joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x61c0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x634258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x634258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x6330e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61c0d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x403460
Capabilities:
Create thread
Log keystrokes

Disassembly:
sub esp, 4
push esi
push edi
lea edi, [ecx + 0xd4]
mov esi, ecx
push 0x44d5dc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi + 0xd8], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xdc], ecx
mov dword [esi + 0xe0], edx
mov dword [esi + 0xe4], eax
cmp dword [0x456048], 0
mov eax, 0
je 0x4034b7
mov eax, dword [0x456048]
mov eax, dword [eax + 0x1c]
lea ecx, [esp + 8]
mov dword [esi + 0xe8], eax
mov eax, dword [esp + 0x20]
push ecx
push 0
mov dword [esi + 0xec], eax
push edi
push 0x403410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xd0], eax
test eax, eax
je 0x40350b
cmp eax, 0xffffffff
je 0x40350b
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 8]
push 1
push ecx
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
xor eax, eax
pop edi
pop esi
add esp, 4
ret 0x14
xor eax, eax
pop edi
pop esi
add esp, 4
ret 0x14

Function at 0x403ac0
Capabilities:
Terminate thread

Disassembly:
push esi
mov eax, dword [ecx + 0xd0]
mov esi, ecx
test eax, eax
je 0x403ade
cmp eax, 0xffffffff
je 0x403ade
push 0x29a
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
call fcn.004036d0
pop esi
ret

Function at 0x404880
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov eax, dword [ecx + 0x1c]
push edi
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4048a3
push 0xffffffffffffffff
push 0
push 0xf00b
call fcn.00439463
pop edi
pop esi
ret 4
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 4]
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4048db
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esi]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x404901
push 0xffffffffffffffff
push 0
push 0xf00c
call fcn.00439463
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
ret 4
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
ret 4
Function at 0x404cb0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404dae
push eax
mov dword fs:[0], esp
sub esp, 4
mov dword [ebp - 0x10], ecx
push ebx
push esi
xor ebx, ebx
push edi
call fcn.0043151a
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0043151a
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], bl
mov byte [ebp - 4], 2
mov dword [eax + 0x30], 0x44df90
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add esi, 0x30
mov edx, dword [ebp - 0x10]
push ebx
mov dword [eax], 0x44e000
push 0xde
mov dword [eax + 0x64], ebx
mov edi, dword [ebp + 8]
mov dword [eax + 0x78], ebx
mov eax, dword [ebp + 0xc]
push eax
push edi
mov ecx, dword [eax + 0x30]
push 0x50000000
push 0x456ba0
mov dword [edx + 0x60], ecx
push ebx
mov ecx, edx
call fcn.004320b6
push 5
mov ecx, dword [ebp - 0x10]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ecx + 0x1c]
push eax
call ebx
push 0x4b0
mov ecx, dword [ebp - 0x10]
push ecx
push edi
push 0x23
add ecx, 0x30
call fcn.0041f291
mov edi, dword [ebp - 0x10]
push 5
mov eax, dword [edi + 0x4c]
add edi, 0x4c
push eax
call ebx
mov eax, dword [edi]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push eax
call fcn.00431a1d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405a40
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405b7d
push eax
mov dword fs:[0], esp
sub esp, 4
mov dword [ebp - 0x10], ecx
push ebx
push esi
xor ebx, ebx
push edi
call fcn.0043151a
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.0043151a
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], bl
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
add esi, 0x30
add ecx, 0x60
mov dword [eax + 0x30], 0x44e220
call fcn.0042f04e
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
push ebx
push 0x29a
lea esi, [eax + 0xd8]
mov dword [eax], 0x44e298
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push eax
mov dword [esi], ebx
mov ecx, dword [eax + 0x30]
push edi
push 0x50000000
mov dword [edx + 0xd4], ecx
push 0x456ba0
mov ecx, edx
push ebx
call fcn.004320b6
push 5
mov ecx, dword [ebp - 0x10]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ecx + 0x1c]
push eax
call ebx
push 0x4b1
mov ecx, dword [ebp - 0x10]
push ecx
push edi
push 0x809
add ecx, 0x30
call fcn.0041f13d
push 0xffffffffffffffff
push 0xc8
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
call fcn.0042f11a
mov dword [esi], 1
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x74
push esi
call fcn.00405e30
push 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x4c]
push ecx
call ebx
push edi
push esi
call dword [sym.imp.USER32.dll_CopyRect]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405f80
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4060b3
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x24]
call fcn.0043100b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], 0
mov ecx, dword [eax + 0xd4]
mov dword [ebp - 4], 1
cmp dword [ecx + 0xb0], 0
jle 0x406070
push 2
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push 0x102c
mov edx, dword [ecx + 0x4c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x406055
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x54]
push ecx
mov edx, dword [ebp - 0x10]
push 0
mov dword [ebp - 0x50], eax
push 0x1005
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x54], 0xc
mov dword [ebp - 0x4c], 0
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 9
mov ecx, dword [ebp - 0x34]
push ecx
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00406290
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004312d9
mov byte [ebp - 4], 1
call fcn.0040609c
push 0xd
lea ecx, [ebp - 0x24]
call fcn.004312c4
push 0xa
lea ecx, [ebp - 0x24]
call fcn.004312c4
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [eax + 0xd4]
cmp dword [ecx + 0xb0], edx
jg 0x405fd1
lea eax, [ebp - 0x24]
mov ecx, dword [ebp + 8]
push eax
call fcn.00431017
or dword [ebp - 0x18], 1
mov byte [ebp - 4], 0
call fcn.004060bd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x407660
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.00407e20
push 0
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x1c]
lea edi, [esi + 0x178]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00431a1d
mov ecx, eax
mov eax, dword [edi]
test ecx, ecx
jne 0x4076a4
or eax, 0x10
mov ecx, dword [esi + 0x134]
push eax
push 0
push ecx
mov ecx, esi
jmp 0x4076b1
or eax, 0x10
mov edx, dword [esi + 0x134]
push eax
push 0
push edx
call fcn.004394eb
cmp eax, 1
jne 0x4076ca
cmp dword [edi], 1
jne 0x4076ca
mov ecx, esi
call fcn.00407e60
pop edi
pop esi
ret
push 0
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x180], 1
push 0x3f2
push 0x111
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
ret
Function at 0x407cb6
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407e0e
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push esi
cmp dword [ecx + 0x17c], 0
jne 0x407e00
mov dword [ecx + 0x17c], 1
cmp dword [ecx + 0x180], 0
jne 0x407df6
cmp dword [ecx + 0x154], 0
je 0x407df6
mov eax, dword [ecx + 0x140]
test eax, eax
je 0x407d3e
push 0
mov ecx, dword [eax + 0x1c]
push 0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x46a
push ecx
call esi
cmp eax, 0x20d
je 0x407d3e
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x140]
push 0
push 0x808
mov edx, dword [ecx + 0x1c]
push edx
call esi
push 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x168]
mov ecx, 0xd1
test eax, eax
je 0x407d66
cmp eax, 1
je 0x407d6d
jmp 0x407d72
mov ecx, 0xcf
jmp 0x407d72
mov ecx, 0xd0
push ecx
call fcn.0040e100
add esp, 4
lea ecx, [ebp - 0x1c]
push eax
call fcn.004310c4
mov dword [ebp - 4], 0
push 0
mov eax, dword [ebp - 0x1c]
push 4
push eax
call fcn.00439449
cmp eax, 6
je 0x407da2
cmp eax, 7
jne 0x407dea
sub eax, 6
cmp eax, 1
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
mov edx, dword [eax + 0x168]
neg ecx
push edx
push ecx
mov ecx, dword [eax + 0x150]
push ecx
call fcn.00412370
add esp, 0xc
cmp dword [0x456048], 0
je 0x407dea
push 0
mov eax, dword [0x456048]
push 0x8004
push 0x111
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
mov dword [ebp - 4], 0xffffffff
call fcn.00407e18
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov esi, dword [eax]
call dword [esi + 0x7c]
mov eax, dword [ebp - 0xc]
pop esi
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret

Function at 0x409630
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetCursor]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x10], eax
call edi
mov ebp, eax
call edi
sub eax, ebp
mov ebx, dword [esp + 0x34]
cmp eax, ebx
jae 0x40968e
mov esi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [esp + 0x14]
push 1
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x409686
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call esi
call edi
sub eax, ebp
cmp eax, ebx
jb 0x40965d
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x40a3f0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push ebp
push 0x323
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_GetWindowTextA]
push eax
push ebx
push esi
call ebp
mov edi, eax
test edi, edi
jne 0x40a442
push 0
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x147
push esi
call ebp
cmp eax, 0xffffffff
je 0x40a442
push ebx
push eax
push 0x148
push esi
call ebp
mov edi, eax
mov esi, dword [sym.imp.USER32.dll_CharNextA]
mov ebp, 1
mov al, byte [ebx]
cmp dword [0x45b52c], ebp
jle 0x40a467
movsx eax, al
push 8
push eax
call fcn.0041feb2
add esp, 8
jmp 0x40a479
movsx ecx, al
mov edx, dword [str.________________________________H]
xor eax, eax
mov ax, word [edx + ecx*2]
and eax, 8
test eax, eax
je 0x40a484
push ebx
call esi
mov ebx, eax
jmp 0x40a44d
test edi, edi
jle 0x40a497
cmp byte [ebx], 0
je 0x40a497
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40a660
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
xor eax, eax
mov ecx, 0x11
push edi
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0x44
push eax
push ecx
mov edx, dword [esp + 0x68]
push 0
mov eax, dword [esp + 0x68]
push 0
push 0
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x40aa20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push ebp
cmp dword [0x456ecc], esi
jle 0x40aada
mov edi, 0x4570e8
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp al, 0x11
je 0x40aa57
cmp al, 4
je 0x40aa57
cmp al, 0x12
je 0x40aa57
cmp edi, 0x4573c0
je 0x40aaca
push 0x200
xor eax, eax
mov ax, word [edi - 4]
mov ecx, dword [0x44a140]
push eax
push ecx
call fcn.00437a26
test eax, eax
je 0x40aaca
push eax
mov eax, dword [0x44a140]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40aaca
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x40aac3
xor ecx, ecx
add eax, 2
mov cx, word [eax - 2]
test ecx, ecx
jle 0x40aac3
cmp ecx, 8
jl 0x40aaa8
mov ecx, 8
mov dword [edi], ecx
test ecx, ecx
jle 0x40aac3
lea edx, [edi + 4]
xor ebp, ebp
add eax, 2
mov bp, word [eax - 2]
add edx, 4
dec ecx
mov dword [edx - 4], ebp
jne 0x40aab1
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
add edi, 0x34
inc esi
cmp esi, dword [0x456ecc]
jl 0x40aa37
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40afc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetCursor]
mov dword [esp + 0x10], eax
push 1
lea eax, [esp + 0x18]
push 0
push 0
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push eax
call edi
test eax, eax
je 0x40b05b
mov esi, dword [sym.imp.USER32.dll_DispatchMessageA]
mov ebx, dword [sym.imp.USER32.dll_IsDialogMessageA]
mov ebp, dword [esp + 0x34]
cmp dword [esp + 0x18], 0x100
jne 0x40b015
cmp dword [esp + 0x1c], 0x1b
jne 0x40b015
mov dword [0x457434], 1
test ebp, ebp
je 0x40b036
cmp dword [0x457428], ebp
jne 0x40b036
lea eax, [esp + 0x14]
push eax
push ebp
call ebx
test eax, eax
je 0x40b036
cmp dword [esp + 0x18], 2
jne 0x40b048
jmp 0x40b05b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x14]
push 1
push 0
push 0
push 0
push eax
call edi
test eax, eax
jne 0x40affa
mov eax, dword [0x457440]
test eax, eax
je 0x40b066
call eax
push 0x1b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x40b07d
mov dword [0x457434], 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x40b6d0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push str.MSINFO32.INI
push ebx
push edi
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, ebx
mov esi, eax
jne 0x40b707
push str.MSINFO32.INI
push ebx
push edi
push str.Options
call fcn.0040b690
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x40b7d0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push str.MSINFO32.INI
mov edi, dword [esp + 0x14]
push eax
push esi
push 0x456cb4
push edi
push str.Options
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x40b81d
mov ebx, dword [esp + 0x1c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.MSINFO32.INI
push ebx
push edi
push str.Options
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebx
ret
mov eax, 1
pop edi
pop esi
pop ebx
ret

Function at 0x40bfd0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x10
lea eax, [esp + 8]
push esi
xor esi, esi
push eax
lea ecx, [esp + 0x14]
lea edx, [esp + 0xc]
lea eax, [esp + 8]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x40c007
mov esi, dword [esp + 0xc]
imul esi, dword [esp + 8]
imul esi, dword [esp + 4]
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x40c8e0
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x4575e4], 0
je 0x40c8ec
xor eax, eax
ret
push 0xa
call fcn.0040c810
add esp, 4
test eax, eax
jne 0x40c914
mov eax, dword [0x4575dc]
test eax, eax
je 0x40c914
cmp eax, 0xffffffff
je 0x40c914
push 0x29a
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0x44a2e8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4575d8
call fcn.0041a580
add esp, 4
push 0x44a2e8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x44a2e8
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, 1
ret
Function at 0x40cce0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x180
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 3
ja 0x40cd57
push 0x44ef88
call fcn.0040cca0
add esp, 4
mov dword [0x457664], eax
cmp eax, 0x20
jb 0x40cd57
push str.Ctl3dRegister
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
mov edi, eax
push str.Ctl3dAutoSubclass
mov eax, dword [0x457664]
push eax
call esi
mov esi, eax
test edi, edi
je 0x40cd4b
test esi, esi
je 0x40cd4b
mov eax, dword [0x44a140]
push eax
call edi
mov dword [0x457660], eax
test eax, eax
je 0x40cd4b
mov eax, dword [0x44a140]
push eax
call esi
jmp 0x40cd57
mov eax, dword [0x457664]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x44a140]
push eax
call fcn.0040e130
add esp, 4
test eax, eax
jne 0x40cd74
xor eax, eax
pop edi
pop esi
add esp, 0x180
ret
mov eax, dword [esp + 0x18c]
cmp byte [eax], 0
je 0x40cdb5
push eax
call fcn.0040cf70
add esp, 4
test eax, eax
jne 0x40cdb5
push 0x30
call fcn.0040e100
add esp, 4
push eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x10]
add esp, 8
push 0x30
push ecx
call fcn.00419a20
add esp, 8
push 0x100
push 0x456cc8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40cdd4
xor eax, eax
pop edi
pop esi
add esp, 0x180
ret
push 0x456cc8
call fcn.0040ac00
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x456cc8
call esi
mov edi, eax
test edi, edi
je 0x40ce02
cmp byte [edi + 0x456cc7], 0x5c
mov eax, 0
je 0x40ce07
mov eax, 1
test eax, eax
jne 0x40ce29
lea eax, [edi + 0x456cc7]
push eax
push 0x456cc8
call fcn.0040e250
add esp, 8
test ax, ax
mov eax, 0
je 0x40ce2e
mov eax, 1
test eax, eax
je 0x40ce40
mov byte [edi + 0x456cc8], 0x5c
mov byte [edi + 0x456cc9], 0
push 0x100
push 0x456dc8
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40ce5f
xor eax, eax
pop edi
pop esi
add esp, 0x180
ret
push 0x456dc8
call fcn.0040ac00
add esp, 4
push 0x456dc8
call esi
mov esi, eax
test esi, esi
je 0x40ce87
cmp byte [esi + 0x456dc7], 0x5c
mov eax, 0
je 0x40ce8c
mov eax, 1
test eax, eax
jne 0x40ceae
lea eax, [esi + 0x456dc7]
push eax
push 0x456dc8
call fcn.0040e250
add esp, 8
test ax, ax
mov eax, 0
je 0x40ceb3
mov eax, 1
test eax, eax
je 0x40cec5
mov byte [esi + 0x456dc8], 0x5c
mov byte [esi + 0x456dc9], 0
mov eax, dword [0x44a140]
push eax
call fcn.0041b780
add esp, 4
mov dword [0x44a144], eax
test eax, eax
jne 0x40cee6
mov dword [0x44a144], 0x4e40409
call fcn.0040aa20
call fcn.00419e30
call fcn.0041ad90
call fcn.00412460
mov eax, 1
pop edi
pop esi
add esp, 0x180
ret
Function at 0x40dfa0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x120
push esi
push edi
mov esi, dword [esp + 0x12c]
push 5
mov edi, dword [esp + 0x134]
push 0
push 0
mov ecx, dword [0x456ec8]
push esi
cmp edi, 1
sbb eax, eax
and eax, str.print
push eax
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x21
jae 0x40e00c
push esi
mov eax, 0x457818
mov ecx, dword [sym.imp.USER32.dll_wsprintfA]
test edi, edi
jne 0x40dfef
mov eax, 0x457814
push eax
push str.notepad.exe__s_s
lea eax, [esp + 0x14]
push eax
call ecx
lea eax, [esp + 0x18]
add esp, 0x10
push eax
call fcn.0040a830
add esp, 4
pop edi
pop esi
add esp, 0x120
ret

Function at 0x40e850
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x254
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [esp + 0x264]
push ebp
mov dword [esp + 0x10], ebx
push 0x41
push str.MSINFO95SYSINFO.CXX
mov dword [edi], ebx
mov dword [esp + 0x24], 0x4000
push 0x4000
call fcn.0040c0a0
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, ebx
jne 0x40e89a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x254
ret
mov esi, dword [esp + 0x26c]
mov ebp, dword [esp + 0x270]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], 0
lea eax, [esp + 0x124]
push eax
je 0x40e8e3
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov ebx, eax
je 0x40e962
mov dword [esp + 0x14], 0
jmp 0x40e8ee
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40e954
test byte [esp + 0x124], 0x10
jne 0x40e8b8
lea eax, [esp + 0x150]
push 0x104
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.0041fd64
lea ecx, [esp + 0x2c]
add esp, 0xc
push ecx
call fcn.0040ac00
lea ecx, [esp + 0x20]
lea edx, [esp + 0x1c]
mov eax, dword [esp + 0x14]
add esp, 4
push ebp
push ecx
lea ecx, [esp + 0x28]
push edx
push edi
push eax
push ecx
call fcn.0040e9d0
mov dword [esp + 0x28], eax
add esp, 0x18
test eax, eax
je 0x40e95c
call fcn.0040d290
test eax, eax
je 0x40e8b8
jmp 0x40e962
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40e962
mov dword [edi], 0
test ebx, ebx
je 0x40e972
cmp ebx, 0xffffffff
je 0x40e972
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [edi], 0
jne 0x40e98d
cmp dword [esp + 0x10], 0
je 0x40e98d
lea eax, [esp + 0x10]
push eax
call fcn.0040c170
add esp, 4
jmp 0x40e9b3
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x1c], eax
je 0x40e9b3
mov ecx, dword [esp + 0x10]
push 0xb7
push str.MSINFO95SYSINFO.CXX
push eax
push ecx
call fcn.0040c110
mov dword [esp + 0x20], eax
add esp, 0x10
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x254
ret