joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x48
push 0
push 0x416ee4
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x416ee8], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x416ee4], eax
call section..text
call fcn.004053cf
call fcn.00413400
call fcn.00412b50
call fcn.0041256d
call fcn.00411f5b
call fcn.004118f0
call fcn.0041160e
call fcn.00411574
call fcn.00410260
call fcn.0040e39c
call fcn.0040dc40
call fcn.0040d14d
call fcn.0040c492
call fcn.0040c3d9
call fcn.0040bfbb
call fcn.0040aa54
call fcn.0040617c
call fcn.00405f27
call fcn.00405c6e
call fcn.004056c4
push 0x416f0c
mov eax, str.88d96a05_f192_11d4_a65f_0040963251e5
push eax
call sub.ole32.dll_CLSIDFromString
push 0x416f1c
mov eax, str.2933BF96_7B36_11d2_B20E_00C04F983E60
push eax
call sub.ole32.dll_CLSIDFromString
mov edx, str.WimgApi.dll
lea ecx, [0x416efc]
call fcn.00405068
mov edx, str.INDEX:R:
lea ecx, [0x416ef8]
call fcn.00405068
mov eax, 0x4150fe
push eax
push dword [0x416ef8]
call fcn.00410510
mov ebx, eax
inc ebx
mov dword [0x416f04], ebx
call fcn.00401831
push 0
jmp 0x401113
call 0x40112d
call fcn.00413450
push dword [0x416ee4]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00405f1b
call fcn.00406126
call fcn.0040aa31
call fcn.0040bfba
call fcn.0040c3d8
call fcn.0040c486
call fcn.00410280
call fcn.00411602
call fcn.0041161a
call fcn.004118e0
call fcn.00411f3d
call fcn.00412c55
call fcn.00412b40
ret
Function at 0x40323d
Capabilities:
Get graphical window text

Disassembly:
push ebp
push ebx
mov edx, 0x1c
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x403244
push 0xe
call fcn.00407deb
push eax
pop eax
mov byte [esp], al
lea ebp, [esp + 4]
mov byte [ebp + 0x17], 1
mov byte [ebp + 0x18], 4
mov byte [ebp + 0x1b], 0
push 0xd
call fcn.00407f1f
push 2
call fcn.0040b0b7
push eax
call sub.USER32.dll_GetDC
mov dword [esp + 0x60], eax
push 0
movsx eax, byte [esp + 4]
push eax
lea eax, [0x401d30]
push eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x70]
call sub.GDI32.dll_EnumFontFamiliesExW
mov dword [esp + 0x64], eax
push dword [esp + 0x60]
push 2
call fcn.0040b0b7
push eax
call sub.USER32.dll_ReleaseDC
push 0
push 0
push 0x31
push 1
call fcn.00407ecb
push eax
call sub.USER32.dll_SendMessageW
mov dword [esp + 0x68], eax
lea eax, [esp + 4]
push eax
push 0x5c
push dword [esp + 0x70]
call sub.GDI32.dll_GetObjectW
push dword [0x417828]
push dword [0x417828]
push dword [0x417828]
lea ebp, [esp + 0x10]
lea eax, [ebp + 0x1c]
push eax
call fcn.00412b70
add dword [0x417828], 2
push 0xc
mov edx, dword [0x4158a8]
add dword [esp + 4], edx
call fcn.00407e80
pop dword [0x417828]
push dword [0x417828]
push 1
push dword [0x417828]
push dword [0x417828]
lea eax, [ebp + 0x1c]
push eax
call fcn.00412b70
add dword [0x417828], 2
push 0xd
mov edx, dword [0x4158a8]
add dword [esp + 4], edx
call fcn.00402461
pop dword [0x417828]
push 0x5a
push dword [0x416f00]
call sub.GDI32.dll_GetDeviceCaps
push eax
push 0x48
lea ebp, [esp + 0xc]
push dword [ebp]
call sub.KERNEL32.dll_MulDiv
mov ebx, eax
neg ebx
mov dword [esp + 0x6c], ebx
push dword [0x417828]
push 1
push dword [0x417828]
push dword [0x417828]
mov eax, dword [esp + 0x7c]
cdq
push edx
push eax
call fcn.004112a0
add dword [0x417828], 2
push 0x10
mov edx, dword [0x4158a8]
add dword [esp + 4], edx
call fcn.00402461
pop dword [0x417828]
xor eax, eax
add esp, 0x70
pop ebx
pop ebp
ret
Function at 0x405b8d
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x405be2
push dword [esp + 0x10]
push 0x405b0c
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x417170]
test esi, esi
je 0x405c3b
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x405bda
cmp byte [esi + 0x10], 0
je 0x405bda
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x405bb6
jmp 0x405c3b
mov esi, dword [0x417170]
test esi, esi
je 0x405c3b
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x405c34
cmp byte [esi + 0x11], 0
je 0x405c10
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x405c27
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x417170
call fcn.004133bc
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x405bef
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x405cde
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push dword [0x417834]
call fcn.00412c56
mov ebp, eax
or ebx, 0xffffffff
xor eax, eax
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, dword [esp + 0x1c]
movzx edx, word [eax]
test dx, dx
je 0x405dde
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x20
mov dword [esp + 0x14], 0x22
cmp dx, word [esp + 0x10]
jne 0x405d34
push 0x20
pop edx
add eax, 2
cmp word [eax], dx
je 0x405d2c
movzx edx, word [eax]
mov dword [esp + 0x1c], 1
cmp dx, word [esp + 0x14]
jne 0x405d74
add eax, 2
mov esi, eax
movzx ecx, word [eax]
test cx, cx
je 0x405db6
push 0x22
pop edx
cmp cx, dx
je 0x405d66
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x405d56
xor ecx, ecx
cmp word [eax], cx
je 0x405db6
mov ecx, eax
add eax, 2
jmp 0x405db8
test dx, dx
je 0x405dbe
push 0x20
mov esi, eax
pop ecx
cmp dx, cx
je 0x405d66
add eax, 2
push 0x22
pop edx
cmp word [eax], dx
jne 0x405dac
add eax, 2
movzx ecx, word [eax]
test cx, cx
je 0x405db6
cmp cx, dx
je 0x405da9
add eax, 2
movzx ecx, word [eax]
test cx, cx
jne 0x405d99
push 0x20
pop ecx
movzx edx, word [eax]
test dx, dx
jne 0x405d7e
jmp 0x405d66
mov ecx, eax
mov edx, dword [esp + 0x1c]
jmp 0x405dc0
xor edx, edx
cmp dword [ebp], ebx
jne 0x405dc9
test edi, edi
jne 0x405de6
test edx, edx
je 0x405dce
inc ebx
xor edx, edx
mov esi, edx
movzx edx, word [eax]
test dx, dx
jne 0x405d22
test edi, edi
jne 0x405df7
mov eax, ebx
jmp 0x405dfb
test esi, esi
je 0x405df7
sub ecx, esi
mov eax, esi
sar ecx, 1
mov dword [edi], ecx
inc dword [ebp]
jmp 0x405dfb
xor ecx, ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x407e18
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [0x417878]
call fcn.00412cbf
mov ebx, eax
test ebx, ebx
je 0x407e7c
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x407e41
push dword [esp + 0xc]
push ebx
call eax
jmp 0x407e7c
push esi
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push dword [esp + 0x14]
mov edi, eax
push edi
call fcn.004136e0
mov esi, eax
lea ecx, [edi + 1]
push ecx
xor eax, eax
push esi
mov word [esi], ax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
sub edi, eax
push edi
call fcn.004137b0
pop edi
pop esi
pop ebx
ret 8

Function at 0x40a834
Capabilities:
Check os version

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x114
xor ebx, ebx
mov esi, 0xc8
and dword [esp + 0x10], ebx
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a9aa
mov eax, dword [esp + 0x24]
dec eax
je 0x40a98d
dec eax
jne 0x40a9aa
lea eax, [esp + 0x128]
xor ebp, ebp
push eax
call fcn.0040a7ed
pop ecx
test eax, eax
je 0x40a8eb
mov ebx, dword [esp + 0x12c]
mov edi, dword [esp + 0x130]
mov eax, dword [esp + 0x134]
cmp byte [esp + 0x242], 1
jne 0x40a8ae
xor ebp, ebp
inc ebp
sub ebx, 3
je 0x40a989
dec ebx
je 0x40a985
dec ebx
je 0x40a964
dec ebx
je 0x40a91e
sub ebx, 4
jne 0x40a9aa
test edi, edi
jne 0x40a9aa
cmp eax, 0x55f0
sbb esi, esi
and esi, 0xfffffff6
add esi, 0x78
jmp 0x40a9aa
lea eax, [esp + 0x244]
mov dword [esp + 0x244], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x40a8ae
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
cmp byte [esp + 0x35e], 1
jmp 0x40a8a9
sub edi, 0
je 0x40a956
dec edi
je 0x40a948
dec edi
je 0x40a93a
dec edi
jne 0x40a9aa
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x69
jmp 0x40a9aa
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x5f
jmp 0x40a9aa
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x55
jmp 0x40a9aa
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x4b
jmp 0x40a9aa
sub edi, 0
je 0x40a981
dec edi
je 0x40a97d
dec edi
jne 0x40a9aa
mov esi, ebp
neg esi
sbb esi, esi
and esi, 0xfffffffb
add esi, 0x41
jmp 0x40a9aa
push 0x3c
jmp 0x40a9a9
push 0x32
jmp 0x40a9a9
push 0x14
jmp 0x40a9a9
push 5
jmp 0x40a9a9
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40a9a7
cmp eax, 0xa
je 0x40a9a3
cmp eax, 0x5a
jne 0x40a9aa
push 0x28
jmp 0x40a9a9
push 0x1e
jmp 0x40a9a9
push 0xa
pop esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret
Function at 0x40b0d3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0x417884]
call fcn.00412cbf
mov esi, eax
test esi, esi
je 0x40b1ad
cmp dword [ebp + 0xc], 0
je 0x40b11f
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40b110
cmp dword [esi + 0x1c], 0
jne 0x40b110
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40b1ad
test byte [ebp + 0x10], 3
je 0x40b13a
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0040bb33
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x40b15f
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x40b173
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x40b190
test ebx, ebx
je 0x40b184
push 8
jmp 0x40b196
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x40b1a3
test ebx, ebx
je 0x40b199
push 3
pop ecx
jmp 0x40b1a3
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x40bcc6
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push 0x414150
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x40bd5e
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x40bd5b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x40bd5b
lea eax, [esi - 1]
push eax
push dword [0x417884]
call fcn.00412cbf
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x40bd5d
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x40bd52
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x40be45
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x40bd38
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x40be04
push eax
call esi
test al, al
jns 0x40be04
push 0x11
call esi
test al, al
js 0x40be04
push 0x10
call esi
test al, al
js 0x40be04
push 0x12
call esi
test al, al
js 0x40be04
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x40be04
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x40bdd8
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x40bdef
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x40be4f
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x40be4f
test ebp, ebp
je 0x40be28
push 0x11
call esi
test al, al
js 0x40be20
push 0x10
call esi
test al, al
js 0x40be20
push 0x12
call esi
test al, al
jns 0x40be28
push 1
push ebp
call fcn.0040be5b
test ebx, ebx
je 0x40be3c
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x40be4f
test edi, edi
je 0x40be4f
mov eax, dword [edi + 8]
jmp 0x40be51
and dword [esp + 0x14], 0
jmp 0x40bd5d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x40e330
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x40e362
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40e35d
cmp dword [esp + 0xc], esi
je 0x40e379
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x411665
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x4117ad
xor ecx, ecx
cmp word [eax], cx
je 0x4117ad
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x4116be
cmp eax, 3
jne 0x4116f8
cmp word [esp + 0xa], 0x3a
jne 0x4116f8
cmp eax, 2
jne 0x4116dc
lea eax, [esp + 8]
push 0x414468
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4117ad
push 0xfffffffffffffffe
pop edi
jmp 0x4117ad
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x41170d
cmp ax, bx
jne 0x411717
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x411700
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x411756
test byte [esp + 0x21c], 0x10
je 0x41173d
push 0xfffffffffffffffe
pop edi
jmp 0x41174d
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4117ab
cmp word [esp + 0x10], bp
jne 0x411764
cmp word [esp + 0x12], bp
je 0x411783
cmp word [esp + 0x10], bx
jne 0x411772
cmp word [esp + 0x12], bx
je 0x411783
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x4117ab
cmp word [esp + 0x12], ax
jne 0x4117ab
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x411798
test al, 0x10
je 0x4117ab
jmp 0x4117a8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4117ab
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x411890
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x4118cc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4
Function at 0x411b10
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x4179ac]
call fcn.00412cbf
test eax, eax
je case.0x411b3e.3
mov ecx, dword [esp + 8]
add ecx, 0xfffffffe
cmp ecx, 0x17
ja case.0x411b3e.3
movzx ecx, byte [ecx + 0x411c48]
jmp dword [ecx*4 + 0x411c30]
cmp dword [eax + 4], 0
je 0x411b5b
push 2
push 0x41446c
push eax
call fcn.00411da0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x41446c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x411b8a
push 3
push 0x414470
push eax
call fcn.00411da0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 3
push 0x414470
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x411bb9
push 2
push 0x414474
push eax
call fcn.00411da0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x414474
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x411be8
push 4
push 0x414478
push eax
call fcn.00411da0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x414478
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x411c17
push 4
push 0x414480
push eax
call fcn.00411da0
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x414480
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x411c60
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x411d68
cmp word [edx], 0
je 0x411d68
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x411c8e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x411ced
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x411cc0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411ca0
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.00411da0
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411cc0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.00411eb0
mov edi, eax
test edi, edi
je 0x411ce3
cmp dword [esi + 4], 0
je 0x411d3b
push dword [esp + 0x14]
push edi
push esi
call fcn.00411da0
push edi
push 0
push dword [0x416ee4]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x416ee4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
Function at 0x411da0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x411ea7
cmp dword [esi + 0x14], 1
jne 0x411deb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x411e68
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x411e53
dec eax
je 0x411e3c
sub eax, 2
je 0x411e27
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00411890
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x411e95
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x411e11
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x407d70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov ecx, 0x4c6728
push esi
call fcn.00401660
cmp byte [0x4c6990], 0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
je 0x407e45
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0x4ba7c8
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x18], xmm0
call fcn.0041ecc0
cmp dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
push dword [0x4c65e4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
cmp ecx, 0x10
jb 0x407e04
mov edx, dword [ebp - 0x18]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407dfa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407f54
push ecx
push edx
call fcn.0042cca6
add esp, 8
cmp dword [0x4c6784], 0x10
mov ecx, 0x4c6770
mov edx, dword [0x4c6780]
cmovae ecx, dword [0x4c6770]
push 1
push 0x4b9a40
call fcn.00416f00
add esp, 8
test al, al
je 0x407f10
push 0x30
push 0x4ba214
push 0x4ba7d8
jmp 0x407f04
cmp byte [0x4c6991], 1
je 0x407f10
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 8], 0
push 0x4ba7f4
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x18], xmm0
call fcn.0041ecc0
cmp dword [ebp - 4], 0x10
lea eax, [ebp - 0x18]
cmovae eax, dword [ebp - 0x18]
push eax
push dword [0x4c65e4]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
cmp ecx, 0x10
jb 0x407ec2
mov edx, dword [ebp - 0x18]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x407eb8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407f59
push ecx
push edx
call fcn.0042cca6
add esp, 8
push 0
push dword [0x4c65e0]
call esi
cmp dword [0x4c6784], 0x10
mov ecx, 0x4c6770
mov edx, dword [0x4c6780]
cmovae ecx, dword [0x4c6770]
push 1
push 0x4b9a40
call fcn.00416f00
add esp, 8
test al, al
je 0x407f10
push 0x40
push 0x4ba214
push 0x4ba7f4
push dword [0x4c6618]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 5
push dword [0x4c65d8]
mov byte [0x4c6990], 0
call esi
push 0
push dword [0x4c65dc]
call esi
push 0
push 0
push 0x402
push dword [0x4c65e0]
mov dword [0x4c65c4], 0
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0047e707
call fcn.0047e707
int3