joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40de35
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestFloatingPoint.exe_gMozillaPoisonSize], eax
call fcn.0040ad01
pop ecx
mov ecx, dword [sym.TestFloatingPoint.exe_gMozillaPoisonSize]
mov dword [sym.TestFloatingPoint.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40de6d
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestFloatingPoint.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret

Function at 0x416830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x41684a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416840
mov eax, 1
add ebx, ebx
jne 0x416863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416858
jne 0x416874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416858
xor ecx, ecx
sub eax, 3
jb 0x416888
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4168fa
mov ebp, eax
add ebx, ebx
jne 0x416893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4168a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4168c4
inc ecx
add ebx, ebx
jne 0x4168b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4168a5
jne 0x4168c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4168a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4168e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4168d5
jmp 0x416846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4168e4
add edi, ecx
jmp 0x416846
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41694c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x169f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416901
mov ecx, edi
jns 0x416930
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16a7c]
or eax, eax
je 0x416946
mov dword [ebx], eax
add ebx, 4
jmp 0x41691e
call dword [esi + 0x16a78]
mov ebp, dword [esi + 0x16a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416980
sub esp, 0xffffff80
jmp 0x404843
Function at 0x40e063
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004097cf
mov dword [ebp - 0x14], eax
cmp dword [0x4308a4], esi
jne 0x40e156
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40e0e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e236
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e236
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e236
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4308a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4308a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4308ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4308b4], eax
test eax, eax
je 0x40e153
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4308b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40e17b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40e16e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40e190
push 4
pop eax
jmp 0x40e238
cmp dword [ebp - 0x14], esi
je 0x40e190
push dword [0x4308a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40e175
mov eax, dword [0x4308b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40e1ee
cmp dword [0x4308b4], edi
je 0x40e1ee
push eax
call ebx
push dword [0x4308b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40e1ee
test eax, eax
je 0x40e1ee
call ecx
test eax, eax
je 0x40e1e3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40e1e3
test byte [ebp - 8], 1
jne 0x40e1ee
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e21e
mov eax, dword [0x4308a8]
cmp eax, edi
je 0x40e21b
push eax
call ebx
test eax, eax
je 0x40e21b
call eax
mov esi, eax
test esi, esi
je 0x40e21b
mov eax, dword [0x4308ac]
cmp eax, edi
je 0x40e21b
push eax
call ebx
test eax, eax
je 0x40e21b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4308a4]
call ebx
test eax, eax
je 0x40e236
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e238
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040419b
mov esp, ebp
pop ebp
ret
Function at 0x10025224
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10025233
pop dword [ebp - 0x20]
mov eax, 0x847bdb0f
sub eax, 0x747988dc
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc57681ae
add dword [ebp - 0x30], 0x88dbc39d
mov dword [ebp - 0x2c], 0x94f80219
sub dword [ebp - 0x2c], 0x62c4b5d4
mov dword [ebp - 0x28], 0x2b87e894
add dword [ebp - 0x28], 0x20c45b9a
mov dword [ebp - 0x24], 0x88c43eac
add dword [ebp - 0x24], 0x773bc154
lea eax, [ebp - 0x30]
push eax
mov eax, 0xdf7fc3a
add eax, 0x20e03d6
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf2c0e52d
add dword [ebp - 0x30], 0x81b18429
mov dword [ebp - 0x2c], 0x984dc9d5
add dword [ebp - 0x2c], 0xa91e97a0
mov dword [ebp - 0x28], 0xb89265bf
sub dword [ebp - 0x28], 0x5522f953
mov dword [ebp - 0x24], 0xc8b27067
add dword [ebp - 0x24], 0x374d8f99
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x576ac
push 0
call eax
mov ecx, 0x4e89
mov esi, eax
mov edi, 0x18fcc7df
add edi, 0xf70bf421
add edi, dword [ebp - 0x20]
mov ebx, 0xd00c74db
sub ebx, 0x847fd2b8
mov edx, dword [edi]
add dword [ebp - 0x18], 0x99288bbb
xor edx, ebx
sub dword [ebp - 0x1c], 0x786c24ea
mov dword [esi], edx
add dword [ebp - 0x18], 0x8cd34648
add esi, 0xc163698b
sub esi, 0xc1636987
add edi, 0x342a3259
sub edi, 0x342a3255
loop 0x1002534a
add eax, 0x12cf7
xor ebx, ebx
add ebx, eax
add eax, 0xd654c838
sub eax, 0xd654c833
mov ecx, 0x91ce6ace
add ecx, 0x7e319532
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4035c1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push dword [0x435144]
call sub.USER32.dll_GetDC
mov dword [ebp - 0x14], eax
push dword [0x43514c]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x1c], eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [ebp - 0x14]
call sub.GDI32.dll_GetTextExtentPoint32A
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push dword [ebp - 8]
pop dword [ebp - 0x24]
push dword [ebp - 4]
pop dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
push dword [ebp + 8]
push 0xffffffffffffffeb
push dword [0x435144]
call sub.USER32.dll_SetWindowLongA
add dword [ebp - 0x10], 8
add dword [ebp - 0xc], 8
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [0x435144]
call sub.USER32.dll_MoveWindow
push 4
push dword [0x435144]
call sub.USER32.dll_ShowWindow
push 0
push 0
push dword [0x435144]
call sub.USER32.dll_InvalidateRect
push dword [0x435144]
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0x14]
push dword [0x435144]
call sub.USER32.dll_ReleaseDC
leave
ret 4
Function at 0x4071d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
jmp 0x4071e9
jmp 0x4071f1
cmp dword [ebp + 0x10], 0
jne 0x407207
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_LoadCursorA
jmp 0x407388
cmp dword [ebp + 0x10], 3
jne 0x407299
push 0x104
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x4071df
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_lstrcatA
push dword [ebp + 0x14]
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0x10
push 0
push 0
push 2
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
or eax, eax
jne 0x407388
push 0
push dword [0x429044]
push 0x4071eb
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
call fcn.00409e79
push 0x10
push 0
push 0
push 2
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
jmp 0x407388
cmp dword [ebp + 0x10], 4
jne 0x407308
push 0x104
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x4071df
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_lstrcatA
push dword [ebp + 0x14]
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0
push dword [0x429044]
push 0x4071eb
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
call fcn.00409e79
push 0x10
push 0
push 0
push 2
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
jmp 0x407388
cmp dword [ebp + 0x10], 5
jne 0x407372
push 0x104
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0x4071df
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_lstrcatA
push dword [ebp + 0x14]
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 2
push dword [0x429044]
push dword [ebp + 0x18]
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
call fcn.00409e79
push 0x10
push 0
push 0
push 2
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
jmp 0x407388
push 0x8000
push 0
push 0
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
mov dword [ebp - 4], eax
call sub.USER32.dll_GetCursor
cmp eax, dword [ebp - 4]
je 0x4073af
cmp dword [ebp + 0x10], 2
je 0x4073af
cmp dword [ebp + 0x10], 4
je 0x4073af
cmp dword [ebp - 4], 0
je 0x4073af
push dword [ebp - 4]
call sub.USER32.dll_SetCursor
mov eax, dword [ebp - 4]
leave
ret 0x14
Function at 0x407692
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push esi
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x40777b
lea eax, [ebp - 0x104]
push eax
push 0
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
je 0x40777b
cmp dword [ebp + 0x18], 0
je 0x40771d
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_DeleteFileA
lea esi, [ebp - 0x104]
lodsb al, byte [esi]
cmp al, 0
je 0x40770e
cmp al, 0x2e
jne 0x4076fe
dec esi
mov byte [esi], 0x5f
inc esi
jmp 0x4076fe
push dword [ebp + 0x18]
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_lstrcatA
cmp dword [ebp + 8], 0
je 0x407735
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.0041df10
cmp dword [ebp + 0x14], 1
jne 0x407742
mov eax, 0x100
jmp 0x407761
cmp dword [ebp + 0x14], 2
jne 0x40774f
mov eax, 0x4000000
jmp 0x407761
cmp dword [ebp + 0x14], 3
jne 0x40775c
mov eax, 0x4000100
jmp 0x407761
mov eax, 0x80
push 0
push eax
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_CreateFileA
pop esi
leave
ret 0x14

Function at 0x4086b3
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], 0
cmp dword [0x42ad3f], 0
je 0x40885c
cmp dword [ebp + 0xc], 0x20
jne 0x4086f9
cmp dword [0x43508c], 1
jne 0x40885c
push 0
call sub.USER32.dll_SetCursor
mov dword [ebp - 4], 1
mov eax, 1
jmp 0x40885c
cmp dword [ebp + 0xc], 6
jne 0x40872a
and dword [ebp + 0x10], 0xffff
cmp dword [ebp + 0x10], 0
jne 0x40871b
mov dword [0x435074], 0
jmp 0x40885c
mov dword [0x435074], 1
jmp 0x40885c
cmp dword [ebp + 0xc], 0x112
jne 0x408758
and dword [ebp + 0x10], 0xfff0
cmp dword [ebp + 0x10], 0xf140
jne 0x40885c
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40885c
cmp dword [ebp + 0xc], 0x100
je 0x40877c
cmp dword [ebp + 0xc], 0x201
je 0x40877c
cmp dword [ebp + 0xc], 0x204
je 0x40877c
cmp dword [ebp + 0xc], 0x207
jne 0x4087b6
cmp dword [0x43508c], 1
jne 0x40885c
push 0
push 0x3f2
push 0x111
push dword [0x429048]
call sub.USER32.dll_SendMessageA
call fcn.00408aed
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40885c
cmp dword [ebp + 0xc], 0x200
jne 0x40884c
cmp dword [0x43508c], 1
jne 0x40885c
cmp dword [0x435080], 0
jne 0x408801
push 0x435084
call sub.USER32.dll_GetCursorPos
mov dword [0x435080], 1
push dword [0x435084]
pop dword [ebp - 0xc]
push dword [0x435088]
pop dword [ebp - 8]
jmp 0x40880a
lea eax, [ebp - 0xc]
push eax
call sub.USER32.dll_GetCursorPos
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x435084]
jne 0x408822
mov eax, dword [ebp - 8]
cmp eax, dword [0x435088]
jne 0x408822
jmp 0x40884a
push 0
push 0x3f2
push 0x111
push dword [0x429048]
call sub.USER32.dll_SendMessageA
call fcn.00408aed
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40885c
cmp dword [ebp + 0xc], 0x10
jne 0x40885c
mov dword [0x435074], 0
mov ebx, dword [ebp + 0x18]
push dword [ebp - 4]
pop dword [ebx]
pop ebx
leave
ret 0x14
Function at 0x409e79
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x18], 1
je 0x409e92
cmp dword [ebp + 0x18], 2
jne 0x409e97
mov eax, dword [ebp + 8]
jmp 0x409eb1
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x409ec3
mov dword [ebp - 0xc], 1
je 0x409f4f
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x18], 2
jne 0x409eda
push dword [ebp + 0xc]
pop dword [ebp - 0x18]
push dword [ebp + 0x10]
pop dword [ebp - 0x10]
