joyce8/EMBER2024-capa huggingface dataset:
Function at 0x519820
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push edi
mov edi, dword [esp + 0x2c]
push 0
push edi
call fcn.00516eb0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x519847
push eax
call fcn.004b7cd0
mov dword [edi + 0x28], 0
jmp 0x519865
mov eax, dword [0x58b724]
mov ecx, dword [0x58b72c]
push eax
push ecx
push 0x551656
call fcn.004b7470
mov dword [edi + 0x28], 1
test eax, eax
mov dword [edi + 0x14], eax
je 0x519a79
mov edx, dword [esp + 0x34]
push ebp
or eax, 0xffffffff
push esi
mov esi, dword [0x598e04]
mov dword [edi + 8], eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov eax, dword [esp + 0x40]
push 0x7f00
push 0
mov dword [edi + 0x18], edx
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call esi
push eax
push 0
push 0
push 0x516d30
push str.EVERYTHING_DROPDOWNLIST_BORDER
push 0
call fcn.004aa4a0
push 0x7f00
push 0
call esi
push eax
push 0
push 0
push 0x518550
push str.EVERYTHING_DROPDOWNLIST
push 0
call fcn.004aa4a0
mov ecx, dword [0x5991b0]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x86000000
push 0x551656
push str.EVERYTHING_DROPDOWNLIST_BORDER
push 0x88
call fcn.004aa5f0
mov cl, byte [edi + 0x184]
push 0
mov dword [edi + 0xc], eax
mov edx, dword [0x5991b0]
mov eax, dword [edi + 0x60]
push edx
push 0
push eax
push 0
push 0
neg cl
push 0
push 0
push 0x86200000
push 0x551656
push str.EVERYTHING_DROPDOWNLIST
sbb ecx, ecx
and ecx, 0x400000
or ecx, 0x88
push ecx
call fcn.004aa5f0
push edi
push eax
mov dword [edi + 0x10], eax
call fcn.004ac9b0
mov eax, edi
call fcn.00517e00
cmp dword [edi + 0x18], 0
je 0x51996d
push edi
call fcn.004c55f0
mov edx, dword [edi + 0xc]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 8
push edx
call esi
mov eax, dword [edi + 0x10]
push 8
push eax
call esi
mov ecx, dword [edi + 0x68]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi + 0x10]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [edi + 0x10], 0
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [edi], edx
mov dword [edi + 4], eax
je 0x519a4d
mov ebp, dword [0x598e18]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
call ebp
test eax, eax
je 0x519a3d
cmp dword [esp + 0x18], 0x12
je 0x519a6f
lea esi, [esp + 0x14]
call fcn.00516f60
test eax, eax
jne 0x519a54
cmp dword [esp + 0x18], 0x100
jne 0x519a00
cmp dword [esp + 0x1c], 9
je 0x519a5b
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
call dword [0x598de8]
test eax, eax
jle 0x519a62
lea eax, [esp + 0x14]
push eax
mov eax, edi
call fcn.00518a30
test eax, eax
jne 0x519a43
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [0x598dc4]
jmp 0x519a43
call dword [sym.imp.USER32.dll_WaitMessage]
cmp dword [edi + 0x10], 0
jne 0x5199c4
push str.no_search_history_hwnd_n
jmp 0x519a67
push str.outside_click_n
jmp 0x519a67
push str.tab_out_n
jmp 0x519a67
push str.no_getmsg_n
call fcn.0048f080
add esp, 4
push 0
push edi
call fcn.00516eb0
pop esi
pop ebp
pop edi
add esp, 0x24
ret 0x10
Function at 0x525300
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
push edi
push 1
push eax
xor edi, edi
call fcn.004a9cd0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x5253ad
push esi
lea ecx, [esp + 0xc]
push ecx
push ebx
call fcn.004aba70
test eax, eax
je 0x5253a5
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, edx
or eax, ecx
je 0x525396
mov eax, edx
add eax, 1
adc ecx, edi
mov esi, eax
or esi, ecx
je 0x5253a5
test ecx, ecx
jg 0x5253a5
jl 0x525356
cmp eax, 0x80000000
jae 0x5253a5
mov esi, dword [esp + 0x18]
add edx, 1
push edx
push esi
call fcn.005236c0
test eax, eax
je 0x5253a5
mov eax, dword [esp + 0xc]
mov edx, dword [esi + 8]
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
push edx
push ebx
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5253a5
mov eax, dword [esi]
cmp dword [esp + 0x1c], eax
jne 0x5253a5
mov ecx, dword [esi + 8]
mov byte [eax + ecx], 0
jmp 0x5253a0
mov edx, dword [esp + 0x18]
push edx
call fcn.005240c0
mov edi, 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 8
ret 8

Function at 0x5297f0
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [eax + 0x34]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x38], esi
lea ebx, [esi + 1]
jle 0x52982a
push ebp
push edi
movzx edi, dl
mov ecx, dword [eax + 0x260]
mov ebp, ecx
shr ebp, 0x18
xor ebp, edi
shl ecx, 8
xor ecx, dword [ebp*4 + 0x597280]
add esi, ebx
mov dword [eax + 0x260], ecx
cmp esi, dword [eax + 0x38]
jl 0x529804
pop edi
pop ebp
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x5298b2
sub ecx, ebx
je 0x529897
sub ecx, ebx
je 0x52988b
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
ret
Function at 0x54cc92
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5982f0]
je 0x54ccad
inc edi
cmp edi, 0x17
jb 0x54cc9e
cmp edi, 0x17
jae 0x54ce2d
push ebp
push 3
call fcn.0054ef70
cmp eax, 1
pop ecx
je 0x54cdf9
push 3
call fcn.0054ef70
test eax, eax
pop ecx
jne 0x54cce1
cmp dword [0x597fc0], 1
je 0x54cdf9
cmp ebx, 0xfc
je 0x54ce2c
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x599868
push ebp
call fcn.0054ef0b
add esp, 0xc
test eax, eax
je 0x54cd17
push esi
push esi
push esi
push esi
push esi
call fcn.0054be15
add esp, 0x14
push 0x104
mov esi, 0x599881
push esi
push 0
mov byte [0x599985], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x54cd5b
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0054ef0b
add esp, 0xc
test eax, eax
je 0x54cd5b
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0054be15
add esp, 0x14
push esi
call fcn.0054ee80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x54cda0
push esi
call fcn.0054ee80
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x599b7c
push 0x570b5c
sub ecx, eax
push ecx
push eax
call fcn.0054edcb
add esp, 0x14
test eax, eax
je 0x54cda0
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0054be15
add esp, 0x14
jmp 0x54cda2
xor esi, esi
push 0x588078
push ebx
push ebp
call fcn.0054ed5a
add esp, 0xc
test eax, eax
je 0x54cdc2
push esi
push esi
push esi
push esi
push esi
call fcn.0054be15
add esp, 0x14
push dword [edi*8 + 0x5982f4]
push ebx
push ebp
call fcn.0054ed5a
add esp, 0xc
test eax, eax
je 0x54cde4
push esi
push esi
push esi
push esi
push esi
call fcn.0054be15
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0054eb9d
add esp, 0xc
jmp 0x54ce2c
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x54ce2c
cmp ebp, 0xffffffff
je 0x54ce2c
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5982f4]
push dword [esi]
call fcn.0054ee80
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x401801
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov al, byte [0x438c20]
push ebx
push esi
mov esi, dword [0x431f88]
push edi
mov edi, dword [0x431f8c]
push eax
xor bl, bl
call dword [sym.imp.USER32.dll_IsCharUpperA]
mov dword [0x438c2c], eax
movsx eax, byte [0x438bea]
push eax
push 0x54bffff
call fcn.0041003a
add dword [0x438c14], eax
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add word [0x438bfc], ax
mov al, byte [esi]
add al, 0x66
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042c950
mov ecx, esp
mov edx, esi
call fcn.00429cdb
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
movsx eax, byte [0x438beb]
push eax
push dword [0x438c10]
call fcn.0041020b
push 0x1ec3ffff
push 0x32ebffff
mov byte [0x438be8], al
call fcn.0041020b
mov word [0x438bf8], ax
mov al, byte [edi]
add al, 0x66
add esp, 0x10
movzx eax, al
add eax, 3
and al, 0xfc
call fcn.0042c950
mov ecx, esp
mov edx, edi
call fcn.00429cdb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx eax, byte [eax]
xor eax, 0x9a
cmp eax, 0xffffff56
jne 0x4018fc
mov eax, dword [0x438c1c]
add eax, 0xa0dbffff
mov dword [0x438c10], eax
movsx eax, byte [0x438bef]
push eax
push 0xbfafffff
call fcn.00410092
pop ecx
mov word [0x438bf8], ax
pop ecx
inc bl
lea esp, [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x401906
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x432590
push 0x42c980
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x1c], ebx
mov word [0x438bfc], 1
mov al, byte [0x438bf1]
shl al, 1
dec al
mov byte [0x438bf1], al
mov dword [ebp - 4], ebx
push 0x255dffff
movsx eax, byte [0x438bef]
push eax
call fcn.004100c8
add byte [0x438bf1], al
push 0x4d
call fcn.004146c6
add esp, 0xc
call eax
test eax, 0x80000000
je 0x4019d3
push 0xfebdffff
push 0x998dffff
call fcn.004101be
add byte [0x438bf1], al
push 0x6815ffff
push 0x772dffff
call fcn.00410246
mov byte [0x438bf0], al
push 0x50cdffff
push 0x264bffff
call fcn.00410285
add esp, 0x18
mov byte [0x438be8], al
mov eax, dword fs:[0x20]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add byte [0x438bec], al
jmp 0x401afb
mov word [0x438bf4], 1
xor eax, eax
cmp byte [0x438bec], bl
setne al
mov byte [0x438beb], al
movsx eax, word [0x438bfa]
push eax
push dword [0x438c1c]
call fcn.00410285
pop ecx
pop ecx
mov dword [0x438c2c], eax
push edx
push ecx
push ebx
and edx, 0xe063ffff
inc edx
mov ecx, 0xa4bffff
imul edx, edx, 0x1207ffff
xor ecx, ecx
imul ebx, ebx, 0xef89ffff
pop ebx
pop ecx
pop edx
mov ebx, dword fs:[0x30]
push edx
push ecx
push eax
dec eax
mov edx, 0x6fafffff
dec ecx
pop eax
pop ecx
pop edx
mov bl, byte [ebx + 2]
push edx
push ecx
push ebx
push eax
and ecx, 0x7e07ffff
sub edx, eax
mov ecx, ecx
xor edx, 0xab2dffff
imul edx, eax
sub ebx, ecx
add edx, eax
pop eax
pop ebx
pop ecx
pop edx
movzx ebx, bl
push edx
push ecx
push ebx
push eax
xor edx, ebx
xor eax, ecx
sub eax, ebx
inc ecx
dec ebx
nop
pop eax
pop ebx
pop ecx
pop edx
mov dword [ebp - 0x1c], ebx
push ecx
push ebx
push eax
sub eax, ebx
add ecx, 0xa4b5ffff
pop eax
pop ebx
pop ecx
xor eax, eax
cmp byte [0x438be9], al
setne al
add dword [0x438c1c], eax
push 0x2795ffff
push dword [0x438c2c]
call fcn.00410092
pop ecx
pop ecx
add dword [0x438c0c], eax
jmp 0x401afb
or dword [ebp - 4], 0xffffffff
xor eax, eax
cmp word [0x438bf8], ax
setne al
mov word [0x438bfe], ax
cmp dword [ebp - 0x1c], 0
je 0x401b1b
mov byte [ebp - 0x20], 1
mov al, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406651
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push 4
mov dword [ebp - 8], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4066f9
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x4066ee
push esi
cmp dword [ebp - 0x24], 0x10
jb 0x4066d8
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jne 0x4066d8
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
je 0x4066d8
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x4066d8
cmp byte [ebp + 8], 0
push esi
je 0x4066c7
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4066cd
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
push 0x37
call fcn.004146c6
pop ecx
call eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x1c
push eax
push edi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x406690
pop esi
push edi
push 0x37
call fcn.004146c6
pop ecx
call eax
pop edi
leave
ret

Function at 0x4086ae
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call sub.MSVCRT.dll_strlen
mov esi, eax
mov dword [esp], 0x78e1ffff
movsx eax, word [0x438bfe]
push eax
call fcn.00410246
mov byte [0x438beb], al
push 0x8263ffff
movsx eax, word [0x438bf4]
push eax
call fcn.004100f9
push dword [0x438c08]
add word [0x438bf4], ax
push dword [0x438c20]
call fcn.004101be
add dword [0x438c10], eax
push 4
push esi
call fcn.004084b1
lea ebx, [eax + eax*2]
xor eax, eax
cmp byte [0x438be8], al
push 0x9ab5ffff
mov dword [ebp - 4], edx
setne al
add byte [0x438bef], al
