joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7f0000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7f0131
push esi
call fcn.007f3145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.007e2080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7f0131
push 0
push ebp
call fcn.007e23a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.007e2260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7f008b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007e22f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7f0121
push 0x808918
push edi
call fcn.007f13f0
push eax
push ebx
push esi
call fcn.007eff60
push 0x8088f8
push edi
call fcn.007f13f0
push eax
push ebx
push esi
call fcn.007eff60
push 0x8088d8
push edi
call fcn.007f13f0
push eax
push ebx
push esi
call fcn.007eff60
push 0x8088c0
push edi
call fcn.007f13f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007eff60
push 0x8088a0
push edi
call fcn.007f13f0
push eax
push ebx
push esi
call fcn.007eff60
push 0x808888
push edi
call fcn.007f13f0
push eax
push ebx
push esi
call fcn.007eff60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7f11b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007f1140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007f1140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007f1140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007f1140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7f1bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7f1c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x80387c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7f1c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7f1c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4061f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
cmp edi, 0x53
ja 0x40628f
je 0x406280
cmp edi, 5
je 0x40625e
cmp edi, 0x46
je 0x406230
cmp edi, 0x4e
jne 0x4062ae
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x30]
push ecx
push edx
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 0xc
cmp byte [esi + 0x18], 0
je 0x406256
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
mov ecx, eax
shr ecx, 0x10
push ecx
mov ecx, dword [esp + 0x18]
movzx eax, ax
push eax
push ecx
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov eax, dword [esi]
mov edx, dword [eax + 0x20]
call edx
pop edi
pop esi
mov al, 1
pop ebx
ret 0xc
mov eax, edi
sub eax, 0x110
je 0x406390
sub eax, 1
je 0x406377
sub eax, 2
je 0x40635e
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push ebp
mov ebp, dword [esp + 0x1c]
cmp edi, dword [esi + 8]
jne 0x40630c
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [ebx]
mov eax, dword [esi + 4]
push 0
push 0
push 0
push eax
push 0
call ebx
test eax, eax
jne 0x4062d0
mov eax, dword [esi + 4]
movzx ecx, word [esp + 0x18]
mov edx, dword [0x439d44]
push ebp
push 0x406100
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp edi, dword [esi + 0x10]
jne 0x406355
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ecx]
mov eax, dword [esi + 4]
push 0
push 0
push 0
push eax
push 0
call ebx
test eax, eax
jne 0x406320
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 4]
mov eax, dword [esi + 4]
push edx
mov edx, dword [ebp]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi]
mov edx, dword [edx + 0x34]
push eax
push ecx
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [esi]
mov edx, dword [esp + 0x14]
mov eax, dword [eax + 0x18]
push ecx
push edx
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 0xc
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [esi + 0x1c]
push ecx
mov bl, al
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop edi
pop esi
mov al, bl
pop ebx
ret 0xc
Function at 0x4065d0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4065ef
cmp eax, 0x106
je 0x4065ef
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x406612
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x406608
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x406720
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42cd18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call ebp
test eax, eax
je 0x40676b
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
push 4
lea esi, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.00404e60
mov eax, esi
push eax
push ebx
mov dword [esp + 0x2c], 0
call fcn.00407e00
test al, al
je 0x4067d8
cmp dword [esp + 0x14], 0
setne al
test al, al
je 0x4067d8
mov esi, dword [esp + 0x10]
push edi
push esi
call ebp
test eax, eax
push esi
setne bl
mov dword [esp + 0x28], 0xffffffff
call fcn.00420d1e
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00420d1e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x406810
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42c988
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebp
call edi
test eax, eax
je 0x40684c
mov al, 1
jmp 0x4068b9
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e60
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e00
test al, al
je 0x4068a2
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x4068a2
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00420d1e
add esp, 4
mov al, bl
jmp 0x4068b9
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00420d1e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x4068d0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x42c988
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
push ebx
push ebp
call edi
test eax, eax
je 0x40690f
mov al, 1
jmp 0x406988
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x406986
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e60
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e00
test al, al
je 0x406971
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406971
mov esi, dword [esp + 0x14]
push ebx
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00420d1e
add esp, 4
mov al, bl
jmp 0x406988
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00420d1e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x406d80
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x42c988
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor edi, edi
mov ecx, ebp
call fcn.00406720
test al, al
je 0x406e34
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call edi
test eax, eax
je 0x406dc9
mov al, 1
jmp 0x406e36
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e60
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e00
test al, al
je 0x406e1f
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406e1f
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00420d1e
add esp, 4
mov al, bl
jmp 0x406e36
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00420d1e
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x407520
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x40753f
cmp eax, 0x106
je 0x40753f
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x407562
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x407558
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x407580
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
jg 0x40759e
cmp eax, 0x106
je 0x40759e
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esi]
xor eax, eax
cmp word [edx], ax
je 0x4075ca
mov ecx, edx
lea ebx, [ebx]
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x4075c0
xor ecx, ecx
mov word [edx + eax*2], cx
mov dword [esi + 4], eax
mov al, 1
pop esi
ret

Function at 0x4075e0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x4075ff
cmp eax, 0x106
je 0x4075ff
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0x430954
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x40762a
mov edx, edi
nop
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x407620
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
ret 4
Function at 0x407e00
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42c5e0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
movzx eax, word [ebp]
xor edi, edi
cmp ax, cx
je 0x407e4e
inc edi
cmp word [ebp + edi*2], cx
jne 0x407e46
cmp edi, 1
movzx ebx, ax
jl 0x407fb9
cmp bx, 0x5c
je 0x407fb9
cmp bx, 0x2e
jne 0x407e82
cmp edi, 1
je 0x407fb9
cmp edi, 2
jne 0x407e82
cmp word [ebp + 2], bx
je 0x407fb9
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call fcn.00404e60
cmp edi, 3
mov dword [esp + 0x4c], 0
jle 0x407ec9
cmp word [ebp + 2], 0x3a
jne 0x407ec9
cmp word [ebp + 4], 0x5c
jne 0x407ec9
cmp bx, 0x61
jb 0x407ec0
cmp bx, 0x7a
jbe 0x407f31
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x407f31
mov eax, dword [esp + 0x1c]
cmp eax, 0x105
jg 0x407ee9
cmp eax, 0x106
je 0x407ee9
push 0x106
lea esi, [esp + 0x18]
call fcn.00404e60
mov eax, dword [esp + 0x14]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [esp + 0x14]
mov edi, eax
call fcn.00405f10
test edi, edi
je 0x407fd1
cmp edi, 0x104
ja 0x407fd1
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x407f31
push 0x5c
mov eax, esi
call fcn.00404c30
mov ebx, str.__
lea eax, [esp + 0x38]
call fcn.00404b30
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
mov edi, eax
mov byte [esp + 0x54], 1
call fcn.004078e0
push ebp
lea ecx, [esp + 0x24]
mov bl, 2
push ecx
mov edi, eax
mov byte [esp + 0x54], bl
call fcn.00408240
mov edi, eax
mov eax, dword [esp + 0x58]
mov byte [esp + 0x4c], 3
call fcn.00404be0
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0x20]
push edx
call fcn.00420d1e
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x30]
push eax
call fcn.00420d1e
mov byte [esp + 0x54], 0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00420d1e
mov dword [esp + 0x58], 0xffffffff
mov edx, dword [esp + 0x20]
push edx
call fcn.00420d1e
add esp, 0x10
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call fcn.00420d1e
add esp, 4
xor al, al
jmp 0x407fbb

Function at 0x408160
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x400000
jbe 0x408184
mov eax, 0x400000
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [edx]
push edi
push eax
mov dword [esp + 0x28], 0
call ebx
mov ecx, dword [esp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x4081ba
test ecx, ecx
je 0x4081b2
add edi, ecx
sub ebp, ecx
jne 0x408175
pop edi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x408640
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi]
mov dword [esi + 4], 0
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebx]
push edi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jne 0x40866f
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x408683
lea ecx, [edi + 1]
cmp ecx, eax
je 0x408683
push ecx
call fcn.00404e60
mov eax, dword [esi]
inc edi
push edi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x4086aa
mov edx, edi
lea esp, [esp]
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4086a0
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
test eax, eax
jne 0x4086c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret
pop edi
mov al, 1
pop esi
ret
Function at 0x413630
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c038
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.004134b0
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
test eax, eax
je 0x413699
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x418a40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c829
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
call fcn.004188d0
lea edx, [esp + 0xc]
mov dword [esp + 0x20], 0
push edx
mov dword [esp + 0xc], 1
call fcn.00405070
push ebx
mov ecx, eax
call fcn.00404fd0
mov eax, dword [esp + 0xc]
push eax
call fcn.00420d1e
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x419a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42be78
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xe], cx
mov dword [esp + 0x28], eax
mov byte [ebx], al
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], eax
mov eax, dword [ebp]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 0xc
push ecx
push eax
call edx
mov edi, eax
test edi, edi
je 0x419ace
lea ecx, [esp + 0xc]
call fcn.004084d0
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
mov ax, word [esp + 0xc]
cmp ax, 0x40
jne 0x419ae8
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x419b20
test ax, ax
je 0x419b0f
lea ecx, [esp + 0xc]
call fcn.004084d0
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
cmp byte [ebp + 0x2c], 0
je 0x419b23
mov edx, dword [ebp + 0x24]
mov dword [esi], edx
mov eax, dword [ebp + 0x28]
mov dword [esi + 4], eax
mov byte [ebx], 1
lea ecx, [esp + 0xc]
call fcn.004084d0
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
Function at 0x41ae10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42b20e
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
mov dword [esi], eax
test eax, eax
je 0x41ae46
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea edi, [ebx + 4]
lea eax, [esi + 4]
mov dword [esp + 0x14], 0
call fcn.00404b90
lea edi, [ebx + 0x10]
lea eax, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.00404b90
mov byte [esp + 0x14], 2
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebx + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [ebx + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov cl, byte [ebx + 0x2c]
lea edi, [ebx + 0x30]
lea eax, [esi + 0x30]
mov byte [esi + 0x2c], cl
call fcn.00404b90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41d580
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x439d44]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
lea esi, [ebp + 0x118]
push esi
push 0x406100
push 0
push 0x1f6
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x41d5b1
mov dword [esi + 4], eax
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x430830
lea edi, [ebp + 0x14]
push ecx
call fcn.00408240
call fcn.0041be80
mov bl, al
test bl, bl
je 0x41d5e2
mov edx, dword [ebp + 0x11c]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [ebp + 0x169]
mov byte [ebp + 0x88], al
test bl, bl
je 0x41d5fa
mov ebx, dword [ebp + 0x11c]
jmp 0x41d5fc
xor ebx, ebx
mov edi, dword [esp + 0x28]
lea esi, [ebp + 0x70]
lea eax, [esi + 0x24]
call fcn.00404be0
mov ecx, dword [0x439d44]
push esi
push 0x406100
push 0
push 0x1f4
push ecx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call esi
mov eax, 0x45
lea ecx, [esp + 0x14]
call fcn.0041b000
mov eax, dword [eax]
mov ecx, dword [ebp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00420d1e
mov eax, dword [ebp + 0x74]
add esp, 4
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc