joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4030dd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4030e3
mov edx, dword [esp + 0x30]
lea ecx, [esp]
call fcn.00404060
push 0x21
call fcn.0040b5d0
mov dword [esp + 4], eax
push 0x21
push dword [esp + 8]
call fcn.0040b6f0
push 0x20
push dword [esp + 8]
mov eax, dword [0x412440]
push eax
call fcn.0040b710
push 1
push dword [esp + 4]
mov ebx, dword [esp + 0xc]
add ebx, 0x20
push ebx
call fcn.0040b740
push dword [0x412940]
push dword [0x412940]
push dword [0x412940]
push dword [0x412940]
push 0x21
push dword [esp + 0x18]
call fcn.0040cb00
mov edx, dword [0x411264]
add dword [esp], edx
call fcn.00404a20
lea eax, [esp + 0xc]
push eax
call fcn.0040e2b0
push dword [esp + 4]
call fcn.0040b6d0
push 0xa
push dword [esp + 0xc]
push dword [esp + 0x34]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x4032b8
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.dll_LoadResource
mov dword [0x41236c], eax
push dword [esp + 0xc]
push dword [esp + 0x30]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x412380], eax
push dword [esp]
mov edx, 0x411027
pop ecx
call fcn.0040e390
jne 0x403200
push dword [esp]
mov edx, 0x41102b
pop ecx
call fcn.0040e390
jne 0x403200
push dword [esp]
mov edx, 0x41102d
pop ecx
call fcn.0040e390
jne 0x403200
jmp 0x403207
mov eax, 1
jmp 0x403209
xor eax, eax
and eax, eax
je 0x4032b8
push dword [0x412380]
call fcn.0040b5d0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov ebx, dword [0x412380]
dec ebx
cmp ebx, dword [esp + 0x14]
jl 0x40326e
mov ebx, dword [0x41236c]
add ebx, dword [esp + 0x14]
push ebx
pop eax
call fcn.0040b5f0
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
imul ebx, ebx, 0xffffffff
mov dword [esp + 0x1c], ebx
push dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 0x18]
push ebx
pop eax
call fcn.0040b600
inc dword [esp + 0x14]
jno 0x403228
push dword [0x412440]
push dword [0x412380]
push dword [esp + 0x18]
call fcn.00402000
push dword [esp + 0x10]
pop eax
mov dword [0x41236c], eax
push dword [0x412380]
push dword [esp + 0x14]
call fcn.004039ee
mov dword [esp + 0x20], eax
push dword [esp + 0x20]
pop eax
mov dword [0x41236c], eax
push dword [esp + 0x20]
call fcn.0040b780
mov dword [0x412380], eax
mov eax, dword [esp + 0xc]
jmp 0x4032c0
push dword [esp + 8]
call fcn.0040e3c0
push dword [esp]
call fcn.0040e3c0
add esp, 0x24
pop ebx
ret 8
Function at 0x403759
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
mov ebx, dword [0x4123fc]
cmp ebx, 1
jne 0x403816
push dword [0x412454]
call fcn.00408c6b
mov ebx, eax
and ebx, ebx
jle 0x4037bd
push dword [0x412454]
call fcn.00408c75
push dword [0x412454]
call fcn.00408c8a
or eax, eax
je 0x4037bd
mov ebp, dword [0x412458]
push dword [ebp + 8]
call fcn.0040ce20
mov ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x4037bb
mov ebp, dword [0x412458]
push dword [ebp + 8]
call fcn.0040b971
jmp 0x403789
push dword [0x41245c]
call fcn.00408c6b
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
jle 0x403816
push 5
push 0
push 1
push dword [0x41245c]
call fcn.00406930
push dword [0x41245c]
call fcn.00408c75
push dword [0x41245c]
call fcn.00408c8a
or eax, eax
je 0x403816
mov ebp, dword [0x412460]
push dword [ebp + 0xc]
call sub.KERNEL32.dll_RemoveDirectoryA
jmp 0x4037f7
mov eax, 1
jmp 0x40381f
add esp, 4
pop ebx
pop ebp
ret
Function at 0x403a75
Capabilities:
Delete directory
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
call fcn.0040748f
mov dword [esp], eax
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4123c4], eax
push dword [0x412940]
push dword [esp + 4]
call fcn.00402859
lea eax, [esp + 8]
push eax
call fcn.0040e2b0
call fcn.00403d2c
call fcn.00403825
push dword [0x412940]
push dword [0x412940]
push 0
call fcn.00407441
inc dword [0x412940]
mov edx, dword [0x4123dc]
pop ecx
mov dword [0x412940], ecx
add ecx, dword [0x411264]
call fcn.0040e390
je 0x403afb
mov ebx, dword [esp]
cmp ebx, 1
jne 0x403afb
mov eax, 1
jmp 0x403afd
xor eax, eax
and eax, eax
je 0x403b06
call fcn.004029ba
mov edx, dword [0x412424]
push dword [0x412940]
call fcn.0040e330
mov edx, dword [0x412410]
call fcn.0040e330
mov edx, dword [0x4123d8]
call fcn.0040e330
lea eax, [0x4123d8]
push eax
call fcn.0040e2b0
push dword [0x412940]
push dword [0x412940]
push 0x800
call fcn.00404a80
lea eax, [esp + 0xc]
push eax
call fcn.0040e2b0
push dword [0x412940]
push dword [esp + 0xc]
push 0
push 0x41101e
mov edx, dword [0x412424]
push dword [0x412940]
call fcn.0040e330
mov edx, dword [0x412410]
call fcn.0040e330
inc dword [0x412940]
mov edx, dword [0x411264]
add dword [esp], edx
call sub.KERNEL32.dll_GetTempFileNameA
pop dword [0x412940]
push dword [esp + 8]
call fcn.0040b971
push str..ps1
push dword [esp + 0xc]
call sub.SHLWAPI.DLL_PathRenameExtensionA
mov edx, dword [esp + 8]
push dword [0x412940]
call fcn.0040e330
lea eax, [0x4123d8]
push eax
call fcn.0040e2b0
call fcn.00403d85
mov edx, dword [0x412390]
xor ecx, ecx
call fcn.0040e390
jne 0x403bf4
push dword [0x412390]
call fcn.00402cc3
call fcn.004032d8
push dword [0x4123d8]
call sub.SHLWAPI.DLL_PathQuoteSpacesA
push dword [0x412940]
push 0x45
push dword [0x4123d0]
mov edx, dword [0x412370]
push dword [0x412940]
call fcn.0040e330
mov edx, str.__BFINOPS
call fcn.0040e330
mov edx, dword [0x4123d8]
call fcn.0040e330
mov edx, str.__BFINOPS
call fcn.0040e330
mov edx, dword [esp + 0x14]
call fcn.0040e330
inc dword [0x412940]
push dword [0x4123bc]
mov edx, dword [0x411264]
add dword [esp + 4], edx
call fcn.00407979
pop dword [0x412940]
mov dword [0x4123e8], eax
push dword [0x4123e8]
call fcn.00407993
mov dword [esp + 0xc], eax
push dword [0x4123e8]
call fcn.004079b1
push 0
lea eax, [0x402ae6]
push eax
call sub.KERNEL32.dll_SetConsoleCtrlHandler
call fcn.00403759
push dword [0x4123d8]
call sub.SHLWAPI.DLL_PathUnquoteSpacesA
push dword [0x4123d8]
call fcn.0040b971
push dword [0x412940]
push dword [0x412940]
push dword [0x412940]
push dword [0x412940]
push dword [0x412940]
call fcn.004074a2
mov edx, dword [0x411264]
add dword [esp], edx
call fcn.0040b8cd
mov edx, dword [0x411264]
add dword [esp], edx
call fcn.0040b8bb
pop dword [0x412940]
push dword [0x412424]
call sub.KERNEL32.dll_RemoveDirectoryA
push dword [esp + 0xc]
jmp fcn.00401771
Function at 0x40724d
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x40729c
push dword [esp + 0x10]
push 0x4071cb
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x41246c]
cmp esi, ebx
je 0x4072f0
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x407294
cmp byte [esi + 0x10], bl
je 0x407294
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x407271
jmp 0x4072f0
mov esi, dword [0x41246c]
cmp esi, ebx
je 0x4072f0
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x4072e9
cmp byte [esi + 0x11], bl
je 0x4072c6
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x4072dc
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x41246c
call fcn.0040dedd
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x4072a7
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x407b14
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
or dword [ebp - 4], 0xffffffff
push esi
push edi
mov edi, eax
mov eax, dword [ebp + 0x10]
xor esi, esi
test eax, eax
je 0x407b45
cmp byte [eax], 0
je 0x407b45
push eax
call fcn.0040ee10
push eax
push edi
mov dword [ebp + 0x10], eax
call fcn.004080fc
pop ecx
pop ecx
mov esi, eax
jmp 0x407b57
cmp dword [edi + 8], esi
je 0x407c47
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 4]
mov esi, dword [ecx + eax*4]
test esi, esi
je 0x407c47
cmp dword [ebp + 0x14], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
je 0x407b80
push dword [esi]
push 0
push dword [0x41235c]
call ebx
mov dword [ebp + 8], eax
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 8], 0
je 0x407c46
mov eax, dword [ebp + 0xc]
cdq
cmp edx, dword [esi + 4]
jl 0x407c46
jg 0x407ba1
cmp eax, dword [esi]
jb 0x407c46
push 0
push 0
push dword [esi + 0x10]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
cmp eax, dword [esi]
jne 0x407be6
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 4]
jne 0x407be6
push 0
lea eax, [ebp - 8]
push eax
push dword [esi]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 8]
mov eax, ecx
cdq
cmp dword [esi], eax
jne 0x407c46
cmp dword [esi + 4], edx
jne 0x407c46
mov dword [ebp - 4], ecx
jmp 0x407c46
push dword [esi + 8]
push 0
push dword [0x41235c]
call ebx
mov ebx, eax
test ebx, ebx
je 0x407c46
push 0
lea eax, [ebp - 8]
push eax
push dword [esi + 8]
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
cdq
cmp dword [esi + 8], eax
jne 0x407c37
cmp dword [esi + 0xc], edx
jne 0x407c37
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.00408260
cdq
add esp, 0xc
cmp eax, dword [esi]
jne 0x407c37
cmp edx, dword [esi + 4]
jne 0x407c37
mov eax, dword [esi]
mov dword [ebp - 4], eax
push ebx
push 0
push dword [0x41235c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop ebx
mov eax, dword [ebp + 0x14]
xor edi, edi
cmp eax, edi
je 0x407c7a
cmp dword [ebp - 4], 0xffffffff
jne 0x407c70
cmp dword [ebp + 8], edi
je 0x407c6b
push dword [ebp + 8]
push edi
push dword [0x41235c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], edi
jmp 0x407c7a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, edi
pop edi
pop esi
je 0x407c8e
cmp byte [eax], 0
je 0x407c8e
push eax
call fcn.0040eec0
mov eax, dword [ebp - 4]
leave
ret
Function at 0x407d44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
push ebx
push esi
push edi
push dword [ebp + 0x14]
call fcn.0040ee10
mov esi, dword [ebp + 0x10]
lea ebx, [esi + 0x18]
push ebx
push 0
push dword [0x41235c]
mov dword [ebp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp + 0x10], edi
test edi, edi
je 0x407e32
push 0
push 5
push ebx
push edi
push esi
push dword [ebp + 0xc]
call fcn.004082c8
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x407d9f
cmp ebx, esi
jge 0x407d9f
mov dword [ebp + 0xc], edi
jmp 0x407da7
mov eax, dword [ebp + 0xc]
mov ebx, esi
mov dword [ebp + 0xc], eax
push dword [ebp + 0x14]
call sub.MSVCRT.dll_strlen
mov edi, dword [ebp + 8]
mov word [ebp - 0xc], ax
mov eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
cdq
mov dword [ebp - 0x1c], eax
pop ecx
mov dword [ebp - 0x18], edx
mov eax, ebx
cdq
push 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
push eax
push 0x12
lea eax, [ebp - 0x1c]
push eax
push dword [edi]
mov dword [ebp - 0x10], edx
call esi
cmp dword [ebp - 4], 0x12
jne 0x407e1a
push 0
lea eax, [ebp - 4]
push eax
movsx eax, word [ebp - 0xc]
push eax
push dword [ebp + 0x14]
push dword [edi]
call esi
movsx eax, word [ebp - 0xc]
cmp eax, dword [ebp - 4]
jne 0x407e1a
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi]
call esi
cmp ebx, dword [ebp - 4]
jne 0x407e1a
mov dword [ebp - 8], 1
push edi
call fcn.00407f54
pop ecx
push dword [ebp + 0x10]
push 0
push dword [0x41235c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp + 0x14]
call fcn.0040eec0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x407f99
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], 0x40
cmp dword [esi + 4], ebx
jne 0x4080f8
push edi
push 0x100
push ebx
push dword [0x41235c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push ebx
push ebx
push 4
pop edi
push edi
push dword [esi]
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp + 8], edi
cmp dword [esi + 0x14], 0x706c7a31
push ebx
lea eax, [ebp - 4]
push eax
jne 0x408028
push 0x18
lea eax, [ebp - 0x34]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0x18
jne 0x4080f7
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov ax, word [ebp - 0x24]
mov word [ebp - 0xc], ax
jmp 0x408040
push 0x12
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0x12
jne 0x4080f7
mov eax, dword [ebp - 8]
cmp dword [esi + 0xc], eax
jl 0x408066
add eax, 0x40
mov dword [ebp - 8], eax
shl eax, 2
push eax
push dword [esi + 4]
push 8
push dword [0x41235c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [esi + 4], eax
movsx eax, word [ebp - 0xc]
add eax, 0x19
push eax
push ebx
push dword [0x41235c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov eax, dword [ebp - 0x1c]
mov dword [edi], eax
mov eax, dword [ebp - 0x18]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [edi + 0xc], eax
push ebx
lea eax, [ebp - 4]
push eax
movsx eax, word [ebp - 0xc]
push eax
lea eax, [edi + 0x14]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, word [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov byte [eax + edi + 0x14], bl
cmp dword [esi + 0x14], 0x706c7a31
movsx eax, word [ebp - 0xc]
jne 0x4080c8
lea eax, [ecx + eax + 0x18]
jmp 0x4080cf
lea eax, [ecx + eax + 0x12]
mov dword [ebp + 8], eax
mov dword [edi + 0x10], eax
add eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
push 1
mov dword [ebp + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + eax*4], edi
inc dword [esi + 0xc]
push ebx
push dword [ebp - 0x14]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x407fe0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4096a4
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x4129f0]
call fcn.0040d80a
mov edi, eax
test edi, edi
je 0x409706
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4096cd
push dword [esp + 0xc]
push edi
call eax
jmp 0x409706
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.0040e530
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.0040e650
pop esi
pop ebx
pop edi
ret 8

Function at 0x409a2f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x1c]
push eax
mov ebx, 0xc8
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x409b18
mov eax, dword [ebp - 0xc]
dec eax
je 0x409afb
dec eax
jne 0x409b18
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x409a8e
cmp byte [ebp - 0x1e], 1
jne 0x409a8e
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x409af7
dec eax
je 0x409af3
dec eax
je 0x409ad1
dec eax
jne 0x409b18
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x409ac5
dec eax
je 0x409ab9
dec eax
jne 0x409b18
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x5f]
jmp 0x409b18
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x55]
jmp 0x409b18
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x4b]
jmp 0x409b18
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x409aef
dec eax
je 0x409aeb
dec eax
jne 0x409b18
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x41]
jmp 0x409b18
push 0x3c
jmp 0x409b17
push 0x32
jmp 0x409b17
push 0x14
jmp 0x409b17
push 5
jmp 0x409b17
cmp dword [ebp - 0x14], 0
je 0x409b15
cmp dword [ebp - 0x14], 0xa
je 0x409b11
cmp dword [ebp - 0x14], 0x5a
jne 0x409b18
push 0x28
jmp 0x409b17
push 0x1e
jmp 0x409b17
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret
Function at 0x40aa60
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x40aadc
push 9
call esi
test bl, al
je 0x40aadc
push 0x11
call esi
test bl, al
jne 0x40aadc
push 0x10
call esi
test bl, al
jne 0x40aadc
push 0x12
call esi
test bl, al
jne 0x40aadc
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40aadc
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x40aadc
xor eax, eax
jmp 0x40ab5e
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x40ab05
push 0x11
call esi
test bl, al
jne 0x40aafd
push 0x10
call esi
test bl, al
jne 0x40aafd
push 0x12
call esi
test bl, al
je 0x40ab05
push 1
push ebp
call fcn.0040aa19
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test edi, edi
je 0x40ab1b
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x40ab5b
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x40ab5b
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40ab5b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x40ab5b
dec esi
push esi
push dword [0x4129f8]
call fcn.0040d80a
test eax, eax
je 0x40ab5b
mov eax, dword [eax + 8]
jmp 0x40ab5d
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x40ac20
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov dword [0x4128cc], eax
cmp eax, edi
je 0x40ac53
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4128d0], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x4128c8], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40ac91
cmp dword [ebp - 0xc], 1
je 0x40aca2
cmp dword [ebp - 0xc], 2
jne 0x40ac91
cmp dword [ebp - 0x18], 5
jb 0x40aca2
jne 0x40ac91
cmp dword [ebp - 0x14], edi
jne 0x40ac91
mov dword [0x4128c8], edi
cmp dword [0x4128c8], edi
je 0x40aca8
call fcn.0040ab67
test eax, eax
jne 0x40aca8
mov dword [0x4128c8], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x40b805
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x40b875
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x40b857
mov dl, byte [eax - 1]
cmp dl, 0x20
je 0x40b856
cmp dl, 0x5c
je 0x40b856
cmp dl, 0x2f
jne 0x40b861
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x40b844
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40b877
xor eax, eax
leave
ret 4
Function at 0x40b943
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x40b96c
test byte [esp + 8], 2
je 0x40b960
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40b96e
xor eax, eax
ret 8

Function at 0x40baa0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x40bad5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x40be80
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x40bed9
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40bed8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x412a98]
push eax
push ecx
call fcn.0040d80a
test eax, eax
je 0x40bed4
cmp dword [eax + 4], 0
je 0x40bec2
push esi
push edi
push eax
call fcn.0040bee0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x40bee0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x40bf15
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40bf8a
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x40bf77
dec ecx
je 0x40bf62
sub ecx, 2
je 0x40bf4f
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.0040baa0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40bfb7
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc