joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef6c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x509ac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004e470a
mov eax, dword [0x5348e8]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004e463c
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004f01d0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4ef767
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ef75e
cmp al, 0xff
je 0x4ef75e
dec al
mov byte [ecx], al
jmp 0x4ef767
push ecx
call fcn.004f8e2f
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4ef798
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ef78f
cmp al, 0xff
je 0x4ef78f
dec al
mov byte [ecx], al
jmp 0x4ef798
push ecx
call fcn.004f8e2f
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4fb493
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4fb4cb
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004f9520
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004f94f8
jmp 0x4fb4d7
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4fcb88
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4fcbca
call fcn.005029f9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4fcbca
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4fcbc1
xor eax, eax
jmp 0x4fcbd2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004fcbd8
pop edi
pop esi
pop ebx
ret 4

Function at 0x502f29
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x502f57
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x502f75
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00502e8f
jmp 0x502f75
mov eax, dword [esi + 0x14]
test eax, eax
je 0x502f75
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00502e8f
test edi, edi
mov eax, edi
jne 0x502f5f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40350c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push dword [0x423264]
call sub.USER32.dll_GetDC
mov dword [ebp - 0x14], eax
push dword [0x42326c]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x1c], eax
push dword [ebp + 8]
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x18]
push dword [ebp + 8]
push dword [ebp - 0x14]
call sub.GDI32.dll_GetTextExtentPoint32A
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
call sub.GDI32.dll_SelectObject
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
push dword [ebp - 8]
pop dword [ebp - 0x24]
push dword [ebp - 4]
pop dword [ebp - 0x20]
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
push dword [ebp + 8]
push 0xffffffffffffffeb
push dword [0x423264]
call sub.USER32.dll_SetWindowLongA
add dword [ebp - 0x10], 8
add dword [ebp - 0xc], 8
add dword [ebp - 8], 2
add dword [ebp - 4], 2
push 1
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [0x423264]
call sub.USER32.dll_MoveWindow
push 4
push dword [0x423264]
call sub.USER32.dll_ShowWindow
push 0
push 0
push dword [0x423264]
call sub.USER32.dll_InvalidateRect
push dword [0x423264]
call sub.USER32.dll_UpdateWindow
push dword [ebp - 0x14]
push dword [0x423264]
call sub.USER32.dll_ReleaseDC
leave
ret 4
Function at 0x406e2b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbec
jmp 0x406e40
jmp 0x406e48
cmp dword [ebp + 0x10], 0
jne 0x406e5e
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_LoadCursorA
jmp 0x406f6e
cmp dword [ebp + 0x10], 3
jne 0x406eee
push 0x104
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x406e36
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.dll_lstrcatA
push dword [ebp + 0x14]
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.dll_lstrcatA
push 0x10
push 0
push 0
push 2
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
or eax, eax
jne 0x406f6e
push dword [0x41f044]
push 0x406e42
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
call fcn.004098ff
push 0x10
push 0
push 0
push 2
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
jmp 0x406f6e
cmp dword [ebp + 0x10], 4
jne 0x406f58
push 0x104
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x406e36
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.dll_lstrcatA
push dword [ebp + 0x14]
lea eax, [ebp - 0x414]
push eax
call sub.KERNEL32.dll_lstrcatA
push dword [0x41f044]
push 0x406e42
push dword [ebp + 0xc]
lea eax, [ebp - 0x414]
push eax
call fcn.004098ff
push 0x10
push 0
push 0
push 2
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
jmp 0x406f6e
push 0x8000
push 0
push 0
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_LoadImageA
