joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412b68
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x412c31
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x412b9f
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00406ddc
mov esi, eax
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00406eb0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e58
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e58
cmp byte [ebp - 5], 0x4d
jne 0x412c0e
cmp byte [ebp - 6], 0x5a
jne 0x412c0e
xor ecx, ecx
mov edx, pe_nt_image_headers32
mov eax, esi
call fcn.00406eb0
lea edx, [ebp - 5]
mov ecx, 1
mov eax, esi
call fcn.00406e58
lea edx, [ebp - 6]
mov ecx, 1
mov eax, esi
call fcn.00406e58
cmp byte [ebp - 5], 0x50
jne 0x412c0e
cmp byte [ebp - 6], 0x45
jne 0x412c0e
mov bl, 1
cmp dword [ebp - 4], 0
je 0x412c1b
mov eax, esi
call fcn.00406ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412c38
lea eax, [ebp - 4]
call fcn.004041cc
ret

Function at 0x412c40
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x412d79
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
xor eax, eax
mov dword [ebp - 8], eax
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00406ddc
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ebx, eax
cmp ebx, 0x3200000
jle 0x412ca5
mov dword [ebp - 8], 0x4d2
jmp 0x412d5b
xor eax, eax
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
xor eax, eax
call fcn.00412b68
test al, al
je 0x412ce0
xor ecx, ecx
mov edx, 0xfc
mov eax, dword [ebp - 0xc]
call fcn.00406eb0
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.00406e58
cmp dword [ebp - 0x10], 0
jle 0x412ce0
mov ebx, dword [ebp - 0x10]
sub ebx, esi
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00406eb0
cmp dword [ebp - 0x10], 0
jle 0x412d09
sub ebx, 0x200
xor ecx, ecx
mov edx, 0x200
mov eax, dword [ebp - 0xc]
call fcn.00406eb0
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
mov eax, dword [ebp - 0xc]
call fcn.00406e58
mov ecx, eax
mov edx, ecx
test edx, edx
jns 0x412d27
add edx, 3
sar edx, 2
test edx, edx
jle 0x412d47
lea eax, [ebp - 0x1010]
sub ebx, 4
cmp ebx, 4
jle 0x412d41
mov esi, dword [eax]
add dword [ebp - 8], esi
add eax, 4
dec edx
jne 0x412d34
cmp ebx, 4
jle 0x412d53
add dword [ebp - 8], 0x4d2
cmp ecx, 0x1000
jge 0x412d09
mov eax, dword [ebp - 0xc]
call fcn.00406ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412d80
lea eax, [ebp - 4]
call fcn.004041cc
ret
Function at 0x412d8c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x412e10
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004046d0
mov eax, dword [ebp - 0x18]
call fcn.00404670
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x412df2
mov ebx, dword [ebp - 8]
imul ebx, dword [ebp - 0xc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e17
lea eax, [ebp - 0x18]
call fcn.004041cc
lea eax, [ebp - 4]
call fcn.004041cc
ret

Function at 0x413ae0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x413bab
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.004041cc
mov eax, dword [ebp - 4]
call fcn.00406f2c
test al, al
je 0x413b95
mov edx, 0x40
mov eax, dword [ebp - 4]
call fcn.00406ddc
mov esi, eax
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
test ebx, ebx
jne 0x413b3f
mov ebx, dword [ebp - 8]
sub ebx, edi
jmp 0x413b4d
mov edx, dword [ebp - 8]
sub edx, edi
mov eax, ebx
call fcn.0040b4dc
mov ebx, eax
test edi, edi
jl 0x413b8e
cmp edi, dword [ebp - 8]
jge 0x413b8e
test ebx, ebx
jle 0x413b8e
xor ecx, ecx
mov edx, edi
mov eax, esi
call fcn.00406eb0
mov eax, dword [ebp + 8]
mov edx, ebx
call fcn.004047fc
mov eax, dword [ebp + 8]
call fcn.004046c8
mov edx, eax
mov ecx, ebx
mov eax, esi
call fcn.00406e58
cmp ebx, eax
je 0x413b8e
mov eax, dword [ebp + 8]
call fcn.004041cc
mov eax, esi
call fcn.00406ebc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413bb2
lea eax, [ebp - 4]
call fcn.004041cc
ret
Function at 0x413f30
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x41401e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0xbff00000
cmp byte [0x425bb0], 0xff
jne 0x413f86
mov byte [0x425bb0], 0
mov edx, 0x414038
mov eax, 0x414054
call fcn.0040b45c
test eax, eax
je 0x413f86
mov byte [0x425bb0], 1
cmp byte [0x425bb0], 0
sete dl
lea eax, [ebp - 4]
call fcn.00413ea0
mov ebx, eax
cmp byte [0x425bb0], 1
jne 0x413fc4
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
mov eax, dword [0x425d7c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x414008
fild qword [ebp - 0x20]
fstp qword [ebp - 0x10]
wait
jmp 0x414008
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x414008
mov eax, dword [ebp - 0x24]
imul dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fstp qword [ebp - 0x10]
wait
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild qword [ebp - 0x38]
fmul qword [ebp - 0x10]
fstp qword [ebp - 0x10]
wait
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414025
lea eax, [ebp - 4]
call fcn.004041cc
ret
Function at 0x4145b4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
lea eax, [ebp - 0x160]
mov edx, dword [0x406100]
call fcn.004049c0
xor eax, eax
push ebp
push 0x41471c
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004072e8
cmp dword [ebp - 8], 0
je 0x414616
lea eax, [ebp - 8]
mov edx, 0x414738
call fcn.00404478
lea ecx, [ebp - 0x160]
mov edx, 0x27
mov eax, ebx
call fcn.00407104
test eax, eax
jne 0x4146da
xor eax, eax
push ebp
push 0x414678
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 1], 0
je 0x41466e
push 0x80
lea eax, [ebp - 0x164]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.004044bc
mov eax, dword [ebp - 0x164]
call fcn.00404670
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414682
xor eax, eax
push ebp
push 0x4146bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x168]
mov ecx, dword [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.004044bc
mov eax, dword [ebp - 0x168]
call fcn.00407194
mov byte [ebp - 2], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4146c7
lea eax, [ebp - 0x160]
call fcn.00407154
test eax, eax
je 0x414630
lea eax, [ebp - 0x160]
call fcn.00407178
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414723
lea eax, [ebp - 0x168]
mov edx, 2
call fcn.004041f0
lea eax, [ebp - 0x160]
mov edx, dword [0x406100]
call fcn.00404a84
lea eax, [ebp - 8]
call fcn.004041cc
ret
Function at 0x414954
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x41495c
push ecx
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x414b08
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x20]
mov al, 1
call fcn.0040cd44
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 8]
mov ecx, 0x414b1c
call fcn.004044bc
lea eax, [ebp - 0x18]
mov edx, 0x414b34
call fcn.00404264
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00413bbc
lea eax, [ebp - 0x1c]
mov edx, 0x414b44
call fcn.00404264
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404264
lea eax, [ebp - 0x10]
call fcn.0040cbc0
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.0040cbd0
cmp byte [ebp - 1], 0
je 0x414a2a
lea eax, [ebp - 0x1c]
call fcn.004041cc
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004073b0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.00404264
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x10]
call fcn.004073b0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
call fcn.00404264
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
call fcn.004073b0
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
call fcn.00404264
lea eax, [ebp - 0x18]
mov edx, 0x414b50
call fcn.00404264
push dword [ebp - 0x18]
push 0x414b64
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0x414b74
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404530
push dword [ebp - 0x18]
push 0x414b80
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0x414b94
push 0x414b74
lea eax, [ebp - 0x18]
mov edx, 7
call fcn.00404530
test bl, bl
je 0x414aa9
push dword [ebp - 0x18]
push 0x414ba8
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 0x414b74
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404530
push dword [ebp - 0x18]
push 0x414b64
push dword [ebp - 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x1c]
push 0x414b74
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404530
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00413bbc
push 0
mov eax, dword [ebp - 8]
call fcn.00404670
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414b0f
lea eax, [ebp - 0x2c]
mov edx, 0xa
call fcn.004041f0
ret
Function at 0x414bac
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x414d67
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x414d3a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, 1
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004046d0
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00406b8c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov ecx, 0x414d80
call fcn.004044bc
mov eax, dword [ebp - 0x10]
mov al, byte [eax]
add al, 0xbf
sub al, 0x1a
jae 0x414d30
mov eax, dword [ebp - 0x10]
call fcn.00404670
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x414d30
push 0x414d8c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x10]
mov dl, byte [edx]
call fcn.00404398
push dword [ebp - 0x1c]
push 0x414d9c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404530
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
mov eax, dword [ebp - 0x10]
call fcn.00404670
mov esi, eax
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
mov edx, 0x414da8
call fcn.0040488c
mov edx, dword [ebp - 0x10]
call fcn.0040488c
mov dl, 0x20
call fcn.00402fb0
call fcn.00404dc8
call fcn.004030f4
cmp ebx, 0xffffffff
jne 0x414cd5
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call sub.kernel32.dll_CreateFileA_1
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x425d38]
mov edx, 0x414dbc
call fcn.0040488c
mov edx, dword [ebp - 0x10]
call fcn.0040488c
mov dl, 0x20
call fcn.00402fb0
call fcn.00404dc8
call fcn.004030f4
cmp ebx, 0xffffffff
je 0x414d30
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
push 0
push 0x2d4808
push ebx
call sub.kernel32.dll_DeviceIoControl
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x414d44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414d6e
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.004041f0
lea eax, [ebp - 4]
call fcn.004041cc
ret
Function at 0x4186bc
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, ecx
mov edi, edx
mov dword [esp], eax
xor ebp, ebp
test esi, esi
jbe 0x418741
mov ebx, 1
mov edx, 0x10000
mov eax, esi
call fcn.0040b4dc
mov dword [esp + 4], eax
push 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, edi
call fcn.004046c8
lea eax, [eax + ebx - 1]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x41870e
or ebp, 0xffffffff
add ebx, dword [esp + 8]
sub esi, dword [esp + 8]
xor eax, eax
call fcn.0040bdec
cmp ebp, 0xffffffff
je 0x41872d
mov eax, dword [edi]
call fcn.00404470
cmp ebx, eax
jle 0x4186d5
mov eax, dword [edi]
call fcn.00404470
cmp ebx, eax
jle 0x418741
mov eax, dword [edi]
call fcn.00404470
mov ebp, eax
mov eax, ebp
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x419488
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x419669
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x425c08], 0
jne 0x419637
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x38
call fcn.00402d2c
mov bl, 0x43
lea esi, [ebp - 0x50]
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404398
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x18]
mov ecx, 0x419680
call fcn.004044bc
mov eax, dword [ebp - 0x18]
call fcn.00404670
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x4195a0
lea eax, [ebp - 0x10]
mov ecx, 0x41968c
mov edx, dword [ebp - 0x18]
call fcn.004044bc
mov eax, dword [ebp - 0x10]
call fcn.00406f3c
test al, al
je 0x419554
push dword [ebp - 0x10]
push 0x41969c
push 0
push 0x2710
push 0
push 0x186a0
lea eax, [ebp - 0x58]
call fcn.0040b4fc
push dword [ebp - 0x58]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404530
mov eax, dword [ebp - 0x10]
call fcn.00406f60
lea eax, [ebp - 0x14]
mov ecx, 0x4196ac
mov edx, dword [ebp - 0x10]
call fcn.004044bc
push 0
push 0
xor ecx, ecx
mov edx, 0x4196c0
mov eax, dword [ebp - 0x14]
call fcn.00413bbc
mov eax, dword [ebp - 0x14]
call fcn.00406f2c
test al, al
je 0x419596
mov eax, dword [ebp - 0x10]
call fcn.00413f30
fstp qword [esi]
wait
xor edx, edx
mov eax, dword [ebp - 0x10]
call fcn.0041473c
inc ebx
add esi, 8
cmp bl, 0x46
jne 0x4194d9
lea edx, [ebp - 0x60]
mov al, 1
call fcn.0040cd44
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00406b8c
mov eax, dword [ebp - 0x5c]
mov dl, byte [eax]
mov byte [ebp - 9], dl
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov bl, 0x43
lea ecx, [ebp - 0x50]
fld qword [ecx]
fcomp qword [ebp - 8]
fnstsw ax
sahf
jbe 0x4195ef
mov eax, dword [ecx]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
mov byte [ebp - 9], bl
inc ebx
add ecx, 8
cmp bl, 0x46
jne 0x4195d7
cmp dl, byte [ebp - 9]
je 0x419637
lea eax, [ebp - 0x64]
mov dl, byte [ebp - 9]
call fcn.00404398
mov edx, dword [ebp - 0x64]
mov eax, 0x425c08
mov ecx, 0x4196cc
call fcn.004044bc
mov eax, dword [0x425c08]
call fcn.00406f3c
test al, al
je 0x419637
mov eax, 0x425c08
mov edx, 0x41969c
call fcn.00404478
cmp dword [0x425c08], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419670
lea eax, [ebp - 0x64]
mov edx, 5
call fcn.004041f0
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004041f0
ret
Function at 0x41db20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404660
xor eax, eax
push ebp
push 0x41dba1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
call fcn.0040cae4
test al, al
je 0x41db5c
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041d1ac
jmp 0x41db67
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.0041cf04
test eax, eax
je 0x41db8b
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dba8
lea eax, [ebp - 4]
call fcn.004041cc
ret
Function at 0x42141c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4214c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x425dcc]
cmp dword [eax], 0
jg 0x4214a8
lea eax, [ebp - 0xc]
call fcn.0041a63c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x4214d8
call fcn.004044bc
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402820
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.004072b4
push dword [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [0x425d70]
mov eax, dword [eax]
call fcn.00413348
push dword [ebp - 0x18]
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404530
push 0
mov eax, dword [ebp - 8]
call fcn.00404670
push eax
call sub.kernel32.dll_WinExec
push 0
call sub.user32.dll_PostQuitMessage
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4214ca
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004041f0
ret
Function at 0x4220b4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov ebx, 0x46
mov esi, 0x14
mov edi, 0x154
mov ebp, 0x12
push ebx
push esi
push edi
push ebp
mov eax, dword [esp + 0x10]
push eax
push 0
mov eax, dword [0x426660]
push eax
push 0
mov edx, 0x4221dc
mov eax, 0x4221e0
mov ecx, 0x50000000
call fcn.00405d90
mov edx, dword [0x425e48]
mov dword [edx], eax
mov ebx, 0x46
mov esi, 0x26
mov edi, 0x188
mov ebp, 0xd
push 0x50000000
push ebx
push esi
push edi
push ebp
mov eax, dword [esp + 0x14]
push eax
push 0
mov eax, dword [0x426660]
push eax
push 0
mov edx, 0x4221e8
xor ecx, ecx
xor eax, eax
call fcn.00405d38
mov edx, dword [0x425d88]
mov dword [edx], eax
mov ebx, 0x1a0
mov esi, 0x14
mov edi, 0x2e
mov ebp, 0xd
push 0x40000000
push ebx
push esi
push edi
push ebp
mov eax, dword [esp + 0x14]
push eax
push 0
mov eax, dword [0x426660]
push eax
push 0
mov edx, 0x4221e8
xor ecx, ecx
xor eax, eax
call fcn.00405d38
mov edx, dword [0x425d2c]
mov dword [edx], eax
push 0
push 0x3e8
push 1
mov eax, dword [esp + 0xc]
push eax
call sub.user32.dll_SetTimer
mov edx, dword [0x425d58]
mov dword [edx], eax
push 0x4221fc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xfffffffffffffff5
call sub.gdi32.dll_CreateFontA
push 0
push eax
push 0x30
mov eax, dword [0x425e48]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x422380
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x422574
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, 0x42258c
call fcn.0040d2e8
test eax, eax
jl 0x4223be
neg eax
mov edx, dword [0x425de8]
mov dword [edx], eax
call sub.comctl32.dll_InitCommonControls
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x28
call fcn.00402d2c
mov dword [ebp - 0x50], 0x422274
mov eax, dword [0x426660]
mov dword [ebp - 0x44], eax
mov eax, dword [0x425cb8]
call fcn.00404670
mov dword [ebp - 0x30], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x3c], eax
push 0x422598
mov eax, dword [0x426660]
push eax
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x54], 8
lea eax, [ebp - 0x54]
push eax
call sub.user32.dll_RegisterClassA
mov esi, 0x1ec
mov edi, 0x6e
push 0
call sub.user32.dll_GetSystemMetrics
sub eax, esi
sar eax, 1
jns 0x42243a
adc eax, 0
mov dword [ebp - 4], eax
push 1
call sub.user32.dll_GetSystemMetrics
sub eax, edi
sar eax, 1
jns 0x42244d
adc eax, 0
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x2c80000
lea eax, [ebp - 0x58]
call fcn.0040cbc0
mov ecx, dword [ebp - 0x58]
mov dl, 1
mov eax, dword [0x412910]
call fcn.00412f88
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x4225ac
mov edx, 0x4225d0
mov eax, ebx
call fcn.0041365c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
push esi
push edi
push 0
push 0
mov eax, dword [0x426660]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.00404670
push eax
mov eax, dword [0x425cb8]
call fcn.00404670
mov edx, eax
xor eax, eax
pop ecx
call fcn.00405d38
mov edx, dword [0x425d0c]
mov dword [edx], eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.00413858
mov eax, dword [ebp - 0x5c]
push eax
mov eax, ebx
call fcn.00413760
push eax
mov eax, ebx
call fcn.004137d8
mov edx, eax
pop ecx
pop eax
call fcn.0040e0c8
mov eax, dword [0x425d0c]
cmp dword [eax], 0
je 0x42252a
push 0
mov eax, dword [0x425d0c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
jmp 0x422517
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_DispatchMessageA
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x422505
push 1
mov eax, dword [0x425d0c]
mov eax, dword [eax]
push eax
call sub.user32.dll_KillTimer
mov al, 1
call fcn.0041bf1c
call fcn.0041beec
xor edx, edx
mov eax, 0x2b
call fcn.0041b768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42257b
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.004041f0
lea eax, [ebp - 0x10]
call fcn.004041cc
ret
Function at 0x422804
Capabilities:
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
xor eax, eax
push ebp
push 0x4228e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402820
lea eax, [ebp - 0x10]
call fcn.00419300
push dword [ebp - 0x10]
push 0x4228f8
push 0x422904
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040733c
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 4
call fcn.00404530
push 0
mov eax, dword [ebp - 8]
call fcn.00404670
push eax
mov eax, dword [ebp - 4]
call fcn.00404670
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x18]
call fcn.0040cfb4
push dword [ebp - 0x18]
push 0x422910
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402820
push dword [ebp - 0x1c]
push 0x422938
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00404530
push 0
push dword [ebp - 8]
push 0x422948
push dword [ebp - 0xc]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404530
mov eax, dword [ebp - 0x20]
call fcn.00404670
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4228eb
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.004041f0
ret