jmp 0x409f12
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_FindResourceA
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_SizeofResource
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.DLL_LoadResource
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_LockResource
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
jne 0x409f31
mov dword [ebp - 0xc], 1
push dword [ebp - 0x14]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp + 0x18], 2
je 0x409f4f
push dword [ebp - 8]
call sub.KERNEL32.DLL_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0xc]
leave
ret 0x14

Function at 0x409f56
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call fcn.00409d6e
mov dword [ebp - 8], eax
push dword [ebp + 0xc]
call fcn.00409d51
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
or eax, eax
jne 0x409f98
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x40c530
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
cmp dword [0x42954f], 0
je 0x40c54b
push dword [0x42954f]
call sub.GDI32.dll_DeleteObject
push dword [0x4299ce]
call fcn.004098dd
push dword [0x4298f5]
call fcn.004098dd
push dword [0x4298f1]
call fcn.004098dd
push dword [0x4299ae]
call fcn.004098dd
cmp dword [0x435160], 1
jne 0x40c592
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x429996], 1
mov dword [0x42999a], 0
mov dword [0x429b58], 0
push dword [0x4299b2]
push 0xfffffffffffffffc
push dword [0x429048]
call sub.USER32.dll_SetWindowLongA
push dword [0x4299eb]
push dword [0x4299ce]
call sub.GDI32.dll_SetStretchBltMode
push dword [0x4298e9]
push dword [0x4298ed]
call fcn.00403a0f
push dword [0x4299ff]
push dword [0x4299ce]
call sub.GDI32.dll_SelectObject
push eax
call sub.GDI32.dll_DeleteObject
push dword [0x4299ce]
call sub.GDI32.dll_DeleteDC
call sub.USER32.dll_GetForegroundWindow
or eax, eax
je 0x40c652
cmp eax, dword [0x429048]
je 0x40c652
cmp eax, dword [0x4297ef]
je 0x40c652
mov dword [0x429b54], 0
mov dword [0x429b50], 0
cmp dword [0x4299a2], 5
jb 0x40c652
cmp dword [0x4299a2], 7
ja 0x40c652
push 0
push 0x40cb86
call sub.USER32.dll_EnumWindows
mov dword [0x429553], 1
call fcn.00412b06
cmp eax, 1
jne 0x40c685
push dword [0x4298e9]
push dword [0x4299ae]
call fcn.0041182b
push 0
push dword [0x429048]
push eax
call fcn.0041177b
push dword [0x429048]
call fcn.004036a3
call sub.USER32.dll_ReleaseCapture
cmp dword [0x429b64], 1
jne 0x40c6ad
call fcn.00404172
mov dword [0x429b64], 0
cmp dword [0x429b6c], 1
jne 0x40c6c9
cmp dword [0x429b70], 0
jne 0x40c6c9
mov dword [0x429b70], 1
cmp dword [0x429887], 0
jne 0x40c735
mov dword [0x42988b], 0
mov eax, dword [0x429b50]
cmp dword [0x429b54], eax
jae 0x40c717
mov ebx, dword [0x429b54]
shl ebx, 4
push dword [ebx + 0x435c63]
push dword [ebx + 0x435c5f]
push dword [ebx + 0x435c5b]
push dword [ebx + 0x435c57]
call sub.USER32.dll_SendMessageA
inc dword [0x429b54]
jmp 0x40c773
cmp dword [0x429b54], eax
jne 0x40c773
mov dword [0x429b54], 0
mov dword [0x429b50], 0
jmp 0x40c773
push 1
push dword [0x4297e7]
push dword [0x4297d7]
push dword [0x4298e9]
push dword [0x4297df]
call fcn.0040cc18
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
push 5
push dword [0x429048]
call sub.USER32.dll_SetTimer
mov dword [0x435164], 1
pop ebx
leave
ret
Function at 0x40d78f
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff990
push edx
lea eax, [ebp - 0x654]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x550]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dword [ebp - 0x4c], 0x4c
mov eax, dword [0x429048]
mov dword [ebp - 0x48], eax
push 0x400
push 0x436813
call sub.KERNEL32.DLL_RtlZeroMemory
push str.EXE_file
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0x66c], eax
inc dword [ebp - 0x66c]
push dword [ebp - 0x66c]
push 0x436813
push str.EXE_file
call fcn.0041df10
mov eax, dword [ebp - 0x66c]
add eax, 0x436813
mov dword [ebp - 0x66c], eax
push 6
push dword [ebp - 0x66c]
push str..exe
call fcn.0041df10
mov dword [ebp - 0x40], 0x436813
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x32
mov dword [ebp - 0x34], 1
push 0x429070
call sub.KERNEL32.DLL_lstrlenA
mov ebx, 0
jmp 0x40d861
mov bl, byte [eax + 0x429070]
dec eax
cmp eax, 0
jbe 0x40d86b
cmp bl, 0x5c
jne 0x40d85a
add eax, 2
add eax, 0x429070
push eax
lea eax, [ebp - 0x150]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x150]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x550]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], str.Save_EXE_Book:
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x18], 0x806
mov word [ebp - 0x14], 0
mov word [ebp - 0x12], 0
lea eax, [ebp - 0x668]
mov byte [eax], 0
push 0x42a3be
push eax
call fcn.0041dec0
lea eax, [ebp - 0x668]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x4c]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
cmp eax, 1
jne 0x40d932
push 0x400
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push dword [ebp - 0x670]
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x550]
push eax
call fcn.004107cf
push 0
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.DLL_CopyFileA
pop edx
leave
ret
Function at 0x4105f1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ecx
push ebx
push 0x400
push 0x436813
call sub.KERNEL32.DLL_RtlZeroMemory
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push eax
lea eax, [ebp - 0x108]
push eax
push 0x436813
call fcn.004107cf
mov dword [ebp - 4], 0x436813
push dword [ebp - 4]
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 8], eax
push 0x100
lea eax, [ebp - 0x108]
push eax
call sub.KERNEL32.DLL_RtlZeroMemory
push dword [ebp - 8]
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 4]
call fcn.0041df10
mov eax, 1
jmp 0x41067c
push 0x429491
push dword [ebp - 4]
push 1
call fcn.0041ddc8
add dword [ebp - 4], eax
or eax, eax
jne 0x41066a
mov byte [0x435334], 0
push dword [ebp - 4]
push 0x435334
call fcn.0041dec0
cmp dword [0x42979b], 1
jne 0x4106ac
push dword [0x435260]
push 0
call fcn.004065e2
jmp 0x4106ba
push str.This_email_attachment_has_been_sent_to_you_by_a_person_using_a_SendMail_facility_inside_the_DigitalWebBook._r_n_r_nPlease_refer_to_the_From:_line_in_the_header_of_this_e_mail_to_identify_the_sender._Please_note_that_if_you_can_not_view_the_attached_file_you_should_download_the_DigitalWebBook_plug_in_viewer_from_www.DigitalWebBooks.com_plugin._When_prompted__either_Open_or_Run_from_current_location._The_plug_in_viewer_will_be_automatically_installed_on_opening._Click_on_the_close_button_to_exit._r_n_r_nOnce_you_have_downloaded_the_152k_plug_in_viewer_which_will_take_approximately_30_seconds_on_a_56k_modem_you_will_be_able_to_view_DigitalWebBooks_in_the_.dnl_format._r_n_r_nEnjoy_the_DigitalWebBook_experience.
push 0x34
push 1
call fcn.0040633e
mov dword [ebp - 4], eax
push 0x429496
push 0x434f54
call fcn.00406a16
push 0x429496
push 0x434f54
call fcn.00406a16
push dword [ebp - 4]
push 0x434f54
call fcn.00406a16
cmp dword [0x42ad27], 0
je 0x410700
push 0
push dword [0x42ad27]
call fcn.004065e2
jmp 0x410706
lea eax, [0x429cd1]
mov dword [ebp - 8], eax
push 0x42948d
push 0x434f48
call fcn.00406a16
push 0x4294b4
push 0x434f48
call fcn.00406a16
push 0x42948d
push 0x434f48
call fcn.00406a16
push dword [ebp - 8]
push 0x434f48
call fcn.00406a16
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
cmp dword [0x434f64], 0
je 0x410766
push dword [0x434f60]
pop dword [ebp - 4]
inc dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 4]
push 0x435334
lea eax, [ebp - 0x108]
push eax
push 0x4353b4
push 0x4353b4
push dword [0x434f54]
push dword [0x434f48]
push 1
push dword [ebp - 8]
call fcn.0041092c
or eax, eax
je 0x4107cb
jmp 0x4107a1
push eax
push 0x41079e
push 0x4352d0
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x4352d0
push 0x4352d0
push dword [0x429048]
call sub.USER32.dll_MessageBoxA
pop ebx
pop ecx
leave
ret