joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4061c0
Capabilities:
Create directory
Get common file path
Read .ini file

Disassembly:
push ecx
push 0x43fb50
push 0
push str.PictureAtDesktop
push str.annie
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x406267
push ebx
push esi
lea eax, [esp + 8]
push edi
push eax
xor esi, esi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test eax, eax
jl 0x406239
lea ecx, [esp + 0x18]
push ecx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40622b
mov edx, dword [esp + 0x18]
push edi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
jne 0x40624b
push 1
push 0
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov esi, eax
test esi, esi
je 0x406260
push str.Picture
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 1
push 0x27
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
pop ecx
ret

Function at 0x406280
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [0x440530]
sub esp, 0x310
lea eax, [esp + 0x108]
push esi
push edi
push eax
push ecx
call fcn.004061c0
lea edx, [esp + 0x10]
push edx
call fcn.0041d599
lea eax, [esp + 0x14]
push eax
call fcn.0041d439
push eax
call fcn.0041d347
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x3a
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x24]
push ecx
call fcn.0041d120
add esp, 0x1c
test eax, eax
pop edi
pop esi
je 0x406310
lea edx, [esp + 4]
push 0x3a
push edx
call fcn.0041d120
mov byte [eax], 0x2d
lea eax, [esp + 0xc]
push 0x3a
push eax
call fcn.0041d120
add esp, 0x10
test eax, eax
jne 0x4062ee
lea ecx, [esp + 4]
lea edx, [esp + 0x108]
push ecx
push edx
lea eax, [esp + 0x214]
push str._s_.19s.bmp
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x20c]
push ecx
mov ecx, 0x43f830
call fcn.0040ff40
push 1
push 0
lea edx, [esp + 0x110]
push 0
push edx
push 0x43988c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x310
ret
Function at 0x406370
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [0x440530]
sub esp, 0x114
lea eax, [esp + 0x10]
push 1
push 0xe
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xa]
mov edx, dword [esp + 8]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0xa]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0xa]
push edx
mov edx, dword [esp + 0xc]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
lea eax, [esp + 0x24]
push edx
push eax
push str._sVideo__d__02d_02d__02d_02d_02d.wmv
push 0x43f4d0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x138
ret

Function at 0x408240
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc4
push ebx
xor ebx, ebx
push esi
push ebx
push 0x80
push 3
push ebx
push 1
push 0xc0000000
push 0x43f4d0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4082f3
lea eax, [esp + 8]
push ebx
push eax
lea ecx, [esp + 0x14]
push 0xc0
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0xc8], 0x7d
jne 0x4082ec
cmp byte [esp + 0xc9], 0xeb
jne 0x4082ec
cmp byte [esp + 0xca], 0x36
jne 0x4082ec
cmp byte [esp + 0xcb], 0xe4
jne 0x4082ec
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea edx, [esp + 8]
push ebx
push edx
lea eax, [esp + 0x14]
push 0xc0
push eax
push esi
mov byte [esp + 0xdf], bl
mov byte [esp + 0xde], bl
mov byte [esp + 0xdd], bl
mov byte [esp + 0xdc], bl
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
add esp, 0xc4
ret

Function at 0x408300
Capabilities:
Read .ini file

Disassembly:
mov dword [0x440394], 0
call fcn.00407ff0
test eax, eax
je 0x40836c
mov eax, dword [0x440534]
push str.Ready_to_Capture_...
push eax
call fcn.004157f0
add esp, 8
mov dword [0x43f624], 1
push 0
push 0x43fb50
push 0x1f4
push str.WaitCaptureTime
push str.annie
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [0x440530]
push eax
push 2
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x440394], 1
mov eax, 1
ret
xor eax, eax
ret
Function at 0x40b9c0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x130
mov edx, dword [esp + 0x134]
lea eax, [esp]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0x104
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov al, byte [esp + 0x2c]
mov dl, 0x5c
cmp al, dl
jne 0x40ba22
cmp byte [esp + 0x2d], dl
jne 0x40ba22
mov cl, byte [esp + 0x2e]
lea eax, [esp + 0x2e]
test cl, cl
mov dword [esp], eax
je 0x40ba1a
cmp cl, dl
je 0x40ba1a
inc eax
mov dword [esp], eax
mov cl, byte [eax]
test cl, cl
jne 0x40ba0b
cmp byte [eax], 0
je 0x40ba2a
inc eax
jmp 0x40ba26
lea eax, [esp + 0x2c]
mov dword [esp], eax
mov cl, byte [eax]
test cl, cl
je 0x40ba3f
cmp cl, dl
je 0x40ba3f
inc eax
mov dword [esp], eax
mov cl, byte [eax]
test cl, cl
jne 0x40ba30
cmp byte [eax], 0
je 0x40ba4c
inc eax
mov dword [esp], eax
mov byte [eax], 0
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40bab9
push str.GetDiskFreeSpaceExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x40bab9
lea eax, [esp + 0x18]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x28]
push ecx
lea eax, [esp + 0x3c]
push edx
push eax
call edi
test eax, eax
jne 0x40ba9e
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x130
ret
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, 0xa
call fcn.0041da00
pop edi
pop esi
add esp, 0x130
ret
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x40]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x40bae8
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x130
ret
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
imul ecx, dword [esp + 0x10]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
pop edi
pop esi
add esp, 0x130
ret

Function at 0x40be60
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push ebx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40be8b
xor eax, eax
xor edx, edx
pop ebx
ret
push ebp
push esi
lea ecx, [esp + 0x10]
push edi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x14]
push 1
push 0
push 0
push edx
mov ebp, eax
call fcn.0041d7f0
mov esi, eax
xor eax, eax
mov edi, edx
add esi, ebp
push ebx
adc edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40bec5
xor esi, esi
xor edi, edi
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40c3f0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [0x43f7b4]
sub esp, 0x400
lea ecx, [esp + 0x200]
push 0
push eax
push ecx
mov ecx, 0x43f100
call fcn.004172f0
lea edx, [esp]
mov ecx, 0x43f100
push edx
call fcn.00417430
push 1
push 0
lea eax, [esp + 8]
push 0
push eax
push 0x43988c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [0x440530]
push 0
push 0x19
push 3
push ecx
mov dword [0x43fb44], 0x14
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, 1
add esp, 0x400
ret

Function at 0x40c460
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push esi
push edi
mov edi, dword [esp + 0x110]
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
call fcn.0041d120
add esp, 8
lea edx, [esp + 8]
mov byte [eax], 0
push 1
push 0
push 0
push edx
push 0x43988c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
pop edi
mov eax, ecx
pop esi
add esp, 0x104
ret

Function at 0x40c650
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x40c691
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
je 0x40c6c4
mov eax, dword [esp + 0x18]
sub eax, 2
jne 0x40c6c4
cmp dword [esp + 0xc], 6
jne 0x40c6c4
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40c6c4
push str.Microsoft_Windows_Vista_or_Windows_Server:Longhorn_n
call fcn.0040c6d0
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x9c
ret
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret

Function at 0x40c6d0
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
mov dword [esp + 0x10], 0
call ebx
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x439468]
cmp eax, 0xffffffff
je 0x40c737
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call esi
cmp eax, 1
jne 0x40c737
push 0x43a2f4
mov dword [esp + 0x10], 0
call ebx
lea edx, [esp + 0xc]
push 0
push edx
push eax
mov eax, dword [0x439468]
push 0x43a2f4
push eax
call esi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40f6f0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 3
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f732
mov ecx, dword [esp + 0xc]
lea edx, [esp + 8]
push 4
push edx
push 4
push eax
mov eax, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
ret
Function at 0x4109a0
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x128
push esi
push edi
xor esi, esi
push 2
mov edi, ecx
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0xc]
push eax
push 0x430874
push 1
push esi
push 0x431af4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x4109de
pop edi
xor al, al
pop esi
add esp, 0x128
ret 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push esi
push edx
mov ecx, dword [eax]
push 0x431ad4
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x410a0e
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
xor al, al
pop esi
add esp, 0x128
ret 4
mov eax, dword [esp + 0xc]
push ebx
push ebp
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
mov dword [edi], esi
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x410b5c
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [edi], esi
jne 0x410b5c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push 0x433508
mov edx, dword [eax]
push esi
push esi
push eax
call dword [edx + 0x24]
test eax, eax
jl 0x410b2c
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push esi
mov word [esp + 0x2c], 8
mov edx, dword [eax]
push ecx
push str.FriendlyName
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x410ab8
mov eax, dword [esp + 0x30]
push esi
push esi
lea edx, [esp + 0x40]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push esi
push esi
call ebx
mov ecx, dword [esp + 0x30]
push ecx
call ebp
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [esp + 0x13c]
lea eax, [esp + 0x38]
push 0x16
push eax
push ecx
mov dword [esp + 0x28], esi
call fcn.0041db30
add esp, 0xc
test eax, eax
jne 0x410b2c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push 0x430804
mov edx, dword [eax]
push esi
push esi
push eax
call dword [edx + 0x20]
test eax, eax
jne 0x410b2c
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], esi
cmp eax, esi
je 0x410b3e
mov ecx, dword [eax]
push edi
push 0x430474
push eax
call dword [ecx]
test eax, eax
jge 0x410b22
mov dword [edi], esi
mov eax, dword [esp + 0x20]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x410b3e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
je 0x410a54
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [edi]
pop ebp
cmp eax, esi
pop ebx
pop edi
pop esi
setne al
add esp, 0x128
ret 4
Function at 0x4159d0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xa8
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb8]
lea eax, [esp + 0xc]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x38]
push 0x80
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov edi, eax
call ebx
mov esi, dword [esp + 0xc0]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x12
call ebx
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x440f14]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push edx
push esi
call ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
inc eax
dec ecx
inc edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
push 0
lea ecx, [esp + 0x3c]
push edi
lea edx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
push edx
push 2
push 1
dec eax
push 4
push esi
mov dword [esp + 0x54], eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov eax, dword [0x440f1c]
mov edx, dword [esp + 0x14]
sub edi, ebx
mov ebx, dword [esp + 0x1c]
push eax
push esi
sub ebx, edx
call ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_PatBlt]
push 0xf00021
push ebx
push 1
push ecx
push edx
push esi
mov dword [esp + 0x3c], eax
call ebp
mov eax, dword [esp + 0x14]
push 0xf00021
push 1
push edi
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push esi
call ebp
mov edx, dword [0x440f18]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
dec ebx
push 0xf00021
push ebx
inc eax
push 1
dec ecx
push eax
push ecx
push esi
call ebp
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push 0xf00021
dec edi
push 1
dec edx
push edi
inc eax
push edx
push eax
push esi
call ebp
mov eax, dword [esp + 0x20]
test eax, eax
je 0x415b16
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x415b26
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret
Function at 0x4172f0
Capabilities:
Delete file

Disassembly:
mov eax, dword [ecx]
sub esp, 0x600
test eax, eax
push ebx
push esi
push edi
je 0x41732f
mov ecx, 0x440f58
call fcn.004108a0
mov edi, 0x441068
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x610]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x417354
lea edi, [ecx + 0x108]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x610]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [esp + 0x614]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
je 0x4173d1
lea eax, [esp + 0xc]
push ebx
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
test eax, eax
je 0x41738a
inc eax
push 0x439888
push eax
call esi
lea edx, [esp + 0x20c]
push 0x200
push edx
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20c]
push eax
push ecx
push str.image_jpeg
call fcn.00419240
add esp, 0xc
test eax, eax
jne 0x4173d1
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0xc]
push edx
push ebx
call esi
mov eax, dword [esp + 0x618]
test eax, eax
je 0x417417
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push ebx
call edi
push eax
lea eax, [esp + 0x210]
push eax
call esi
lea ecx, [esp + 0xc]
push ebx
push ecx
call esi
lea edx, [esp + 0xc]
push edx
call edi
mov byte [eax], 0
lea eax, [esp + 0x20c]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00418d10
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x600
ret 0xc

Function at 0x417cf0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x38
xor eax, eax
push ebx
mov dword [esp + 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0x54]
push esi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x14], eax
push edi
lea edx, [esp + 0x5c]
mov word [esp + 0x1c], ax
mov dword [esp + 0x5c], eax
push eax
push edx
lea eax, [esp + 0x18]
push 0xe
lea ecx, [ebp + 0x36]
push eax
push esi
mov word [esp + 0x24], 0x4d42
mov dword [esp + 0x26], ecx
mov dword [esp + 0x2e], 0x36
call ebx
mov edx, dword [esp + 0x54]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x50]
mov ax, word [esp + 0x58]
mov dword [esp + 0x24], ecx
xor edi, edi
lea ecx, [esp + 0x5c]
mov dword [esp + 0x28], edx
push edi
push ecx
lea edx, [esp + 0x28]
push 0x28
push edx
push esi
mov dword [esp + 0x34], 0x28
mov word [esp + 0x40], 1
mov word [esp + 0x42], ax
mov dword [esp + 0x70], edi
call ebx
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x5c]
push edi
push eax
push ebp
push ecx
push esi
mov dword [esp + 0x70], edi
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x419750
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x38]
xor esi, esi
push str.AMCapIcon
push edi
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0x4194f0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x24], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x43afe4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x4198bf
push ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push ebx
call ebp
push 0xa
push ebx
mov esi, eax
call ebp
pop ebp
cmp esi, 0x320
pop ebx
jg 0x4197fc
mov ecx, 0x140
mov edx, 0xf0
mov dword [0x441458], ecx
jmp 0x41980c
mov ecx, 0x1e0
mov edx, 0x168
mov dword [0x441458], ecx
sub esi, ecx
sub eax, edx
sub esi, 3
sub eax, 0x28
add ecx, esi
push 0
mov dword [0x441588], ecx
mov dword [0x441578], ecx
mov ecx, dword [0x43afe0]
mov dword [0x441568], edx
push 0
add edx, eax
push ecx
push 0x441580
mov dword [0x441580], esi
mov dword [0x441584], eax
mov dword [0x44158c], edx
mov dword [0x441570], esi
mov dword [0x441574], eax
mov dword [0x44157c], edx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov edx, dword [0x44158c]
mov eax, dword [0x441584]
mov ecx, dword [0x441580]
push 0
push edi
push 0
sub edx, eax
push 0
push edx
mov edx, dword [0x441588]
sub edx, ecx
push edx
push eax
mov eax, dword [0x43afe0]
push ecx
push eax
push 0x440db4
push 0x43afe4
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x4415e8], eax
je 0x4198bf
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
add esp, 0x28
ret
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x419a20
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, ebp
mov dword [esp + 0x10], ebp
je 0x419a3b
call fcn.004199f0
mov eax, dword [esp + 0x18]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419aaf
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0041d32e
add esp, 4
lea ecx, [esp + 0x18]
mov ebp, eax
push 0
push ecx
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jle 0x419a9b
push edi
push ebp
mov ecx, esi
call fcn.00419b10
test eax, eax
je 0x419a9b
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.0041d33c
mov ebp, dword [esp + 0x14]
add esp, 4
mov eax, dword [esi + 4]
xor ecx, ecx
cmp eax, ecx
mov dword [esi + 0x10], edi
je 0x419afe
mov edx, dword [eax]
lea edi, [esi + 0xc]
push edi
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 4]
add esi, 0x14
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x9ec
push 0x60
push edx
call ebx
mov dword [edi], eax
mov eax, dword [esi]
push 0x9ec
push 0x60
push eax
call ebx
mov dword [esi], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x41a080
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x118
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 0x18], esi
push esi
lea eax, [esp + 0x28]
push str.SYSTEMCurrentControlSetControlClass6BDD1FC6_810F_11D0_BEC7_08002BE2092F_04d
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push 0xf003f
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x41a12c
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.UVCFlags
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41a0fa
cmp dword [esp + 0x10], 0x10
je 0x41a121
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push 0
push str.UVCFlags
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0x10
call ebp
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 0x270f
jl 0x41a0a2
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x41a14a
call fcn.00419ef0
add esp, 0x118
ret
Function at 0x40893e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
sub eax, 0x32cbb62f
sub eax, 0xfa7a3fe1
call fcn.00408972
push 0xdd51dfe
pop eax
xor dword [ecx], edx
mov eax, 0xea095065
sub eax, edi
inc ecx
add eax, 0xb4598e4
cmp ecx, ebx
jne fcn.0040893e
dec edi
ret