joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4071d7
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x21c]
call fcn.0040fb24
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push 0xffffffffffffff9e
push ebp
push 0x7f
push 0x405f98
call 0x4071f0
mov eax, 0x41914a
lea ecx, [ebp - 0x14]
mov eax, 0x4196d6
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push dword [esp - 0x70]
push esi
call 0x407215
cmp eax, 0xffffffff
je 0x407225
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [esp + 0xc]
pop eax
ret 0xc
cmp eax, 0xffffffff
jne 0x4071b2
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040647b
xchg dword [esp], edx
mov edx, dword [ebp + 8]
push dword [esp + 0xc]
push 0xffffffffffffffaa
push 0xffffffffffffff9b
push 0x40bb3b
call fcn.0040432b
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004078e2
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax

Function at 0x4071f0
Capabilities:
Get graphical window text

Disassembly:
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x21c]
call fcn.0040fb24
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push 0xffffffffffffff9e
push ebp
push 0x7f
push 0x405f98
call 0x4071f0
mov eax, 0x41914a
lea ecx, [ebp - 0x14]
mov eax, 0x4196d6
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push dword [esp - 0x70]
push esi
call 0x407215
cmp eax, 0xffffffff
je 0x407225
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea esp, [esp + 0xc]
pop eax
ret 0xc
cmp eax, 0xffffffff
jne 0x4071b2
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040647b
xchg dword [esp], edx
mov edx, dword [ebp + 8]
push dword [esp + 0xc]
push 0xffffffffffffffaa
push 0xffffffffffffff9b
push 0x40bb3b
call fcn.0040432b
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004078e2
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax

Function at 0x407ca0
Capabilities:
Get graphical window text

Disassembly:
add edi, 4
mov dword [esi + 8], edi
pop edi
pop esi
mov edx, dword [esp + 8]
mov eax, dword [esi + 8]

Function at 0x407cc8
Capabilities:
Get graphical window text

Disassembly:
lea esp, [esp + 8]
mov eax, dword [esp + 8]
push esp
push 0x404628
call 0x407ce6
sub esp, 8
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push ecx
push dword [esp - 0x96]
push 0x4056b8
call fcn.00407d19
mov dword [esp + 0x2c], 0xffffffff
je 0x407cbc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]

Function at 0x407ce6
Capabilities:
Get graphical window text

Disassembly:
lea esp, [esp + 8]
mov eax, dword [esp + 8]
push esp
push 0x404628
call 0x407ce6
sub esp, 8
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push ecx
push dword [esp - 0x96]
push 0x4056b8
call fcn.00407d19
mov dword [esp + 0x2c], 0xffffffff
je 0x407cbc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
Function at 0x4082b0
Capabilities:
Create directory

Disassembly:
call fcn.0040c1ad
sub esp, 0xc
push ebx
push dword [esp + 0x79]
push dword [esp - 0x38]
push dword [esp + 0x1c]
push 0x39
call 0x4082e7
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push 0x41a259
push eax
mov dword [esp + 0x14], 7
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push dword [esp - 0x64]
push 0x404758
push 0x7e
call 0x408309
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0xffffffffffffffdf
call fcn.0040832b
jmp dword [sym.imp.KERNEL32.dll_GetProcessTimes]

Function at 0x4082e7
Capabilities:
Create directory

Disassembly:
call fcn.0040c1ad
sub esp, 0xc
push ebx
push dword [esp + 0x79]
push dword [esp - 0x38]
push dword [esp + 0x1c]
push 0x39
call 0x4082e7
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push 0x41a259
push eax
mov dword [esp + 0x14], 7
lea esp, [esp + 0x14]
mov ebx, dword [esp + 8]
push dword [esp - 0x64]
push 0x404758
push 0x7e
call 0x408309
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0xffffffffffffffdf
call fcn.0040832b
jmp dword [sym.imp.KERNEL32.dll_GetProcessTimes]

Function at 0x40870a
Capabilities:
Clear file content
Create directory

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push 5
jne 0x408706
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
push 0
push eax
call fcn.00405fab
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax + 0x16]
push 0x400e89
push 0xffffffffffffff8e
push 0x4006af
push 0x40a085
call fcn.00404062
push eax
lea ecx, [esp + 0xc]
push ecx
push 0x4190e4
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
test eax, eax
je 0x408705

Function at 0x408e64
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 4]
call fcn.0040bcce
test eax, eax
push edi
shr edi, 1
mov edi, 0x38f1076c
xor dword [esp + 4], edi
pop edi
push eax
push ebp
push dword [esp + 8]
push ecx
push 0x4085fa
call fcn.00404062
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x419007
push esi

Function at 0x408e71
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x4190bf
push ebx
push dword [esp - 0xe6]
push dword [esp + 0x2f]
call 0x408eb0
mov eax, dword [esp + 8]
push edx
push eax
push 0x4193a4
call dword [sym.imp.KERNEL32.dll_LoadResource]
pop esi
mov eax, dword [ecx + 0x14]
lea esp, [esp + 0xc]
mov ebx, dword [esp + 8]
push 0xffffffffffffffe4
push dword [esp - 0xf2]
push 0x4d
call 0x408ee3
pop ecx
push 0xffffffffffffffff
push 0x41913c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
lea esp, [esp + 0x10]
add dword [esp + 4], ebx
push 0x4042b0
push dword [esp - 0xc9]
push dword [esp + 0x3b]
call 0x408f0b
push 0x18
push 0x419cce
push esi
call edi
pop edi
lea esp, [esp + 0x10]
pop ebx
ret 0xc
Function at 0x409563
Capabilities:
Create directory

Disassembly:
xor eax, eax
push esi
mov dword [esp + 0xc], eax
call fcn.0040e9ab
mov edx, eax
add esp, 4
push eax
push dword [esp + 0xc]
push eax
push 0x4042a5
call fcn.004037fe
cmp esi, eax
je 0x40957e
cmp esi, 2
jne 0x409565
mov eax, dword [0x41949a]
cmp eax, edi
je 0x409522
jmp dword [sym.imp.KERNEL32.dll_GetThreadPriority]
je 0x4094fd
mov ecx, dword [esp + 8]
or ebx, dword [esp]
add esp, 4
push 0x55
push 0x6a
push ecx
push 0x3fc8ac
call fcn.00404199
push ebp
mov ebp, esp

Function at 0x409581
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
push ebx
push edi
push eax
push 0x36
push dword [esp - 0x6b]
call 0x4095b7
call fcn.0040add1
push 0xc
push 0x419f63
call fcn.004017b7
mov dword [ebp - 0x1c], 0x10034a70
cmp dword [ebp + 0x4d], 0x100041a2
jae 0x409592
and dword [ebp - 4], 0
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push dword [esp + 0xe]
push esi
call 0x4095e1
jne 0x409638
mov ecx, dword [0x419dcb]
mov edx, dword [ecx]
push 0x4192d5
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop edi
pop esi
lea esp, [esp + 0xc]
add dword [esp + 4], edi
push dword [esp - 0x80]
call 0x40960b
push eax
lea ecx, [esp + 4]
push ecx
push 0x419dcb
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x409683
lea esp, [esp + 8]
pop edi
ret 4
mov eax, dword [ecx + 0x114]
test eax, eax
push 0x57
push esi
lea esi, [eax + edx*4 - 7]
mov esi, 0x8f68d6c6
push 0xd
push dword [esp + 4]
push 0xffffffffffffffc2
push 0x409649
call fcn.00403db1
mov ecx, dword [ebx + 8]
push 0
push 0
push 0x63
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
call fcn.0040b186
mov eax, dword [0x419aa0]
inc dword [eax]
mov eax, dword [0x419e31]
mov ecx, dword [ebp - 0xc]

Function at 0x4095b7
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
push ebx
push edi
push eax
push 0x36
push dword [esp - 0x6b]
call 0x4095b7
call fcn.0040add1
push 0xc
push 0x419f63
call fcn.004017b7
mov dword [ebp - 0x1c], 0x10034a70
cmp dword [ebp + 0x4d], 0x100041a2
jae 0x409592
and dword [ebp - 4], 0
lea esp, [esp + 0x10]
mov edi, dword [esp + 8]
push dword [esp + 0xe]
push esi
call 0x4095e1
jne 0x409638
mov ecx, dword [0x419dcb]
mov edx, dword [ecx]
push 0x4192d5
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop edi
pop esi
lea esp, [esp + 0xc]
add dword [esp + 4], edi
push dword [esp - 0x80]
call 0x40960b
push eax
lea ecx, [esp + 4]
push ecx
push 0x419dcb
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x409683
lea esp, [esp + 8]
pop edi
ret 4
mov eax, dword [ecx + 0x114]
test eax, eax
push 0x57
push esi
lea esi, [eax + edx*4 - 7]
mov esi, 0x8f68d6c6
push 0xd
push dword [esp + 4]
push 0xffffffffffffffc2
push 0x409649
call fcn.00403db1
mov ecx, dword [ebx + 8]
push 0
push 0
push 0x63
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
call fcn.0040b186
mov eax, dword [0x419aa0]
inc dword [eax]
mov eax, dword [0x419e31]
mov ecx, dword [ebp - 0xc]
Function at 0x409786
Capabilities:
Parse url

Disassembly:
jne 0x40979f
mov eax, 0x419047
mov edx, dword [esp + 0x1c]
push ecx
push 0x1a
push 0x405d38
call fcn.004097a0
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
je 0x409751
mov edi, dword [ecx]
push eax

Function at 0x409839
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
push dword [esp - 0x45]
push ecx
call 0x40984a
pop ebp
mov eax, dword [0x41927a]
lea esp, [esp + 0xc]
mov edx, dword [esp + 8]
push dword [esp - 0xac]
call 0x409873
mov ecx, dword [esp + 0xc]
push esi
call fcn.0040924f
push eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
pop esi
sub esp, 0xc
lea esp, [esp + 8]
add dword [esp + 4], edx
push dword [esp + 0x4b]
call 0x40988c
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
lea esp, [esp + 8]
pop edx
ret 0xc

Function at 0x40984a
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
push dword [esp - 0x45]
push ecx
call 0x40984a
pop ebp
mov eax, dword [0x41927a]
lea esp, [esp + 0xc]
mov edx, dword [esp + 8]
push dword [esp - 0xac]
call 0x409873
mov ecx, dword [esp + 0xc]
push esi
call fcn.0040924f
push eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
pop esi
sub esp, 0xc
lea esp, [esp + 8]
add dword [esp + 4], edx
push dword [esp + 0x4b]
call 0x40988c
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
lea esp, [esp + 8]
pop edx
ret 0xc

Function at 0x409873
Capabilities:
Query or enumerate registry value

Disassembly:
push edx
push dword [esp - 0x45]
push ecx
call 0x40984a
pop ebp
mov eax, dword [0x41927a]
lea esp, [esp + 0xc]
mov edx, dword [esp + 8]
push dword [esp - 0xac]
call 0x409873
mov ecx, dword [esp + 0xc]
push esi
call fcn.0040924f
push eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
pop esi
sub esp, 0xc
lea esp, [esp + 8]
add dword [esp + 4], edx
push dword [esp + 0x4b]
call 0x40988c
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
lea esp, [esp + 8]
pop edx
ret 0xc

Function at 0x40a5d7
Capabilities:
Set file attributes

Disassembly:
push edx
push 0x402d78
push edx
push 0xfffffffffffffff9
push dword [esp + 0x37]
call fcn.0040a5fb
add byte [eax], al
add byte [eax + 0x1000935c], bh
push esi
push 0
mov esi, ecx
call fcn.0041036b

Function at 0x40b5a0
Capabilities:
Clear file content
Resolve dns

Disassembly:
mov dword [esi], eax
jne 0x40b5a4
mov edx, dword [esi + 4]
push esi
call dword [edx + 0x18]
mov eax, dword [ebx + 0xc]
push edi
push dword [esp - 0x30]
push 0x4050b0
call 0x40b5d3
push 0x419852
push esi
mov edi, eax
call sub.KERNEL32.dll_SetEndOfFile
xor eax, eax
test edi, edi
pop edi
pop ebx
lea esp, [esp + 0xc]
mov edi, dword [esp + 8]
push dword [esp - 0x1a]
push dword [esp - 0x48]
call 0x40b5f6
add byte [eax], al
mov eax, 0x419051
push esi
lea esp, [esp + 0xc]
add dword [esp + 4], edi
push 0x404b50
push dword [esp - 0xf]
call fcn.0040b631
lea ecx, [ebp - 0x2c]
jmp dword [sym.imp.WS2_32.dll_gethostbyname]
Function at 0x40b5d3
Capabilities:
Resolve dns

Disassembly:
mov dword [esi], eax
jne 0x40b5a4
mov edx, dword [esi + 4]
push esi
call dword [edx + 0x18]
mov eax, dword [ebx + 0xc]
push edi
push dword [esp - 0x30]
push 0x4050b0
call 0x40b5d3
push 0x419852
push esi
mov edi, eax
call sub.KERNEL32.dll_SetEndOfFile
xor eax, eax
test edi, edi
pop edi
pop ebx
lea esp, [esp + 0xc]
mov edi, dword [esp + 8]
push dword [esp - 0x1a]
push dword [esp - 0x48]
call 0x40b5f6
add byte [eax], al
mov eax, 0x419051
push esi
lea esp, [esp + 0xc]
add dword [esp + 4], edi
push 0x404b50
push dword [esp - 0xf]
call fcn.0040b631
lea ecx, [ebp - 0x2c]
jmp dword [sym.imp.WS2_32.dll_gethostbyname]

Function at 0x40b5f6
Capabilities:
Resolve dns

Disassembly:
mov dword [esi], eax
jne 0x40b5a4
mov edx, dword [esi + 4]
push esi
call dword [edx + 0x18]
mov eax, dword [ebx + 0xc]
push edi
push dword [esp - 0x30]
push 0x4050b0
call 0x40b5d3
push 0x419852
push esi
mov edi, eax
call sub.KERNEL32.dll_SetEndOfFile
xor eax, eax
test edi, edi
pop edi
pop ebx
lea esp, [esp + 0xc]
mov edi, dword [esp + 8]
push dword [esp - 0x1a]
push dword [esp - 0x48]
call 0x40b5f6
add byte [eax], al
mov eax, 0x419051
push esi
lea esp, [esp + 0xc]
add dword [esp + 4], edi
push 0x404b50
push dword [esp - 0xf]
call fcn.0040b631
lea ecx, [ebp - 0x2c]
jmp dword [sym.imp.WS2_32.dll_gethostbyname]

Function at 0x40ba1a
Capabilities:
Move file

Disassembly:
lea esp, [esp + 0x14]
mov esi, dword [esp + 8]
push 0x403b98
push 0xffffffffffffff85
call 0x40ba43
mov ecx, dword [esp + 8]
push ecx
mov ecx, dword [esp + 8]
call fcn.00405916
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push 0xffffffffffffffda
push dword [esp - 0x6b]
push dword [esp - 0x68]
call 0x40ba76
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea esp, [esp + 0x10]
pop esi
ret 4

Function at 0x40bcce
Capabilities:
Get common file path

Disassembly:
push ecx
mov eax, dword [ecx + 0xc8]
push ecx
push 0x73
push ebp
push dword [esp - 0x78]
push dword [esp - 0x30]
call 0x40bcef
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push dword [esp - 0xbe]
push 0x403d98
call 0x40bd18
call fcn.00405783
mov eax, dword [esi + 8]
mov edx, eax
sub edx, ebx
lea ecx, [esp + 0x20]
lea esp, [esp + 0xc]
add dword [esp + 4], ecx
push 0x403be0
push dword [esp - 6]
call 0x40bd3e
push eax
call fcn.0040d448
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea esp, [esp + 0xc]
pop ecx
ret 0xc
Function at 0x40bcef
Capabilities:
Get common file path

Disassembly:
push ecx
mov eax, dword [ecx + 0xc8]
push ecx
push 0x73
push ebp
push dword [esp - 0x78]
push dword [esp - 0x30]
call 0x40bcef
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push dword [esp - 0xbe]
push 0x403d98
call 0x40bd18
call fcn.00405783
mov eax, dword [esi + 8]
mov edx, eax
sub edx, ebx
lea ecx, [esp + 0x20]
lea esp, [esp + 0xc]
add dword [esp + 4], ecx
push 0x403be0
push dword [esp - 6]
call 0x40bd3e
push eax
call fcn.0040d448
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea esp, [esp + 0xc]
pop ecx
ret 0xc

Function at 0x40bd18
Capabilities:
Get common file path

Disassembly:
push ecx
mov eax, dword [ecx + 0xc8]
push ecx
push 0x73
push ebp
push dword [esp - 0x78]
push dword [esp - 0x30]
call 0x40bcef
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
lea esp, [esp + 0x14]
mov ecx, dword [esp + 8]
push dword [esp - 0xbe]
push 0x403d98
call 0x40bd18
call fcn.00405783
mov eax, dword [esi + 8]
mov edx, eax
sub edx, ebx
lea ecx, [esp + 0x20]
lea esp, [esp + 0xc]
add dword [esp + 4], ecx
push 0x403be0
push dword [esp - 6]
call 0x40bd3e
push eax
call fcn.0040d448
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea esp, [esp + 0xc]
pop ecx
ret 0xc

Function at 0x40c841
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
push eax
push eax
push dword [esp - 0x3d]
push dword [esp - 0x2a]
push dword [esp + 0xe]
call fcn.0040c863
mov byte [ebp - 4], 5
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
Function at 0x40d5bd
Capabilities:
Move file

Disassembly:
call fcn.004101a6
cmp eax, 0xffffffff
je 0x40d641
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]

Function at 0x40d87d
Capabilities:
Copy file

Disassembly:
push ecx
push 0x41a053
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
je 0x40d822
mov ecx, dword [esp]

Function at 0x40e24e
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
xor eax, eax
test ebp, ebp
pop esi
setge al
jmp fcn.00405cbe
xor eax, eax
mov dword [edi + 0xcc], eax
pop edi
mov eax, 0x41914e
pop esi
mov eax, dword [ecx + 0xcc]
test eax, eax
je 0x40e21c
push eax
push dword [esp - 0x6a]
push dword [esp - 0x35]
push eax
push 0x5f
push dword [esp - 0xe6]
call 0x40e295
call edi
lea ecx, [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
push eax
lea edx, [esp + 0x50]
push edx
lea esp, [esp + 0x18]
mov eax, dword [esp + 8]
push 0xffffffffffffffac
push 0x75
call 0x40e2ae
pop ebx
push ebp
call dword [sym.imp.GDI32.dll_GetStockObject]
lea esp, [esp + 0xc]
add dword [esp + 4], eax
push 0x402000
call 0x40e2cc
pop esi
mov eax, edx
mov esi, dword [esi + 0x14]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x6c]
lea esp, [esp + 8]
pop eax
ret 8

Function at 0x40e3ad
Capabilities:
Delete file

Disassembly:
push edi
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov eax, dword [esp + 4]
push ebx
push 0x2b21655f
push ebp
push 0x4001b0
push 0x400829
push 0x3f8ad1
call fcn.0040396f
cmp ebx, eax
mov esi, ebx
jne 0x40e3a5
pop ebx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
xor dword [esp + 4], ebx
pop ebx
push dword [esp + 0xc]
push eax
push 0x4008dc
push 0x3f9165
call fcn.00404062
mov dword [eax + 0x14], 5
mov byte [eax + 0x18], 1
mov eax, dword [esi + 0xc8]
mov ecx, dword [eax]
mov dword [esp + 0x24], esp
push eax
call dword [ecx + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
mov eax, dword [esp + 8]
push 0x41972d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
push esi
push 0x403e50
push 0xffffffffffffffc8
push dword [esp - 0x43]
call 0x40e455
mov eax, ecx
pop ecx
push ecx
mov eax, dword [ecx + 0xc8]
lea esp, [esp + 0x10]
mov esi, dword [esp + 8]
push dword [esp - 0x75]
push esp
push dword [esp - 0xbd]
push dword [esp + 0x4f]
push ebx
call 0x40e480
mov ecx, esi
call fcn.004082b0
mov eax, esi
pop esi
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push dword [esp - 0xbf]
push dword [esp - 0xf4]
push dword [esp + 0x38]
push edx
push edx
call 0x40e4b9
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea esp, [esp + 0x18]
pop esi
ret 4
Function at 0x40e50d
Capabilities:
Get common file path

Disassembly:
mov ecx, dword [esp + 4]
call fcn.0040cd4e
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
shl ecx, 2
push 0x400d12
push 0xffffffffffffffe3
push ebx
push 0x40396a
call fcn.00403ef1
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dword [ebp - 0x18], eax
mov ebx, eax
xor edi, edi
push 0x419bcc
mov dword [ebp - 4], 2
call fcn.004110e2
mov ecx, dword [ebp - 0x4c]
push ecx
xchg dword [esp], ecx
push edx
push dword [esp + 8]
push 0x3f
push 0x3f8d6a
call fcn.0040432b
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]

Function at 0x40e587
Capabilities:
Create process on windows

Disassembly:
test eax, eax
je 0x40e5a7
mov edx, dword [eax]
push eax
mov dword [ebp - 4], esp
push 0x6a
push ebp
push 0x5b
push 0x404d3e
call fcn.0040396f
push 8
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x44]

Function at 0x40e7cb
Capabilities:
Get graphical window text

Disassembly:
push ecx
push 0x419f64
push edx
test al, al
jne 0x40e843
lea ecx, [esp]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
push dword [esp - 0x50]
call 0x40e7ee
mov edx, ecx
add ecx, 0x1c
test edi, edi
jne 0x40e770
test esi, esi
lea esp, [esp + 8]
mov esi, dword [esp + 8]
push edx
push 0x4043d0
push dword [esp + 0x79]
push 0x28
push dword [esp + 0xf]
call 0x40e812
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push 0x401278
call 0x40e82c
push esi
mov esi, ecx
call fcn.0040ec17
lea esp, [esp + 8]
pop esi
ret 0xc
jne 0x40e8b3

Function at 0x40ea32
Capabilities:
Check internet connectivity via wininet

Disassembly:
lea ecx, [ebp - 0x10]
mov eax, 0x4190dc
lea ecx, [ebp - 0x3c]
lea ecx, [ebp - 0x28]
lea ecx, [ebp - 0x10]
jmp dword [sym.imp.WININET.dll_InternetGetConnectedState]

Function at 0x40eade
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41980b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 4
leave
push 0x400622
push 0x4008b3
push 0x400e70
push 0x3f9677
call fcn.0040432b
cmp eax, 0xffffffff
je 0x40eb8f
mov ecx, dword [esp + 8]
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp], eax
lea eax, [esp]
push eax
push 0x4194a6
push ecx
mov esi, dword [esp]
push dword [esp + 0xc]
push ebp
push 0x400d0f
push 0x3fa105
call fcn.0040432b
xor ecx, ecx
mov byte [esp + 8], dl
mov dword [esp + 9], ecx
lea edx, [esp + 8]
push edx

Function at 0x40fc99
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push eax
push dword [esp - 0x12]
call fcn.0040fcac
sub esp, 8
mov ecx, dword [esp + 0x10]
xor eax, eax
Function at 0x40fcac
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
lea esp, [esp + 8]
mov eax, dword [esp + 8]
push dword [esp - 0xb4]
push 0x76
push dword [esp + 0x45]
push ecx
call 0x40fce0
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, edi
mov dword [ebp + 0x10], ecx
jae 0x4133f8
mov edx, dword [ebp + 8]
push edx
lea eax, [edi + edi*4]
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push dword [esp - 0xb1]
call 0x40fd00
test edi, edi
je 0x40fcfc
mov ebp, dword [esp + 0x18]
mov eax, dword [edi]
mov esi, ebp
lea esp, [esp + 8]
pop eax
ret 8

Function at 0x40ffab
Capabilities:
Get file version info

Disassembly:
push edi
push 0xa
push dword [esp - 0x100]
call fcn.0040ffd2
mov ecx, esi
call fcn.0040b422
inc ebp
cmp ebp, 0x419bf3
mov edi, eax
jle 0x40ff88
mov dword [esi], 1

Function at 0x40ffd2
Capabilities:
Get file version info

Disassembly:
lea esp, [esp + 0xc]
mov edi, dword [esp + 8]
push dword [esp - 0x75]
push ebp
push 0x401348
call fcn.00410000
call fcn.00405f7f
test eax, eax

Function at 0x410000
Capabilities:
Get file version info

Disassembly:
jl 0x410025
test byte [esp + 0x14], 8
jne 0x410030
lea ecx, [esp + 0x4c]
lea esp, [esp + 0x10]
add dword [esp + 4], edi
push 0x7b
push dword [esp - 8]
push dword [esp - 0xa0]
push ebp
call 0x410038
push eax
push str.ne_GetPiPPGtex
push ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
jne 0x40fff3
pop ecx
mov edx, dword [esp]
mov eax, dword [0x4196ff]
lea esp, [esp + 0x14]
pop edi
ret 0xc

Function at 0x41020f
Capabilities:
Get file attributes

Disassembly:
lea esp, [esp + 0x10]
mov ebx, dword [esp + 8]
push ebx
push dword [esp - 0xe2]
push 0x12
push edx
call 0x410239
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esi + 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
lea esp, [esp + 0x14]
add dword [esp + 4], ebx
push 0x403cf8
push dword [esp - 0x56]
call 0x410266
pop esi
sub esp, 0xc
mov edx, dword [esp + 0x14]
xor eax, eax
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea esp, [esp + 0xc]
pop ebx
ret 0xc

Function at 0x41036b
Capabilities:
Set file attributes

Disassembly:
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x1c]
push ecx
push 0x41950b
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]