joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8806b0
Capabilities:
Log keystrokes via application hook

Disassembly:
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [0x468bb0], eax
cmp byte [0x81b5a0], 0
jne 0x880707
push str.Set_BreakPoint__F4_
push 0x15e0
push 0
push dword [0x468bb0]
call dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, dword [0x81b5a4]
cmp dword [eax], 0
je 0x880702
push str.Delete_all_BreakPoints__Shift___F4_
push 0x15e2
push 0
push dword [0x468bb0]
call dword [sym.imp.USER32.dll_AppendMenuA]
jmp 0x880742
push str.Delete_BreakPoint__F4_
push 0x15e1
push 0
push dword [0x468bb0]
call dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, dword [0x81b5a4]
cmp dword [eax + 4], 0
je 0x880742
push str.Delete_all_BreakPoints__Shift___F4_
push 0x15e2
push 0
push dword [0x468bb0]
call dword [sym.imp.USER32.dll_AppendMenuA]
push 0x480
push 0
push dword [0x468bb0]
push dword [0x818aa8]
call dword [sym.imp.USER32.dll_HiliteMenuItem]
mov dword [0x81b584], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x880519
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x82a10c], eax
push dword [0x4660a8]
mov dword [0x4660a8], 1
call fcn.0088060a
pop dword [0x4660a8]
push 0
push dword [0x818aa8]
push 0
push ebx
push eax
push 0
push dword [0x468bb0]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push dword [0x82a10c]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push dword [0x468bb0]
call dword [sym.imp.USER32.dll_DestroyMenu]
ret
Function at 0x881259
Capabilities:
Create directory
Enumerate files on windows
Get common file path

Disassembly:
cmp dword [0x82d718], 0
je 0x881272
call fcn.00895505
cmp eax, 7
jne 0x881272
pop esi
ret
push 0x1030
push str.Wait_a_minute...
push str.Set_the_caret_where_you_want_the_code_to_be_pasted__and_click_OK.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0084a2b1
mov esi, 0x4a7614
mov edi, 0x816c9c
cmp byte [esi], 0
je 0x8812a0
movsb byte es:[edi], byte [esi]
jmp 0x881298
mov esi, str.WZRD010Form.exe
cmp byte [esi], 0
je 0x8812ad
movsb byte es:[edi], byte [esi]
jmp 0x8812a5
mov byte [edi], 0
push 0x81c1c4
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, 0x81c1c4
add esi, eax
mov dword [esi], 0x7a69575c
add esi, 4
mov dword [esi], 0x46647261
add esi, 4
mov dword [esi], 0x73656c69
add esi, 4
mov byte [esi], 0
push esi
push 0
push 0x81c1c4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop esi
mov dword [esi], 0x525a575c
add esi, 4
mov dword [esi], 0x726f4644
add esi, 4
mov dword [esi], 0x772e2a6d
add esi, 4
mov word [esi], 0x6677
add esi, 2
mov byte [esi], 0
push esi
push 0x468fb0
push 0x81c1c4
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [0x81c5e4], eax
xor ecx, ecx
cmp eax, 0xffffffff
je 0x88135e
push ecx
push 0x468fb0
push dword [0x81c5e4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
pop ecx
inc ecx
cmp eax, 0
jne 0x881337
push ecx
push dword [0x81c5e4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ecx
pop esi
mov ebx, ecx
mov edi, esi
sub edi, 2
std
mov ecx, 4
mov al, bl
and al, 0xf
cmp al, 0xa
jb 0x881376
add al, 7
add al, 0x30
stosb byte es:[edi], al
shr ebx, 4
loop 0x88136c
cld
mov dword [esi - 1], 0x6677772e
mov byte [esi + 3], 0
mov edi, 0x81b5b4
mov byte [edi], 0x22
inc edi
mov esi, 0x816c9c
cmp byte [esi], 0
je 0x8813a0
movsb byte es:[edi], byte [esi]
jmp 0x881398
mov byte [edi], 0x22
inc edi
mov dword [edi], 0x2220662d
add edi, 4
mov esi, 0x81c1c4
cmp byte [esi], 0
je 0x8813ba
movsb byte es:[edi], byte [esi]
jmp 0x8813b2
mov word [edi], 0x2022
add edi, 2
mov word [edi], 0x632d
add edi, 2
mov byte [edi], 0x20
inc edi
mov word [edi], 0x522d
add edi, 2
mov byte [edi], 0
inc edi
push 0
call fcn.008813e7
call fcn.00878ee6
ret
Function at 0x8813e7
Capabilities:
Create process on windows
Delete file
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push str.ProducedCode_BeginWrite
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x81c5d4], eax
push 0x829210
push 0x82dddc
push 0
push 0
push 0
push 0
push 0
push 0
push 0x81b5b4
push 0x816c9c
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
jne 0x881447
push 0x1030
push str._error
push str.The_Wizard_cannot_be_loaded.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x8814e5
push 0xffffffffffffffff
push dword [0x81c5d4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push str.RosAsmWizardProducedCode
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [0x81c5dc], eax
push 0
push 0
push 0
push 0xf001f
push dword [0x81c5dc]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edx, eax
mov dword [0x81c5e0], edx
add dword [0x81c5e0], 4
cmp dword [edx], 0
je 0x8814b4
cmp dword [ebp + 8], 0
je 0x8814a5
push dword [ebp + 8]
call fcn.00881079
push dword [edx]
push dword [0x81c5e0]
call fcn.0088118f
jmp 0x8814c5
cmp dword [ebp + 8], 0
jne 0x8814c5
push 0x81c1c4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.ProducedCode_Written
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [0x81c5d8], eax
push dword [0x81c5d8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [0x81c5d4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4

