joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e9a73
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100e99ef
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100e9be2
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100e9be2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100e9b97
jg 0x100e9acf
test eax, eax
je 0x100e9b8d
push 1
push 0x1000
call fcn.100da060
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100e9af2
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e9b84
push 0x8000
push ebx
call fcn.100e991e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100e9b1b
jg 0x100e9b16
cmp ecx, 0x1000
jb 0x100e9b1b
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100df1fc
add esp, 0x10
cmp eax, 0xffffffff
je 0x100e9b60
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100e9b16
jl 0x100e9b47
test ecx, ecx
jne 0x100e9b08
push dword [ebp - 0xc]
push ebx
call fcn.100e991e
push esi
call fcn.100da010
add esp, 0xc
xor ebx, ebx
jmp 0x100e9bf0
cmp byte [edi + 0x24], 0
je 0x100e9b77
cmp dword [edi + 0x20], 5
jne 0x100e9b77
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100e9b82
mov ebx, dword [edi + 0x18]
jmp 0x100e9b84
xor ebx, ebx
push esi
call fcn.100da010
pop ecx
jmp 0x100e9bf0
test ecx, ecx
jg 0x100e9b59
jl 0x100e9b97
test eax, eax
jae 0x100e9b59
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100e0c77
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x100e9bb7
cmp byte [edi + 0x1c], 0
je 0x100e9b59
jmp 0x100e9be8
push ebx
call fcn.100e73db
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100e9b59
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100e9bf0
cmp byte [edi + 0x1c], 0
je 0x100e9bed
mov ebx, dword [edi + 0x18]
jmp 0x100e9bf0
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100e0c77
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100eb4b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100eb4dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100eb4dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406c9b
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040682a
mov dword [ebp - 8], eax
test bl, 8
je 0x406cd9
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434ac8], eax
jmp 0x406e5b
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
push esi
je 0x406cf4
test eax, eax
je 0x406e07
test bl, 2
je 0x406e07
push edi
mov esi, 0x430410
push esi
call fcn.004064b7
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406d16
push 0x4089c0
push esi
call ebx
jmp 0x406d1c
push edi
call fcn.004067b6
cmp word [edi], 0
jne 0x406d2c
cmp word [0x430410], 0x5c
jne 0x406d34
push 0x4082b0
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406dfb
cmp word [ebp - 0x22c], 0x2e
jne 0x406d7f
cmp word [ebp - 0x22a], 0
je 0x406dde
cmp word [ebp - 0x22a], 0x2e
jne 0x406d7f
cmp word [ebp - 0x228], 0
je 0x406dde
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004064b7
test byte [ebp - 0x258], 0x10
je 0x406daa
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406dde
push dword [ebp + 0xc]
push edi
call fcn.00406c9b
jmp 0x406dde
push dword [ebp - 4]
push edi
call fcn.0040673f
test eax, eax
jne 0x406dd6
cmp dword [ebp - 4], eax
je 0x406dce
push edi
push 0xfffffffffffffff1
call fcn.004051f2
push 0
push edi
call fcn.00406c6f
jmp 0x406dde
inc dword [0x434ac8]
jmp 0x406dde
push edi
push 0xfffffffffffffff2
call fcn.004051f2
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406d57
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406e07
xor eax, eax
mov word [ebx - 2], ax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406e5a
cmp dword [ebp - 8], esi
je 0x406e4a
push edi
call fcn.004065a5
test eax, eax
je 0x406e5a
push edi
call fcn.00406787
mov eax, dword [ebp - 4]
or eax, 1
push eax
push edi
call fcn.0040673f
test eax, eax
jne 0x406e52
cmp dword [ebp - 4], esi
je 0x406e4a
push edi
push 0xfffffffffffffff1
call fcn.004051f2
push esi
push edi
call fcn.00406c6f
jmp 0x406e5a
inc dword [0x434ac8]
jmp 0x406e5a
push edi
push 0xffffffffffffffe5
call fcn.004051f2
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x406e61
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x431414], 0
jne 0x406e9f
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e75
mov dword [ecx*4 + 0x431410], eax
inc ecx
cmp ecx, 0x100
jl 0x406e70
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ecc
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x431410]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ead
not eax
pop ebp
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x286f3e54
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x305d670b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x8ccbad
Capabilities:
Encode data using xor

Disassembly:
push 0x8cc92e
pop edx
sub esp, 4
mov dword [esp], edi
pop ebx
call fcn.008ccc06
sub edi, 0xf3e4bfee
sub ebx, 1
xor dword [esi], edx
sub edi, 0x1b089ba8
sub ebx, edi
or edi, edi
add esi, 1
inc ebx
mov ebx, edi
push ebx
mov edi, dword [esp]
add esp, 4
cmp esi, ecx
jne fcn.008ccbad
add edi, 0xffd57b8a
add edi, 1
ret
Function at 0x4032be
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
mov edx, 0x14
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4032c5
mov edx, dword [esp + 0x5c]
lea ecx, [esp]
call fcn.00405060
mov edx, dword [esp + 0x60]
lea ecx, [esp + 4]
call fcn.00405060
mov edx, dword [esp + 0x64]
lea ecx, [esp + 8]
call fcn.00405060
lea eax, [esp + 0xc]
lea ebp, [esp + 0xc]
mov dword [ebp], 0x3c
mov dword [ebp + 4], 0x140
mov dword [ebp + 0x1c], 0
mov eax, 0x41008f
push eax
pop eax
mov dword [ebp + 0xc], eax
mov eax, dword [esp]
push eax
pop eax
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 8]
push eax
pop eax
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 4]
push eax
pop eax
mov dword [ebp + 0x18], eax
lea eax, [esp + 0xc]
push eax
call sub.SHELL32.DLL_ShellExecuteExA
mov dword [esp + 0x48], eax
push 0x19
call fcn.00409752
lea eax, [esp + 0x4c]
push eax
lea ebp, [esp + 0x10]
push dword [ebp + 0x38]
call sub.KERNEL32.dll_GetExitCodeProcess
and eax, eax
je 0x403374
mov ebx, dword [esp + 0x4c]
cmp ebx, 0x103
je 0x403374
jmp 0x403376
jmp 0x403347
mov eax, 1
jmp 0x40337f
push dword [esp]
call fcn.0040e0b0
push dword [esp + 4]
call fcn.0040e0b0
push dword [esp + 8]
call fcn.0040e0b0
add esp, 0x50
pop ebx
pop ebp
ret 0xc

Function at 0x4033a1
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push 0x400
call fcn.0040b2d0
mov dword [esp], eax
push dword [0x411738]
push dword [0x411738]
call fcn.0040b44d
lea eax, [esp + 8]
push eax
call fcn.0040dfa0
push dword [esp]
push 0
push 0x41001e
push dword [esp + 0x10]
call sub.KERNEL32.dll_GetTempFileNameA
push dword [0x411738]
push dword [0x411738]
push dword [esp + 8]
call fcn.0040b1e0
lea eax, [0x411438]
push eax
call fcn.0040dfa0
push dword [esp]
call fcn.0040b2f0
push dword [0x411438]
call fcn.0040b4dc
push dword [0x411438]
call fcn.0040b4ea
push dword [0x411738]
push dword [0x411738]
call fcn.0040b385
lea eax, [0x4113d8]
push eax
call fcn.0040dfa0
push dword [esp + 0x14]
pop eax
call fcn.0040b310
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40347a
mov edx, dword [0x411438]
push dword [0x411738]
call fcn.0040e050
lea eax, [0x4113d8]
push eax
call fcn.0040dfa0
mov dword [esp + 0xc], 2
jmp 0x40348c
mov ebx, 1
cmp ebx, dword [esp]
jne 0x40348c
mov dword [esp + 0xc], 1
pop eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
push ebx
pop eax
call fcn.0040b310
mov dword [0x411404], eax
mov ebx, dword [esp + 0x14]
add ebx, dword [esp + 8]
inc ebx
push ebx
pop eax
call fcn.0040b310
mov dword [0x411370], eax
mov eax, 1
jmp 0x4034bf
push dword [esp + 4]
call fcn.0040e0b0
add esp, 0xc
pop ebx
ret 4
Function at 0x403beb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
mov edx, dword [esp + 0x24]
lea ecx, [esp]
call fcn.00405060
push 0xa
push dword [esp + 4]
push dword [esp + 0x28]
call sub.KERNEL32.dll_FindResourceA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x403c41
push dword [esp + 4]
push dword [esp + 0x24]
call sub.KERNEL32.dll_LoadResource
mov dword [0x411374], eax
push dword [esp + 4]
push dword [esp + 0x24]
call sub.KERNEL32.dll_SizeofResource
mov dword [0x411388], eax
push dword [esp]
mov edx, 0x41006e
pop ecx
call fcn.0040e020
je 0x403cb8
push dword [0x411388]
call fcn.0040b2d0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov ebx, dword [0x411388]
dec ebx
cmp ebx, dword [esp + 0xc]
jl 0x403cae
mov ebx, dword [0x411374]
add ebx, dword [esp + 0xc]
push ebx
pop eax
call fcn.0040b310
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0xffffffff
mov dword [esp + 0x14], ebx
push dword [esp + 0x14]
mov ebx, dword [esp + 0xc]
add ebx, dword [esp + 0x10]
push ebx
pop eax
call fcn.0040b320
inc dword [esp + 0xc]
jno 0x403c68
push dword [esp + 8]
pop eax
mov dword [0x411374], eax
mov eax, dword [esp + 4]
jmp 0x403cc0
push dword [esp]
call fcn.0040e0b0
add esp, 0x18
pop ebx
ret 8
Function at 0x403f7c
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
mov ebx, dword [0x411404]
cmp ebx, 1
jne 0x404039
push dword [0x411458]
call fcn.0040889b
mov ebx, eax
and ebx, ebx
jle 0x403fe0
push dword [0x411458]
call fcn.004088a5
push dword [0x411458]
call fcn.004088ba
or eax, eax
je 0x403fe0
mov ebp, dword [0x41145c]
push dword [ebp + 8]
call fcn.0040cb10
mov ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x403fde
mov ebp, dword [0x41145c]
push dword [ebp + 8]
call fcn.0040b4dc
jmp 0x403fac
push dword [0x411460]
call fcn.0040889b
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, ebx
jle 0x404039
push 5
push 0
push 1
push dword [0x411460]
call fcn.004078d0
push dword [0x411460]
call fcn.004088a5
push dword [0x411460]
call fcn.004088ba
or eax, eax
je 0x404039
mov ebp, dword [0x411464]
push dword [ebp + 0xc]
call sub.KERNEL32.dll_RemoveDirectoryA
jmp 0x40401a
mov eax, 1
jmp 0x404042
add esp, 4
pop ebx
pop ebp
ret

Function at 0x4081ed
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x40823c
push dword [esp + 0x10]
push 0x40816b
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x411470]
cmp esi, ebx
je 0x408290
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x408234
cmp byte [esi + 0x10], bl
je 0x408234
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x408211
jmp 0x408290
mov esi, dword [0x411470]
cmp esi, ebx
je 0x408290
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x408289
cmp byte [esi + 0x11], bl
je 0x408266
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x40827c
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x411470
call fcn.0040dbcd
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x408247
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x4092d4
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x4117ac]
call fcn.0040d4fa
mov edi, eax
test edi, edi
je 0x409336
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4092fd
push dword [esp + 0xc]
push edi
call eax
jmp 0x409336
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.0040e1e0
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.0040e310
pop esi
pop ebx
pop edi
ret 8
Function at 0x40965f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x1c]
push eax
mov ebx, 0xc8
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x409748
mov eax, dword [ebp - 0xc]
dec eax
je 0x40972b
dec eax
jne 0x409748
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x4096be
cmp byte [ebp - 0x1e], 1
jne 0x4096be
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x409727
dec eax
je 0x409723
dec eax
je 0x409701
dec eax
jne 0x409748
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x4096f5
dec eax
je 0x4096e9
dec eax
jne 0x409748
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x5f]
jmp 0x409748
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x55]
jmp 0x409748
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x4b]
jmp 0x409748
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x40971f
dec eax
je 0x40971b
dec eax
jne 0x409748
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x41]
jmp 0x409748
push 0x3c
jmp 0x409747
push 0x32
jmp 0x409747
push 0x14
jmp 0x409747
push 5
jmp 0x409747
cmp dword [ebp - 0x14], 0
je 0x409745
cmp dword [ebp - 0x14], 0xa
je 0x409741
cmp dword [ebp - 0x14], 0x5a
jne 0x409748
push 0x28
jmp 0x409747
push 0x1e
jmp 0x409747
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret

Function at 0x40a6b1
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x40a72d
push 9
call esi
test bl, al
je 0x40a72d
push 0x11
call esi
test bl, al
jne 0x40a72d
push 0x10
call esi
test bl, al
jne 0x40a72d
push 0x12
call esi
test bl, al
jne 0x40a72d
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40a72d
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x40a72d
xor eax, eax
jmp 0x40a7af
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x40a756
push 0x11
call esi
test bl, al
jne 0x40a74e
push 0x10
call esi
test bl, al
jne 0x40a74e
push 0x12
call esi
test bl, al
je 0x40a756
push 1
push ebp
call fcn.0040a66a
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test edi, edi
je 0x40a76c
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x40a7ac
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x40a7ac
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40a7ac
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x40a7ac
dec esi
push esi
push dword [0x4117b4]
call fcn.0040d4fa
test eax, eax
je 0x40a7ac
mov eax, dword [eax + 8]
jmp 0x40a7ae
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x40a871
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor edi, edi
mov dword [0x4116c4], eax
cmp eax, edi
je 0x40a8a4
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4116c8], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x4116c0], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40a8e2
cmp dword [ebp - 0xc], 1
je 0x40a8f3
cmp dword [ebp - 0xc], 2
jne 0x40a8e2
cmp dword [ebp - 0x18], 5
jb 0x40a8f3
jne 0x40a8e2
cmp dword [ebp - 0x14], edi
jne 0x40a8e2
mov dword [0x4116c0], edi
cmp dword [0x4116c0], edi
je 0x40a8f9
call fcn.0040a7b8
test eax, eax
jne 0x40a8f9
mov dword [0x4116c0], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x40b4ae
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x40b4d7
test byte [esp + 8], 2
je 0x40b4cb
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40b4d9
xor eax, eax
ret 8

Function at 0x40b4ea
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x40b55a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x40b53c
mov dl, byte [eax - 1]
cmp dl, 0x20
je 0x40b53b
cmp dl, 0x5c
je 0x40b53b
cmp dl, 0x2f
jne 0x40b546
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x40b529
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x40b55c
xor eax, eax
leave
ret 4

Function at 0x40b630
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x40b665
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4
Function at 0x40ba10
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x40ba57
cmp byte [esi], al
je 0x40ba57
mov eax, dword [esp + 0xc]
mov ecx, dword [0x411854]
push eax
push ecx
call fcn.0040d4fa
test eax, eax
je 0x40ba85
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x40ba60
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40ba45
sub ecx, edi
push ecx
push esi
push eax
call fcn.0040bbd0
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40ba60
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8

Function at 0x40ba90
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x40bae9
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40bae8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x411854]
push eax
push ecx
call fcn.0040d4fa
test eax, eax
je 0x40bae4
cmp dword [eax + 4], 0
je 0x40bad2
push esi
push edi
push eax
call fcn.0040bbd0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc

Function at 0x40baf0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x411854]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0040d4fa
mov esi, eax
test esi, esi
je 0x40bbb7
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
test ecx, ecx
je 0x40bb6f
cmp byte [ecx], 0
je 0x40bb6f
cmp dword [esi + 4], 0
mov eax, ecx
push edi
lea edi, [eax + 1]
je 0x40bb57
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40bb40
sub eax, edi
push eax
push ecx
push esi
call fcn.0040bbd0
mov dword [esp + 0xc], eax
jmp 0x40bb6e
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40bb57
push 0
lea edx, [esp + 0x10]
push edx
sub eax, edi
push eax
mov eax, dword [esi]
push ecx
push eax
call ebp
pop edi
cmp dword [esi + 4], 0
je 0x40bb92
push 2
push 0x40f504
push esi
call fcn.0040bbd0
mov ecx, eax
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x40f504
push edx
call ebp
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 8
Function at 0x40bbd0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x40bc05
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40bc7a
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x40bc67
dec ecx
je 0x40bc52
sub ecx, 2
je 0x40bc3f
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.0040b630
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40bca7
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc