joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cf69
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0x218], 0
mov word [ebp - 0x210], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x214], 0x104
mov dword [ebp - 4], str.SoftwareMicrosoftInternet_ExplorerMain
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d023
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push str.Start_Page
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41d016
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00435395
add esp, 8
test eax, eax
jne 0x41d016
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x218]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x41d96f
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xfe0c
call fcn.00434c10
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], 0
push 0x7ef4
push 0
lea eax, [ebp - 0xfe04]
push eax
call fcn.00434640
add esp, 0xc
push 0
push 0
push 0
push 0
push str.Testing
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x41d9d2
mov eax, dword [ebp - 0xc]
jmp 0x41db15
push 0
push 0x80000000
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0xfe0c], eax
cmp dword [ebp - 0xfe0c], 0
jne 0x41da09
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x41db12
mov dword [ebp - 0xc], 1
mov ecx, 1
test ecx, ecx
je 0x41daeb
lea edx, [ebp - 0x14]
push edx
push 0x7ef4
lea eax, [ebp - 0xfe04]
push eax
mov ecx, dword [ebp - 0xfe0c]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0xfe08], eax
cmp dword [ebp - 0x14], 0
jne 0x41da4b
jmp 0x41daeb
cmp dword [ebp - 4], 0
je 0x41da99
mov dword [ebp - 4], 0
push 0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x41da99
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
jmp 0x41daeb
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x14]
push edx
lea eax, [ebp - 0xfe04]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41dad0
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], 0
jmp 0x41daeb
push 0x7ef4
push 0
lea eax, [ebp - 0xfe04]
push eax
call fcn.00434640
add esp, 0xc
jmp 0x41da10
cmp dword [ebp - 4], 0
jne 0x41dafb
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xfe0c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x41e030
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
push 0
push 0
push 0x41e022
push 0
push 0
call fcn.00435438
add esp, 0x18
mov dword [ebp - 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x41e302
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41e362
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x41e35c
mov dword [ebp - 4], 0
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 1
mov edx, dword [ebp - 4]
push edx
call fcn.0042d529
add esp, 8
mov dword [0x4567b8], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret

Function at 0x41ed4e
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x41ee50
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
test ecx, ecx
je 0x41ee50
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41eddd
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [ebp + 8]
push edx
call fcn.004346e7
add esp, 4
add eax, 1
imul eax, dword [0x456c50]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004346c2
add esp, 8
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push ecx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x41ee50
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41ee50
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov edx, dword [ebp + 8]
push edx
call fcn.004346e7
add esp, 4
add eax, 1
imul eax, dword [0x456c50]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.004346c2
add esp, 8
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0xc]
push ecx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esp, ebp
pop ebp
ret
Function at 0x41ee54
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41eebb
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x41eeb3
mov dword [ebp - 4], 0
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
push 0x2710
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [0x44d1e8]
push edx
call fcn.00434f1e
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x41eec8
push 0x4462cc
call fcn.0042f9e8
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x428810
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
mov dword [ebp - 8], 1
jmp 0x42882f
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x14
jge 0x42892b
mov ecx, dword [ebp - 8]
push ecx
call fcn.004124f0
add esp, 4
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add edx, dword [0x4566fc]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4566fc]
mov ecx, dword [eax]
add ecx, dword [0x4566fc]
push ecx
call fcn.00435395
add esp, 8
test eax, eax
jne 0x428926
mov edx, dword [0x44dbc8]
mov eax, dword [ebp - 8]
mov dword [edx + 0xac], eax
mov ecx, dword [0x44dbc8]
mov edx, dword [ecx + 0xac]
push edx
call fcn.0041481f
add esp, 4
mov eax, dword [0x44dbc8]
mov word [eax + 0x178], 0
mov ecx, dword [0x44d5cc]
add ecx, dword [0x4566fc]
mov word [ecx + 0x3acc], 0
call fcn.004321c3
mov dword [0x44d604], 1
call fcn.00413ece
call fcn.00431935
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42890d
push 0
call fcn.00431935
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00431935
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call fcn.004333c5
add esp, 4
call fcn.00430707
call fcn.00430874
mov edx, dword [ebp - 4]
add edx, dword [0x4566fc]
push edx
call fcn.0042f9e8
add esp, 4
call fcn.00414230
jmp 0x42892b
jmp 0x428826
mov esp, ebp
pop ebp
ret
Function at 0x42f13c
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x104
push 0x104
push 0x4562e8
mov eax, dword [0x456eb8]
push eax
call fcn.0042f0dc
add esp, 0xc
push 0x104
push 0x4560e0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4560e0
call fcn.004346e7
add esp, 4
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx*2 + 0x4560e0]
cmp edx, 0x5c
je 0x42f1a3
mov eax, dword [ebp - 4]
mov word [eax*2 + 0x4560e2], 0x5c
lea ecx, [ebp - 0xc]
push ecx
push 0x20019
push 0
push str.Softwareplsbhg
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42f200
lea edx, [ebp - 8]
push edx
push 0x4564f0
push 0
push 0
push str.path
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x42f1f4
push 0x449790
push 0x4564f0
call fcn.004346c2
add esp, 8
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42f212
push str.D:Program_Filespanluosen_bhg_
push 0x4564f0
call fcn.004346c2
add esp, 8
push 0x4564f0
call fcn.004346e7
add esp, 4
sub eax, 1
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
xor eax, eax
mov ax, word [edx*2 + 0x4564f0]
cmp eax, 0x5c
je 0x42f244
mov ecx, dword [ebp - 4]
mov word [ecx*2 + 0x4564f2], 0x5c
mov esp, ebp
pop ebp
ret

Function at 0x4302b9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x456c18], 0
je 0x4302c7
jmp 0x4302ef
mov dword [0x456c18], 1
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [0x456c18], 0
pop ebp
ret

Function at 0x430707
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430736
push 0
mov ecx, dword [0x456fd0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x456fd0]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call fcn.004302f1
push eax
push 0
call fcn.004060c0
push eax
mov eax, dword [0x44d5cc]
add eax, dword [0x4566fc]
mov ecx, dword [eax + 0x3a88]
shl ecx, 2
push ecx
mov edx, dword [0x457040]
push edx
push 0
push 0
push 0x88000000
push 0
push str.PYCAND
push 0x100
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x456fd0], eax
mov eax, dword [0x44d5cc]
add eax, dword [0x4566fc]
mov ecx, dword [eax + 0x3a88]
shl ecx, 2
push ecx
mov edx, dword [0x457040]
push edx
call fcn.00432082
add esp, 8
cmp dword [0x457004], 0
jne 0x4307bf
push 4
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x430812
mov ecx, dword [0x44d5cc]
add ecx, dword [0x4566fc]
mov edx, dword [ecx + 0x3ab8]
cmp edx, dword [0x4567a4]
je 0x4307f2
cmp dword [0x457008], 0
jne 0x4307f2
push 4
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x430812
mov ecx, dword [0x456fd0]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430812
push 0
mov edx, dword [0x456fd0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x430874
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x457004], 0
jne 0x430889
cmp dword [0x456bdc], 0
jne 0x4308d5
mov eax, dword [0x44d5cc]
add eax, dword [0x4566fc]
mov ecx, dword [eax + 0x3ab8]
cmp ecx, dword [0x4567a4]
je 0x4308b4
cmp dword [0x457008], 0
jne 0x4308b4
cmp dword [0x456bdc], 0
jne 0x4308d5
mov edx, dword [0x456fd0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4308d3
push 0
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4308f0
mov ecx, dword [0x456fd0]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4308eb
call fcn.00430707
call fcn.004308f2
pop ebp
ret
Function at 0x4331f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov eax, dword [0x44d5cc]
add eax, dword [0x4566fc]
mov ecx, dword [eax + 0x3a88]
imul ecx, ecx, 3
mov dword [ebp - 0xc], ecx
mov edx, dword [0x457040]
mov dword [ebp - 8], edx
mov eax, dword [0x44d5cc]
add eax, dword [0x4566fc]
mov ecx, dword [eax + 0x3a88]
shl ecx, 2
mov dword [ebp - 4], ecx
cmp dword [0x456bdc], 0
je 0x43329a
cmp dword [0x457004], 0
jne 0x433262
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x433298
mov ecx, dword [0x44d5cc]
add ecx, dword [0x4566fc]
mov edx, dword [ecx + 0x3ab8]
cmp edx, dword [0x4567a4]
je 0x433298
cmp dword [0x457008], 0
jne 0x433298
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x456fd0]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4332b9
mov edx, dword [0x456fd0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4332b9
push 0
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret

Function at 0x43357c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x456bdc], 0
je 0x43361c
cmp dword [0x457004], 0
jne 0x4335b6
push 0
push 0
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
push 4
mov ecx, dword [0x456fd0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43361a
mov edx, dword [0x44d5cc]
add edx, dword [0x4566fc]
mov eax, dword [edx + 0x3ab8]
cmp eax, dword [0x4567a4]
je 0x4335fb
cmp dword [0x457008], 0
jne 0x4335fb
push 0
push 0
mov ecx, dword [0x456fd0]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 4
mov edx, dword [0x456fd0]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43361a
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43361a
push 0
mov ecx, dword [0x456fd0]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43363b
mov edx, dword [0x456fd0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43363b
push 0
mov eax, dword [0x456fd0]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x43363d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x44d5cc]
add eax, dword [0x4566fc]
mov ecx, dword [eax + 0x3ab8]
cmp ecx, dword [0x4567a4]
je 0x4336b4
cmp dword [0x457008], 0
je 0x433696
mov dword [0x457004], 0
mov dword [0x457008], 0
call fcn.00431935
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x433694
push 0
call fcn.00431935
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4336af
mov dword [0x457004], 1
mov dword [0x457008], 1
call fcn.00430874
jmp 0x43373b
