joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bbd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46dab8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push ebp
push esi
push edi
mov edi, ecx
push 0xf
lea ebp, [edi + 0x74]
call ebx
mov esi, dword [esp + 0x60]
push eax
push ebp
mov ecx, esi
call fcn.00460534
lea eax, [edi + 0x84]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 8]
push 0x200f
mov dword [esp + 0x38], edx
mov edx, dword [eax + 0xc]
push 0xa
lea eax, [esp + 0x38]
mov dword [esp + 0x40], ecx
mov ecx, dword [esi + 4]
push eax
push ecx
mov dword [esp + 0x4c], edx
call dword [sym.imp.USER32.dll_DrawEdge]
push 0xffffff
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.00460534
push 0x16
call ebx
push eax
push 1
push 0
lea ecx, [esp + 0x1c]
call fcn.004531c9
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
push eax
push ecx
mov dword [esp + 0x60], 0
call fcn.004530dc
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
mov edx, dword [edi + 0x98]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
mov byte [esp + 0x64], 1
call fcn.00452b04
mov edx, dword [edi + 0x98]
mov eax, dword [esp + 0x38]
push edx
push eax
mov ecx, esi
call fcn.004527eb
mov ecx, dword [esp + 0x34]
mov edx, dword [edi + 0x94]
push ecx
push edx
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.00452b04
mov ecx, dword [esp + 0x3c]
mov edx, dword [edi + 0x94]
push ecx
push edx
mov ecx, esi
call fcn.004527eb
mov eax, ebp
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x40], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x48], ecx
mov ecx, dword [edi + 0xa8]
mov dword [esp + 0x44], edx
mov edx, dword [eax + 0xc]
mov eax, dword [edi + 0xa4]
neg ecx
push ecx
neg eax
push eax
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x58], edx
call dword [sym.imp.USER32.dll_InflateRect]
mov edx, dword [esi]
push 5
mov ecx, esi
call dword [edx + 0x24]
mov ebx, eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
push ecx
mov byte [esp + 0x6c], 2
call dword [sym.imp.GDI32.dll_Ellipse]
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.0044c81d
cmp eax, edi
jne 0x42bd66
mov edx, dword [esi + 4]
push ebp
push edx
call dword [sym.imp.USER32.dll_DrawFocusRect]
test ebx, ebx
mov byte [esp + 0x58], 1
je 0x42bd72
mov ebx, dword [ebx + 4]
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.004530dc
mov eax, dword [esp + 0x1c]
test eax, eax
mov byte [esp + 0x58], 0
je 0x42bd8c
mov eax, dword [eax + 4]
mov ecx, dword [esi + 4]
push eax
push ecx
call fcn.004530dc
lea ecx, [esp + 0x10]
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.004530aa
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 4
Function at 0x42ccf0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46db90
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
call fcn.00465db5
mov ecx, dword [eax + 4]
call fcn.0044aea4
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
mov dword [esp + 0x28], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x42cd89
push eax
lea eax, [esp + 8]
push eax
call fcn.0042c9f0
mov ecx, dword [eax]
push ecx
push str.ShellExecute_failed:__1_s_
mov byte [esp + 0x20], 1
call fcn.0040baf0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0x10], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42cd89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov dword [esp + 0x10], 0xffffffff
call fcn.00465db5
mov ecx, dword [eax + 4]
call fcn.0044aeb9
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x42d0bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42d113
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x4768d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42d106
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x42d115
xor eax, eax
pop esi
leave
ret 4
Function at 0x42f1cd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x42f220
call fcn.00465db5
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, ebx
je 0x42f220
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x42f216
xor eax, eax
jmp 0x42f339
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x42f250
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x42f250
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x42f336
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x42f27d
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0042e37b
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x42f336
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42f2c6
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x42f2c6
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x42f2c0
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0042e37b
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x42f326
and dword [ebp + 0xc], 0
jmp 0x42f326
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x42f326
push 0xc
call fcn.0044f3e3
mov esi, eax
test esi, esi
pop ecx
je 0x42f308
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x42f30a
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x42f321
push dword [ebp - 8]
call fcn.00448ee5
jmp 0x42f326
call fcn.00448ebc
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x42f28b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x439193
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4391b0
call fcn.0043a26f
mov dword [eax], 0x16
xor eax, eax
jmp 0x43921a
push esi
push 0x8c
push 1
call fcn.0043a2f4
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x439205
push esi
call fcn.0043b163
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4391e3
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4390fe
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x439219
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0043792a
test ebx, ebx
pop ecx
je 0x439217
push ebx
call fcn.0043a281
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4396b8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00437dd0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x439753
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x48fef0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x439753
cmp eax, 1
je 0x439774
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x439753
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x439720
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x43974f
xor eax, eax
inc eax
jmp 0x439793
cmp edi, eax
jae 0x439757
xor eax, eax
jmp 0x439793
cmp eax, esi
jae 0x43975e
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x48fef0]
jmp 0x439777
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x439e3e
Capabilities:
Terminate process

Disassembly:
push 8
push 0x47d958
call fcn.0043966c
push 8
call fcn.0043bf6f
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x48ff30], esi
jne 0x439e72
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x48ff2c], esi
mov al, byte [ebp + 0x10]
mov byte [0x48ff28], al
cmp dword [ebp + 0xc], edi
jne 0x439ebc
cmp dword [0x4918a8], edi
je 0x439eac
mov eax, dword [0x4918a4]
sub eax, 4
mov dword [0x4918a4], eax
cmp eax, dword [0x4918a8]
jb 0x439eac
mov eax, dword [eax]
cmp eax, edi
je 0x439e8d
call eax
jmp 0x439e8d
push 0x48b0b4
mov eax, 0x48b0ac
call fcn.00439dbc
pop ecx
push 0x48b0c0
mov eax, 0x48b0b8
call fcn.00439dbc
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x439eed
cmp dword [ebp + 0x10], edi
jne 0x439efb
mov dword [0x48ff30], esi
push dword [ebp + 8]
call fcn.00439d7a
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x439efa
push 8
call fcn.0043beba
pop ecx
ret
call fcn.004396a7
ret

Function at 0x43a68b
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x48c71c]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x48c908]
je 0x43a6c0
inc eax
cmp eax, 0x13
jb 0x43a6b1
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x48c908]
jne 0x43a7e6
mov eax, dword [0x48fedc]
cmp eax, 1
je 0x43a7be
cmp eax, edx
jne 0x43a6f0
cmp dword [0x48c708], 1
je 0x43a7be
cmp ecx, 0xfc
je 0x43a7e6
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x43a726
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004415f0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004395e0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x43a75a
mov eax, edi
push eax
call fcn.004395e0
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x47dd80
push edi
call fcn.004416f0
add esp, 0x10
push edi
call fcn.004395e0
push dword [esi + 0x48c90c]
mov ebx, eax
call fcn.004395e0
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00437dd0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004415f0
push edi
push ebx
call fcn.00441600
push 0x47dd60
push ebx
call fcn.00441600
push dword [esi + 0x48c90c]
push ebx
call fcn.00441600
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004414ee
add esp, 0x2c
jmp 0x43a7e6
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x48c90c]
push dword [esi]
call fcn.004395e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.004379cc
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x43acae
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x490144]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
push edi
xor ebx, ebx
xor esi, esi
xor edi, edi
cmp eax, ebx
jne 0x43acf7
call ebp
mov esi, eax
cmp esi, ebx
je 0x43acdd
mov dword [0x490144], 1
jmp 0x43acfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x43acf2
push 2
pop eax
mov dword [0x490144], eax
jmp 0x43acf7
mov eax, dword [0x490144]
cmp eax, 1
jne 0x43ad54
cmp esi, ebx
jne 0x43ad0f
call ebp
mov esi, eax
cmp esi, ebx
jne 0x43ad0f
xor eax, eax
jmp 0x43adfb
cmp word [esi], bx
mov eax, esi
je 0x43ad24
inc eax
inc eax
cmp word [eax], bx
jne 0x43ad16
inc eax
inc eax
cmp word [eax], bx
jne 0x43ad16
sub eax, esi
inc eax
inc eax
mov ebp, eax
push ebp
call fcn.004393ee
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x43ad47
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
jmp 0x43adfb
push ebp
push esi
push edi
call fcn.00438d90
add esp, 0xc
jmp 0x43ad39
cmp eax, 2
je 0x43ad5d
cmp eax, ebx
jne 0x43ad08
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebp, eax
cmp ebp, ebx
je 0x43ad08
cmp byte [ebp], bl
mov esi, ebp
je 0x43ad93
push ebx
push ebx
push 0xffffffffffffffff
push esi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x43ad08
push esi
add edi, eax
call fcn.004395e0
lea esi, [esi + eax + 1]
cmp byte [esi], bl
pop ecx
jne 0x43ad70
inc edi
lea eax, [edi + edi]
push eax
mov dword [esp + 0x18], edi
call fcn.004393ee
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x43ae0c
cmp byte [ebp], bl
mov edi, ebp
mov esi, eax
je 0x43aded
mov ecx, dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x10]
sar eax, 1
sub ecx, eax
push ecx
push esi
push 0xffffffffffffffff
push edi
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x43ae02
push edi
call fcn.004395e0
push esi
lea edi, [edi + eax + 1]
call fcn.00437a78
cmp byte [edi], bl
pop ecx
pop ecx
lea esi, [esi + eax*2 + 2]
jne 0x43adb3
push ebp
mov word [esi], bx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push dword [esp + 0x10]
call fcn.0043792a
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x43ad08
Function at 0x43ae18
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword [0x490148]
push ebp
xor ebp, ebp
cmp eax, ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jne 0x43ae58
call esi
test eax, eax
je 0x43ae3d
mov dword [0x490148], 1
jmp 0x43ae5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x43ae54
mov dword [0x490148], 2
jmp 0x43ae66
xor eax, eax
jmp 0x43aeb4
cmp eax, 1
jne 0x43ae61
call esi
jmp 0x43aeb4
cmp eax, 2
jne 0x43ae54
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebp
push ebp
push 0xffffffffffffffff
mov ebx, eax
push ebx
push 1
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x43aeac
lea eax, [esi + esi]
push eax
call fcn.004393ee
mov ebp, eax
test ebp, ebp
pop ecx
je 0x43aeac
push esi
push ebp
push 0xffffffffffffffff
push ebx
push 1
push 0
call edi
test eax, eax
jne 0x43aeb0
push ebp
call fcn.0043792a
pop ecx
xor eax, eax
jmp 0x43aeb2
mov eax, ebp
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4405c1
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4405ef
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4405f6
cmp ebx, dword [eax + 4]
jae 0x4405f6
xor eax, eax
jmp 0x4407e6
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x440607
xor eax, eax
inc eax
jmp 0x4407e5
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x44061d
cmp ecx, edx
jae 0x440762
cmp dword [eax + 4], 0
je 0x440626
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x44060e
cmp dword [ebp + 8], 0
je 0x440648
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x440762
cmp eax, esi
jae 0x440762
mov eax, dword [0x4902c8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x44066d
cmp dword [esi*4 + 0x4902d0], edi
je 0x440766
inc esi
cmp esi, eax
jl 0x44065b
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4407e2
cmp dword [ebp - 8], 0x1000000
jne 0x4407e2
test byte [ebp - 0xc], 0xcc
je 0x4406eb
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4407e2
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4407e2
cmp word [eax + 0x18], 0x10b
jne 0x4407e2
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4407e2
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4406eb
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4406eb
test byte [ecx + 0x27], 0x80
jne 0x440762
push 1
push 0x490310
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4405ff
mov ecx, dword [0x4902c8]
test ecx, ecx
mov edx, ecx
jle 0x44071f
lea eax, [ecx*4 + 0x4902cc]
cmp dword [eax], edi
je 0x44071f
dec edx
sub eax, 4
test edx, edx
jg 0x440713
test edx, edx
jne 0x440750
push 0xf
pop ebx
cmp ecx, ebx
jg 0x44072c
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x440744
lea eax, [edx*4 + 0x4902d0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x440732
cmp ecx, 0x10
jge 0x440750
inc ecx
mov dword [0x4902c8], ecx
push 0
push 0x490310
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4405ff
xor eax, eax
jmp 0x4407e5
test esi, esi
jle 0x4405ff
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x490310
call ebx
test eax, eax
jne 0x4405ff
cmp dword [esi*4 + 0x4902d0], edi
je 0x4407bc
mov eax, dword [0x4902c8]
lea esi, [eax - 1]
test esi, esi
jl 0x4407aa
cmp dword [esi*4 + 0x4902d0], edi
je 0x4407a6
dec esi
jns 0x44079a
test esi, esi
jge 0x4407ba
cmp eax, 0x10
jge 0x4407b5
inc eax
mov dword [0x4902c8], eax
lea esi, [eax - 1]
jmp 0x4407bc
je 0x4407d4
xor ecx, ecx
test esi, esi
jl 0x4407d4
lea eax, [ecx*4 + 0x4902d0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4407c2
push 0
push 0x490310
call ebx
jmp 0x4405ff
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44109b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x48c71c]
push esi
mov esi, dword [ebp + 8]
test esi, esi
mov dword [ebp - 4], eax
je 0x44111a
push esi
call fcn.004446c5
test eax, eax
pop ecx
jne 0x4410e2
call fcn.0043a278
mov dword [eax], 0xf
call fcn.0043a26f
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.004379cc
leave
ret
and word [ebp - 6], 0
lea eax, [ebp - 0x218]
push eax
add esi, 0x40
lea eax, [ebp - 0x214]
push eax
mov word [ebp - 0xc], si
mov esi, 0x104
push esi
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
mov word [ebp - 8], 0x2e
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x44112d
lea eax, [ebp - 0x214]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4410d5
inc eax
cmp eax, esi
ja 0x4410d5
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x441164
cmp eax, dword [ebp + 0x10]
jg 0x441145
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
call fcn.004393ee
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x441179
call fcn.0043a26f
mov dword [eax], 0xc
jmp 0x4410d5
cmp eax, dword [ebp + 0x10]
jle 0x441179
call fcn.0043a26f
mov dword [eax], 0x22
jmp 0x4410d5
lea eax, [ebp - 0x214]
push eax
push ecx
call fcn.0043a632
pop ecx
pop ecx
jmp 0x4410d7

Function at 0x4414ee
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4903f8], ebx
push esi
push edi
jne 0x44156e
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4415a9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x4903f8], eax
je 0x4415a9
push 0x47e914
push edi
call esi
push 0x47e900
push edi
mov dword [0x4903fc], eax
call esi
cmp dword [0x48fef0], 2
mov dword [0x490400], eax
jne 0x44156e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x490408], eax
je 0x44156e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x490404], eax
mov eax, dword [0x490404]
test eax, eax
je 0x4415b3
call eax
test eax, eax
je 0x44159a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x490408]
test eax, eax
je 0x44159a
test byte [ebp - 8], 1
jne 0x4415b3
cmp dword [0x48fefc], 4
jb 0x4415ad
or byte [ebp + 0x12], 0x20
jmp 0x4415d2
xor eax, eax
jmp 0x4415e2
or byte [ebp + 0x12], 4
jmp 0x4415d2
mov eax, dword [0x4903fc]
test eax, eax
je 0x4415d2
call eax
mov ebx, eax
test ebx, ebx
je 0x4415d2
mov eax, dword [0x490400]
test eax, eax
je 0x4415d2
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4903f8]
pop edi
pop esi
pop ebx
leave
ret