joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406540
Capabilities:
Set current directory

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x104
test eax, eax
push 0x104
je 0x406571
mov edx, dword [esp + 0x10c]
lea ecx, [esp + 4]
push ecx
push eax
push edx
call sub.procs.dll_GetModulePath
test eax, eax
jne 0x40658e
add esp, 0x104
ret
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 4]
push eax
push ecx
call sub.procs.dll_GetProcessPath
test eax, eax
jne 0x40658e
add esp, 0x104
ret
lea edx, [esp]
push edx
call fcn.00401ad0
add esp, 4
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, 1
add esp, 0x104
ret

Function at 0x4065c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x110]
push edi
push esi
call fcn.004064e0
add esp, 4
test eax, eax
jne 0x4065fc
mov eax, dword [esp + 0x110]
push str.Process_not_active_anymore__
push eax
call fcn.004043a0
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x104
ret
mov eax, dword [0x41e270]
mov edi, dword [esp + 0x110]
test eax, eax
je 0x406645
push esi
lea ecx, [esp + 0xc]
push str.Are_you_sure_you_want_to_kill_this_process__PID:_0x_08lX___
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [str.Agreement]
add esp, 0xc
lea eax, [esp + 8]
push 0x24
push edx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x406645
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40666f
push str.Couldnt_receive_process_handle_:_
push edi
call fcn.004043a0
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x104
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40669c
push str._TerminateProcess__failed__
push edi
call fcn.004043a0
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x104
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x104
ret

Function at 0x406830
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
push esi
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x406859
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x10]
push 0
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
ret
Function at 0x4081b0
Capabilities:
Read .ini file

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
push 0x41e540
push 0x41e140
call ebx
push 0x41e140
call fcn.00401b00
mov eax, dword [str.LordPE.iNi]
add esp, 4
push eax
push 0x41e140
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, 1
xor edi, edi
push 0x41b364
push 0x41e290
mov dword [0x41e260], esi
mov dword [0x41e264], esi
mov dword [0x41e268], esi
mov dword [0x41e26c], edi
mov dword [0x41e270], edi
mov dword [0x41e274], esi
mov dword [0x41e278], edi
mov dword [0x41e27c], 2
mov dword [0x41e280], esi
mov dword [0x41e284], edi
mov dword [0x41e288], edi
mov dword [0x41e28c], esi
call ebx
mov edx, dword [str.Current]
mov eax, dword [0x41c420]
xor ecx, ecx
push 0x41e140
mov dword [0x41e398], ecx
push 0x180
mov dword [0x41e39c], ecx
push 0x41e260
mov dword [0x41e3a0], ecx
push edx
push eax
mov dword [0x41e394], esi
mov dword [0x41e3a4], ecx
mov dword [0x41e3a8], esi
mov dword [0x41e3ac], edi
mov dword [0x41e3b0], esi
mov dword [0x41e3b4], edi
mov dword [0x41e3b8], esi
mov dword [0x41e3bc], 2
mov dword [0x41e3c0], esi
mov dword [0x41e3c4], esi
mov dword [0x41e3c8], esi
mov dword [0x41e3cc], edi
mov dword [0x41e3d0], edi
mov dword [0x41e3d4], 0x400000
mov dword [0x41e3d8], edi
mov dword [0x41e3dc], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructA]
pop edi
pop esi
pop ebx
ret

Function at 0x4089c0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x120
mov eax, dword [esp + 0x130]
mov ecx, 1
test eax, eax
mov dword [esp], ecx
jbe 0x408a9d
push ebx
mov ebx, dword [esp + 0x128]
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
push esi
mov esi, dword [esp + 0x138]
push edi
mov edi, dword [esp + 0x138]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
push ebx
push eax
lea ecx, [esp + 0x28]
push str._sfile_shell_scommand
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x1c]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x20]
push edx
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x408a49
mov dword [esp + 0x10], 0
jmp 0x408a7c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x18]
push eax
push edi
push 1
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x408a71
mov dword [esp + 0x10], 0
jmp 0x408a7c
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
add esi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x408a01
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
mov eax, ecx
add esp, 0x120
ret
Function at 0x408bb0
Capabilities:
Set current directory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x150
test eax, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
je 0x408c43
push eax
push 0x41dec0
call esi
push 0x41dec0
call fcn.00402090
add esp, 4
test eax, eax
je 0x408c07
push 0x42024
push str.PE_Editor___Please_choose...
push str.This_file_has_its_readonly_attributes_set._nCan_I_wipe_it_out__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x408c07
push 0x41dec0
call fcn.004020b0
add esp, 4
push 0x41dec0
call fcn.00415890
add esp, 4
test eax, eax
je 0x408c95
push 0x41dec0
call fcn.00415a30
add esp, 4
test eax, eax
je 0x408c95
mov ecx, dword [0x41e760]
push eax
push ecx
call fcn.004159b0
add esp, 8
xor eax, eax
pop esi
add esp, 0x150
ret
lea eax, [esp + 4]
push eax
call fcn.004017b0
mov ecx, dword [0x41e760]
mov edx, dword [str..exe__.dll__.dmp]
add esp, 4
lea eax, [esp + 4]
mov byte [0x41dec0], 0
mov dword [esp + 0x20], 0x41dec0
push eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x3c], 0x1804
mov dword [esp + 0x14], edx
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
jne 0x408bcd
pop esi
add esp, 0x150
ret
lea edx, [esp + 0x50]
push 0x41dec0
push edx
call esi
lea eax, [esp + 0x50]
push eax
call fcn.00401ad0
add esp, 4
lea ecx, [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edx, dword [0x41e760]
mov eax, dword [0x41e75c]
push 0
push 0x408cf0
push edx
push 0x66
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0x41dec0
call fcn.00415a00
add esp, 4
mov eax, 1
pop esi
add esp, 0x150
ret
Function at 0x415f30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4194d8
push 0x4181f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x16c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call fcn.0040a1a0
mov ebx, eax
xor esi, esi
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x68]
push eax
call fcn.004017b0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x178]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx]
mov dword [ebp - 0x178], ecx
mov edx, dword [ebx + 4]
mov dword [ebp - 0x174], edx
lea eax, [ebp - 0x178]
push eax
call fcn.00416450
add esp, 8
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x5c], 0x41b228
mov edi, dword [ebp + 8]
mov dword [ebp - 0x64], edi
lea edx, [ebp - 0x68]
push edx
call sub.comdlg32.dll_GetSaveFileNameA
test eax, eax
je 0x4160fe
mov eax, dword [ebx + 0x10]
push eax
call fcn.00401a60
add esp, 4
mov dword [ebp - 0x70], eax
cmp eax, esi
jne 0x416001
mov ecx, dword [str.Not_enough_memory__]
push ecx
push edi
call fcn.004043a0
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov ecx, dword [ebx + 0x10]
mov esi, dword [ebx + 0x14]
add esi, dword [0x41dfcc]
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], 0xffffffff
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x416082
mov ecx, dword [str.File_access_error__]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004043a0
add esp, 8
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x70]
push ecx
call fcn.00401a90
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebx + 0x10]
push ecx
mov edx, dword [ebp - 0x70]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push str.Section_saved_successfully_to_disk_:_
mov eax, dword [ebp + 8]
push eax
call fcn.004043e0
add esp, 8
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x70]
push ecx
call fcn.00401a90
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7056e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x294000]
push edi
or ebp, 0xffffffff
jmp 0x705702
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x705709
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7056f8
mov eax, 1
add ebx, ebx
jne 0x70571b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x70572c
jne 0x70573c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x70573c
dec eax
add ebx, ebx
jne 0x705738
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x705710
xor ecx, ecx
sub eax, 3
jb 0x705754
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7057c6
sar eax, 1
mov ebp, eax
jmp 0x70575f
add ebx, ebx
jne 0x70575f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x70576c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x705790
inc ecx
add ebx, ebx
jne 0x70577c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x705771
jne 0x70578d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x705771
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7057b0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7057a1
jmp 0x7056fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7057b0
add edi, ecx
jmp 0x7056fe
pop esi
mov edi, esi
mov ecx, 0x54d9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7057ce
cmp byte [edi], 0x1e
jne 0x7057ce
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x7057d3
lea edi, [esi + 0x302000]
mov eax, dword [edi]
or eax, eax
je 0x705842
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3070c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3071b8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x705800
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3071bc]
or eax, eax
je 0x70583c
mov dword [ebx], eax
add ebx, 4
jmp 0x70581d
call dword [esi + 0x3071c0]
popal
jmp 0x4a8a10
Function at 0x4034ff
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x88c1cc], 0x594
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
jne 0x403539
push 0x402ca8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x427148]
mov edi, dword [0x42714c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
call fcn.004034f8
mov eax, dword [0x427150]
add dword [ebp - 0x14], 0x23f
mov ebx, dword [0x427154]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl ecx, 4
cmp dword [0x88c1cc], 0xc
mov dword [ebp - 4], ecx
jne 0x4035d6
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x440]
push eax
push esi
push 0x402cc8
push 0x402ce8
push 0x402d08
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
add dword [ebp - 4], ecx
mov ecx, dword [0x88c1cc]
cmp ecx, 0xfa9
jne 0x4035f4
mov dword [0x88c1c8], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x403602
mov dword [0x865364], esi
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
shr eax, cl
mov dword [0x88c1c4], 0xf4ea3dee
add eax, ebx
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x88c1cc], 0x213
mov dword [ebp - 0x18], ecx
jne 0x403641
push esi
push 0x402d20
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x88c1cc], 0xc
jne 0x403674
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0xc40]
push eax
push 0x402d78
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
add eax, edi
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
call fcn.004034f1
dec dword [ebp - 0x1c]
jne 0x40356e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4036c4
Capabilities:
Create pipe
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x88c1cc]
mov ecx, dword [0x865368]
sub esp, 0x42c
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4037b8
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x88c1cc], 0x959
jne 0x4037a4
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402d4c
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x402e30
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402e40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.004034ff
add ebx, 8
dec dword [ebp - 4]
jne 0x4036ed
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40388a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4245f4
call fcn.00424500
mov eax, 0x1828
call fcn.0040faf0
push ebx
push esi
xor esi, esi
cmp dword [0x88c1cc], 0x5b1
push edi
jne 0x40393e
push esi
lea eax, [ebp - 0x834]
push eax
push esi
push 0x402ecc
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
call dword [sym.imp.KERNEL32.dll_SetLocalTime]
lea eax, [ebp - 0x34]
call fcn.00403b9a
push esi
mov dword [ebp - 4], esi
call fcn.0040472f
call fcn.004046cd
lea ecx, [ebp - 0x18]
mov dword [esp], 0x402f34
call fcn.004033b0
lea ecx, [ebp - 0x18]
call fcn.004033cc
lea ecx, [ebp - 0x18]
call fcn.00403412
lea ecx, [ebp - 0x18]
call fcn.0040342b
push esi
push esi
call fcn.00404bfe
push esi
call fcn.00404bcf
push esi
call fcn.00404bb8
push esi
call fcn.00404d77
add esp, 0x10
mov dword [esp], esi
call fcn.004034d2
fstp st(0)
push esi
call fcn.00404bb8
pop ecx
call fcn.00404c91
add dword [0x88c1cc], 0x1134b
push dword [0x88c1cc]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x865368], eax
call fcn.004037d5
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, 0x206d47
jg 0x403987
inc edi
cmp edi, 0x4f6a4
jl 0x403967
mov eax, dword [0x88c1cc]
xor ecx, ecx
cmp eax, esi
jbe 0x4039ad
mov edx, dword [0x88cc30]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x865368]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x403992
xor edi, edi
lea ecx, [eax + edi]
cmp ecx, 0xe
jne 0x4039fc
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [ebp - 0x434]
push eax
push esi
push 0x402f48
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402f90
push 0x402fac
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
lea eax, [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov eax, dword [0x88c1cc]
inc edi
cmp edi, 0x39621
jl 0x4039af
call fcn.004036c4
xor edi, edi
call ebx
cmp edi, 0x26
jne 0x403a18
call fcn.004037bb
inc edi
cmp edi, 0x6753f
jl 0x403a0c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x7b
pop ebx
cmp dword [0x88c1cc], 0x86
jne 0x403a73
push 0x402fbc
push 0x402fd8
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push esi
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push esi
lea eax, [ebp - 0x1034]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [0x88c1cc], 0xf
jne 0x403a9b
push esi
push esi
call edi
push esi
lea eax, [ebp - 0x1834]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0x402fe8
push 0x403020
call edi
dec ebx
jne 0x403a2a
push 0x403074
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40546b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42646c]
jne 0x405475
repz ret
jmp fcn.0040942c

Function at 0x40c37b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407456
and dword [ebp - 4], 0
cmp dword [0x42ac4c], 0
mov ebx, eax
jne 0x40c42c
push 0x4022c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c4dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4022b8
push edi
call esi
test eax, eax
je 0x40c4dd
push eax
call fcn.004073e4
mov dword [esp], 0x4022a8
push edi
mov dword [0x42ac4c], eax
call esi
push eax
call fcn.004073e4
mov dword [esp], 0x402294
push edi
mov dword [0x42ac50], eax
call esi
push eax
call fcn.004073e4
mov dword [esp], 0x402278
push edi
mov dword [0x42ac54], eax
call esi
push eax
call fcn.004073e4
pop ecx
mov dword [0x42ac5c], eax
test eax, eax
je 0x40c42c
push 0x402260
push edi
call esi
push eax
call fcn.004073e4
pop ecx
mov dword [0x42ac58], eax
mov eax, dword [0x42ac58]
cmp eax, ebx
je 0x40c484
cmp dword [0x42ac5c], ebx
je 0x40c484
push eax
call fcn.0040745f
push dword [0x42ac5c]
mov esi, eax
call fcn.0040745f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c484
test edi, edi
je 0x40c484
call esi
test eax, eax
je 0x40c47b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c47b
test byte [ebp - 0xc], 1
jne 0x40c484
or dword [ebp + 0x10], 0x200000
jmp 0x40c4bd
mov eax, dword [0x42ac50]
cmp eax, ebx
je 0x40c4bd
push eax
call fcn.0040745f
pop ecx
test eax, eax
je 0x40c4bd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c4bd
mov eax, dword [0x42ac54]
cmp eax, ebx
je 0x40c4bd
push eax
call fcn.0040745f
pop ecx
test eax, eax
je 0x40c4bd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42ac4c]
call fcn.0040745f
pop ecx
test eax, eax
je 0x40c4dd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c4df
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret