebx, eax
add eax, 0x1b18df7b
sub eax, 0x1b18df76
mov ecx, 0xc221d15f
sub ecx, 0xb221d15f
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4287b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x18], esi
mov dword [esi], 0x42a570
mov dword [esi + 4], ebx
mov eax, dword [0x438a9c]
mov dword [ebp - 0x10], esp
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x4010ae
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x14]
push ecx
push ebx
push ebx
push ebx
push str.ExceptionServers
push eax
call edi
test eax, eax
jne 0x4010ae
mov edx, dword [ebp - 0x14]
inc edx
push edx
call fcn.0041cc13
add esp, 4
cmp eax, ebx
mov dword [esi + 4], eax
je 0x4010ae
mov edx, dword [0x438a9c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push ebx
push ebx
push str.ExceptionServers
push edx
call edi
test eax, eax
je 0x4010ae
mov eax, dword [esi + 4]
push eax
call fcn.0041cc3c
add esp, 4
mov dword [esi + 4], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4015a0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push esi
mov esi, ecx
push 0
call fcn.00424557
push str.IDMAgent_IEBBMon_Class
push 0
push 0
mov dword [esi], method.CWinApp.virtual_0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0xc0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4015d9
push 0
call fcn.0040d5ce
mov eax, esi
pop esi
ret
mov ecx, 0x4388b0
jmp 0x4015a0

Function at 0x402160
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
lea eax, [esp]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings
push SysReAllocString
mov esi, 1
call edi
test eax, eax
jne 0x4021c9
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push eax
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push edx
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4021b6
mov eax, dword [esp + 0xc]
xor esi, esi
push eax
call edi
mov ecx, dword [esp + 8]
push ecx
call edi
test esi, esi
jne 0x4021c9
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
mov ecx, dword [0x438a9c]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push str.lstbhotime
push ecx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4021fd
pop edi
xor eax, eax
pop esi
add esp, 0x14
ret
lea edx, [esp + 0x14]
push edx
call fcn.0040d856
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
sub eax, esi
add esp, 4
xor ecx, ecx
cmp eax, 0x15180
setle cl
pop edi
mov eax, ecx
pop esi
add esp, 0x14
ret
Function at 0x402a10
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x438a9c]
sub esp, 8
test eax, eax
jne 0x402a29
call fcn.00402ab0
test al, al
jne 0x402a29
add esp, 8
ret
mov eax, dword [0x438aa0]
test eax, eax
jne 0x402a6d
push 0x438aa0
push 1
push eax
push str.SoftwareDownloadManagerIDMBIIEXPLORE
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402a5e
mov dword [0x438aa0], 0
xor al, al
add esp, 8
ret
mov eax, dword [0x438aa0]
test eax, eax
jne 0x402a6d
xor al, al
add esp, 8
ret
lea ecx, [esp]
lea edx, [esp + 4]
push ecx
push edx
push 0
push 0
push 0x4343c0
push eax
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402a99
xor al, al
add esp, 8
ret
mov eax, dword [esp + 4]
test eax, eax
setne al
add esp, 8
ret

Function at 0x403cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4289e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
mov edx, dword [0x438a9c]
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x18]
xor esi, esi
push eax
push ecx
push esi
push esi
push str.AdvancedIntegration
push edx
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403d16
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
push 0x3f
push edi
call fcn.0040cfd0
mov bl, byte [ebp + 0x20]
add esp, 8
test eax, eax
je 0x403d54
test bl, bl
je 0x403d54
push 8
push edi
push str.https:__
call fcn.00417c50
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov edi, dword [ebp + 0x18]
cmp edi, esi
je 0x403d6a
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 0x20], ecx
jmp 0x403d6d
mov dword [ebp + 0x20], esi
mov ecx, dword [ebp + 0x10]
push esi
push esi
push 0xffffffffffffffff
push ecx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
dec esi
push esi
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov edi, eax
test edi, edi
je 0x403da1
mov edx, dword [ebp + 0x10]
push esi
push edi
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp + 0x10], edi
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x1c]
neg bl
mov edx, dword [ebp + 0x20]
mov byte [ebp - 4], 1
sbb ebx, ebx
and ebx, 4
add ebx, 4
push ebx
push eax
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push edi
push 0
push 0
push ecx
push edx
push eax
call fcn.00403960
add esp, 0x30
test al, al
push edi
jne 0x403dee
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x403d3f
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4046f0
Capabilities:
Parse url

Disassembly:
push 0xffffffffffffffff
push 0x428a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov ebx, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov edx, 0x7d0
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
ja 0x4048dd
mov eax, 0x64
lea ecx, [ebx + 0x874]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x24], eax
lea eax, [ebx + 0x40]
mov dword [ebx + 0x38], eax
lea eax, [ebx + 0x810]
mov dword [ebx + 0x14], eax
lea eax, [ebx + 0x110c]
mov dword [ebx + 8], eax
lea eax, [ebx + 0x93c]
lea ebp, [ebx + 4]
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x28], ecx
mov dword [ebx + 0x30], eax
lea edx, [ebx + 0x8d8]
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp], 0x3c
mov dword [ebx + 0xc], 0xa
mov dword [ebx + 0x20], edx
mov word [ebx + 0x1c], 0
push ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x4048dd
push 3
lea edi, [ebx + 0x110c]
push 0x434868
push edi
call fcn.0041bf30
add esp, 0xc
test eax, eax
je 0x40481a
push 3
push 0x434864
push edi
call fcn.0041bf30
add esp, 0xc
test eax, eax
je 0x40481a
lea eax, [ebx + 0x93c]
push 0x25
push eax
call fcn.0040cfd0
add esp, 8
test eax, eax
je 0x40481a
mov ecx, 3
mov edi, 0x434860
mov esi, eax
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4048d8
mov cl, byte [eax + 1]
inc eax
test cl, cl
je 0x404816
push 0x25
push eax
call fcn.0040cfd0
add esp, 8
test eax, eax
jne 0x4047e9
mov esi, dword [esp + 0x24]
lea eax, [ebx + 0x40]
lea ecx, [esp + 0x10]
push eax
call fcn.00421214
mov ecx, 0x7d0
mov eax, 0x64
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x34], ecx
mov dword [ebx + 0x24], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp], 0x3c
mov dword [ebx + 0xc], 0xa
repne scasb al, byte es:[edi]
not ecx
push ebp
dec ecx
push 0x10000000
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x404881
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004211ea
xor eax, eax
jmp 0x4048dd
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
push 0x434864
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebx + 0x110c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00415630
add esp, 8
test eax, eax
jne 0x4048c7
cmp word [ebx + 0x1c], ax
jne 0x4048c7
mov word [ebx + 0x1c], 0x6db
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004211ea
mov eax, 1
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x413475
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x435ef0
cmp edx, dword [eax]
je 0x413497
add eax, 8
inc ecx
cmp eax, 0x435f80
jl 0x413488
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x435ef0]
jne 0x4135c5
mov eax, dword [0x43ab30]
cmp eax, 1
je 0x41359f
test eax, eax
jne 0x4134c8
cmp dword [0x4356c4], 1
je 0x41359f
cmp edx, 0xfc
je 0x4135c5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4134ff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00414890
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040e990
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x413542
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040e990
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42cfd4
push edi
call fcn.00415970
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00414890
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004148a0
lea eax, [ebp - 0xa0]
push 0x42cfb4
push eax
call fcn.004148a0
push dword [esi + 0x435ef4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004148a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00416410
add esp, 0x2c
pop edi
jmp 0x4135c5
lea eax, [ebp + 8]
lea esi, [esi + 0x435ef4]
push 0
push eax
push dword [esi]
call fcn.0040e990
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x41b880
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0040d940
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x41b94b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x41b94b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x41b8fe
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x41b909
or bh, 8
and edi, 0x8000000
je 0x41b924
mov eax, dword [0x43c2bc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x41b94b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret