joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4027a2
Capabilities:
Set current directory

Disassembly:
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x12c
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x40194f
call fcn.004029d4
push dword [0x401743]
call 0x402818
dec esi
jne 0x402874
bound esp, qword [ebp + 0x72]
and byte [edi + 0x66], ch
and byte [esi + 0x69], ah
insb byte es:[edi], dx
jae 0x40284e
and byte [0x958d0064], ah
in al, dx
std
invalid
pop ss
inc eax
add byte [edx], ch
push 0x406
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
xor edx, edx
mov eax, 0x60
mul dword [0x401743]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [0x401076], eax
push 0x12c
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
call 0x4028a9
inc esi
imul ebp, dword [ebp + 0x20], 0x7473696c
cmp al, byte [eax]
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x40169f], eax
mov dword [0x4016a3], 0xffff0003
mov dword [0x40106e], 0
xor edx, edx
mov eax, dword [0x401743]
mov ecx, 0x5c
mul ecx
add eax, 0x104
mov dword [0x4014ed], eax
push dword [0x40169f]
push 0x40194f
call fcn.00402aba
call 0x402923
inc ebx
cmp bl, byte [eax + eax - 1]
adc eax, sym.imp.KERNEL32.DLL_SetCurrentDirectoryA
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x40169f], 0
mov dword [0x4016a3], 0xffff0000
call 0x40295d
inc esp
outsd dx, dword [esi]
outsb dx, byte [esi]
and dword gs:[eax], eax
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
leave
ret
Function at 0x402818
Capabilities:
Set current directory

Disassembly:
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x12c
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x40194f
call fcn.004029d4
push dword [0x401743]
call 0x402818
dec esi
jne 0x402874
bound esp, qword [ebp + 0x72]
and byte [edi + 0x66], ch
and byte [esi + 0x69], ah
insb byte es:[edi], dx
jae 0x40284e
and byte [0x958d0064], ah
in al, dx
std
invalid
pop ss
inc eax
add byte [edx], ch
push 0x406
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
xor edx, edx
mov eax, 0x60
mul dword [0x401743]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [0x401076], eax
push 0x12c
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
call 0x4028a9
inc esi
imul ebp, dword [ebp + 0x20], 0x7473696c
cmp al, byte [eax]
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x40169f], eax
mov dword [0x4016a3], 0xffff0003
mov dword [0x40106e], 0
xor edx, edx
mov eax, dword [0x401743]
mov ecx, 0x5c
mul ecx
add eax, 0x104
mov dword [0x4014ed], eax
push dword [0x40169f]
push 0x40194f
call fcn.00402aba
call 0x402923
inc ebx
cmp bl, byte [eax + eax - 1]
adc eax, sym.imp.KERNEL32.DLL_SetCurrentDirectoryA
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x40169f], 0
mov dword [0x4016a3], 0xffff0000
call 0x40295d
inc esp
outsd dx, dword [esi]
outsb dx, byte [esi]
and dword gs:[eax], eax
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
leave
ret
Function at 0x4028a9
Capabilities:
Set current directory

Disassembly:
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x12c
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x40194f
call fcn.004029d4
push dword [0x401743]
call 0x402818
dec esi
jne 0x402874
bound esp, qword [ebp + 0x72]
and byte [edi + 0x66], ch
and byte [esi + 0x69], ah
insb byte es:[edi], dx
jae 0x40284e
and byte [0x958d0064], ah
in al, dx
std
invalid
pop ss
inc eax
add byte [edx], ch
push 0x406
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
xor edx, edx
mov eax, 0x60
mul dword [0x401743]
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [0x401076], eax
push 0x12c
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
call 0x4028a9
inc esi
imul ebp, dword [ebp + 0x20], 0x7473696c
cmp al, byte [eax]
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x40169f], eax
mov dword [0x4016a3], 0xffff0003
mov dword [0x40106e], 0
xor edx, edx
mov eax, dword [0x401743]
mov ecx, 0x5c
mul ecx
add eax, 0x104
mov dword [0x4014ed], eax
push dword [0x40169f]
push 0x40194f
call fcn.00402aba
call 0x402923
inc ebx
cmp bl, byte [eax + eax - 1]
adc eax, sym.imp.KERNEL32.DLL_SetCurrentDirectoryA
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
mov dword [0x40169f], 0
mov dword [0x4016a3], 0xffff0000
call 0x40295d
inc esp
outsd dx, dword [esi]
outsb dx, byte [esi]
and dword gs:[eax], eax
lea edx, [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x214]
mov dword [0x4016b7], eax
push 0x40169f
push 0
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
leave
ret
Function at 0x4029d4
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
call 0x4029ea
and eax, 0x2a5c73
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
push 0x4014f5
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x20c], eax
call 0x402a19
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402a62
inc eax
add byte [ebx + 0x40106e], ah
call 0x402a31
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402a7a
inc eax
add byte [ebp - 0x7caf8b40], al
cmp eax, 0x40106e
add byte [edi + eax*2 - 0x7d], dh
and eax, 0x4014f5
adc byte [ebx + 0x4014f53d], al
add byte [eax], al
je 0x402a8a
push 0x401521
push dword [ebp + 8]
call 0x402a6c
and eax, 0x73255c73
push es
add byte [eax], al
add byte [0x73255c73], ah
add byte [ebp - 0x2076b], cl
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
add esp, 0x10
les edx, [eax]
lea edx, [ebp - 0x208]
push edx
call fcn.004029d4
jmp 0x402a90
inc dword [0x401743]
push 0x4014f5
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 0
jne 0x402a12
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.DLL_FindClose]
leave
ret 4

Function at 0x4029ea
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
call 0x4029ea
and eax, 0x2a5c73
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
push 0x4014f5
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x20c], eax
call 0x402a19
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402a62
inc eax
add byte [ebx + 0x40106e], ah
call 0x402a31
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402a7a
inc eax
add byte [ebp - 0x7caf8b40], al
cmp eax, 0x40106e
add byte [edi + eax*2 - 0x7d], dh
and eax, 0x4014f5
adc byte [ebx + 0x4014f53d], al
add byte [eax], al
je 0x402a8a
push 0x401521
push dword [ebp + 8]
call 0x402a6c
and eax, 0x73255c73
push es
add byte [eax], al
add byte [0x73255c73], ah
add byte [ebp - 0x2076b], cl
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
add esp, 0x10
les edx, [eax]
lea edx, [ebp - 0x208]
push edx
call fcn.004029d4
jmp 0x402a90
inc dword [0x401743]
push 0x4014f5
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 0
jne 0x402a12
push dword [ebp - 0x20c]
call dword [sym.imp.KERNEL32.DLL_FindClose]
leave
ret 4
Function at 0x402aba
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push dword [ebp + 0xc]
pop dword [0x40169f]
push dword [ebp + 8]
call 0x402ad9
and eax, 0x2a5c73
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
push 0x4014f5
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x414], eax
call 0x402b08
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402b51
inc eax
add byte [ecx + 0x3e8c3], cl
add byte [eax], al
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402b66
inc eax
add byte [ebp + 0x77840fc0], al
add dword [eax], eax
add byte [ebp + 0x6f840fdb], al
add dword [eax], eax
add byte [eax + 0x21], ch
adc eax, 0x75ff0040
or al, ch
push es
add byte [eax], al
add byte [0x73255c73], ah
add byte [ebp - 0x40f6b], cl
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
mov dword [0x4016b7], 0x401521
push 0x40169f
push 0
lahf
push ss
inc eax
add byte [edx], ch
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
and dword [0x4014f5], 0x10
cmp dword [0x4014f5], 0
je 0x402ba8
push eax
lea edx, [ebp - 0x410]
push edx
call fcn.00402aba
push dword [ebp + 0xc]
pop dword [0x40169f]
jmp 0x402ca7
mov dword [0x40172b], eax
push dword [0x4014ed]
pop dword [0x401723]
xor edx, edx
mov eax, dword [0x401511]
mov ecx, 0xffffffff
mul ecx
add eax, dword [0x401511]
add eax, dword [0x401515]
mov dword [0x401727], eax
add dword [0x4014ed], eax
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edx, dword [ebp + eax - 0x414]
xor eax, eax
cmp edx, 0x67706a2e
jne 0x402c03
mov eax, 1
jmp 0x402c26
cmp edx, 0x6167742e
jne 0x402c12
mov eax, 2
jmp 0x402c26
cmp edx, 0x67676f2e
jne 0x402c21
mov eax, 3
jmp 0x402c26
mov eax, 0
mov dword [0x40171f], eax
push 0x50
push 0x4016cf
call dword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
lea edx, [ebp - 0x208]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [ebp + eax - 0x40f]
push edx
push 0x4016cf
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor edx, edx
mov eax, 0x60
mul dword [0x40106e]
mov edx, dword [0x401076]
add edx, eax
push 0x60
push edx
push 0x4016cf
call fcn.00403d7e
inc dword [0x40106e]
push 0
push 0
push 0x405
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x4014f5
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 0
jne 0x402b01
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.DLL_FindClose]
leave
ret 8
Function at 0x402ad9
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push dword [ebp + 0xc]
pop dword [0x40169f]
push dword [ebp + 8]
call 0x402ad9
and eax, 0x2a5c73
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
push 0x4014f5
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x414], eax
call 0x402b08
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402b51
inc eax
add byte [ecx + 0x3e8c3], cl
add byte [eax], al
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402b66
inc eax
add byte [ebp + 0x77840fc0], al
add dword [eax], eax
add byte [ebp + 0x6f840fdb], al
add dword [eax], eax
add byte [eax + 0x21], ch
adc eax, 0x75ff0040
or al, ch
push es
add byte [eax], al
add byte [0x73255c73], ah
add byte [ebp - 0x40f6b], cl
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
mov dword [0x4016b7], 0x401521
push 0x40169f
push 0
lahf
push ss
inc eax
add byte [edx], ch
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
and dword [0x4014f5], 0x10
cmp dword [0x4014f5], 0
je 0x402ba8
push eax
lea edx, [ebp - 0x410]
push edx
call fcn.00402aba
push dword [ebp + 0xc]
pop dword [0x40169f]
jmp 0x402ca7
mov dword [0x40172b], eax
push dword [0x4014ed]
pop dword [0x401723]
xor edx, edx
mov eax, dword [0x401511]
mov ecx, 0xffffffff
mul ecx
add eax, dword [0x401511]
add eax, dword [0x401515]
mov dword [0x401727], eax
add dword [0x4014ed], eax
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edx, dword [ebp + eax - 0x414]
xor eax, eax
cmp edx, 0x67706a2e
jne 0x402c03
mov eax, 1
jmp 0x402c26
cmp edx, 0x6167742e
jne 0x402c12
mov eax, 2
jmp 0x402c26
cmp edx, 0x67676f2e
jne 0x402c21
mov eax, 3
jmp 0x402c26
mov eax, 0
mov dword [0x40171f], eax
push 0x50
push 0x4016cf
call dword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
lea edx, [ebp - 0x208]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [ebp + eax - 0x40f]
push edx
push 0x4016cf
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor edx, edx
mov eax, 0x60
mul dword [0x40106e]
mov edx, dword [0x401076]
add edx, eax
push 0x60
push edx
push 0x4016cf
call fcn.00403d7e
inc dword [0x40106e]
push 0
push 0
push 0x405
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x4014f5
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 0
jne 0x402b01
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.DLL_FindClose]
leave
ret 8
Function at 0x402b4b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push dword [ebp + 0xc]
pop dword [0x40169f]
push dword [ebp + 8]
call 0x402ad9
and eax, 0x2a5c73
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
push 0x4014f5
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov dword [ebp - 0x414], eax
call 0x402b08
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402b51
inc eax
add byte [ecx + 0x3e8c3], cl
add byte [eax], al
add byte cs:[eax + 0x21], ch
adc eax, 0x15ff0040
jle 0x402b66
inc eax
add byte [ebp + 0x77840fc0], al
add dword [eax], eax
add byte [ebp + 0x6f840fdb], al
add dword [eax], eax
add byte [eax + 0x21], ch
adc eax, 0x75ff0040
or al, ch
push es
add byte [eax], al
add byte [0x73255c73], ah
add byte [ebp - 0x40f6b], cl
call dword [edx - 1]
adc eax, sym.imp.USER32.DLL_wsprintfA
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x10
mov dword [0x4016b7], 0x401521
push 0x40169f
push 0
lahf
push ss
inc eax
add byte [edx], ch
push 0x1100
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
and dword [0x4014f5], 0x10
cmp dword [0x4014f5], 0
je 0x402ba8
push eax
lea edx, [ebp - 0x410]
push edx
call fcn.00402aba
push dword [ebp + 0xc]
pop dword [0x40169f]
jmp 0x402ca7
mov dword [0x40172b], eax
push dword [0x4014ed]
pop dword [0x401723]
xor edx, edx
mov eax, dword [0x401511]
mov ecx, 0xffffffff
mul ecx
add eax, dword [0x401511]
add eax, dword [0x401515]
mov dword [0x401727], eax
add dword [0x4014ed], eax
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov edx, dword [ebp + eax - 0x414]
xor eax, eax
cmp edx, 0x67706a2e
jne 0x402c03
mov eax, 1
jmp 0x402c26
cmp edx, 0x6167742e
jne 0x402c12
mov eax, 2
jmp 0x402c26
cmp edx, 0x67676f2e
jne 0x402c21
mov eax, 3
jmp 0x402c26
mov eax, 0
mov dword [0x40171f], eax
push 0x50
push 0x4016cf
call dword [sym.imp.KERNEL32.DLL_RtlZeroMemory]
lea edx, [ebp - 0x208]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea edx, [ebp + eax - 0x40f]
push edx
push 0x4016cf
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
xor edx, edx
mov eax, 0x60
mul dword [0x40106e]
mov edx, dword [0x401076]
add edx, eax
push 0x60
push edx
push 0x4016cf
call fcn.00403d7e
inc dword [0x40106e]
push 0
push 0
push 0x405
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
push 0x4014f5
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
cmp eax, 0
jne 0x402b01
push dword [ebp - 0x414]
call dword [sym.imp.KERNEL32.DLL_FindClose]
leave
ret 8
Function at 0x403c1b
Capabilities:
Get common file path
Read file on windows
Set current directory
Write file on windows

Disassembly:
xor edx, edx
mov eax, 0x60
mul dword [ebp - 0xc70]
mov edx, dword [0x401076]
add edx, eax
lea eax, [ebp - 0x464]
push 0x60
push eax
push edx
call fcn.00403d7e
lea edx, [ebp - 0x464]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
xor ecx, ecx
cmp ecx, eax
jae 0x403c02
mov dl, byte [ebp + ecx - 0x464]
inc ecx
cmp dl, 0x5c
jne 0x403c00
mov edx, ecx
push eax
push ecx
push edx
lea edx, [ebp - 0x464]
push edx
lea edx, [ebp - 0xc6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
lea edx, [ebp - 0x86c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
call fcn.00403bce
pop esp
add byte [ebp - 0x86b6b], cl
lea edx, [ebp - 0x86c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0x86c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [ebp - 0xc6c]
push edx
lea edx, [ebp - 0x86c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
lea edx, [ebp - 0x86c]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
pop ecx
pop eax
jmp 0x403b8b
lea edx, [ebp - 0xc6c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
call 0x403c1b
pop esp
add byte [ebp - 0xc6b6b], cl
call dword [edx - 1]
adc eax, sym.imp.KERNEL32.DLL_lstrcatA
lea edx, [ebp - 0x464]
push edx
lea edx, [ebp - 0xc6c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0xc0000000
lea edx, [ebp - 0xc6c]
push edx
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [ebp - 0xc74], eax
push 0
push 0
push dword [ebp - 0x410]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push dword [ebp - 0x40c]
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x46c], eax
push 0
push 0x40106e
push dword [ebp - 0x40c]
push dword [ebp - 0x46c]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0
push 0x40106e
push dword [ebp - 0x40c]
push dword [ebp - 0x46c]
push dword [ebp - 0xc74]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
push dword [ebp - 0xc74]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0
push 0
push 0x405
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
inc dword [ebp - 0xc70]
mov ecx, dword [ebp - 0xc70]
cmp ecx, dword [0x401743]
jne 0x403b58
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call 0x403d1a
inc ebx
cmp bl, byte [eax + eax - 1]
adc eax, sym.imp.KERNEL32.DLL_SetCurrentDirectoryA
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x67
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0
push 0
push 0x402
push dword [0x401066]
call dword [sym.imp.USER32.DLL_SendMessageA]
leave
ret 4
Function at 0x403d99
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov dword [ebp - 0x38], 0x656c6946
mov dword [ebp - 0x34], 0x7325203a
mov byte [ebp - 0x30], 0xa
mov dword [ebp - 0x2f], 0x656c6966
mov dword [ebp - 0x2b], 0x70797420
mov dword [ebp - 0x27], 0x25203a65
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], 0xa
mov dword [ebp - 0x21], 0x656c6966
mov dword [ebp - 0x1d], 0x66666f20
mov dword [ebp - 0x19], 0x3a746573
mov word [ebp - 0x15], 0x2520
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0xa
mov dword [ebp - 0x11], 0x657a6973
mov dword [ebp - 0xd], 0x6425203a
mov dword [ebp - 9], 0x74796220
mov word [ebp - 5], 0x7365
mov byte [ebp - 3], 0
cmp dword [0x401743], 0
jne 0x403e20
leave
ret 8
movzx eax, word [ebp + 0xc]
cmp eax, 0x12c
jne 0x403f14
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0xfffffe63
jne 0x403f14
mov ebx, dword [eax + 0x14]
mov dword [ebp - 0x830], ebx
lea eax, [ebp - 0x80c]
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x820], 0xfa
mov dword [ebp - 0x834], 0x51
lea edx, [ebp - 0x834]
push edx
push 0
push 0x110c
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
cmp dword [ebp - 0x814], 0
jne 0x403f14
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
xor edx, edx
mov eax, 0x60
mul dword [ebp - 0x3c]
mov edx, dword [0x401076]
add edx, eax
push 0x60
push 0x4016cf
push edx
call fcn.00403d7e
mov eax, dword [ebp - 0x830]
cmp eax, dword [0x40172b]
jne 0x403f06
xor eax, eax
mov ax, word [0x40171f]
push dword [0x401727]
push dword [0x401723]
push eax
push 0x4016cf
lea edx, [ebp - 0x38]
push edx
lea edx, [ebp - 0x80c]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x18
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x80c]
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 0xff
leave
ret 8
inc dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [0x401743]
jne 0x403e94
leave
ret 8