joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d2d5
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push ecx
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x41d52c
js 0x41d52c
shl eax, 2
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [ebp - 0xc], eax
or eax, eax
jne 0x41d30e
jmp 0x41d52c
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
push dword [esi + 0x1c]
pop dword [ebp - 0x10]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0
jmp 0x41d50f
mov ebx, 0
mov bl, byte [eax]
cmp bl, 0x20
jne 0x41d358
push dword [ebp - 4]
pop dword [ebp - 0x14]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
je 0x41d358
mov dword [esi + 0x24], 1
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
shl eax, 2
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
push eax
push dword [ebp - 8]
push dword [ebp - 8]
push dword [esi + 0x10]
call sub.GDI32.dll_GetCharWidth32A
or eax, eax
jne 0x41d37f
jmp 0x41d52c
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x2c]
push dword [ebx]
pop dword [ebp - 0x30]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x30]
lea eax, [eax + eax*2]
shr eax, 1
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 8]
sub eax, dword [ebp - 0x30]
cmp dword [ebp - 0x2c], eax
jbe 0x41d506
push dword [ebp - 0x18]
pop dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
cmp byte [eax], 0x20
je 0x41d3c4
cmp byte [eax + 1], 0x20
jne 0x41d3d9
push dword [ebp - 4]
pop dword [ebp - 0x18]
call fcn.0041d3eb
call fcn.0041d461
jmp 0x41d4e9
cmp dword [ebp - 0x14], 0
jbe 0x41d4c0
push dword [ebp - 0x14]
pop dword [ebp - 0x18]
jmp 0x41d44b
call fcn.0041d3eb
inc dword [ebp - 0x18]
push dword [ebp - 0x18]
pop dword [ebp - 0x1c]
push dword [ebp - 4]
pop dword [ebp - 0x18]
jmp 0x41d488
call fcn.0041d461
call fcn.0041d3eb
jmp 0x41d4be
jmp 0x41d4e9
push dword [ebp - 4]
pop dword [ebp - 0x18]
cmp dword [esi + 0x24], 1
jne 0x41d4df
call fcn.0041d461
call fcn.0041d3eb
mov dword [esi + 0x24], 0
jmp 0x41d4e9
call fcn.0041d3eb
call fcn.0041d461
inc dword [ebp - 0x18]
mov dword [ebp - 0x14], 0
push dword [esi + 0x1c]
pop dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0
jne 0x41d506
mov dword [esi + 0x24], 0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, dword [ebp + 0xc]
cmp byte [eax], 0
jne 0x41d337
push dword [ebp - 0x18]
pop dword [ebp - 0x1c]
push dword [ebp - 4]
pop dword [ebp - 0x18]
dec dword [ebp - 0x18]
call fcn.0041d3eb
Function at 0x41da56
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push ebx
push esi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x41d915
push dword [ebp + 0xc]
lea eax, [edi + 0x28]
push eax
call fcn.0041dd27
or eax, eax
jne 0x41da7f
jmp 0x41dc1c
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041dcaa
or eax, eax
jne 0x41da9c
jmp 0x41dc1c
mov ebx, eax
mov dword [ebx + 0x14], 0x23
push 0x40
push 0x1000
push 0x30
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41dabe
jmp 0x41dc1c
mov dword [ebx + 0x3c], eax
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [esi + 0x28]
call fcn.0042dc70
mov dword [ebp - 0xc], ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041dcaa
or eax, eax
jne 0x41daec
jmp 0x41dc1c
mov ebx, eax
mov dword [ebx + 0x14], 0x64
mov eax, dword [ebx + 0xc]
add eax, dword [edi + 0x5c]
sub eax, dword [ebx + 0x14]
mov dword [ebx + 0xc], eax
push 0x40
push 0x1000
push 0x30
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41db1a
jmp 0x41dc1c
mov dword [ebx + 0x3c], eax
mov dword [ebp - 8], eax
push str.Page
push dword [ebx + 0x3c]
call sub.KERNEL32.dll_lstrcpyA
push str.Page
call sub.KERNEL32.dll_lstrlenA
add dword [ebp - 8], eax
push dword [ebp - 8]
push dword [esi + 0xc]
call fcn.0042dc70
mov dword [ebx + 0x38], 1
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041dcaa
or eax, eax
jne 0x41db69
jmp 0x41dc1c
mov ebx, eax
push ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 0x14]
pop ebx
mov dword [ebx + 0xc], eax
push ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
pop ebx
sub eax, dword [ebx + 0xc]
mov dword [ebx + 0x14], eax
push dword [edi + 0x1c]
pop dword [ebx + 0x44]
push dword [edi + 0x20]
pop dword [ebx + 0x48]
push esi
call fcn.0041dc23
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x40], 1
cmp dword [esi + 0x2c], 1
jne 0x41dbb2
mov dword [ebx + 0x68], 0x8000ff
jmp 0x41dbb9
mov dword [ebx + 0x68], 0xff0000
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x5c], 0x3b8
mov dword [ebx + 0x60], 3
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041dcaa
or eax, eax
jne 0x41dbe5
jmp 0x41dc1c
mov ebx, eax
push ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
pop ebx
mov dword [ebx + 0x10], eax
push dword [edi + 0x5c]
pop dword [ebx + 0x14]
push dword [edi + 0x64]
pop dword [ebx + 0x18]
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
mov dword [edi + 0x54], eax
push dword [edi + 0x1c]
pop dword [ebx + 0x44]
push dword [edi + 0x20]
pop dword [ebx + 0x48]
push dword [esi + 0x1c]
pop dword [ebx + 0x3c]
pop esi
pop ebx
pop edi
leave
ret 0xc
Function at 0x41dc23
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], 0
mov eax, dword [edi + 0x20]
sub eax, 0x14
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x20]
add eax, dword [edi + 0x24]
add eax, 0x14
mov dword [ebp - 8], eax
push dword [edi + 0x1c]
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0xc], eax
push dword [edi + 0x1c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0041d24d
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jae 0x41dc71
jmp 0x41dca2
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41dc8d
jmp 0x41dca2
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 0x1c]
add eax, dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push eax
call fcn.0042e300
mov eax, dword [ebp - 0x10]
pop edi
leave
ret 4

Function at 0x41dd5e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push edi
push ebx
push esi
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x41d915
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call fcn.0041dd27
or eax, eax
jne 0x41dd86
jmp 0x41deae
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041dcaa
or eax, eax
jne 0x41dda3
jmp 0x41deae
mov ebx, eax
mov dword [ebx + 0x14], 0x41
lea eax, str.Previous
mov dword [ebx + 0x3c], eax
mov dword [ebp - 0xc], ebx
mov dword [ebx + 0x68], 0xff0000
mov dword [ebx + 0x6c], 1
push dword [ebp + 0x18]
pop dword [ebx + 0x5c]
mov dword [ebx + 0x60], 1
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041dcaa
or eax, eax
jne 0x41dded
jmp 0x41deae
mov ebx, eax
mov dword [ebx + 0x14], 0x3c
mov eax, dword [ebx + 0xc]
add eax, dword [edi + 0x5c]
sub eax, dword [ebx + 0x14]
mov dword [ebx + 0xc], eax
lea eax, str.Next
mov dword [ebx + 0x3c], eax
mov dword [ebx + 0x68], 0xff0000
mov dword [ebx + 0x6c], 1
mov dword [ebx + 0x38], 1
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x1c]
pop dword [ebx + 0x5c]
mov dword [ebx + 0x60], 2
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041dcaa
or eax, eax
jne 0x41de47
jmp 0x41deae
mov ebx, eax
push ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebx + 0xc]
add eax, dword [ebx + 0x14]
pop ebx
mov dword [ebx + 0xc], eax
push ebx
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebx + 0xc]
pop ebx
sub eax, dword [ebx + 0xc]
mov dword [ebx + 0x14], eax
push 0x40
push 0x1000
push 0x80
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41de7e
jmp 0x41deae
mov dword [ebx + 0x3c], eax
push dword [ebp + 0x20]
push dword [ebx + 0x3c]
call sub.KERNEL32.dll_lstrcpyA
push dword [ebx + 0x3c]
call sub.KERNEL32.dll_lstrlenA
add eax, dword [ebx + 0x3c]
push eax
push dword [ebp + 0x24]
call fcn.0042dc70
mov dword [ebx + 0x40], 1
mov dword [ebx + 0x38], 2
pop esi
pop ebx
pop edi
leave
ret 0x20
Function at 0x41e0d5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push edi
mov edi, dword [ebp + 8]
push dword [edi + 0x28]
call fcn.0041b952
push 0xc
lea eax, [edi + 0x28]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [edi + 0x44], 0
cmp dword [edi + 0x34], 0
jne 0x41e105
push dword [edi + 8]
pop dword [edi + 0x34]
cmp dword [0x4430e4], 0
jne 0x41e14a
lea eax, [ebp - 0x18]
push eax
push dword [edi + 0x48]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
push dword [ebp - 0x10]
pop dword [0x4430e4]
push dword [ebp - 0x10]
pop dword [0x4430dc]
push dword [ebp - 0xc]
pop dword [0x4430e8]
push dword [ebp - 0xc]
pop dword [0x4430e0]
cmp dword [0x4430ec], 0
jne 0x41e15d
mov dword [0x4430ec], 5
push dword [ebp + 8]
call fcn.0041deb5
push dword [edi + 0x40]
push dword [ebp + 8]
call fcn.0041e64c
cmp eax, dword [0x4430e0]
jb 0x41e17f
mov dword [0x4430e0], eax
jmp 0x41e1b3
mov dword [ebp - 4], 0
jmp 0x41e19d
mov dword [ebp - 4], 1
inc dword [edi + 0x40]
push dword [edi + 0x40]
push dword [ebp + 8]
call fcn.0041e64c
cmp eax, 0
jbe 0x41e1aa
cmp eax, dword [0x4430e0]
jbe 0x41e188
cmp dword [ebp - 4], 1
jne 0x41e1b3
dec dword [edi + 0x40]
push dword [ebp + 8]
call fcn.0041d997
cmp dword [edi + 0x30], 1
ja 0x41e1d3
cmp dword [edi + 0xec], 0
jbe 0x41e1e9
cmp dword [0x4430ec], 5
jbe 0x41e1e9
push 4
push dword [ebp + 8]
call fcn.0041e64c
cmp eax, 0
jbe 0x41e226
mov dword [0x4430e8], eax
jmp 0x41e226
cmp dword [0x4430ec], 5
ja 0x41e1f8
cmp dword [edi + 0x20], 0
jbe 0x41e21a
push 1
push dword [ebp + 8]
call fcn.0041e64c
cmp eax, 0
jbe 0x41e20c
mov dword [0x4430e8], eax
push dword [0x4430e8]
pop dword [0x4430e0]
jmp 0x41e226
push dword [0x4430e8]
pop dword [0x4430e0]
push dword [edi + 0x28]
push dword [ebp + 8]
call fcn.0041e2e1
push 1
push dword [edi + 0x48]
call fcn.0041e85d
lea eax, [ebp - 0x18]
push eax
push dword [edi + 0x48]
call sub.USER32.dll_GetClientRect
push dword [0x4430ec]
pop dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x10], eax
push dword [0x4430cc]
pop dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
sub eax, 5
mov dword [ebp - 0xc], eax
push 0x4ed
push dword [edi + 0x48]
call sub.USER32.dll_GetDlgItem
mov dword [ebp - 8], eax
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 8]
call sub.USER32.dll_MoveWindow
push 5
push dword [ebp - 8]
call sub.USER32.dll_ShowWindow
mov eax, 5
shr eax, 1
sub eax, dword [ebp - 0xc]
neg eax
add eax, dword [ebp - 0x14]
sub eax, dword [edi + 0x60]
mov dword [edi + 0xfc], eax
cmp dword [edi + 0x30], 0
jbe 0x41e2c5
cmp dword [edi + 0x20], 0
ja 0x41e2ce
cmp dword [0x4430ec], 5
jbe 0x41e2dc
push dword [edi + 0xfc]
push dword [edi + 0x2c]
call fcn.0041ebd0
pop edi
leave
ret 4
Function at 0x41e31c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push dword [ebp + 0xc]
pop dword [ebp - 4]
push dword [ebp + 0x10]
pop dword [ebp - 0xc]
push dword [ebp - 4]
call sub.KERNEL32.dll_lstrlenA
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41e361
jmp 0x41e3c0
mov dword [ebp - 8], eax
push eax
push dword [ebp - 4]
push eax
call sub.KERNEL32.dll_lstrcatA
pop dword [ebp - 4]
push dword [ebp - 4]
call sub.USER32.dll_CharLowerA
push dword [ebp - 0xc]
call sub.KERNEL32.dll_lstrlenA
inc eax
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41e397
jmp 0x41e3c0
mov dword [ebp - 0x10], eax
push eax
push dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_lstrcatA
pop dword [ebp - 0xc]
push dword [ebp - 0xc]
call sub.USER32.dll_CharLowerA
push dword [ebp - 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0040d6fd
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
je 0x41e3d5
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_VirtualFree
cmp dword [ebp - 0x10], 0
je 0x41e3ea
push 0x8000
push 0
push dword [ebp - 0x10]
call sub.KERNEL32.dll_VirtualFree
mov eax, dword [ebp - 0x14]
leave
ret 0xc
Function at 0x41e6b6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push 0xfffffffffffffff4
push dword [ebp + 8]
call sub.USER32.dll_GetWindowLongA
mov dword [ebp - 4], eax
test dword [ebp + 0xc], 1
je 0x41e70f
cmp dword [ebp - 4], 0x44c
jbe 0x41e70f
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetWindowRect
push dword [ebp + 8]
call sub.USER32.dll_GetParent
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push 0
call sub.USER32.dll_MapWindowPoints
push dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.USER32.dll_SetWindowLongA
test dword [ebp + 0xc], 2
je 0x41e734
cmp dword [ebp - 4], 0x44c
jae 0x41e734
cmp dword [ebp - 4], 0x384
jb 0x41e734
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
test dword [ebp + 0xc], 4
je 0x41e759
cmp dword [ebp - 4], 0x44c
jae 0x41e759
cmp dword [ebp - 4], 0x384
jb 0x41e759
push 5
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
test dword [ebp + 0xc], 8
je 0x41e79f
cmp dword [ebp - 4], 0x44c
jbe 0x41e78c
cmp dword [ebp - 4], 0x4f1
jne 0x41e780
push 0
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
jmp 0x41e79f
push 0x10
push dword [ebp + 8]
call fcn.0041e6b6
jmp 0x41e79f
cmp dword [ebp - 4], 0x384
jb 0x41e79f
push 4
push dword [ebp + 8]
call fcn.0041e6b6
test dword [ebp + 0xc], 0x20
je 0x41e7e3
cmp dword [ebp - 4], 0x44c
jbe 0x41e7d0
cmp dword [ebp - 4], 0x4f1
jne 0x41e7c4
push 5
push dword [ebp + 8]
call sub.USER32.dll_ShowWindow
push 0x10
push dword [ebp + 8]
call fcn.0041e6b6
jmp 0x41e7e3
cmp dword [ebp - 4], 0x384
jb 0x41e7e3
push 2
push dword [ebp + 8]
call fcn.0041e6b6
test dword [ebp + 0xc], 0x10
je 0x41e854
cmp dword [ebp - 4], 0x44c
jbe 0x41e854
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x18]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
sub dword [ebp - 0xc], eax
push dword [ebp + 8]
call sub.USER32.dll_GetParent
mov dword [ebp - 8], eax
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
push 0
call sub.USER32.dll_MapWindowPoints
push 0xffffffffffffffeb
push dword [ebp + 8]
call sub.USER32.dll_GetWindowLongA
add eax, dword [0x4430ec]
sub eax, 5
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call sub.USER32.dll_MoveWindow
mov eax, 1
leave
ret 8
Function at 0x41ec0e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
mov esi, dword [ebp + 8]
push 0x18
push esi
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [esi], 9
push dword [ebp + 0xc]
pop dword [esi + 4]
lea eax, [0x41edd7]
mov dword [esi + 8], eax
lea eax, [0x41eed7]
mov dword [esi + 0xc], eax
lea eax, [0x41ef80]
mov dword [esi + 0x10], eax
mov eax, 0x34
mov dword [ebp - 4], eax
mul dword [esi]
push 0x40
push 0x1000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
je 0x41ed85
mov dword [esi + 0x14], eax
mov edi, dword [esi + 0x14]
mov dword [edi], 0x4ec
mov dword [edi + 0x1c], 0x14
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x3e8
mov dword [edi + 0x1c], 0x15
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x4ef
mov dword [edi + 0x1c], 0xc
mov dword [edi + 0x20], 0xd
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x4ee
mov dword [edi + 0x1c], 0xe
mov dword [edi + 0x20], 0xf
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x4f1
mov dword [edi + 0x1c], 0xa
mov dword [edi + 0x20], 0xb
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x3ea
mov dword [edi + 0x1c], 0x10
mov dword [edi + 0x20], 0x11
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x4f2
mov dword [edi + 0x1c], 0x12
mov dword [edi + 0x20], 0x13
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x4f3
mov dword [edi + 4], 1
mov dword [edi + 8], 0xcccccc
push dword [esi + 4]
push edi
call fcn.0041ed8f
add edi, dword [ebp - 4]
mov dword [edi], 0x3eb
mov dword [edi + 0x1c], 0x16
mov dword [edi + 0x20], 0x17
mov dword [edi + 4], 2
push dword [esi + 4]
push edi
call fcn.0041ed8f
push esi
call dword [esi + 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x41f47a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push edi
push edx
push esi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x74], 0
je 0x41f5f6
cmp dword [edi + 0x78], 0
je 0x41f5f6
push dword [ebp + 8]
call fcn.0041f5fd
or eax, eax
je 0x41f4ae
jmp 0x41f5f6
push 0x40
push 0x1000
push dword [edi + 0x78]
push 0
call sub.KERNEL32.dll_VirtualAlloc
or eax, eax
jne 0x41f4c8
jmp 0x41f5f6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
push 0x144
lea eax, [ebp - 0x160]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
mov dword [ebp - 8], 0xc
mov dword [ebp - 4], 1
mov eax, dword [edi + 0xec]
jmp 0x41f549
push dword [ebp - 4]
lea eax, [edi + 0xe8]
push eax
call fcn.0040c927
or eax, eax
je 0x41f540
mov dword [ebp - 0xc], eax
mov al, byte [eax]
cmp al, 0x5a
ja 0x41f519
cmp al, 0x41
jb 0x41f519
sub al, 0x41
jmp 0x41f527
cmp al, 0x7a
ja 0x41f525
cmp al, 0x61
jb 0x41f525
sub al, 0x61
jmp 0x41f527
mov al, 0x1a
and eax, 0xff
mul dword [ebp - 8]
lea edx, [ebp - 0x160]
add eax, edx
push dword [ebp - 0xc]
push eax
call fcn.0040c8d4
inc dword [ebp - 4]
mov eax, dword [edi + 0xec]
cmp dword [ebp - 4], eax
jbe 0x41f4f5
mov eax, 0x1b
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
jmp 0x41f5dc
mov eax, dword [ebp - 4]
mul dword [ebp - 8]
lea edx, [ebp - 0x160]
add eax, edx
mov esi, eax
mov dword [ebp - 0x10], 1
mov eax, dword [esi + 4]
jmp 0x41f5bf
inc dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
call fcn.0040c927
or eax, eax
je 0x41f5b9
mov dword [ebp - 0x1c], eax
push eax
push dword [ebp - 0x18]
call sub.KERNEL32.dll_lstrcpyA
push dword [ebp - 0x18]
push dword [ebp - 0xc]
lea eax, [edi + 0xe8]
push eax
call fcn.0040c8a8
push dword [ebp - 0x1c]
call sub.KERNEL32.dll_lstrlenA
inc eax
add dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
mov eax, dword [esi + 4]
cmp dword [ebp - 0x10], eax
jbe 0x41f57f
push esi
call fcn.0040c818
mov eax, dword [ebp - 4]
push dword [ebp - 0xc]
pop dword [edi + eax*4 + 0x7c]
inc dword [ebp - 4]
mov eax, 0x1b
cmp dword [ebp - 4], eax
jb 0x41f563
push 0x8000
push 0
push dword [edi + 0x74]
call sub.KERNEL32.dll_VirtualFree
push dword [ebp - 0x14]
pop dword [edi + 0x74]
pop esi
pop edx
pop edi
leave
ret 4
Function at 0x4207ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
call fcn.00420749
or eax, eax
je 0x4208f3
mov dword [ebp - 0x414], eax
push 0x104
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x4415ad
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_lstrcatA
push dword [0x443070]
push 0
call fcn.0040c1be
mov dword [ebp - 0x418], eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_GetBinaryTypeA
or eax, eax
jne 0x4208f3
push dword [0x451ad8]
push 7
call fcn.0040c1be
mov dword [ebp - 0x41c], eax
inc dword [ebp - 0x414]
push dword [0x443070]
push dword [ebp - 0x414]
call fcn.0040c1be
push 4
push dword [ebp - 0x41c]
push eax
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x4208f3
push dword [0x443078]
push 3
call fcn.0040c1be
push dword [0x443078]
push dword [ebp + 8]
push eax
call fcn.004208f7
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_GetBinaryTypeA
or eax, eax
jne 0x4208f3
push dword [0x451ad8]
push 7
call fcn.0040c1be
mov dword [ebp - 0x41c], eax
push dword [0x443078]
push 9
call fcn.0040c1be
push 4
push dword [ebp - 0x41c]
push eax
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x4208f3
jmp 0x420888
leave
ret 4
Function at 0x4208f7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
mov dword [ebp - 0x2b8], 0
lea eax, [ebp - 0x2a5]
push eax
lea eax, [ebp - 0x2b8]
push eax
push str.DWB_Temp_File_Temp_u.tmp
call fcn.00425e39
cmp eax, 0xffffffff
je 0x4209da
mov dword [ebp - 0x38], eax
push 0x14
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp + 0x10]
push 5
call fcn.0040c1be
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x10]
push 6
call fcn.0040c1be
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2b0], eax
push dword [ebp + 0xc]
pop dword [ebp - 0x2c]
lea eax, [ebp - 0xa5]
push eax
push 2
push 0
push dword [ebp + 8]
call fcn.004255cb
push eax
or eax, eax
jne 0x4209b2
push dword [ebp + 0x10]
push 7
call fcn.0040c1be
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2a5]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp - 0x2b4]
push eax
push 0x4209de
push dword [ebp + 0xc]
push str.PostPrgsDlg
push dword [0x44115c]
call sub.USER32.dll_DialogBoxParamA
lea eax, [ebp - 0x2a5]
push eax
call sub.KERNEL32.dll_DeleteFileA
pop eax
or eax, eax
je 0x4209da
push 0
push 0x441c6b
push str.The_DNL_Reader_needs_to_install_extensions_to_properly_run_this_Digital_Web_r_nBook._It_is_unable_to_do_this_at_present._Some_of_the_possible_reasons_are:_r_n_r_n1._This_computer_may_not_be_connected_to_the_Internet_or_you_may_be_r_nexperiencing_network_problems._r_n_r_n2._Your_firewall_software_may_not_be_prompting_you_to_give_you_a_choice_to_r_ndownload_the_extension_the_DNL_reader_requires_to_use_this_Digital_Web_Book._r_n_r_nPossible_solution:_r_nA._Temporarily_switch_off_the_firewall_to_allow_this_program_to_access_the_r_nInternet._r_nB._Configure_your_firewall_to_allow_the_DNL_reader_to_access_the_Internet._r_n_r_n3._If_you_are_using_a_proxy_server_or_external_gateway__please_ensure_that_r_nit_is_correctly_configured._If_you_are_connecting_to_the_internet_using_a_r_ncorporate_network__please_ask_your_network_administrator_for_help._r_n
push dword [0x441160]
call sub.USER32.dll_MessageBoxA
leave
ret 0xc

Function at 0x420b2a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebp + 0x18], 2
je 0x420b77
push 0
push 0x80
push dword [ebp + 0xc]
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x420bb3
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 3
jne 0x420b6d
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
pop eax
jmp 0x420bb3
cmp dword [ebp + 0x18], 4
jne 0x420b7d
jmp 0x420bb3
push dword [ebp + 0xc]
pop dword [ebp - 4]
cmp dword [ebp + 0x18], 1
jne 0x420b91
push 0
push 0
push 1
push dword [ebp - 4]
call sub.KERNEL32.dll_SetNamedPipeHandleState
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp + 0x18], 2
je 0x420bb3
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
leave
ret 0x14