joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010e60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x7d4
mov eax, dword [0x10032f68]
xor eax, esp
mov dword [esp + 0x7d0], eax
push esi
mov esi, dword [esp + 0x7dc]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10010e8c
test al, 0x10
je 0x10010ed0
cmp dword [esp + 0x7e0], 0
je 0x10010ed0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.DLL_File__s__not_exist__Err:_d
push 1
push 0x10034838
call fcn.100146a0
push esi
call fcn.10010d70
add esp, 0x18
xor eax, eax
pop esi
mov ecx, dword [esp + 0x7d0]
xor ecx, esp
call fcn.100157eb
add esp, 0x7d4
ret
push ebp
push 0x3e8
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 8]
push ecx
call ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push eax
call fcn.10014fe0
add esp, 8
test eax, eax
je 0x10010f33
lea edx, [esp + 8]
push edx
push esi
call fcn.100154be
add esp, 8
test eax, eax
je 0x10010f33
pop ebp
mov eax, 1
pop esi
mov ecx, dword [esp + 0x7d0]
xor ecx, esp
call fcn.100157eb
add esp, 0x7d4
ret
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.base.dll
lea eax, [esp + 0x14]
push eax
mov ecx, eax
push ecx
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea edx, [esp + 0x10]
push edx
call ebx
test eax, eax
jne 0x10010faf
lea edx, [esp + 0x10]
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x10010f63
lea eax, [esp + 0x10]
push eax
call ebp
push str.base.dll
lea ecx, [esp + 0x14]
push ecx
mov edx, ecx
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x10010faf
push esi
call fcn.10002450
add esp, 4
test eax, eax
jne 0x10011009
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.DLL_File__s__HasWppExSign_Fail__Err:_d
jmp 0x10010fe3
cmp dword [0x1003482c], 0
jne 0x1001101a
lea ecx, [esp + 0x10]
push ecx
call fcn.1000f220
add esp, 4
test eax, eax
jne 0x10011010
push esi
call fcn.10002450
add esp, 4
test eax, eax
jne 0x10011009
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1002b880
push 1
push 0x10034838
call fcn.100146a0
add esp, 0x14
cmp dword [esp + 0x7ec], 0
je 0x10011005
push esi
call fcn.10010d70
add esp, 4
xor eax, eax
jmp 0x1001105d
mov eax, 1
jmp 0x1001105d
mov dword [0x1003482c], 1
push 0
push esi
mov ecx, 0x10032188
call fcn.100151e0
mov edi, eax
test edi, edi
jne 0x1001105b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.DLL_File__s__HasWppExSign_Fail__ErrCode:_d
push 1
push 0x10034838
call fcn.100146a0
add esp, 0x14
cmp dword [esp + 0x7ec], edi
je 0x1001105b
push esi
call fcn.10010d70
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x7e0]
pop edi
pop ebx
pop ebp
pop esi
xor ecx, esp
call fcn.100157eb
add esp, 0x7d4
ret
Function at 0x10012350
Capabilities:
Terminate process

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
push ebx
push esi
mov esi, dword [esp + 0x1c]
mov ebx, ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push esi
push eax
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov dword [esp + 0x24], eax
test eax, eax
je 0x1001239e
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 8]
pop esi
mov dword [ecx], edx
pop ebx
pop ecx
ret 0x1c
mov eax, dword [esi]
cmp eax, 6
je 0x100123ad
cmp eax, 0xb
je 0x100123ad
push eax
jmp 0x100123c2
mov eax, dword [esi + 8]
mov ecx, dword [eax]
push ecx
mov ecx, ebx
call fcn.10011e00
cmp eax, 1
jne 0x100123dd
mov edx, dword [esi]
push edx
mov eax, dword [esp + 0xc]
push eax
push 0
push str.MySendMessageTimeout_Failed:_d___d_Msg:_u
push 1
push 0x10034838
call fcn.100146a0
add esp, 0x18
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
je 0x100123f7
call edi
cmp eax, 0x5b4
jne 0x100124ac
mov eax, dword [esi]
cmp eax, 6
je 0x10012403
cmp eax, 0xb
jne 0x10012417
mov eax, dword [esi + 8]
mov edx, dword [eax]
push edx
mov ecx, ebx
call fcn.10011e00
cmp eax, 1
jne 0x10012436
mov eax, dword [esi]
push eax
call edi
mov ecx, dword [esp + 0x10]
push eax
push ecx
push 0
push str.MySendMessageTimeout_timeout:__d___d___d_Msg:_u
push 1
push 0x10034838
call fcn.100146a0
add esp, 0x1c
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push eax
mov dword [ebx + 0xd0], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10012495
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10012495
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Terminate_SendMsgs_Process...
push 1
push 0x10034838
call fcn.100146a0
add esp, 0xc
mov eax, dword [0x10034830]
inc eax
cmp eax, 2
mov dword [0x10034830], eax
jl 0x100124ac
mov ecx, ebx
call fcn.10011510
mov eax, dword [esp + 0x28]
pop edi
pop esi
pop ebx
pop ecx
ret 0x1c
Function at 0x10014190
Capabilities:
Create thread

Disassembly:
sub esp, 0x26c
mov eax, dword [0x10032f68]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
mov ebx, dword [esp + 0x27c]
push ebp
mov ebp, dword [esp + 0x27c]
push esi
push edi
mov edi, dword [esp + 0x280]
push ebp
push str.Init_pdown.dll_HWND:_u
push 1
push 0x10034838
mov esi, ecx
call fcn.100146a0
add esp, 0x10
lea eax, [esi + 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp eax, 1
jg 0x100143c7
mov ecx, esi
call fcn.1000eb80
test edi, edi
je 0x10014213
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10014200
sub eax, edx
sar eax, 1
push eax
push edi
jmp 0x1001421a
push 0
push 0x1002ee54
lea ecx, [esi + 0xf8]
call fcn.1000a200
test ebx, ebx
je 0x10014243
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10014230
sub eax, edx
sar eax, 1
push eax
push ebx
jmp 0x1001424a
push 0
push 0x1002ee54
lea ecx, [esi + 0x14c]
call fcn.1000a200
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x7a]
push edx
mov word [esp + 0x7c], cx
call fcn.10015800
add esp, 0xc
push 0x104
lea eax, [esp + 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x70]
lea edx, [eax + 2]
jmp 0x10014290
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10014290
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esi + 0x114]
call fcn.1000a200
xor edx, edx
push 0x5e
push edx
lea eax, [esp + 0x1a]
push eax
mov dword [esi + 0xcc], ebp
mov word [esp + 0x1c], dx
call fcn.10015800
push 0x60
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.1000e2d0
add esp, 0x18
test eax, eax
je 0x10014307
lea eax, [esp + 0x10]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100142f0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x14]
push eax
jmp 0x1001430e
push 0
push 0x1002ee54
lea ecx, [esi + 0x130]
call fcn.1000a200
mov eax, dword [esi + 0x170]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1001432c
push eax
call edi
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp dword [esi + 0x178], 0
mov dword [esi + 0x170], eax
jne 0x10014371
mov ecx, esi
call fcn.1000ded0
lea ecx, [esi + 0x17c]
push ecx
push 0
push esi
push 0x10013380
push 0
push 0
call fcn.10016d0d
add esp, 0x18
mov dword [esi + 0x178], eax
push 1
push 0x4a
call fcn.1000eb30
mov edx, dword [esi + 0x170]
add esp, 8
push 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x170]
push eax
call edi
cmp dword [esi + 0xc8], 0
mov dword [esi + 0x170], 0
jne 0x100143b2
mov ecx, esi
call fcn.10011510
push ebp
push str.Init_pdown.dll_HWND:_u_
push 1
push 0x10034838
call fcn.100146a0
add esp, 0x10
mov ecx, dword [esp + 0x278]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.100157eb
add esp, 0x26c
ret 0xc
Function at 0x10014540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x10032f68]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x41c]
push edi
mov edi, dword [esp + 0x424]
test edi, edi
jne 0x10014581
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.100157eb
add esp, 0x414
ret
push esi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x21e]
xor eax, eax
push edx
mov word [edi], ax
mov word [esp + 0x220], cx
call fcn.10015800
add esp, 0xc
push 0
push 0x1a
lea eax, [esp + 0x21c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], cx
call fcn.10015800
add esp, 0xc
push 0x104
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0xc]
push 0x5c
push ecx
call fcn.10015492
lea edx, [esp + 0x14]
push 0x2f
push edx
mov esi, eax
call fcn.10015492
add esp, 0x10
test esi, esi
jne 0x10014626
test eax, eax
jne 0x1001462c
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.100157eb
add esp, 0x414
ret
cmp esi, eax
jbe 0x1001462c
mov eax, esi
lea esi, [eax + 2]
push 0x2e
push esi
call fcn.10015492
add esp, 8
test eax, eax
je 0x10014643
xor ecx, ecx
mov word [eax], cx
push esi
lea edx, [esp + 0x218]
push edx
push str._sHalowpLiveUpdateLog_s.log
push 0x103
push edi
call fcn.1001627b
lea eax, [esp + 0x228]
push eax
push str._sHalowpLiveUpdateLog
push 0x103
push ebx
call fcn.1001627b
mov ecx, dword [esp + 0x440]
add esp, 0x24
pop esi
pop edi
pop ebx
xor ecx, esp
mov al, 1
call fcn.100157eb
add esp, 0x414
ret
Function at 0x10014d60
Capabilities:
Create thread

Disassembly:
push edi
mov edi, ecx
mov ecx, dword [0x10034c6c]
call fcn.10011580
test al, al
jne 0x10011694
pop edi
ret
push ebx
push esi
lea esi, [edi + 8]
mov ecx, esi
mov bl, 1
call fcn.10008940
test al, al
jne 0x100116b3
mov ecx, esi
call fcn.1000d980
mov bl, al
test bl, bl
je 0x100116dd
cmp dword [edi + 0x180], 0
jne 0x100116dd
lea eax, [edi + 0x184]
push eax
push 0
push edi
push 0x1000e860
push 0
push 0
call fcn.10016d0d
add esp, 0x18
mov dword [edi + 0x180], eax
push str.Start_Lan....
push 1
push 0x10034838
call fcn.100146a0
add esp, 0xc
pop esi
mov al, bl
pop ebx
pop edi
ret
mov ecx, dword [0x10034c6c]
jmp 0x10011680

Function at 0x10014de0
Capabilities:
Copy file

Disassembly:
sub esp, 0x244
mov eax, dword [0x10032f68]
xor eax, esp
mov dword [esp + 0x240], eax
mov ecx, dword [esp + 0x258]
mov edx, dword [esp + 0x250]
mov eax, dword [esp + 0x248]
push ebx
push esi
push edi
mov edi, dword [esp + 0x258]
push ecx
mov ecx, dword [esp + 0x264]
push 0
push 0
push ecx
push edx
push edi
push eax
xor bl, bl
call sym.PDown.dll_PPStartTask
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x10014eba
lea eax, [esp + 0xc]
push eax
push esi
call sym.PDown.dll_PPQueryTask
add esp, 8
test al, al
je 0x10014eab
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x3c]
cmp eax, 1
je 0x10014e88
cmp eax, 2
je 0x10014eaa
cmp eax, 3
je 0x10014eaa
cmp eax, 4
je 0x10014eaa
cmp eax, 0xffffffff
je 0x10014eaa
push 0xc8
call ebp
lea ecx, [esp + 0x10]
push ecx
push esi
call sym.PDown.dll_PPQueryTask
add esp, 8
test al, al
jne 0x10014e50
jmp 0x10014eaa
lea edx, [esp + 0x48]
push edi
push edx
call fcn.10017367
add esp, 8
test eax, eax
je 0x10014ea8
push 0
push edi
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov bl, 1
pop ebp
push esi
call sym.PDown.dll_PPRemoveTask
push esi
call sym.PDown.dll_PPCloseHandle
add esp, 8
mov ecx, dword [esp + 0x24c]
pop edi
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.100157eb
add esp, 0x244
ret

Function at 0x100157eb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10032f68]
jne 0x100157f5
repz ret
jmp fcn.10019ac0
Function at 0x10021c4a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100188e5
and dword [ebp - 4], 0
cmp dword [0x10035640], 0
mov ebx, eax
jne 0x10021cfb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10021dac
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10021dac
push eax
call fcn.10018873
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10035640], eax
call esi
push eax
call fcn.10018873
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10035644], eax
call esi
push eax
call fcn.10018873
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10035648], eax
call esi
push eax
call fcn.10018873
pop ecx
mov dword [0x10035650], eax
test eax, eax
je 0x10021cfb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10018873
pop ecx
mov dword [0x1003564c], eax
mov eax, dword [0x1003564c]
cmp eax, ebx
je 0x10021d53
cmp dword [0x10035650], ebx
je 0x10021d53
push eax
call fcn.100188ee
push dword [0x10035650]
mov esi, eax
call fcn.100188ee
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10021d53
test edi, edi
je 0x10021d53
call esi
test eax, eax
je 0x10021d4a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10021d4a
test byte [ebp - 0xc], 1
jne 0x10021d53
or dword [ebp + 0x10], 0x200000
jmp 0x10021d8c
mov eax, dword [0x10035644]
cmp eax, ebx
je 0x10021d8c
push eax
call fcn.100188ee
pop ecx
test eax, eax
je 0x10021d8c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10021d8c
mov eax, dword [0x10035648]
cmp eax, ebx
je 0x10021d8c
push eax
call fcn.100188ee
pop ecx
test eax, eax
je 0x10021d8c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10035640]
call fcn.100188ee
pop ecx
test eax, eax
je 0x10021dac
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10021dae
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x1ca367ca
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x9286ed9
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402591
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x484f88
call fcn.004847e4
sub esp, 0x30
push ebx
push esi
mov esi, ecx
or ebx, 0xffffffff
mov ecx, dword [ebp + 8]
cmp ecx, ebx
mov dword [ebp - 0x14], esi
sete al
test al, al
je 0x4025b2
xor eax, eax
cmp ecx, ebx
cmovne eax, ecx
jmp 0x402706
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4025e1
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4025e1
mov eax, dword [ebp + 8]
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], al
jmp 0x402705
xor edi, edi
cmp dword [esi + 0x4c], edi
je 0x402703
mov ecx, esi
call fcn.00403168
cmp dword [esi + 0x38], edi
jne 0x402610
push dword [esi + 0x4c]
mov esi, dword [ebp + 8]
push esi
call fcn.00401e23
test al, al
pop ecx
pop ecx
cmovne ebx, esi
jmp 0x402703
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
push edi
push 8
mov byte [ebp - 0x10], al
call fcn.00401f77
lea eax, [esi + 0x40]
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x28]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
cmp edi, 0x10
lea edx, [ebp - 0x3c]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x3c]
cmovae edx, dword [ebp - 0x3c]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
lea eax, [ebp - 0xf]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call dword [edi + 0x1c]
test eax, eax
js 0x4026f7
cmp eax, 1
jg 0x4026dc
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp edi, 0x10
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x20], edx
je 0x4026ad
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x3c]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.00469a73
mov edx, dword [ebp - 0x20]
add esp, 0x10
cmp edx, eax
jne 0x4026f7
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x10]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x24], eax
jne 0x4026d7
test edx, edx
jne 0x40262d
cmp dword [ebp - 0x2c], 0x20
jae 0x4026f7
push edx
push 8
lea ecx, [ebp - 0x3c]
call fcn.00402f3c
jmp 0x40262a
mov ebx, dword [ebp + 8]
jmp 0x4026f7
cmp eax, 3
jne 0x4026f7
mov eax, dword [ebp - 0x14]
push dword [eax + 0x4c]
push dword [ebp - 0x10]
call fcn.00401e23
test al, al
pop ecx
cmovne ebx, dword [ebp + 8]
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00402cee
mov eax, ebx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4031b6
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x484fb8
call fcn.004847e4
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x4032ac
cmp byte [ebx + 0x3d], 0
je 0x4032ac
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x4031f4
xor al, al
jmp 0x4032ae
push 0
push 8
lea ecx, [ebp - 0x2c]
call fcn.00401f77
and dword [ebp - 4], 0
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10
lea eax, [ebp - 0x14]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
lea esi, [ebp - 0x2c]
cmovae edi, edx
cmovae esi, edx
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x403244
sub eax, 1
je 0x403248
dec eax
sub eax, 1
je 0x40329a
xor bl, bl
jmp 0x40329c
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
cmp ecx, 0x10
mov esi, dword [ebp - 0x14]
cmovae eax, edx
sub esi, eax
je 0x403280
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
push esi
cmovae eax, edx
push 1
push eax
call fcn.00469a73
add esp, 0x10
cmp esi, eax
jne 0x403240
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp byte [ebx + 0x3d], 0
je 0x40329a
test esi, esi
jne 0x40320a
push esi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00402f3c
jmp 0x403204
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00402cee
mov al, bl
jmp 0x4032ae
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403f6e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 4], ebx
push esi
push edi
lea esi, [ebx + 0x10]
mov dword [ebx], vtable.Window.0
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebp - 4], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.00406896
mov dword [esi], eax
lea edi, [ebx + 0x18]
lea esi, [edi + 8]
mov dword [edi], 0x40414c
mov ecx, esi
mov dword [edi + 4], ebx
call fcn.00406250
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 0x12
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esi + 1], edi
mov eax, ebx
pop edi
mov dword [esi + 0xc], 0x4063b7
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x404026
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
and dword [ebp - 4], 0
lea eax, [ebp - 0x404]
push esi
push 0x400
push 0
push eax
mov esi, ecx
call fcn.004663d0
add esp, 0xc
lea eax, [ebp - 0x404]
push 0x200
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x404]
push eax
call fcn.00406124
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x404295
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x1c], 0
xor eax, eax
push ebx
push esi
push edi
push 6
mov esi, ecx
lea edi, [ebp - 0x18]
pop ecx
rep stosd dword es:[edi], eax
movzx eax, word [ebp + 0xc]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push esi
push ecx
lea ecx, [ebp - 0x38]
mov byte [esi + 0x48], 1
mov ebx, eax
call fcn.00405e24
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
movzx eax, word [esi + 0x44]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [esi + 4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x40433f
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x404348
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40433f
lea eax, [ebp - 0x1c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x40433f
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push dword [esi + 4]
call edi
test eax, eax
jne 0x4042f5
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret 8