joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
mov edi, edx
mov byte [esp], al
mov byte [esp + 1], 0
mov dword [esp + 4], 1
mov dword [esp + 8], 0xff
lea eax, [esp + 8]
push eax
mov eax, dword [0x4bedb0]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x413670
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413662
xor ebx, ebx
mov bl, byte [esp]
add ebx, 0x40
mov byte [esp + 0xc], 0
mov eax, dword [0x4bedb0]
call fcn.004b8144
mov edx, eax
dec edx
test edx, edx
jl 0x4134db
inc edx
mov eax, dword [0x4bedb0]
cmp bl, byte [eax]
jne 0x4134d7
mov byte [esp + 0xc], 1
jmp 0x4134db
inc eax
dec edx
jne 0x4134cc
cmp byte [esp + 0xc], 0
je 0x413662
mov dword [esp + 8], 0xff
lea eax, [esp + 8]
push eax
mov eax, dword [0x4bedb0]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x413690
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413662
push 0x413698
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x41353f
push 0x4136a0
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x413662
mov dword [esp + 8], 0x13
lea eax, [esp + 8]
push eax
mov eax, dword [0x4beadc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x4136a8
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413662
xor eax, eax
call fcn.004aa6bc
mov byte [esi + 2], al
mov eax, dword [0x4be95c]
cmp byte [eax], 0
jne 0x413662
mov dword [esp + 8], 0x13
lea eax, [esp + 8]
push eax
mov eax, dword [0x4beadc]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x4136b0
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413662
xor eax, eax
call fcn.004aa6bc
mov byte [esi + 1], al
mov eax, dword [0x4be95c]
cmp byte [eax], 0
jne 0x413662
xor ebp, ebp
mov eax, ebp
mov byte [esi], al
mov edx, dword [0x4bedb0]
mov eax, dword [esi]
call fcn.00413130
test al, al
je 0x41363d
mov dword [esp + 8], 0xff
lea eax, [esp + 8]
push eax
mov eax, dword [0x4beb38]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x4136c0
push edi
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41363d
mov eax, dword [0x4bedb0]
mov byte [eax + 8], 0
mov eax, dword [0x4beb38]
mov byte [eax + 8], 0
mov eax, dword [0x4beb38]
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x41363d
mov al, byte [esp]
mov byte [esi + 3], al
mov byte [esp + 1], 1
jmp 0x413662
inc ebp
cmp ebp, 8
jne 0x4135cb
mov byte [esi], 0
mov edx, dword [0x4bedb0]
mov eax, dword [esi]
call fcn.00413130
test al, al
je 0x413662
mov al, byte [esp]
mov byte [esi + 3], al
mov byte [esp + 1], 1
mov al, byte [esp + 1]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4136cc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffddc
mov dword [esp + 4], edx
mov byte [esp], al
lea edi, [esp + 0x11e]
mov ebp, dword [0x4beb38]
mov byte [esp + 8], 0
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov edx, 0x4bd2f0
lea eax, [esp + 0x18]
call fcn.004b81b0
lea eax, [esp + 0xc]
push eax
push 8
push 0
lea eax, [esp + 0x24]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41382c
xor esi, esi
jmp 0x4137fa
mov edx, 0x4bd2f0
lea eax, [esp + 0x18]
call fcn.004b81b0
push 0x41383c
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
push eax
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x10]
push eax
push 8
push 0
lea eax, [esp + 0x24]
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4137f9
xor ebx, ebx
jmp 0x4137da
lea edx, [esp + 0x18]
mov eax, edi
call fcn.004b81b0
push 0x41383c
push edi
call sub.kernel32.dll_lstrcatA
push ebp
push edi
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x14]
push eax
push edi
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x4137d9
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
mov al, byte [esp]
call fcn.00413460
test al, al
je 0x4137d9
mov byte [esp + 8], 1
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x413818
inc ebx
push 0x105
push ebp
push ebx
mov eax, dword [esp + 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x413783
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc esi
push 0x105
mov eax, dword [0x4bedb0]
push eax
push esi
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
je 0x413736
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov al, byte [esp + 8]
add esp, 0x224
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x41679c
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x52
popal
sbb eax, dword [edx]
mov eax, dword [0xd45eae7]
xchg esi, eax
mov byte [edx + 0x5f], ah
push 0xfffffffffffffffc
sub dword [eax - 0x65], ebx
shr byte [esi + eax*2], cl
and esp, eax
aad 0x4e
pop esi
sti
ret 0x967f
xchg esi, eax
std
outsd dx, dword [esi]
pop edi
lds ecx, [edx + 0x37]
jnp 0x416716
mov al, byte [ebx + esi*4 - 0x18]
xchg ecx, eax
sub eax, 0xd422b978
mov word [eax - 0x49], cs
int1
sub dword [esi - 0x1f], eax
std
cmp ch, byte [ebx + 0x5b]
sub eax, 0x61dbae80
cmpsd dword [esi], dword es:[edi]
adc esp, ecx
mov ebx, 0xd0fc162b
loopne 0x4166ae
shl byte [esi], 1
loopne 0x4166ae
lodsb al, byte [esi]
and al, 0x25
cmp al, 0
or esi, dword [0x801360e0]
call 0x34143a9
out dx, eax
out 0x81, eax
adc al, 0xdd
pop esp
xchg esp, eax
pop ebp
in eax, 0xb
aas
pop ebx
jno 0x41670f
and ecx, edi
stosb byte es:[edi], al
test cl, ah
aad 0x63
jbe 0x416709
xor eax, 0xa1ebf5e6
mov edi, 0x66f46b4e
inc esi
div byte [ecx - 0x26]
enter 0xffffffffffffa5fb, 0x28
sbb eax, 0x7e9d2e2b
adc al, 0xa8
into
popfd
jle 0x416768
test al, 0xce
dec esi
lodsb al, byte [esi]
js 0x4166e5
bound ebp, qword [0x8c2905dc]
cld
fnstenv [ebx + edx*2]
retf
fsubr dword [ebp + 0x2e4d6756]
mov edx, 0xa297d286
and eax, 0x36e496d4
push cs
push esp
into
call 0xf963d61f
fcmovbe st(0), st(1)
add eax, 0xab1dc099
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
aad 0xa1
ror dword [edx], 1
imul ebp, dword [edx - 0x30], 0xffffff99
stc
stc
int1
inc edx
push 0xfdf543ea
clc
test ecx, ecx
leave
lodsd eax, dword [esi]
pop esi
cmp ebx, ebp
push ecx
pop ebp
pop edi
jae 0x416786
fsub st(7), st(0)
xchg esp, eax
mov bl, 0x10
je 0x416751
cmp dword [eax], esi
jg 0x4167e3
mov bl, 0x44
push ebp
cmp eax, 0x25f4f8e0
push edx
mov dl, bh
jnp 0x4167b1
pop ebx
jbe 0x4167ee
add al, 0x41
and al, byte [ebp + edi*8 - 0x24]
pop ebx
jl 0x416843
and eax, 0x74703a7d
jo 0x416844
xor ch, byte [ebx - 0x2a]
shr bl, 1
outsb dx, byte [esi]
dec ecx
imul eax, esp, 0x1700da17
push 0x38
jne 0x4167ce
in eax, dx
test dword [esi], edx
dec eax
out dx, al
mov esi, 0x7377466c
mov ah, 0xe0
cwde
je 0x416793
movsb byte es:[edi], byte [esi]
ficom word [edi]
mov byte [ebx - 0x4a6fe154], bl
cmp byte [edi - 4], al
mov ebx, 0x27e20bc7
ret
sub eax, 0xb9b93b8
xchg ah, bh
inc esp
wait
sbb dl, byte [ebx + 0x793cd3d0]
into
ja 0x4167e0
xchg ebp, eax
enter 0xffffffffffff94cc, 2
mov dh, 0x65
sar byte [ebx + 0x638325ec], 1
test eax, 0x4c3d748d
push edi
shr byte [edx + 0x64], 1
xchg esp, eax
adc dword [edx - 0x1a], edi
jp 0x41682c
scasb al, byte es:[edi]
mov dl, byte [esi - 0x16c3d4ee]
add byte [edx + 0x41a05b00], ah
outsd dx, dword [esi]
jp 0x41681a
js 0x41682c
mov edx, ebp
nop
in al, dx
popal
add byte [edx + 0x71], ah
xchg ebx, eax
sbb dword [eax], ebp
cmpsd dword es:[esi], dword es:[edi]
inc edx
mov esp, 0x879f4282
pop es
sbb ah, byte [ebp + 0xf152422]
movsb byte es:[edi], byte [esi]
ret 0x26f1
Function at 0x416c08
Capabilities:
Encode data using xor

Disassembly:
push ebx
add esp, 0xffffff6c
lea eax, [esp + 0x11]
push eax
lea eax, [esp + 0x15]
push eax
mov edx, dword [0x4becf4]
mov ecx, 0xb7
mov al, 1
call fcn.0040f720
lea edx, [esp + 0x11]
lea eax, [esp + 0x11]
call fcn.0040f808
mov dl, 0x10
lea eax, [esp + 0x11]
lea ecx, [esp + 0x31]
mov bl, byte [eax]
xor bl, byte [eax + 0x10]
mov byte [ecx], bl
inc ecx
inc eax
dec dl
jne 0x416c42
mov edx, 0x4bd470
mov eax, esp
mov ecx, 0x10
call fcn.004066dc
push 0
lea ecx, [esp + 4]
mov edx, dword [fcn.00407928]
xor eax, eax
call fcn.00407c1c
mov ebx, eax
push 0
lea edx, [esp + 0x35]
mov eax, ebx
mov ecx, 0x10
call fcn.00407c74
mov edx, 0x2c
mov eax, ebx
call fcn.00402524
mov eax, esp
mov edx, 0x10
call fcn.004066e4
lea edx, [esp + 0x31]
lea eax, [esp + 0x41]
mov ecx, 0x10
call fcn.004066dc
mov edx, dword [0x4becf4]
add edx, 0xb7
lea eax, [esp + 0x51]
mov ecx, 0x10
call fcn.004066dc
lea eax, [esp + 0x61]
push eax
lea eax, [esp + 0x65]
push eax
lea edx, [esp + 0x49]
mov ecx, 0x20
mov al, 1
call fcn.0040f720
lea edx, [esp + 0x61]
lea eax, [esp + 0x61]
call fcn.0040f808
mov dl, 0x10
lea eax, [esp + 0x61]
lea ecx, [esp + 0x81]
mov bl, byte [eax]
xor bl, byte [eax + 0x10]
mov byte [ecx], bl
inc ecx
inc eax
dec dl
jne 0x416cff
mov edx, dword [0x4becf4]
add edx, 0xc7
mov eax, 0x4bfc04
mov ecx, 0x10
call fcn.004066dc
lea edx, [esp + 0x81]
mov eax, esp
mov ecx, 0x10
call fcn.004066dc
push 0
lea ecx, [esp + 4]
mov edx, dword [fcn.00407928]
xor eax, eax
call fcn.00407c1c
mov ebx, eax
push 0
mov edx, 0x4bfc04
mov eax, ebx
mov ecx, 0x10
call fcn.00407d08
mov edx, 0x2c
mov eax, ebx
call fcn.00402524
mov eax, esp
mov edx, 0x10
call fcn.004066e4
add esp, 0x94
pop ebx
ret
Function at 0x416d84
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
add esp, 0xfffff904
xor ebx, ebx
cmp byte [0x4bfc00], 0
je 0x416d9e
mov bl, 1
jmp 0x416f8f
mov eax, dword [0x4be8ec]
cmp word [eax], 0x43a
jae 0x416db9
mov eax, dword [0x4be8ec]
cmp word [eax], 0x64
jne 0x416f5d
push 0x1c
lea eax, [esp + 0x10]
push eax
push 0x400000
call sub.kernel32.dll_VirtualQuery
push esp
push 0x40
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x416f5d
lea eax, [esp + 0x39]
mov ecx, 0x6c0
mov edx, dword [0x4bd46c]
call fcn.004066dc
call fcn.00416c08
mov edx, 0x4bfc04
lea eax, [esp + 0x28]
mov ecx, 0x10
call fcn.004066dc
push 0
lea ecx, [esp + 0x2c]
mov edx, dword [fcn.00407928]
xor eax, eax
call fcn.00407c1c
mov esi, eax
push 0
lea edx, [esp + 0x3d]
mov ecx, 0x6c0
mov eax, esi
call fcn.00407d08
mov edx, 0x2c
mov eax, esi
call fcn.00402524
lea eax, [esp + 0x28]
mov edx, 0x10
call fcn.004066e4
mov eax, 0x4bfc04
mov edx, 0x10
call fcn.004066e4
lea eax, [esp + 8]
push eax
push 0x6c0
lea eax, [esp + 0x41]
push eax
mov eax, dword [0x4bd46c]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
test eax, eax
je 0x416f5d
cmp dword [esp + 8], 0x6c0
jne 0x416f5d
push 0x20
mov eax, dword [0x4becf4]
push eax
lea eax, [esp + 0x41]
push eax
call sub.kernel32.dll_lstrcpynA
lea eax, [esp + 0x28]
mov edx, 0x10
call fcn.004066e4
mov edx, dword [0x4be82c]
lea eax, [esp + 0x28]
call fcn.004b81b0
push 0
lea ecx, [esp + 0x2c]
mov edx, dword [fcn.00407928]
xor eax, eax
call fcn.00407c1c
mov esi, eax
push 0
lea edx, [esp + 0x3d]
mov ecx, 0x20
mov eax, esi
call fcn.00407d08
mov edx, 0x2c
mov eax, esi
call fcn.00402524
lea eax, [esp + 0x28]
mov edx, 0x10
call fcn.004066e4
lea eax, [esp + 0x39]
mov edx, 0x6c0
call fcn.004066e4
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
mov eax, dword [0x4bd46c]
add eax, 0x6c0
dec eax
cmp byte [eax], 0
jne 0x416f5d
mov byte [0x4bfc00], 1
mov bl, 1
jmp 0x416f8f
mov eax, dword [0x4bea18]
call fcn.004b1c50
mov eax, dword [0x4bedb0]
call fcn.004b1914
test al, al
je 0x416f7c
call fcn.004ac3f4
jmp 0x416f8f
mov ax, 0xd5
call fcn.004aa600
mov edx, 1
call fcn.004b12a8
mov eax, ebx
add esp, 0x6fc
pop esi
pop ebx
ret
Function at 0x419834
Capabilities:
Delete file
Move file

Disassembly:
push ebx
push esi
add esp, 0xfffffdf8
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x5c], 0
jne 0x419a18
mov al, byte [esi + 0x96]
cmp al, 3
je 0x41985b
cmp al, 4
jne 0x419872
cmp dword [esi + 0x98], 0
je 0x41986b
mov eax, esi
call fcn.00419bf0
mov bl, 1
jmp 0x419a18
mov eax, dword [0x4be784]
movzx eax, word [eax + 0x1872]
mov edx, 0x32
call fcn.004aa578
mov dword [esp + 0x204], eax
fild dword [esp + 0x204]
fild qword [esi + 0x10]
fdiv dword [0x419a24]
fdiv dword [0x419a24]
fcompp
fnstsw ax
sahf
jbe 0x419930
mov eax, dword [0x4be784]
cmp byte [eax + 0x18ed], 0
jne 0x419930
push dword [esi + 0x14]
push dword [esi + 0x10]
call fcn.004b1e30
mov edx, eax
mov eax, dword [0x4beb38]
call fcn.004b81b0
mov ax, 0x2b8
call fcn.004aa600
mov edx, dword [0x4beb38]
call fcn.004ae1b0
push 0x419a28
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov ax, 0x124
call fcn.004aa600
push eax
mov eax, dword [0x4bedb0]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bedb0]
mov edx, 0x24
call fcn.004b12a8
mov eax, dword [0x4bec68]
mov al, byte [eax]
mov edx, dword [0x4be784]
mov byte [edx + 0x18ed], al
mov eax, dword [0x4bea98]
mov byte [eax], 1
mov ax, word [esi + 0x92]
call fcn.004b1cb8
mov edx, eax
lea eax, [esp + 0x101]
call fcn.004b81b0
cmp byte [esi + 0xa1], 0
je 0x4199bb
lea edx, [esp + 0x101]
lea eax, [esp + 1]
call fcn.004b81b0
push 0x419a2c
lea eax, [esp + 5]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 1]
push eax
call sub.kernel32.dll_DeleteFileA_1
lea eax, [esp + 1]
push eax
lea eax, [esp + 0x105]
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4199bb
call sub.kernel32.dll_GetLastError_1
call fcn.004ae200
mov eax, dword [0x4bedb0]
mov edx, 1
call fcn.004b12a8
jmp 0x419a18
mov al, byte [esp]
xor al, 1
add al, 7
push eax
lea ecx, [esp + 0x105]
lea edx, [esp + 5]
mov eax, esi
call fcn.00419530
test al, al
je 0x4199f5
mov byte [esi + 0x96], 3
mov byte [esi + 0xa1], 1
lea eax, [esp + 1]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov bl, 1
jmp 0x419a10
cmp byte [esi + 0xa1], 0
je 0x419a10
lea eax, [esp + 0x101]
push eax
lea eax, [esp + 5]
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [0x4bea98]
mov byte [eax], 0
mov eax, ebx
add esp, 0x208
pop esi
pop ebx
ret
Function at 0x419a30
Capabilities:
Delete file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov edi, eax
xor ebx, ebx
cmp byte [edi + 0x90], 0
jne 0x419bdd
cmp dword [edi + 0x5c], 0
jne 0x419bdd
cmp byte [edi + 0x96], 0
je 0x419bdd
fild qword [edi + 0x10]
fcomp dword [0x419bec]
fnstsw ax
sahf
ja 0x419bdd
cmp dword [edi + 0x98], 0
je 0x419a84
mov bl, 1
jmp 0x419bdd
fild qword [edi + 0x10]
call fcn.004028e8
add eax, 0x400
mov dword [edi + 0x9c], eax
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
push 4
push 0x1000
mov eax, dword [edi + 0x9c]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
test esi, esi
jne 0x419af8
fild dword [edi + 0x9c]
add esp, 0xfffffff8
fistp qword [esp]
wait
call fcn.004b1e30
mov edx, eax
mov ax, 0xb
call fcn.004acdac
jmp 0x419bdd
mov eax, dword [0x4be4c4]
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, edi
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x10]
push 0x7f02
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
fild qword [edi + 0x10]
call fcn.004028e8
push eax
mov edx, dword [0x4be4c4]
mov eax, edi
mov ecx, esi
mov ebp, dword [eax + 0x1a0]
call dword [ebp + 0x18]
mov dword [esp + 0x100], eax
fild dword [esp + 0x100]
fild qword [edi + 0x10]
fcompp
fnstsw ax
sahf
jbe 0x419b86
mov eax, edi
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
push 0x4000
mov eax, dword [edi + 0x9c]
push eax
push esi
call sub.kernel32.dll_VirtualFree_1
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
jmp 0x419bdd
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
mov eax, edi
mov edx, dword [eax + 0x1a0]
call dword [edx + 0x14]
mov dword [edi + 0x98], esi
mov ax, word [edi + 0x92]
call fcn.004b1cb8
mov edx, eax
mov eax, esp
call fcn.004b81b0
cmp byte [edi + 0xa1], 0
je 0x419bd4
push esp
call sub.kernel32.dll_DeleteFileA_1
mov byte [edi + 0xa1], 0
mov byte [edi + 0x96], 3
mov bl, 1
mov eax, ebx
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x421d04
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
mov byte [ebp - 5], 0
mov eax, ebx
add al, 0xf9
sub al, 2
jae 0x421ecd
mov eax, esi
call fcn.004b22b8
fistp qword [ebp - 0x18]
wait
fild qword [ebp - 0x18]
fcomp dword [0x421edc]
fnstsw ax
sahf
jne 0x421db7
push 0x421ee0
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcpyA
push 0x421f38
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x20d]
call fcn.004b8144
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x20d]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x421da0
cmp eax, dword [esp]
pop edx
pop eax
ja 0x421ecd
jmp 0x421da8
pop edx
pop eax
jg 0x421ecd
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x421ecd
jmp 0x421dc3
push 2
push 0
push 0
push esi
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x20d]
mov edx, 0x1f5
call fcn.004066e4
push 0x421f3c
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcpyA
cmp bl, 8
jne 0x421df9
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
push 0x421f40
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
cmp bl, 7
jne 0x421e1f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
push 0x421f44
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
push 0x421f4c
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b849c
push eax
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
push 0x421f50
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
push 0x421f38
lea eax, [ebp - 0x20d]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x20d]
call fcn.004b8144
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x20d]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x421ec5
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x421ec9
jmp 0x421ecd
pop edx
pop eax
jg 0x421ecd
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42405c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
mov ebx, eax
mov eax, dword [0x4be868]
mov byte [eax], 1
push 0x1e
lea eax, [esp + 8]
push eax
xor eax, eax
mov al, bl
mov edx, dword [0x4bece8]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x4241f4
cmp bl, 0xf
jae 0x4240cb
mov eax, dword [0x4be924]
push eax
mov eax, dword [0x4be784]
mov al, byte [eax + 0x1889]
push eax
mov eax, dword [0x4be784]
mov al, byte [eax + 0x1887]
push eax
lea eax, [esp + 0xd]
push eax
lea edx, [esp + 0x14]
xor ecx, ecx
mov eax, ebx
call fcn.00423944
mov byte [esp], al
jmp 0x4241c1
cmp bl, 0x10
je 0x4240d5
cmp bl, 0x11
jne 0x4240df
mov byte [esp + 2], 0x10
mov byte [esp + 3], 0x11
cmp bl, 0x12
je 0x4240e9
cmp bl, 0x13
jne 0x4240f3
mov byte [esp + 2], 0x12
mov byte [esp + 3], 0x13
cmp bl, 0x14
je 0x4240fd
cmp bl, 0x15
jne 0x424107
mov byte [esp + 2], 0x14
mov byte [esp + 3], 0x15
cmp bl, 0x16
je 0x424111
cmp bl, 0x17
jne 0x42411b
mov byte [esp + 2], 0x16
mov byte [esp + 3], 0x17
cmp bl, 0x18
je 0x424125
cmp bl, 0x19
jne 0x42412f
mov byte [esp + 2], 0x18
mov byte [esp + 3], 0x19
cmp bl, 0x1a
je 0x424139
cmp bl, 0x1b
jne 0x424143
mov byte [esp + 2], 0x1a
mov byte [esp + 3], 0x1b
push 0xc
lea eax, [esp + 8]
push eax
xor eax, eax
mov al, byte [esp + 0xa]
mov edx, dword [0x4bece8]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x4241f4
push 0xc
mov eax, dword [0x4beb38]
push eax
xor eax, eax
mov al, byte [esp + 0xb]
mov edx, dword [0x4bece8]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_GetWindowTextA
test eax, eax
je 0x4241f4
mov eax, dword [0x4be924]
push eax
mov eax, dword [0x4be784]
mov al, byte [eax + 0x1889]
push eax
mov eax, dword [0x4be784]
mov al, byte [eax + 0x1887]
push eax
lea eax, [esp + 0xd]
push eax
mov ecx, dword [0x4beb38]
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.00423944
mov byte [esp], al
cmp byte [esp], 0
je 0x4241f4
mov eax, dword [0x4bec7c]
mov eax, dword [eax]
mov edx, dword [0x4be754]
mov eax, dword [edx + eax*4 - 4]
mov esi, dword [eax]
push esi
call sub.user32.dll_SetFocus
push 0
xor eax, eax
mov al, bl
push eax
push 0x402
push esi
call sub.user32.dll_SendMessageA
jmp 0x424238
cmp byte [esp + 1], 0
je 0x42420e
mov ax, 0xd1
call fcn.004aa600
mov edx, 3
call fcn.004b12a8
mov byte [esp], 0
mov eax, dword [0x4be868]
mov byte [eax], 0
mov eax, 1
call fcn.004ae058
xor eax, eax
mov al, bl
mov edx, dword [0x4bece8]
mov eax, dword [edx + eax*4 - 4]
push eax
call sub.user32.dll_SetFocus
mov al, byte [esp]
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x4242f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
push 0x1e
mov eax, dword [0x4bedb0]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x4243bc
mov eax, dword [0x4bece8]
cmp ebx, dword [eax + 0x38]
je 0x4243bc
mov eax, dword [0x4bee6c]
cmp byte [eax], 0
jne 0x4243bc
mov eax, dword [0x4be4a4]
mov byte [eax], 1
xor edx, edx
mov ax, 1
call fcn.004066c4
push eax
push 3
push 0xd3
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0
push 0xcf
push ebx
call sub.user32.dll_SendMessageA
push 0x50810080
push 0xfffffffffffffff0
push ebx
call sub.user32.dll_SetWindowLongA
push 0x20
push 0xf
mov eax, dword [0x4be784]
mov eax, dword [eax + 0x17cc]
mov edx, dword [0x4be784]
sub eax, dword [edx + 0x17c4]
sub eax, 0x37
sub eax, 7
mov edx, dword [0x4be9b4]
movzx edx, byte [edx]
add edx, edx
lea edx, [edx + edx*2]
sub eax, edx
push eax
push 0xfffffffffffffff4
push ebx
call sub.user32.dll_GetWindowLongA
movzx eax, ax
dec eax
push eax
mov eax, dword [0x4be9b4]
movzx eax, byte [eax]
mov edx, eax
shl eax, 3
sub eax, edx
add eax, 0x3a
push eax
push 0
push ebx
call sub.user32.dll_SetWindowPos
pop ebx
ret

Function at 0x4244dc
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [0x4be784]
cmp byte [edx + 0x190f], 0
je 0x42452c
mov edx, dword [0x4be744]
cmp dword [edx], 0
jle 0x424509
test al, al
je 0x424509
push 4
mov eax, dword [0x4be928]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4be744]
cmp dword [eax], 0
je 0x42451d
mov eax, dword [0x4be7e4]
cmp byte [eax], 0
je 0x42452c
push 0
mov eax, dword [0x4be928]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
ret