Function at 0x88253d
Capabilities:
Get file size
Read file on windows

Disassembly:
mov byte [0x81d3d4], 0
mov edi, 0x81cba0
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x4696dc
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x81cba0], 0
jne 0x88256a
ret
cmp dword [0x4696c4], 0
jbe 0x88257f
push dword [0x4696c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x81cba0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x8825b8
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
mov dword [0x4696c4], 0
jmp 0x882600
mov dword [0x4696c4], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x4696bc], eax
mov ebx, 0x4696b8
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x4696bc]
push dword [0x4696b8]
push dword [0x4696c4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
ret
Function at 0x8827db
Capabilities:
Write file on windows

Disassembly:
call fcn.0088253d
cmp dword [0x4696c4], 0
je 0x8828c9
call fcn.00882601
cmp byte [0x81d3d8], 1
jne 0x8828a0
mov edi, eax
mov esi, 0x46936e
rep movsb byte es:[edi], byte [esi]
push dword [0x4696c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4696c4], 0
push 0x1034
push 0x4697b3
push str.Ready_to_modify_choosen_PE_
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x882843
jmp 0x8828a0
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push 0x81cba0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x882872
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x469790], eax
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x4696bc]
push dword [0x4696b8]
push dword [0x469790]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [0x4696b8], 0
je 0x8828bd
mov eax, dword [0x4696b8]
call fcn.0084b661
mov dword [0x4696b8], 0
push dword [0x469790]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x8828d5
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, str.No_36_36_icon_in_this_file__or_too_much_colors_
call fcn.0084a000
ret
mov edi, 0x81cba0
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
mov dword [0x46982c], 0x281804
push 0x4697f8
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x81cba0], 0
jne 0x882905
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x81cba0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x882934
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x4696c4], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x81d3e0], eax
mov ebx, 0x81d3dc
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x81d3e0]
push dword [0x81d3dc]
push dword [0x4696c4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [0x81d3dc]
add esi, 4
lodsw ax, word [esi]
movzx ecx, ax
cmp byte [esi], 0x20
je 0x882999
add esi, 0x10
loop 0x88298a
jmp 0x8828ca
cmp dword [esi + 8], 0x2e8
je 0x8829a7
jmp 0x8828ca
add esi, 0xc
mov esi, dword [esi]
mov edi, 0x46936e
mov ecx, 0x2e8
add esi, dword [0x81d3dc]
rep movsb byte es:[edi], byte [esi]
push dword [0x4696c4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x81d3dc], 0
je 0x8829e7
mov eax, dword [0x81d3dc]
call fcn.0084b661
mov dword [0x81d3dc], 0
ret
Function at 0x8829e8
Capabilities:
Write file on windows

Disassembly:
mov edi, 0x81cba0
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
mov dword [0x46982c], 0x288006
push 0x4697f8
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
cmp dword [0x81cba0], 0
jne 0x882a18
ret
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
push 0x81cba0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x882a47
mov eax, str.This_option_saves_only_new_files
call fcn.0084a000
ret
mov dword [0x469790], eax
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push 0x2fe
push 0x469358
push dword [0x469790]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x469790]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x883283
Capabilities:
Get graphical window text

Disassembly:
push 0
push 0
push 0xe
push dword [0x469acd]
call dword [sym.imp.USER32.dll_SendMessageA]
inc eax
push str._1000
push eax
push 0xd
push dword [0x469acd]
call dword [sym.imp.USER32.dll_SendMessageA]
push str._1000
pop esi
call fcn.00882ddb
mov dword [str._1000], 0
cmp eax, 0x7d00
jbe 0x8832dd
mov eax, dword [str.ID_base_number_must_be_between_1_and_65535]
call fcn.0084a000
mov dword [str._1000], 0
ret
cmp eax, 1
jae 0x8832f7
mov eax, dword [0x4304b4]
call fcn.0084a000
mov dword [str._1000], 0
ret
mov dword [0x469b04], eax
inc eax
mov dword [str._1000], eax
ret

Function at 0x88374f
Capabilities:
Get graphical window text

Disassembly:
push 0
push 0
push 0xe
push dword [0x469ad4]
call dword [sym.imp.USER32.dll_SendMessageA]
inc eax
mov dword [0x828f84], eax
mov ebx, 0x828f88
mov edx, eax
call fcn.0084b515
push dword [0x828f88]
push dword [0x828f84]
push 0xd
push dword [0x469ad4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0x828f88]
cmp dword [esi], 0
jne 0x8837bb
cmp dword [0x828f88], 0
je 0x8837b5
mov eax, dword [0x828f88]
call fcn.0084b661
mov dword [0x828f88], 0
mov eax, 0
ret
add esi, dword [0x828f84]
mov dword [esi + 1], 0
cmp byte [esi], 0x20
ja 0x8837db
mov byte [esi], 0
dec esi
cmp esi, dword [0x828f88]
jb 0x883798
jmp 0x8837c8
push dword [0x828f88]
push 0
push 0xc
push dword [0x469ad4]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x828f88], 0
je 0x88380e
mov eax, dword [0x828f88]
call fcn.0084b661
mov dword [0x828f88], 0
mov eax, 1
ret
Function at 0x883c40
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x829188], 1
jne 0x883c58
cmp byte [0x46774c], 1
jne 0x883c57
call fcn.0088393d
ret
mov dword [0x48a6dc], 0x834c78
mov byte [0x829198], 0
cmp byte [0x829198], 0
jne 0x883c79
call fcn.008842c6
jmp 0x883c69
cmp dword [0x48a6dc], 0
jne 0x883c83
ret
mov edi, 0x508fa8
mov eax, 0
mov ecx, 0x41
rep stosd dword es:[edi], eax
mov dword [0x82b3c8], 0x2e77654e
mov dword [0x82b3cb], 0x666d622e
mov dword [0x82b3cf], 0
push 0x478fd8
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
cmp eax, 0
jne 0x883cc3
ret
push 0x666d622e
push 0x82b3c8
call fcn.0088b19e
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push 0x82b3c8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x883cff
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x4319b8], eax
mov dword [0x4319c0], 0
mov esi, dword [0x48a6dc]
mov ecx, dword [esi + 8]
mov esi, dword [esi + 4]
push 0
push 0x4319c0
push ecx
push esi
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [0x4319b8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4319b8], 0
ret

Function at 0x883d46
Capabilities:
Get file size
Read file on windows

Disassembly:
cmp byte [0x829188], 1
jne 0x883d5e
cmp byte [0x46774c], 1
jne 0x883d5d
call fcn.0088393d
ret
mov dword [0x48a844], str.bmf_Files
mov dword [0x48a868], 0x48a7fd
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x883db0
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x883ddf
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x829194], eax
cmp eax, 0
jbe 0x883e2e
mov ebx, 0x829190
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x829194]
push dword [0x829190]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x883e2f
ret
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 0x834c78
cmp dword [esi], 0
je 0x883e4a
add esi, 0xc
jmp 0x883e40
mov eax, dword [esi - 0xc]
add eax, 0x3e8
mov dword [esi], eax
mov eax, dword [0x829190]
mov dword [esi + 4], eax
mov eax, dword [0x829194]
mov dword [esi + 8], eax
ret
Function at 0x883e65
Capabilities:
Get file size
Read file on windows

Disassembly:
cmp byte [0x829188], 1
jne 0x883e7d
cmp byte [0x46774c], 1
jne 0x883e7c
call fcn.0088393d
ret
mov dword [0x48a6dc], 0x834c78
mov byte [0x829198], 0
cmp byte [0x829198], 0
jne 0x883e9e
call fcn.008842c6
jmp 0x883e8e
cmp dword [0x48a6dc], 0
jne 0x883ea8
ret
mov dword [0x48a844], str.bmf_Files
mov dword [0x48a868], 0x48a7fd
push dword [0x8187e4]
pop dword [0x48a83c]
push dword [0x8187e0]
pop dword [0x48a840]
mov edi, 0x845604
mov ecx, 0x104
mov eax, 0
rep stosd dword es:[edi], eax
push 0x48a838
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x845604], 0
jne 0x883efa
ret
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x845604
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x883f29
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x845a14], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x829194], eax
cmp eax, 0
jbe 0x883f78
mov ebx, 0x829190
mov edx, eax
call fcn.0084b515
mov dword [0x4319c0], 0
push 0
push 0x4319c0
push dword [0x829194]
push dword [0x829190]
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x883f79
ret
push dword [0x845a14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x48a6dc]
push esi
cmp dword [esi + 4], 0
je 0x883fa1
mov eax, dword [esi + 4]
call fcn.0084b661
mov dword [esi + 4], 0
pop esi
mov eax, dword [0x829190]
mov dword [esi + 4], eax
mov eax, dword [0x829194]
mov dword [esi + 8], eax
ret

Function at 0x88470b
Capabilities:
Get graphical window text

Disassembly:
mov byte [0x8291f4], 0
push 4
push dword [0x8291d4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [0x8291d0], eax
push 0
push 0
push 0xe
push dword [0x8291d0]
call dword [sym.imp.USER32.dll_SendMessageA]
inc eax
mov dword [0x8291c8], eax
mov ebx, 0x8291cc
mov edx, eax
call fcn.0084b515
push dword [0x8291cc]
push dword [0x8291c8]
push 0xd
push dword [0x8291d0]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, eax
cmp ecx, 0
jne 0x88476f
jmp 0x8847a6
mov esi, dword [0x8291cc]
add esi, dword [0x8291c8]
mov dword [esi + 1], 0
cmp byte [esi], 0x20
jae 0x88478d
mov byte [esi], 0
dec esi
jmp 0x884782
mov esi, dword [0x8291cc]
add ecx, esi
cmp byte [esi], 0x23
jae 0x8847a1
lodsb al, byte [esi]
cmp esi, ecx
ja 0x8847a1
jmp 0x884795
cmp byte [esi], 0x23
je 0x8847ca
push 0x1000
push str._error
push str.Bad_or_missing_ID_number_encounted_____r_n_________________________or_r_n___missing_space_separator_or_String
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [0x8291f4], 1
jmp 0x8847d0
mov dword [0x8291cc], esi
push dword [0x8291cc]
push 0
push 0xc
push dword [0x8291d0]
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [0x8291cc], 0
je 0x884803
mov eax, dword [0x8291cc]
call fcn.0084b661
mov dword [0x8291cc], 0
ret
Function at 0x884e99
Capabilities:
Create process on windows
Terminate process

Disassembly:
cmp byte [0x466bd6], 1
jne 0x884eb4
push dword [0x829224]
push dword [0x829210]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x829210
push 0x82dddc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Calc.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
jne 0x884eff
push 0x829210
push 0x82dddc
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.C:Program_FilesBaseCalcBASECALC.EXE
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 0
jne 0x884f21
push 0x1040
push str.Requested_file_not_found
push str._r_n_r_n____Copy_your_prefered_Calc_in_this_directory_r_n_r_n____and_rename_it_Calc.exe_r_n_r_n____or_have_a_search_for_Calc.exe_in_RosAsm_source_____r_n____and_read_the_header_comment..._r_n_r_n
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x884f39
push 0x829224
push dword [0x829210]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov byte [0x466bd6], 1
ret

Function at 0x8850ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.open
push dword [0x8187e4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x8850e9
push eax
push 0x1040
push str.Requested_file_not_found
push dword [ebp + 0x10]
push dword [0x8187e4]
call dword [sym.imp.USER32.dll_MessageBoxA]
pop eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x8850ef
Capabilities:
Create process on windows

