joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468dcf
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x4c8518], 0
push esi
push edi
mov esi, 0x4c8530
jne 0x468dee
push 0
call fcn.00425d1a
pop ecx
mov ecx, eax
call fcn.00468d92
mov dword [0x4c5190], 0x270
mov edi, 0xe3
mov dword [0x4c8ef0], esi
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi], eax
mov esi, edx
dec edi
jne 0x468e03
mov edi, 0x18c
lea edx, [esi + 4]
mov al, byte [edx]
and al, 1
movzx ecx, al
mov eax, dword [esi]
neg ecx
sbb ecx, ecx
xor eax, dword [edx]
and eax, 0x7ffffffe
and ecx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, ecx
mov dword [esi], eax
lea esi, [edx]
dec edi
jne 0x468e38
mov ecx, dword [0x4c8530]
mov al, cl
and al, 1
movzx edx, al
mov eax, dword [esi]
neg edx
pop edi
sbb edx, edx
xor eax, ecx
and eax, 0x7ffffffe
and edx, 0x9908b0df
xor eax, dword [esi]
shr eax, 1
xor eax, dword [esi - 0x38c]
xor eax, edx
mov dword [esi], eax
pop esi
ret

Function at 0x4692d7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x4692fc
mov eax, dword [esi + 0xc]
add eax, dword [esi + 4]
push 8
push eax
lea eax, [ebp - 8]
push eax
call fcn.00421950
add esp, 0xc
jmp 0x46930f
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.004260f2
add esp, 0x10
movzx ecx, byte [ebp - 4]
movzx eax, byte [ebp - 3]
add dword [esi + 0xc], 8
shl ecx, 8
or ecx, eax
mov byte [ebp - 4], 0
movzx eax, byte [ebp - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 1]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
push str.EA06
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
call fcn.004261a0
neg eax
pop ecx
pop ecx
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4693e5
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov ecx, 0x10000
mov eax, dword [esi + 0x460]
test eax, eax
je 0x4693fb
cmp eax, ecx
jne 0x469416
push dword [esi + 0x1c]
push ecx
push 1
push dword [esi + 0x458]
call fcn.004260f2
add esp, 0x10
and dword [esi + 0x460], 0
mov ecx, dword [esi + 0x460]
mov eax, dword [esi + 0x458]
mov al, byte [ecx + eax]
inc ecx
mov dword [esi + 0x460], ecx
pop esi
ret

Function at 0x46942e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x45c]
mov esi, dword [edi + 0x454]
mov byte [esi + edx], al
mov eax, 0x10000
inc dword [edi + 0x45c]
cmp dword [edi + 0x45c], eax
jne 0x469475
push dword [edi + 0x20]
push eax
push 1
push dword [edi + 0x454]
call fcn.00425373
add esp, 0x10
and dword [edi + 0x45c], 0
pop edi
pop esi
pop ebp
ret 4
Function at 0x46947b
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x45c]
test eax, eax
je 0x4694a3
push dword [esi + 0x20]
push eax
push 1
push dword [esi + 0x454]
call fcn.00425373
add esp, 0x10
and dword [esi + 0x45c], 0
pop esi
ret

Function at 0x46964f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
lea ecx, [ebp - 0xdc]
push esi
push edi
call fcn.004694a5
push dword [ebp + 0x10]
lea ecx, [ebp - 0xdc]
call fcn.004694eb
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x469693
mov edi, dword [ebp + 8]
push ecx
push ecx
lea ecx, [ebp - 0xdc]
call fcn.00469623
xor byte [esi + edi], al
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x46967d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x472834
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ecx + 0x30], 0
je 0x472843
pop ebp
jmp fcn.00472904
pop ebp
jmp fcn.00472849

Function at 0x472be2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
je 0x472c1f
cmp byte [ebp + 8], 0
je 0x472c1f
sub esp, 0x10
lea ecx, [esi + 0xd4]
call fcn.00471c80
push esi
push 0
push 0x472cb2
call fcn.004267dc
xor eax, eax
add esp, 0xc
cmp dword [esi + 0x18], eax
sete al
jmp 0x472c27
push dword [ebp + 8]
call fcn.00471e54
pop esi
pop ebp
ret 4

Function at 0x4777e2
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
or edx, 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 8]
add eax, esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov ebx, eax
imul ebx, dword [ebp + 0x14]
push edi
mov edi, esi
lea eax, [esi + eax*4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x14]
shl ebx, 2
shl eax, 2
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 2]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi + 1]
xor edx, dword [ecx*4 + 0x4b80c0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
movzx eax, byte [esi]
add esi, ebx
xor edx, dword [ecx*4 + 0x4b80c0]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4b80c0]
cmp esi, dword [ebp + 8]
jb 0x477859
add edi, dword [ebp + 0xc]
mov esi, edi
cmp edi, dword [ebp + 0x10]
jb 0x477815
not edx
mov dword [ebp + 8], edx
fild dword [ebp + 8]
test edx, edx
jns 0x477870
fadd qword [0x4bcad8]
pop edi
fstp qword [ebp - 8]
fld qword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xf2f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00f2f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xf2f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2f06a
add dl, dl
jne 0xf2f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2f0dc
xor eax, eax
add dl, dl
jne 0xf2f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xf2f17d
add dl, dl
jne 0xf2f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xf2f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xf2f075
mov eax, 1
add dl, dl
jne 0xf2f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf2f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2f0e1
sub eax, ebx
mov ebx, 1
jne 0xf2f128
mov ecx, 1
add dl, dl
jne 0xf2f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf2f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf2f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xf2f136
cmp eax, 0x7d00
jae 0xf2f16d
cmp eax, 0x500
jb 0xf2f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2f075
cmp eax, 0x7f
ja 0xf2f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xf2f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xf2f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xf2f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401942
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401981
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401981
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401981
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401981
cmp dword [ecx + 0x74], 0xe
jbe 0x401981
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40fc60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fc8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fc8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x412040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
push esi
push edi
push eax
mov ebx, ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x41207d
push ebx
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 8]
push dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, 0x41e05c
mov ecx, 0x41e070
call fcn.004122e0
mov esi, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412097
sub eax, esi
lea edi, [ebx - 2]
nop word [eax + eax]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4120b0
mov ecx, eax
mov edx, 0x41e074
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.004122e0
mov ecx, eax
call fcn.00412260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4120f0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x41c]
mov esi, ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 0x418]
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
pop esi
test eax, eax
js 0x41214d
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x41c]
push dword [ebp - 0x418]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x41e034
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x41e050
push eax
call fcn.00401010
add esp, 0x10
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret

Function at 0x412260
Capabilities:
Create directory

Disassembly:
push edi
mov edi, ecx
cmp word [edi + 2], 0x3a
jne 0x4122cf
cmp word [edi + 4], 0x5c
jne 0x4122cf
push ebx
push esi
lea eax, [edi + 6]
push 0x5c
push eax
call fcn.00401c75
mov esi, eax
add esp, 8
test esi, esi
je 0x4122c0
movzx ebx, word [esi + 2]
add esi, 2
xor eax, eax
push eax
push edi
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4122ac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4122c9
push 0x5c
push esi
mov word [esi], bx
call fcn.00401c75
mov esi, eax
add esp, 8
test esi, esi
jne 0x412287
pop esi
pop ebx
mov eax, 1
pop edi
ret
pop esi
pop ebx
xor eax, eax
pop edi
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
ret
Function at 0x4123b0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0
push 0x80000080
push 2
push 0
push 0
push 0x40000000
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4123e0
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp + 8]
movzx eax, si
push eax
push dword [0x422650]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41242a
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x1010
push 0x41db8c
push 0xa
push eax
call esi
push 0x1010
push str.test
push str.FindResource
push edi
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push dword [0x422650]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
push dword [0x422650]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4128c0
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa3c
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor edx, edx
nop dword [eax + eax]
movzx eax, word [edx + 0x422750]
lea edx, [edx + 2]
mov word [ebp + edx - 0x61e], ax
test ax, ax
jne 0x4128e0
push 0x41dfbc
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push 0x41dfd8
push eax
call fcn.00401010
add esp, 0x10
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 0xa34]
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x41295d
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0xa34]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0xa38]
push dword [ebp - 0xa34]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0xa38]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x41dfe4
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x41e000
push eax
call fcn.00401010
add esp, 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0xa30]
push eax
push 0x4172b0
push 1
push 0
push 0x4172d0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
js 0x412aaa
mov eax, dword [ebp - 0xa30]
lea edx, [ebp - 0xa3c]
push edx
push 0x4172c0
push eax
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
test esi, esi
js 0x412a9e
mov eax, dword [ebp - 0xa30]
lea edx, [ebp - 0x414]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov esi, eax
test esi, esi
js 0x412a92
xor ecx, ecx
nop word [eax + eax]
movzx eax, word [ebp + ecx - 0x414]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x20e], ax
test ax, ax
jne 0x412a00
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412a21
sub ecx, edx
sar ecx, 1
test ecx, ecx
jle 0x412a44
cmp word [ebp + ecx*2 - 0x20c], 0x5c
je 0x412a44
dec ecx
test ecx, ecx
jg 0x412a34
cmp ecx, 2
mov eax, 3
cmovne eax, ecx
add eax, eax
cmp eax, 0x208
jae 0x412ac4
xor ecx, ecx
lea edx, [ebp - 0x20c]
mov word [ebp + eax - 0x20c], cx
mov eax, dword [ebp - 0xa30]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov esi, eax
test esi, esi
js 0x412a92
mov eax, dword [ebp - 0xa3c]
lea edx, [ebp - 0xa2c]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0xa3c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xa30]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
test esi, esi
pop esi
setne al
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
call fcn.004013b8
int3
Function at 0x412ad0
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x41c]
mov esi, ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 0x418]
push eax
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
pop esi
test eax, eax
js 0x412b2d
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [ebp - 0x41c]
push dword [ebp - 0x418]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x41e00c
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push 0x41e028
push eax
call fcn.00401010
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412b77
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
Function at 0x4140e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xc8
mov eax, dword [0x421040]
xor eax, esp
mov dword [esp + 0xc4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xc], edi
cmp dword [edi], 4
je 0x41411e
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0xc4]
xor ecx, esp
call fcn.00401288
mov esp, ebp
pop ebp
ret
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov esi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0xffffff
mov dword [esp + 0x14], eax
call esi
push 0x8080ff
mov dword [esp + 0x1c], eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x18]
add ecx, 0xffffff2e
mov dword [esp + 0x14], eax
cmp ecx, 6
ja case.default.0x414159
jmp dword [ecx*4 + 0x4142f0]
cmp byte [0x42308c], 0
jne 0x4141c0
mov edx, eax
jmp 0x4141c0
cmp byte [0x42308e], 0
je 0x4141c0
mov edx, eax
jmp 0x4141c0
cmp byte [0x423088], 0
jne 0x4141c0
mov edx, eax
jmp 0x4141c0
cmp byte [0x42308d], 0
jne 0x4141c0
mov edx, eax
jmp 0x4141c0
cmp byte [0x42308a], 0
je 0x4141c0
mov edx, eax
jmp 0x4141c0
cmp byte [0x42308b], 0
je 0x4141c0
mov edx, eax
jmp 0x4141c0
cmp byte [0x423089], 0
je 0x4141c0
mov edx, eax
jmp 0x4141c0
mov edx, 0x10
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
mov edi, dword [edi + 0x18]
push edx
push eax
movups xmm0, xmmword [esi + 0x1c]
push edi
movups xmmword [esp + 0x2c], xmm0
call dword [sym.imp.USER32.dll_FillRect]
push dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.00413f10
movups xmm0, xmmword [esi + 0x1c]
add esp, 8
lea eax, [esp + 0x30]
movups xmmword [esp + 0x30], xmm0
push 0xfffffffffffffffd
push 0xfffffffffffffffd
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov dword [esp + 0x1c], 0
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [esi + 0x14], eax
jne 0x414238
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_FrameRect]
mov dword [esp + 0x1c], 1
push dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
mov ecx, edi
call fcn.00413f10
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
add esp, 8
push dword [esp + 0x18]
call esi
push dword [esp + 0x14]
call esi
cmp dword [esp + 0x1c], 1
jne 0x414270
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0x40
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x14]
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 1
push edi
mov dword [esp + 0x1c], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp dword [esp + 0x10], 0
mov esi, dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 0xc], eax
je 0x4142a6
push 0
jmp 0x4142ab
push 0x808080
push edi
call esi
push 0x25
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x54]
push eax
push edi
call dword [sym.imp.USER32.dll_DrawTextW]
push 0
push edi
call esi
push dword [esp + 0xc]
push edi
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esp + 0xcc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.00401288
mov esp, ebp
pop ebp
ret
Function at 0x3a174b
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, ecx
mov eax, dword [edi + 0x44]
xor ebx, ebx
cmp eax, ebx
je 0x3a17a6
cmp eax, 0xffffffff
je 0x3a17a6
cmp dword [ebp + 8], ebx
je 0x3a17a6
push esi
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [edi + 0x44]
push ebx
mov esi, eax
lea eax, [ebp - 4]
push eax
add esi, esi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x3af302
cmp esi, dword [ebp - 4]
jne 0x3af31d
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 4
mov ebx, 0x80070057
jmp 0x3a179e

Function at 0x3a227c
Capabilities:
Query environment variable

Disassembly:
push 0x20
mov eax, 0x3b621c
call fcn.003a1350
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
push ebx
push 0x20019
push dword [0x3bb458]
lea ecx, [ebp - 0x2c]
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call fcn.003a2097
test eax, eax
jne 0x3a23c4
lea eax, [ebp - 0x20]
push eax
push dword [0x3bb45c]
lea ecx, [ebp - 0x2c]
push ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
call fcn.003a23dc
test eax, eax
jne 0x3a23c4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
push 2
add eax, eax
pop edx
mul edx
seto cl
mov byte [ebp - 4], 1
neg ecx
or ecx, eax
push ecx
call fcn.003a13e0
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
cmp esi, ebx
je 0x3a23c4
lea eax, [ebp - 0x20]
push eax
push dword [0x3bb45c]
lea ecx, [ebp - 0x2c]
push esi
call fcn.003a23dc
test eax, eax
jne 0x3a23bb
push ebx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call esi
mov edi, eax
cmp edi, ebx
je 0x3a23bb
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003a13e0
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x3a23bb
push edi
push eax
push dword [ebp - 0x1c]
call esi
mov esi, eax
cmp esi, ebx
je 0x3a23b2
cmp dword [ebp + 8], ebx
je 0x3aea08
push dword [0x3bb460]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + esi + 1]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.003a13e0
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x3a23b2
push dword [ebp - 0x14]
push esi
push eax
call fcn.003a21cb
push dword [0x3bb460]
push edi
push dword [ebp - 0x18]
call fcn.003a2436
push dword [ebp - 0x14]
call fcn.003a13c0
pop ecx
push dword [ebp - 0x1c]
call fcn.003a13c0
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.003a1f10
mov eax, dword [ebp - 0x18]
call fcn.003a1390
ret 4