joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014d0
Capabilities:
Check if file exists
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a4118
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea edi, [esp + 0x14]
call fcn.00427ce0
mov dword [esp + 0x28], 0
mov ebp, dword [esp + 0x14]
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x40153c
lea ecx, [eax - 1]
test ecx, ecx
jl 0x401691
cmp ecx, eax
jg 0x401691
movzx eax, word [ebp + ecx*2]
cmp ax, 0x5c
je 0x40153c
push 0x5c
call fcn.004053f0
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ebx, str.CBCache.dat
call fcn.004030f0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40157e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x4015c2
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
mov ebx, str.CBCache.dat
call fcn.004030f0
mov eax, dword [eax]
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4015c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, 1
test byte [0x4d8594], bl
jne 0x4015fe
or dword [0x4d8594], ebx
cmp dword [0x4d6b68], 0
jne 0x4015f1
cmp dword [0x4d6b6c], 0
jne 0x4015f1
mov dword [0x4d6b68], 0x4d7528
push 0x4a7e20
call fcn.0047ff6f
add esp, 4
mov ecx, dword [0x4d6b68]
cmp dword [ecx + 0xc4c], 0
mov dword [0x4d6b64], ebx
je 0x401655
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x20]
push eax
mov ebx, str.CBCache.dat
call fcn.004030f0
mov eax, dword [eax]
mov edi, dword [esp + 0x38]
add esp, 8
call fcn.00401a60
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401655
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401679
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push 0x80070057
call fcn.004054d0
int3
Function at 0x401a60
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ecx
push esi
mov esi, eax
test esi, esi
je 0x401b47
cmp dword [edi + 8], 0
je 0x401b47
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401b47
push ebx
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 3
push 0xc0000000
push esi
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x401b4c
call fcn.00405370
test eax, eax
jl 0x401b46
mov edx, dword [edi + 0x20]
test edx, edx
je 0x401b3b
lea eax, [esp + 8]
push eax
mov ecx, 0xac
call fcn.00405340
xor esi, esi
mov eax, dword [edi + 0x20]
mov ecx, dword [eax + 0xc]
imul ecx, esi
lea edx, [ecx + eax + 0xac]
test edx, edx
je 0x401afa
cmp dword [edx], 0
je 0x401afa
mov ecx, dword [edx + 0xc]
lea eax, [esp + 8]
add ecx, 0x10
push eax
call fcn.00405340
add esi, 1
cmp esi, 0x14
jl 0x401ad1
mov eax, dword [edi + 0x20]
mov ecx, dword [eax + 0xc]
imul ecx, dword [eax + 8]
lea ecx, [ecx + eax + 0xac]
test ecx, ecx
je 0x401b3b
cmp dword [ecx], 0
je 0x401b3b
mov eax, dword [ecx + 0xc]
push 0
lea edx, [esp + 0xc]
push edx
add eax, 0x10
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401b3b
call fcn.00405370
test ebx, ebx
je 0x401b46
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
xor eax, eax
pop esi
pop ecx
ret
mov ebx, eax
mov dword [esp + 8], ebx
jmp 0x401ab9

Function at 0x405340
Capabilities:
Write file on windows

Disassembly:
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [eax]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x405362
call fcn.00405370
ret 4
xor eax, eax
ret 4

Function at 0x405450
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
mov edx, dword [ecx]
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp], eax
jne 0x405475
call fcn.00405370
test eax, eax
jl 0x405480
mov eax, dword [esp]
mov dword [esi], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
xor eax, eax
add esp, 0xc
ret
Function at 0x405a80
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, 1
push 0
mov edi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x405b52
mov eax, dword [0x4d6bd0]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x405abe
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, edi
call fcn.00405b60
xor esi, esi
xor ebp, ebp
xor ebx, ebx
jmp 0x405ad0
push esi
call dword [sym.imp.USER32.dll_EnumClipboardFormats]
mov esi, eax
test esi, esi
je 0x405b01
call fcn.00405bc0
test eax, eax
je 0x405ad0
push esi
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x405ad0
push eax
push esi
call fcn.00405c50
test eax, eax
je 0x405b10
add ebp, 1
jmp 0x405ad0
test ebp, ebp
jne 0x405b1d
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x405b1d
mov ebx, 1
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_CloseClipboard]
test ebx, ebx
jne 0x405b31
push edi
call fcn.00405ea0
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x48]
test eax, eax
je 0x405b56
push eax
call fcn.0047f45b
mov eax, dword [esp + 0x14]
add esp, 4
mov dword [edi + 0x48], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x406630
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x4a1ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, edx
lea eax, [esp + 0x18]
push eax
push ecx
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0xffffffff
call fcn.00406790
test eax, eax
je 0x406775
mov edi, dword [esi + 0x40]
push 0xffffffffffffffff
push edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x40669b
cmp eax, 0x80
jne 0x4066a0
mov byte [esp + 0x24], 1
lea edx, [esp + 0x1c]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x18]
push edx
lea eax, [esi + 0x18]
call fcn.00401760
test eax, eax
je 0x406767
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x406767
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x406767
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esi + 0x60]
mov edx, dword [eax]
lea ecx, [esi + 0x60]
push 0
mov dword [esi + 0x58], 1
call edx
xor edi, edi
xor ebp, ebp
cmp dword [ebx + 8], edi
jbe 0x40675d
test edi, edi
jne 0x406704
lea edi, [ebx + 0x10]
jmp 0x40670b
mov eax, dword [edi + 4]
lea edi, [edi + eax + 8]
test edi, edi
je 0x406755
mov ecx, dword [edi + 4]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406755
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x406744
mov edx, dword [edi + 4]
push edx
lea ecx, [edi + 8]
push ecx
push eax
call fcn.00488b70
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [edi]
push esi
push edx
call dword [sym.imp.USER32.dll_SetClipboardData]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
add ebp, 1
cmp ebp, dword [ebx + 8]
jb 0x4066fb
call dword [sym.imp.USER32.dll_CloseClipboard]
mov edi, dword [esp + 0x20]
cmp byte [esp + 0x24], 0
je 0x406775
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x4076c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4076d7
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x407708
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x407704
cmp esi, eax
jae 0x407708
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4076f4
cmp esi, eax
jb 0x40770e
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x40fda0
Capabilities:
Get common file path
Get startup folder

Disassembly:
sub esp, 0x214
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, 1
test byte [0x4d85c4], bl
mov dword [esp + 4], 0
jne 0x40fdf4
mov eax, dword [0x4d5c6c]
mov edx, dword [eax + 0xc]
or dword [0x4d85c4], ebx
mov ecx, 0x4d5c6c
call edx
add eax, 0x10
push 0x4a7cc0
mov dword [0x4d85c0], eax
call fcn.0047ff6f
add esp, 4
mov eax, dword [0x4d85c0]
cmp dword [eax - 0xc], 0
jne 0x40fe51
push 0x20a
lea ecx, [esp + 0xe]
push 0
push ecx
mov word [esp + 0x14], 0
call fcn.004854b0
add esp, 0xc
push ebx
push 7
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fe31
sub eax, edx
sar eax, 1
lea ecx, [esp + 8]
mov ebx, eax
push ecx
mov eax, 0x4d85c0
call fcn.00405240
mov eax, dword [0x4d85c0]
add eax, 0xfffffff0
call fcn.004050b0
mov ecx, dword [esp + 0x214]
add eax, 0x10
pop ebx
mov dword [esi], eax
xor ecx, esp
mov eax, esi
call fcn.0047f460
add esp, 0x214
ret

Function at 0x40fe80
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x4a96bc
push 1
xor esi, esi
push esi
push 0x4a96cc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40ff2e
mov eax, dword [esp + 4]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push str._autorun__1
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push 0x4ac230
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 5
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x4a96dc
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x40ff22
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, 1
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop ecx
ret 8

Function at 0x412ff0
Capabilities:
Hide graphical window

Disassembly:
push ecx
cmp dword [ebx + 0x190], 0
push esi
push edi
mov dword [ebx + 0x194], eax
mov dword [ebx + 0x158], eax
jne 0x413047
call fcn.00413a90
test eax, eax
mov dword [ebx + 0x190], eax
je 0x413047
mov ecx, dword [ebx + 0x194]
mov dword [eax + 0x24], ecx
mov eax, dword [ebx + 0x194]
mov edi, dword [ebx + 0x190]
push eax
call fcn.00413940
mov eax, dword [ebx + 0x190]
mov ecx, dword [eax + 4]
add eax, 4
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebx + 0x190]
push 0xffffffffffffffff
push 1
call fcn.004157d0
push 1
push 0x50
push ecx
mov edx, esp
mov dword [esp + 0x14], esp
push edx
mov ecx, 0x4acca4
call fcn.00410300
mov esi, ebx
call fcn.00446db0
pop edi
pop esi
pop ecx
ret
Function at 0x413810
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x4a2878
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4d16b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x10c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41391b
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0xc]
mov ecx, esi
call fcn.004134c0
mov dword [esp + 0x20], 0
mov esi, dword [esp + 0x10]
cmp dword [esi - 4], 1
jle 0x413885
mov ecx, dword [esi - 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00404f90
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 0xc]
lea eax, [eax + eax + 2]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4138cf
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4138bf
mov ecx, dword [esi - 0xc]
lea ecx, [ecx + ecx + 2]
push ecx
push esi
push eax
call fcn.00488b70
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4138d4
sub eax, edx
sar eax, 1
js 0x413931
cmp eax, dword [esi - 8]
jg 0x413931
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call dword [sym.imp.USER32.dll_CloseClipboard]
lea eax, [esi - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41391b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 4
push 0x80070057
call fcn.004054d0
int3
Function at 0x4144d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x4c
mov eax, dword [0x4d16b0]
xor eax, esp
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x54]
push ebx
push ebp
mov ebp, dword [esp + 0x58]
push esi
push edi
xor esi, esi
push esi
push 0x80
push 4
push esi
push 1
push 0x40000000
push eax
mov dword [esp + 0x30], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x414605
call fcn.00405370
cmp eax, esi
jl 0x4145f0
mov ebx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [esp + 0x20]
push eax
push esi
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
call edi
cmp eax, 0xffffffff
jne 0x414543
call fcn.00405370
xor eax, eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x34], eax
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x34], 0x51515346
mov dword [esp + 0x38], 0x651ee4a5
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0x24
lea edx, [esp + 0x3c]
push edx
push ebx
mov dword [esp + 0x64], 0x30
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4145bb
call fcn.00405370
mov esi, eax
test esi, esi
jl 0x4145e3
mov eax, dword [esp + 0x50]
xor esi, esi
push esi
lea ecx, [esp + 0x20]
push ecx
push eax
push ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], esi
call edi
cmp eax, 0xffffffff
jne 0x41460e
call fcn.00405370
cmp eax, esi
jge 0x41460e
mov esi, eax
test ebx, ebx
je 0x4145ee
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0047f460
add esp, 0x4c
ret 8
mov dword [esp + 0x14], eax
jmp 0x41451d
xor eax, eax
add ebp, 0x360
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x35d
xor edi, edi
test byte [edi + 0x4b74dc], 2
jne 0x414675
mov ecx, dword [edi + 0x4b74d8]
cmp ecx, 0xa
ja case.default.0x414644
jmp dword [ecx*4 + 0x4146d8]
mov edx, dword [ebp]
push edx
jmp 0x41465b
mov ecx, dword [ebp]
push ecx
jmp 0x41465b
mov eax, dword [ebp]
push eax
movzx ebx, word [edi + 0x4b74de]
lea esi, [esp + 0x1c]
call fcn.00414b20
mov ebx, dword [esp + 0x14]
xor esi, esi
cmp eax, esi
jl 0x414683
add edi, 0x18
add ebp, 4
cmp edi, 0x22e0
jb 0x414630
mov edx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
push edx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4146a7
call fcn.00405370
mov edi, eax
jmp 0x4146a9
xor edi, edi
test esi, esi
je 0x4146b6
push esi
call fcn.0047fdbd
add esp, 4
test ebx, ebx
je 0x4146c1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x54]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047f460
add esp, 0x4c
ret 8
Function at 0x414b90
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push 2
push 0
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
jne 0x414bca
call fcn.00405370
pop edi
add esp, 0x10
ret
mov ecx, dword [esp + 8]
push 0
push ecx
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x10]
push edx
mov dword [esi + 4], ecx
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x14]
push ecx
push 4
push eax
mov dword [esi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
test eax, eax
mov dword [esi], eax
jne 0x414c1f
call fcn.00405370
mov edx, dword [esi + 8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov eax, edi
pop edi
add esp, 0x10
ret
xor eax, eax
pop edi
add esp, 0x10
ret

Function at 0x415dd5
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 0x18], 0
push esi
mov esi, ecx
jne 0x415e42
mov eax, dword [esp + 0xc]
cmp eax, 0x110
jne 0x415e0d
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 1
call fcn.00415fe0
cmp dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
je 0x415e42
mov eax, 1
pop esi
ret 0x18
cmp eax, 2
jne 0x415e48
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x415e38
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esp + 0x18]
mov dword [edx], 1
xor eax, eax
pop esi
ret 0x18
cmp eax, 0xf
jne 0x415e75
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 1
call fcn.00416060
cmp dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
je 0x415e42
mov eax, 1
pop esi
ret 0x18
cmp eax, 0x113
jne 0x415e42
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 1
call fcn.00416180
cmp dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
je 0x415e42
mov eax, 1
pop esi
ret 0x18

Function at 0x415fe0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esi + 0x44], 0
jne 0x416041
mov ecx, 0x4ba6e0
call fcn.00417f80
test eax, eax
mov dword [esi + 0x40], eax
je 0x416041
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [esi + 0x44], eax
je 0x416041
mov eax, dword [esi + 4]
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 4]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x44]
mov dword [esi + 0x3c], 0xff
movzx edx, byte [esi + 0x3c]
push 2
push edx
push 0
push eax
call ecx
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 4]
mov dword [eax], 1
mov eax, 1
ret 4
Function at 0x416210
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ebx
mov ebx, eax
mov eax, dword [esi + 4]
push ebp
push eax
mov dword [esi + 0x30], 0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
je 0x416244
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 4]
push 0
push edx
call ebp
test ebx, ebx
mov dword [esi + 0x24], 0xbb8
lea eax, [esi + 0x2c]
jne 0x416256
xor ecx, ecx
jmp 0x416271
mov ecx, ebx
lea edx, [ecx + 2]
mov dword [esp + 8], edx
nop
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x416260
sub ecx, dword [esp + 8]
sar ecx, 1
push ebx
mov ebx, ecx
call fcn.00405240
mov eax, dword [edi + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [edi]
push 0
sub edx, eax
push edx
mov edx, dword [edi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esi + 4]
push 4
push ecx
call ebp
mov eax, dword [esi + 0x44]
test eax, eax
pop ebp
mov dword [esi + 0x3c], 0xff
pop ebx
je 0x4162bf
movzx edx, byte [esi + 0x3c]
mov ecx, dword [esi + 4]
push 2
push edx
push 0
push ecx
call eax
mov edx, dword [esi + 4]
push 0
push 0x32
push 1
push edx
call dword [sym.imp.USER32.dll_SetTimer]
pop ecx
ret

Function at 0x4162e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x416306
mov ecx, dword [esi + 4]
push 1
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
ret