Disassembly:
sub eax, 0x7d0
mov ecx, 0x100
mul ecx
add eax, 0x81a8f8
push 0xa
push 0
push 0x46a4f3
push eax
push str.open
push dword [0x8187e4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
ret
Function at 0x88643e
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
mov dword [0x829dd4], 0
mov dword [0x829ee0], 0
push dword [0x8187e4]
pop dword [0x46aafc]
push dword [0x8187e0]
pop dword [0x46ab00]
push 0x46aaf8
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
cmp dword [0x829dd4], 0
je 0x886550
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x829dd4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x8864b8
mov eax, dword [str.Unable_to_open:_System_mangling_destination_file]
call fcn.0084a000
ret
mov dword [0x829ed8], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x829edc], eax
mov ebx, 0x829ee0
mov edx, dword [0x829edc]
call fcn.0084b515
add eax, dword [0x829edc]
mov dword [0x829ee4], eax
push 0
push 0x4319c0
push dword [0x829edc]
push dword [0x829ee0]
push dword [0x829ed8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x829ed8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x829ee0]
cmp word [eax], 0x5a4d
je 0x88651f
jmp 0x886551
sub eax, 0x44448c
add eax, 0x4444c8
mov ebx, dword [eax]
mov eax, dword [0x829ee0]
add eax, ebx
cmp eax, dword [0x829ee4]
jbe 0x88653d
jmp 0x886551
cmp eax, dword [0x829ee0]
jae 0x886547
jmp 0x886551
cmp word [eax], 0x4550
je 0x886550
jmp 0x886551
ret
mov eax, dword [str.This_is_not_a_PE_File]
call fcn.0084a000
cmp dword [0x829ee0], 0
je 0x886578
mov eax, dword [0x829ee0]
call fcn.0084b661
mov dword [0x829ee0], 0
ret
Function at 0x886af2
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov esi, 0x813c64
mov edi, 0x829f50
cmp byte [esi], 0
je 0x886b07
movsb byte es:[edi], byte [esi]
jmp 0x886aff
cmp byte [edi - 1], 0x5c
je 0x886b10
dec edi
jmp 0x886b07
mov dword [0x82a054], edi
mov word [edi], 0x2e2a
mov dword [edi + 2], 0x445547
push 0x509de8
push 0x829f50
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x886c1e
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 0x509e14
mov edi, dword [0x82a054]
cmp byte [esi], 0
je 0x886b55
movsb byte es:[edi], byte [esi]
jmp 0x886b4d
mov byte [edi], 0
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
push 0x829f50
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x82a058], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x82a05c], eax
mov ebx, 0x82a060
mov edx, eax
call fcn.0084b515
push 0
push 0x4319c0
push dword [0x82a05c]
push dword [0x82a060]
push dword [0x82a058]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [0x82a058]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [0x82a060]
mov edx, esi
add edx, dword [0x82a05c]
cmp esi, edx
jae 0x886c12
cmp byte [esi], 0x5b
jne 0x886c0c
inc esi
cmp byte [esi], 0x26
jne 0x886c0c
inc esi
mov edi, 0x4a7a28
cmp byte [esi], 0x3a
je 0x886bf2
movsb byte es:[edi], byte [esi]
jmp 0x886bea
mov byte [edi], 0
push edx
push 0x4a7a28
push 0
push 0x180
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edx
inc esi
jmp 0x886bcd
mov byte [0x82a064], 1
jmp 0x886c32
push 0
push str.File_not_found
push str._r_nBefore_using_this_Tool__r_nyou_have_to_save_the_GUIDs_File_s__r_nin_the_RosAsmFiles_Directory_r_n_aside_Equates.equ__r_n
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esp, ebp
pop ebp
ret 4

Function at 0x88ac0b
Capabilities:
Get graphical window text

Disassembly:
push ecx
push 0x82b344
push 0xf
push 0xd
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edx
call fcn.00889849
mov esi, 0x82b180
mov ebx, 1
cmp dword [esi], edx
je 0x88ac36
add esi, 4
inc ebx
jmp 0x88ac2c
shr ebx, 1
cmp ebx, 2
jbe 0x88ac3e
dec ebx
add ebx, dword [0x82b3bc]
mov al, 0x20
cmp ebx, 0
jbe 0x88ac50
repne scasb al, byte es:[edi]
dec ebx
jmp 0x88ac46
push edi
mov eax, 0
mov ecx, 0
mov esi, 0x82b344
mov cl, byte [esi]
inc esi
cmp cl, 0
jbe 0x88ac76
mov edx, 0xa
mul edx
sub ecx, 0x30
add eax, ecx
jmp 0x88ac60
mov ebx, eax
add ebx, dword [0x82b17c]
mov dword [0x82b17c], 0
mov edi, 0x82b344
call fcn.0088884d
mov al, 0
stosb byte es:[edi], al
pop edi
mov eax, 0x30303030
stosd dword es:[edi], eax
dec edi
mov esi, 0x82b344
cmp byte [esi + 1], 0
jbe 0x88acab
inc esi
jmp 0x88aca2
std
mov ecx, 4
lodsb al, byte [esi]
stosb byte es:[edi], al
cmp esi, 0x82b344
jae 0x88acbd
jmp 0x88acbf
loop 0x88acb1
cld
ret