cmp dword [0x456bf8], 0
je 0x4336cc
push 0x449b04
call fcn.0042f9e8
add esp, 4
jmp 0x4336d9
push 0x449b18
call fcn.0042f9e8
add esp, 4
push 1
push 0
call fcn.00432470
add esp, 8
cmp dword [0x457004], 0
je 0x433709
mov dword [0x457004], 0
mov dword [0x457008], 0
call fcn.00430874
jmp 0x43373b
mov dword [0x457004], 1
mov dword [0x457008], 0
call fcn.00431935
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43373b
push 0
call fcn.00431935
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret
Function at 0x433d6c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
push esi
push edi
mov eax, dword [0x457264]
mov dword [ebp - 0x4b4], eax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x4b0]
rep stosd dword es:[edi], eax
mov ecx, dword [0x457268]
mov dword [ebp - 0x254], ecx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x250]
rep stosd dword es:[edi], eax
mov ecx, 0x16
mov esi, 0x449b2c
lea edi, [ebp - 0x2ac]
rep movsd dword es:[edi], dword [esi]
cmp dword [0x456c14], 0
je 0x433dcc
jmp 0x433f9d
mov dword [0x456c14], 1
mov dword [ebp - 0x4c], 0x4c
mov edx, dword [ebp + 8]
mov dword [ebp - 0x48], edx
lea eax, [ebp - 0x2ac]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x4b4]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], 0x208
lea edx, [ebp - 0x254]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0x208
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x449b84
mov dword [ebp - 0x18], 0x1804
mov word [ebp - 0x14], 0
mov word [ebp - 0x12], 0
mov dword [ebp - 0x10], 0x449b98
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x4c]
push eax
call sub.comdlg32.dll_GetOpenFileNameW
test eax, eax
je 0x433f87
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0xffffffff
jne 0x433ead
push 0x30
push 0
push 0x449ba0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
mov eax, dword [ebp - 0x4c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x4b8], eax
cmp dword [ebp - 0x4b8], 0xffffffff
jne 0x433ede
push 0x30
push 0
push 0x449bb0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [0x44d1ec]
mov dword [ebp - 0x4bc], edx
cmp dword [ebp - 0x4bc], 0
jne 0x433f06
push 0x30
push 0
push 0x449bc4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
lea ecx, [ebp - 0x4c4]
push ecx
mov edx, dword [ebp - 0x4b8]
push edx
mov eax, dword [ebp - 0x4bc]
push eax
mov ecx, dword [ebp - 0x4c0]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x4c4], 0
je 0x433f58
mov edx, dword [ebp - 0x4bc]
push edx
push 0
push 0xc
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x433f6b
push 0x30
push 0
push 0x449bd4
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0x4c0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x30]
push edx
push 0x45705c
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
call fcn.004060ca
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [0x456c14], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x433fa3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xfeff
push 0x45705c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4340dd
push 3
push 0x449be8
push 0x449bf0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 6
jne 0x4340db
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push 0x45705c
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x434032
push 0x30
push 0
push 0x449c00
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push 0
push 0xe
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
imul eax, dword [0x456c50]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x43406b
push 0x30
push 0
push 0x449c10
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [0x44d1ec]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0
je 0x4340be
mov eax, dword [0x44d1ec]
push eax
call fcn.004060ca
push eax
call fcn.00409064
add esp, 8
push 0
lea ecx, [ebp - 0x18]
push ecx
push 2
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4340d1
push 0x30
push 0
push 0x449c28
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x434117
push 3
push 0x449c38
push 0x449c40
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 6
jne 0x434117
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0043412a
add esp, 8
test eax, eax
jne 0x434117
mov dword [ebp - 0xc], 2
call fcn.004060ca
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x439a65
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44a240
cmp edx, dword [eax]
je 0x439a87
add eax, 8
inc ecx
cmp eax, 0x44a2d0
jl 0x439a78
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44a240]
jne 0x439bb5
mov eax, dword [0x4572c0]
cmp eax, 1
je 0x439b8f
test eax, eax
jne 0x439ab8
cmp dword [0x449cb4], 1
je 0x439b8f
cmp edx, 0xfc
je 0x439bb5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x439aef
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043c020
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0043b260
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x439b32
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043b260
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x441640
push edi
call fcn.0043c1a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043c020
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043c030
lea eax, [ebp - 0xa0]
push 0x441620
push eax
call fcn.0043c030
push dword [esi + 0x44a244]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043c030
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0043c110
add esp, 0x2c
pop edi
jmp 0x439bb5
lea eax, [ebp + 8]
lea esi, [esi + 0x44a244]
push 0
push eax
push dword [esi]
call fcn.0043b260
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret