joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4100e7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.0041a230
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fd31
mov dword [ebp - 0x1010], eax
cmp dword [ebp - 0x1010], 0
jne 0x410115
xor eax, eax
jmp 0x41024a
mov eax, dword [ebp + 0x18]
mov dword [eax], 0x3ff
push dword [ebp + 0x18]
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x41015e
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x41024a
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x1014], 0
jle 0x4101df
cmp dword [ebp - 0x1014], 2
jle 0x41018f
cmp dword [ebp - 0x1014], 3
jle 0x4101df
cmp dword [ebp - 0x1014], 5
jle 0x4101a4
jmp 0x4101df
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x410228
lea eax, [ebp - 0x800]
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp - 0x1008]
push dword [eax]
push 0x421a40
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x410228
and dword [ebp - 0x1004], 0
jmp 0x4101f5
mov eax, dword [ebp - 0x1004]
inc eax
mov dword [ebp - 0x1004], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x1004]
cmp ecx, dword [eax]
jge 0x41021c
mov eax, dword [ebp + 0x1c]
add eax, dword [ebp - 0x1004]
mov ecx, dword [ebp - 0x1004]
mov cl, byte [ebp + ecx - 0x800]
mov byte [eax], cl
jmp 0x4101e8
mov eax, dword [ebp + 0x1c]
add eax, dword [ebp - 0x1004]
and byte [eax], 0
push dword [ebp - 0x1010]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x100c], eax
cmp dword [ebp - 0x100c], 0
je 0x410247
xor eax, eax
jmp 0x41024a
push 1
pop eax
leave
ret 0x18
Function at 0x410480
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 0x14], 0
and byte [ebp - 0x10], 0
and byte [ebp - 0xf], 0
and byte [ebp - 0xe], 0
and byte [ebp - 0xd], 0
and byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 5
cmp dword [0x425854], 0
je 0x4104b3
push 1
pop eax
jmp 0x4105e4
lea eax, [ebp - 8]
push eax
push 0
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x410500
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x4104f9
lea eax, [ebp - 8]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4104f7
xor eax, eax
jmp 0x4105e4
jmp 0x410500
xor eax, eax
jmp 0x4105e4
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x41051e
xor eax, eax
jmp 0x4105e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x410530
xor eax, eax
jmp 0x4105e4
mov eax, dword [ebp - 0x1c]
add eax, 3
and al, 0xfc
call fcn.0041a230
mov dword [ebp - 0x24], esp
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x410553
xor eax, eax
jmp 0x4105e4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x410570
xor eax, eax
jmp 0x4105e4
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x41059b
xor eax, eax
jmp 0x4105e4
and dword [ebp - 4], 0
and dword [ebp - 0x20], 0
jmp 0x4105ac
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax]
jae 0x4105d8
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
push dword [ecx + eax*8 + 4]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4105d6
mov dword [ebp - 4], 1
jmp 0x4105d8
jmp 0x4105a5
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x24]
leave
ret
Function at 0x41115d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetRectEmpty]
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x411192
xor eax, eax
jmp 0x41120e
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
xor eax, eax
leave
ret
Function at 0x416b0b
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push dword [ebp + 8]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x214]
push eax
call fcn.0040831c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x31c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x416bed
push 1
pop eax
test eax, eax
je 0x416bed
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x416bd7
jmp 0x416bed
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x416b87
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
leave
ret
Function at 0x416c98
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push edi
and dword [ebp - 0xc], 0
and byte [ebp - 0x90], 0
push 0x20
pop ecx
xor eax, eax
lea edi, [ebp - 0x8f]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x198], 0
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x197]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], 0x17
cmp dword [0x424f74], 0
jne 0x416ce5
cmp dword [ebp + 0x18], 0
jne 0x416cec
mov dword [ebp - 4], 2
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x416d18
push 0x424850
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jl 0x416d18
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
jne 0x416d3d
push 0x105
push 0x424850
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Start_MenuPrograms
push 0x424850
call fcn.00409bba
push dword [ebp + 8]
call fcn.00409268
test eax, eax
jne 0x416d70
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x5c
je 0x416d70
push dword [ebp + 8]
push 0x424850
push dword [ebp + 0x10]
call fcn.00409bda
push 1
push dword [ebp + 0x10]
call fcn.0040831c
jmp 0x416d86
push dword [ebp + 8]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push dword [ebp + 0x10]
call fcn.0040831c
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call fcn.00409bda
lea eax, [ebp - 0x90]
push eax
push dword [ebp + 0xc]
call fcn.00409458
push 0x421c90
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x416dc7
push str..lnk
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
pop eax
pop edi
leave
ret

Function at 0x417e57
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x428
cmp dword [0x424f6c], 0
je 0x417e71
push 1
pop eax
jmp 0x417f4b
lea eax, [ebp - 0x428]
push eax
push dword [ebp + 8]
call fcn.00408374
lea eax, [ebp - 0x110]
push eax
push dword [ebp + 8]
call fcn.00408266
push 0x105
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 1
lea eax, [ebp - 0x218]
push eax
call fcn.0040831c
push 1
lea eax, [ebp - 0x110]
push eax
call fcn.0040831c
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x417eda
push 1
pop eax
jmp 0x417f4b
mov dword [ebp - 8], 0x579
push 0x105
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 8]
push dword [0x424f70]
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417f48
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x417f21
xor eax, eax
jmp 0x417f4b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
push 0x105
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 8]
push dword [0x424f70]
call dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 4], eax
jmp 0x417eff
push 1
pop eax
leave
ret
Function at 0x4181e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x418207
xor eax, eax
jmp 0x41821c
mov eax, dword [ebp - 8]
shl eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x4183c3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 8], 0
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4183ea
or eax, 0xffffffff
jmp 0x4184b4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41843a
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 2
push dword [ebp + 8]
call fcn.0040abe0
mov dword [ebp - 4], eax
push 0x8000
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp - 4], 0xffffffff
je 0x418435
push dword [ebp - 4]
call fcn.0040b14a
push 0xfffffffffffffff8
pop eax
jmp 0x4184b4
push 0xfffffffffffffffe
pop eax
jmp 0x4184b4
mov eax, dword [ebp - 0x18]
inc eax
push eax
push 0x7ffe
call fcn.00403130
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x418457
or eax, 0xffffffff
jmp 0x4184b4
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x418471
or eax, 0xffffffff
jmp 0x4184b4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x421fd8
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41848f
or eax, 0xffffffff
jmp 0x4184b4
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0xc]
mov dword [eax], ecx
push dword [ebp - 0x10]
push 0x7ffe
call fcn.00402d50
xor eax, eax
leave
ret 0xc

Function at 0x4184b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
call fcn.004092f1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4184fb
xor eax, eax
jmp 0x4184fe
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x418502
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
call fcn.004092f1
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
leave
ret 8
Function at 0x41871c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
mov eax, dword [ebp + 8]
push dword [eax + 0x21c]
lea eax, [ebp - 0x36c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x36c]
push eax
call fcn.00408266
push dword [ebp + 8]
call fcn.00418cd8
pop ecx
mov dword [ebp - 8], 1
mov dword [ebp - 0x120], 1
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x41885e
cmp dword [ebp - 0x120], 0
je 0x4187aa
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x36c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4187a8
and dword [ebp - 0xc], 0
jmp 0x41885e
jmp 0x4187d5
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4187d5
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
and dword [ebp - 0xc], 0
jmp 0x41885e
and dword [ebp - 0x120], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 2
test eax, eax
je 0x4187f6
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 4
test eax, eax
je 0x418816
mov eax, dword [ebp - 0x264]
and eax, 0x10
test eax, eax
je 0x418814
and dword [ebp - 8], 0
jmp 0x418859
mov eax, dword [ebp - 0x264]
and eax, 0x10
test eax, eax
jne 0x418859
mov eax, dword [ebp - 0x264]
and eax, 0x80
test eax, eax
jne 0x418855
mov eax, dword [ebp - 0x264]
and eax, 0x20
test eax, eax
jne 0x418855
cmp dword [ebp - 0x264], 0
je 0x418855
mov eax, dword [ebp - 0x264]
and eax, 1
test eax, eax
je 0x418859
and dword [ebp - 8], 0
jmp 0x41876f
cmp dword [ebp - 0xc], 0
je 0x4188f4
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push dword [ebp + 0xc]
call fcn.0040831c
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp + 0xc]
add eax, 0x105
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
movzx eax, word [ebp - 0x10]
movzx ecx, word [ebp - 0x124]
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x20c], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x244]
mov dword [eax + 0x210], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x21c]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x10c], ecx
mov eax, dword [ebp + 0xc]
add eax, 0x105
jmp 0x418950
mov eax, dword [ebp + 8]
cmp dword [eax + 0x224], 0
je 0x41894e
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x224]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x36c]
push eax
call fcn.00408f54
test eax, eax
je 0x418936
lea eax, [ebp - 0x36c]
push eax
push 1
mov eax, dword [ebp + 8]
push dword [eax + 0x220]
push dword [ebp + 8]
call dword [ebp - 0x14]
jmp 0x41894e
lea eax, [ebp - 0x36c]
push eax
push 2
mov eax, dword [ebp + 8]
push dword [eax + 0x220]
push dword [ebp + 8]
call dword [ebp - 0x14]
xor eax, eax
leave
ret
Function at 0x418cd8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 1
test eax, eax
jne 0x418cf5
xor eax, eax
jmp 0x418e5d
lea eax, [ebp - 0x354]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x21c]
call fcn.00408266
push 1
lea eax, [ebp - 0x354]
push eax
call fcn.0040831c
push 0x421fdc
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x418d4e
xor eax, eax
jmp 0x418e5d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 2
test eax, eax
je 0x418d68
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
cmp dword [ebp - 4], 0
je 0x418e5a
mov eax, dword [ebp - 0x24c]
and eax, 0x10
test eax, eax
je 0x418e19
movsx eax, byte [ebp - 0x220]
cmp eax, 0x2e
je 0x418e19
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.00408266
push 1
lea eax, [ebp - 0x10c]
push eax
call fcn.0040831c
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea eax, [ebp - 0x10c]
push eax
call fcn.0040831c
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x21c]
push dword [eax + 0x114]
call fcn.0041dd10
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x21c]
push dword [eax + 0x114]
call fcn.0041ddb0
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418e3b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
jmp 0x418e5d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 2
test eax, eax
je 0x418e55
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
jmp 0x418d68
push 1
pop eax
leave
ret
Function at 0x418ee7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
call fcn.0041904b
mov dword [ebp - 0x20], 1
cmp dword [ebp + 0x10], 0
je 0x418f0c
mov dword [ebp - 0x20], 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x418f20
xor eax, eax
jmp 0x419047
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x418f34
xor eax, eax
jmp 0x419047
push 0xfffffffffffffff4
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov word [ebp - 0x1c], ax
movsx eax, word [ebp - 0x1c]
cmp eax, 0x514
je 0x418f55
xor eax, eax
jmp 0x419047
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0x23
jle 0x418f74
xor eax, eax
jmp 0x419047
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x50
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
push str.static
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x418fb6
xor eax, eax
jmp 0x419047
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
and eax, 0xf
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 7
je 0x418fd7
xor eax, eax
jmp 0x419047
mov eax, dword [ebp + 0x10]
mov dword [0x421fe0], eax
push 0
push dword [0x424f70]
push 0xffffffffffffffff
push dword [ebp + 0xc]
push dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x50000000
push str.CutWinName
push 0x422004
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x419039
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EnableWindow]
push 5
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
leave
ret 0xc

Function at 0x419b27
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
jne 0x419b3a
xor eax, eax
jmp 0x419b81
push 0x105
lea eax, [ebp - 0x108]
push eax
push 0x489
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp + 8]
add eax, 0x30f
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 8]
mov dword [eax + 0x62c], 1
push 1
pop eax
leave
ret
Function at 0x419c60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x41b298
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x424ae0], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x424adc], ecx
shl ecx, 8
add ecx, edx
mov dword [0x424ad8], ecx
shr eax, 0x10
mov dword [0x424ad4], eax
call fcn.0041b160
test eax, eax
jne 0x419cca
push 0x1c
call fcn.00419e30
add esp, 4
mov dword [ebp - 4], 0
call fcn.0041af60
call fcn.0041af50
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x425990], eax
call fcn.0041a930
mov dword [0x424aa4], eax
test eax, eax
je 0x419cfd
mov eax, dword [0x425990]
test eax, eax
jne 0x419d07
push 0xffffffffffffffff
call fcn.0041a290
add esp, 4
call fcn.0041a680
call fcn.0041a590
call fcn.0041a260
mov esi, dword [0x425990]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x419de6
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x419d4e
test al, al
je 0x419d4e
and eax, 0xff
push eax
call fcn.0041a530
add esp, 4
test eax, eax
je 0x419d28
inc esi
mov dword [ebp - 0x64], esi
jmp 0x419d28
cmp byte [esi], 0x22
jne 0x419d57
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x419d67
cmp al, 0x20
ja 0x419d67
inc esi
mov dword [ebp - 0x64], esi
jmp 0x419d57
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x419d88
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x419d8d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0041a290
jmp 0x419dcb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x419d57
inc esi
mov dword [ebp - 0x64], esi
jmp 0x419de6

Function at 0x419e30
Capabilities:
Terminate process

Disassembly:
cmp dword [0x424aac], 1
jne 0x419e3e
call fcn.0041b370
mov eax, dword [esp + 4]
push eax
call fcn.0041b3b0
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]