joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100884a0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x100884e9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x10088960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100c96e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.10088510
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.10088590
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.10088590
lea ecx, [esi + 0xc]
call fcn.100b6ae3
lea ecx, [esi + 0x10]
call fcn.100b6ae3
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.10089b20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.10089b20
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.10089b20
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.100b6b58
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.100b6b58
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x1008de30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x1008df51
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x1008df35
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x1008de87
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x1008de65
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x1008e999
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1008e9f0
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x1008e9f0
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x1008e9f0
xor eax, eax
inc eax
jmp 0x1008e9f2
xor eax, eax
leave
ret 0x10
Function at 0x1008ea1b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x1008ea89
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x101a8744
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008ea80
cmp dword [ebp - 0xc], 4
jne 0x1008ea80
cmp dword [ebp - 0x10], edi
je 0x1008ea80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x101d8088], edi
xor eax, eax
jmp 0x1008eac8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x101d8088], edi
jge 0x1008eac3
lea eax, [ebp - 0x34]
push eax
mov dword [0x101d8088], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x1008eac3
cmp word [ebp - 0x14], 5
jb 0x1008eac3
call fcn.1008e9f6
test eax, eax
je 0x1008eac3
emms
mov dword [0x101d8088], 1
mov eax, dword [0x101d8088]
pop edi
leave
ret

Function at 0x1009e613
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x14], edi
mov ebx, ecx
je 0x1009e651
call fcn.100c09d7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x1009e651
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1009e668
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push 1
test edi, edi
pop eax
je 0x1009e668
push dword [esp + 0x18]
mov eax, dword [ebx]
mov ecx, ebx
push edi
push dword [esp + 0x18]
call dword [eax + 0x1c]
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x100b8f85
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100b8fbd
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.100b6fff
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.100b6fd7
jmp 0x100b8fc9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100ba67b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x100ba6bd
call fcn.100c09d7
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x100ba6bd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100ba6b4
xor eax, eax
jmp 0x100ba6c5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.100ba6cb
pop edi
pop esi
pop ebx
ret 4
Function at 0x401150
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi], 0
jne 0x401182
lea eax, [edi + 0x68]
push 0x418200
push eax
call fcn.004025a0
add esp, 8
mov dword [edi], eax
test eax, eax
jne 0x401182
push str.Cannot_open_archive_file_n
call fcn.004017b0
add esp, 4
xor eax, eax
pop edi
ret
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push 0
push ecx
call sub.WS2_32.dll_ntohl
add eax, dword [edi + 4]
mov edx, dword [edi]
push eax
push edx
call fcn.00407af9
mov eax, dword [esi + 8]
add esp, 0xc
push eax
call sub.WS2_32.dll_ntohl
push eax
call fcn.0040773a
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4011cd
push str.Could_not_allocate_read_buffer_n
call fcn.004017b0
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
ret
mov ecx, dword [edi]
mov edx, dword [esi + 8]
push ecx
push 1
push edx
call sub.WS2_32.dll_ntohl
push eax
push ebx
call fcn.00407a52
add esp, 0x10
cmp eax, 1
jae 0x4011fd
push str.Could_not_read_from_file_n
call fcn.004017b0
add esp, 4
pop esi
pop ebx
xor eax, eax
pop edi
ret
cmp byte [esi + 0x10], 1
jne 0x401233
push ebp
push ebx
call fcn.00401060
push ebx
mov ebp, eax
call fcn.004077ce
add esp, 8
mov ebx, ebp
test ebp, ebp
pop ebp
jne 0x401233
add esi, 0x12
push esi
push str.Error_decompressing__s_n
call fcn.004017b0
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
mov eax, dword [edi]
test eax, eax
je 0x401248
push eax
call fcn.004076c6
add esp, 4
mov dword [edi], 0
pop esi
mov eax, ebx
pop ebx
pop edi
ret

