joyce8/EMBER2024-capa huggingface dataset:
Function at 0x88b0ac
Capabilities:
Write file on windows

Disassembly:
call fcn.0088aefb
mov edi, 0x508fa8
mov eax, 0
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [0x82b3c8], 0x2e77654e
mov dword [0x82b3cb], 0x676c642e
mov dword [0x82b3cf], 0
push 0x478fd8
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
cmp eax, 0
jne 0x88b0f5
jmp 0x88b179
push 0x676c642e
push 0x82b3c8
call fcn.0088b19e
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push 0x82b3c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x88b135
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
jmp 0x88b179
mov dword [0x4319b8], eax
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x82b3c4]
push dword [0x82b3c0]
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b8], 0
cmp dword [0x82b3c0], 0
je 0x88b196
mov eax, dword [0x82b3c0]
call fcn.0084b661
mov dword [0x82b3c0], 0
mov byte [0x81b2fc], 0
ret

Function at 0x88b1fe
Capabilities:
Get file size
Read file on windows

Disassembly:
mov dword [0x48a844], str.Dlg_Files
mov dword [0x48a868], 0x48a7fd
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x88b251
pop eax
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x88b281
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
pop eax
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x818c08], eax
cmp eax, 0
jbe 0x88b2de
mov ebx, 0x818c04
mov edx, eax
call fcn.0084b515
mov eax, dword [0x818c04]
add eax, dword [0x818c08]
mov dword [0x82bbe8], eax
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x818c08]
push dword [0x818c04]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret
Function at 0x88c2ca
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x82b178], 1
jne 0x88c2e2
cmp byte [0x46774c], 1
jne 0x88c2e1
call fcn.0088393d
ret
call fcn.0088c292
cmp byte [0x82bc04], 0x1b
jne 0x88c2f1
ret
mov edi, 0x508fa8
mov eax, 0
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [0x82b3c8], 0x2e77654e
mov dword [0x82b3cb], 0x666c642e
mov dword [0x82b3cf], 0
push 0x478fd8
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
cmp eax, 0
jne 0x88c331
ret
push 0x6664622e
push 0x82b3c8
call fcn.0088b19e
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push 0x82b3c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x88c36d
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x4319b8], eax
mov dword [0x4319c0], 0
mov esi, dword [0x82bc00]
sub esi, 4
mov ecx, dword [esi + 8]
mov esi, dword [esi + 4]
push 0
push 0x4319c0
push ecx
push esi
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b8], 0
ret

Function at 0x88c3b7
Capabilities:
Get file size
Read file on windows

Disassembly:
cmp byte [0x82b178], 1
jne 0x88c3cf
cmp byte [0x46774c], 1
jne 0x88c3ce
call fcn.0088393d
ret
mov dword [0x48a844], str.bdf_Files
mov dword [0x48a868], 0x48a7fd
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x88c421
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x88c450
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x82bc28], eax
cmp eax, 0
jbe 0x88c49f
mov ebx, 0x82bc24
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x82bc28]
push dword [0x82bc24]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x88c4a0
ret
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x836d48
cmp dword [esi], 0
je 0x88c4bb
add esi, 0xc
jmp 0x88c4b1
mov dword [0x48a6e0], esi
mov eax, dword [0x82bc24]
mov dword [esi + 4], eax
mov eax, dword [0x82bc28]
mov dword [esi + 8], eax
mov byte [0x82b179], 0
push 0
push 0x88b3a5
push 0
push 0x479034
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
cmp byte [0x479148], 1
jne 0x88c53d
mov esi, 0x836d48
cmp dword [esi + 4], 0
je 0x88c50b
add esi, 0xc
jmp 0x88c500
mov dword [esi - 4], 0
mov dword [esi - 8], 0
mov dword [esi - 0xc], 0
cmp dword [0x82bc24], 0
je 0x88c53d
mov eax, dword [0x82bc24]
call fcn.0084b661
mov dword [0x82bc24], 0
ret
Function at 0x88c53e
Capabilities:
Get file size
Read file on windows

Disassembly:
cmp byte [0x82b178], 1
jne 0x88c556
cmp byte [0x46774c], 1
jne 0x88c555
call fcn.0088393d
ret
call fcn.0088c292
cmp byte [0x82bc04], 0x1b
jne 0x88c565
ret
mov dword [0x48a844], str.bdf_Files
mov dword [0x48a868], 0x48a7fd
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x88c5b7
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x88c5e6
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x82bc28], eax
cmp eax, 0
jbe 0x88c635
mov ebx, 0x82bc24
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x82bc28]
push dword [0x82bc24]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x88c636
ret
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [0x82bc00]
sub edi, 4
cmp dword [edi + 4], 0
je 0x88c660
mov eax, dword [edi + 4]
call fcn.0084b661
mov dword [edi + 4], 0
mov eax, dword [0x82bc24]
mov dword [edi + 4], eax
mov eax, dword [0x82bc28]
mov dword [edi + 8], eax
ret
Function at 0x88ca10
Capabilities:
Get file size
Read file on windows

Disassembly:
call fcn.0088cbd4
mov edi, 0x82c044
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x4793d8
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x82c044], 0
jne 0x88ca3b
ret
cmp dword [0x47939c], 0
jbe 0x88ca50
push dword [0x47939c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x82c044
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x88ca7f
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x47939c], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub eax, 0xe
mov edi, dword [0x48a6f8]
add edi, 8
stosd dword es:[edi], eax
add eax, 0xe
mov dword [0x479398], eax
mov ebx, 0x4cfabc
mov edx, eax
call fcn.0084b515
mov edi, dword [0x48a6f8]
add edi, 4
mov dword [edi], eax
push edi
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push 0xe
push dword [0x4cfabc]
push dword [0x47939c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
mov esi, dword [edi]
lodsw ax, word [esi]
cmp ax, 0x4d42
jne 0x88cbec
lodsd eax, dword [esi]
cmp eax, dword [0x479398]
jne 0x88cbec
lodsd eax, dword [esi]
cmp eax, 0
jne 0x88cbec
lodsd eax, dword [esi]
mov dword [0x82c874], eax
mov ecx, dword [0x479398]
sub ecx, 0xe
push edi
push 0
push 0x4319c0
push ecx
push dword [edi]
push dword [0x47939c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
mov edi, dword [edi]
cmp dword [edi + 0x14], 0
jne 0x88cb42
mov eax, dword [0x479398]
sub eax, dword [0x82c874]
mov dword [edi + 0x14], eax
push 0
push 0x88cc1a
push 0
push 0x479464
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamA]
cmp byte [0x82c878], 1
jne 0x88cb6c
call fcn.0088cb7b
jmp 0x88cb7a
mov edi, dword [0x48a6f8]
mov eax, 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
ret
push 0x1000
push str.Arghhh___...
push str.Bad_BitMap_file_header
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [0x48a6f8]
mov eax, 0
mov ecx, 3
rep stosd dword es:[edi], eax
ret
Function at 0x88d0d7
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
call fcn.0088d19e
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x82c894
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x88d127
cmp dword [str..EXE.EXE.SCR.DLL.SYSTest.a], 0x5243532e
jne 0x88d11d
mov eax, 0x479694
jmp 0x88d122
mov eax, 0
jmp 0x88d198
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x88d157
push str.SetupCommandLine:_GetFileSize
call fcn.0088d416
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0
jmp 0x88d198
mov dword [ebp - 8], eax
mov ebx, 0x82c88c
mov edx, dword [ebp - 8]
call fcn.0084b515
mov edi, dword [0x82c88c]
push 0
push 0x82c890
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
add edi, dword [0x82c890]
mov byte [edi], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x82c88c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x88d1bb
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.0088d19e
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x82c894
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x88d207
push 0
push 0xd6
push dword [0x846f94]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x88d290
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x88d21c
jmp 0x88d290
mov dword [ebp - 8], eax
mov ebx, 0x82c88c
mov edx, dword [ebp - 8]
call fcn.0084b515
push 0
push 0x82c890
push dword [ebp - 8]
push dword [0x82c88c]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x82c88c]
add eax, dword [0x82c890]
mov byte [eax], 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x82c88c]
push 0xd6
push dword [0x846f94]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [0x82c88c], 0
je 0x88d290
mov eax, dword [0x82c88c]
call fcn.0084b661
mov dword [0x82c88c], 0
mov esp, ebp
pop ebp
ret
Function at 0x88d294
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 0xe
push 0xd6
push dword [0x846f94]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov dword [ebp - 8], eax
cmp eax, 0
jne 0x88d2ce
call fcn.0088d19e
push 0x82c894
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x88d35e
mov ebx, 0x82c88c
mov edx, dword [ebp - 8]
call fcn.0084b515
call fcn.0088d19e
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x82c894
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x88d341
mov eax, dword [ebp - 8]
inc eax
push eax
push dword [0x82c88c]
push 0xd6
push dword [0x846f94]
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0
push 0x82c890
push eax
push dword [0x82c88c]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x82c88c], 0
je 0x88d35e
mov eax, dword [0x82c88c]
call fcn.0084b661
mov dword [0x82c88c], 0
mov esp, ebp
pop ebp
ret

Function at 0x88f52c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
movzx ecx, word [0x82d738]
movzx edx, word [0x82d73a]
sub edx, 0xc3
push 0
push dword [0x8187e0]
push 0xc8
push dword [0x82d718]
push edx
push ecx
push 0xc3
push 0
push 0x54000008
push str.DataTab
push str.SysTabControl32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
push 1
push dword [0x82d73c]
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x82d6e0], 1
mov dword [0x82d6ec], 0x47a5d4
push 0x82d6e0
push 0
push 0x1307
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x82d6ec], 0x47a5dc
push 0x82d6e0
push 1
push 0x1307
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x82d6ec], 0x47a5e6
push 0x82d6e0
push 2
push 0x1307
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x82d6ec], 0x47a5f4
push 0x82d6e0
push 3
push 0x1307
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x82d6ec], 0x47a5fb
push 0x82d6e0
push 4
push 0x1307
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x894278
push ebx
push 0x3f3
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x82d60c], eax
mov dword [0x82d614], eax
push 0
push 0x8927e5
push ebx
push 0x3f4
push dword [0x8187e0]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x82d610], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.0088e1e5
push 0
push dword [0x82cb1c]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.0088de1b
push 0
push dword [0x82c9f8]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call fcn.0088d4c6
push 0
push dword [0x82c99c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call fcn.0088fa65
mov esp, ebp
pop ebp
ret 4
Function at 0x88f9b2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [0x82d6dc], 0
jne 0x88f9c3
jmp 0x88fa34
cmp dword [0x82d608], 0
jne 0x88fa14
mov ebx, 0
cmp ebx, 8
jae 0x88fa0f
mov eax, dword [ebx*4 + 0x479870]
push dword [eax]
call fcn.00897aaa
mov edi, eax
mov eax, ebx
add eax, 0x47
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
inc ebx
jmp 0x88f9d5
jmp 0x88fa34
mov ebx, 0x47
cmp ebx, 0x4e
ja 0x88fa34
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
inc ebx
jmp 0x88fa19
mov esp, ebp
pop ebp
ret 4

Function at 0x8900f8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], esp
push dword [ebp - 4]
push dword [ebp + 8]
push 0x433
push dword [0x82d720]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x14]
pop dword [0x82a148]
push dword [ebp - 8]
pop dword [0x82a14c]
push 0x82a148
push dword [0x82d720]
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [ebp + 8]
cmp edx, 0
jne 0x89014a
mov eax, dword [0x82d620]
jmp 0x890178
cmp edx, 1
jne 0x890156
mov eax, dword [0x82d624]
jmp 0x890178
cmp edx, 2
jne 0x890162
mov eax, dword [0x82d628]
jmp 0x890178
cmp edx, 3
jne 0x89016e
mov eax, dword [0x82d62c]
jmp 0x890178
cmp edx, 4
jne 0x890178
mov eax, dword [0x82d630]
mov dword [0x82d640], eax
mov dword [0x82d638], edx
push dword [ebp - 4]
push dword [0x82d640]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
mov edx, dword [0x82a148]
add edx, ecx
cmp edx, eax
jbe 0x8901b3
sub eax, ecx
mov dword [0x82a148], eax
push 1
push dword [ebp + 8]
push 0x403
push dword [0x82d720]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x82d63c], 1
cmp dword [0x82d634], 0
je 0x8901fd
push str.Unhook____
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x82d634]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x82d634], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push dword [0x8187e0]
push 0x88ff68
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x82d634], eax
push str.SetHook
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push dword [0x82d718]
push 0
push dword [0x82a14c]
push dword [0x82a148]
push 0
push dword [0x82d640]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push dword [ebp + 8]
push 0x403
push dword [0x82d720]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x82d634], 0
je 0x89028b
push str.Unhook
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [0x82d634]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x82d634], 0
mov dword [0x82d63c], 0
mov esp, ebp
pop ebp
ret 4
Function at 0x890f70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], esp
mov dword [ebp - 0x28], 0x72614254
mov dword [ebp - 0x24], 0x1c
mov al, byte [0x82d65c]
mov byte [ebp - 0x20], al
push 0x47a0ac
push 1
push 0x41d
push dword [0x82d654]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x47a0b4]
pop dword [ebp - 0x10]
push dword [0x47a0d8]
pop dword [ebp - 0x1c]
push 0x47a0ac
push 2
push 0x41d
push dword [0x82d654]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x47a0b4]
pop dword [ebp - 0xc]
push dword [0x47a0d8]
pop dword [ebp - 0x18]
push 0x47a0ac
push 3
push 0x41d
push dword [0x82d654]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [0x47a0b4]
pop dword [ebp - 8]
push dword [0x47a0d8]
pop dword [ebp - 0x14]
push 0
push 0x82c890
push 0x24
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esp, ebp
pop ebp
ret 4

Function at 0x891028
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], esp
mov eax, 0
cmp dword [ebp + 0xc], 0x1c
je 0x891041
jmp 0x89115e
push 0
push 0x82c890
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [ebp - 0x20], 0
je 0x891062
call fcn.00890e25
mov ebx, dword [0x47a0b0]
mov dword [0x47a0b0], 0x41
push dword [ebp - 0x10]
pop dword [0x47a0b4]
push dword [ebp - 0x1c]
pop dword [0x47a0d8]
push 0x47a0ac
push 1
push 0x406
push dword [0x82d654]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0xc]
pop dword [0x47a0b4]
push dword [ebp - 0x18]
pop dword [0x47a0d8]
push 0x47a0ac
push 2
push 0x406
push dword [0x82d654]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 8]
pop dword [0x47a0b4]
push dword [ebp - 0x14]
pop dword [0x47a0d8]
push 0x47a0ac
push 3
push 0x406
push dword [0x82d654]
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
test dword [ebp - 0x10], 8
sete al
shl al, 3
push eax
push 0x12d
push dword [0x82d658]
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
test dword [ebp - 0xc], 8
sete al
shl al, 3
push eax
push 0x12e
push dword [0x82d658]
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
test dword [ebp - 8], 8
sete al
shl al, 3
push eax
push 0x12f
push dword [0x82d658]
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov dword [0x47a0b0], ebx
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x891351
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push esi
call fcn.0084a2b1
mov edi, 0x4a7614
mov eax, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov esi, str.debug.cfg
mov ecx, 0xd
rep movsb byte es:[edi], byte [esi]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x4a7614
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [edi], 0
cmp eax, 0xffffffff
jne 0x8913a6
jmp 0x891547
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push 0
push 0x82c890
push 8
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [0x82c890], 8
jne 0x89153e
cmp dword [ebp - 0x10], 0x58676552
jne 0x891412
lea eax, [ebp - 8]
push 0
push 0x82c890
push 4
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 1
jne 0x89140d
push 0
push 0xbc2
push 0x111
push dword [0x82d718]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x891539
cmp dword [ebp - 0x10], 0x70657453
jne 0x891458
lea eax, [ebp - 8]
push 0
push 0x82c890
push 4
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 1
jne 0x891453
push 0
push 0xbc1
push 0x111
push dword [0x82d718]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x891539
cmp dword [ebp - 0x10], 0x746e6f46
jne 0x89148d
push 0
push 0x82c890
push dword [ebp - 0xc]
push 0x47a104
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x82d718]
call fcn.00891164
jmp 0x891539
cmp dword [ebp - 0x10], 0x74636552
jne 0x8914ea
push 0
push 0x82c890
push dword [ebp - 0xc]
push 0x82d6fc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x82d704]
sub eax, dword [0x82d6fc]
mov edx, dword [0x82d708]
sub edx, dword [0x82d700]
push 1
push edx
push eax
push dword [0x82d700]
push dword [0x82d6fc]
push dword [0x82d718]
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x891539
cmp dword [ebp - 0x10], 0x72614254
jne 0x89150c
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.00891028
cmp eax, 0
je 0x891529
jmp 0x891539
cmp dword [ebp - 0x10], 0x614c614c
jne 0x891529
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.0089394d
jmp 0x891539
push 1
push 0
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x8913a9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x89154d
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push esi
call fcn.0084a2b1
mov edi, 0x4a7614
mov eax, 0
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov esi, str.debug.cfg
mov ecx, 0xd
rep movsb byte es:[edi], byte [esi]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push 0x4a7614
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov byte [edi], 0
cmp eax, 0xffffffff
jne 0x8915a2
jmp 0x8916bc
mov dword [ebp - 4], eax
push 0
push 0xbc2
push dword [0x82d628]
call dword [sym.imp.USER32.dll_GetMenuState]
and eax, 8
cmp eax, 0
je 0x8915c9
mov dword [ebp - 8], 1
jmp 0x8915d0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0x58676552
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0x10]
push 0
push 0x82c890
push 0xc
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], 0x70657453
push dword [0x82d710]
pop dword [ebp - 8]
lea eax, [ebp - 0x10]
push 0
push 0x82c890
push 0xc
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], 0x746e6f46
mov dword [ebp - 0xc], 0x3c
lea eax, [ebp - 0x10]
push 0
push 0x82c890
push 8
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x82c890
push dword [ebp - 0xc]
push 0x47a104
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], 0x74636552
mov dword [ebp - 0xc], 0x10
push 0x82d6fc
push dword [0x82d718]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push 0
push 0x82c890
push 8
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x82c890
push dword [ebp - 0xc]
push 0x82d6fc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 4]
call fcn.00890f70
push dword [ebp - 4]
call fcn.008939ab
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov esp, ebp
pop ebp
ret