joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404290
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1544
call fcn.0040ae30
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x44c598]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [0x44c59c]
push esi
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], edx
call fcn.00404280
mov edi, dword [ebp - 0xc]
mov ecx, dword [0x44c5a0]
mov edx, dword [str.7__]
add edi, 0x23f
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x10], 0x20
lea ecx, [ecx]
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x453d1c]
shl esi, 4
add esi, dword [ebp - 0x1c]
cmp eax, 0xfa9
jne 0x40431c
mov dword [0x453d18], 0xedeb2e40
jmp 0x404337
cmp eax, 0x3eb
jne 0x404337
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x4537a8], 0
mov eax, dword [ebp - 8]
lea ecx, [edi + eax]
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x453d1c], 0x9e6
mov dword [0x453d14], 0xf4ea3dee
jne 0x404370
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x453d1c], 0x213
jne 0x40440b
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoA]
lea eax, [ebp - 0x944]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x1544]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommError]
lea eax, [ebp - 0xd44]
push eax
push 0
push 0x403f68
push 0x403fb4
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
sub ebx, dword [ebp - 4]
cmp dword [0x453d1c], 0xc
jne 0x40441f
push 0
call dword [sym.imp.KERNEL32.dll_GlobalWire]
mov ecx, ebx
shr ecx, 5
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x18]
add dword [ebp - 4], eax
mov edx, ebx
shl edx, 4
add edx, dword [ebp - 0x14]
lea eax, [edi + ebx]
xor edx, eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub dword [ebp - 8], eax
add edi, 0x61c88647
sub dword [ebp - 0x10], 1
jne 0x4042f0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax + 4], ebx
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404470
Capabilities:
Clear file content
Connect pipe
Get thread local storage value
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1808
call fcn.0040ae30
mov eax, dword [0x453d1c]
mov ecx, dword [0x4537ac]
shr eax, 3
test eax, eax
jbe 0x404576
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenJobObjectA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x453d1c], 0x959
jne 0x40455c
push 0
lea eax, [ebp - 0x808]
push eax
push 0
push 0x403fc0
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0x1008]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea edx, [ebp - 0x1808]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 4]
push eax
call fcn.00404290
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4044b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4077e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b4f8]
jne 0x4077ea
repz ret
jmp fcn.0040ca1e

Function at 0x40c643
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00409b16
and dword [ebp - 4], 0
cmp dword [0x451798], 0
mov ebx, eax
jne 0x40c6f4
push 0x401d44
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c7a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401d38
push edi
call esi
test eax, eax
je 0x40c7a5
push eax
call fcn.00409aa4
mov dword [esp], 0x401d28
push edi
mov dword [0x451798], eax
call esi
push eax
call fcn.00409aa4
mov dword [esp], 0x401d14
push edi
mov dword [0x45179c], eax
call esi
push eax
call fcn.00409aa4
mov dword [esp], 0x401cf8
push edi
mov dword [0x4517a0], eax
call esi
push eax
call fcn.00409aa4
pop ecx
mov dword [0x4517a8], eax
test eax, eax
je 0x40c6f4
push 0x401ce0
push edi
call esi
push eax
call fcn.00409aa4
pop ecx
mov dword [0x4517a4], eax
mov eax, dword [0x4517a4]
cmp eax, ebx
je 0x40c74c
cmp dword [0x4517a8], ebx
je 0x40c74c
push eax
call fcn.00409b1f
push dword [0x4517a8]
mov esi, eax
call fcn.00409b1f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c74c
test edi, edi
je 0x40c74c
call esi
test eax, eax
je 0x40c743
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c743
test byte [ebp - 0xc], 1
jne 0x40c74c
or dword [ebp + 0x10], 0x200000
jmp 0x40c785
mov eax, dword [0x45179c]
cmp eax, ebx
je 0x40c785
push eax
call fcn.00409b1f
pop ecx
test eax, eax
je 0x40c785
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c785
mov eax, dword [0x4517a0]
cmp eax, ebx
je 0x40c785
push eax
call fcn.00409b1f
pop ecx
test eax, eax
je 0x40c785
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x451798]
call fcn.00409b1f
pop ecx
test eax, eax
je 0x40c7a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c7a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4018fa
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ecx
push edx
mov ecx, 0xfe
add ecx, 1
push ecx
push ebx
push 0x468804
call sub.KERNEL32.dll_lstrcpynA
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x468804
push 0x468039
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x468804
push 0x468062
call fcn.004010ba
pop edx
pop ecx
push esi
mov esi, dword [0x468d60]
call fcn.004010fc
push ecx
push edx
push 0x468d70
push dword [0x468800]
call sub.KERNEL32.dll_lstrcpyA
pop edx
pop ecx
pop esi
push ecx
push edx
push 0xfe
push 0x468804
push dword [0x468800]
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x468804
push 0x468077
call fcn.004010ba
pop edx
pop ecx
cmp dword [0x468d60], 0
jne 0x4019c2
push ecx
push edx
mov ecx, 0xfe
add ecx, 1
push ecx
push 0x468038
push 0x468c44
call sub.KERNEL32.dll_lstrcpynA
pop edx
pop ecx
jmp 0x4019e2
push 0
push 0x100
push 0x468c44
push 0
push dword [0x468d60]
push 0
push 0x1200
call sub.KERNEL32.dll_FormatMessageA
push ecx
push edx
push 0xfe
push 0x468804
push 0x468039
call fcn.004010ba
pop edx
pop ecx
push ecx
push edx
push 0xfe
push 0x468804
push 0x468c44
call fcn.004010ba
pop edx
pop ecx
push ecx
push 0xffff
push str.ERROR:
call fcn.00401000
push 0
push 0x468d58
push eax
push str.ERROR:
push dword [0x468d68]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
push ecx
push 0xffff
push 0x468804
call fcn.00401000
push 0
push 0x468d58
push eax
push 0x468804
push dword [0x468d68]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
push 0xfe
push 0x468910
call sub.KERNEL32.dll_GetConsoleTitleA
push ecx
push edx
push 0x100
push 4
push 0x468a20
push 0x468910
call fcn.00401072
pop edx
pop ecx
push ecx
push edx
mov eax, 0x100
cmp eax, 0x10000
jbe 0x401aaa
mov eax, 0x10000
push eax
push str.CMD
push 0x468a20
call fcn.0040101d
pop edx
pop ecx
je 0x401b4a
push ecx
push edx
push 0x100
push 8
push 0x468a20
push 0x468910
call fcn.00401072
pop edx
pop ecx
push ecx
push edx
mov eax, 0x100
cmp eax, 0x10000
jbe 0x401aef
mov eax, 0x10000
push eax
push str.Command
push 0x468a20
call fcn.0040101d
pop edx
pop ecx
je 0x401b4a
push ecx
push 0xffff
push str._r_n__press_ENTER:
call fcn.00401000
push 0
push 0x468d58
push eax
push str._r_n__press_ENTER:
push dword [0x468d68]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
push 0
push 0x468d58
push 1
push 0x468804
push dword [0x468d64]
call sub.KERNEL32.dll_ReadFile
mov eax, 0xffffffff
pop ebx
leave
ret 4
Function at 0x401bca
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.00402c93
push str.ERROR_
call fcn.00402c93
mov eax, dword [0x4690e4]
call fcn.00402aff
cmp dword [0x468dce], 0
je 0x401c06
push str._IN_LINE
call fcn.00402c93
mov eax, dword [0x468dce]
call fcn.00402aff
push 0x4680b9
call fcn.00402c93
mov edx, str.SUCCESS__not_actually_an_error_
mov eax, dword [0x4690e4]
test eax, eax
je 0x401d81
mov edx, str.INVALID_FUNCTION_NUMBER
dec eax
je 0x401d81
mov edx, str.FILE_NOT_FOUND
dec eax
je 0x401d81
mov edx, str.PATH_NOT_FOUND
dec eax
je 0x401d81
mov edx, str.TOO_MANY_OPEN_FILES
dec eax
je 0x401d81
mov edx, str.ACCESS_DENIED
dec eax
je 0x401d81
mov edx, str.INVALID_HANDLE
dec eax
je 0x401d81
mov edx, str.NOT_ENOUGH_MEMORY
sub eax, 2
je 0x401d81
mov edx, str.BAD_LOAD_FORMAT
sub eax, 3
je 0x401d81
mov edx, str.INVALID_ACCESS
dec eax
je 0x401d81
mov edx, str.INVALID_DATA
dec eax
je 0x401d81
mov edx, str.OUT_OF_MEMORY
dec eax
je 0x401d81
mov edx, str.INVALID_DRIVE
dec eax
je 0x401d81
mov edx, str.CANT_DELETE_CURRENT_DIRECTORY
dec eax
je 0x401d81
mov edx, str.CANT_MOVE_TO_DIFFERENT_DEVICE
dec eax
je 0x401d81
mov edx, str.NO_MORE_FILES_AVAILABLE
dec eax
je 0x401d81
mov edx, str.MEDIA_IS_WRITE_PROTECTED
dec eax
je 0x401d81
mov edx, str.THE_SYSTEM_CANNOT_FIND_THE_DEVICE_SPECIFIED
dec eax
je 0x401d81
mov edx, str.DEVICE_NOT_READY
dec eax
je 0x401d81
mov edx, str.BAD_COMMAND
dec eax
je 0x401d81
mov edx, str.CRC_DATA_ERROR
dec eax
je 0x401d81
mov edx, str.BAD_COMMAND_LENGTH
dec eax
je 0x401d81
mov edx, str.SEEK_ERROR
dec eax
je 0x401d81
mov edx, str.NOT_A_DOS_FORMATTED_DISK
dec eax
je 0x401d81
mov edx, str.SECTOR_NOT_FOUND
dec eax
je 0x401d81
mov edx, str.WRITE_FAULT
sub eax, 2
je 0x401d81
mov edx, str.READ_FAULT
dec eax
je 0x401d81
mov edx, str.GENERAL_FAILURE
dec eax
je 0x401d81
mov edx, str.SHARING_VIOLATION
dec eax
je 0x401d81
mov edx, str.LOCK_VIOLATION
dec eax
je 0x401d81
mov edx, str.WRONG_DISK_IN_DRIVE__disk_change_was_invalid_
dec eax
je 0x401d81
mov edx, str.TOO_MANY_SHARED_FILES
sub eax, 2
je 0x401d81
mov edx, str.REACHED_EOF
sub eax, 2
je 0x401d81
mov edx, str.DISK_FULL
dec eax
je 0x401d81
mov edx, 0x468351
push ecx
push 0xffff
push edx
call fcn.00401000
push 0
push 0x468d58
push eax
push edx
push dword [0x468d68]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
call fcn.00402ccc
jmp 0x4165f0
Function at 0x401e33
Capabilities:
Write file on windows

Disassembly:
push eax
push ebx
push edi
pushfd
mov ebx, dword [0x4fd0aa]
cmp ebx, 0x200
jae 0x401e87
mov edi, dword [0x4fb09a]
mov dword [ebx*4 + 0x4fb0aa], edi
add ebx, 1
mov dword [0x4fd0aa], ebx
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
mov eax, 0xffff
sub eax, ecx
test eax, 1
je 0x401e75
add eax, 1
add eax, dword [0x4fb09a]
cmp eax, dword [0x4fd0ae]
jl 0x4020c9
popfd
push dword [0x468dd6]
mov eax, dword [0x469140]
mov dword [0x468dd6], eax
push ecx
push 0xffff
push str._r_nSTRING_MEMORY_OVERFLOW_r_n
call fcn.00401000
push 0
push 0x468d58
push eax
push str._r_nSTRING_MEMORY_OVERFLOW_r_n
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
push ecx
push 0xffff
push str.Total__of_defined_strings_
call fcn.00401000
push 0
push 0x468d58
push eax
push str.Total__of_defined_strings_
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
mov eax, dword [0x4fd0aa]
call fcn.00402aff
push ecx
push 0xffff
push str._r_nList_of_strings:_r_n
call fcn.00401000
push 0
push 0x468d58
push eax
push str._r_nList_of_strings:_r_n
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
sub ecx, ecx
push ecx
push ecx
push ecx
push ecx
push 0xffff
push 0x4683cf
call fcn.00401000
push 0
push 0x468d58
push eax
push 0x4683cf
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
pop eax
call fcn.00402aff
push ecx
push 0xffff
push str.__len
call fcn.00401000
push 0
push 0x468d58
push eax
push str.__len
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
pop ebx
mov edi, dword [ebx*4 + 0x4fb0aa]
push edi
push ebx
push edi
sub eax, eax
mov ecx, 0xffff
repne scasb al, byte es:[edi]
mov eax, 0xffff
sub eax, ecx
call fcn.00402aff
push ecx
push 0xffff
push str.__max
call fcn.00401000
push 0
push 0x468d58
push eax
push str.__max
push dword [0x469140]
call sub.KERNEL32.dll_WriteFile
pop ecx
mov eax, dword [0x468d58]
pop edi
pop ebx
add ebx, 1
mov eax, dword [ebx*4 + 0x4fb0aa]
sub eax, edi
call fcn.00402aff
push ecx
push 0xffff
push str.____
invalid

Function at 0x4021b3
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
mov ebx, dword [ebp + 8]
sub edx, edx
call sub.KERNEL32.dll_GetCommandLineA
mov esi, eax
cmp dword [0x468dda], 0
add byte [ebp + 5], dh

Function at 0x40260e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4690e4], 0
inc esi
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x5d030c5d], cl
adc byte [ebx + 0x3c601eb], al
add esi, eax
add eax, dword [eax]

Function at 0x402880
Capabilities:
Write file on windows

Disassembly:
mov ecx, 0x20
sub ebx, ebx
cmp dword [ebx*4 + 0x4fd0b2], 0
jne 0x402899
add ebx, 1
sub ecx, 1
jne 0x402887
test ecx, ecx
je 0x40290c
outsd dx, dword [esi]

Function at 0x402ccc
Capabilities:
Write file on windows

Disassembly:
push esi
push 0
push 0x468d58
push 2
push 0x468001
push dword [0x468dd6]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [0x468d58]
pop esi
ret
Function at 0x404c92
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x468d68]
mov dword [esi], eax
add esi, 4
mov eax, dword [ebp + 8]
mov ecx, 0x10
shl eax, cl
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
and eax, 0xffff
or dword [esi], eax
push dword [esi]
push dword [esi - 4]
call sub.KERNEL32.dll_SetConsoleCursorPosition
sub esi, 4
leave
ret 8

Function at 0x404cc6
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0x4e9744
push dword [0x468d68]
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
mov eax, dword [0x468d68]
mov dword [esi], eax
add esi, 4
movzx eax, word [0x4e974a]
mov ecx, 0x10
shl eax, cl
mov dword [esi], eax
mov eax, dword [ebp + 8]
and eax, 0xffff
or dword [esi], eax
push dword [esi]
push dword [esi - 4]
call sub.KERNEL32.dll_SetConsoleCursorPosition
sub esi, 4
leave
ret 4

Function at 0x404e88
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jle 0x404eda
mov eax, 8
mov dword [esi], eax
add esi, 4
push 0xffff
push str.GET_STRING_ARRAY_ELEMENT_BOUNDARY_OVERFLOW
push dword [0x4fb09a]
call fcn.00402d7b
sub esi, 4
mov dword [0x468dce], 0x528
push dword [0x4fb09a]
push dword [esi]
call fcn.00401de2
mov esi, 0x468de0
jmp 0x4165f0
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x404efb
test ecx, ecx
je 0x404efb
add ebx, eax
add ebx, 4
or ebx, 3
add ebx, 1
sub ecx, 1
jmp 0x404ee0
mov dword [ebp + 0x10], ebx
mov dword [ebp + 8], ecx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
cmp eax, 0xffffffff
jne 0x404f34
mov eax, 0
mov dword [0x4690e0], eax
push 0xffff
push dword [0x4e968c]
push dword [0x4fb09a]
call fcn.00402d7b
mov eax, dword [0x4fb09a]
leave
ret 0xc
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [0x4690e0], eax
leave
ret 0xc

Function at 0x40724e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x810
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
mov eax, 1
mov dword [0x4692e8], eax
Function at 0x409299
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push 0x1428
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
add eax, 0x408
add al, 0
add byte [ecx + 0x805e845], cl
call 0x449ac2
add byte [ecx + 0x805e445], cl
add al, 0
add byte [ecx + 0x805e045], cl
add al, 0
add byte [ecx + 0x805dc45], cl
add al, 0
invalid
mov ebx, dword [0x4e96c0]
movzx eax, byte [ebx]
sub edx, edx
mov ecx, 0x20
cmp ecx, eax
je 0x4092f1
mov ecx, 9
cmp ecx, eax
jne 0x4092fa
call fcn.00408fa3
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
push 0xffff
push dword [0x4fb09a]
call fcn.00402f8e
push 0x404
push dword [0x4fb09a]
push dword [0x4e96c4]
call fcn.00402d7b
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x14]
call fcn.00402d7b
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
push 2
push 0xffff
push 0x45b714
push dword [0x4fb09a]
call fcn.00403008
jne 0x4093bb
push 0xffff
push dword [0x4e9690]
push dword [0x4fb09a]
call fcn.00402d7b
mov eax, dword [0x469158]
mov dword [esi], eax
mov eax, 1
add dword [esi], eax
mov dword [esi + 4], 1
push 0xffff
push dword [esi + 4]
push dword [esi]
push dword [0x4fb09a]
push dword [ebp - 0x14]
call fcn.00402ee1
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
sub edx, edx
push 2
push 0xffff
push 0x45b716
push dword [0x4fb09a]
call fcn.00403008
jne 0x4093ef
or edx, 1
mov dword [esi], edx
add esi, 4
push 0xffff
push dword [ebp - 0x14]
push dword [0x4fb09a]
call fcn.00402d7b
sub edx, edx
push 2
push 0xffff
push 0x45b718
push dword [0x4fb09a]
call fcn.00403008
jne 0x409425
sub esi, 4
and dword [esi], edx
je 0x409459
call fcn.00408fa3
push 0x404
push 0x45b71a
push dword [0x4e96c0]
call fcn.00402d7b
push 0x404
push dword [0x4e968c]
push dword [ebp - 0x14]
call fcn.00402d7b
push 0x104
push dword [0x4e968c]
dec esi
add bh, bh
xor eax, 0x4e96bc
call fcn.00402d7b
mov ebx, dword [0x4e96c0]
movzx eax, byte [ebx]
sub edx, edx
mov ecx, 0x30
cmp eax, ecx
jl 0x409497
mov ecx, 0x39
cmp eax, ecx
jg 0x409490
sub ecx, ecx
jmp 0x409495
mov ecx, 1
test ecx, ecx
je 0x409499
jne 0x40949e
or edx, 1
mov dword [esi], edx
add esi, 4
push 0xffff
push dword [0x4e96c0]
push dword [0x4fb09a]
call fcn.00402d7b
mov ebx, dword [0x4fb09a]
movzx eax, byte [ebx]
mov dword [esi], eax
mov eax, 0x2e
sub edx, edx
cmp dword [esi], eax
jne 0x4094d2
or edx, 1
mov dword [esi], edx
add esi, 4
push 0xffff
push dword [ebp - 0x14]
push dword [0x4fb09a]
call fcn.00402d7b
mov ebx, dword [0x4fb09a]
movzx eax, byte [ebx]
sub edx, edx
mov ecx, 0x30
cmp eax, ecx
jl 0x409512
mov ecx, 0x39
cmp eax, ecx
jg 0x40950b
sub ecx, ecx
jmp 0x409510
mov ecx, 1
test ecx, ecx
je 0x409514
jne 0x409519
or edx, 1
sub esi, 4
mov eax, dword [esi]
and eax, edx
sub esi, 4
or dword [esi], eax
je 0x409971
push 0x404
push 0x45b71d
invalid

Function at 0x40c664
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0xffff
push dword [0x4e9694]
push dword [0x4fb09a]
dec edi
add al, ch
sti
invalid
invalid
invalid
call fcn.00401e33
push 0xffff
push 0x45ba42
Function at 0x410248
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push 0x1428
push 0x40
inc eax

Function at 0x411799
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
mov edi, 0x468de0
mov ecx, 0x4fd5d0
sub ecx, edi
sub ecx, 4
shr ecx, 2
sub eax, eax
sal bl, 0xab
push 0x20000
push 0
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x468800], eax
test eax, eax
jne 0x4117e3
call fcn.00459936
invalid
pushal
invalid

Function at 0x417ca5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push 0x1020
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
add eax, 0x408
mov dword [ebp - 8], eax
add eax, 0x408
mov dword [ebp - 0xc], eax
add eax, 0x408
mov dword [ebp - 0x10], eax
add eax, 0x408
add al, ch
push esp
mov eax, dword [0x6c7fffe]
and byte [esi], cl
add byte [eax + 0x4ae], bh
mov dword [0x468dce], 0x4b1
jmp fcn.00401db5
mov eax, dword [esi]
mov ecx, 0x48
mul ecx
add eax, 0x4e975a
mov dword [esi], eax
mov eax, 3
mov edi, dword [esi]
mov dword [edi + 0x10], eax
push 0x404
push dword [0x4e9698]
push dword [ebp - 4]
call fcn.00402d7b
mov eax, 3
mov dword [0x4692b8], eax
sub edx, edx
mov ebx, dword [0x4e96f4]
cmp byte [ebx], 0
je 0x417f4c
mov eax, dword [0x4692b8]
cmp eax, 3
je 0x417ec7
call fcn.00401e33
mov dword [esi], 0x4e20
mov eax, 0x4b4
add dword [esi], eax
push dword [esi]
push 0xffff
push str.still_inside_dialog_
push dword [0x4fb09a]
call fcn.00402d7b
push 0xffff
push dword [0x4e96f4]
push dword [0x4fb09a]
call fcn.00402db3
push 0xffff
push 0x45dc95
push dword [0x4fb09a]
call fcn.00402db3
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d55f
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
add al, ch
adc dword [edx - 0x7a160002], esp
add byte [eax], al
invalid
call fcn.00401e33
mov dword [esi], 0x4e20
mov eax, 0x4b5
add dword [esi], eax
push dword [esi]
push 0xffff
push str.still_inside_window_
push dword [0x4fb09a]
call fcn.00402d7b
push 0xffff
push dword [0x4e96f4]
push dword [0x4fb09a]
call fcn.00402db3
push 0xffff
push str.___nesting_not_allowed
push dword [0x4fb09a]
call fcn.00402db3
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.0042d55f
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
call fcn.004020d3
call fcn.00401e33
push 0xffff
push dword [ebp - 4]
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]

Function at 0x420d88
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
call fcn.00401e33
mov eax, dword [ebp + 8]
push eax
push 0xffff
push 0x46003f
push dword [0x4fb09a]
call fcn.00402d7b
mov ecx, dword [0x4fb09a]
mov dword [esi], ecx
add esi, 4
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
push 0xffff
push dword [0x4e968c]
push dword [0x4fb09a]
call fcn.00402d7b
push dword [0x4fb09a]
add eax, 0x1000
add dword [0x4fb09a], eax
call fcn.00406216
sub esi, 4
mov ecx, dword [esi]
mov dword [0x4fb09a], ecx
invalid
rcl byte [edx], cl