joyce8/EMBER2024-capa huggingface dataset:
Function at 0x91be14
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x91be1a
pop ebp
sub ebp, 6
sub ebp, 0x51be14
jmp 0x91be78
jmp 0x91be81
mov eax, 0x51be14
add eax, ebp
add eax, 0x93
mov ecx, 0x5b2
mov edx, 0xea91abbd
xor byte [eax], dl
inc eax
dec ecx
jne 0x91be98
jmp 0x91beab
jo 0x91bee4
xor al, 0x81
mov ebp, 0x7c3cbdbd
inc ebp
mov ebp, 0x70bebdbd
add eax, 0xbdbdbdba
pop es
xchg ebp, eax
mov ebp, 0x5f4abdbd
mov esi, 0xb13c3675
mov ebp, 0x78bebdbd
in eax, dx
in eax, dx
aad 0x15
cmpsb byte [esi], byte es:[edi]
mov bl, 0xbd
aad 0xd4
pop ds
invalid
outsb dx, byte [esi]
push ebp
mov eax, 0x54bdbdbd
xchg edi, eax
mov ebp, 0x30e8bdbd
rcr dword [ecx - 0x4ac7c943], 1
mov ebp, 0x2836bdbd
mov cl, 0xbd
mov ebp, 0xad3036bd
mov ebp, 0x547cbdbd
mov edi, 0x7f3ebf8c
mov ecx, 0x4938b2f4
inc edx
inc edx
inc edx
loopne 0x91bf96
mov cl, 0xbd
xor dword ss:[ecx - 0x42424247], ebx
aad 0x15
cmpsb byte [esi], byte es:[edi]
mov bl, 0xbd
aad 0xd4
pop ds
invalid
xchg esp, eax
jmp 0x7cd07f20

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x13e6f7c
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x18b2625e], al
pop edi
pop ss
inc edi
test al, 0xeb
jmp 0x13e6f86
add byte [eax + 0x2c], al
add byte [eax], al
pushal
call 0x13e6f8c
jmp 0x13e6f86
pushal
call 0x13e6f8c
pop ebp
sub ebp, 0x10
sub ebp, 0xfe6f7c
jmp 0x13e6fa2
mov eax, 0xfe6f7c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a7
mov edx, 0xeb3f0f2f
xor byte [eax], dl
inc eax
dec ecx
jne 0x13e6fb9
jmp 0x13e6fcc
movsb byte es:[edi], byte [esi]
loop 0x13e6f73
cmpsb byte [esi], byte es:[edi]
adc ebp, dword [edi]
das
das
scasb al, byte es:[edi]
out dx, al
xlatb
das
das
das
sub al, 0xe2
xchg edi, eax
sub ch, byte [edi]
das
das
xchg ebp, eax
pop es
das
das
das
fmul st(5)
sub al, 0xe7
movsb byte es:[edi], byte [esi]
scasb al, byte es:[edi]
and ebp, dword [edi]
das
das
sub al, 0xea
mov byte [0xa6d30b4b], al
sub ecx, dword [ebx]
jg 0x13e7042
scasd eax, dword es:[edi]
mov eax, dword [0xd3472f0c]
iretd
and ebp, dword [edi]
movsb byte es:[edi], byte [esi]
mov dword [0x2f2f2b0b], eax
das
inc edi
scasd eax, dword es:[edi]
mov eax, dword [0xd3472f0c]
iretd
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push 0
mov ebp, esp
and esp, 0xfffffff0
sub esp, 4
mov edx, 1
jmp fcn.00463d77
Function at 0x405687
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
nop
push 0x47825c
push 0x471c33
lea eax, [ebp - 0x104]
push eax
call fcn.0045eeda
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x4056e5
push 0x47825c
push str._sCC386_Projects_
push ebx
call fcn.0045eeda
add esp, 0xc
push esi
call sub.KERNEL32.DLL_FindClose
jmp 0x40570a
push ebx
push 0
push 0
push 5
push 0
call sub.shell32.DLL_SHGetFolderPathA
test eax, eax
jne 0x405707
push str.CC386_Projects
push ebx
call fcn.0045f2e4
add esp, 8
jmp 0x40570a
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408464
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
push ebx
push esi
push edi
nop
mov edi, 0x479960
push 0x47825c
lea eax, [ebp - 0x104]
push eax
call fcn.0045f361
add esp, 8
push str._rule.rul
lea eax, [ebp - 0x104]
push eax
call fcn.0045f2e4
add esp, 8
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40857b
push 0x11c
push 1
call fcn.0045bd81
add esp, 8
mov esi, eax
push 0x47825c
mov eax, esi
add eax, 4
push eax
call fcn.0045f361
add esp, 8
push str._rule_
mov eax, esi
add eax, 4
push eax
call fcn.0045f2e4
add esp, 8
lea eax, [ebp - 0x218]
push eax
mov eax, esi
add eax, 4
push eax
call fcn.0045f2e4
add esp, 8
mov dword [esi + 0x110], 1
mov dword [esi + 0x10c], 1
mov eax, esi
add eax, 4
push eax
call fcn.004470ac
pop ecx
mov dword [esi + 0x108], eax
mov eax, dword [esi + 0x108]
test eax, eax
jne 0x40855c
mov eax, esi
add eax, 4
push eax
push str.Rule_file__s_cannot_be_loaded
push 0
push str.Missing_Rule_File
call fcn.00401735
add esp, 0x10
mov dword [esi + 0x110], 0
mov dword [edi], esi
mov edi, esi
lea eax, [ebp - 0x244]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x4084bc
push ebx
call sub.KERNEL32.DLL_FindClose
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409fb1
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
nop
mov ebx, 0x1505
jmp 0x409fca
mov eax, ebx
shl eax, 5
add eax, ebx
xor eax, esi
mov ebx, eax
mov eax, dword [ebp + 8]
inc dword [ebp + 8]
movzx eax, byte [eax]
mov esi, eax
test eax, eax
jne 0x409fbf
mov eax, ebx
and eax, 0x3ff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40bbc8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
nop
mov eax, dword [0x46a220]
test eax, eax
jne 0x40be03
mov eax, dword [0x4949a4]
test eax, eax
je 0x40be03
mov dword [ebp - 0x110], 0
push 1
push dword [0x4949a4]
call fcn.004330ed
add esp, 8
push 0
push dword [0x4949a4]
call fcn.004350f4
add esp, 8
push 0
push dword [0x4949a4]
push str.__DEBUG_EXECUTABLE
call fcn.00434843
add esp, 0xc
mov ebx, eax
push 0
push dword [0x4949a4]
push str.__DEBUG_ARGUMENTS
call fcn.00434843
add esp, 0xc
mov esi, eax
push 0
push dword [0x4949a4]
push str.__DEBUG_WORKING_DIR
call fcn.00434843
add esp, 0xc
mov dword [ebp - 0x108], eax
push dword [ebp - 0x108]
lea eax, [ebp - 0x104]
push eax
call fcn.0045f361
add esp, 8
push dword [ebp - 0x108]
call fcn.0045d549
pop ecx
movsx eax, byte [ebp - 0x104]
test eax, eax
jne 0x40bcb8
push ebx
lea eax, [ebp - 0x104]
push eax
call fcn.0045f361
add esp, 8
push 0x5c
lea eax, [ebp - 0x104]
push eax
call fcn.00460545
add esp, 8
mov edi, eax
test edi, edi
je 0x40bcb8
mov byte [edi], 0
test ebx, ebx
je 0x40bcc9
push ebx
call fcn.00439706
pop ecx
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
test eax, eax
jg 0x40bd34
mov eax, dword [ebp - 0x110]
test eax, eax
jne 0x40bcfb
push 0x484974
push str.File__s_was_not_found
push 0x11000
push 0x472337
call fcn.00401735
add esp, 0x10
jmp 0x40bd17
push 0x484974
push str.File__s_must_be_a_win32_executable_to_debug.
push 0x11000
push 0x472337
call fcn.00401735
add esp, 0x10
call fcn.0043519a
push ebx
call fcn.0045d549
pop ecx
push esi
call fcn.0045d549
pop ecx
mov eax, dword [0x46a220]
jmp 0x40be08
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40bd3e
sub eax, eax
test eax, 0x40c02990
nop
sub eax, eax
inc eax
mov dword [0x48496c], eax
mov dword [0x484968], 1
push 0
push 1
push 0
push 0
call sub.KERNEL32.DLL_CreateSemaphoreA
mov dword [0x484950], eax
push 0
push 1
push 0
push 0
call sub.KERNEL32.DLL_CreateSemaphoreA
mov dword [0x484954], eax
lea eax, [ebp - 0x104]
push eax
push esi
push ebx
push 0x4722e9
lea eax, [0x484974]
push eax
call fcn.0045eeda
add esp, 0x14
push 1
lea eax, [0x484974]
push eax
call fcn.0045f327
add esp, 8
mov byte [eax], 0
call fcn.0043519a
push ebx
call fcn.0045d549
pop ecx
push esi
call fcn.0045d549
pop ecx
lea eax, [ebp - 0x114]
push eax
push 0
lea eax, [0x484974]
push eax
push 0x40caf0
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
call fcn.0043519a
push 0xffffffffffffffff
push dword [0x484950]
call sub.KERNEL32.DLL_WaitForSingleObject
push 0
push 0
push 0x2776
push dword [0x478664]
call sub.USER32.DLL_PostMessageA
mov eax, dword [0x46a220]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c6c1
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
nop
mov eax, dword [0x484964]
mov esi, dword [eax + 0x14]
mov eax, dword [0x46a220]
cmp eax, 6
je 0x40c6f8
mov eax, dword [0x46a220]
cmp eax, 1
je 0x40c6f8
mov eax, dword [0x46a220]
cmp eax, 4
jne 0x40c81f
call sub.KERNEL32.DLL_GetCurrentThread
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetThreadPriority
mov dword [ebp - 8], eax
push dword [0x478664]
call sub.USER32.DLL_SetForegroundWindow
push 0xff
push ebx
call sub.KERNEL32.DLL_SetThreadPriority
jmp 0x40c731
push dword [esi + 0xd8]
call sub.KERNEL32.DLL_SuspendThread
mov esi, dword [esi + 0xcc]
test esi, esi
jne 0x40c720
push 0
call fcn.0040c635
pop ecx
mov eax, dword [0x484964]
mov esi, dword [eax + 0x14]
mov eax, dword [esi + 0xb8]
mov dword [esi + 0xdc], eax
mov eax, dword [0x484964]
mov eax, dword [eax + 0xc]
mov dword [esi + 0xe8], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xed], 0
mov eax, esi
add eax, 0xe4
push eax
mov eax, dword [0x484964]
push dword [eax + 4]
call fcn.004058f4
add esp, 8
push 0
push 0
push 0
push dword [esi + 0xd4]
call sub.USER32.DLL_PostThreadMessageA
push 0
call fcn.0040c67e
pop ecx
push dword [esi + 0xd8]
call sub.KERNEL32.DLL_ResumeThread
dec eax
mov dword [esi + 0xe0], eax
mov eax, dword [esi + 0xe0]
test eax, eax
jns 0x40c7c6
mov dword [esi + 0xe0], 0
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x40c7e0
push dword [esi + 0xd8]
call sub.KERNEL32.DLL_ResumeThread
cmp eax, 1
ja 0x40c7d0
mov esi, dword [esi + 0xcc]
jmp 0x40c7f9
push dword [esi + 0xd8]
call sub.KERNEL32.DLL_ResumeThread
mov esi, dword [esi + 0xcc]
test esi, esi
jne 0x40c7e8
cmp edi, 0xa
je 0x40c808
mov dword [0x46a220], edi
push dword [ebp - 8]
push ebx
call sub.KERNEL32.DLL_SetThreadPriority
mov eax, dword [0x484964]
push dword [eax + 8]
call fcn.0040be5b
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c8d8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, 0x484970
nop
mov eax, dword [esi]
test eax, eax
jne 0x40c8fc
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_CreateEventA
mov dword [esi], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x40c826
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
push 0xffffffffffffffff
push dword [esi]
call sub.KERNEL32.DLL_WaitForSingleObject
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c928
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x104]
nop
test ebx, ebx
je 0x40c949
movsx eax, byte [ebx]
test eax, eax
jne 0x40c94e
jmp 0x40c9e5
push str.SystemRoot_
push ebx
call fcn.00460586
add esp, 8
mov esi, eax
cmp esi, ebx
jne 0x40c9b0
push 0x104
push edi
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
test eax, eax
je 0x40c9ae
push 0x472293
push edi
call fcn.0045f2e4
add esp, 8
push str.SystemRoot_
call fcn.0046038e
pop ecx
add eax, ebx
push eax
push edi
call fcn.0045f2e4
add esp, 8
push edi
push ebx
call fcn.0045f361
add esp, 8
jmp 0x40c9e5
jmp 0x40c9e5
push 0x47228e
push ebx
call fcn.00460586
add esp, 8
mov esi, eax
cmp esi, ebx
jne 0x40c9e5
push 0x47228e
call fcn.0046038e
pop ecx
add eax, ebx
push eax
push edi
call fcn.0045f361
add esp, 8
push edi
push ebx
call fcn.0045f361
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413c33
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
lea edi, [ebp - 0x400]
nop
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push edi
push 0x3fc
push 0xd
push ebx
call sub.USER32.DLL_SendMessageA
mov esi, eax
mov byte [esi + edi], 0
push edi
push dword [ebp + 0x10]
call fcn.0045f361
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4140ca
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
nop
mov esi, dword [edi + 0x10]
test esi, esi
je 0x41412a
push dword [0x486708]
push dword [edi + 0xc]
call sub.USER32.DLL_SetParent
mov dword [edi + 0x10], 0
mov dword [esi + 0x14], 0
mov eax, dword [esi]
cmp eax, 6
jne 0x414118
push 0
push dword [esi + 0xc]
push 0x221
push dword [0x48670c]
call sub.USER32.DLL_SendMessageA
jmp 0x41412a
push 0
push dword [esi + 0xc]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0xc]
call sub.USER32.DLL_DestroyWindow
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414131
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
nop
push edi
call fcn.004140ca
pop ecx
mov eax, dword [edi]
cmp eax, 2
jne 0x414244
push dword [0x486708]
call fcn.0042d7c5
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], edi
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push dword [edi + 0xc]
call sub.USER32.DLL_SetParent
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4141b8
push 1
mov eax, dword [edi + 0x54]
add eax, 0x12
push eax
push 0x21
call sub.USER32.DLL_GetSystemMetrics
mov ecx, eax
pop eax
add eax, ecx
push eax
push 5
call sub.USER32.DLL_GetSystemMetrics
shl eax, 1
add eax, dword [edi + 0x50]
push eax
push dword [esi + 4]
push dword [esi]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call sub.USER32.DLL_MoveWindow
jmp 0x4141eb
push 1
push 6
call sub.USER32.DLL_GetSystemMetrics
shl eax, 1
add eax, dword [edi + 0x4c]
push eax
mov eax, dword [edi + 0x48]
add eax, 0x12
push eax
push 0x20
call sub.USER32.DLL_GetSystemMetrics
mov ecx, eax
pop eax
add eax, ecx
push eax
push dword [esi + 4]
push dword [esi]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call sub.USER32.DLL_MoveWindow
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x414218
push 5
push dword [edi + 0xc]
call sub.USER32.DLL_ShowWindow
push 5
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call sub.USER32.DLL_ShowWindow
push 0
push 0
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call sub.USER32.DLL_InvalidateRect
push dword [ebp + 0x10]
push 0x12
push 0x802
push dword [edi + 0xc]
call sub.USER32.DLL_SendMessageA
push dword [ebp + 0x10]
push 0
push 0x802
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
call sub.USER32.DLL_SendMessageA
jmp 0x4142fb
push dword [0x486708]
call fcn.0042cb51
pop ecx
mov ebx, eax
mov dword [ebx + 0x14], edi
mov dword [edi + 0x10], ebx
push dword [ebx + 0xc]
push dword [edi + 0xc]
call sub.USER32.DLL_SetParent
push dword [ebp + 0x10]
push 0
push 0x802
push dword [edi + 0xc]
call sub.USER32.DLL_SendMessageA
push dword [ebp + 0x10]
push 0
push 0x802
push dword [ebx + 0xc]
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4142b2
push 1
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
add eax, 2
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
add eax, 0x10
push eax
push dword [esi + 4]
push dword [esi]
push dword [ebx + 0xc]
call sub.USER32.DLL_MoveWindow
jmp 0x4142d4
push 1
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
add eax, 0x10
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi]
add eax, 2
push eax
push dword [esi + 4]
push dword [esi]
push dword [ebx + 0xc]
call sub.USER32.DLL_MoveWindow
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4142fb
push 5
push dword [edi + 0xc]
call sub.USER32.DLL_ShowWindow
push 5
push dword [ebx + 0xc]
call sub.USER32.DLL_ShowWindow
push 0
push 0
push dword [ebx + 0xc]
call sub.USER32.DLL_InvalidateRect
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4144e5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
nop
mov dword [ebp - 4], 0
mov eax, dword [0x486704]
cmp eax, dword [0x486700]
jge 0x414613
push 1
push 0x64
call fcn.0045bd81
add esp, 8
mov edi, eax
push 1
push 0x5c
call fcn.0045bd81
add esp, 8
mov esi, eax
test edi, edi
je 0x41452e
test esi, esi
jne 0x414541
push edi
call fcn.0045d549
pop ecx
push esi
call fcn.0045d549
pop ecx
jmp 0x414613
push 0
push dword [ebp + 0x14]
push 0
push dword [0x486708]
push dword [ebp + 0x1c]
push ebx
push 0
push 0
push 0x46000000
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [edi + 4], eax
mov dword [edi], 1
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], eax
mov dword [esi + 8], 1
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x38], eax
lea eax, [esi + 0x3c]
push esi
push edi
add esi, 0x2c
mov edi, eax
cld
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [esi + 0x1c]
push esi
push edi
add esi, 0x3c
mov edi, eax
cld
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x486704]
lea eax, [eax*4]
mov ecx, dword [0x486600]
mov dword [eax + ecx], edi
mov eax, dword [0x486704]
inc dword [0x486704]
lea eax, [eax*4]
mov ecx, dword [0x486604]
mov dword [eax + ecx], esi
push dword [esi + 8]
push 0
push 0
mov eax, esi
add eax, 0x2c
push eax
push edi
call fcn.00414131
add esp, 0x14
push 5
push dword [edi + 0xc]
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414991
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x46a7f4
nop
mov eax, dword [edi]
test eax, eax
je 0x4149fb
mov esi, dword [esi + 0x14]
mov eax, dword [0x48673c]
test eax, eax
je 0x4149ee
push 0
push dword [0x486754]
call sub.USER32.DLL_ShowWindow
mov dword [0x48673c], 0
mov eax, dword [edi]
test eax, eax
je 0x4149db
push esi
call fcn.00419265
pop ecx
jmp 0x4149ee
push 0x48672c
mov eax, dword [esi + 0x10]
push dword [eax + 0xc]
call fcn.00414dc0
add esp, 8
mov dword [edi], 0
push 0
call sub.USER32.DLL_ClipCursor
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41a4a1
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x8004
call fcn.004605f4
push ebx
push esi
push edi
nop
push 0x8000
push 0x486760
push str.PATH
call sub.KERNEL32.DLL_GetEnvironmentVariableA
push 0x486760
push 0x47825c
push str._s_bin__s
lea eax, [ebp - 0x8000]
push eax
call fcn.0045eeda
add esp, 0x10
lea eax, [ebp - 0x8000]
push eax
push str.PATH
call sub.KERNEL32.DLL_SetEnvironmentVariableA
call sub.KERNEL32.DLL_GetEnvironmentStringsA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41a8ba
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
nop
push 1
push 0x14
call fcn.0045bd81
add esp, 8
mov esi, eax
test esi, esi
je 0x41a94b
mov eax, dword [ebp + 8]
test eax, eax
je 0x41a8ef
push dword [ebp + 8]
call fcn.0045f379
pop ecx
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41a902
push dword [ebp + 0xc]
call fcn.0045f379
pop ecx
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x41a915
push dword [ebp + 0x10]
call fcn.0045f379
pop ecx
mov dword [esi + 0x10], eax
test edi, edi
je 0x41a922
push edi
call fcn.0045f379
pop ecx
mov dword [esi], eax
test ebx, ebx
je 0x41a930
push ebx
call fcn.0045f379
pop ecx
mov dword [esi + 4], eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x41a524
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41adf3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
nop
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x41ae21
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x41ae1a
mov eax, 0
jmp 0x41ae23
mov eax, 0xffffffff
jmp 0x41ae23
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41b9a6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
nop
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x41b966
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ba7e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
nop
push 0x48e774
call sub.KERNEL32.DLL_EnterCriticalSection
mov eax, dword [0x48e78c]
mov ebx, eax
mov esi, eax
mov dword [0x48e78c], 0
push 0x48e774
call sub.KERNEL32.DLL_LeaveCriticalSection
jmp 0x41bac1
push 0
push dword [esi + 0x218]
call sub.USER32.DLL_ShowWindow
mov esi, dword [esi + 4]
test esi, esi
jne 0x41bab1
mov esi, ebx
jmp 0x41badd
push 0
push 0
push 0x10
push dword [esi + 0x218]
call sub.USER32.DLL_PostMessageA
mov esi, dword [esi + 4]
test esi, esi
jne 0x41bac9
jmp 0x41baed
lea eax, [ebp - 0x1c]
push eax
call fcn.00404516
pop ecx
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
jne 0x41bae3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret