joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005c530
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1009c6a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1008f7a3
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.10094e5b
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.10096377
test eax, eax
je 0x1005c64c
mov ecx, dword [esp + 0x3c]
call fcn.10094e88
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x1005c610
push edi
mov ecx, esi
call fcn.100924ce
mov ecx, esi
call fcn.1005c7f0
cmp dword [esp + 0x38], 1
jne 0x1005c645
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.10092609
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x1005e830
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x1005e863
push esi
call fcn.1006cc10
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x1005e85c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x1005e8e9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x1005e8d2
mov eax, dword [esi + 8]
test eax, eax
je 0x1005e887
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1005e8ce
cmp eax, 2
je 0x1005e8d2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1005e87a
cmp eax, 3
je 0x1005e8ad
cmp eax, 1
jne 0x1005e87a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x1005e87a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x1005e87a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.1005e910
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x1005e8f8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.1005e910
add esp, 4
pop esi
ret

Function at 0x1005f190
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x1005f1b1
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x1005f1b1
mov eax, dword [eax + 0x44]
test eax, eax
je 0x1005f1b1
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1005f600
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1005f60b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x1005f70e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x100a68b8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x100a68b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x100a68b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x100a68b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x100a68b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x100a68b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x100a68b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x100a68b8]
xor eax, edx
inc ecx
dec edi
jne 0x1005f626
pop edi
test esi, esi
je 0x1005f730
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x100a68b8]
xor eax, edx
inc ecx
dec esi
jne 0x1005f712
pop esi
pop ebx
not eax
ret
Function at 0x100796a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x10079706
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x10079706
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x100796e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x10079a90
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10079ac8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x1007a790
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x1007a7d9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x1007ac50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009cbf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.1007a800
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.1007a880
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.1007a880
lea ecx, [esi + 0xc]
call fcn.1008e17f
lea ecx, [esi + 0x10]
call fcn.1008e17f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.1007be10
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.1007be10
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.1007be10
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.1008e1f4
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.1008e1f4
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10090598
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100905d0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1008e64f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1008e627
jmp 0x100905dc
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10091c8b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10091ccd
call fcn.10097a1d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10091ccd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10091cc4
xor eax, eax
jmp 0x10091cd5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10091cdb
pop edi
pop esi
pop ebx
ret 4
Function at 0x404000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x40401a
push 0x4046f2
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor al, al
jmp 0x40406e
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x24]
test ecx, ecx
jne 0x40402e
mov edx, dword [ebp + 8]
cmp dword [edx + 0x38], 0
jne 0x40403f
push 0x404702
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor al, al
jmp 0x40406e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCancelIrp]
movzx ecx, al
test ecx, ecx
jne 0x404061
push 0x404712
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor al, al
jmp 0x40406e
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.00401140
mov al, 1
pop ebp
ret 4
Function at 0x405000
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 0
push 0x40536c
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
mov edx, dword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov eax, dword [edx]
push eax
push 0
push 0
push 0x40
lea ecx, [ebp - 0x18]
push ecx
call sub.ntoskrnl.exe_ObReferenceObjectByName
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x405057
push 0x40538e
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x4050ad
mov ecx, dword [ebp + 8]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
push 0x4053a0
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x4050aa
cmp dword [ebp - 8], 2
jne 0x405096
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004050c0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x40507d
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4050c0
Capabilities:
Create device object
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0x405312
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
lea eax, [ebp - 4]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x2c]
push edx
lea eax, [ebp - 0x28]
push eax
push 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x40511d
push 0x405334
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor eax, eax
jmp 0x40523e
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov byte [edx + 0x10], 0
mov eax, dword [ebp - 8]
add eax, 0x18
push eax
call fcn.00401000
push 0
push 0x31323334
push 0x20
push 0
push 0
push 0
mov ecx, dword [ebp - 8]
add ecx, 0x20
push ecx
call dword [sym.imp.ntoskrnl.exe_ExInitializePagedLookasideList]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x1c]
and ecx, 0x2014
mov edx, dword [ebp - 4]
or ecx, dword [edx + 0x1c]
mov eax, dword [ebp - 4]
mov dword [eax + 0x1c], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x20], eax
push 0x405346
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov dword [edx + 0x88], eax
mov ecx, dword [ebp - 0x1c]
mov dword [edx + 0x8c], ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jge 0x4051de
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, dword [ebp - 0xc]
jmp 0x40523e
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntoskrnl.exe_IoAttachDeviceToDeviceStack]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40520b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov dword [ebp - 0xc], 0xc0000001
mov eax, dword [ebp - 0xc]
jmp 0x40523e
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
and ecx, 0xffffff7f
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], ecx
push 0x405360
call sub.ntoskrnl.exe_DbgPrint
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4052c6
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.004052d6
pop ebp
jmp fcn.00405250
Function at 0x402060
Capabilities:
Create thread

Disassembly:
push ecx
mov ecx, dword [0x56bc94]
mov eax, 1
cmp ecx, eax
je 0x4020b0
lea ecx, [esp]
mov dword [0x56bc94], eax
push ecx
push 0
push eax
push 0x4020c0
push 0
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x4020a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ecx
ret
mov dword [0x56bc94], 0
xor eax, eax
pop ecx
ret
Function at 0x405ff0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x3f18]
test eax, eax
je 0x406037
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4060f0
mov ecx, dword [esi + 0x3f18]
lea eax, [esi + 0x5010]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi + 0x3f18]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x10
ret
lea eax, [esp + 4]
push 0
push eax
mov ecx, esi
call fcn.00405b70
mov edx, dword [0x58bccc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push 0
push edx
mov edx, dword [esi + 4]
sub eax, ecx
push 0
push edx
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push 0x44000080
push 0x56bc90
push str.edit
push 0x20
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0xfffffffffffffffc
push eax
mov dword [esi + 0x3f18], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x3f10], eax
mov eax, dword [esi + 0x3f18]
push esi
push str.CLASSPROC
push eax
call dword [sym.imp.USER32.dll_SetPropW]
mov ecx, dword [esi + 0x3f18]
push 0x4053f0
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
call fcn.004063f0
mov ecx, esi
call fcn.00406240
mov eax, dword [esi + 0x3f18]
lea edx, [esi + 0x5010]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x3f18]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x10
ret

Function at 0x4081e3
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 2
call fcn.0050a9d0
mov eax, dword [esp + 0x14]
push 1
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x408237
mov eax, dword [esi + 0x70a0]
cmp eax, 0xffffffff
je 0x408237
cmp eax, dword [esp + 4]
jne 0x408230
mov eax, dword [esi + 0x70a4]
mov ecx, dword [esp + 8]
cmp eax, ecx
je 0x408237
mov ecx, esi
call fcn.004096c0
mov ecx, esi
call fcn.00407dc0
mov edx, dword [esi + 0x3f14]
mov ecx, 0x20
cmp edx, ecx
jne 0x40825d
test eax, eax
je 0x408270
mov dword [esi + 0x3f14], 0x10
jmp 0x408267
test eax, eax
jne 0x408270
mov dword [esi + 0x3f14], ecx
push 1
mov ecx, esi
call fcn.00408ec0
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00407fa0
test eax, eax
je 0x408287
push 0x7f01
jmp 0x4082a2
mov ecx, esi
call fcn.00407ea0
test eax, eax
jne 0x40829d
mov ecx, esi
call fcn.00407f20
test eax, eax
je 0x4082b1
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, esi
call fcn.00408ef0
pop esi
add esp, 8
ret 8
Function at 0x409600
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov dword [esi + 0x1e68], 0
mov dword [esi + 0x1e6c], 0
call fcn.00409570
push 1
push 0
mov ecx, esi
call fcn.00408e40
mov eax, dword [esi + 0x3f18]
push 0x56bc90
push eax
mov dword [esi + 0x1e74], 1
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x3f18]
push 0
push ecx
mov dword [esi + 0x1e74], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.004097d0
push 0x56bc90
mov ecx, esi
call fcn.00407c10
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x40968e
mov edx, dword [esi + 4]
push 1
push eax
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
ret

Function at 0x40ac70
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x2090
call fcn.0051c5a0
mov eax, dword [0x56c760]
push edi
test eax, eax
mov edi, ecx
je 0x40ac93
mov eax, 0x56c764
pop edi
add esp, 0x2090
ret
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add edi, 0x64
push 0x5c
push edi
mov esi, eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
mov edi, eax
lea eax, [esp + 0x10]
push esi
push 0x5384a4
push 0x1047
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
add esp, 0x10
lea ecx, [esp + 0x10]
push edi
push ecx
call ebx
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, eax
test esi, esi
je 0x40acef
push edi
call ebp
lea esi, [esi + eax*2]
add esp, 4
test esi, esi
jne 0x40ad0d
lea esi, [edi + 2]
lea edx, [esp + 0x10]
push esi
push edx
call ebx
mov edi, eax
test edi, edi
je 0x40ad7c
push esi
call ebp
lea esi, [edi + eax*2]
add esp, 4
test esi, esi
je 0x40ad7c
push 0x5389e0
push esi
call ebx
test eax, eax
je 0x40ad1e
lea esi, [eax + 4]
jmp 0x40ad36
push 2
push 0x5389d8
push esi
call dword [sym.imp.MSVCRT.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x40ad36
add esi, 4
cmp word [esi], 0
je 0x40ad7c
push esi
push 0x5384a4
push 0x1047
push 0x56c764
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x56c764
mov word [0x56e7f2], 0
call fcn.004be890
push 0x56c764
call fcn.004bef90
push 0x56c764
call fcn.004be890
add esp, 0x1c
pop esi
pop ebp
pop ebx
mov dword [0x56c760], 1
mov eax, 0x56c764
pop edi
add esp, 0x2090
ret
Function at 0x40aec0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x64]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x18]
push edx
call fcn.0043f430
lea eax, [esp + 0x1c]
push eax
call fcn.004be960
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 0xc], eax
je 0x40b06f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b06f
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 1
mov ecx, esi
call fcn.0040ada0
test eax, eax
mov dword [0x5868fc], eax
jne 0x40af50
push 0x64
call ebx
mov edx, edi
inc edi
cmp edx, 0x14
jb 0x40af27
mov eax, dword [0x5868fc]
test eax, eax
je 0x40b06f
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov edx, dword [0x5868fc]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov edi, dword [esp + 0x21c]
cmp word [edi], 0
jne 0x40afd6
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x40afb0
push 1
push 0x9051
mov dword [esi + 0x2c], 0x9051
call fcn.004c1710
add esp, 8
mov ecx, dword [esi + 0x2c]
mov edx, dword [0x5868fc]
push 0
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
mov ebx, dword [sym.imp.MSVCRT.dll_wcscmp]
push 0x538a18
push edi
call ebx
add esp, 8
test eax, eax
jne 0x40b031
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x40b008
push 1
push 0x9051
mov dword [esi + 0x2c], 0x9051
call fcn.004c1710
add esp, 8
mov eax, dword [esi + 0x2c]
mov ecx, dword [0x5868fc]
push 0x1e0000
push 0xffffffffffffffff
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push str._sandboxse
push edi
call ebx
add esp, 8
test eax, eax
je 0x40b05e
push edi
mov ecx, esi
call fcn.0040c940
test eax, eax
je 0x40b05e
mov edx, dword [0x5868fc]
push edi
push 0
push edx
call fcn.00450500
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret 4
Function at 0x40b370
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x410
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], si
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x420]
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x538a2c
push ecx
call fcn.0044fa00
add esp, 0x10
test eax, eax
je 0x40b41e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], si
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x537acc
push 0x56bf34
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 8]
push 1
push eax
push 0x56bd2c
call esi
push 2
lea ecx, [esp + 0x214]
push 0x56bd2c
push ecx
call esi
lea edx, [esp + 8]
push 1
push edx
call fcn.004bffc0
add esp, 8
pop edi
pop esi
add esp, 0x410
ret 4

Function at 0x40b430
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push 0x103
push eax
push 0x538a2c
push esi
call fcn.0044fa00
add esp, 0x10
test eax, eax
je 0x40b4b9
cmp word [esp + 8], 0
je 0x40b4b9
push 0
push 0x538a48
push esi
call fcn.0044f970
add esp, 0xc
cmp eax, 1
jne 0x40b4a8
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0043fd00
add esp, 8
pop edi
pop esi
add esp, 0x208
ret 4
lea edx, [esp + 8]
push edx
call fcn.004061d0
mov ecx, eax
call fcn.0042fa90
pop edi
pop esi
add esp, 0x208
ret 4