mov dword [ebp - 4], eax
call sub.USER32.dll_GetCursor
cmp eax, dword [ebp - 4]
je 0x406f95
cmp dword [ebp + 0x10], 2
je 0x406f95
cmp dword [ebp + 0x10], 4
je 0x406f95
cmp dword [ebp - 4], 0
je 0x406f95
push dword [ebp - 4]
call sub.USER32.dll_SetCursor
mov eax, dword [ebp - 4]
leave
ret 0x10
Function at 0x408175
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], 0
cmp dword [0x420a43], 0
je 0x40831e
cmp dword [ebp + 0xc], 0x20
jne 0x4081bb
cmp dword [0x4231ac], 1
jne 0x40831e
push 0
call sub.USER32.dll_SetCursor
mov dword [ebp - 4], 1
mov eax, 1
jmp 0x40831e
cmp dword [ebp + 0xc], 6
jne 0x4081ec
and dword [ebp + 0x10], 0xffff
cmp dword [ebp + 0x10], 0
jne 0x4081dd
mov dword [0x423194], 0
jmp 0x40831e
mov dword [0x423194], 1
jmp 0x40831e
cmp dword [ebp + 0xc], 0x112
jne 0x40821a
and dword [ebp + 0x10], 0xfff0
cmp dword [ebp + 0x10], 0xf140
jne 0x40831e
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40831e
cmp dword [ebp + 0xc], 0x100
je 0x40823e
cmp dword [ebp + 0xc], 0x201
je 0x40823e
cmp dword [ebp + 0xc], 0x204
je 0x40823e
cmp dword [ebp + 0xc], 0x207
jne 0x408278
cmp dword [0x4231ac], 1
jne 0x40831e
push 0
push 0x3f2
push 0x111
push dword [0x41f048]
call sub.USER32.dll_SendMessageA
call fcn.004085af
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40831e
cmp dword [ebp + 0xc], 0x200
jne 0x40830e
cmp dword [0x4231ac], 1
jne 0x40831e
cmp dword [0x4231a0], 0
jne 0x4082c3
push 0x4231a4
call sub.USER32.dll_GetCursorPos
mov dword [0x4231a0], 1
push dword [0x4231a4]
pop dword [ebp - 0xc]
push dword [0x4231a8]
pop dword [ebp - 8]
jmp 0x4082cc
lea eax, [ebp - 0xc]
push eax
call sub.USER32.dll_GetCursorPos
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x4231a4]
jne 0x4082e4
mov eax, dword [ebp - 8]
cmp eax, dword [0x4231a8]
jne 0x4082e4
jmp 0x40830c
push 0
push 0x3f2
push 0x111
push dword [0x41f048]
call sub.USER32.dll_SendMessageA
call fcn.004085af
mov dword [ebp - 4], 1
mov eax, 0
jmp 0x40831e
cmp dword [ebp + 0xc], 0x10
jne 0x40831e
mov dword [0x423194], 0
mov ebx, dword [ebp + 0x18]
push dword [ebp - 4]
pop dword [ebx]
pop ebx
leave
ret 0x14

Function at 0x4098ff
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 0xc], 0
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x409934
mov dword [ebp - 0xc], 1
je 0x4099a6
mov dword [ebp - 0x14], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_FindResourceA
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_SizeofResource
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push dword [ebp + 0x14]
call sub.KERNEL32.dll_LoadResource
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.KERNEL32.dll_LockResource
mov dword [ebp - 0x18], eax
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call sub.KERNEL32.dll_WriteFile
or eax, eax
jne 0x40998e
mov dword [ebp - 0xc], 1
push dword [ebp - 0x14]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 8]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
leave
ret 0x10
Function at 0x40bf3e
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
cmp dword [0x41f54f], 0
je 0x40bf59
push dword [0x41f54f]
call sub.GDI32.dll_DeleteObject
push dword [0x41f8e9]
call fcn.00409363
push dword [0x41f810]
call fcn.00409363
push dword [0x41f80c]
call fcn.00409363
push dword [0x41f8c9]
call fcn.00409363
cmp dword [0x423280], 1
jne 0x40bfa0
push 0x7f00
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [0x41f8b1], 1
mov dword [0x41f8b5], 0
mov dword [0x41fa73], 0
push dword [0x41f8cd]
push 0xfffffffffffffffc
push dword [0x41f048]
call sub.USER32.dll_SetWindowLongA
push dword [0x41f906]
push dword [0x41f8e9]
call sub.GDI32.dll_SetStretchBltMode
push dword [0x41f804]
push dword [0x41f808]
call fcn.0040394d
push dword [0x41f91a]
push dword [0x41f8e9]
call sub.GDI32.dll_SelectObject
push eax
call sub.GDI32.dll_DeleteObject
push dword [0x41f8e9]
call sub.GDI32.dll_DeleteDC
call sub.USER32.dll_GetForegroundWindow
or eax, eax
je 0x40c060
cmp eax, dword [0x41f048]
je 0x40c060
cmp eax, dword [0x41f712]
je 0x40c060
mov dword [0x41fa6f], 0
mov dword [0x41fa6b], 0
cmp dword [0x41f8bd], 5
jb 0x40c060
cmp dword [0x41f8bd], 7
ja 0x40c060
push 0
push 0x40c580
call sub.USER32.dll_EnumWindows
mov dword [0x41f553], 1
call fcn.00411d53
cmp eax, 1
jne 0x40c093
push dword [0x41f804]
push dword [0x41f8c9]
call fcn.00410a78
push 0
push dword [0x41f048]
push eax
call fcn.004109c8
push dword [0x41f048]
call fcn.004035ee
call sub.USER32.dll_ReleaseCapture
cmp dword [0x41fa7f], 1
jne 0x40c0bb
call fcn.00404078
mov dword [0x41fa7f], 0
cmp dword [0x41fa87], 1
jne 0x40c0d7
cmp dword [0x41fa8b], 0
jne 0x40c0d7
mov dword [0x41fa8b], 1
cmp dword [0x41f7a2], 0
jne 0x40c143
mov dword [0x41f7a6], 0
mov eax, dword [0x41fa6b]
cmp dword [0x41fa6f], eax
jae 0x40c125
mov ebx, dword [0x41fa6f]
shl ebx, 4
push dword [ebx + 0x423d73]
push dword [ebx + 0x423d6f]
push dword [ebx + 0x423d6b]
push dword [ebx + 0x423d67]
call sub.USER32.dll_SendMessageA
inc dword [0x41fa6f]
jmp 0x40c181
cmp dword [0x41fa6f], eax
jne 0x40c181
mov dword [0x41fa6f], 0
mov dword [0x41fa6b], 0
jmp 0x40c181
push 1
push dword [0x41f70a]
push dword [0x41f6fa]
push dword [0x41f804]
push dword [0x41f702]
call fcn.0040c612
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
push 5
push dword [0x41f048]
call sub.USER32.dll_SetTimer
mov dword [0x423284], 1
pop ebx
leave
ret
Function at 0x40cf35
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff990
push edx
lea eax, [ebp - 0x654]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x550]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
mov dword [ebp - 0x4c], 0x4c
mov eax, dword [0x41f048]
mov dword [ebp - 0x48], eax
push 0x400
push 0x424923
call sub.KERNEL32.dll_RtlZeroMemory
push str.EXE_file
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 0x66c], eax
inc dword [ebp - 0x66c]
push dword [ebp - 0x66c]
push 0x424923
push str.EXE_file
call fcn.0041b8c0
mov eax, dword [ebp - 0x66c]
add eax, 0x424923
mov dword [ebp - 0x66c], eax
push 6
push dword [ebp - 0x66c]
push str..exe
call fcn.0041b8c0
mov dword [ebp - 0x40], 0x424923
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x32
mov dword [ebp - 0x34], 1
push 0x41f070
call sub.KERNEL32.dll_lstrlenA
mov ebx, 0
jmp 0x40d007
mov bl, byte [eax + 0x41f070]
dec eax
cmp eax, 0
jbe 0x40d011
cmp bl, 0x5c
jne 0x40d000
add eax, 2
add eax, 0x41f070
push eax
lea eax, [ebp - 0x150]
push eax
call sub.KERNEL32.dll_lstrcpyA
lea eax, [ebp - 0x150]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x104
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x550]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], str.Save_EXE_Book:
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x18], 0x806
mov word [ebp - 0x14], 0
mov word [ebp - 0x12], 0
lea eax, [ebp - 0x668]
mov byte [eax], 0
push 0x4202d9
push eax
call fcn.0041b870
lea eax, [ebp - 0x668]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0x4c]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
cmp eax, 1
jne 0x40d0d8
push 0x400
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp - 0x670]
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x550]
push eax
call fcn.0040fd2c
push 0
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x550]
push eax
call sub.KERNEL32.dll_CopyFileA
pop edx
leave
ret
Function at 0x40fbe3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ecx
push ebx
push 0x400
push 0x424923
call sub.KERNEL32.dll_RtlZeroMemory
lea eax, [ebp - 0x408]
push eax
push 0x104
call sub.KERNEL32.dll_GetCurrentDirectoryA
push eax
lea eax, [ebp - 0x408]
push eax
push 0x424923
call fcn.0040fd2c
mov dword [ebp - 4], 0x424923
push dword [ebp - 4]
call sub.KERNEL32.dll_lstrlenA
mov dword [ebp - 8], eax
push 0x400
lea eax, [ebp - 0x408]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp - 8]
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 4]
call fcn.0041b8c0
mov eax, 1
jmp 0x40fc6e
push 0x41f491
push dword [ebp - 4]
push 1
call fcn.0041b778
add dword [ebp - 4], eax
or eax, eax
jne 0x40fc5c
mov byte [0x423444], 0
push dword [ebp - 4]
push 0x423444
call fcn.0041b870
cmp dword [0x41f6be], 1
jne 0x40fc9e
push dword [0x423370]
push 0
call fcn.00406277
jmp 0x40fcac
push str.This_email_attachment_has_been_sent_to_you_by_a_person_using_a_SendMail_facility_inside_the_DigitalWebBook._r_n_r_nPlease_refer_to_the_From:_line_in_the_header_of_this_e_mail_to_identify_the_sender._Please_note_that_if_you_can_not_view_the_attached_file_you_should_download_the_DigitalWebBook_plug_in_viewer_from_www.DigitalWebBooks.com_plugin._When_prompted__either_Open_or_Run_from_current_location._The_plug_in_viewer_will_be_automatically_installed_on_opening._Click_on_the_close_button_to_exit._r_n_r_nOnce_you_have_downloaded_the_152k_plug_in_viewer_which_will_take_approximately_30_seconds_on_a_56k_modem_you_will_be_able_to_view_DigitalWebBooks_in_the_.dnl_format._r_n_r_nEnjoy_the_DigitalWebBook_experience.
push 0x34
push 1
call fcn.00405fd3
mov dword [ebp - 4], eax
cmp dword [0x420a2b], 0
je 0x40fcc7
push 0
push dword [0x420a2b]
call fcn.00406277
jmp 0x40fccd
lea eax, str.DigitalWebBook
mov dword [ebp - 8], eax
push 0x423444
lea eax, [ebp - 0x408]
push eax
push 0x4234c4
push 0x4234c4
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push 1
call fcn.0040fdd3
or eax, eax
je 0x40fd28
jmp 0x40fcfe
push eax
push 0x40fcfb
push 0x4233e0
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push 0x4233e0
push 0x4233e0
push dword [0x41f048]
call sub.USER32.dll_MessageBoxA
pop ebx
pop ecx
leave
ret
Function at 0x410b8a
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
cmp dword [0x41f4d7], 0
jne 0x410bf2
push dword [0x41f7b6]
call sub.GDI32.dll_CreateCompatibleDC
mov dword [0x41f4d7], eax
cmp eax, 0
je 0x410d31
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [0x41f7b6]
call sub.GDI32.dll_CreateCompatibleBitmap
or eax, eax
jne 0x410be1
push dword [0x41f4d7]
call sub.GDI32.dll_DeleteDC
mov dword [0x41f4d7], 0
jmp 0x410d31
push eax
push dword [0x41f4d7]
call sub.GDI32.dll_SelectObject
mov dword [0x41f4db], eax
cmp dword [0x41f4df], 1
jne 0x410c9a
lea eax, [ebp - 0x20]
push eax
push dword [0x41f048]
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
sub dword [ebp - 0x14], eax
push 0
push 1
push 1
push 0
push 0
push dword [0x41f048]
call sub.USER32.dll_MoveWindow
cmp dword [0x41f61a], 1
jne 0x410c5c
lea eax, [ebp - 0x30]
push eax
push dword [0x42325c]
call sub.USER32.dll_GetWindowRect
push 0
push 1
push 1
push 0
push 0
push dword [0x42325c]
call sub.USER32.dll_MoveWindow
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
add eax, dword [ebp + 0x10]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
add eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push 0x410d35
call sub.USER32.dll_EnumWindows
cmp dword [0x41f563], 1
jne 0x410c9a
mov dword [0x41f563], 0
leave
ret 0x10
push 0xcc0020
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x41f7b6]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push 0
push dword [0x41f4d7]
call sub.GDI32.dll_BitBlt
cmp dword [0x41f4df], 1
jne 0x410d31
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [0x41f048]
call sub.USER32.dll_MoveWindow
cmp dword [0x41f61a], 1
jne 0x410d10
mov eax, dword [ebp - 0x30]
sub dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0x24], eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [0x42325c]
call sub.USER32.dll_MoveWindow
push dword [0x41f804]
call fcn.0041076a
cmp eax, 1
jne 0x410d27
push 0
call fcn.00411663
mov dword [0x41f563], 0
leave
ret 0x10
Function at 0x4127ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
call fcn.0041276e
or eax, eax
je 0x412918
mov dword [ebp - 0x414], eax
push 0x104
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x41f491
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_lstrcatA
push dword [0x420a2f]
push 0
call fcn.00406277
mov dword [ebp - 0x418], eax
push dword [ebp - 0x418]
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_lstrcatA
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_GetBinaryTypeA
or eax, eax
jne 0x412918
push dword [0x423370]
push 7
call fcn.00406277
mov dword [ebp - 0x41c], eax
inc dword [ebp - 0x414]
push dword [0x420a2f]
push dword [ebp - 0x414]
call fcn.00406277
push 4
push dword [ebp - 0x41c]
push eax
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x412918
push dword [0x420a37]
push 3
call fcn.00406277
push dword [0x420a37]
push dword [ebp + 8]
push eax
call fcn.0041291c
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.dll_GetBinaryTypeA
or eax, eax
jne 0x412918
push dword [0x423370]
push 7
call fcn.00406277
mov dword [ebp - 0x41c], eax
push dword [0x420a37]
push 9
call fcn.00406277
push 4
push dword [ebp - 0x41c]
push eax
push dword [ebp + 8]
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x412918
jmp 0x4128ad
leave
ret 4
Function at 0x41291c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd4c
mov dword [ebp - 0x2b4], 0
lea eax, [ebp - 0x2a1]
push eax
lea eax, [ebp - 0x2b4]
push eax
push str.DWB_Temp_File_Temp_u.tmp
call fcn.0041671e
cmp eax, 0xffffffff
je 0x4129ff
mov dword [ebp - 0x38], eax
push 0x14
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push dword [ebp + 0x10]
push 5
call fcn.00406277
mov dword [ebp - 0x1c], eax
push dword [ebp + 0x10]
push 6
call fcn.00406277
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2ac], eax
push dword [ebp + 0xc]
pop dword [ebp - 0x2c]
lea eax, [ebp - 0xa1]
push eax
push 2
push 0
push dword [ebp + 8]
call fcn.00415fc1
push eax
or eax, eax
jne 0x4129d7
push dword [ebp + 0x10]
push 7
call fcn.00406277
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x2a1]
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2b0]
push eax
push 0x412a03
push dword [ebp + 0xc]
push str.PostPrgsDlg
push dword [0x41f044]
call sub.USER32.dll_DialogBoxParamA
lea eax, [ebp - 0x2a1]
push eax
call sub.KERNEL32.dll_DeleteFileA
pop eax
or eax, eax
je 0x4129ff
push 0
push str.Message
push str.The_DNL_reader_need_to_install_extensions_to_properly_run_this_Digital_Web_r_nBook._It_is_unable_to_do_this_at_present._Some_of_the_possible_reasons_are:_r_n_r_n1._This_computer_may_not_be_connected_to_the_Internet_or_you_may_be_r_nexperiencing_network_problems._r_n_r_n2._Your_firewall_software_may_not_be_prompting_you_to_give_you_a_choice_to_r_ndownload_the_extension_the_DNL_reader_requires_to_use_this_Digital_Web_Book._r_n_r_nPossible_solution:_r_nA._Temporarily_switch_off_the_firewall_to_allow_this_program_to_access_the_r_nInternet._r_nB._Configure_your_firewall_to_allow_the_DNL_reader_to_access_the_Internet._r_n_r_n3._If_you_are_using_a_proxy_server_or_external_gateway__please_ensure_that_r_nit_is_correctly_configured._If_you_are_connecting_to_the_internet_using_a_r_ncorporate_network__please_ask_your_network_administrator_for_help._r_n
push dword [0x41f048]
call sub.USER32.dll_MessageBoxA
leave
ret 0xc

Function at 0x412b4f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
cmp dword [ebp + 0x18], 2
je 0x412b9c
push 0
push 0x80
push dword [ebp + 0xc]
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x412bd8
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 3
jne 0x412b92
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
pop eax
jmp 0x412bd8
cmp dword [ebp + 0x18], 4
jne 0x412ba2
jmp 0x412bd8
push dword [ebp + 0xc]
pop dword [ebp - 4]
cmp dword [ebp + 0x18], 1
jne 0x412bb6
push 0
push 0
push 1
push dword [ebp - 4]
call sub.KERNEL32.dll_SetNamedPipeHandleState
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call sub.KERNEL32.dll_WriteFile
cmp dword [ebp + 0x18], 2
je 0x412bd8
push dword [ebp - 4]
call sub.KERNEL32.dll_CloseHandle
leave
ret 0x14