joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401277
Capabilities:
Capture screenshot
Delete file
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x19c], eax
push ebx
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
cmp edi, ebx
jne 0x4012aa
xor eax, eax
jmp 0x401397
push esi
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xc
push edi
call esi
push 8
push edi
call esi
push 0xa
push edi
mov dword [ebp - 0x74], eax
call esi
push edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x78]
mov dword [ebp - 0x70], eax
push dword [ebp - 0x74]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x70], ebx
je 0x40138c
cmp eax, ebx
je 0x40138c
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 0x70]
call esi
push 0xcc0020
push ebx
push ebx
push edi
push dword [ebp - 0x78]
mov dword [ebp - 0x80], eax
push dword [ebp - 0x74]
push ebx
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.GDI32.dll_BitBlt]
push 0x208
lea eax, [ebp - 0x6c]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
push 0x104
lea eax, [ebp - 0x6c]
push eax
push str._PUBLIC_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push str.Picturesindex.dat
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
call fcn.00401000
pop ecx
pop ecx
push dword [ebp - 0x80]
mov dword [ebp - 0x74], eax
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x7c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x70]
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x74]
jmp 0x401396
push edi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
pop esi
mov ecx, dword [ebp + 0x19c]
pop edi
xor ecx, ebp
pop ebx
call fcn.00401416
add ebp, 0x1a0
leave
ret

Function at 0x401416
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401420
repz ret
jmp fcn.00401425
Function at 0x401000
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 4], 5
mov eax, dword [0x408550]
mov dword [ebp - 0x1ac], eax
jmp 0x40103d
mov ecx, dword [ebp - 0x1a0]
mov dword [ebp - 0x1ac], ecx
cmp dword [ebp - 0x1ac], 0
je 0x401067
mov edx, dword [ebp - 0x1ac]
mov eax, dword [edx]
mov dword [ebp - 0x1a0], eax
mov ecx, dword [ebp - 0x1ac]
push ecx
push 0
call fcn.004012f2
add esp, 8
jmp 0x401031
mov dword [0x408550], 0
mov dword [ebp - 0x19c], 0x94
lea edx, [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40109c
cmp dword [ebp - 0x18c], 2
jne 0x40109c
mov dword [ebp - 4], 4
lea eax, [ebp - 0x1a8]
push eax
lea ecx, [ebp - 0x1a4]
push ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 2
call sub.ZSPOOL.dll_EnumPrintersA
cmp dword [ebp - 0x1a4], 0
je 0x401210
mov eax, dword [ebp - 0x1a4]
add eax, 3
and al, 0xfc
call fcn.00405f20
mov dword [ebp - 0x1cc], esp
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
je 0x401210
lea ecx, [ebp - 0x1a8]
push ecx
lea edx, [ebp - 0x1a4]
push edx
mov eax, dword [ebp - 0x1a4]
push eax
mov ecx, dword [ebp - 0x1b0]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 2
call sub.ZSPOOL.dll_EnumPrintersA
test eax, eax
je 0x401210
mov eax, dword [ebp - 4]
sub eax, 4
neg eax
sbb eax, eax
and eax, 8
add eax, 0xc
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b8], 0
jmp 0x40116b
mov ecx, dword [ebp - 0x1b8]
add ecx, 1
mov dword [ebp - 0x1b8], ecx
mov edx, dword [ebp - 0x1b0]
add edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b0], edx
mov eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x1a8]
jae 0x401210
mov ecx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1c0], ecx
push 0
lea edx, [ebp - 0x1bc]
push edx
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [eax]
push ecx
call sub.ZSPOOL.dll_OpenPrinterA
test eax, eax
je 0x40120b
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x1c4], 0
lea edx, [ebp - 0x1c8]
push edx
push 0x104
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x1c4]
push ecx
push 0x408010
mov edx, dword [ebp - 0x1bc]
push edx
call sub.ZSPOOL.dll_GetPrinterDataA
test eax, eax
jne 0x4011ff
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.0040126e
add esp, 8
mov eax, dword [ebp - 0x1bc]
push eax
call sub.ZSPOOL.dll_ClosePrinter
jmp 0x40114a
push str.ZSCRIPT.INI
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0x40875c
push str.ZPSDirectory
push str.ZScript32
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40124b
push 0
lea edx, [ebp - 0x108]
push edx
call fcn.0040126e
add esp, 8
xor eax, eax
cmp dword [0x408550], 0
setne al
push eax
call fcn.0040131a
add esp, 4
xor eax, eax
lea esp, [ebp - 0x1cc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4016be
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x408340
mov eax, dword [0x408340]
mov dword [ebp - 8], eax
jmp 0x4016f8
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4018af
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0
cmp dword [ebp + 0xc], 0
je 0x40172d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
add edx, 4
push edx
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x401749
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call sub.ZSPOOL.dll_OpenPrinterA
test eax, eax
je 0x401749
mov edx, dword [ebp - 0x18]
mov dword [ebp + 8], edx
cmp dword [ebp + 8], 0
je 0x401857
mov eax, dword [ebp - 8]
cmp dword [eax + 0x20c], 0
je 0x401857
mov dword [ebp - 0x20], 0
cmp dword [ebp + 0x10], 0
je 0x401789
push 3
push 0
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x20c]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.ZSPOOL.dll_SetJobA
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0
push 2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.ZSPOOL.dll_GetJobA
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x401857
cmp dword [ebp - 0x20], 0
je 0x401857
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 4]
jbe 0x4017ef
cmp dword [ebp - 0x20], 0x8000
jae 0x4017ef
mov eax, dword [ebp - 0x20]
add eax, 0x64
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
add eax, 3
and al, 0xfc
call fcn.00405f20
mov dword [ebp - 0x28], esp
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x401857
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 2
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.ZSPOOL.dll_GetJobA
test eax, eax
je 0x401857
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x34], 0x80
je 0x40184a
mov ecx, dword [ebp - 0x24]
cmp dword [ecx + 0x34], 0x100
je 0x40184a
mov edx, dword [ebp - 0x24]
cmp dword [edx + 0x34], 2
je 0x40184a
mov dword [ebp - 0x2c], 0
jmp 0x401851
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x401892
mov ecx, dword [ebp - 8]
add ecx, 0x108
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 8]
mov dword [edx + 0x20c], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004012f2
add esp, 8
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
jmp 0x40189b
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x18], 0
je 0x4018aa
mov ecx, dword [ebp - 0x18]
push ecx
call sub.ZSPOOL.dll_ClosePrinter
jmp 0x4016ea
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 0x2c]
mov esp, ebp
pop ebp
ret
Function at 0x402477
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.00402014
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40252b
mov ecx, dword [ebp + 0xc]
push ecx
push str.ZSPOOL__X
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40252b
push 0
push 0
push 0
push 6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x402521
push 0xb
push 0x4080a4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
push 0
mov edx, dword [ebp - 0x30]
push edx
call sub.ZSPOOL.dll_ZSP_StructCopy
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x402fc6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
push eax
push 0
call fcn.00402014
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je case.0x403052.3
mov dword [ebp - 0x10], 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x14]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x403021
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x8bc
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x118], ecx
mov edx, dword [ebp - 0x118]
sub edx, 1
mov dword [ebp - 0x118], edx
cmp dword [ebp - 0x118], 4
ja case.0x403052.3
mov eax, dword [ebp - 0x118]
jmp dword [eax*4 + 0x4030fd]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x34]
or al, 1
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [edx + 0x34], eax
jmp case.0x403052.3
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x34]
and edx, 0xfffffffe
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ecx + 0x34], edx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov ecx, dword [eax + 4]
push ecx
push 0
push 0x857
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x403052.3
cmp dword [ebp - 0xc], 0
je case.0x403052.4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0x34]
or edx, 4
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
mov dword [ecx + 0x34], edx
jmp case.0x403052.3
push 0x104
lea edx, [ebp - 0x114]
push edx
mov eax, dword [ebp + 0x10]
push eax
call sub.ZSPOOL.dll_ZSP_MakeSpoolFilePath
test eax, eax
je 0x4030ea
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00401f15
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4039bd
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
push edi
mov dword [ebp - 0x308], 0
mov byte [ebp - 0x40c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x40b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x204], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
xor eax, eax
mov word [ebp - 0x103], ax
mov byte [ebp - 0x100], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x614], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x613]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x304], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x303]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x510], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x50f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov word [ebp - 0x514], ax
lea ecx, [ebp - 0x614]
push ecx
mov edx, dword [ebp - 0x514]
and edx, 0xffff
push edx
call fcn.0040392a
add esp, 8
lea eax, [ebp - 0x304]
push eax
mov ecx, dword [ebp - 0x514]
and ecx, 0xffff
and ecx, 0x3ff
and ecx, 0xffff
or ch, 4
push ecx
call fcn.0040392a
add esp, 8
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll__splitpath]
add esp, 0x14
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x614]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403be8
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x304]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403be8
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x14
push 4
lea ecx, [ebp - 0x510]
push ecx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x403b8b
lea edx, [ebp - 0x510]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x308], 1
jmp 0x403be8
lea ecx, [ebp - 0x304]
push ecx
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x510]
push edx
call dword [sym.imp.MSVCRT.dll__makepath]
add esp, 0x14
push 4
lea eax, [ebp - 0x510]
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x403be8
lea ecx, [ebp - 0x510]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x308], 1
mov eax, dword [ebp - 0x308]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4047bf
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40494f
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x99887766
jne 0x40494f
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x188]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x40480b
mov ecx, dword [ebp - 8]
add ecx, 0x188
mov dword [ebp - 0x24], ecx
jmp 0x404812
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
movsx ecx, byte [eax + 0x14]
test ecx, ecx
je 0x40482e
mov edx, dword [ebp - 8]
add edx, 0x14
mov dword [ebp - 0x28], edx
jmp 0x404835
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x118]
test edx, edx
je 0x404856
mov eax, dword [ebp - 8]
add eax, 0x118
mov dword [ebp - 0x2c], eax
jmp 0x40485d
mov dword [ebp - 0x2c], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [eax + 0x158], 0x30
push 0
push 0
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 8]
add edx, 0x158
push edx
call sub.QDPRINT.dll_QdOpenProgress
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
push eax
push 0x404714
push 0
push 0
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call sub.QDPRINT.dll_QdSMF
mov dword [ebp - 4], eax
cmp dword [ebp - 0x14], 0
je 0x4048da
mov edx, dword [ebp - 8]
add edx, 0x158
push edx
call sub.QDPRINT.dll_QdCloseProgress
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x4048f3
cmp dword [ebp - 0xc], 0
je 0x4048f3
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x20], 0
jmp 0x404905
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jae 0x404936
push 0xc
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*4 + 4]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x404934
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx*4 + 4]
mov dword [eax], 5
jmp 0x4048fc
xor ecx, ecx
cmp dword [ebp - 4], 0
sete cl
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x404961
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4049d1
mov ecx, dword [ebp - 8]
cmp dword [ecx], 0x99887766
jne 0x4049d1
mov dword [ebp - 0xc], 0
cmp dword [0x40889c], 0
je 0x4049a3
mov edx, dword [ebp - 8]
push edx
call fcn.004047bf
mov dword [ebp - 4], eax
jmp 0x4049d1
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push fcn.004047bf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4049d1
push str.CreateThread:SMFPrint
mov edx, dword [ebp + 8]
push edx
call fcn.00405adf
add esp, 8
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x404b4d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x48]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00403d78
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404cea
lea edx, [ebp - 0x48]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x60]
mov eax, dword [edx + 4]
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x68], ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call sub.ZSPOOL.dll_OpenPrinterA
test eax, eax
je 0x404ce0
mov dword [ebp - 0xa4], 0
xor edx, edx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], edx
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xa4], eax
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], 0x408234
push 0x20
lea edx, [ebp - 0x90]
push edx
push 3
mov eax, dword [0x4088a4]
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x404c4c
push str.IMF32
lea ecx, [ebp - 0x90]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0xa4]
push edx
push 2
mov eax, dword [ebp - 0x4c]
push eax
call sub.ZSPOOL.dll_StartDocPrinterA
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x404cd7
lea ecx, [ebp - 0x90]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x404cce
push str.ImfPrintJob
mov edx, dword [ebp - 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
je 0x404cc1
push 0
push 0
push 0
mov eax, dword [ebp - 0x70]
push eax
push 0
mov ecx, dword [ebp - 0x68]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
call dword [ebp - 0xac]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x4c]
push ecx
call sub.ZSPOOL.dll_EndDocPrinter
mov edx, dword [ebp - 0x4c]
push edx
call sub.ZSPOOL.dll_ClosePrinter
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x4054ce
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x4088a4], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x4082b0
push 0x4082bc
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405516
xor eax, eax
jmp 0x405567
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0x1b58
push 0x7ee
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4088a8], 0
mov dword [0x4088a0], 0
mov dword [0x408898], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x403670
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x84d0e8]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x403840
mov eax, dword [esp + 8]
mov dword [eax], 0x61707865
mov dword [eax + 4], 0x61707865
mov dword [eax + 8], 0x61707865
mov dword [eax + 0xc], 0x61707865
mov dword [eax + 0x10], 0x3320646e
mov dword [eax + 0x14], 0x3320646e
mov dword [eax + 0x18], 0x3320646e
mov dword [eax + 0x1c], 0x3320646e
mov dword [eax + 0x20], 0x79622d32
mov dword [eax + 0x24], 0x79622d32
mov dword [eax + 0x28], 0x79622d32
mov dword [eax + 0x2c], 0x79622d32
mov dword [eax + 0x30], 0x6b206574
mov dword [eax + 0x34], 0x6b206574
mov dword [eax + 0x38], 0x6b206574
mov dword [eax + 0x3c], 0x6b206574
mov ecx, dword [esp + 4]
mov edx, dword [ecx]
mov dword [eax + 0x40], edx
mov dword [eax + 0x44], edx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], edx
mov edx, dword [ecx + 4]
mov dword [eax + 0x50], edx
mov dword [eax + 0x54], edx
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], edx
mov edx, dword [ecx + 8]
mov dword [eax + 0x60], edx
mov dword [eax + 0x64], edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0x70], edx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x80], edx
mov dword [eax + 0x84], edx
mov dword [eax + 0x88], edx
mov dword [eax + 0x8c], edx
mov edx, dword [ecx + 0x14]
mov dword [eax + 0x90], edx
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], edx
mov edx, dword [ecx + 0x18]
mov dword [eax + 0xa0], edx
mov dword [eax + 0xa4], edx
mov dword [eax + 0xa8], edx
mov dword [eax + 0xac], edx
mov ecx, dword [ecx + 0x1c]
mov dword [eax + 0xb0], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb8], ecx
mov dword [eax + 0xbc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0xc0], ecx
lea edx, [ecx + 1]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 2]
mov dword [eax + 0xc8], edx
add ecx, 3
mov dword [eax + 0xcc], ecx
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 0
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 0
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 0
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 0
ret
call sym.runtime.morestack_noctxt
jmp sym.internal_chacha8rand.setup