Function at 0x401250
Capabilities:
Write file on windows

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
push edi
push esi
call fcn.00401150
push esi
mov ebp, eax
call fcn.00403850
add esp, 0xc
cmp eax, 0xffffffff
jne 0x401278
pop edi
pop esi
or eax, eax
pop ebp
ret
push ebx
lea ebx, [edi + 0x12]
push ebx
add esi, 0x2068
push esi
call fcn.00403cb0
mov esi, eax
mov eax, dword [edi + 0xc]
add esp, 8
push eax
call sub.WS2_32.dll_ntohl
mov edi, eax
test esi, esi
jne 0x4012b3
push ebx
push str._s_could_not_be_extracted__n
call fcn.00401750
add esp, 8
pop ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
push esi
push 1
push edi
push ebp
call fcn.00407ccc
add esp, 0x10
cmp eax, 1
je 0x4012df
test edi, edi
je 0x4012df
push ebx
push str.Failed_to_write_all_bytes_for__s_n
call fcn.00401750
add esp, 8
pop ebx
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret
push esi
call fcn.004076c6
push ebp
call fcn.004077ce
add esp, 8
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
ret

Function at 0x401300
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [esi]
push 0
add eax, 0xffffffa8
push eax
push ecx
call fcn.00407af9
add esp, 0xc
test eax, eax
je 0x401319
or eax, 0xffffffff
ret
mov edx, dword [esi]
push edi
push edx
push 1
lea edi, [esi + 0x10]
push 0x58
push edi
call fcn.00407a52
add esp, 0x10
cmp eax, 1
jae 0x401337
or eax, 0xffffffff
pop edi
ret
push 8
push str.MEI_f_v_n_v
push edi
call fcn.00407d46
add esp, 0xc
neg eax
sbb eax, eax
pop edi
ret
Function at 0x401350
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esi]
push 0
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.00407af9
mov ecx, dword [esi]
push ecx
push 2
lea edx, [esp + 0x14]
push 1
push edx
call fcn.00407a52
mov ax, word [esp + 0x1c]
add esp, 0x1c
cmp al, 0x4d
jne 0x40141e
cmp ah, 0x5a
jne 0x40141e
mov eax, dword [esi]
push 0
push 0x3c
push eax
call fcn.00407af9
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x18]
push 4
push edx
call fcn.00407a52
mov eax, dword [esp + 0x20]
mov ecx, dword [esi]
push 0
add eax, 0x18
push eax
push ecx
call fcn.00407af9
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x30]
push 2
push eax
call fcn.00407a52
mov ax, word [esp + 0x38]
add esp, 0x38
cmp al, 0xb
jne 0x40141e
cmp ah, 1
jne 0x4013e9
mov eax, 0x98
jmp 0x4013f3
cmp ah, 2
jne 0x40141e
mov eax, 0xa8
add eax, dword [esp + 4]
mov edx, dword [esi]
push 0
push eax
push edx
call fcn.00407af9
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.00407a52
mov eax, dword [esp + 0x20]
add esp, 0x1c
test eax, eax
jne 0x401421
or eax, 0xffffffff
add esp, 8
ret
Function at 0x401430
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi], 0
jne 0x401456
lea eax, [esi + 0x68]
push 0x418200
push eax
call fcn.004025a0
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x401456
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
push edi
push 2
push 0
push ecx
call fcn.00407af9
mov edx, dword [esi]
push edx
call fcn.00407fea
add esp, 0x10
mov edi, eax
call fcn.00401300
test eax, eax
jns 0x4014e3
call fcn.00401350
mov edi, eax
cmp edi, 1
jl 0x40159f
push ebx
push ebp
xor ebp, ebp
lea ecx, [ecx]
mov ecx, dword [esi]
push 0
lea eax, [edi - 0x58]
push eax
push ecx
call fcn.00407af9
add esp, 0xc
test eax, eax
jne 0x4014d1
mov edx, dword [esi]
push edx
push 1
lea ebx, [esi + 0x10]
push 0x58
push ebx
call fcn.00407a52
add esp, 0x10
cmp eax, 1
jb 0x4014d1
push 8
push str.MEI_f_v_n_v
push ebx
call fcn.00407d46
add esp, 0xc
test eax, eax
je 0x4014d8
inc ebp
dec edi
cmp ebp, 8
jl 0x401490
cmp ebp, 8
pop ebp
pop ebx
je 0x40159f
mov eax, dword [esi + 0x18]
push eax
mov dword [esi + 0x406c], 0
call sub.WS2_32.dll_ntohl
mov ecx, dword [esi + 0x1c]
push 0
sub edi, eax
push ecx
mov dword [esi + 4], edi
call sub.WS2_32.dll_ntohl
add eax, dword [esi + 4]
mov edx, dword [esi]
push eax
push edx
call fcn.00407af9
mov eax, dword [esi + 0x20]
add esp, 0xc
push eax
call sub.WS2_32.dll_ntohl
push eax
call fcn.0040773a
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x401541
push str.Could_not_allocate_buffer_for_TOC.
call fcn.00401750
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
mov edx, dword [esi + 0x20]
push ecx
push 1
push edx
call sub.WS2_32.dll_ntohl
push eax
mov eax, dword [esi + 8]
push eax
call fcn.00407a52
add esp, 0x10
cmp eax, 1
jae 0x401574
push str.Could_not_read_from_file.
call fcn.00401750
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi + 0x20]
push ecx
call sub.WS2_32.dll_ntohl
add eax, dword [esi + 8]
mov edx, dword [esi]
push edx
mov dword [esi + 0xc], eax
call fcn.00407e2e
add esp, 4
test eax, eax
je 0x4015a5
push str.Error_on_file
call fcn.00401750
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi]
test eax, eax
je 0x4015ba
push eax
call fcn.004076c6
add esp, 4
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
ret
Function at 0x403650
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.004088d0
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push 0
push eax
push 0
call fcn.004043a0
add esp, 0xc
push 0x2000
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4036e1
push 0x2000
lea edx, [esp + 0x2004]
push edx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call fcn.004042b0
add esp, 0xc
test eax, eax
je 0x4036e1
cmp byte [eax], 0
je 0x4036e1
push eax
call fcn.00409afc
add esp, 4
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.00408118
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4000]
xor ecx, esp
xor eax, eax
call fcn.00408118
add esp, 0x4004
ret

Function at 0x403700
Capabilities:
Set environment variable

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0
push eax
push 0
call fcn.004043a0
mov ecx, dword [esp + 0x20]
push 0
push ecx
push 0
mov esi, eax
call fcn.004043a0
add esp, 0x18
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
mov ebx, eax
call fcn.004077ce
push edi
call fcn.004077ce
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x403750
Capabilities:
Set environment variable

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push eax
push 0
call fcn.004043a0
add esp, 0xc
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
mov edi, eax
call fcn.004077ce
add esp, 4
mov eax, edi
pop edi
pop esi
ret

Function at 0x403780
Capabilities:
Get common file path

Disassembly:
mov eax, 0x2024
call fcn.004088d0
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x2020], eax
push ebx
mov ebx, dword [esp + 0x202c]
push esi
push edi
lea eax, [esp + 0x2c]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
lea ecx, [esp + 0x10]
push str._MEI_d
push ecx
mov edx, 0x10
call fcn.00403630
add esp, 0xc
xor edi, edi
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.00409ca0
mov esi, eax
push esi
call fcn.00409c6e
add esp, 0xc
test eax, eax
je 0x403818
push esi
call fcn.004077ce
inc edi
add esp, 4
cmp edi, 5
jl 0x4037d1
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2020]
xor ecx, esp
call fcn.00408118
add esp, 0x2024
ret
push 0x1000
push esi
push ebx
call fcn.004042b0
push esi
call fcn.004077ce
mov ecx, dword [esp + 0x203c]
add esp, 0x10
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00408118
add esp, 0x2024
ret
Function at 0x403e30
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.004088d0
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
mov ebx, dword [esp + 0x1014]
push esi
push edi
mov edi, dword [esp + 0x1018]
push 0x418200
push eax
call fcn.004025a0
push ebx
push edi
mov esi, eax
call fcn.00403cb0
add esp, 0x10
xor ebx, ebx
mov edi, eax
test esi, esi
je 0x403f2c
test edi, edi
je 0x403f2c
push esi
call fcn.00407e06
add esp, 4
test eax, eax
jne 0x403f03
push esi
push 1
lea eax, [esp + 0x14]
push 0x1000
push eax
call fcn.00407a52
add esp, 0x10
cmp eax, 0xffffffff
jne 0x403ec2
push esi
call fcn.00407e2e
add esp, 4
test eax, eax
je 0x403ee8
push esi
jmp 0x403ef8
push edi
push 1
lea ecx, [esp + 0x14]
push 0x1000
push ecx
call fcn.00407ccc
add esp, 0x10
test eax, eax
jle 0x403ef7
push edi
call fcn.00407e2e
add esp, 4
test eax, eax
jne 0x403ef7
push esi
call fcn.00407e06
add esp, 4
test eax, eax
je 0x403e98
jmp 0x403f03
push edi
call fcn.0040a243
add esp, 4
or ebx, 0xffffffff
push esi
call fcn.004076c6
push edi
call fcn.004076c6
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00408118
add esp, 0x1004
ret
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.00408118
add esp, 0x1004
ret
Function at 0x403f90
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x2068
call fcn.004088d0
mov eax, dword [0x41f004]
xor eax, esp
mov dword [esp + 0x2064], eax
mov eax, dword [esp + 0x206c]
push esi
push 0x1000
push eax
lea eax, [esp + 0x70]
xor esi, esi
push eax
mov dword [esp + 0x10], esi
call fcn.004043a0
push 1
push 0x16
call fcn.0040a71b
push 1
push 2
call fcn.0040a71b
push 1
push 0xf
call fcn.0040a71b
push 1
push 0x15
call fcn.0040a71b
add esp, 0x2c
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov edx, 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], dx
call fcn.00408127
push eax
call fcn.004098c3
push eax
call fcn.0040a355
mov dword [esp + 0x64], eax
call fcn.00408127
add eax, 0x20
push eax
call fcn.004098c3
push eax
call fcn.0040a355
mov dword [esp + 0x70], eax
call fcn.00408127
add eax, 0x40
push eax
call fcn.004098c3
push eax
call fcn.0040a355
add esp, 0x18
mov dword [esp + 0x64], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push esi
push esi
push esi
push 1
push esi
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop esi
test eax, eax
je 0x4040d5
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
lea edx, [esp]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp]
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.00408118
add esp, 0x2068
ret
push str.Error_creating_child_process__n
call fcn.00401750
mov ecx, dword [esp + 0x2068]
add esp, 4
xor ecx, esp
or eax, 0xffffffff
call fcn.00408118
add esp, 0x2068
ret
Function at 0x408118
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f004]
jne 0x408122
repz ret
jmp fcn.0040e3a6

Function at 0x413003
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41302a
call fcn.0040b969
mov dword [eax], esi
call fcn.0040b956
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040b459
mov eax, esi
jmp 0x41307f
test dword [ebp + 0xc], 0xfffffff9
jne 0x413010
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x413057
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b97c
pop ecx
call fcn.0040b956
mov eax, dword [eax]
jmp 0x41307f
test al, 0x10
jne 0x41307d
test al, 1
je 0x41307d
test byte [ebp + 0xc], 2
je 0x41307d
call fcn.0040b969
mov dword [eax], 5
call fcn.0040b956
mov dword [eax], 0xd
jmp 0x41304e
xor eax, eax
pop esi
pop ebp
ret
Function at 0x413a00
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41f004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b4a0
and dword [ebp - 0x14], 0
cmp dword [0x42ce74], 0
mov dword [ebp - 0x18], eax
jne 0x413ab3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x413b5b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x413b5b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42ce74], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42ce78], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42ce7c], eax
call edi
push eax
call esi
mov dword [0x42ce84], eax
test eax, eax
je 0x413ab3
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42ce80], eax
mov eax, dword [0x42ce80]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x413b0c
cmp dword [0x42ce84], ecx
je 0x413b0c
push eax
call esi
push dword [0x42ce84]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x413b0c
test ebx, ebx
je 0x413b0c
call edi
test eax, eax
je 0x413b03
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x413b03
test byte [ebp - 8], 1
jne 0x413b0c
or dword [ebp + 0x10], 0x200000
jmp 0x413b3f
mov eax, dword [0x42ce78]
cmp eax, dword [ebp - 0x18]
je 0x413b3f
push eax
call esi
test eax, eax
je 0x413b3f
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x413b3f
mov eax, dword [0x42ce7c]
cmp eax, dword [ebp - 0x18]
je 0x413b3f
push eax
call esi
test eax, eax
je 0x413b3f
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42ce74]
call esi
test eax, eax
je 0x413b5b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x413b5d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408118
leave
ret