joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e474
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
test dl, dl
je 0x1002e4ba
cmp byte [ebp + 8], 0
jne 0x1002e49a
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002e496
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esp, ebp
pop ebp
ret
push 1
push ecx
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push ecx
mov edx, 0x7ab
mov ecx, 0x4a4f
call fcn.1002e2cd
add esp, 0x10
jmp 0x1002e496
test cl, cl
je 0x1002e48e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1002e496

Function at 0x1002f2c6
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov byte [esp + 4], cl
test cl, cl
je 0x1002f336
mov dword [esp + 8], 0
mov dword [esp + 0x10], 0xafe01bd9
mov dword [esp + 0x10], 0xdae8c9f3
mov dword [esp + 0x10], 0x6092
mov dword [esp + 0x10], 0xfffffffb
mov dword [esp + 0x10], 3
mov dword [esp + 8], 0xfffffff3
jmp 0x1002f32d
mov dword [esp + 0xc], 5
mov dword [esp + 0x14], 0x735e4b78
inc dword [esp + 0xc]
dec dword [esp + 0x10]
inc dword [esp + 8]
cmp dword [esp + 8], 0x15
jne 0x1002f311
jmp 0x1002f33e
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x1002f42d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10054fff
call fcn.10053f54
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002f50a
cmp byte [ebp + 0x18], 0
je 0x1002f458
and dword [ecx], 0
jmp 0x1002f566
mov dword [ebp - 0x14], 0x6c6b
cmp dword [ebp - 0x14], 0x6eb7
jle 0x1002f4ae
xor esi, esi
mov dword [ebp + 0x10], esi
xor edi, edi
and dword [ebp - 0x18], 0
mov ebx, esi
mov esi, dword [ebp - 0x18]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1006d158
xor eax, esi
cdq
push edx
push eax
call fcn.100021b6
inc esi
cmp esi, 0x2dcc
jl 0x1002f47c
mov esi, dword [ebp + 0x10]
inc edi
cmp edi, 0x4ada
jl 0x1002f46f
inc esi
mov dword [ebp + 0x10], esi
cmp esi, 0x324e
jl 0x1002f46d
mov byte [ebp + 0x13], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x6b8e
jge 0x1002f4ce
mov edx, str.gxxqb_gxxhzra_nuzxcmvi_slzcvqzl_kmfqr_epvkka
mov ecx, 0x1006d158
call fcn.100037d8
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x13], 0
je 0x1002f566
push 0xde8
mov edx, 0x733b
xor cl, cl
call fcn.1002f7be
pop ecx
jmp 0x1002f566
cmp byte [ebp + 8], 0
je 0x1002f541
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x30]
push eax
call fcn.100330c1
mov ecx, dword [ebp + 0x1c]
push eax
mov dword [ebp - 4], 2
call fcn.1003316f
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10003fdb
jmp 0x1002f566
cmp byte [edx], 0
je 0x1002f566
push 0
push 0x181d
push 0x226
push 0
push 0x772
push 0x100b
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100308a2
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10055183
push eax
mov dword fs:[0], esp
mov eax, ecx
sub esp, 0x30
push ebx
test dl, dl
je 0x10030955
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10003e3e
lea ecx, [esp + 0x24]
call fcn.1002feb3
add esp, 0x18
xor ebx, ebx
mov dword [esp + 0x3c], ebx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0xc], eax
je 0x10030945
push dword [esp + 8]
xor ecx, ecx
mov dword [esp + 0x30], 7
push eax
push dword [esp + 0x14]
mov word [esp + 0x24], cx
lea ecx, [esp + 0x24]
mov dword [esp + 0x34], ebx
call fcn.10014cc9
mov ecx, dword [ebp + 0xc]
lea edx, [esp + 0x18]
mov byte [esp + 0x3c], 1
call fcn.10030860
lea ecx, [esp + 0x18]
push ebx
push 1
test eax, eax
jns 0x10030940
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
call fcn.10003fdb
jmp 0x1003094a
call fcn.10003fdb
mov eax, dword [ebp + 0x14]
mov byte [eax], bl
lea ecx, [esp + 0xc]
call fcn.1002da0c
jmp 0x1003097a
xor ebx, ebx
push ebx
push 0x21df
push 0x1766
push 0x2214
push 0x59
push 0xfe6
push 0x17f1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030f52
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005519f
call fcn.10053f54
sub esp, 0x24
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10030f8d
mov eax, dword [ebp + 0x14]
movzx eax, word [eax]
push eax
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.100042d4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x17e0
cmp dword [ebp - 0x24], 0x1a88
jle 0x10030fec
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], 0x7b3a
mov ebx, edi
mov dword [ebp - 0x18], 0x2716
xor esi, esi
mov eax, ebx
mov ecx, 0x1006d158
xor eax, esi
cdq
push edx
push eax
call fcn.100021b6
inc esi
cmp esi, 0x10ae
jl 0x10030fb6
inc ebx
dec dword [ebp - 0x18]
jne 0x10030fb4
mov esi, dword [ebp - 0x20]
add edi, esi
dec dword [ebp - 0x1c]
jne 0x10030fab
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7bd8
jl 0x10030fa2
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10030ffc
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x17c5
jge 0x10030f7c
mov dword [ebp - 0x24], 0x2683
cmp dword [ebp - 0x24], 0x1103
jge 0x10031077
lea eax, [ebp - 0x30]
push eax
push 0x1005ca40
call fcn.1003c4a6
xor esi, esi
inc esi
pop ecx
pop ecx
cmp dword [ebp - 0x30], esi
jl 0x10031077
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
push str._d__d
call fcn.1003c4a6
mov edx, dword [ebp - 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 0x28]
call fcn.10030f2c
mov ecx, eax
mov eax, dword [ebp - 0x28]
cdq
idiv ecx
push ecx
imul eax, dword [ebp - 0x2c]
push eax
push esi
push str._d__d__d_n
call fcn.1003bcd0
add esp, 0x10
inc esi
cmp esi, dword [ebp - 0x30]
jle 0x10031035
mov edx, str.ubdkwhsyt_hlmiizdgn_kfdjw_fopyj_bnnfohx_ourlmfhym_mid_bsehla_tqaavek_iki_wnioyu_sckxl_ahrqhniz
mov ecx, 0x1006d158
call fcn.100037d8
jmp 0x10030f7c
Function at 0x10035431
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10055398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov esi, edx
mov dword [esp + 0x14], esi
je 0x10035556
xor ebx, ebx
mov dword [esp + 0x10], 0xfffffffe
inc ebx
mov dword [esp + 0xc], 0x50e6da50
push ebx
push ebx
push 0x6484
push 0x5b60
push 0x6555
push 0x3c17
mov edx, 0x27fe
mov ecx, 0x4c22
call fcn.10034d61
add esp, 0x18
lea eax, [esp + 0xc]
lea edx, [esp + 0x10]
push ebx
push eax
push ecx
push 0x6620
call fcn.100352e8
and dword [esp + 0x38], 0
xor eax, eax
add esp, 0x10
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
and dword [esp + 0x3c], eax
lea ecx, [esp + 0x18]
push esi
call fcn.10014e52
mov eax, dword [0x1006fe44]
test bl, al
jne 0x10035500
or eax, ebx
mov dword [0x1006fe44], eax
push 0xbddf
mov byte [esp + 0x40], bl
call fcn.1002a336
pop ecx
mov word [0x1006fe38], ax
mov byte [esp + 0x3c], 0
lea eax, [esp + 0x14]
mov edx, 0x4b3b
push eax
push 0x3f73
push ebx
push ecx
push ecx
push 0x1006fe38
push ecx
lea ecx, [esp + 0x34]
call fcn.10034c6e
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x34]
add esp, 0x1c
cmp ecx, eax
je 0x10035539
push 0xffffffffffffffff
push 0
push eax
call fcn.10003f01
push 0
push ebx
lea ecx, [esp + 0x20]
call fcn.10003fdb
mov ecx, dword [esp + 0x34]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10035545
push 0x1df4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10035c52
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor edx, edx
mov byte [ebp - 8], cl
test cl, cl
je 0x10035ca1
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax], edx
jne 0x10035c97
mov eax, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
sub eax, 0x49a54b2e
jne 0x10035c81
cmp dword [ecx], edx
jne 0x10035c81
mov esi, edx
jmp 0x10035c84
xor esi, esi
inc esi
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov eax, dword [eax]
cmp eax, esi
pop esi
setle cl
dec ecx
cmp ecx, 2
ja 0x10035c9a
xor edx, edx
inc edx
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x10035cb0
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x10035cb0
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x10035e8e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10035ea5
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10035ec7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1006eab4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1006ee40
jl 0x10035ed5
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1006f0e4
jl 0x10035f15
mov ecx, dword [0x1006fe30]
xor ecx, dword [0x1006eab4]
and ecx, edi
xor ecx, dword [0x1006fe30]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1006eab0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1006f0e4]
mov dword [0x1006f470], eax
pop esi
ret
Function at 0x403d99
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 0x670]
xor ecx, ecx
cmp eax, 1
push edi
lea edi, [esi + 0x430]
mov dword [ebp - 4], ecx
mov word [edi], cx
jne 0x403f29
mov ebx, 0x208
push ebx
push ecx
lea eax, [ebp - 0x23e]
push eax
mov word [ebp - 0x240], cx
call sub.msvcrt.dll_memset
and word [ebp - 0x450], 0
add esp, 0xc
push ebx
lea eax, [ebp - 0x44e]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ebx, [ebp - 0x450]
call fcn.0040ea84
push 0x410910
call sub.msvcrt.dll_wcslen
mov ebx, eax
pop ecx
lea eax, [ebp - 0x450]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, 0x104
pop ecx
jae 0x403e46
lea eax, [ebp - 0x450]
push 0x410910
push eax
lea eax, [ebp - 0x240]
call fcn.00406087
pop ecx
pop ecx
jmp 0x403e4e
and word [ebp - 0x240], 0
lea eax, [ebp - 0x240]
push eax
call fcn.00405f1f
test eax, eax
pop ecx
je 0x403f20
lea eax, [ebp - 0x240]
lea ebx, [esi + 4]
push eax
mov eax, ebx
call fcn.0040472c
test eax, eax
jne 0x403f4a
and dword [ebp - 0x10], eax
and dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
mov dword [ebp - 8], 0x1388
call fcn.0040694c
push str.dllhost.exe
call fcn.00406994
push str.taskhost.exe
lea eax, [ebp - 0x30]
call fcn.00406994
push str.taskhostex.exe
lea eax, [ebp - 0x30]
call fcn.00406994
push str.taskhostw.exe
lea eax, [ebp - 0x30]
call fcn.00406994
push 0x4109d8
call fcn.00405dcc
pop ecx
push edi
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040d23b
test eax, eax
push edi
je 0x403efd
mov eax, ebx
call fcn.0040472c
test eax, eax
jne 0x403f0e
mov eax, dword [esi + 0x418]
mov dword [ebp - 4], eax
jmp 0x403f0e
mov dword [ebp - 4], 0xfffffffe
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
and word [edi], 0
lea esi, [ebp - 0x30]
call fcn.0040696e
lea ecx, [ebp - 0x10]
call fcn.00406eed
jmp 0x403f4a
mov dword [ebp - 4], 0xfffffffd
jmp 0x403f4a
cmp eax, 2
jne 0x403f4a
lea eax, [esi + 0x674]
push eax
lea eax, [esi + 4]
call fcn.0040472c
test eax, eax
jne 0x403f4a
mov eax, dword [esi + 0x418]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40425e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp dword [edi + 0x670], 3
push ebx
push esi
jne 0x404281
lea eax, [edi + 0x87e]
push eax
mov ecx, edi
call fcn.00404511
jmp 0x4042f0
mov eax, edi
call fcn.00403d99
xor esi, esi
cmp eax, esi
mov dword [esp + 0xc], eax
jne 0x4042ec
cmp dword [edi + 0x42c], esi
jle 0x4042cd
mov eax, esi
lea ecx, [edi + 0x420]
call fcn.00404679
push 0xe
mov ebx, eax
push str.CookieEntryEx_
push ebx
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x4042c4
push ebx
push edi
call fcn.00403f52
inc esi
cmp esi, dword [edi + 0x42c]
jl 0x40429a
lea esi, [edi + 4]
call fcn.004047ac
lea esi, [edi + 0x430]
cmp word [esi], 0
je 0x4042ec
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
and word [esi], 0
mov eax, dword [esp + 0xc]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404484
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [ebp + 0xc]
call fcn.00405a86
mov ebx, eax
cmp ebx, 0xffffffff
pop ecx
je 0x40450a
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
test edi, edi
je 0x4044eb
mov esi, dword [ebp + 8]
lea eax, [edi + 0xa]
add esi, 0x63c
push eax
mov eax, esi
call fcn.00406f2a
mov eax, dword [esi]
push edi
push eax
push ebx
call fcn.00406573
add esp, 0xc
test eax, eax
je 0x4044eb
mov eax, dword [esi]
push 5
add eax, edi
push 0
push eax
mov dword [ebp - 4], 1
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 4], 0
je 0x40450a
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 0x63c]
push eax
call fcn.004042f6
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x405ab8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x405c3f
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test ebp, ebp
je 0x405c9c
push ebx
push edi
push ebp
call sub.msvcrt.dll_wcslen
pop ecx
lea ebx, [eax + eax + 2]
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x405c9a
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push ebx
push ebp
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x405ca7
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00405a86
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x405d39
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x405d22
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x405d22
shr esi, 1
and word [edi + esi*2], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x405d2b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x405d42
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x405f1f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x4060ab
Capabilities:
Get common file path

Disassembly:
cmp word [0x415310], 0
push esi
mov esi, 0x415310
jne 0x4060cc
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x41551c], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x41551c]
pop ecx
pop ecx
pop esi
ret

Function at 0x406402
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x410484
push eax
push eax
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x406d36
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
push edi
jne 0x406d70
lea edi, [esi + 4]
mov ecx, edi
call fcn.00405fdf
mov dword [esi + 0x28c], eax
lea eax, [esi + 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov dword [esp + 8], ecx
jmp 0x406d8b
lea ecx, [esi + 0x290]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov dword [esp + 8], eax
jne 0x406d92
call fcn.00406ddc
cmp dword [esp + 8], 0
je 0x406dd4
push ebx
lea edi, [esi + 0x4e0]
lea ebx, [esi + 0x2bc]
push ebp
add esi, 0x768
push esi
call sub.msvcrt.dll_wcslen
push ebx
mov ebp, eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + ebp + 1]
cmp eax, 0x143
pop ecx
pop ecx
jae 0x406dce
push ebx
push esi
mov eax, edi
call fcn.00406087
pop ecx
pop ecx
jmp 0x406dd2
and word [edi], 0
pop ebp
pop ebx
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret
Function at 0x40758d
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x414c78
push dword [esp + 0xc]
push esi
push 0x410484
push dword [esp + 0x14]
push 0x414e88
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x4075b2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040f310
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x414c78
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x410484
push dword [ebp + 8]
push 0x414e88
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x407621
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x407625
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040f310
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x414c78
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x410484
push dword [ebp + 8]
mov esi, 0x414e88
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x40768c
cmp dword [ebp + 0x10], 0
jne 0x40768c
xor eax, eax
jmp 0x40769a
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x407a11
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00405f1f
test eax, eax
pop ecx
je 0x407a98
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x414c78
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x414e88
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x410bd8
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x414f10
mov dword [0x414f0c], eax
call fcn.0040758d
push 0x3f
push str.TranslatorName
mov esi, 0x414f90
call fcn.0040758d
push 0xff
push str.TranslatorURL
mov esi, 0x415010
call fcn.0040758d
add esp, 0x18
pop edi
pop esi
ret
Function at 0x4089fd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, eax
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, edi
call fcn.00407fc9
and dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 8], eax
jle 0x408a8a
cmp dword [ebp + 8], 0
je 0x408a48
mov eax, dword [ebp - 4]
push 0x64
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x408a48
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x10]
cmp eax, 0x1f4
ja 0x408a8a
mov ebx, dword [esi + 0xc]
add ebx, dword [ebp - 4]
cmp ebx, dword [ebp - 8]
jl 0x408a5c
test byte [esi + 0x10], 0x20
je 0x408a8a
sub ebx, dword [ebp - 8]
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push edi
mov eax, ebx
call fcn.00408777
test eax, eax
je 0x408a7f
push dword [ebp + 8]
push dword [ebp - 0xc]
call fcn.0040896e
test eax, eax
jne 0x408a94
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x408a25
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, ebx
jmp 0x408a8d

Function at 0x408fc7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.0040f310
push ebx
push esi
mov esi, 0x7fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x8003]
push ebx
push eax
mov byte [ebp - 0x8004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x8004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x8004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x8004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret

Function at 0x409036
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040f310
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret