joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f746
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x1028cf0]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp byte [ebp + 0xc], 0
mov ebx, dword [eax + 0xc]
je 0x100f80d
test byte [ebp + 0xa], 1
je 0x100f7f5
test byte [esi + 0x65], 4
je 0x100f7a1
mov ecx, esi
call fcn.0100eeae
mov ebx, eax
mov edi, 0xf000
test edi, ebx
je 0x100f7a1
call fcn.0100df39
test al, al
je 0x100f7a1
push edi
push ebx
mov ecx, esi
call fcn.0101193a
jmp 0x100f7f5
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.01007311
mov edi, eax
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.01007336
mov ecx, dword [edi]
mov edx, dword [eax]
lea ebx, [edx + ecx]
cmp ebx, ecx
jl 0x100f7e5
mov eax, dword [eax + 4]
mov ebx, dword [edi + 4]
add ebx, eax
cmp ebx, dword [edi + 4]
mov dword [ebp + 0xc], eax
jl 0x100f7e5
push 0xb
push eax
push edx
push dword [edi + 4]
push ecx
push dword [esi + 4]
call dword [sym.imp.DUSER.dll_SetGadgetRect]
mov ecx, dword [ebp - 4]
call fcn.010072f8
mov ecx, dword [ebp - 8]
call fcn.010072f8
test byte [ebp + 0xa], 2
je 0x100f8b3
push dword [esi + 4]
call dword [sym.imp.DUSER.dll_InvalidateGadget]
jmp 0x100f8b3
test byte [ebp + 8], 5
je 0x100f85a
mov eax, esi
mov edi, eax
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100f824
cmp dword [edi + 0x44], 0xfffffffe
jne 0x100f815
test byte [ebp + 8], 1
je 0x100f83b
or byte [esi + 0x66], 2
mov ecx, dword [ebx + 0x14]
push 1
push 1
push edi
call fcn.0100e018
test byte [ebp + 8], 4
je 0x100f85a
mov eax, dword [esi + 0x68]
and eax, 0xfffffffd
push 1
or eax, 1
push 1
mov dword [esi + 0x68], eax
mov ecx, dword [ebx + 0x10]
push edi
call fcn.0100e018
test byte [ebp + 8], 0xa
je 0x100f8b3
mov eax, esi
xor edi, edi
mov esi, eax
mov eax, dword [eax + 0x20]
test eax, eax
je 0x100f879
test edi, edi
jne 0x100f873
mov edi, eax
cmp dword [esi + 0x44], 0xfffffffe
jne 0x100f864
test edi, edi
je 0x100f8b3
test byte [ebp + 8], 2
je 0x100f894
or byte [edi + 0x66], 2
mov ecx, dword [ebx + 0x14]
push 1
push 1
push esi
call fcn.0100e018
test byte [ebp + 8], 8
je 0x100f8b3
mov eax, dword [edi + 0x68]
and eax, 0xfffffffd
push 1
or eax, 1
push 1
mov dword [edi + 0x68], eax
mov ecx, dword [ebx + 0x10]
push esi
call fcn.0100e018
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10158d3
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1028aa8]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push edi
push esi
push 0x1003c6c
mov dword [ebp - 4], eax
lea eax, [ebp - 0xd0]
push 0x65
push eax
mov ebx, ecx
call dword [sym.imp.msvcrt.dll__snwprintf]
and word [ebp - 8], 0
add esp, 0x18
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x101592d
push dword [ebp + 0x10]
push edi
push esi
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b845
leave
ret 0xc

Function at 0x1017060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1028aa8]
push ebx
push esi
mov esi, ecx
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, ecx
push edi
mov dword [esi + 0x43c], eax
mov word [esi + 0x2c], cx
mov word [esi + 0x234], cx
jne 0x101709d
lea eax, [esi + 0x440]
mov dword [eax], ecx
mov dword [esi + 0x43c], eax
mov eax, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x58]
push 0x1003e98
push eax
mov byte [esi + 0xc], 0
call dword [sym.imp.msvcrt.dll_swprintf]
mov eax, dword [esi + 0x43c]
mov edi, dword [eax]
add esp, 0xc
push 0x1003e88
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x1017107
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1017107
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push edi
mov dword [ebp - 0x5c], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x5c]
mov ecx, esi
call fcn.01016cca
test eax, eax
jl 0x1017109
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b845
leave
ret 0xc

Function at 0x10176dd
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1028aa8]
push edi
push 0x25
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 5
pop edi
jb 0x101772a
xor eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jae 0x101772c
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.0100b845
leave
ret
Function at 0x1017856
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1028cf0]
cmp eax, 0xffffffff
push ebx
push esi
push edi
jne 0x1017875
mov edi, 0x80004005
jmp 0x1017974
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebx, ebx
cmp eax, ebx
je 0x101788c
inc dword [eax + 4]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push 0x1c
call fcn.0100de3b
mov esi, eax
cmp esi, ebx
jne 0x10178a3
mov edi, 0x8007000e
jmp 0x1017937
push esi
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [esi + 8]
push eax
push ebx
push 0x30
push 0x18
call fcn.01019e90
mov edi, eax
cmp edi, ebx
jl 0x1017937
lea eax, [esi + 0xc]
push eax
call fcn.0100fe4a
mov edi, eax
cmp edi, ebx
jl 0x1017937
lea eax, [esi + 0x10]
push eax
push 8
call fcn.0101c43d
mov edi, eax
cmp edi, ebx
jl 0x1017937
mov dword [esi + 4], 1
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], ebx
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
cmp dword [0x102e2f8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
setne cl
push 2
pop eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 8], ebx
add ecx, eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], ecx
call dword [sym.imp.DUSER.dll_InitGadgets]
cmp eax, ebx
mov dword [esi], eax
jne 0x1017885
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp esi, ebx
je 0x1017974
mov ecx, dword [esi + 0x10]
cmp ecx, ebx
je 0x1017947
call fcn.0101c42f
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x1017954
push eax
call fcn.0100d79e
mov eax, dword [esi]
cmp eax, ebx
je 0x1017961
push eax
call dword [sym.imp.DUSER.dll_DeleteHandle]
push esi
call fcn.01008235
push ebx
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, edi
jmp 0x1017887

Function at 0x1017980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1028cf0]
cmp eax, 0xffffffff
jne 0x1017990
mov eax, 0x80004005
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x10179a5
mov eax, 0x8004000a
pop esi
ret
dec dword [esi + 4]
cmp dword [esi + 4], 0
jg 0x10179ee
push dword [esi]
call dword [sym.imp.DUSER.dll_DeleteHandle]
cmp byte [esi + 0x14], 0
je 0x10179c2
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esi + 0x10]
call fcn.0101c42f
push dword [esi + 0xc]
call fcn.0100d79e
mov ecx, dword [esi + 8]
call fcn.0101c42f
push esi
call fcn.01008235
push 0
push dword [0x1028cf0]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
pop esi
ret
Function at 0x108fc27
Capabilities:
Encode data using xor

Disassembly:
enter 0, 0
pushal
mov ebx, 0x7fffffff
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov edi, esi
imul eax, edx, 0x10dcd
add eax, 0x116c5
xor edx, edx
div ebx
lodsd eax, dword [esi]
xor eax, edx
stosd dword es:[edi], eax
loop 0x108fc3c
popal
leave
ret 0xc
Function at 0x4064e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x40650c
xor eax, eax
test eax, eax
je 0x40651f
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40651f
xor ecx, ecx
jmp 0x406522
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406609
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x406640
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x40661a
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x406615
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406671
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x406653
pop edi
not eax
pop esi
ret 0xc

Function at 0x1001152
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push 0x104
lea eax, [ebp - 0x170]
mov dword [ebp - 4], eax
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
call fcn.010010e4
cmp eax, 1
jl 0x100121b
push ebx
xor ebx, ebx
cmp byte [ebp - 0x170], bl
push esi
lea esi, [ebp - 0x170]
je 0x10011bb
cmp byte [esi], 0x3a
je 0x100119e
inc esi
cmp byte [esi], bl
jne 0x1001192
jmp 0x10011a1
mov byte [esi], bl
inc esi
cmp byte [esi], bl
je 0x10011bb
push 0x10010ac
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x10011c1
lea esi, [ebp - 0x170]
push 0x29
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1001219
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0x1001219
push ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x1001219
push ebx
lea eax, [ebp - 0x14]
push eax
call sub.ole32.dll_CoRegisterSurrogateEx
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
xor eax, eax
leave
ret 0x10
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x402ee4
pop dword [ebp - 0x10]
mov eax, 0x4b1e06a5
sub eax, 0x4addd7c1
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x6fedda58
sub dword [ebp - 0x20], 0x219b950d
mov dword [ebp - 0x1c], 0xd83c6474
add dword [ebp - 0x1c], 0x59f6e7d1
mov dword [ebp - 0x18], 0x947f8da6
add dword [ebp - 0x18], 0xb7ccb688
mov dword [ebp - 0x14], 0x2dc3b36
sub dword [ebp - 0x14], 0x2dc3b36
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xf7042013
sub dword [ebp - 0x20], 0x8291b6bd
mov dword [ebp - 0x1c], 0x36e0af30
sub dword [ebp - 0x1c], 0xf5744dbb
mov dword [ebp - 0x18], 0xbed8ae81
sub dword [ebp - 0x18], 0x5b694215
mov dword [ebp - 0x14], 0xa3e3cbb7
sub dword [ebp - 0x14], 0xa3e3cbb7
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3a39f
push 0
call eax
mov ecx, 0x509c987b
sub ecx, 0x509c43b8
mov edx, eax
mov ebx, 0x46e400
add ebx, dword [ebp - 0x10]
mov edi, 0x23472204
add edi, 0x663633a
xor dword [ebp - 4], 0xa0f071d8
mov esi, dword [ebx]
xor dword [ebp - 0xc], ecx
sub esi, edi
add dword [ebp - 0xc], 0xca4fc65
mov dword [edx], esi
xor dword [ebp - 0xc], ebx
add edx, 0xc9c67d03
add edx, 0x36398301
add ebx, 4
loop 0x402ff6
add eax, 0x66cfff8
add eax, 0xf99445e7
mov ebx, eax
add eax, 0x609aa2a9
sub eax, 0x609aa2a4
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x418e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x412015
lea edi, [esi - 0x11015]
push edi
or ebp, 0xffffffff
jmp 0x418e92
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x418e99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x418e88
mov eax, 1
add ebx, ebx
jne 0x418eab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x418ea0
jne 0x418ebc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418ea0
xor ecx, ecx
sub eax, 3
jb 0x418ed0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x418f42
mov ebp, eax
add ebx, ebx
jne 0x418edb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x418ee8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x418f0c
inc ecx
add ebx, ebx
jne 0x418ef8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x418eed
jne 0x418f09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x418eed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x418f2c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x418f1d
jmp 0x418e8e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x418f2c
add edi, ecx
jmp 0x418e8e
pop esi
mov edi, esi
mov ecx, 0x76
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x418f4a
cmp byte [edi], 0
jne 0x418f4a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x418f4f
lea edi, [esi + 0x16000]
mov eax, dword [edi]
or eax, eax
je 0x418fbe
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x180dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1812c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x418f7c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18130]
or eax, eax
je 0x418fb8
mov dword [ebx], eax
add ebx, 4
jmp 0x418f99
call dword [esi + 0x18140]
mov ebp, dword [esi + 0x18134]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x418ff2
sub esp, 0xffffff80
jmp 0x401ae1
Function at 0x401200
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push 0x40b098
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret 0xc

Function at 0x401c10
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x50
push esi
mov esi, dword [esp + 0x58]
test esi, esi
je 0x401c2a
push 0x50
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [esp + 0x60]
test al, 0x70
jne 0x401c35
or eax, 0x30
mov ecx, 0x40b044
test esi, esi
je 0x401c42
lea ecx, [esp + 4]
or eax, 0x2000
push eax
push ecx
mov ecx, dword [esp + 0x64]
push ecx
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
add esp, 0x50
ret 0xc
Function at 0x402300
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x154
push ebx
mov ebx, dword [esp + 0x15c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402369
push edi
mov edi, dword [esp + 0x16c]
test edi, edi
je 0x402368
push ebx
lea ecx, [esp + 0x60]
push 0x4091ec
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x50
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x2030
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x64]
push ecx
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x154
ret 0xc

Function at 0x4028b0
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4028d6
or eax, 0xffffffff
ret 0xc
mov eax, dword [esp + 0xc]
ret 0xc

Function at 0x4028e0
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x402906
or eax, 0xffffffff
ret 0xc
mov eax, dword [esp + 0xc]
ret 0xc

Function at 0x402930
Capabilities:
Set file attributes

Disassembly:
push esi
push 0x40b1a8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_AddAtomA]
push str.OrgWndProc
call esi
push str.CurrWndSize
mov word [0x40b1a4], ax
call esi
push 0x104
mov word [0x40b094], ax
mov eax, dword [0x40b19c]
push 0x40b098
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40b03c
push 0x40b098
call fcn.00402140
push 0
push 0x40b098
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
ret
Function at 0x402a80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov dword [ebp - 8], 0
xor ebx, ebx
cld
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402ab5
mov edi, dword [ebp + 8]
mov al, 0x5c
mov edx, ecx
repne scasb al, byte es:[edi]
jne 0x402ab5
sub edx, ecx
dec edx
mov eax, edx
jmp 0x402ab8
xor eax, eax
dec eax
test eax, eax
jl 0x402be6
push 1
push 0x104
call fcn.00401170
mov ebx, eax
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x402be6
push esi
mov esi, dword [ebp + 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call fcn.004021b0
push ebx
mov byte [eax - 1], 0
call fcn.00401b80
cmp eax, 2
je 0x402bde
mov eax, 0x5c5c
mov dword [ebp - 4], esi
cmp word [esi], ax
jne 0x402b38
push 0x5c
add esi, 2
push esi
call fcn.004018b0
test eax, eax
jle 0x402be5
lea esi, [esi + eax + 1]
push 0x5c
push esi
call fcn.004018b0
test eax, eax
jle 0x402be5
lea esi, [esi + eax + 1]
jmp 0x402b4c
cmp byte [esi], 0
je 0x402b4f
cmp byte [esi + 1], 0x3a
jne 0x402b4f
cmp byte [esi + 2], 0x5c
jne 0x402b4f
add esi, 3
mov dword [ebp - 4], esi
push 0x5c
push esi
call fcn.004018b0
test eax, eax
jle 0x402be5
nop
cld
mov edi, dword [ebp - 4]
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x402b84
mov edi, dword [ebp - 4]
mov al, 0x5c
mov edx, ecx
repne scasb al, byte es:[edi]
jne 0x402b84
sub edx, ecx
dec edx
mov eax, edx
jmp 0x402b87
xor eax, eax
dec eax
test eax, eax
jl 0x402bde
lea esi, [esi + eax + 1]
mov eax, dword [ebp + 8]
mov ecx, esi
sub ecx, eax
push ecx
push eax
push ebx
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call fcn.00401b80
cmp eax, 2
je 0x402b60
cld
mov edi, dword [ebp - 0xc]
xor ecx, ecx
dec ecx
mov al, 0
repne scasb al, byte es:[edi]
dec edi
mov al, 0x5c
mov ah, 0
stosw word es:[edi], ax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x402b60
pop esi
push ebx
call fcn.004029d0
mov eax, dword [ebp - 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 8], 1
pop esi
push ebx
call fcn.004029d0
mov eax, dword [ebp - 8]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x402cc0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x50
push esi
push edi
push 3
push 0x20218
call fcn.00401170
mov esi, eax
test esi, esi
je 0x402d2c
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x5c]
push eax
push 0
push edi
call fcn.00402300
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x402cff
push esi
call fcn.004029d0
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 8
push edi
lea ecx, [esi + 0x20010]
push ecx
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop edi
mov eax, esi
pop esi
add esp, 0x50
ret 8
mov edi, dword [esp + 0x60]
test edi, edi
je 0x402d5a
push 0x50
lea edx, [esp + 0xc]
push edx
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x2030
lea eax, [esp + 0xc]
push eax
push 0x409290
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, esi
pop edi
pop esi
add esp, 0x50
ret 8
Function at 0x402ff0
Capabilities:
Set file attributes

Disassembly:
push esi
push edi
push 9
push 0x230
xor edi, edi
call fcn.00401170
mov esi, eax
test esi, esi
je 0x40302b
mov eax, dword [esp + 0xc]
push eax
push esi
call fcn.00402790
push 0x5c
mov edi, eax
push 0x2f
push edi
call fcn.00402750
mov ecx, dword [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
push esi
call fcn.004029d0
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4031b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x30
push esi
call fcn.00401a50
mov eax, dword [esp + 0x18]
mov dword [esi + 0x10], eax
test eax, eax
jne 0x403204
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 0x409410
push ecx
call fcn.00401b30
mov dword [esi + 0x14], eax
test eax, eax
je 0x40322b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esi + 4], eax
test eax, eax
je 0x40322b
mov eax, dword [esp + 0x10]
cdq
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
pop edi
xor eax, eax
pop esi
ret 0x10
cmp eax, 1
jne 0x403235
mov edi, dword [esp + 0x10]
push 0x1b
push 8
push edi
call fcn.00401ae0
mov dword [esi + 0x20], eax
test eax, eax
je 0x4031fd
push edi
call fcn.004030a0
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x4031fd
pop edi
mov eax, 0xa
pop esi
ret 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
cdq
mov dword [esi + 8], eax
or eax, edx
mov dword [esi + 0xc], edx
jne 0x4031fd
pop edi
mov eax, 0xa
pop esi
ret 0x10