joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dc10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x404
mov eax, dword [0x437008]
xor eax, esp
mov dword [esp + 0x400], eax
cmp dword [0x2a7401c], 0x114e
mov eax, dword [esp + 0x408]
mov dword [0x2a73e60], eax
jne 0x42dc51
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401000
add esp, 0x404
ret

Function at 0x42dc80
Capabilities:
Get hostname

Disassembly:
sub esp, 0x818
mov eax, dword [0x437008]
xor eax, esp
mov dword [esp + 0x814], eax
push esi
xor esi, esi
cmp dword [esp + 0x820], esi
mov dword [esp + 0xc], edx
jle 0x42dd6f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push edi
mov edi, dword [esp + 0x18]
jmp 0x42dcc0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], 5
mov dword [esp + 0x1c], 0
call fcn.0042dc70
mov eax, dword [esp + 0x1c]
add eax, 0x46
mov dword [esp + 0x10], eax
nop
sub dword [esp + 0x10], 0x46
movsx eax, byte [edx + esi]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
xor dword [esp + 0x14], eax
cmp dword [esp + 0x82c], 0xf
mov cl, byte [esp + 0x14]
mov byte [edx + esi], cl
jne 0x42dd5e
push 0
push 0
call ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
push str.gomomokukowumipusaxevu
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push 0
lea ecx, [esp + 0x428]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push edi
push str.wowohasare
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x18]
inc esi
cmp esi, dword [esp + 0x82c]
jl 0x42dcc0
pop edi
pop ebp
pop ebx
cmp dword [esp + 0x820], 0x2d
pop esi
jne 0x42dd8e
mov dword [0x2a74150], 0xa62e7790
mov dword [0x2a74154], 0xffffffff
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.00401000
add esp, 0x818
ret

Function at 0x42ddb0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc04
mov eax, dword [0x437008]
xor eax, esp
mov dword [esp + 0xc00], eax
mov eax, dword [0x437fe0]
push esi
mov esi, dword [0x2a7401c]
push edi
mov edi, dword [0x2a73e64]
push eax
call fcn.0042dc10
add esp, 4
cmp dword [0x2a7401c], 0x2f
jne 0x42ddef
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
mov edx, edi
call fcn.0042dc80
add esp, 4
cmp dword [0x2a7401c], 0x568
pop edi
pop esi
jne 0x42de29
push 0
push 0
lea ecx, [esp + 0x408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push 0
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.00401000
add esp, 0xc04
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x435028
push 0x435024
push 0x435020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x435028]
push dword [0x435024]
push dword [0x435020]
mov dword [0x435014], esp
call fcn.004174d0
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
push eax
mov ecx, 2
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4012a6
push edi
mov dword [ebp - 4], 3
jmp 0x4012c1
push 0x32
call sub.KERNEL32.dll_Sleep
push 0
call sub.USER32.DLL_OpenClipboard
mov dword [ebp - 8], eax
cmp eax, 0
jne 0x4012de
mov edi, dword [ebp - 4]
sub edi, 1
mov dword [ebp - 4], edi
cmp edi, 0
jg 0x4012ba
mov eax, dword [ebp - 8]
pop edi
leave
ret

Function at 0x4012e4
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4012ef
push edi
mov dword [ebp - 4], 0
call fcn.0040129c
cmp eax, 0
je 0x40136a
push dword [ebp + 8]
call fcn.0041aea4
add esp, 4
mov edi, eax
add edi, 1
push edi
push 0x2000
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x401365
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0041ae2d
add esp, 8
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
call sub.USER32.DLL_EmptyClipboard
push dword [ebp - 8]
push 1
call sub.USER32.DLL_SetClipboardData
mov dword [ebp - 4], 1
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x401370
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40137b
push edi
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.dll_RtlZeroMemory
call fcn.0040129c
cmp eax, 0
je 0x4013e2
push 1
call sub.USER32.DLL_GetClipboardData
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4013dd
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 0xc], eax
push dword [ebp + 0xc]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.CRTDLL.DLL_strncpy
add esp, 0xc
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalUnlock
mov dword [ebp - 4], 1
call sub.USER32.DLL_CloseClipboard
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x401944
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov ecx, 0x84
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x401952
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov word [ebp + 0xc], di
call sub.KERNEL32.dll_GetCommandLineA
mov dword [ebp - 4], eax
mov edi, dword [ebp - 4]
cmp byte [edi], 0x22
jne 0x40198b
mov edi, dword [ebp - 4]
mov esi, edi
add esi, 1
mov dword [ebp - 4], esi
mov bl, byte [edi]
mov byte [ebp - 0x209], bl
jmp 0x401992
mov byte [ebp - 0x209], 0x20
mov dword [ebp - 8], 0
dec word [ebp + 0xc]
jmp 0x4019be
mov edi, dword [ebp - 8]
mov esi, edi
add esi, 1
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
mov ebx, esi
add ebx, 1
mov dword [ebp - 4], ebx
mov bl, byte [esi]
mov byte [ebp + edi - 0x208], bl
mov edi, dword [ebp - 4]
movsx ebx, byte [edi]
cmp ebx, 0
je 0x4019dd
movsx edx, byte [ebp - 0x209]
cmp ebx, edx
je 0x4019dd
movzx edi, word [ebp + 0xc]
cmp dword [ebp - 8], edi
jl 0x40199f
mov edi, dword [ebp - 8]
mov byte [ebp + edi - 0x208], 0
push 0x3a
lea edi, [ebp - 0x208]
push edi
call sub.CRTDLL.DLL_strchr
add esp, 8
cmp eax, 0
jne 0x401a10
cmp byte [ebp - 0x208], 0x5c
jne 0x401a27
cmp byte [ebp - 0x207], 0x5c
jne 0x401a27
lea edi, [ebp - 0x208]
push edi
push dword [ebp + 8]
call fcn.0041ae2d
add esp, 8
jmp 0x401b30
push dword [ebp + 8]
push 0x100
call sub.KERNEL32.dll_GetCurrentDirectoryA
cmp byte [ebp - 0x208], 0x5c
jne 0x401a70
push 0x5c
push dword [ebp + 8]
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401a59
mov edi, dword [ebp - 4]
mov byte [edi], 0
lea edi, [ebp - 0x208]
push edi
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
jmp 0x401b30
cmp byte [ebp - 0x208], 0x2e
jne 0x401af3
cmp byte [ebp - 0x207], 0x2e
jne 0x401af3
cmp byte [ebp - 0x206], 0x5c
jne 0x401af3
lea edi, [ebp - 0x208]
mov dword [ebp - 4], edi
jmp 0x401abf
push 0x5c
push dword [ebp + 8]
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
je 0x401abb
mov edi, dword [ebp - 0x210]
mov byte [edi], 0
add dword [ebp - 4], 3
mov edi, dword [ebp - 4]
cmp byte [edi], 0x2e
jne 0x401ad3
cmp byte [edi + 1], 0x2e
jne 0x401ad3
cmp byte [edi + 2], 0x5c
je 0x401a96
push 0x435104
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp - 4]
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
jmp 0x401b30
lea edi, [ebp - 0x208]
mov dword [ebp - 4], edi
cmp byte [ebp - 0x208], 0x2e
jne 0x401b12
cmp byte [ebp - 0x207], 0x5c
jne 0x401b12
add dword [ebp - 4], 2
push 0x435104
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp - 4]
push dword [ebp + 8]
call sub.CRTDLL.DLL_strcat
add esp, 8
push 0x5c
push dword [ebp + 8]
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401b4d
mov edi, dword [ebp - 4]
mov byte [edi + 1], 0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402161
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov ecx, 0xd8
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40216f
push edi
push 0x44
push 0
lea edi, [ebp - 0x44]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 0xa
mov word [ebp - 0x14], 4
push 0x10
push 0
lea edi, [ebp - 0x258]
push edi
call sub.CRTDLL.DLL_memset
add esp, 0xc
push dword [ebp + 8]
lea edi, [ebp - 0x358]
push edi
call fcn.0041ae2d
add esp, 8
push 0x5c
lea edi, [ebp - 0x358]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x4021ec
mov edi, dword [ebp - 0x360]
mov byte [edi], 0
push dword [ebp + 8]
lea edi, [ebp - 0x248]
push edi
call sub.KERNEL32.dll_lstrcpyA
lea edi, [ebp - 0x248]
push edi
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x48], eax
mov edi, dword [ebp - 0x48]
mov byte [ebp + edi - 0x248], 0x20
inc dword [ebp - 0x48]
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x48]
lea edi, [ebp + edi - 0x248]
push edi
call sub.KERNEL32.dll_lstrcpyA
lea edi, [ebp - 0x258]
push edi
lea edi, [ebp - 0x44]
push edi
lea edi, [ebp - 0x358]
push edi
push 0
push 0x20
push 0
push 0
push 0
lea edi, [ebp - 0x248]
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
je 0x40229c
mov edi, dword [ebp - 0x258]
cmp edi, 0
je 0x40227f
cmp edi, 0xffffffff
je 0x40227f
push dword [ebp - 0x258]
call sub.KERNEL32.dll_CloseHandle
cmp dword [ebp - 0x254], 0
je 0x40229c
cmp dword [ebp - 0x254], 0xffffffff
je 0x40229c
push dword [ebp - 0x254]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0x35c]
pop edi
leave
ret
Function at 0x40409a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov ecx, 0x85
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x4040a8
push edi
lea edi, [ebp - 0x10c]
push edi
push 1
push 0
push dword [ebp + 8]
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
cmp eax, 0
jne 0x40418d
mov dword [ebp - 8], 0x100
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 0x20c]
push edi
lea edi, [ebp - 0x210]
push edi
push 0
push str.Count
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x404182
mov edi, dword [ebp - 0x20c]
mov dword [ebp - 0x214], edi
mov dword [ebp - 4], 0
jmp 0x404177
push dword [ebp - 4]
push 0x45e3a7
lea edi, [ebp - 0x108]
push edi
call fcn.0041adb1
add esp, 0xc
mov dword [ebp - 8], 0x100
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 0x20c]
push edi
lea edi, [ebp - 0x210]
push edi
push 0
lea edi, [ebp - 0x108]
push edi
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegQueryValueExA
cmp eax, 0
jne 0x404174
push dword [ebp + 0xc]
lea edi, [ebp - 0x20c]
push edi
call fcn.00403db5
add esp, 8
inc dword [ebp - 4]
mov edi, dword [ebp - 0x214]
cmp dword [ebp - 4], edi
jb 0x404119
push dword [ebp - 0x10c]
call sub.ADVAPI32.DLL_RegCloseKey
pop edi
leave
ret
Function at 0x404742
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov ecx, 0x40
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x404750
push ebx
push edi
cmp dword [ebp + 0xc], 0
jne 0x40476b
lea edi, [ebp - 0x100]
mov dword [ebp + 0xc], edi
push 0x4331dc
push dword [ebp + 0xc]
call fcn.0041ae2d
add esp, 8
push dword [ebp + 8]
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_strcat
add esp, 8
push str..exe
push dword [ebp + 0xc]
call sub.CRTDLL.DLL_strcat
add esp, 8
push dword [ebp + 0xc]
call sub.KERNEL32.dll_GetFileAttributesA
mov edi, eax
cmp edi, 0xffffffff
je 0x4047af
mov ebx, 1
jmp 0x4047b4
mov ebx, 0
mov eax, ebx
pop edi
pop ebx
leave
ret

Function at 0x404c8d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 5
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x404c98
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 0
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x404cec
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x404cec
mov dword [ebp - 4], 0
cmp dword [ebp - 0xc], 0xffffffff
je 0x404dcf
cmp dword [ebp - 4], 0
je 0x404dcf
push dword [ebp - 4]
push dword [0x41f014]
push str.send__s_with__ld_bytes_r_n
push dword [0x41f004]
call fcn.00406494
add esp, 0x10
cmp dword [0x424970], 0
jl 0x404d71
push 0
mov edi, dword [0x424970]
shl edi, 7
lea edi, [edi + 0x4285ec]
push edi
call sub.USER32.DLL_FindWindowA
mov dword [0x4203dc], eax
cmp eax, 0
je 0x404dcf
push dword [ebp + 8]
push dword [0x4203dc]
call fcn.00401616
add esp, 8
mov edi, dword [0x41f008]
mov dword [0x41f00c], edi
mov dword [ebp - 8], 1
jmp 0x404dcf
push dword [ebp - 4]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp eax, 0
jne 0x404d8d
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
jmp 0x404dcf
push 0
lea edi, [ebp - 0x14]
push edi
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call sub.KERNEL32.dll_ReadFile
cmp eax, 0
je 0x404dbf
mov edi, dword [ebp - 4]
cmp dword [ebp - 0x14], edi
jne 0x404dbf
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.00404a9d
add esp, 8
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalFree
cmp dword [ebp - 8], 0
jne 0x404ddf
mov dword [0x41f00c], 0xffffffff
mov eax, dword [ebp - 8]
pop edi
leave
ret
Function at 0x406068
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 3
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x406073
push edi
push 0x45e205
push dword [ebp + 8]
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x40610f
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
push dword [ebp - 0xc]
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 8], eax
cmp eax, 0
je 0x4060f8
push dword [ebp - 4]
push dword [ebp - 0xc]
push 1
push dword [ebp - 8]
call sub.CRTDLL.DLL_fread
add esp, 0x10
push dword [ebp - 8]
call fcn.00405e6c
add esp, 4
push dword [ebp - 8]
call sub.KERNEL32.dll_GlobalFree
jmp 0x406102
mov dword [0x41f00c], 0xffffffff
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
jmp 0x406119
mov dword [0x41f00c], 0xffffffff
pop edi
leave
ret
Function at 0x407933
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 6
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40793e
push edi
lea edi, [ebp - 8]
push edi
lea edi, [ebp - 4]
push edi
push 0xb0
push dword [ebp + 8]
call sub.USER32.DLL_SendMessageA
mov edi, dword [ebp - 4]
cmp dword [ebp - 8], edi
je 0x407a1b
lea edi, [ebp - 0xc]
push edi
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.004071af
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp eax, 0
je 0x407a1b
push dword [ebp - 0xc]
push 0x4284dc
call fcn.00407750
add esp, 8
mov dword [ebp - 0x14], eax
cmp eax, 0
je 0x407a13
cmp dword [ebp - 0x14], 5
jae 0x4079c0
movzx edi, word [ebp - 0x14]
push edi
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0x10]
push edi
call fcn.004072c8
add esp, 0xc
jmp 0x4079db
cmp dword [ebp - 0x14], 5
jbe 0x4079db
movzx edi, word [ebp - 0x14]
push edi
lea edi, [ebp - 0xc]
push edi
lea edi, [ebp - 0x10]
push edi
call fcn.004074cb
add esp, 0xc
push 0x45e966
push 0x4284dc
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 0x18], eax
cmp eax, 0
je 0x407a13
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push 1
push dword [ebp - 0x10]
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
push dword [ebp - 0x18]
call sub.CRTDLL.DLL_fclose
add esp, 4
push dword [ebp - 0x10]
call sub.KERNEL32.dll_GlobalFree
pop edi
leave
ret
Function at 0x407ad0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov ecx, 0x82
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x407ade
push esi
push edi
mov dword [ebp - 0x104], 2
mov dword [0x424148], 0
call fcn.0040ed90
cmp eax, 0
je 0x407c6b
push str.The_hardcopy_is_put_into_Clipboard
push 0
call fcn.00406708
add esp, 8
push 0x4330dc
lea edi, [ebp - 0x204]
push edi
call fcn.0041ae2d
add esp, 8
push 0x2e
lea edi, [ebp - 0x204]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x407b54
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
lea edi, [ebp - 0x204]
push edi
push str._s.bmp
lea edi, [ebp - 0x100]
push edi
call fcn.0041adb1
add esp, 0xc
jmp 0x407b9e
mov edi, dword [ebp - 0x104]
mov esi, edi
add esi, 1
mov dword [ebp - 0x104], esi
push edi
lea edi, [ebp - 0x204]
push edi
push str._s__d_.bmp
lea edi, [ebp - 0x100]
push edi
call fcn.0041adb1
add esp, 0x10
lea edi, [ebp - 0x100]
push edi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x407b71
lea edi, [ebp - 0x100]
push edi
call fcn.00407a1e
add esp, 4
cmp eax, 0
je 0x407c6b
lea edi, [ebp - 0x100]
push edi
push 0x434524
call fcn.004114c7
add esp, 8
push 0x2e
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x407c00
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
lea edi, [ebp - 0x100]
push edi
call fcn.0041aea4
add esp, 4
mov edi, eax
sub edi, 1
cmp byte [ebp + edi - 0x100], 0x29
jne 0x407c43
push 0x28
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strrchr
add esp, 8
mov dword [ebp - 0x208], eax
cmp eax, 0
je 0x407c43
mov edi, dword [ebp - 0x208]
mov byte [edi], 0
push str..bmp
lea edi, [ebp - 0x100]
push edi
call sub.CRTDLL.DLL_strcat
add esp, 8
lea edi, [ebp - 0x100]
push edi
push 0x4330dc
call fcn.0041ae2d
add esp, 8
cmp dword [0x434524], 0
je 0x407c89
push dword [0x434524]
call sub.KERNEL32.dll_GlobalFree
mov dword [0x434524], 0
mov dword [0x424148], 1
pop edi
pop esi
leave
ret
Function at 0x4082f3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov ecx, 0x45
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x408301
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [edi + 0x10c], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x108], 0
je 0x408342
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x108], 0
mov edi, dword [ebp + 8]
cmp byte [edi], 0
je 0x408530
push 0x4331dc
push dword [ebp + 8]
lea edi, [ebp - 0x104]
push edi
call fcn.00401b52
add esp, 0xc
push 0x45e838
lea edi, [ebp - 0x104]
push edi
call sub.CRTDLL.DLL_fopen
add esp, 8
mov dword [ebp - 4], eax
cmp eax, 0
je 0x40851e
push 2
push 0
push dword [ebp - 4]
call sub.CRTDLL.DLL_fseek
add esp, 0xc
push dword [ebp - 4]
call sub.CRTDLL.DLL_ftell
add esp, 4
mov dword [ebp - 0x108], eax
push dword [ebp - 4]
call sub.CRTDLL.DLL_rewind
add esp, 4
cmp dword [ebp - 0x108], 0
je 0x408513
mov edi, dword [ebp - 0x108]
add edi, 1
push edi
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov esi, dword [ebp + 8]
mov dword [esi + 0x108], eax
cmp eax, 0
je 0x408513
push dword [ebp - 4]
push dword [ebp - 0x108]
push 1
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.CRTDLL.DLL_fread
add esp, 0x10
cmp eax, dword [ebp - 0x108]
je 0x408424
mov edi, dword [ebp + 8]
push dword [edi + 0x108]
call sub.KERNEL32.dll_GlobalFree
mov edi, dword [ebp + 8]
mov dword [edi + 0x108], 0
jmp 0x408513
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x108]
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x108]
mov esi, dword [ebp - 0x10c]
mov byte [esi + edi], 0
mov edi, dword [ebp + 8]
mov dword [edi + 0x10c], 0
mov edi, dword [ebp + 8]
add edi, 0x100
push edi
lea edi, [ebp - 0x104]
push edi
call fcn.0040828a
add esp, 8
jmp 0x408504
mov edi, dword [ebp - 0x10c]
mov dword [ebp - 0x110], edi
jmp 0x408483
add dword [ebp - 0x10c], 1
mov edi, dword [ebp - 0x10c]
movsx ebx, byte [edi]
cmp ebx, 0
je 0x408496
cmp ebx, 0xa
jne 0x40847c
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0xa
jne 0x4084b5
mov edi, dword [ebp - 0x10c]
mov esi, edi
add esi, 1
mov dword [ebp - 0x10c], esi
mov byte [edi], 0
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10c], 0x1f3
jge 0x408504
mov edi, dword [ebp + 8]
mov eax, 0xc
mul dword [edi + 0x10c]
mov dword [ebp - 0x114], eax
mov esi, dword [ebp - 0x114]
lea edi, [esi + edi + 0x110]
push edi
push dword [ebp - 0x110]
call fcn.00407fe0
add esp, 8
cmp eax, 0
je 0x408504
mov edi, dword [ebp + 8]
add edi, 0x10c
inc dword [edi]
mov edi, dword [ebp - 0x10c]
cmp byte [edi], 0
jne 0x40846e
push dword [ebp - 4]
call sub.CRTDLL.DLL_fclose
add esp, 4
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10c], 0
jne 0x408530
mov edi, dword [ebp + 8]
mov byte [edi], 0
push 0
mov edi, dword [ebp + 8]
push dword [edi + 0x10c]
push 0x445
push dword [0x4203ec]
call sub.USER32.DLL_SetDlgItemInt
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cd96
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 5
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40cda1
push edi
cmp dword [0x4343b4], 0
je 0x40cdf1
lea edi, [ebp - 0x14]
push edi
lea edi, [ebp - 8]
push edi
push dword [0x4343b4]
call sub.KERNEL32.dll_ClearCommError
cmp eax, 0
jne 0x40cdd7
mov eax, 0xffffffff
jmp 0x40ce6f
cmp dword [ebp - 8], 0
je 0x40cdec
mov edi, 0
mov eax, edi
sub eax, dword [ebp - 8]
jmp 0x40ce6f
mov eax, dword [ebp - 0x10]
jmp 0x40ce6f
cmp dword [0x4345d4], 0
je 0x40ce43
lea edi, [ebp - 4]
push edi
push dword [0x4345d4]
call dword [0x4345e0]
mov dword [0x434634], eax
cmp dword [0x434634], 0
jne 0x40ce1d
mov eax, dword [ebp - 4]
jmp 0x40ce6f
call fcn.0040cbb9
push 0x32
call sub.KERNEL32.dll_Sleep
push dword [0x43439c]
push 0x2634
call fcn.0040c911
add esp, 8
mov eax, 0
jmp 0x40ce6f
cmp dword [0x4343e0], 0
je 0x40ce6a
lea edi, [ebp - 4]
push edi
push 0x4004667f
push dword [0x4343e0]
call sub.WS2_32.DLL_ioctlsocket
cmp eax, 0
jne 0x40ce6a
mov eax, dword [ebp - 4]
jmp 0x40ce6f
mov eax, 0xffffffff
pop edi
leave
ret

Function at 0x40ceb8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, 4
dec ecx
mov dword [esp + ecx*4], 0xfffa5a5a
jne 0x40cec3
push edi
cmp dword [0x4343b4], 0
jne 0x40cef3
cmp dword [0x4345d4], 0
jne 0x40cef3
cmp dword [0x4343e0], 0
jne 0x40cef3
mov eax, 0xffffffff
jmp 0x40cfcd
call fcn.0040c895
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
cmp dword [0x4343b4], 0
je 0x40cf27
push 0
lea edi, [ebp - 4]
push edi
push 1
lea edi, [ebp - 0xd]
push edi
push dword [0x4343b4]
call sub.KERNEL32.dll_ReadFile
jmp 0x40cf86
cmp dword [0x4345d4], 0
je 0x40cf52
call fcn.0040cd96
cmp eax, 1
jl 0x40cf86
lea edi, [ebp - 4]
push edi
push 1
lea edi, [ebp - 0xd]
push edi
push dword [0x4345d4]
call dword [0x43459c]
jmp 0x40cf86
cmp dword [0x4343e0], 0
je 0x40cf86
call fcn.0040cd96
cmp eax, 1
jl 0x40cf86
lea edi, [ebp - 0xd]
push edi
push 1
push 0x4343d8
call fcn.0041242f
add esp, 0xc
cmp eax, 0
jne 0x40cf86
mov edi, dword [0x4343e4]
mov dword [ebp - 4], edi
cmp dword [ebp - 4], 1
je 0x40cfac
call fcn.0040c895
mov dword [ebp - 8], eax
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], edi
je 0x40cfac
dec dword [ebp + 8]
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
push 0xa
call sub.KERNEL32.dll_Sleep
cmp dword [ebp - 4], 1
je 0x40cfbc
cmp dword [ebp + 8], 0
jg 0x40cefe
cmp dword [ebp - 4], 1
je 0x40cfc9
mov eax, 0xffffffff
jmp 0x40cfcd
movzx eax, byte [ebp - 0xd]
pop edi
leave
ret