joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405747
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7a05a0
push esi
call fcn.00405b5a
push esi
call fcn.004056fa
mov edi, eax
test edi, edi
jne 0x405768
xor eax, eax
jmp 0x4057ba
push edi
call fcn.00405d96
test byte [0x7a2bb0], 0x80
je 0x405781
mov al, byte [edi]
test al, al
je 0x405764
cmp al, 0x5c
je 0x405764
sub edi, esi
jmp 0x405799
call fcn.00405e2f
test eax, eax
je 0x405793
test byte [eax], 0x10
je 0x405764
push esi
call fcn.004056ae
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x405785
call fcn.00405667
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x40582b
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40585a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40589e
test edi, edi
jne 0x405865
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405898
Function at 0x4058a2
Capabilities:
Get common file path
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push str.MoveFileExA
push str.KERNEL32.dll
call fcn.00405e6d
test eax, eax
mov esi, dword [esp + 0x18]
je 0x4058ce
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405a14
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x7a1328], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x7a1328
je 0x405912
push 1
push 0
push esi
call fcn.0040582b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405a1a
cmp eax, edi
jg 0x405a1a
mov esi, 0x7a0da0
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405a1a
cmp eax, edi
jg 0x405a1a
push esi
push ebp
push str._s_s_r_n
push 0x7a09a0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call sub.KERNEL32.dll_lstrcatA
xor eax, eax
push eax
push 0x8000080
push 4
push eax
push eax
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x405a14
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405a0d
lea eax, [esp + 0x18]
push 0
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405a0d
cmp edi, dword [esp + 0x18]
jne 0x405a0d
push str._Rename__r_n
push esi
call fcn.004057bf
test eax, eax
jne 0x405a21
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call fcn.00405b5a
add edi, 0xa
mov eax, edi
push ebx
add eax, esi
push 0x7a09a0
push eax
call fcn.0040580b
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0x18]
push 0
add edi, ebx
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x7a2c30]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409324
push eax
call fcn.004057bf
test eax, eax
je 0x4059d8
inc eax
lea edx, [esi + edi]
cmp eax, edx
mov ecx, eax
jae 0x405a4a
mov dl, byte [ecx]
mov byte [ecx + ebx], dl
inc ecx
lea edx, [esi + edi]
cmp ecx, edx
jb 0x405a3d
sub eax, esi
jmp 0x4059da
Function at 0x405a4e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405ab2
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405aa1
cmp dword [ebp + 0x14], 1
je 0x405aa3
cmp dword [ebp + 0x14], 2
je 0x405aa3
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x405b7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jge 0x405b9d
mov ecx, dword [0x7a237c]
lea eax, [ebx*4 + 4]
sub ecx, eax
mov ebx, dword [ecx]
mov eax, dword [0x7a2bd8]
mov ecx, dword [ebp + 8]
add ebx, eax
mov eax, 0x7a1b40
sub ecx, eax
mov edi, eax
cmp ecx, 0x800
jae 0x405d70
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405d70
mov edx, edi
sub edx, eax
cmp edx, 0x400
jge 0x405d7d
inc ebx
cmp cl, 0xfc
jbe 0x405d63
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
mov edx, ecx
and esi, 0x7f
and edx, 0x7f
shl esi, 7
or esi, edx
mov edx, 0x8000
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], eax
or ecx, edx
or eax, edx
inc ebx
mov dword [ebp - 0x14], ecx
inc ebx
cmp byte [ebp + 0xf], 0xfe
mov dword [ebp - 0xc], eax
jne 0x405d0e
and dword [ebp + 0xc], 0
and byte [edi], 0
push 4
pop esi
cmp dword [ebp - 0x10], esi
jne 0x405c31
mov dword [ebp + 0xc], str.MicrosoftInternet_ExplorerQuick_Launch
jmp 0x405ca9
mov eax, dword [ebp - 0x18]
cmp eax, 0x2b
jne 0x405c50
push edi
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405a4e
jmp 0x405ca4
cmp eax, 0x26
jne 0x405c80
push edi
push str.ProgramFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00405a4e
cmp byte [edi], 0
jne 0x405d06
push str.C:Program_Files
push edi
call fcn.00405b5a
jmp 0x405ca4
cmp eax, 0x25
jne 0x405c93
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x405ca4
cmp eax, 0x24
jne 0x405ca9
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp byte [edi], 0
jne 0x405d06
cmp dword [0x7a2c24], 0
jne 0x405cb5
push 2
pop esi
lea eax, [ebp - 4]
dec esi
push eax
push dword [ebp + esi*4 - 0x18]
push dword [0x7a2ba4]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405ceb
push edi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 4]
mov dword [ebp - 8], eax
call fcn.004053c3
cmp dword [ebp - 8], 0
jne 0x405cf2
jmp 0x405cee
and byte [edi], 0
test esi, esi
jne 0x405cb5
cmp byte [edi], 0
je 0x405d06
cmp dword [ebp + 0xc], 0
je 0x405d06
push dword [ebp + 0xc]
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call fcn.00405d96
jmp 0x405d54
cmp byte [ebp + 0xf], 0xfd
jne 0x405d42
cmp esi, 0x1b
jne 0x405d27
push dword [0x7a2ba4]
push edi
call fcn.00405ab8
jmp 0x405d38
mov eax, esi
shl eax, 0xa
add eax, section..ndata
push eax
push edi
call fcn.00405b5a
add esi, 0xffffffeb
cmp esi, 6
jae 0x405d54
jmp 0x405d06
cmp byte [ebp + 0xf], 0xff
jne 0x405d54
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00405b7c
push edi
call sub.KERNEL32.dll_lstrlenA
add edi, eax
mov eax, 0x7a1b40
jmp 0x405d70
jne 0x405d6d
mov cl, byte [ebx]
mov byte [edi], cl
inc edi
inc ebx
jmp 0x405d70
mov byte [edi], cl
inc edi
mov cl, byte [ebx]
test cl, cl
mov byte [ebp + 0xf], cl
jne 0x405bc8
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x405d92
push eax
push dword [ebp + 8]
call fcn.00405b5a
leave
ret 8
Function at 0x405eca
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x7a172c], 0
push esi
jne 0x405f01
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405edb
mov dword [ecx*4 + 0x7a1728], eax
inc ecx
cmp ecx, 0x100
jl 0x405ed6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f32
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x7a1728]
xor eax, esi
inc ecx
dec edx
jne 0x405f14
pop edi
not eax
pop esi
ret 0xc

Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
mov al, byte [0x8b0041bb]
dec ebp
in al, dx
xchg ebx, eax
cmp esp, ebx
or al, 0x3b
add eax, 0x5640d010
cmp al, 0x8c
adc ch, al
invalid
pop ebp
ret
push ebp
mov ebp, esp
salc
in al, dx
js 0x401dca
mov bh, 0x75
or al, 0xea
lea eax, [ebp - 0x78]
push 0x78
push eax
push esi
call 0x1bf486e0
mov ecx, dword [ebp + 8]
mov edx, dword [sym.imp.MSVCRT.dll__iob]
push eax
push ecx
loope 0x401e26
inc eax
push str._s:__s___d__n
push edx
mov dh, 0x15
add cl, 0x40
add byte [ecx + 0x4102ac], ah
mov es, word [ecx + 0x74c08514]
invalid

Function at 0x403603
Capabilities:
Encode data using xor

Disassembly:
invalid
inc eax
pop esi
xor dword [esi + 0xe], 0xaa7c54c7
sub esi, 0xfffffffc
loop 0x403606
cmp ebp, edi
in eax, 0x80
xor byte [edi + edx*4 + 0x4d0299a6], bl
mov ah, 0x6a
push ebp
mov edi, 0x8b21072f
imul ebp, dword [edi], 0x385583bb
je 0x4035f8
pop esp
clts
pop esp
lodsd eax, dword [esi]
invalid
Function at 0x40262f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0x3e9
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x41e737
push dword [0x4b6a68]
push 0x152
push dword [0x4b6a60]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [0x4ce72c], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x4027c9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
sub esp, 0x10
call fcn.00412892
imul edx, eax, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
add dword [ebp - 0x18], eax
push 0
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
movzx eax, byte [ecx + 0x1c]
inc eax
imul eax, eax, 0x14
mov dword [ebp - 0x14], eax
push 0
push eax
add ecx, 8
call fcn.004191a9
mov ecx, dword [ebp - 0x14]
sub dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 1
jne 0x40287e
push dword [ebp - 0x10]
push dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.004025a7
test eax, eax
je 0x40287e
mov dword [ebp - 0x14], eax
jmp 0x402832
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp dl, byte [eax + 0x1d]
jae 0x40284e
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
jmp 0x40282f
mov byte [ebp - 8], 0
jmp 0x402857
inc dword [ebp - 8]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
cmp dl, byte [eax + 0x1e]
jae 0x402877
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov dword [eax + edx*4 + 0xa0], ecx
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
jmp 0x402854
mov eax, 1
jmp 0x402880
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x402a25
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push 1
mov ecx, dword [ebp - 8]
call fcn.00402537
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x14], ecx
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.004192c5
push 0
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
add ecx, 8
call fcn.00418f5c
test eax, eax
je 0x402a9e
push 1
mov ecx, dword [ebp - 8]
call fcn.0040369f
lea edx, [ebp - 4]
push edx
push 0
push dword [ebp - 8]
push 0x41295c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
test eax, eax
je 0x402a97
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
jmp 0x402aa0
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x403510
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x484f4c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
add ecx, 8
call fcn.004032b0
inc dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.0043a93e
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x30], 0x1010ffff
xor ecx, ecx
mov dword [eax + 0x34], ecx
mov dword [eax + 0x38], ecx
mov dword [eax + 0x3c], ecx
mov dword [eax + 0x40], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], ecx
mov dword [eax + 0x54], ecx
mov dword [eax + 0x58], ecx
mov dword [eax + 0x5c], 0xfffffc18
mov dword [eax + 0x60], 0xfffffc18
dec dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4069b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push str.AutoDll.ini
push 1
push dword [ebp - 8]
lea ecx, [ebp - 4]
call fcn.00418f5c
test eax, eax
je 0x406a39
push dword [ebp - 8]
call fcn.00418ed4
add esp, 4
push eax
push eax
push 0
push 0x500dea
push 0x500de2
call dword [0x4be042]
mov byte [0x500df9], al
push dword [ebp - 0xc]
push 0
push 0x500e3d
push 0x500de2
call dword [0x4be042]
mov byte [0x4ce7fe], al
push dword [ebp - 0xc]
push 0xa
push 0x500e03
push 0x500dfa
call dword [0x4be042]
cmp ax, 0xa
jae 0x406a28
mov ax, 0xa
mov word [0x500e0d], ax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x406a47
mov byte [0x500df9], al
mov word [0x500e0d], 0xa
mov esp, ebp
pop ebp
ret

Function at 0x406a4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
xor byte [0x500e02], 1
mov eax, dword [0x4cea0c]
test eax, eax
je 0x406a93
mov byte [0x500e0c], 1
push 0
push 0
push 0
push 0x406a95
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x406a85
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
call fcn.0040a985
mov byte [0x500e0c], 0
pop ebp
ret
Function at 0x40b1f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
sub esp, 0xd4
lea ecx, [ebp - 0xdc]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041439f
push dword [ebp - 8]
push 0x3f8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 8]
call fcn.004264f8
push 0x5ab
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
call fcn.0040c45a
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40b271
cmp byte [ebp + 0x10], 0xff
je 0x40b271
push 5
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0x10]
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x40b28f
push 0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x492e2c
push 0x5ac
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0x10], 0
jne 0x40b2c3
push 0x565
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x5ad
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 8]
call fcn.0040b460
push dword [eax*4 + 0x48bc04]
push 0x3ff
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 0x12], 0xff
jne 0x40b2fe
push 0x48b284
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x40b317
mov ecx, dword [ebp - 8]
call fcn.0040d85e
push 0
push eax
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemInt]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.00461fc8
lea edx, [ebp - 0x70]
push edx
push 0x401
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
lea edx, [ebp - 0x70]
push edx
call fcn.0040df60
lea edx, [ebp - 0x70]
push edx
push 0x5af
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 8]
call fcn.0041b4f7
mov dword [ebp - 0xc], eax
jmp 0x40b36b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 0x50
jae 0x40b3cf
push dword [ebp - 4]
call fcn.0040687c
add esp, 4
cmp al, 0xff
je 0x40b368
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
movzx eax, byte [ecx + 0x11]
cmp al, 0x1a
jae 0x40b39f
push eax
mov ecx, dword [ebp - 4]
call fcn.0041b782
call fcn.0041c60f
jmp 0x40b3b3
mov al, byte [ecx + 0x14]
cmp al, 3
je 0x40b368
mov edx, eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00420e83
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x5c0
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x40b368
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b418
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b6a68]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
push dword [0x4b6a60]
push 0x4132c9
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x4cea0c], eax
pop ebp
ret

Function at 0x40c2ad
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
cmp byte [0x5005a0], 0
je 0x40c2e1
jmp 0x40c2c0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 2
jae 0x40c2e1
add eax, 0x7e4
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c2bd
mov esp, ebp
pop ebp
ret 4

Function at 0x40d5a4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
call fcn.0040a52e
call fcn.00420231
push 0x4a7b20
call fcn.0040b6f9
push 0x4a8660
call fcn.0040b6f9
push 0x4c3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_SetParent]
xor ecx, ecx
push ecx
movzx eax, byte [0x500c9b]
push eax
mov ax, word [0x500c99]
push eax
push ecx
push ecx
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [0x4b5fe8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x40dfba
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.0040b913
cmp al, 2
jne 0x40dfff
call fcn.00414dbe
call fcn.00429906
movzx eax, ax
mov dword [ebp - 4], eax
and eax, 8
test eax, eax
je 0x40dffa
push 0
push dword [0x4ff3d0]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
jmp 0x40e005
mov ax, word [0x4abf9c]
mov esp, ebp
pop ebp
ret

Function at 0x40ec30
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push 0
push ecx
cmp al, 0
je 0x40ec3e
cmp al, 0xcc
jne 0x40ec97
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042168d
mov dword [ebp - 8], eax
jmp 0x40ec51
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp al, 0xa
jae 0x40ec97
imul eax, eax, 3
add eax, 0x501ae1
inc eax
mov edx, dword [eax]
cmp word [ebp - 8], dx
jne 0x40ec4e
movzx ecx, byte [eax + 2]
mov dword [ebp - 8], ecx
mov eax, 0x2a540
call fcn.00401536
mov ecx, dword [ebp - 8]
imul ecx, ecx, 0x1b0
add eax, ecx
push 4
push eax
push 0xc
push 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00451913
mov esp, ebp
pop ebp
ret 8

Function at 0x413df8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x4b6a8c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x4b6bc0
call fcn.0046364f
mov eax, dword [0x4b6a68]
call fcn.00476203
push 0
push 0
push 5
push dword [0x4b6a8c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 5
push dword [0x4b6a8c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.004759bc
add esp, 4
pop ebp
ret
Function at 0x4158ec
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push dword [eax*4 + 0x4b5fd0]
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x4b6a68]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetParent]
mov esp, ebp
pop ebp
ret 4

Function at 0x418ed4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
call fcn.00412e27
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4196f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
call fcn.00403116
push eax
sub esp, 0x28
cmp byte [0x4ac63c], 3
je 0x419733
cmp word [ebp + 0xc], 0x56b
jne 0x419733
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
test cx, cx
jne 0x419733
push dword [ebp + 8]
mov ecx, 0x496f38
call fcn.00438fc1
test eax, eax
jne 0x419738
jmp 0x41982a
push 0
call fcn.004759bc
add esp, 4
mov ecx, 0x496f38
call fcn.00423cce
call fcn.0041e5f6
xor ecx, ecx
mov eax, dword [ebp + 8]
cmp al, 3
jae 0x4197d9
mov edx, 0x496f4c
cmp dword [edx + eax*4], ecx
je 0x4197bf
cmp dword [ebp - 8], ecx
je 0x4197bf
mov cl, byte [eax + 0x407d1a]
push ecx
call fcn.0040c755
push eax
call fcn.0041992e
push eax
mov eax, dword [ebp + 8]
imul edx, eax, 0xf
add edx, 0x48b49b
push edx
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x30]
push edx
call fcn.0042d5b0
push 0
push dword [ebp - 0x34]
push 0x48b496
call fcn.0042d5b0
xor ecx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x496f4c
mov dword [edx + eax*4], ecx
cmp al, 0
jne 0x4197c6
inc ecx
jmp 0x4197ca
cmp al, 1
jne 0x4197d2
push ecx
call fcn.00461cf6
jmp 0x419812
call fcn.00461c88
jmp 0x419812
cmp al, 3
jne 0x419812
push 1
mov ecx, 0x492f90
call fcn.00418597
mov dword [ebp - 4], eax
test eax, eax
je 0x419812
push 0
push dword [0x4b7508]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.00410f9d
add esp, 4
mov dword [0x4ae4c0], 1
cmp dword [ebp - 4], 0
jne 0x41982a
mov byte [0x496f48], 0
call fcn.004034d2
push eax
call fcn.004759bc
mov esp, ebp
pop ebp
ret 8