joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403cf0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x403d04
lea edi, [esi - 0x24]
jmp 0x403d06
xor edi, edi
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [edi + 4]
jne 0x403e39
mov ebx, dword [ebp + 0xc]
lea eax, [ebx - 0xd]
cmp eax, 0x1b
ja case.0x403d2b.14
movzx eax, byte [eax + 0x403e64]
jmp dword [eax*4 + 0x403e50]
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x20], eax
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esi], 0
je case.0x403d2b.14
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x1c]
cmp ebx, 0x25
mov ebx, dword [esi + 0x38]
mov ecx, 0xfffffff6
mov edx, dword [esi + 0x14]
mov edi, 0xa
cmove edi, ecx
mov dword [ebp + 0xc], eax
mov ecx, dword [esi + 0x34]
add edi, eax
sub edx, dword [esi + 0xc]
lea eax, [ecx + ebx]
cmp edi, eax
jl 0x403da3
sub edx, dword [esi + 0x2c]
sub edx, ecx
mov ecx, edi
sub edx, ebx
cmp edi, edx
cmovg ecx, edx
mov eax, dword [ebp - 8]
sub ecx, dword [ebp + 0xc]
push dword [ebp - 4]
add eax, ecx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_SetCursorPos]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [esi], 0
jne case.0x403d2b.14
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x1c]
cmp ebx, 0x26
mov ebx, dword [esi + 0x38]
mov ecx, 0xfffffff6
mov edx, dword [esi + 0x18]
mov edi, 0xa
cmove edi, ecx
mov dword [ebp + 0xc], eax
mov ecx, dword [esi + 0x34]
add edi, eax
sub edx, dword [esi + 0x10]
lea eax, [ecx + ebx]
cmp edi, eax
jl 0x403e19
sub edx, dword [esi + 0x2c]
sub edx, ecx
mov ecx, edi
sub edx, ebx
cmp edi, edx
cmovg ecx, edx
mov eax, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
add eax, ecx
push eax
push dword [ebp - 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_SetCursorPos]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x406e80
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov eax, dword [ebx]
cmp eax, dword [esi + 4]
je 0x406ea7
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov eax, 1
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
je 0x406ed6
test byte [esi + 0x58], 4
je 0x406ecd
cmp dword [esi + 0xac], 0
jne 0x406ecd
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esi + 0xac], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push dword [ebx + 0xc]
push 0x419
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [esi + 0x84], 0xcf
mov ecx, esi
push 1
push eax
call fcn.00406bd0
pop esi
xor eax, eax
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x407440
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [esi + 0xa8]
mov dword [edi], 0
cmp eax, 0x12
je 0x407479
cmp eax, 0x79
jne 0x40746c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x407479
cmp dword [esi + 0xa8], 0x20
jne 0x4074f9
cmp dword [ebp + 0xc], 0xf100
jne 0x4074f9
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x4074b5
mov ecx, esi
call fcn.00409ca0
push 0
push 0xffffffffffffffff
push 0x448
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
and byte [esi + 0x84], 0xbf
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0xa8]
cmp eax, 0x20
je 0x4074f9
test byte [esi + 0x84], 0x40
jne 0x4074ee
mov cl, byte [esi + 0x85]
mov al, cl
and al, 6
cmp al, 2
jne 0x4074e5
test cl, 8
je 0x4074e5
push 1
mov ecx, esi
call fcn.00409c40
mov ecx, esi
call fcn.00409c10
jmp 0x4074f3
cmp eax, 0x20
je 0x4074f9
mov dword [edi], 1
and byte [esi + 0x84], 0xbf
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x407c60
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x469070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.0042c5c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x407cbd
cmp dword [ebp - 0x114], 6
jb 0x407cbd
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret
Function at 0x40c026
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push ebx
push ebx
push dword [0x469310]
adc byte [ebx + 0x44890046], dl
and al, 0x24
call esi
push ebx
push ebx
push dword [0x46934c]
mov dword [esp + 0x20], eax
call esi
push dword [0x46931c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x46933c]
mov edi, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
push 0x104
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call edi
mov esi, dword [0x469354]
mov edi, eax
cmp dword [esi], 0
je 0x40c0de
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp al, byte [esi]
je 0x40c0cd
cmp al, byte [esi + 1]
je 0x40c0cd
push 0x10
push dword [0x469318]
push dword [0x46930c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
adc eax, sym.imp.USER32.dll_MessageBoxW
push edi
call fcn.0040c001
pop ecx
cmp eax, dword [esi + 4]
je 0x40c0de
cmp eax, dword [esi + 8]
jne 0x40c0af
push dword [0x46933c]
and dword [esp + 0x14], 0
push 0
call ebx
push eax
call ebp
xor edx, edx
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x20
jl 0x40c0f2
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40c0af
mov esi, dword [0x469380]
lea eax, [esp + 0x10]
push eax
push dword [0x469378]
push 0x4000
push esi
call edi
mov ecx, dword [0x469304]
lea edx, [esi + 8]
add ecx, dword [esp + 0x18]
mov ebx, 0xffe
mov eax, dword [ecx + 4]
sub ecx, esi
mov dword [esp + 0x18], eax
mov eax, dword [ecx + edx]
add eax, dword [esp + 0x18]
mov dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x40c14b
mov eax, dword [0x469368]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x4000
push esi
call edi
mov eax, dword [0x469340]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x469340]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
jmp 0x40c0af
Function at 0x40c040
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
push ebx
push ebx
push dword [0x469310]
adc byte [ebx + 0x44890046], dl
and al, 0x24
call esi
push ebx
push ebx
push dword [0x46934c]
mov dword [esp + 0x20], eax
call esi
push dword [0x46931c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [0x46933c]
mov edi, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebp
push 0x104
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call edi
mov esi, dword [0x469354]
mov edi, eax
cmp dword [esi], 0
je 0x40c0de
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp al, byte [esi]
je 0x40c0cd
cmp al, byte [esi + 1]
je 0x40c0cd
push 0x10
push dword [0x469318]
push dword [0x46930c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
adc eax, sym.imp.USER32.dll_MessageBoxW
push edi
call fcn.0040c001
pop ecx
cmp eax, dword [esi + 4]
je 0x40c0de
cmp eax, dword [esi + 8]
jne 0x40c0af
push dword [0x46933c]
and dword [esp + 0x14], 0
push 0
call ebx
push eax
call ebp
xor edx, edx
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + eax], ecx
add edx, 4
cmp edx, 0x20
jl 0x40c0f2
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40c0af
mov esi, dword [0x469380]
lea eax, [esp + 0x10]
push eax
push dword [0x469378]
push 0x4000
push esi
call edi
mov ecx, dword [0x469304]
lea edx, [esi + 8]
add ecx, dword [esp + 0x18]
mov ebx, 0xffe
mov eax, dword [ecx + 4]
sub ecx, esi
mov dword [esp + 0x18], eax
mov eax, dword [ecx + edx]
add eax, dword [esp + 0x18]
mov dword [edx], eax
lea edx, [edx + 4]
sub ebx, 1
jne 0x40c14b
mov eax, dword [0x469368]
mov dword [esi + 8], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 0x4000
push esi
call edi
mov eax, dword [0x469340]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x469340]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
jmp 0x40c0af

Function at 0x40c0c0
Capabilities:
Terminate process

Disassembly:
adc eax, sym.imp.USER32.dll_MessageBoxW
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40dfb0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x228
mov eax, dword [0x469070]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
or eax, 0x2001f
push esi
push edi
push eax
push edx
push dword [ecx]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0040df00
mov esi, eax
test esi, esi
jne 0x40e0a7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
jne 0x40e079
nop dword [eax]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
call fcn.0040dfb0
mov esi, eax
test esi, esi
jne 0x40e0a7
lea eax, [esp + 0x20]
mov dword [esp + 8], 0x100
push eax
push esi
push esi
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
push esi
push dword [esp + 0x28]
call edi
test eax, eax
je 0x40e040
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e090
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
push dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], 0
call fcn.0040e0f0
mov esi, eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40e0b6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x22c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00429d08
mov esp, ebp
pop ebp
ret 4
Function at 0x40ecc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449966
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x469070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x40ed6c
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x40ed6c
call fcn.0040d320
mov esi, eax
jmp 0x40ee5c
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40ed8f
call fcn.0040d320
jmp 0x40ee4f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x40edad
call fcn.0040d320
jmp 0x40ee4f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40edce
mov esi, 0x8007000e
jmp 0x40ee51
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0040d2d0
jmp 0x40edf8
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x40ee0f
mov esi, 0x8007000e
jmp 0x40ee51
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x40ee2f
call fcn.0040d320
jmp 0x40ee4f
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040eb60
mov esi, eax
test edi, edi
je 0x40ee5c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40ee80
lea ecx, [ebp - 0x418]
call fcn.0040d280
nop word [eax + eax]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40f600
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x469070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x110
lea eax, [ebp - 0x114]
mov dword [ebp - 0x118], 0x114
push 0
push eax
call fcn.0042c5c0
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40f66d
mov eax, dword [ebp - 0x114]
cmp eax, 5
jae 0x40f65d
cmp eax, 4
jne 0x40f66d
cmp dword [ebp - 0x110], 0x5a
jb 0x40f66d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret

Function at 0x411770
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449af8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x469070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x14], 0
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov edx, 2
nop
add edi, 0x104
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00429fed
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x4117dd
push 2
push esi
call fcn.00429fda
add esp, 8
push edi
push ebx
push dword [0x46c298]
mov esi, ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edx, 2
cmp eax, edi
je 0x4117b0
test eax, eax
jne 0x411852
call fcn.004273e0
push 0x208
push 0x46d350
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push ebx
push 0x39
push str.CConfigWin.cpp
mov edi, eax
call esi
push eax
push 0x10
push edi
push str.Failed_assertion_in__s_at_line__d_n_n_s
call fcn.00427590
add esp, 0x18
push 1
call fcn.004316e6
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, eax
mov dword [0x46c2c8], 7
xor eax, eax
mov dword [0x46c2c4], 0
mov word [0x46c2b4], ax
cmp word [edx], ax
jne 0x411887
xor ecx, ecx
jmp 0x41189f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411890
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x46c2b4
call fcn.0040ad40
push 2
push ebx
call fcn.00429fda
add esp, 8
mov eax, 0x46c2b4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4128d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x449c8b
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x469070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push ecx
lea ecx, [ebp - 0x81c]
call fcn.004275c0
push ecx
lea ecx, [ebp - 0x81c]
mov dword [ebp - 4], 0
call fcn.00427a00
mov esi, eax
mov ecx, str.About__s
push esi
call fcn.0040fa50
push eax
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.00412710
add esp, 0x10
lea eax, [ebp - 0x810]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.00429fe8
add esp, 4
lea ecx, [ebp - 0x81c]
call fcn.00427900
push 0x208
push 0x46d350
push 0
mov dword [ebp - 0x814], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
mov ebx, eax
mov eax, dword [ebp - 0x814]
test eax, eax
jne 0x4129ca
push str.NULL_pointer
push 0x287
push str.CDialogsWin.h
call esi
push eax
push 0x10
push ebx
push str.Failed_assertion_in__s_at_line__d_n_n_s
call fcn.00427590
add esp, 0x18
push 1
call fcn.004316e6
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push eax
push 0x3f4
push dword [edi + 4]
call esi
mov eax, dword [ebp - 0x814]
push eax
call fcn.00429fe8
add esp, 4
mov ecx, str.GlobalNamesAxCrypt
call fcn.0040fa50
push eax
mov ecx, str.This_is_an_ALPHA_version__Pre_BETA__Enjoy__but_be_aware__and_please_report_problems_and_suggestions__Get_the_full_version_of__s_for_one_click_encryption__decryption_and_viewing.
call fcn.0040fa50
push eax
lea eax, [ebp - 0x810]
push 0x800
push eax
call fcn.00412710
add esp, 0x10
lea eax, [ebp - 0x810]
push eax
push 0x3f3
push dword [edi + 4]
call esi
mov ecx, str.http:__www.axantum.com
call fcn.0040fa50
push eax
push 0x3f2
push dword [edi + 4]
call esi
push ecx
lea ecx, [edi + 4]
call fcn.00417060
push dword [ebp - 0x818]
call fcn.00429fe8
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret 0x10
Function at 0x412a80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov edi, ecx
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
push esi
mov ebx, eax
call dword [sym.imp.COMCTL32.dll_ImageList_Duplicate]
mov dword [edi + 8], eax
mov dword [ebp + 8], 0
test ebx, ebx
jle 0x412ad3
nop dword [eax]
lea eax, [ebp + 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004164e0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jl 0x412ab0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [edi + 8]
call dword [sym.imp.COMCTL32.dll_ImageList_GetIconSize]
cmp eax, 1
jne 0x412bfa
push 0
push dword [ebp - 8]
push dword [ebp - 0xc]
push eax
push 0x71
push dword [0x46b2ec]
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
test esi, esi
jne 0x412b44
call fcn.004273e0
push 0x208
push 0x46d350
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push ebx
mov edi, eax
push 0x7b
jmp 0x412c2d
push esi
push 0xffffffffffffffff
push dword [edi + 8]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x412b8f
push 0x208
push 0x46d350
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push str.ImageList_ReplaceIcon___failed
mov edi, eax
push 0x7e
jmp 0x412c2d
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
test eax, eax
jne 0x412bd2
call fcn.004273e0
push 0x208
push 0x46d350
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push ebx
mov edi, eax
push 0x7f
jmp 0x412c2d
lea eax, [ebp + 8]
mov dword [ebp + 8], 0xffffffff
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.004164e0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax + 0x14], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x208
push 0x46d350
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push str.ImageList_GetIconSize__
mov edi, eax
push 0x77
push str.CMainFrame.h
call esi
push eax
push 0x10
push edi
push str.Failed_assertion_in__s_at_line__d_n_n_s
call fcn.00427590
add esp, 0x18
push 1
call fcn.004316e6
int3
Function at 0x412c50
Capabilities:
Get file system object information
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x469070]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2b8]
push edi
push 0x2b4
push 0
push eax
mov edi, ecx
call fcn.0042c5c0
add esp, 0xc
lea eax, [ebp - 0x2b8]
push 0x4109
push 0x2b4
push eax
push 0
push dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x412d38
mov ecx, dword [edi]
mov eax, ecx
mov esi, dword [ebp - 0x2b4]
mov edx, dword [ecx + 4]
cmp byte [edx + 0xd], 0
jne 0x412cca
cmp dword [edx + 0x10], esi
jge 0x412cc0
mov edx, dword [edx + 8]
jmp 0x412cc4
mov eax, edx
mov edx, dword [edx]
cmp byte [edx + 0xd], 0
je 0x412cb6
cmp eax, ecx
je 0x412cd3
cmp esi, dword [eax + 0x10]
jge 0x412cd5
mov eax, ecx
cmp eax, ecx
je 0x412cee
mov eax, dword [eax + 0x14]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret 8
push dword [ebp - 0x2b8]
push 0xffffffffffffffff
push dword [edi + 8]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov esi, eax
cmp esi, 0xffffffff
je 0x412d4d
lea eax, [ebp - 0x2b4]
mov ecx, edi
push eax
lea eax, [ebp - 0x2c0]
push eax
call fcn.004164e0
mov eax, dword [ebp - 0x2c0]
pop edi
mov dword [eax + 0x14], esi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00429d08
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.00429d08
mov esp, ebp
pop ebp
ret 8
push 0x208
push 0x46d350
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
mov edx, 0x46d350
mov ecx, str.Unknown_module._GetModuleFileName___failed_too.
cmovne ecx, edx
push ecx
call esi
push str.ImageList_ReplaceIcon__
push 0xa0
push str.CMainFrame.h
mov edi, eax
call esi
push eax
push 0x10
push edi
push str.Failed_assertion_in__s_at_line__d_n_n_s
call fcn.00427590
add esp, 0x18
push 1
call fcn.004316e6
int3