movsx eax, byte [0x438bee]
push eax
call fcn.00410167
add esi, edi
add esp, 0x28
mov word [0x438c02], ax
cmp byte [esi - 1], 0x3d
je 0x40877b
or al, 0xff
sub al, byte [0x438c0c]
add byte [0x438be9], al
movsx eax, word [0x438bf6]
push eax
movsx eax, word [0x438bf8]
push eax
call fcn.00410130
pop ecx
mov dword [0x438c20], eax
pop ecx
jmp 0x408807
movsx eax, word [0x438c00]
push eax
push 0xce95ffff
call fcn.00410246
inc dword [0x438c10]
push dword [0x438c10]
mov word [0x438c00], ax
movsx eax, word [0x438c02]
push eax
call fcn.00410285
add esp, 0x10
mov byte [0x438beb], al
cmp byte [esi - 2], 0x3d
jne 0x4087f7
movsx eax, word [0x438bf6]
push dword [0x438c0c]
mov ecx, 0x4ebdffff
sub ecx, eax
mov al, byte [0x438c2c]
push dword [0x438c24]
inc al
mov dword [0x438c1c], ecx
mov byte [0x438bee], al
call fcn.00410130
add byte [0x438beb], al
pop ecx
dec ebx
pop ecx
dec ebx
jmp 0x408807
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
add dword [0x438c08], eax
dec ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 4
Function at 0x409da2
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x42d5fe
call fcn.0042c930
sub esp, 0x20
push ebx
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add word [0x438c04], ax
mov al, byte [0x438c28]
sub al, byte [0x438bee]
add dword [0x438c08], 0x3bedffff
xor ebx, ebx
mov byte [0x438bef], al
cmp dword [esi + 0xfc], ebx
je 0x409f0b
movsx eax, word [0x438bf8]
or eax, 0x9d91ffff
push 4
add dword [0x438c14], eax
mov al, byte [0x438be8]
and al, byte [0x438be9]
movsx ax, al
add word [0x438bfe], ax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041f5b4
pop ecx
pop ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov word [0x438c00], ax
movsx eax, byte [0x438bed]
push eax
movsx eax, byte [0x438bec]
push eax
call fcn.00410167
add word [0x438c04], ax
push dword [0x438c20]
movsx eax, byte [0x438bef]
push eax
call fcn.00410167
add word [0x438bf4], ax
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040afdd
add esp, 0x18
mov ecx, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov byte [ebp - 4], 1
push dword [ecx]
lea ecx, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::append_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [ebp + 0xc]
mov edx, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x409eab
mov eax, edx
cmp dword [ebp - 0x18], ebx
je 0x409eb3
mov edx, dword [ebp - 0x18]
inc ecx
push ecx
push eax
push 1
push ebx
push edx
push dword [esi + 0xfc]
push 0x17
call fcn.004146c6
pop ecx
call eax
movsx eax, word [0x438c04]
push dword [0x438c20]
push eax
push dword [0x438c14]
call dword [sym.imp.KERNEL32.dll_MulDiv]
add word [0x438bfc], ax
mov al, byte [0x438c00]
push eax
call dword [sym.imp.USER32.dll_IsCharAlphaA]
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
mov dword [0x438c20], eax
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40aa6f
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x42d6e1
call fcn.0042c930
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add dword [0x438c14], eax
cmp dword [ebp + 8], 0xa
jge 0x40ab68
mov al, byte [0x438c20]
push esi
dec al
mov esi, dword [ebp + 0xc]
add byte [0x438be9], al
push 0
movsx ax, byte [0x438beb]
sub ax, word [0x438c02]
lea ecx, [ebp - 0x1c]
mov word [0x438bfc], ax
mov al, byte [esi]
mov byte [ebp - 0x1c], al
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea ecx, [ebp - 0x1c]
push dword [eax]
push 0
push esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00411055
pop ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4389e0
push dword [ebp + 8]
call fcn.00409da2
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
mov ecx, dword [ebp + 8]
shl ecx, 4
push dword [eax]
lea eax, [ebp - 0x1c]
add ecx, 0x438a0c
push 0
push eax
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
movsx eax, word [0x438c02]
push 0xc391ffff
push eax
call fcn.00410167
push 0x43afffff
push 0x2b57ffff
mov dword [0x438c2c], eax
call fcn.0041003a
add esp, 0x10
mov dword [0x438c2c], eax
push 0x9d35ffff
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
add byte [0x438beb], al
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x410b0b
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2950
call fcn.0042c950
push ebx
xor ebx, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
add byte [0x438bee], al
push 0x9563ffff
push 0x3b55ffff
call fcn.004101be
add byte [0x438bf1], al
mov eax, dword [ebp + 8]
pop ecx
mov eax, dword [eax + 4]
pop ecx
cmp eax, ebx
jne 0x410b53
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
push 0x3a
call fcn.004146c6
pop ecx
call eax
movsx ecx, byte [0x438bec]
and ecx, 0x4b6dffff
mov dword [ebp + 8], eax
add dword [0x438c20], ecx
cmp eax, 0xffffffff
je 0x410d2f
movsx eax, word [0x438bf2]
push esi
push edi
push eax
push 0x997ffff
mov dword [ebp - 0xc], ebx
call fcn.004100f9
mov dword [0x438c20], eax
pop ecx
movsx eax, word [0x438bfa]
add eax, 0xc77ffff
pop ecx
mov dword [0x438c10], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
add dword [0x438c10], eax
mov edi, 0xa6
push edi
lea eax, [ebp - 0xb4]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [0x438c2c]
add esp, 0xc
mov ecx, eax
mov dword [ebp - 0xb4], ebx
and ecx, 0x1abdffff
push eax
add dword [0x438c18], ecx
mov word [0x438bf2], 0xfffe
mov dword [ebp - 0xb0], ebx
call dword [sym.imp.USER32.dll_IsCharUpperA]
add byte [0x438bee], al
mov esi, 0x289a
push esi
lea eax, [ebp - 0x2950]
push ebx
push eax
call sub.MSVCRT.dll_memset
movsx eax, byte [0x438bf1]
push eax
push dword [0x438c20]
call fcn.004101be
add byte [0x438bef], al
add esp, 0x14
cmp dword [0x439030], ebx
jne 0x410c4f
push 0x62
call fcn.004146c6
pop ecx
mov dword [0x439030], eax
push 0xfdf3ffff
push 0x5b33ffff
call fcn.004101be
add dword [0x438c18], eax
push 0x593ffff
movsx eax, byte [0x438bee]
push eax
call fcn.004101be
add esp, 0x10
cmp word [0x438bfa], bx
mov byte [0x438be8], al
jne 0x410c95
cmp dword [0x438c18], ebx
mov byte [0x438bec], bl
je 0x410c9c
mov byte [0x438bec], 1
lea eax, [ebp - 0xc]
push ebx
push eax
lea eax, [ebp - 0x2950]
push esi
push eax
lea eax, [ebp - 0xb4]
push edi
push eax
push 0x2d1400
push dword [ebp + 8]
call dword [0x439030]
pop edi
pop esi
test eax, eax
je 0x410cf6
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x2950]
push eax
call fcn.004104f8
movsx eax, word [0x438bfe]
push 0x5ca9ffff
push eax
mov dword [ebp - 4], 1
call fcn.004101be
add word [0x438c02], ax
pop ecx
pop ecx
push 0x2af1ffff
push 0x59ebffff
mov word [0x438bfa], 1
call fcn.004100f9
add dword [0x438c0c], eax
pop ecx
inc byte [0x438bf1]
pop ecx
push dword [ebp + 8]
push 0x37
call fcn.004146c6
pop ecx
call eax
inc byte [0x438bf0]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov byte [0x438bea], al
mov eax, dword [ebp - 4]
pop ebx
leave
ret 4
Function at 0x414d8f
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x315bffff
mov esi, ecx
push dword [0x438c08]
call fcn.004100c8
add word [0x438bf8], ax
xor edi, edi
cmp word [0x438bf2], di
pop ecx
pop ecx
je 0x414dc8
cmp dword [0x438c10], edi
mov word [0x438bfa], 1
jne 0x414dcf
mov word [0x438bfa], di
push edi
push edi
push 1
push edi
push 0x39
call fcn.004146c6
pop ecx
call eax
mov dword [esi + 0x18], eax
lea eax, [esi + 0x14]
push eax
push edi
push esi
push 0x414e34
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
push 0xfffffffffffffffe
push edi
push 0x67
call fcn.004146c6
pop ecx
call eax
push edi
push 0x37
call fcn.004146c6
pop ecx
call eax
push 0x3e8
push dword [esi + 0x18]
push 0x5f
call fcn.004146c6
pop ecx
call eax
push dword [esi + 0x18]
push 0x37
call fcn.004146c6
pop ecx
call eax
or dword [esi + 0x18], 0xffffffff
pop edi
pop esi
ret