joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40270e
Capabilities:
Access the windows event log
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
xor ebx, ebx
call edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp ebx, 0x58ce99d
jg 0x40273e
inc ebx
cmp ebx, 0x1f6502b0
jl 0x402724
cmp dword [0x4ae264], 0x400
jne 0x4027c0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeCmpStringHandles]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_BackupEventLogA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push str.nojojatobajehivonafepuxefemi
push esi
call fcn.00402a88
push esi
push esi
call fcn.00402e34
fldz
add esp, 8
fstp qword [esp]
call fcn.00402cd0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402860
fstp st(0)
push esi
call fcn.00402ee1
push esi
call fcn.00402ef0
add esp, 0x10
xor ebx, ebx
cmp ebx, 0xd0fe
jge 0x4027d1
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp ebx, 0x58bc6e
jg 0x4027eb
inc ebx
cmp ebx, 0xe52f
jl 0x4027c2
mov eax, dword [0x4a7304]
mov dword [0x4ae264], eax
call fcn.0040249e
mov edi, 0x3078f
cmp dword [0x4ae264], 0x51f
jne 0x402819
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x4027ff
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x4071ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a6d58]
jne 0x4071b8
repz ret
jmp fcn.00409aee
Function at 0x409718
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a6d58]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405b0c
and dword [ebp - 0x14], 0
cmp dword [0x4a8e24], 0
mov dword [ebp - 0x18], eax
jne 0x4097cb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409873
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409873
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4a8e24], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4a8e28], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4a8e2c], eax
call edi
push eax
call esi
mov dword [0x4a8e34], eax
test eax, eax
je 0x4097cb
push 0x4a4d18
push ebx
call edi
push eax
call esi
mov dword [0x4a8e30], eax
mov eax, dword [0x4a8e30]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409824
cmp dword [0x4a8e34], ecx
je 0x409824
push eax
call esi
push dword [0x4a8e34]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409824
test ebx, ebx
je 0x409824
call edi
test eax, eax
je 0x40981b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40981b
test byte [ebp - 8], 1
jne 0x409824
or dword [ebp + 0x10], 0x200000
jmp 0x409857
mov eax, dword [0x4a8e28]
cmp eax, dword [ebp - 0x18]
je 0x409857
push eax
call esi
test eax, eax
je 0x409857
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409857
mov eax, dword [0x4a8e2c]
cmp eax, dword [ebp - 0x18]
je 0x409857
push eax
call esi
test eax, eax
je 0x409857
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4a8e24]
call esi
test eax, eax
je 0x409873
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409875
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004071ae
leave
ret
Function at 0x414fa6
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push 8
mov eax, 0x429b80
call fcn.004183e9
mov dword [ebp - 0x14], ecx
mov eax, dword [0x434e8c]
inc dword [0x434e8c]
test eax, eax
jne 0x4150a7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x434e84], eax
cmp eax, 0xffffffff
jne 0x414fef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
push 0x430310
lea eax, [ebp - 0x10]
push eax
call fcn.00417fb7
push 0x18
call fcn.00415d24
pop ecx
mov dword [ebp - 0x10], eax
xor esi, esi
mov dword [ebp - 4], esi
cmp eax, esi
je 0x41500c
mov ecx, eax
call fcn.00414da5
jmp 0x41500e
xor eax, eax
or dword [ebp - 4], 0xffffffff
push 0x54
mov dword [0x434e80], eax
call fcn.00415d24
pop ecx
mov dword [ebp - 0x10], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
cmp eax, esi
je 0x415039
push ebx
push esi
mov ecx, eax
call fcn.00414f17
mov edi, eax
jmp 0x41503b
xor edi, edi
or dword [ebp - 4], 0xffffffff
push 2
push esi
lea eax, [edi + 0x38]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov dword [edi + 0x1c], ebx
mov dword [ebp - 0x10], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x414fd8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
push dword [0x434e84]
mov dword [edi + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x414fd8
push ebx
call fcn.00414ebc
pop ecx
push eax
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x414fd8
mov eax, dword [ebp - 0x14]
call fcn.00418452
ret

Function at 0x41512d
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x10
mov eax, 0x429ba3
call fcn.004183e9
mov esi, ecx
lea ebx, [esi + 4]
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
call fcn.00414dbb
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0x1c], edi
je 0x41516c
xor eax, eax
lea edi, [ebp - 0xd]
stosb byte es:[edi], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0xd], al
push 0x430370
lea eax, [ebp - 0xd]
push eax
call fcn.00417fb7
lea eax, [ebp - 0x14]
push eax
push 4
push esi
push 0x4150b0
push edi
push edi
call fcn.00418567
mov ecx, dword [ebp - 0x14]
add esp, 0x18
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ecx
cmp eax, edi
jne 0x4151a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
push 0x430310
lea eax, [ebp - 0x18]
jmp 0x415166
push dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
je 0x41518f
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x41518f
mov dword [esi + 0x1c], 1
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
call fcn.00414dc3
call fcn.00418452
ret

Function at 0x415ae3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433300]
jne 0x415aed
repz ret
jmp fcn.0041b496
Function at 0x42132a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041d03c
and dword [ebp - 4], 0
cmp dword [0x435a98], 0
mov ebx, eax
jne 0x4213db
push 0x42e4dc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42148c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42e4d0
push edi
call esi
test eax, eax
je 0x42148c
push eax
call fcn.0041cfca
mov dword [esp], 0x42e4c0
push edi
mov dword [0x435a98], eax
call esi
push eax
call fcn.0041cfca
mov dword [esp], 0x42e4ac
push edi
mov dword [0x435a9c], eax
call esi
push eax
call fcn.0041cfca
mov dword [esp], 0x42e490
push edi
mov dword [0x435aa0], eax
call esi
push eax
call fcn.0041cfca
pop ecx
mov dword [0x435aa8], eax
test eax, eax
je 0x4213db
push 0x42e478
push edi
call esi
push eax
call fcn.0041cfca
pop ecx
mov dword [0x435aa4], eax
mov eax, dword [0x435aa4]
cmp eax, ebx
je 0x421433
cmp dword [0x435aa8], ebx
je 0x421433
push eax
call fcn.0041d045
push dword [0x435aa8]
mov esi, eax
call fcn.0041d045
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421433
test edi, edi
je 0x421433
call esi
test eax, eax
je 0x42142a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42142a
test byte [ebp - 0xc], 1
jne 0x421433
or dword [ebp + 0x10], 0x200000
jmp 0x42146c
mov eax, dword [0x435a9c]
cmp eax, ebx
je 0x42146c
push eax
call fcn.0041d045
pop ecx
test eax, eax
je 0x42146c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42146c
mov eax, dword [0x435aa0]
cmp eax, ebx
je 0x42146c
push eax
call fcn.0041d045
pop ecx
test eax, eax
je 0x42146c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435a98]
call fcn.0041d045
pop ecx
test eax, eax
je 0x42148c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42148e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x424180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea ecx, [ebp + 8]
call fcn.00407080
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov byte [ebp - 5], cl
lea ecx, [ebp + 8]
call fcn.004070a0
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x424290
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x444]
test ecx, ecx
je 0x4242c2
push 0
push 0x42e5ab
push 0x104
mov edx, dword [ebp - 4]
add edx, 0x33
push edx
call fcn.00417c58
add esp, 0x10
jmp 0x4242d4
mov eax, dword [ebp - 4]
add eax, 0x33
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x33
push ecx
push 0x104
mov edx, dword [ebp - 4]
add edx, 0x23b
push edx
call fcn.00417c58
add esp, 0x10
push 0x104
mov eax, dword [ebp - 4]
add eax, 0x33
push eax
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x137
push ecx
call fcn.00417c58
add esp, 0x10
mov ecx, 0x435bd0
call fcn.00407080
push eax
mov edx, dword [ebp - 4]
add edx, 0x23b
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov ecx, 0x435bb4
call fcn.00407080
push eax
mov eax, dword [ebp - 4]
add eax, 0x137
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x33f
push ecx
mov edx, dword [0x435b88]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 4]
mov byte [eax + 0x442], 0
mov esp, ebp
pop ebp
ret

Function at 0x424380
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004235c0
mov eax, dword [0x433300]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1000], ecx
mov eax, dword [ebp - 0x1000]
movzx ecx, byte [eax + 0x444]
test ecx, ecx
je 0x4243b5
mov al, 1
jmp 0x42449f
push 0xfd2
lea edx, [ebp - 0xfe0]
push edx
push 0x68
mov eax, dword [0x435b88]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x4243da
xor al, al
jmp 0x42449f
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov ecx, dword [ebp - 0x1000]
add ecx, 0x23b
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xff4], eax
cmp dword [ebp - 0xff4], 0xffffffff
jne 0x424412
xor al, al
jmp 0x42449f
mov edx, dword [ebp - 0xff4]
push edx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea ecx, [ebp - 0xfec]
push ecx
call fcn.004046b0
add esp, 0xc
lea edx, [ebp - 0xfec]
mov dword [ebp - 0xff0], edx
push 0
lea eax, [ebp - 0xff8]
push eax
push 0xfd2
lea ecx, [ebp - 0xfe0]
push ecx
mov edx, dword [ebp - 0xff4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424478
cmp dword [ebp - 0xff8], 0xfd2
jne 0x424478
mov dword [ebp - 0x1004], 1
jmp 0x424482
mov dword [ebp - 0x1004], 0
mov al, byte [ebp - 0x1004]
mov byte [ebp - 0xff9], al
lea ecx, [ebp - 0xfec]
call fcn.00401c40
mov al, byte [ebp - 0xff9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415ae3
mov esp, ebp
pop ebp
ret
Function at 0x4244b0
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
push 0x42e640
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [0x435b88]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4244e0
xor al, al
jmp 0x42464f
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [0x435b88]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x424500
xor al, al
jmp 0x42464f
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [0x435b88]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x424521
xor al, al
jmp 0x42464f
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [sym.imp.KERNEL32.dll_FreeResource]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.004046b0
add esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x424565
mov byte [ebp - 0x39], 0
lea ecx, [ebp - 0xc]
call fcn.00401c40
mov al, byte [ebp - 0x39]
jmp 0x42464f
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0xc]
call fcn.00407080
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4245d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4245c3
mov ecx, dword [ebp + 0xc]
call fcn.00407080
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4245c3
mov byte [ebp - 0x3a], 1
lea ecx, [ebp - 0xc]
call fcn.00401c40
mov al, byte [ebp - 0x3a]
jmp 0x42464f
mov byte [ebp - 0x3b], 0
lea ecx, [ebp - 0xc]
call fcn.00401c40
mov al, byte [ebp - 0x3b]
jmp 0x42464f
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.004046b0
add esp, 0xc
lea edx, [ebp - 0x20]
mov dword [ebp - 0x28], edx
push 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x424638
mov ecx, dword [ebp + 0xc]
call fcn.00407080
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x424638
mov byte [ebp - 0x3c], 0
lea ecx, [ebp - 0x20]
call fcn.00401c40
lea ecx, [ebp - 0xc]
call fcn.00401c40
mov al, byte [ebp - 0x3c]
jmp 0x42464f
mov byte [ebp - 0x3d], 1
lea ecx, [ebp - 0x20]
call fcn.00401c40
lea ecx, [ebp - 0xc]
call fcn.00401c40
mov al, byte [ebp - 0x3d]
mov esp, ebp
pop ebp
ret 8
Function at 0x424660
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x433300]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x130], ecx
mov ecx, dword [ebp - 0x130]
call fcn.00424290
mov eax, dword [ebp - 0x130]
add eax, 0x33
push eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call fcn.00417d0d
add esp, 0xc
mov ecx, 0x435bec
call fcn.00407080
push eax
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4246fd
push 0x42e638
push 7
mov ecx, dword [ebp - 0x130]
add ecx, 0x2c
push ecx
call fcn.00417d0d
add esp, 0xc
jmp 0x42476d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea ecx, [ebp - 0x128]
push ecx
call fcn.004046b0
add esp, 0xc
lea edx, [ebp - 0x128]
mov dword [ebp - 0x12c], edx
push 0
lea eax, [ebp - 0x11c]
push eax
push 7
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [ebp - 0x112], 0
push 7
mov eax, dword [ebp - 0x130]
add eax, 0x2c
push eax
push 7
lea ecx, [ebp - 0x118]
push ecx
call fcn.00424160
add esp, 0x10
lea ecx, [ebp - 0x128]
call fcn.00401c40
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415ae3
mov esp, ebp
pop ebp
ret
Function at 0x4247f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a15d
mov eax, dword fs:[0]
push eax
sub esp, 0xd0
mov eax, dword [0x433300]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 4], 1
push 0x44
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.00416360
add esp, 0xc
mov dword [ebp - 0x6c], 0x44
push 0x42e664
lea ecx, [ebp - 0x88]
call fcn.00406c40
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0xd0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0xd0]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xa4]
push ecx
call fcn.004146c0
add esp, 0xc
mov dword [ebp - 0xd4], eax
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0xd8], edx
mov byte [ebp - 4], 3
lea eax, [ebp + 0x24]
push eax
mov ecx, dword [ebp - 0xd8]
push ecx
lea edx, [ebp - 0xc0]
push edx
call fcn.004146c0
add esp, 0xc
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0xdc]
call fcn.00407080
push eax
lea ecx, [ebp + 8]
call fcn.00407080
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0xc0]
call fcn.004070a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.004070a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x88]
call fcn.004070a0
cmp dword [ebp - 0x14], 0
setne dl
mov byte [ebp - 0xc1], dl
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004070a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x24]
call fcn.004070a0
mov al, byte [ebp - 0xc1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x38

Function at 0x424b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x24], ecx
push 0
push 0
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp - 0x24]
add eax, 0x137
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x424b73
mov ecx, dword [ebp - 0x24]
add ecx, 0x137
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x1c], esp
push ecx
mov ecx, edx
call fcn.00406c40
mov dword [ebp - 0x28], eax
call fcn.00424180
add esp, 0x1c
mov byte [ebp - 0x29], al
movzx eax, byte [ebp - 0x29]
test eax, eax
jne 0x424b73
xor al, al
jmp 0x424bdc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.004046b0
add esp, 0xc
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424bc4
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0xc]
jne 0x424bc4
mov dword [ebp - 0x30], 1
jmp 0x424bcb
mov dword [ebp - 0x30], 0
mov cl, byte [ebp - 0x30]
mov byte [ebp - 0x1d], cl
lea ecx, [ebp - 0x18]
call fcn.00401c40
mov al, byte [ebp - 0x1d]
mov esp, ebp
pop ebp
ret 8
Function at 0x4255e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 4]
mov byte [edx + 0x10], 0
mov esp, ebp
pop ebp
ret

Function at 0x425670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CModelessDialog.0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 4], 0
je 0x4256c0
push 0
push 0xffffffffffffffeb
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov esp, ebp
pop ebp
ret
Function at 0x4010d4
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010e6
mov eax, dword [0x44308b]
shl eax, 2
mov dword [0x44308f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00405cf0
pop edx
call fcn.0040508c
call fcn.00405cf4
push 0
call fcn.00407244
pop ecx
push 0x443034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x443093], eax
push 0
jmp fcn.0040d950

Function at 0x4015a8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x492c21]
mov edx, dword [0x492c29]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x492c25]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x492c2d]
mov dword [0x4ab2a8], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4016ec
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401657
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4016ee
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00406268
add esp, 0xc
test eax, eax
je 0x401671
xor eax, eax
jmp 0x4016ee
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x40169a
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4016ee
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x49216c], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x49216c]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4016e5
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4016ee
mov eax, 1
jmp 0x4016ee
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret