joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4050c0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, edx
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsWordpad
push ebx
sub esp, 0x5c
mov dword [ebp - 0x2c], eax
mov eax, 0x6f
mov dword [ebp - 0x1c], 0x5c
jmp 0x4050e7
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x4050e3
sub edx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsWordpad
sar edx, 1
cmp word [edi], 0
mov eax, edx
je 0x405110
mov eax, edi
add eax, 2
cmp word [eax], 0
jne 0x405101
sub eax, edi
sar eax, 1
add eax, edx
lea eax, [eax + eax + 4]
mov dword [esp + 4], 8
mov edx, dword fs:[0x18]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
mov edx, 0x53
mov ebx, eax
sub esp, 0xc
xor eax, eax
test ebx, ebx
jne 0x405157
jmp 0x405270
movzx edx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionAppletsWordpad]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x405150
cmp word [ebx], 0
mov edx, ebx
je 0x405179
lea esi, [esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x405170
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [ebp + eax - 0x1c]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x405180
cmp word [ebx], 0
mov edx, ebx
je 0x4051a9
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x4051a0
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4051b0
test esi, esi
je 0x405240
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x2001f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegCreateKeyExW
sub esp, 0x24
mov esi, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
mov eax, esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
mov esi, eax
jmp 0x40520c
lea esp, [ebp - 0xc]
mov esi, 1
pop ebx
mov eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x405280
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, edx
push ebx
lea edx, [ebp - 0xc]
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x30
mov dword [ebp - 0xc], 0
call sym.unk_52
test eax, eax
je 0x4052b0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x10]
shl ebx, 2
mov dword [esp + 0x14], 4
add esi, ebx
mov dword [esp + 0xc], 4
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x10]
add ebx, dword [ebp + 8]
sub esp, 0x18
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x405340
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
shl eax, 2
push ebx
lea ebx, [ecx + eax]
mov ecx, edx
lea edx, [ebp - 0x20]
sub esp, 0x3c
add eax, dword [ebp + 8]
mov dword [ebx], 0
mov dword [eax], 0
mov edi, eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0
call sym.unk_52
test eax, eax
jne 0x4053a4
mov eax, dword [ebp - 0x20]
cmp eax, 2
je 0x4053b0
mov dword [ebx], 0xf
cmp eax, 2
je 0x4053f1
xor eax, eax
test esi, esi
sete al
mov dword [edi], eax
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.BarState0
mov dword [esp], eax
mov dword [ebp - 0x1c], 4
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x405382
jmp 0x405388
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Wrap
mov dword [esp], eax
mov dword [ebp - 0x1c], 4
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x40538d
jmp 0x405396
Function at 0x405440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Options
mov ebp, esp
sub esp, 0x68
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0
call sym.unk_52
test eax, eax
je 0x4054a0
mov ecx, str.Settings
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x40]
call sym.unk_52
test eax, eax
je 0x405480
leave
ret
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sym.unk_38
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
leave
ret
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x2c
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.user32.dll_GetWindowPlacement
xor eax, eax
sub esp, 8
cmp dword [ebp - 0x2c], 3
sete al
mov dword [esp + 0x14], 0x10
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
lea eax, [ebp - 0x38]
sub esp, 0x18
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x40]
mov dword [esp + 0x14], 4
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
mov eax, dword [ebp - 0x40]
sub esp, 0x18
mov dword [esp], eax
call sym.unk_36
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x405461

Function at 0x405550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x10
call sym.unk_52
test eax, eax
je 0x4055b0
test ebx, ebx
je 0x40559a
mov dword [ebx], 0
mov dword [ebx + 8], 0x258
mov dword [ebx + 4], 0
mov dword [ebx + 0xc], 0x12c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.FrameRect
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x40557b
cmp dword [ebp - 0xc], 0x10
jne 0x40557b
jmp 0x40559a

Function at 0x4055f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
xor edx, edx
mov ecx, str.Options
mov ebp, esp
push ebx
lea eax, [ebp - 0x10]
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 4
call sym.unk_52
test eax, eax
je 0x405634
mov dword [ebx], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov ebx, dword [ebp - 4]
sub esp, 4
leave
ret
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Maximized
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x40561b
cmp dword [ebp - 0xc], 4
jne 0x40561b
jmp 0x405621
Function at 0x405bd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ecx, str.Recent_file_list
mov ebp, esp
push edi
push esi
lea edx, [ebp - 0x68]
lea eax, [ebp - 0x6c]
push ebx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
call sym.unk_52
test eax, eax
je 0x405c10
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym.unk_58
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
mov eax, dword [ebp + 0xc]
mov edi, 0x3ed
mov dword [esp], eax
call sub.user32.dll_GetMenu
mov dword [ebp - 0x48], 0x30
mov dword [ebp - 0x44], 0x20
sub esp, 4
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp + 8], ebx
mov ebx, edi
mov edi, eax
lea eax, [ebp - 0x48]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym.unk_179
sub esp, 0x10
test eax, eax
je 0x405c8d
mov eax, dword [ebp - 0x28]
mov dword [ebp + ebx*4 - 0x100c], eax
add ebx, 1
cmp ebx, 0x3f1
jne 0x405c56
mov ebx, dword [ebp + 8]
mov edi, dword [ebp - 0x58]
mov dword [esp], ebx
mov dword [esp + 4], edi
call sub.kernel32.dll_lstrcmpiW
sub esp, 8
test eax, eax
je 0x405d70
mov eax, edi
xor edx, edx
mov dword [ebp - 0x7c], edi
mov edi, edx
test eax, eax
je 0x405ce0
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.kernel32.dll_lstrcmpiW
sub esp, 8
test eax, eax
je 0x405d8a
add edi, 1
cmp edi, 4
je 0x405ce0
mov eax, dword [ebp + edi*4 - 0x58]
test eax, eax
jne 0x405cb7
nop
mov edi, dword [ebp - 0x7c]
test edi, edi
je 0x405da1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], eax
lea edi, [ebp - 0x64]
test ebx, ebx
je 0x405d70
add esi, 1
mov dword [esp + 4], str.File_d
mov dword [esp + 8], esi
mov dword [esp], edi
call sub.user32.dll_wsprintfW
cmp word [ebx], 0
je 0x405d83
mov eax, ebx
add eax, 2
cmp word [eax], 0
jne 0x405d23
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
cmp esi, 4
je 0x405d70
mov ebx, dword [ebp + esi*4 - 0x58]
jmp 0x405d00
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x405bf3
mov eax, 2
jmp 0x405d34
test edi, edi
je 0x405da1
lea ecx, [ebp - 0x58]
lea eax, [ecx + edi*4]
mov edx, dword [eax - 4]
sub eax, 4
mov dword [eax + 4], edx
cmp ecx, eax
jne 0x405d94
mov dword [ebp - 0x58], ebx
jmp 0x405cfd

Function at 0x405e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call sym.unk_54
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp sym.unk_54
Function at 0x405e90
Capabilities:
Set registry value

Disassembly:
push ebp
mov edx, 0x411618
xor eax, eax
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov ecx, ebx
call sym.unk_53
mov dword [ebp + 8], esi
add esp, 0x10
mov ecx, ebx
mov edx, 0x41160c
pop ebx
mov eax, 1
pop esi
pop ebp
jmp sym.unk_53

Function at 0x406770
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x6f8]
push ebx
sub esp, 0x71c
mov eax, dword [0x41a728]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 0x7dd
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call sym.unk_169
mov ecx, 0x1c
lea edx, [ebp - 0x6fc]
mov dword [ebp - 0x6fc], 0x74
mov esi, eax
xor eax, eax
sub esp, 0x10
rep stosd dword es:[edi], eax
mov eax, dword [0x41a724]
mov dword [esp + 0xc], edx
lea edi, [ebp - 0x612]
mov dword [esp + 8], 1
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call sym.unk_169
sub esp, 0x10
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], esi
call sym.unk_169
sub esp, 0x10
test eax, eax
jne 0x406842
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebp - 0x6e2]
mov dword [esp], edi
mov dword [esp + 4], ecx
call sub.kernel32.dll_lstrcmpW
sub esp, 8
test eax, eax
je 0x4068a0
lea ecx, [ebp - 0x6e2]
mov dword [esp], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
call sym.unk_169
sub esp, 0x10
mov dword [esp], ebx
mov dword [esp + 4], 0x7de
call sub.user32.dll_GetDlgItem
sub esp, 8
call sym.unk_73
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x70c], eax
mov eax, dword [0x41a728]
lea edi, [ebp - 0x684]
lea esi, [ebp - 0x688]
mov dword [esp + 4], 0x7d4
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], 0x7de
mov dword [esp], eax
call sub.user32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x407
mov dword [esp], eax
call sym.unk_169
mov edx, dword [ebp - 0x70c]
mov ecx, 0x1c
mov dword [ebp - 0x688], 0x74
mov ebx, eax
sub esp, 0x10
mov eax, edx
rep stosd dword es:[edi], eax
mov eax, dword [0x41a724]
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x414]
mov dword [esp + 8], 1
lea edi, [ebp - 0x216]
mov dword [esp + 4], 0x43a
mov dword [esp], eax
call sym.unk_169
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x104
mov dword [esp + 4], 0xd
mov dword [esp], ebx
call sym.unk_169
mov ecx, dword [ebp - 0x67c]
mov edx, 0x66666667
sub esp, 0x10
mov eax, ecx
sar ecx, 0x1f
mov dword [esp + 4], 0x411958
imul edx
mov dword [esp], edi
sar edx, 3
sub edx, ecx
mov dword [esp + 8], edx
call sub.user32.dll_wsprintfW
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.kernel32.dll_lstrcmpW
sub esp, 8
test eax, eax
je 0x40683a
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov dword [esp], ebx
call sym.unk_169
sub esp, 0x10
jmp 0x40683a
Function at 0x407070
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call sub.kernel32.dll_WriteFile
mov edx, 1
sub esp, 0x14
test eax, eax
je 0x4070b0
cmp ebx, dword [ebp - 0xc]
je 0x4070c0
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 0x10
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], ebx
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 0x10
Function at 0x407810
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym.unk_193
mov edx, 1
sub esp, 0x14
test eax, eax
je 0x407854
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
xor edx, edx
leave
mov eax, edx
ret 0x10

Function at 0x4078f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x244]
mov esi, ecx
push ebx
mov ebx, eax
lea eax, [ebp - 0x220]
sub esp, 0x25c
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x244], 1
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], 0xff
mov dword [ebp - 0x240], 0
jmp 0x407960
mov eax, dword [ebp - 0x23c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.kernel32.dll_lstrcmpiW
sub esp, 8
test eax, eax
jg 0x407983
add dword [ebp - 0x240], 1
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40d
mov dword [esp], esi
call sym.unk_169
sub esp, 0x10
test eax, eax
jne 0x407940
cmp word [ebx], 0
mov eax, ebx
mov edx, 2
je 0x4079a1
add eax, 2
cmp word [eax], 0
jne 0x407990
sub eax, ebx
sar eax, 1
lea edx, [eax + eax + 2]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
xor edx, edx
mov dword [ebp - 0x23c], eax
sub esp, 0xc
lea esi, [esi]
movzx ecx, word [ebx + edx]
mov word [eax + edx], cx
add edx, 2
test cx, cx
jne 0x4079d0
mov edx, dword [ebp - 0x24c]
or dword [ebp - 0x244], 0x20
and edx, 1
je 0x407a01
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub eax, dword [edx]
shl eax, 0x10
mov edx, eax
movzx eax, word [ebp - 0x24c]
mov dword [esp + 0xc], edi
mov dword [esp], esi
mov dword [esp + 8], 0
or eax, edx
mov dword [esp + 4], 0x40b
mov dword [ebp - 0x224], eax
call sym.unk_169
mov edx, dword [ebp - 0x23c]
sub esp, 0x10
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407b50
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ebx, 0x419ac0
sub esp, 0x10
test eax, eax
je 0x407b68
call sym.unk_90
mov ebx, eax
cmp word [ebx], 0
je 0x407ca0
mov eax, ebx
add eax, 2
cmp word [eax], 0
jne 0x407b74
sub eax, ebx
sar eax, 1
lea edx, [eax + eax + 0x20]
mov dword [esp + 8], edx
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapAlloc
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x407c90
cmp word [ebx], 0
je 0x407caa
mov eax, ebx
nop
add eax, 2
cmp word [eax], 0
jne 0x407bc0
sub eax, ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_memcpy
cmp word [ebx], 0
je 0x407cb1
mov eax, ebx
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x407bf0
sub eax, ebx
lea edx, [esi + eax]
sar eax, 1
lea eax, [eax + eax + 6]
mov ecx, dword [0x411778]
add eax, esi
mov dword [edx], ecx
movzx ecx, word [0x41177c]
mov word [edx + 4], cx
mov edx, dword [0x411978]
mov dword [eax], edx
mov edx, dword [0x41197c]
mov dword [eax + 4], edx
mov edx, dword [0x411980]
mov dword [eax + 8], edx
mov edx, dword [0x411984]
mov dword [eax + 0xc], edx
mov edx, dword [0x411988]
mov dword [eax + 0x10], edx
mov edx, dword [0x41198c]
mov dword [eax + 0x14], edx
movzx edx, word [0x411990]
mov word [eax + 0x18], dx
mov eax, dword [0x41a728]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.user32.dll_SetWindowTextW
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov edx, 0x20
jmp 0x407b85
xor eax, eax
jmp 0x407bcb
mov edx, esi
mov eax, 6
jmp 0x407c04
Function at 0x407cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x5c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], eax
call sub.kernel32.dll_CreateFileW
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x407e60
mov edi, eax
lea edx, [ebp - 0x24]
cmp ebx, 0x11
je 0x407e12
mov eax, dword [0x41a724]
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x44a
mov dword [esp], eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], sym.unk_80
call sym.unk_169
sub esp, 0x10
mov dword [ebp - 0x3c], eax
mov dword [esp], edi
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x41a724]
sub esp, 4
mov dword [esp], eax
call sub.user32.dll_SetFocus
mov edx, dword [ebp - 0x3c]
sub esp, 4
test edx, edx
je 0x407dd0
xor eax, eax
movzx edx, word [esi + eax]
add eax, 2
mov word [eax + 0x41a4fe], dx
test dx, dx
jne 0x407d70
mov eax, 0x41a500
call sym.unk_91
mov eax, dword [0x41a724]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call sym.unk_169
mov eax, ebx
sub esp, 0x10
call sym.unk_85
mov edx, 1
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [0x41a724]
mov dword [esp + 4], 0x45f
mov dword [esp], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x4b0
call sym.unk_169
mov edx, dword [ebp - 0x3c]
sub esp, 0x10
test eax, eax
je 0x407d6e
jmp 0x407dc1
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x411794
mov dword [esp], eax
call sub.kernel32.dll_WriteFile
lea edx, [ebp - 0x24]
sub esp, 0x14
cmp dword [ebp - 0x24], 2
je 0x407d1f
mov dword [esp], edi
call sub.kernel32.dll_CloseHandle
xor edx, edx
sub esp, 4
jmp 0x407dc1
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 5
mov dword [esp + 0xc], 0x30
sete al
mov dword [esp + 8], 0x411978
movzx eax, al
add eax, 0x6ab
mov dword [esp + 4], eax
mov eax, dword [0x41a728]
mov dword [esp], eax
call sym.unk_175
xor edx, edx
sub esp, 0x10
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4080a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x4c
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call sub.kernel32.dll_CreateFileW
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x408250
mov esi, eax
lea eax, [ebp - 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x29]
mov dword [esp + 8], 5
mov dword [esp + 4], eax
mov dword [esp], esi
call sym.unk_193
sub esp, 0x14
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.kernel32.dll_SetFilePointer
mov eax, dword [ebp - 0x30]
sub esp, 0x10
cmp eax, 1
jbe 0x408240
cmp byte [ebp - 0x29], 0xff
je 0x408291
cmp eax, 4
jbe 0x408240
cmp dword [ebp - 0x29], 0x74725c7b
je 0x4082d0
mov edi, 1
mov eax, dword [0x411780]
cmp dword [ebp - 0x29], eax
je 0x4082e4
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], sym.unk_86
call sym.unk_66
mov eax, edi
call sym.unk_85
lea eax, [ebp - 0x24]
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
mov eax, dword [0x41a724]
mov dword [esp + 4], 0x449
mov dword [esp], eax
call sym.unk_169
sub esp, 0x10
mov dword [esp], esi
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x41a724]
sub esp, 4
mov dword [esp], eax
call sub.user32.dll_SetFocus
mov eax, ebx
sub esp, 4
call sym.unk_91
xor eax, eax
lea esi, [esi]
movzx edx, word [ebx + eax]
add eax, 2
mov word [eax + 0x41a4fe], dx
test dx, dx
jne 0x4081e0
mov eax, dword [0x41a724]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb9
mov dword [esp], eax
call sym.unk_169
mov eax, dword [0x41a728]
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.unk_59
call sym.unk_76
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 1
jmp 0x40817c
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 5
mov dword [esp + 0xc], 0x30
sete al
mov dword [esp + 8], 0x411978
movzx eax, al
add eax, 0x6ad
mov dword [esp + 4], eax
mov eax, dword [0x41a728]
mov dword [esp], eax
call sym.unk_175
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [ebp - 0x28], 0xfe
jne 0x408153
mov dword [esp + 0xc], 0
mov edi, 0x11
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], esi
call sub.kernel32.dll_SetFilePointer
sub esp, 0x10
jmp 0x40817c
cmp byte [ebp - 0x25], 0x66
mov edi, 2
jne 0x408169
jmp 0x40817c
mov dword [esp], esi
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x41a728]
mov ecx, 0x30
mov edx, 0x6aa
sub esp, 4
call sym.unk_94
jmp 0x408231