joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d05
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x84
push ebx
push esi
mov esi, dword [ebp + 0x68]
push edi
call fcn.004036bf
xor ebx, ebx
push 0x3f
lea eax, [ebp - 0x23]
push ebx
push eax
mov dword [ebp + 0x5c], ebx
mov byte [ebp - 0x24], bl
call sub.msvcrt.dll_memset
push 0x3f
lea eax, [ebp + 0x1d]
push ebx
push eax
mov byte [ebp + 0x1c], bl
call sub.msvcrt.dll_memset
mov esi, dword [ebp + 0x6c]
add esp, 0x18
cmp esi, 0x8003
jne 0x403d55
mov dword [ebp + 0x6c], 0x10
jmp 0x403d5f
mov eax, esi
call fcn.004036eb
mov dword [ebp + 0x6c], eax
cmp esi, 0x800e
push 0x40
pop edi
jne 0x403d6d
add edi, 0x40
lea eax, [ebp - 0x24]
push eax
push 0x14
push dword [ebp + 0x74]
push 0x14
push dword [ebp + 0x70]
push esi
push dword [ebp + 0x68]
call fcn.0040381d
mov eax, dword [ebp + 0x78]
dec eax
cmp eax, ebx
jbe 0x403dd8
mov dword [ebp + 0x74], eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x6c]
lea eax, [ebp - 0x24]
push eax
push 0x14
push dword [ebp + 0x70]
push esi
push dword [ebp + 0x68]
call fcn.0040381d
mov dword [ebp + 0x5c], eax
xor eax, eax
cmp dword [ebp + 0x6c], ebx
jbe 0x403dc0
mov cl, byte [ebp + eax - 0x24]
xor byte [ebp + eax + 0x1c], cl
inc eax
cmp eax, dword [ebp + 0x6c]
jb 0x403db2
push dword [ebp + 0x6c]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
dec dword [ebp + 0x74]
jne 0x403d8f
push dword [ebp + 0x6c]
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x7c]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x5c]
add esp, 0xc
pop edi
pop esi
pop ebx
add ebp, 0x60
leave
ret 0x18

Function at 0x404032
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x10]
mov ebx, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403f5a
mov edi, eax
test edi, edi
je 0x4040ad
push dword [ebp + 0xc]
call fcn.00406932
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0xc], eax
je 0x4040ab
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov edi, eax
lea esi, [ebx + 4]
push edi
mov eax, esi
call fcn.00407f88
cmp edi, 0x32
jbe 0x40409d
mov eax, dword [esi]
push edi
push eax
push dword [ebp + 0xc]
call fcn.004073fd
push 0xa0
push dword [esi]
add ebx, 0x18
push ebx
mov edi, eax
call sub.msvcrt.dll_memcpy
add esp, 0x18
jmp 0x40409f
xor edi, edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
jmp 0x4040ad
xor edi, edi
mov eax, edi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x4041cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x70]
mov eax, 0x21ac
call fcn.0043fb00
and dword [ebp + 0x68], 0
push esi
mov esi, dword [ebx + 4]
push edi
mov edi, 0xfff
push edi
lea eax, [ebp - 0x213b]
push 0
push eax
mov byte [ebp - 0x213c], 0
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x113b]
push 0
push eax
mov byte [ebp - 0x113c], 0
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x68]
add esp, 0x18
cmp eax, 0xbb8
jae 0x4043db
push eax
lea edi, [esi + 0xa0]
lea eax, [ebp - 0x213c]
push edi
push eax
call sub.msvcrt.dll_memcpy
push dword [esi + 0x68]
lea eax, [ebp - 0x113c]
push edi
push eax
call sub.msvcrt.dll_memcpy
xor eax, eax
mov byte [ebp + 0x50], 0
lea edi, [ebp + 0x51]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor edi, edi
lea eax, [ebp + 0x11]
push edi
push eax
mov byte [ebp + 0x10], 0
call sub.msvcrt.dll_memset
push 0x10
lea eax, [esi + 0x84]
push eax
lea eax, [ebp + 0x50]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x30
lea eax, [ebp + 0x10]
push eax
mov byte [ebp + 0x63], 1
push dword [esi + 0x94]
lea eax, [ebp + 0x50]
push eax
push dword [ebp + 0x7c]
push dword [esi + 0x98]
push ebx
call fcn.00403d05
push 0x20
pop eax
push eax
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
mov byte [ebp - 0x3c], 8
mov dword [ebp - 0x38], 0x6610
mov byte [ebp - 0x3b], 2
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp + 0x6c]
push eax
push 0x2c
lea eax, [ebp - 0x3c]
push eax
push dword [ebx]
mov eax, dword [ebx + 0x14]
mov dword [ebp + 0x6c], edi
call fcn.004034a1
cmp dword [ebp + 0x6c], edi
je 0x4043d6
mov eax, dword [esi + 0x68]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp - 0x113c]
push eax
push dword [ebp + 0x6c]
mov eax, dword [ebx + 0x14]
call fcn.00403476
push dword [ebp + 0x6c]
mov eax, dword [ebx + 0x14]
call fcn.004034ce
xor eax, eax
mov cl, byte [ebp + eax + 0x30]
xor byte [ebp + eax - 0x113c], cl
inc eax
cmp eax, 0x10
jl 0x404310
push 0x7f
lea eax, [ebp - 0x13b]
push edi
push eax
mov byte [ebp - 0x13c], 0
call sub.msvcrt.dll_memset
push 0x7f
lea eax, [ebp - 0xbb]
push edi
push eax
mov byte [ebp - 0xbc], 0
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x13c]
push eax
push 0x10
lea eax, [ebp - 0x113c]
push eax
push 0x14
push dword [ebp + 0x7c]
mov edi, 0x80
push dword [esi + 0x98]
push ebx
call fcn.0040381d
lea eax, [ebp - 0xbc]
push eax
push 0x40
lea eax, [ebp - 0x10ec]
push eax
push 0x40
lea eax, [ebp - 0x13c]
push eax
push dword [esi + 0x98]
push ebx
call fcn.0040381d
push 0x40
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0xbc]
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4043d6
push dword [ebp + 0x78]
lea eax, [ebp - 0x10ec]
push 0x40
push eax
push 0x8004
mov eax, ebx
call fcn.00403716
mov dword [ebp + 0x68], 1
mov eax, dword [ebp + 0x68]
jmp 0x4043e7
mov dword [ebx + 0x31c], 0xfffffffe
xor eax, eax
pop edi
pop esi
add ebp, 0x70
leave
ret 8
Function at 0x406828
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
and word [ebp - 0x800], 0
push esi
push 0x7fe
lea eax, [ebp - 0x7fe]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp word [0x44f258], 0
mov esi, 0x44f258
jne 0x406870
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
mov dword [0x44f464], eax
lea eax, [ebp - 0x800]
push esi
push eax
call sub.msvcrt.dll_wcscpy
lea esi, [ebp - 0x800]
call fcn.00406988
push dword [ebp + 8]
mov eax, esi
push eax
call sub.msvcrt.dll_wcscat
mov eax, esi
mov esi, dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
add esp, 0x10
push eax
call esi
test eax, eax
jne 0x4068aa
push dword [ebp + 8]
call esi
pop esi
leave
ret

Function at 0x406964
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret

Function at 0x406aeb
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00406932
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x406b7d
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x406b66
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x406b66
shr esi, 1
and word [edi + esi*2], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x406b6f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x406b86
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x406d56
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x406f66
Capabilities:
Get common file path

Disassembly:
cmp word [0x44f048], 0
push esi
mov esi, 0x44f048
jne 0x406f87
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x44f254], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x44f254]
pop ecx
pop ecx
pop esi
ret

Function at 0x407223
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x440528
push eax
push eax
push dword [esp + 0x14]
push 0x44109c
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret
Function at 0x4076d3
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
test ebp, ebp
je 0x407730
push ebx
push edi
push ebp
call sub.msvcrt.dll_wcslen
pop ecx
lea ebx, [eax + eax + 2]
push ebx
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40772e
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push ebx
push ebp
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
mov esi, eax
neg esi
sbb esi, esi
neg esi
pop edi
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x407dc5
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
jne 0x407df1
lea eax, [esi + 0x28c]
push eax
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov dword [esp + 4], ecx
jmp 0x407e0c
lea ecx, [esi + 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov dword [esp + 4], eax
jne 0x407e13
call fcn.00407e5e
cmp dword [esp + 4], 0
je 0x407e57
push ebx
push ebp
push edi
lea edi, [esi + 0x4dc]
lea ebx, [esi + 0x2b8]
add esi, 0x764
push esi
call sub.msvcrt.dll_wcslen
push ebx
mov ebp, eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + ebp + 1]
cmp eax, 0x143
pop ecx
pop ecx
jae 0x407e50
push ebx
push esi
mov eax, edi
call fcn.00406ed9
pop ecx
pop ecx
jmp 0x407e54
and word [edi], 0
pop edi
pop ebp
pop ebx
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x408097
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
call fcn.00406932
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0xc], eax
je 0x40811d
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea edi, [esi + 5]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x1388
call fcn.00407f6f
mov edi, dword [ebp - 0xc]
push esi
push edi
push dword [ebp + 0xc]
call fcn.004073fd
lea eax, [edi + esi]
mov byte [eax], bl
mov byte [eax + 1], bl
mov byte [eax + 2], bl
mov eax, dword [ebp + 8]
add esp, 0xc
push 0xfde9
mov dword [eax + 0x34], ebx
push edi
lea ebx, [eax + 0x20]
call fcn.00407ab4
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea esi, [ebp - 0xc]
call fcn.00407feb
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
jmp 0x40811f
xor eax, eax
leave
ret 8

Function at 0x408a83
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x44e080
push dword [esp + 0xc]
push esi
push 0x440528
push dword [esp + 0x14]
push 0x44e290
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret
Function at 0x408aa8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0043fb00
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x44e080
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x440528
push dword [ebp + 8]
push 0x44e290
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x408b17
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x408b1b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0043fb00
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x44e080
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x440528
push dword [ebp + 8]
mov esi, 0x44e290
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x408b82
cmp dword [ebp + 0x10], 0
jne 0x408b82
xor eax, eax
jmp 0x408b90
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x408f07
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00406d56
test eax, eax
pop ecx
je 0x408f8e
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x44e080
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x44e290
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x441148
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x44e320
mov dword [0x44e318], eax
call fcn.00408a83
push 0x3f
push str.TranslatorName
mov esi, 0x44e3a0
call fcn.00408a83
push 0xff
push str.TranslatorURL
mov esi, 0x44e420
call fcn.00408a83
add esp, 0x18
pop edi
pop esi
ret

Function at 0x40a0d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0043fb00
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x40af3c
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
push ebp
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x2b0], ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x40b003
cmp dword [esi + 0x2b8], ebx
je 0x40afd3
push 0x2b0
lea eax, [esp + 0x230]
push ebx
push eax
mov dword [esp + 0x234], ebx
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x2a4], eax
push eax
jmp 0x40aff4
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
push 1
push eax
mov dword [esi + 0x2a4], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2a4]
push 1
push 0x1003
push dword [esi + 0x29c]
call edi
cmp dword [esi + 0x2b4], ebx
je 0x40b03a
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebp
push 1
push eax
mov dword [esi + 0x2a8], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2a8]
push ebx
push 0x1003
push dword [esi + 0x29c]
call edi
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push ebx
mov dword [esi + 0x2a0], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
mov dword [esp + 0x14], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
push dword [esi + 0x2a0]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x2a0]
call ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x2a0]
call ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x2a0]
mov esi, dword [esi + 0x29c]
push eax
push ebx
push 0x1208
push esi
call fcn.00405371
pop ecx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret
Function at 0x40c388
Capabilities:
Delete file
Get common file path
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
push edi
mov esi, eax
lea eax, [ebp - 0x410]
push eax
mov edi, 0x104
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x40c3ba
push edi
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
and word [ebp - 0x208], 0
lea eax, [ebp - 0x208]
push eax
push 0
push 0x4415bc
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
mov eax, dword [esi + 0x694]
push 1
push 1
push 2
lea ecx, [ebp - 0x208]
push ecx
push eax
call fcn.0040c07d
test eax, eax
je 0x40c43e
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40c419
lea eax, [ebp - 0x208]
push eax
call fcn.00406aeb
pop ecx
jmp 0x40c41f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x40c431
push dword [esi + 0x208]
mov ecx, eax
call fcn.004069ab
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
pop edi
pop esi
leave
ret
Function at 0x40e468
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20000
call fcn.0043fb00
cmp dword [ebp + 8], 0
je 0x40e4cd
test esi, esi
je 0x40e4bb
push 0x22
push esi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x40e4bb
and word [ebp - 0x20000], 0
push esi
push str.__s_
lea eax, [ebp - 0x20000]
push 0xfffe
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20000]
push eax
jmp 0x40e4bf
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
leave
ret

Function at 0x40e4e5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.0043fb00
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x40e544
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.0040743b
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
mov esi, eax
jmp 0x40e585
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x440528
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.004074c4
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x40e58b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x40e5a9
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.0040e41b
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret

Function at 0x40e5d7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e610
mov ecx, dword [ebp - 4]
cmp ecx, 2
jb 0x40e60c
shr ecx, 1
and word [esi + ecx*2], ax
leave
ret
and word [esi], 0
leave
ret
Function at 0x410a23
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
push edi
xor edi, edi
push edi
push 0x14
mov dword [eax], edi
call fcn.0040f69f
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
jne 0x410a43
push 7
pop eax
jmp 0x410a9b
cmp dword [0x44a00c], edi
je 0x410a70
mov eax, dword [esp + 0x14]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push edi
push esi
push 0x410a06
push edi
push edi
mov dword [esi + 0xc], ebx
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
cmp eax, edi
mov dword [esi], eax
jne 0x410a7c
push 0x14
push edi
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [esi + 8], edi
jne 0x410a93
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
push ebx
mov dword [esi + 4], eax
call dword [esp + 0x18]
pop ecx
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [eax], esi
xor eax, eax
pop edi
pop esi
pop ecx
ret

Function at 0x4117c6
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4117ea
push esi
movzx ecx, cl
movzx ecx, byte [ecx + 0x442c88]
mov esi, eax
shl esi, 3
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4117cf
pop esi
ret
Function at 0x42773a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
test ebx, ebx
push esi
push edi
jne 0x42774f
xor eax, eax
jmp 0x427819
mov esi, dword [ebp + 8]
push 0
push 8
call fcn.0040fa98
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
mov dword [esp + 0xc], ecx
je 0x427748
test byte [ebp + 0xc], 1
mov eax, dword [ebx]
mov dword [ecx], eax
jne 0x427780
mov ecx, dword [ebx]
xor eax, eax
inc eax
cmp ecx, eax
jle 0x427780
add eax, eax
cmp eax, ecx
jl 0x42777a
imul eax, eax, 0x18
push 0
push eax
call fcn.0040fa98
mov edi, eax
test edi, edi
mov eax, dword [esp + 0x14]
pop ecx
pop ecx
mov dword [eax + 4], edi
jne 0x4277a5
push eax
mov eax, esi
call fcn.0040f8d9
pop ecx
jmp 0x427748
and dword [esp + 8], 0
cmp dword [ebx], 0
mov esi, dword [ebx + 4]
jle 0x427815
mov eax, dword [esi]
push 0
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00427509
mov dword [edi], eax
push dword [esi + 4]
push dword [ebp + 8]
call fcn.0040fb2c
mov dword [edi + 4], eax
push dword [esi + 8]
push dword [ebp + 8]
call fcn.0040fb2c
mov dword [edi + 8], eax
mov al, byte [esi + 0xc]
and dword [edi + 0x10], 0xfffffffe
mov byte [edi + 0xc], al
mov eax, dword [edi + 0x10]
mov ecx, dword [esi + 0x10]
xor ecx, eax
and ecx, 2
xor ecx, eax
mov dword [edi + 0x10], ecx
mov eax, dword [esi + 0x14]
add esp, 0x20
inc dword [esp + 8]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 8]
add edi, 0x18
add esi, 0x18
cmp eax, dword [ebx]
jl 0x4277b2
mov eax, dword [esp + 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret