joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f2c5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41f362
push ebx
push esi
call fcn.0041f28e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0041e00b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41f30f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f361
push edi
push eax
call fcn.0041a905
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41f32f
call fcn.00417121
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41f360
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0041e00b
add esp, 0x20
test eax, eax
jne 0x41f34e
push edi
call fcn.00417121
jmp 0x41f356
push ebx
call fcn.00417121
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4893bfc
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..text_1
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x24a63068
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401210
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
imul edi
ror esi, 0x18
sbb eax, 0x31
mov edx, 0xe7
ror eax, 0x7a
bswap edx
ror edx, 0x62
mov edi, 0x70
and esi, 0xbc
not edx
or esi, 0x24
mov edi, 0x43
mov edi, 0xd
bswap eax
neg edi
not edi
rcr ebx, 0x29
neg ebx
sbb edi, 0x7e
bswap ebx
or eax, 0x69
not esi
and esi, 0x3d
inc edi
bswap eax
rol edx, 0xea
rol eax, 0x2c
inc edi
sub eax, 0xe2
imul eax
imul edi
rcl edx, 0x83
sub edi, 0xb7
and esi, 0x65
not esi
inc eax
dec edx
inc edi
dec edi
sbb ebx, 0x95
ror edx, 0xcd
dec edx
bswap esi
or esi, 0x89
not edi
ror eax, 0xcf
bswap esi
sbb esi, 0x6d
rcr eax, 0xb2
mov esi, 0xc
xor ecx, ecx
xor edi, edi
add eax, 0x9c
mov esi, 0x5b
neg eax
rcl eax, 0xce
and edi, 0x66
bswap eax
not edx
inc eax
rcr edi, 0xca
and ebx, 0xeb
dec eax
sub edi, 0xec
imul esi
bswap edi
inc edx
sbb edx, 0xd4
imul ebx
ror eax, 0x81
mov edx, 0xb4
mov ebx, 0xa1
imul edx
rol eax, 0
sub edx, 0x1b
dec edx
imul eax
inc edx
ror ebx, 0xab
sbb eax, 0x45
rcr edx, 0xf4
inc ebx
inc edx
sbb ebx, 0x98
neg edx
inc ebx
neg ebx
mov edx, 0xde
rcr ebx, 0xe2
and eax, 0xc5
and eax, 0x45
neg eax
inc ebx
rcr eax, 0x43
imul edx
rol eax, 8
bswap edi
bswap edi
or edx, 0xf7
not esi
not edi
and eax, 2
mov ecx, dword [ebp + 0xc]
ror eax, 0x88
inc edi
neg edi
dec eax
bswap edi
or ebx, 8
neg ebx
bswap edx
neg edi
rol edi, 0x99
add ebx, 0xb
ror ebx, 0xea
bswap ebx
add eax, 0x2f
sub edi, 0xd8
sbb ebx, 0x8f
rcr edi, 0xc8
rcl esi, 0x15
imul esi
and edx, 0x7b
add eax, 0x68
inc ebx
ror eax, 0xce
rol edx, 0x4e
sbb eax, 0x50
inc edi
ror edx, 0xcd
imul edi
imul esi
add eax, 0x47
inc edi
dec edi
inc ebx
rcl esi, 0x8a
dec eax
neg edi
not eax
or edi, 0x46
sub edi, 0x13
inc eax
sbb edx, 0x19
imul eax
not edx
rcl ebx, 0xcd
neg eax
inc ebx
imul esi
rcr eax, 0x49
sub eax, 0x60
inc edi
mov edi, dword [ebp + 8]
mov esi, esi
mov ebx, esi
xor ebx, esi
not byte [edi]
xor esi, ebx
xor esi, esi
mov ebx, ebx
mov ebx, eax
mov ebx, esi
mov ebx, ebx
mov eax, ebx
mov ebx, eax
xor esi, eax
add byte [edi], 0x79
mov esi, esi
mov esi, ebx
xor ebx, esi
xor ebx, ebx
mov ebx, esi
mov esi, ebx
xor ebx, ebx
xor esi, ebx
mov eax, esi
sub byte [edi], 0x30
mov eax, eax
xor eax, ebx
xor eax, ebx
xor esi, eax
xor eax, ebx
mov ebx, eax
mov ebx, eax
mov eax, esi
xor eax, eax
imul byte [edi]
inc edi
loop 0x4013bc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x404f65
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x494800]
jne 0x404f6f
repz ret
jmp fcn.00407300
Function at 0x4055d5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404385
and dword [ebp - 4], 0
cmp dword [0x495990], 0
mov ebx, eax
jne 0x405686
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405737
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x405737
push eax
call fcn.00404313
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x495990], eax
call esi
push eax
call fcn.00404313
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x495994], eax
call esi
push eax
call fcn.00404313
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x495998], eax
call esi
push eax
call fcn.00404313
pop ecx
mov dword [0x4959a0], eax
test eax, eax
je 0x405686
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404313
pop ecx
mov dword [0x49599c], eax
mov eax, dword [0x49599c]
cmp eax, ebx
je 0x4056de
cmp dword [0x4959a0], ebx
je 0x4056de
push eax
call fcn.0040438e
push dword [0x4959a0]
mov esi, eax
call fcn.0040438e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4056de
test edi, edi
je 0x4056de
call esi
test eax, eax
je 0x4056d5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4056d5
test byte [ebp - 0xc], 1
jne 0x4056de
or dword [ebp + 0x10], 0x200000
jmp 0x405717
mov eax, dword [0x495994]
cmp eax, ebx
je 0x405717
push eax
call fcn.0040438e
pop ecx
test eax, eax
je 0x405717
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405717
mov eax, dword [0x495998]
cmp eax, ebx
je 0x405717
push eax
call fcn.0040438e
pop ecx
test eax, eax
je 0x405717
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x495990]
call fcn.0040438e
pop ecx
test eax, eax
je 0x405737
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405739
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406ca0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [edi]
imul eax, eax, 0x2710
movzx ecx, word [edi + 2]
imul ecx, ecx, 0x64
add ecx, eax
movzx edi, word [edi + 6]
add edi, ecx
cmp edi, dword [esi + 0x1c]
jne 0x406cee
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x406cee
mov ebx, 3
cmp dword [esi + 0x20], eax
jge 0x406d62
mov edx, dword [ebp + 0x14]
xor ebx, ebx
lea eax, [ebp - 0x24]
mov dword [eax], ebx
mov ecx, dword [ebp + 8]
push eax
push edx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ecx
call fcn.00406e30
add esp, 0x18
test al, al
je 0x406d1b
cmp dword [esi + 0x1c], edi
jne 0x406d2d
mov eax, dword [esi + 0x20]
jmp 0x406d32
mov eax, 0xfffffe70
add eax, dword [ebp - 0x24]
xor ebx, ebx
cmp eax, 0x64
setb bl
jmp 0x406d62
mov dword [esi + 0x1c], edi
xor eax, eax
inc eax
mov dword [esi + 0x20], eax
cmp dword [esi + 0x10], 0
je 0x406d5d
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x406d46
mov eax, dword [esi]
push 0x42d8ae
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x406d78
mov ebx, 2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
push dword [ebp - 0x20]
push 1
push 5
push str.GBP1_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.0041ec90
add esp, 0xc
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp - 0x20]
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.0041ec90
add esp, 0xc
push dword [ebp - 0x20]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
jmp 0x406d5d
Function at 0x409e10
Capabilities:
Delete file
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x1c
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 8], eax
push str.MOZ_CRASHREPORTER_NO_DELETE_DUMP
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
add esp, 4
test eax, eax
je 0x409e3c
cmp byte [eax], 0
jne 0x409f67
cmp dword [0x431504], 0
je 0x409ea1
lea esi, [ebp - 0x20]
mov ecx, esi
mov edx, 0x4314f4
call fcn.004159c0
cmp dword [esi + 0x14], 8
jb 0x409e5d
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x409ea1
mov ecx, dword [ebp - 0x20]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x409e97
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x409f77
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
cmp dword [0x43151c], 0
je 0x409f06
lea esi, [ebp - 0x20]
mov ecx, esi
mov edx, 0x43150c
call fcn.004159c0
cmp dword [esi + 0x14], 8
jb 0x409ec2
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x409f06
mov ecx, dword [ebp - 0x20]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x409efc
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x409f77
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
cmp dword [0x431534], 0
je 0x409f67
lea esi, [ebp - 0x20]
mov ecx, esi
mov edx, 0x431524
call fcn.004159c0
cmp dword [esi + 0x14], 8
jb 0x409f27
mov esi, dword [ebp - 0x20]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0xc]
cmp eax, 8
jb 0x409f67
mov ecx, dword [ebp - 0x20]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x409f5d
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x409f77
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041d0b0
add esp, 0x1c
pop esi
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x4151a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edx, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x28]
mov ecx, esi
call fcn.004159c0
cmp dword [esi + 0x14], 8
jb 0x4151c8
mov esi, dword [ebp - 0x28]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x41520c
mov ecx, dword [ebp - 0x28]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x415202
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x415237
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.0041c5cc
add esp, 8
test esi, esi
jne 0x41521d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x415233
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, ebx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x41521f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x416380
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
movzx eax, cx
cmp byte [0x431610], 1
jne 0x41640e
xor ebx, ebx
push 5
push eax
push ebx
mov dword [ebp - 0x14], edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
push eax
push ebx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
push ebx
push dword [ebp - 0x10]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
or byte [esi + 0xa], 0x40
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebp - 0x14]
push esi
push eax
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
jmp 0x41641d
xor ecx, ecx
push ecx
push dword [ebp + 8]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x417eb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov edi, edx
mov esi, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [edx + 0x10]
cmp dword [ecx + 0x10], eax
jne 0x417ef6
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x417ed9
mov ecx, dword [esi]
cmp dword [edi + 0x14], 0x10
mov edx, edi
jb 0x417ee3
mov edx, dword [edi]
push eax
push edx
push ecx
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x417fa2
lea ebx, [ebp - 0x28]
mov ecx, ebx
mov edx, edi
call fcn.004159c0
cmp dword [ebx + 0x14], 8
jb 0x417f0b
mov ebx, dword [ebp - 0x28]
lea edi, [ebp - 0x40]
mov ecx, edi
mov edx, esi
call fcn.004159c0
cmp dword [edi + 0x14], 8
jb 0x417f20
mov edi, dword [ebp - 0x40]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, 1
sete bl
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x417f67
mov ecx, dword [ebp - 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x417f5d
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x417fb8
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
mov eax, dword [ebp - 0x14]
cmp eax, 8
jb 0x417fa4
mov ecx, dword [ebp - 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x417f96
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x417fb8
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.0041c5cc
add esp, 8
jmp 0x417fa4
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x418b20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x818
mov esi, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ecx]
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
xor eax, eax
push eax
push eax
push 0x31
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x418b5c
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
lea edi, [esi + 8]
lea eax, [ebp - 0x810]
push 0x400
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x18]
cmp dword [esi + 0x1c], 8
mov dword [ebp - 0x824], edi
jb 0x418b85
mov edi, dword [esi + 8]
lea edx, [ebp - 0x818]
push edx
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x418bee
lea edi, [ebp - 0x810]
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
lea ecx, [ebp - 0x820]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
test eax, eax
je 0x418bee
mov eax, dword [ebp - 0x818]
mov edx, dword [ebp - 0x820]
sub eax, edx
mov ebx, 0
js 0x418c15
mov ecx, dword [esi + 4]
mov ebx, dword [esi + 0x24]
test ebx, ebx
jne 0x418be2
mov ebx, dword [ecx + 8]
add edx, dword [ecx]
sub ebx, edx
add ebx, eax
cmp byte [esi + 0x20], 0
je 0x418bf2
sub dword [ecx], ebx
jmp 0x418bf5
xor ebx, ebx
jmp 0x418c15
add dword [ecx + 8], ebx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax]
mov edi, dword [eax + 4]
sub ecx, edi
mov eax, dword [eax + 8]
sub eax, edx
push 1
push ecx
push eax
push edi
push edx
push dword [esi]
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [esi + 0x1c]
cmp eax, 8
jb 0x418c53
mov ecx, dword [ebp - 0x824]
mov ecx, dword [ecx]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x418c49
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x418c7e
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.0041c5cc
add esp, 8
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 7
mov word [esi + 8], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, ebx
add esp, 0x818
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x418c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, edx
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov byte [ecx], 0
lea ebx, [ebp - 0x1c]
push ebx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x418cd6
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x418cd6
xor ebx, ebx
jmp 0x418d16
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov dword [ecx], 4
lea edx, [ebp - 0x20]
lea edi, [ebp - 0x14]
push ecx
push edx
push edi
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ebx, ebx
test eax, eax
jne 0x418d0d
cmp dword [ebp - 0x14], 4
jne 0x418d0d
cmp dword [ebp - 0x20], 1
mov eax, dword [ebp + 8]
sete byte [eax]
mov bl, 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419e10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x9c54
call fcn.0041d620
mov dword [ebp - 0x9c60], edx
mov edi, ecx
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4e32]
push 0x2711
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea esi, [ebp - 0x9c5c]
lea ebx, [ebp - 0x9c58]
push esi
push ebx
push 0xb0
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi]
mov ecx, dword [ebx]
mov edi, 0xfffffffe
sub eax, ecx
je 0x419ed0
lea ecx, [ecx*2 - 0x4e32]
add ecx, ebp
lea edi, [ebp - 0x9c54]
push eax
push ecx
push 0x2711
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov eax, dword [ebp - 0x9c5c]
sub eax, dword [ebp - 0x9c58]
mov word [ebp + eax*2 - 0x9c54], 0
sub esp, 0x20
xor eax, eax
mov dword [esp + 0x1c], eax
movaps xmm0, xmmword [0x42b140]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
not edi
sub esp, 0x20
xor esi, esi
mov dword [esp + 0x1c], esi
movaps xmm0, xmmword [0x42b140]
movups xmmword [esp + 0xc], xmm0
lea eax, [ebp - 0x4e32]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, 0xfde9
mov dword [esp], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call ebx
mov ecx, ebx
mov ebx, eax
sub esp, 0x20
mov dword [esp + 0x1c], esi
movaps xmm0, xmmword [0x42b140]
movups xmmword [esp + 0xc], xmm0
mov eax, dword [ebp - 0x9c60]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, 0xfde9
mov dword [esp], eax
call ecx
mov esi, eax
add ebx, edi
add esi, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, esi
add esp, 0x9c54
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41fb00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x431014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x41fba2
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x41fba2
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x41fba0
mov ebx, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov edi, dword [eax + 0x20]
mov ecx, edi
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, ebx
mov ebx, edx
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call edi
cmp eax, 3
je 0x41fbb6
cmp eax, 1
je 0x41fb7c
test eax, eax
jne 0x41fba0
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
sub edi, ebx
je 0x41fb97
push dword [esi + 0x4c]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x41fba0
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x41fba2
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041d0b0
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [esi + 0x3d], 0
mov bl, 1
jmp 0x41fba2
Function at 0x401040
Capabilities:
Execute command

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__getdrive]
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__chdrive]
mov ebx, eax
mov esi, 1
push esi
call edi
add esp, 4
test eax, eax
jne 0x401071
lea eax, [esi + 0x40]
push eax
push str._c:_n
call fcn.00401010
add esp, 8
inc esi
cmp esi, 0x1a
jle 0x401056
push ebx
call edi
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret