joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219

Function at 0x456da0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x48000]
push edi
jmp 0x456dba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x456dc1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x456db0
mov eax, 1
add ebx, ebx
jne 0x456dd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x456dc8
jne 0x456de4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456dc8
xor ecx, ecx
sub eax, 3
jb 0x456df8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x456e6a
mov ebp, eax
add ebx, ebx
jne 0x456e03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x456e10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x456e34
inc ecx
add ebx, ebx
jne 0x456e20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x456e15
jne 0x456e31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x456e15
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x456e54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x456e45
jmp 0x456db6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x456e54
add edi, ecx
jmp 0x456db6
pop esi
mov edi, esi
mov ecx, 0x6f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x456e72
cmp byte [edi], 6
jne 0x456e72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x456e77
lea edi, [esi + 0x42000]
mov eax, dword [edi]
or eax, eax
je 0x456ee6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x57970]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x57bb4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x456ea4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x57bb8]
or eax, eax
je 0x456ee0
mov dword [ebx], eax
add ebx, 4
jmp 0x456ec1
call dword [esi + 0x57bc8]
mov ebp, dword [esi + 0x57bbc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x456f1a
sub esp, 0xffffff80
jmp 0x4145ec
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x45005a]
shl eax, 2
mov dword [0x45005e], eax
push edi
push ecx
xor eax, eax
mov edi, 0x45d788
mov ecx, 0x471a78
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
mov edx, dword fs:[4]
mov dword [0x45006e], edx
mov eax, dword [edx - 8]
mov dword [0x450066], eax
mov eax, dword [edx - 4]
mov dword [0x45006a], eax
sub edx, 4
mov dword [0x46e79c], edx
sub edx, 4
cmp edx, esp
jae 0x401054
mov esp, edx
push 0
call fcn.004488ba
pop ecx
push 0x45002c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x450062], eax
push 0
jmp fcn.0044df68

Function at 0x40142c
Capabilities:
Read .ini file

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
push 0x45d8b0
push 0x103
lea eax, [esp + 8]
push eax
push 0x4501d2
push 0x4501ca
push 0x4501c4
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov edx, esp
mov eax, ebx
call fcn.00401469
add esp, 0x104
pop ebx
ret

Function at 0x401469
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdec
mov ebp, edx
mov dword [esp], eax
push ebp
call fcn.00446238
pop ecx
add eax, 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
inc eax
push eax
call fcn.0044cdb4
pop ecx
mov esi, eax
xor edi, edi
xor ebx, ebx
mov eax, edi
inc edi
mov al, byte [ebp + eax]
movsx edx, al
cmp edx, 0x25
je 0x4014bd
test al, al
je 0x40153c
mov ecx, dword [esp + 4]
cmp ebx, ecx
jae 0x401498
mov byte [esi + ebx], al
inc ebx
jmp 0x401498
xor eax, eax
mov dl, byte [ebp + edi]
mov byte [esp + 8], dl
mov cl, byte [esp + 8]
test cl, cl
je 0x4014ec
inc edi
movsx edx, byte [esp + 8]
cmp edx, 0x25
je 0x4014ec
cmp eax, 0x103
jae 0x4014bf
mov cl, byte [esp + 8]
mov byte [esp + eax + 0xc], cl
inc eax
jmp 0x4014bf
mov byte [esp + eax + 0xc], 0
push dword [esp]
push 0x103
lea eax, [esp + 0x118]
push eax
push 0x4501c9
lea eax, [esp + 0x1c]
push eax
push 0x45020d
call sub.KERNEL32.dll_GetPrivateProfileStringA
xor edx, edx
mov ecx, edx
inc edx
mov al, byte [esp + ecx + 0x110]
test al, al
je 0x401498
cmp ebx, 0x103
jae 0x401517
mov byte [esi + ebx], al
inc ebx
jmp 0x401517
mov byte [esi + ebx], 0
mov eax, esi
add esp, 0x214
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4027eb
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, eax
mov eax, ecx
sub eax, 0x100
je 0x402823
dec eax
je 0x402951
add eax, 0xffffff01
sub eax, 3
jb 0x40299d
dec eax
sub eax, 2
jb 0x40299d
jmp 0x4029ef
mov edx, dword [ebp + 0xc]
cmp edx, 0x24
jg 0x402852
je 0x402901
sub edx, 0xd
je 0x402871
sub edx, 0xe
je 0x4028f3
sub edx, 5
je 0x4028b5
sub edx, 3
je 0x40290f
jmp 0x4029ef
sub edx, 0x25
je 0x40291d
sub edx, 2
je 0x402937
sub edx, 0x51
je 0x402886
dec edx
je 0x4028a7
jmp 0x4029ef
push 0
push 0
push 0x10
push dword [ebx + 4]
call sub.USER32.dll_PostMessageA
mov al, 1
jmp 0x4029f1
mov eax, ebx
call fcn.00402a23
push 0x12
call sub.USER32.dll_GetKeyState
test ah, 1
je 0x4028a0
mov eax, ebx
call fcn.00403037
mov al, 1
jmp 0x4029f1
mov eax, ebx
call fcn.00402bbc
mov al, 1
jmp 0x4029f1
push 0x78
push dword [ebx + 4]
call sub.USER32.dll_GetDlgItem
mov esi, eax
call sub.USER32.dll_GetFocus
cmp esi, eax
je 0x4029ef
test byte [ebx + 0x56], 4
setne al
and eax, 1
test al, al
je 0x4028e5
mov eax, ebx
call fcn.00402a23
jmp 0x4028ec
mov eax, ebx
call fcn.00402bbc
mov al, 1
jmp 0x4029f1
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x28]
mov al, 1
jmp 0x4029f1
mov eax, ebx
call fcn.00402be8
mov al, 1
jmp 0x4029f1
mov eax, ebx
call fcn.00403037
mov al, 1
jmp 0x4029f1
push 0
push 0
push 0x201
push 0x73
push dword [ebx + 4]
call sub.USER32.dll_SendDlgItemMessageA
mov al, 1
jmp 0x4029f1
push 0
push 0
push 0x201
push 0x74
push dword [ebx + 4]
call sub.USER32.dll_SendDlgItemMessageA
mov al, 1
jmp 0x4029f1
mov edx, dword [ebp + 0xc]
sub edx, 0x25
je 0x402963
sub edx, 2
je 0x402980
jmp 0x4029ef
push 0
push 0
push 0x202
push 0x73
push dword [ebx + 4]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
mov al, 1
jmp 0x4029f1
push 0
push 0
push 0x202
push 0x74
push dword [ebx + 4]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SendMessageA
mov al, 1
jmp 0x4029f1
mov edi, dword [ebx + 4]
mov dword [ebp - 4], ecx
lea esi, [ebx + 0x52a7]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ebx, edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov ecx, dword [esi]
test ecx, ecx
je 0x4029ef
push ebx
push edi
call sub.USER32.dll_IsChild
test eax, eax
je 0x4029ef
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], ebx
push eax
push 0
push 0x407
push dword [esi]
call sub.USER32.dll_SendMessageA
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x406895
Capabilities:
Read .ini file

Disassembly:
add esp, 0xffffffec
add eax, 0x24
push eax
push 0x13
lea edx, [esp + 8]
push edx
push 0x4507ee
push 0x4507e8
push 0x4507e2
call sub.KERNEL32.dll_GetPrivateProfileStringA
mov byte [esp + 0x13], 0
push esp
call fcn.0044af44
pop ecx
test eax, eax
jge 0x4068c9
xor eax, eax
add esp, 0x14
ret
Function at 0x40d12a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, eax
mov ebx, edx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x110]
push dword [ebp - 4]
push 0x103
push ecx
push esi
push edx
push eax
call sub.KERNEL32.dll_GetPrivateProfileStringA
push ebx
push edi
call sub.USER32.dll_GetDlgItem
mov esi, eax
push 0
push 0
push 0x14b
push esi
call sub.USER32.dll_SendMessageA
xor eax, eax
mov dword [ebp - 8], eax
xor edi, edi
mov ebx, 0x4512a8
jmp 0x40d1d2
mov al, byte [ebp + 8]
test al, al
je 0x40d191
mov dl, byte [ebx + 9]
test dl, dl
je 0x40d1ce
push dword [ebx + 4]
push 0
push 0x143
push esi
call sub.USER32.dll_SendMessageA
mov dword [ebp - 0xc], eax
push edi
push dword [ebp - 0xc]
push 0x151
push esi
call sub.USER32.dll_SendMessageA
push dword [ebx]
lea ecx, [ebp - 0x110]
push ecx
call fcn.004462cc
add esp, 8
test eax, eax
jne 0x40d1ce
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
inc edi
add ebx, 0xa
mov edx, dword [ebx]
test edx, edx
jne 0x40d183
push 0
push dword [ebp - 8]
push 0x14e
push esi
call sub.USER32.dll_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x413a19
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], 0x50
jmp 0x413acf
push 0
mov ebx, esi
push ebx
push edi
push dword [ebp - 8]
call sub.WSOCK32.dll_send
cmp ebx, eax
jle 0x413afc
test eax, eax
jg 0x413a7b
test eax, eax
jge 0x413a6a
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x413afc
mov eax, dword [ebp - 0xc]
add dword [ebp - 0xc], 0xffffffff
test eax, eax
je 0x413afc
jmp 0x413a86
mov dword [ebp - 0xc], 0x50
add edi, eax
sub esi, eax
xor eax, eax
mov dword [ebp - 0x118], eax
cmp eax, 0x40
jae 0x413aa9
mov edx, dword [ebp - 0x118]
inc dword [ebp - 0x118]
mov ecx, dword [ebp - 8]
mov dword [ebp + edx*4 - 0x114], ecx
xor eax, eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x10], 0x3d090
push edx
push 0
push ecx
push 0
push 1
call sub.WSOCK32.dll_select
test eax, eax
jl 0x413afc
mov ebx, dword [ebp - 4]
add ebx, 8
mov eax, dword [ebx]
test eax, eax
je 0x413aef
push 0
push dword [ebx]
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x413aef
xor edx, edx
jmp 0x413af4
mov edx, 1
test dl, dl
je 0x413a3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x413ddf
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, ecx
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call sub.KERNEL32.dll_CreateFileA
mov edi, eax
mov dword [ebp - 0xc], edi
push 0
push edi
call sub.KERNEL32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x413e25
xor eax, eax
jmp 0x413e27
mov eax, esi
test eax, eax
jne 0x413e44
mov edx, dword [ebp - 0xc]
cmp edx, 0xffffffff
je 0x413ff0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
jmp 0x413ff0
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
jne 0x413e59
xor ecx, ecx
jmp 0x413e5b
mov ecx, esi
mov dword [ebp - 0x94], ecx
xor eax, eax
mov dword [ebp - 0x90], eax
fild qword [ebp - 0x94]
fdivr qword [ebp + 8]
fstp qword [ebp - 0x14]
lea edx, [ebp - 0x3c]
push 0
push edx
lea eax, [ebp - 0x37]
push 3
push eax
push dword [ebp - 0xc]
call sub.KERNEL32.dll_ReadFile
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x413fa1
mov dl, byte [ebp - 0x37]
xor ecx, ecx
mov cl, dl
and dl, 3
sar ecx, 2
and edx, 0xff
shl edx, 4
mov cl, byte [ecx + 0x45ab4c]
mov byte [ebp + ebx - 0x8c], cl
xor ecx, ecx
mov cl, byte [ebp - 0x36]
inc ebx
sar ecx, 4
or edx, ecx
mov dl, byte [edx + 0x45ab4c]
mov byte [ebp + ebx - 0x8c], dl
inc ebx
cmp eax, 1
jbe 0x413ef4
mov dl, byte [ebp - 0x36]
and dl, 0xf
xor ecx, ecx
mov cl, dl
shl ecx, 2
xor edx, edx
mov dl, byte [ebp - 0x35]
sar edx, 6
or ecx, edx
mov cl, byte [ecx + 0x45ab4c]
jmp 0x413ef6
mov cl, 0x3d
mov byte [ebp + ebx - 0x8c], cl
inc ebx
cmp eax, 2
jbe 0x413f14
mov al, byte [ebp - 0x35]
and al, 0x3f
xor edx, edx
mov dl, al
mov al, byte [edx + 0x45ab4c]
jmp 0x413f16
mov al, 0x3d
mov byte [ebp + ebx - 0x8c], al
inc ebx
cmp ebx, 0x49
jbe 0x413e75
mov byte [ebp + ebx - 0x8c], 0xd
inc ebx
lea eax, [ebp - 0x8c]
mov byte [ebp + ebx - 0x8c], 0xa
inc ebx
mov byte [ebp + ebx - 0x8c], 0
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push eax
call fcn.00446238
pop ecx
push eax
lea ecx, [ebp - 0x8c]
mov edx, esi
mov eax, ebx
call fcn.00413a19
xor ebx, ebx
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x413f7e
push 1
push 0
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_SetFilePointer
jmp 0x413f80
xor eax, eax
mov dword [ebp - 0x94], eax
xor edx, edx
mov dword [ebp - 0x90], edx
fild qword [ebp - 0x94]
fmul qword [ebp - 0x14]
fadd qword [ebp + 0x10]
fstp st(0)
jmp 0x413e75
test ebx, ebx
jbe 0x413fe2
mov byte [ebp + ebx - 0x8c], 0xd
inc ebx
lea eax, [ebp - 0x8c]
mov byte [ebp + ebx - 0x8c], 0xa
inc ebx
mov byte [ebp + ebx - 0x8c], 0
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
push eax
call fcn.00446238
pop ecx
push eax
lea ecx, [ebp - 0x8c]
mov edx, esi
mov eax, ebx
call fcn.00413a19
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x413ff0
push eax
call sub.KERNEL32.dll_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x414e41
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, eax
push esi
add esp, 0xfffffefc
mov dword [ebx + 0x121], 1
lea esi, [ebx + 0x1d]
push esi
push 0x103
lea eax, [esp + 8]
push eax
push 0x45298a
push 0x452b6b
push 0x452afd
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0x452b70
lea edx, [esp + 4]
push edx
call fcn.004462cc
add esp, 8
test eax, eax
jne 0x414e97
mov dword [ebx + 0x121], 2
mov dword [ebx + 0x125], 2
push 0
mov ecx, 0x452ae7
mov edx, 0x452afd
mov eax, esi
call fcn.00445c49
mov byte [ebx + 0x129], al
xor eax, eax
movsx edx, al
mov byte [ebx + 0x13e], al
mov eax, ebx
mov byte [ebx + edx + 0x12a], 0
call fcn.00416232
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x416232
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, eax
push esi
add esp, 0xfffffce0
lea esi, [ebx + 0x1d]
mov ecx, 0x452d9c
mov eax, esi
push 0
mov edx, 0x452afd
call fcn.00445c9e
test al, al
je 0x416298
mov ecx, 0x452c5d
lea edx, [esp + 0x118]
mov eax, esi
call fcn.00445bb8
push esi
push 0x103
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x124]
push ecx
push 0x452da3
push 0x452afd
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.004171e9
jmp 0x4162a8
mov ecx, 0x452c5d
lea edx, [esp + 0x14]
mov eax, esi
call fcn.00445bb8
xor ecx, ecx
lea esi, [ebx + 0x1d]
mov dword [esp], ecx
mov ecx, 0x452dae
push 0
mov eax, esi
mov edx, 0x452afd
call fcn.00445c9e
test al, al
je 0x416393
xor edx, edx
mov dword [esp + 4], edx
lea edx, [esp + 0x14]
lea eax, [esp + 4]
call fcn.0040544c
push 0
mov ecx, 0x452dc7
mov edx, 0x452afd
mov eax, esi
call fcn.00445c49
push eax
push esi
push 0x103
lea ecx, [esp + 0x228]
push ecx
push 0x45298a
push 0x452db9
push 0x452afd
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea edx, [esp + 0x220]
mov ecx, 0x45298a
lea eax, [ebx + 0x79f]
call fcn.00414134
mov edx, eax
lea eax, [esp + 8]
pop ecx
call fcn.00404b64
push 1
lea edx, [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 0x1f40
call fcn.0040553f
lea edx, [esp + 8]
mov eax, esp
call fcn.004249f0
mov esi, dword [esp + 8]
test esi, esi
je 0x416380
dec word [esi + 0xe]
mov ax, word [esi + 0xe]
test ax, ax
jne 0x416380
mov edx, dword [esp + 8]
test edx, edx
je 0x416380
mov edx, 3
mov eax, dword [esp + 8]
mov ecx, dword [eax]
call dword [ecx]
lea eax, [esp + 4]
mov edx, 2
call fcn.00405417
jmp 0x41643d
lea edx, [esp + 0x14]
lea eax, [esp + 0xc]
call fcn.00425355
lea edx, [esp + 0xc]
mov eax, esp
call fcn.004249f0
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4163d5
dec word [esi + 0xe]
mov ax, word [esi + 0xe]
test ax, ax
jne 0x4163d5
mov edx, dword [esp + 0xc]
test edx, edx
je 0x4163d5
mov edx, 3
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
call dword [ecx]
mov eax, dword [esp]
test eax, eax
je 0x4163ea
test byte [eax + 0xd], 1
setne dl
and edx, 1
test dl, dl
je 0x41643d
mov ecx, 0x452dd6
lea edx, [esp + 0x14]
lea eax, [ebx + 0x1d]
call fcn.00445bb8
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
call fcn.0043ac2e
lea edx, [esp + 0x10]
mov eax, esp
call fcn.004249f0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x41643d
dec word [esi + 0xe]
mov ax, word [esi + 0xe]
test ax, ax
jne 0x41643d
mov edx, dword [esp + 0x10]
test edx, edx
je 0x41643d
mov edx, 3
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
call dword [ecx]
add esp, 0xfffffffc
mov eax, dword [esp + 4]
mov dword [esp], eax
test eax, eax
je 0x416452
mov edx, dword [esp]
inc word [edx + 0xe]
mov eax, ebx
call fcn.004164c7
mov ebx, dword [esp]
test ebx, ebx
je 0x416480
dec word [ebx + 0xe]
mov ax, word [ebx + 0xe]
test ax, ax
jne 0x416480
mov edx, dword [esp]
test edx, edx
je 0x416480
mov edx, 3
mov eax, dword [esp]
mov ecx, dword [eax]
call dword [ecx]
add esp, 0x320
pop esi
pop ebx
ret
Function at 0x419229
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xfffffaac
push 0x65
push dword [eax + 4]
call sub.USER32.dll_GetDlgItem
mov esi, eax
push 0
push 0
push 0x14b
push esi
call sub.USER32.dll_SendMessageA
lea eax, [esp + 4]
push eax
push 0x45dcc8
lea edx, [esp + 0x14c]
push edx
call fcn.00446208
add esp, 8
mov edx, 0x4538c2
lea eax, [esp + 0x148]
call fcn.00445579
lea ecx, [esp + 0x148]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov dword [esp], eax
jmp 0x419358
cmp eax, 0xffffffff
je 0x419297
lea ebx, [esp + 0x30]
jmp 0x41929c
mov ebx, 0x4533b5
push 0x45dcc8
lea eax, [esp + 0x24c]
push eax
call fcn.00446208
add esp, 8
mov edx, ebx
lea eax, [esp + 0x248]
call fcn.00445579
push 1
mov ecx, 0x4538cc
mov edx, 0x4538c8
lea eax, [esp + 0x24c]
call fcn.00445c9e
test al, al
je 0x41930e
push 0
lea ecx, [esp + 0x350]
push ecx
push 0
push 0
lea eax, [esp + 0x258]
push eax
call fcn.00448bb4
add esp, 0x14
lea edx, [esp + 0x34c]
push edx
push 0
push 0x143
push esi
call sub.USER32.dll_SendMessageA
mov ebx, dword [esp]
cmp ebx, 0xffffffff
je 0x41933a
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x419338
push dword [esp]
call sub.KERNEL32.dll_FindClose
mov dword [esp], 0xffffffff
xor edx, edx
jmp 0x41933a
mov dl, 1
mov al, byte [esp + 0x248]
test al, al
je 0x419358
lea ecx, [esp + 0x248]
push ecx
push 0
push 0
push 0
call sub.KERNEL32.dll_WritePrivateProfileStringA
mov eax, dword [esp]
cmp eax, 0xffffffff
setne dl
and edx, 1
test dl, dl
jne 0x41928c
push 0x45d8b0
push 0x103
lea ecx, [esp + 0x458]
push ecx
push 0x4538e0
push 0x4538dc
push 0x4538d3
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [esp + 0x450]
push eax
push 0xffffffffffffffff
push 0x14d
push esi
call sub.USER32.dll_SendMessageA
mov eax, dword [esp]
cmp eax, 0xffffffff
je 0x4193b5
push eax
call sub.KERNEL32.dll_FindClose
add esp, 0x554
pop esi
pop ebx
ret
Function at 0x4193be
Capabilities:
Enumerate files on windows
Read .ini file

Disassembly:
push ebx
push esi
add esp, 0xfffffaac
push 0x67
push dword [eax + 4]
call sub.USER32.dll_GetDlgItem
mov esi, eax
push 0
push 0
push 0x14b
push esi
call sub.USER32.dll_SendMessageA
lea eax, [esp + 4]
push eax
push 0x45dbc4
lea edx, [esp + 0x14c]
push edx
call fcn.00446208
add esp, 8
mov edx, 0x4538fa
lea eax, [esp + 0x148]
call fcn.00445579
lea ecx, [esp + 0x148]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov dword [esp], eax
jmp 0x4194d1
cmp eax, 0xffffffff
je 0x41942c
lea ebx, [esp + 0x30]
jmp 0x419431
mov ebx, 0x4533b5
push 0x45dbc4
lea eax, [esp + 0x24c]
push eax
call fcn.00446208
add esp, 8
mov edx, ebx
lea eax, [esp + 0x248]
call fcn.00445579
push 0
lea ecx, [esp + 0x350]
push ecx
push 0
push 0
lea eax, [esp + 0x258]
push eax
call fcn.00448bb4
add esp, 0x14
lea edx, [esp + 0x34c]
push edx
push 0
push 0x143
push esi
call sub.USER32.dll_SendMessageA
mov ebx, dword [esp]
cmp ebx, 0xffffffff
je 0x4194b3
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4194b1
push dword [esp]
call sub.KERNEL32.dll_FindClose
mov dword [esp], 0xffffffff
xor edx, edx
jmp 0x4194b3
mov dl, 1
mov al, byte [esp + 0x248]
test al, al
je 0x4194d1
lea ecx, [esp + 0x248]
push ecx
push 0
push 0
push 0
call sub.KERNEL32.dll_WritePrivateProfileStringA
mov eax, dword [esp]
cmp eax, 0xffffffff
setne dl
and edx, 1
test dl, dl
jne 0x419421
push 0x45d8b0
push 0x103
lea ecx, [esp + 0x458]
push ecx
push 0x453900
push 0x4538fc
push 0x4538d3
call sub.KERNEL32.dll_GetPrivateProfileStringA
lea eax, [esp + 0x450]
push eax
push 0xffffffffffffffff
push 0x14d
push esi
call sub.USER32.dll_SendMessageA
inc eax
jne 0x419532
push 0
push 0
push 0x14e
push esi
call sub.USER32.dll_SendMessageA
mov eax, dword [esp]
cmp eax, 0xffffffff
je 0x419540
push eax
call sub.KERNEL32.dll_FindClose
add esp, 0x554
pop esi
pop ebx
ret
Function at 0x41b730
Capabilities:
Copy file
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff768
mov edi, eax
mov eax, edi
call fcn.0041d660
push 0x104
lea edx, [esp + 4]
push edx
push 0x67
push dword [edi + 4]
call sub.USER32.dll_GetDlgItemTextA
push 0x69
push dword [edi + 4]
call sub.USER32.dll_GetDlgItem
mov esi, eax
push 0
push 0
push 0x1004
push esi
call sub.USER32.dll_SendMessageA
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
jle 0x41b960
push 2
push ebx
push 0x102c
push esi
call sub.USER32.dll_SendMessageA
test al, 2
je 0x41b957
xor eax, eax
lea edx, [esp + 0x104]
mov dword [esp + 0x210], eax
lea ecx, [esp + 0x208]
mov dword [esp + 0x220], 0x104
mov dword [esp + 0x21c], edx
push ecx
push ebx
push 0x102d
push esi
call sub.USER32.dll_SendMessageA
lea eax, [esp + 0x104]
push eax
lea edx, [esp + 4]
push edx
push 0x45dbc4
push 0x453e32
lea ecx, [esp + 0x23c]
push ecx
call sub.USER32.dll_wsprintfA
add esp, 0x14
push 0x45d8b0
push 0x103
lea eax, [esp + 0x54c]
push eax
push 0x4533b5
push 0x453f89
push 0x4538d3
call sub.KERNEL32.dll_GetPrivateProfileStringA
push 0
push 0
lea edx, [esp + 0x754]
push edx
lea ecx, [esp + 0x654]
push ecx
lea eax, [esp + 0x554]
push eax
call fcn.00448bb4
add esp, 0x14
lea edx, [esp + 0x74c]
push edx
lea ecx, [esp + 0x64c]
push ecx
call fcn.00446178
add esp, 8
lea eax, [esp + 0x648]
push eax
lea edx, [esp + 0x548]
push edx
call fcn.00446208
add esp, 8
lea ecx, [esp + 0x104]
push ecx
lea eax, [esp + 0x548]
push eax
call fcn.00446178
add esp, 8
push 0x4c
push 0
lea edx, [esp + 0x854]
push edx
call fcn.00446148
add esp, 0xc
xor edx, edx
mov dword [esp + 0x84c], 0x4c
mov ecx, dword [edi + 4]
lea eax, [esp + 0x544]
mov dword [esp + 0x850], ecx
lea ecx, [esp + 0x648]
mov dword [esp + 0x858], 0x453f94
mov dword [esp + 0x864], 1
mov dword [esp + 0x868], eax
lea eax, [esp + 0x84c]
mov dword [esp + 0x86c], 0x104
mov dword [esp + 0x870], edx
mov dword [esp + 0x878], ecx
mov dword [esp + 0x87c], 0x453fa5
mov dword [esp + 0x880], 0x8000c
mov dword [esp + 0x888], 0x453fa0
push eax
call sub.COMDLG32.dll_GetSaveFileNameA
test eax, eax
je 0x41b960
push 0
lea edx, [esp + 0x548]
push edx
lea ecx, [esp + 0x234]
push ecx
call sub.KERNEL32.dll_CopyFileA
push 0x45d8b0
lea eax, [esp + 0x548]
push eax
push 0x453f89
push 0x4538d3
call sub.KERNEL32.dll_WritePrivateProfileStringA
inc ebx
cmp ebp, ebx
jg 0x41b77e
add esp, 0x898
pop ebp
pop edi
pop esi
pop ebx
ret