joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aff0
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x424
mov eax, dword [0x42d278]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push ebp
mov ebp, dword [0x43579c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x429cc0
call esi
push eax
push 0x429cc0
push 0x434ec0
call fcn.0040f9dd
add esp, 0xc
xor ebx, ebx
test eax, eax
jne 0x40b0ea
jmp 0x40b040
movzx ecx, word [eax + 0x434ec0]
mov word [esp + eax + 0x1c], cx
add eax, 2
cmp cx, bx
jne 0x40b040
lea eax, [esp + 0x1c]
push eax
call esi
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
lea esi, [esp + eax*2 + 0x22]
call fcn.00410f54
add esp, 8
cmp eax, esi
je 0x40b095
push edi
lea edi, [esp + 0x20]
add edi, 0xfffffffe
lea ebx, [ebx]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x40b080
mov edx, dword [0x429d84]
mov dword [edi], edx
pop edi
lea eax, [esp + 0x20]
push 0x5c
push eax
call fcn.0040f9bb
add esp, 8
cmp eax, ebx
je 0x40b1f7
add eax, 2
push 0x5c
push eax
call fcn.0040f9bb
add esp, 8
cmp eax, ebx
je 0x40b1f7
lea ecx, [esp + 0x1c]
sub eax, ecx
sar eax, 1
mov esi, eax
lea edx, [esi + 1]
push edx
mov eax, ecx
push eax
lea ecx, [esp + 0x22c]
push ecx
call fcn.0040ead2
mov word [esp + esi*2 + 0x232], bx
jmp 0x40b157
mov eax, 0x434ec0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40b0f2
sub eax, edx
sar eax, 1
cmp eax, 2
jb 0x40b119
cmp word [0x434ec2], 0x3a
jne 0x40b119
push 2
push 0x434ec0
jmp 0x40b138
lea eax, [esp + 0x1c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40b1f7
push 2
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x22c]
push edx
call fcn.0040ead2
mov word [esp + 0x234], 0x5c
mov word [esp + 0x236], bx
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x40b211
push 0x40
push str.GetDiskFreeSpace2
push 0x4352f0
mov dword [0x4352e8], 0xcb
call fcn.0040ead2
add esp, 0xc
mov word [0x435370], bx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x104
push 0x434ec0
push 0x435370
mov dword [0x4352ec], eax
call fcn.0040ead2
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x435578
mov word [0x435576], bx
call fcn.0040ead2
add esp, 0x18
mov word [0x43577e], bx
mov dword [0x435780], 0xea1
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0040eac3
add esp, 0x424
ret
xor edx, edx
mov eax, ebp
div dword [esp + 0x14]
cmp edx, ebx
je 0x40b220
add eax, 1
xor edx, edx
div dword [esp + 0x10]
cmp edx, ebx
je 0x40b22d
add eax, 1
cmp dword [esp + 0xc], eax
jae 0x40b293
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x435578
mov dword [0x4352e8], 0xffffef30
mov word [0x435370], bx
mov dword [0x4352ec], ebx
mov word [0x435576], bx
call fcn.0040ead2
add esp, 0xc
pop esi
pop ebp
mov word [0x43577e], bx
mov dword [0x435780], 0xeb8
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0040eac3
add esp, 0x424
ret
mov ecx, dword [esp + 0x42c]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0040eac3
add esp, 0x424
ret
Function at 0x40dd00
Capabilities:
Get file version info
Link many functions at runtime

Disassembly:
sub esp, 0x250
mov eax, dword [0x42d278]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
xor edi, edi
push str.sflog.dll
mov dword [esp + 0x10], edi
call esi
test eax, eax
mov dword [0x4357c4], eax
je 0x40de9c
push str.sfcommon.dll
call esi
test eax, eax
mov dword [0x4357c8], eax
je 0x40deb6
mov ecx, dword [0x4357c4]
push 0x104
lea eax, [esp + 0x54]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x54]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [esp + 0x10], eax
je 0x40de9c
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x40de9c
mov ecx, dword [esp + 0x10]
push ebx
push ecx
push edi
lea edx, [esp + 0x5c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x429d84
push ebx
call sub.VERSION.dll_VerQueryValueW
mov esi, dword [esp + 0x14]
mov ecx, 0xd
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x10
cmp ax, 7
jb 0x40de81
jne 0x40ddeb
cmp cx, 0x32
jb 0x40de81
mov edx, dword [0x4357c4]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.sflog_log_init
push edx
call esi
test eax, eax
mov dword [0x4357cc], eax
je 0x40de81
mov eax, dword [0x4357c4]
push str.sflog_set_UserNameW
push eax
call esi
test eax, eax
mov dword [0x4357d0], eax
je 0x40de81
mov ecx, dword [0x4357c4]
push str.sflog_log_writeAccessFltW
push ecx
call esi
test eax, eax
mov dword [0x4357d4], eax
je 0x40de81
mov edx, dword [0x4357c4]
push str.sflog_log_term
push edx
call esi
test eax, eax
mov dword [0x4357d8], eax
je 0x40de81
mov eax, dword [0x4357c8]
push str.sfcm_reg_GetValueW
push eax
call esi
test eax, eax
mov dword [0x4357dc], eax
je 0x40de81
mov ecx, dword [0x4357c8]
push str.sfcm_misc_GetUNCPath
push ecx
call esi
test eax, eax
mov dword [0x4357e0], eax
je 0x40de81
mov dword [esp + 0xc], 1
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [esp + 0xc], 0
jne 0x40deea
mov edi, dword [esp + 0xc]
mov eax, dword [0x4357c8]
test eax, eax
je 0x40deb6
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4357c8], 0
mov eax, dword [0x4357c4]
test eax, eax
je 0x40ded0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4357c4], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24c]
xor ecx, esp
call fcn.0040eac3
add esp, 0x250
ret
mov ecx, dword [esp + 0x258]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040eac3
add esp, 0x250
ret
Function at 0x40df10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x854
mov eax, dword [0x42d278]
xor eax, esp
mov dword [esp + 0x84c], eax
push ebx
push ebp
push esi
push edi
push 0x105
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
push ebx
mov ebp, 1
mov byte [esp + 0x23], bl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x20]
call fcn.00401800
cmp dword [0x4352e8], ebx
mov esi, eax
je 0x40df5e
xor ebp, ebp
jmp 0x40e113
call fcn.004014f0
cmp dword [0x4352e8], ebx
movzx eax, ax
jne 0x40e0f9
cmp ax, 0xffff
je 0x40dffe
lea esp, [esp]
movsx eax, ax
cmp eax, 0x110
jg 0x40dfb1
je 0x40dfd1
cmp eax, 0x105
jg 0x40e0d7
cmp eax, 0x101
jge 0x40dfd1
cmp eax, 2
jl 0x40e12e
cmp eax, 6
jle 0x40dfd1
cmp eax, 0x10
jmp 0x40dfcb
cmp eax, 0x220
jg 0x40dfc6
je 0x40dfd1
sub eax, 0x200
je 0x40dfd1
sub eax, 0x10
jmp 0x40dfcb
cmp eax, 0x300
jne 0x40e12e
call fcn.00401640
cmp dword [0x4352e8], ebx
jne 0x40e0f9
mov eax, esi
call fcn.004014f0
cmp dword [0x4352e8], ebx
movzx eax, ax
jne 0x40e0f9
cmp ax, 0xffff
jne 0x40df80
mov edx, dword [esi]
push edx
call fcn.0040f238
add esp, 4
push esi
call fcn.0040f5d8
add esp, 4
cmp byte [esp + 0x17], bl
je 0x40e113
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 1
call esi
push ebx
mov edi, eax
push ebx
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00411bc1
add esp, 0x14
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x440]
push str._s_s
push edx
call fcn.0040f88a
add esp, 0x10
lea eax, [esp + 0x648]
push eax
push ebx
push 0x42a164
lea ecx, [esp + 0x444]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40e176
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x435578
mov dword [0x4352e8], 0xffffef1a
mov word [0x435370], bx
mov dword [0x4352ec], ebx
mov word [0x435576], bx
call fcn.0040ead2
add esp, 0xc
push edi
mov word [0x43577e], bx
mov dword [0x435780], 0x163f
xor ebp, ebp
call esi
jmp 0x40e113
cmp eax, 0x106
jne 0x40e12e
lea ecx, [esp + 0x17]
push ecx
mov ecx, esi
call fcn.00402890
add esp, 4
cmp dword [0x4352e8], ebx
je 0x40dffe
xor ebp, ebp
cmp esi, ebx
je 0x40e113
mov eax, dword [esi]
push eax
call fcn.0040f238
add esp, 4
push esi
call fcn.0040f5d8
add esp, 4
mov ecx, dword [esp + 0x85c]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0040eac3
add esp, 0x854
ret
push 0x104
push str....._src_sfslfdec_sfmkcore.c
push 0x435578
mov dword [0x4352e8], 8
mov word [0x435370], bx
mov dword [0x4352ec], ebx
mov word [0x435576], bx
call fcn.0040ead2
add esp, 0xc
mov word [0x43577e], bx
mov dword [0x435780], 0x161c
jmp 0x40e0f9
lea edx, [esp + 0x648]
push edx
call fcn.00403440
push edi
call esi
jmp 0x40e113
Function at 0x40e190
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x42d278]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
xor ebx, ebx
push 0x110
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.00414e60
add esp, 0xc
cmp edi, ebx
je 0x40e25e
cmp ebp, ebx
je 0x40e25e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40e25e
push str.SetDefaultDllDirectories
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40e25e
push 0x800
call eax
cmp eax, ebx
je 0x40e25e
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40e25e
mov eax, dword [esp + 0x10]
cmp eax, 7
jae 0x40e259
cmp eax, 6
jb 0x40e22d
cmp dword [esp + 0x14], 2
jae 0x40e259
push 4
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x40e25e
mov ebx, str.sspicli.dll
call fcn.004044b0
mov dword [esi], eax
mov dword [edi], esi
mov dword [ebp], 1
mov ebx, 1
mov ecx, dword [esp + 0x120]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040eac3
add esp, 0x118
ret
Function at 0x40e2e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x238
mov eax, dword [0x42d278]
xor eax, esp
mov dword [esp + 0x234], eax
push esi
push edi
push 0x42a7e8
push str.wininit.ini
call fcn.0040f83e
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 8], 0xfeff
jne 0x40e3d3
push eax
push 0x80
push 1
push eax
push eax
push 0x40000000
push str.wininit.ini
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e36c
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x40e385
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.0040eac3
add esp, 0x238
ret
push 0
lea edx, [esp + 0x38]
push 0x42a7ec
push edx
call fcn.0040f88a
lea eax, [esp + 0x40]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e3a0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x40]
push eax
push esi
call edi
test eax, eax
je 0x40e356
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40e45d
lea ecx, [esp + 0x10]
push ecx
push str.wininit.ini
call fcn.004104c8
add esp, 8
cmp dword [esp + 0x24], 0
jne 0x40e454
push esi
call fcn.0040f238
push 0x42a7f8
push str.wininit.ini
call fcn.0040f83e
mov esi, eax
push esi
push 1
lea edx, [esp + 0x1c]
push 2
push edx
call fcn.0040f144
push 0
lea eax, [esp + 0x54]
push 0x42a7ec
push eax
call fcn.0040f88a
lea eax, [esp + 0x5c]
add esp, 0x28
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e430
sub eax, edx
push esi
sar eax, 1
push 1
lea ecx, [eax + eax + 2]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.0040f144
add esp, 0x10
push esi
call fcn.0040f238
add esp, 4
push str.wininit.ini
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
xor ecx, esp
call fcn.0040eac3
add esp, 0x238
ret
Function at 0x40e490
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
test ebx, ebx
je InitCommonControls
test esi, esi
je InitCommonControls
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0x42
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
push 0x21
jne 0x40e4cc
push esi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
pop edi
pop ebp
pop ebx
ret
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ebx, eax
test ebx, ebx
je 0x40e503
mov edx, 0x21
mov ecx, esi
mov eax, edi
call fcn.0040e280
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push 0
mov ebx, eax
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
push edi
mov dword [esi + 0x1c], eax
push eax
mov byte [esi + 0x20], al
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
xor eax, eax
pop ebx
ret

Function at 0x40eac3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d278]
jne 0x40eacd
repz ret
jmp fcn.00414180
Function at 0x40ed2e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x40ed6b
cmp dword [ebp + 0x14], edi
je 0x40ed6b
cmp ecx, edi
jne 0x40ed72
call fcn.0041083d
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0041490c
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x40ed86
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x40eda7
cmp ebx, 0xffffffff
je 0x40ed96
push ebx
push edi
push ecx
call fcn.00414e60
add esp, 0xc
cmp esi, edi
je 0x40ed53
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x40ed53
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x40edc3
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x40edca
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x40eebb
test word [esi + 0xc], 0x10c
je 0x40ee1e
mov eax, dword [esi + 4]
test eax, eax
je 0x40ee1e
jl 0x40ef1c
cmp ebx, eax
mov edi, ebx
jb 0x40edef
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x40eec3
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00414de2
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x40eeb3
cmp ebx, dword [ebp - 0xc]
jb 0x40ee8b
cmp dword [ebp - 0xc], 0
je 0x40ee48
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x40ee3d
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x40ee44
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x40ee53
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x40ee53
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x40eeef
push eax
push dword [ebp - 8]
push esi
call fcn.004147d9
pop ecx
push eax
call fcn.004118b6
add esp, 0xc
test eax, eax
je 0x40ef2e
cmp eax, 0xffffffff
je 0x40ef1c
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x40eeb3
push esi
call fcn.00414cc2
cmp eax, 0xffffffff
pop ecx
je 0x40ef20
cmp dword [ebp - 4], 0
je 0x40eeef
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x40edd2
mov eax, dword [ebp + 0x14]
jmp 0x40ed6d
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x40eeda
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00414e60
add esp, 0xc
call fcn.0041083d
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x40ed63
cmp dword [ebp + 0xc], 0xffffffff
je 0x40ef05
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00414e60
add esp, 0xc
call fcn.0041083d
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x40ed63
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x40ed6d
or dword [esi + 0xc], 0x10
jmp 0x40ef20
Function at 0x40f920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x40f94d
call fcn.00410850
mov dword [eax], esi
call fcn.0041083d
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041490c
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x40f929
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40f97c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00410863
pop ecx
call fcn.0041083d
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x40f9a3
test al, 1
je 0x40f9a3
test byte [esp + 0xc], 2
je 0x40f9a3
call fcn.00410850
mov dword [eax], 5
call fcn.0041083d
mov dword [eax], 0xd
jmp 0x40f973
xor eax, eax
pop esi
ret
Function at 0x416322
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x42d670]
je 0x41633d
inc edi
cmp edi, 0x17
jb 0x41632e
cmp edi, 0x17
jae 0x4164bd
push ebp
push 3
call fcn.0041fc32
cmp eax, 1
pop ecx
je 0x416489
push 3
call fcn.0041fc32
test eax, eax
pop ecx
jne 0x416371
cmp dword [0x42d274], 1
je 0x416489
cmp ebx, 0xfc
je 0x4164bc
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4347e8
push ebp
call fcn.00418853
add esp, 0xc
test eax, eax
je 0x4163a7
push esi
push esi
push esi
push esi
push esi
call fcn.00414810
add esp, 0x14
push 0x104
mov esi, 0x434801
push esi
push 0
mov byte [0x434905], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4163eb
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00418853
add esp, 0xc
test eax, eax
je 0x4163eb
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00414810
add esp, 0x14
push esi
call fcn.0041c880
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x416430
push esi
call fcn.0041c880
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x434afc
push 0x426a04
sub ecx, eax
push ecx
push eax
call fcn.0041bfd6
add esp, 0x14
test eax, eax
je 0x416430
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00414810
add esp, 0x14
jmp 0x416432
xor esi, esi
push 0x426a00
push ebx
push ebp
call fcn.0041bf10
add esp, 0xc
test eax, eax
je 0x416452
push esi
push esi
push esi
push esi
push esi
call fcn.00414810
add esp, 0x14
push dword [edi*8 + 0x42d674]
push ebx
push ebp
call fcn.0041bf10
add esp, 0xc
test eax, eax
je 0x416474
push esi
push esi
push esi
push esi
push esi
call fcn.00414810
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0041fa75
add esp, 0xc
jmp 0x4164bc
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4164bc
cmp ebp, 0xffffffff
je 0x4164bc
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x42d674]
push dword [esi]
call fcn.0041c880
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41fa75
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0041752b
xor ebx, ebx
cmp dword [0x434e68], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x41fb4b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x41fc2b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x41fc2b
push eax
call fcn.004174bd
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434e68], eax
call esi
push eax
call fcn.004174bd
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x434e6c], eax
call esi
push eax
call fcn.004174bd
mov dword [0x434e70], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004160af
test eax, eax
pop ecx
pop ecx
je 0x41fb19
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00414810
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x41fb4b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004174bd
cmp eax, ebx
pop ecx
mov dword [0x434e78], eax
je 0x41fb4b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004174bd
pop ecx
mov dword [0x434e74], eax
mov eax, dword [0x434e74]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x41fbd0
cmp dword [0x434e78], ecx
je 0x41fbd0
push eax
call fcn.00417534
push dword [0x434e78]
mov esi, eax
call fcn.00417534
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x41fbd0
cmp edi, ebx
je 0x41fbd0
call esi
cmp eax, ebx
je 0x41fb9d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41fb9d
test byte [ebp - 0x18], 1
jne 0x41fbd0
lea eax, [ebp - 0x10]
push eax
call fcn.004160e6
test eax, eax
pop ecx
je 0x41fbb8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00414810
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x41fbc7
or dword [ebp + 0x10], 0x200000
jmp 0x41fc0b
or dword [ebp + 0x10], 0x40000
jmp 0x41fc0b
mov eax, dword [0x434e6c]
cmp eax, dword [ebp - 8]
je 0x41fc0b
push eax
call fcn.00417534
cmp eax, ebx
pop ecx
je 0x41fc0b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41fc0b
mov eax, dword [0x434e70]
cmp eax, dword [ebp - 8]
je 0x41fc0b
push eax
call fcn.00417534
cmp eax, ebx
pop ecx
je 0x41fc0b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x434e68]
call fcn.00417534
cmp eax, ebx
pop ecx
je 0x41fc2b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41fc2d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret