joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5807f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x123000]
push edi
jmp 0x58080a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x580811
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x580800
mov eax, 1
add ebx, ebx
jne 0x580823
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x580834
jne 0x580853
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x580853
dec eax
add ebx, ebx
jne 0x580840
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x580818
add ebx, ebx
jne 0x58084f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5808a5
xor ecx, ecx
sub eax, 3
jb 0x58086b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5808da
sar eax, 1
mov ebp, eax
jmp 0x580876
add ebx, ebx
jne 0x580876
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x580844
inc ecx
add ebx, ebx
jne 0x580884
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x580844
add ebx, ebx
jne 0x580891
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x580886
jne 0x5808a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x580886
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5808c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5808b6
jmp 0x580806
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5808c4
add edi, ecx
jmp 0x580806
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5808e2
cmp byte [edi], 0x11
jne 0x5808e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5808e7
lea edi, [esi + 0x179000]
mov eax, dword [edi]
or eax, eax
je 0x58095f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21b908]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21ba84]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x580914
mov ecx, edi
jns 0x580943
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21ba88]
or eax, eax
je 0x580959
mov dword [ebx], eax
add ebx, 4
jmp 0x580931
call dword [esi + 0x21ba98]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x580990
cmp al, 0xef
ja 0x580983
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x580965
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x580972
mov ebp, dword [esi + 0x21ba8c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5809c4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x5abe43b6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x7e7b53ba
nop
nop
nop
nop
test eax, eax
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4029b0
Capabilities:
Create pipe
Create process on windows
Set environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c0c
call fcn.0040fa60
mov eax, dword [0x4588a4]
mov ecx, dword [0x458334]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x402ac5
mov ebx, dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x4588a4], 0x959
jne 0x402aae
push 0
lea eax, [ebp - 0x1408]
push eax
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
lea edx, [ebp - 0x408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x1c08]
push eax
push 0
call edi
mov ecx, dword [ebp - 4]
push ecx
call fcn.00402780
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x4029ee
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40841c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x449770]
jne 0x408426
repz ret
jmp fcn.0040b37d

Function at 0x409b95
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00407b46
and dword [ebp - 4], 0
cmp dword [0x44f584], 0
mov ebx, eax
jne 0x409c46
push 0x401b04
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409cf7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401af8
push edi
call esi
test eax, eax
je 0x409cf7
push eax
call fcn.00407ad4
mov dword [esp], 0x401ae8
push edi
mov dword [0x44f584], eax
call esi
push eax
call fcn.00407ad4
mov dword [esp], 0x401ad4
push edi
mov dword [0x44f588], eax
call esi
push eax
call fcn.00407ad4
mov dword [esp], 0x401ab8
push edi
mov dword [0x44f58c], eax
call esi
push eax
call fcn.00407ad4
pop ecx
mov dword [0x44f594], eax
test eax, eax
je 0x409c46
push 0x401aa0
push edi
call esi
push eax
call fcn.00407ad4
pop ecx
mov dword [0x44f590], eax
mov eax, dword [0x44f590]
cmp eax, ebx
je 0x409c9e
cmp dword [0x44f594], ebx
je 0x409c9e
push eax
call fcn.00407b4f
push dword [0x44f594]
mov esi, eax
call fcn.00407b4f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409c9e
test edi, edi
je 0x409c9e
call esi
test eax, eax
je 0x409c95
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409c95
test byte [ebp - 0xc], 1
jne 0x409c9e
or dword [ebp + 0x10], 0x200000
jmp 0x409cd7
mov eax, dword [0x44f588]
cmp eax, ebx
je 0x409cd7
push eax
call fcn.00407b4f
pop ecx
test eax, eax
je 0x409cd7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409cd7
mov eax, dword [0x44f58c]
cmp eax, ebx
je 0x409cd7
push eax
call fcn.00407b4f
pop ecx
test eax, eax
je 0x409cd7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f584]
call fcn.00407b4f
pop ecx
test eax, eax
je 0x409cf7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409cf9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402abf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
mov dword [ebp - 4], 0x208
push eax
push 0
push 0x401414
push ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x402b20
mov eax, dword [ebp - 4]
cmp eax, 2
jb 0x402b1b
shr eax, 1
xor ecx, ecx
cmp cx, word [esi + eax*2 - 2]
jne 0x402b1b
mov eax, dword [ebp - 8]
sub eax, 1
je 0x402b17
sub eax, 1
jne 0x402b1b
mov ecx, esi
call fcn.004029ca
test eax, eax
jne 0x402b20
xor eax, eax
jmp 0x402b20
mov eax, 0x3f7
pop esi
leave
ret 8

Function at 0x402ef0
Capabilities:
Terminate process

Disassembly:
push 0xc
push 0x403500
call 0x495000
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x4043c0
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x402d18
cmp eax, esi
jne 0x402d0b
xor esi, esi
inc esi
mov edi, esi
jmp 0x402d1b
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x402cef
xor esi, esi
inc esi
cmp dword [0x4043c4], esi
jne 0x402d2d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x402d67
cmp dword [0x4043c4], ebx
jne 0x402d61
mov dword [0x4043c4], esi
push 0x4011a8
push 0x40119c
call fcn.00402e4c
pop ecx
pop ecx
test eax, eax
je 0x402d67
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402e3c
mov dword [0x404034], esi
cmp dword [0x4043c4], esi
jne 0x402d8a
push 0x401198
push 0x40118c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4043c4], 2
test edi, edi
jne 0x402d97
xor eax, eax
mov ecx, 0x4043c0
xchg dword [ecx], eax
cmp dword [0x4043c8], 0
je 0x402dc3
push 0x4043c8
call fcn.004030d0
pop ecx
test eax, eax
je 0x402dc3
push ebx
push 2
push ebx
mov esi, dword [0x4043c8]
mov ecx, esi
call dword [0x405168]
call esi
push dword [0x404040]
push dword [0x40403c]
push dword [0x404038]
call fcn.00401ae1
add esp, 0xc
mov dword [0x404030], eax
cmp dword [0x404048], 0
jne 0x402e21
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x404034], 0
jne 0x402e35
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x404030]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
call fcn.004031c5
jmp 0x402cd3
Function at 0x40336e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
mov esi, edx
mov edi, ecx
push 0x25
mov ecx, esi
call fcn.00401f47
push esi
cmp eax, 0xffffffff
jne 0x4033a1
mov ecx, edi
call fcn.0040241c
jmp 0x403438
lea ecx, [ebp - 0x1c]
call fcn.0040241c
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4033b3
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4033cf
push esi
mov ecx, edi
call fcn.0040241c
jmp 0x403430
xor ecx, ecx
add eax, 2
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043b1e5
cmp dword [esi + 0x14], 8
mov ebx, eax
pop ecx
jb 0x4033f1
mov esi, dword [esi]
mov ecx, dword [ebp - 0x20]
inc ecx
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40341e
cmp eax, dword [ebp - 0x20]
ja 0x40341e
xor ecx, ecx
push ebx
mov word [ebx + eax*2], cx
call fcn.0043ef4e
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040206a
push ebx
call fcn.0043afa7
pop ecx
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.00402372
lea ecx, [ebp - 0x1c]
call fcn.0040203f
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043af96
leave
ret
Function at 0x40513b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x46600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push 0xc35
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4051b0
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.0043cc90
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4051b0
lea eax, [ebp - 0x804]
push eax
call fcn.0043ef4e
pop ecx
push eax
lea eax, [ebp - 0x804]
push eax
lea ecx, [edi + 0x10]
call fcn.0040206a
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043af96
leave
ret 4

Function at 0x4051c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
mov edi, ecx
xor ebx, ebx
push 0x4597e0
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x18], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x1c], eax
test eax, eax
je 0x40525f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegCreateKeyExW
push eax
call esi
push str.RegQueryValueW
push dword [edi + 0x1c]
mov dword [edi], eax
call esi
push str.RegSetValueW
push dword [edi + 0x1c]
mov dword [edi + 4], eax
call esi
push str.RegQueryValueExW
push dword [edi + 0x1c]
mov dword [edi + 8], eax
call esi
push str.RegSetValueExW
push dword [edi + 0x1c]
mov dword [edi + 0xc], eax
call esi
push str.RegCloseKey
push dword [edi + 0x1c]
mov dword [edi + 0x10], eax
call esi
mov dword [edi + 0x14], eax
pop esi
cmp dword [edi], ebx
je 0x40525f
cmp dword [edi + 4], ebx
je 0x40525f
cmp dword [edi + 8], ebx
je 0x40525f
cmp dword [edi + 0xc], ebx
je 0x40525f
cmp dword [edi + 0x10], ebx
je 0x40525f
test eax, eax
je 0x40525f
mov byte [edi + 0x18], 1
mov eax, edi
pop edi
pop ebx
ret

Function at 0x40607e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push edi
push 0x44
xor edi, edi
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.0043cc90
push 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 0x58], 0x44
push edi
push eax
call fcn.0043cc90
mov ecx, dword [ebp + 0xc]
add esp, 0x18
mov dword [ebp - 0x2c], 1
cmp dword [ecx + 0x14], 8
push 5
pop eax
mov word [ebp - 0x28], ax
jb 0x4060c2
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4060cd
mov eax, dword [eax]
lea edx, [ebp - 0x10]
push edx
lea edx, [ebp - 0x58]
push edx
push ecx
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4060f9
cmp dword [ebp - 0x10], edi
je 0x4060f5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4060fb
xor al, al
pop edi
leave
ret 8
Function at 0x406d61
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp dword [eax + 0x14], 8
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x20], esi
jb 0x406d87
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
jne 0x406d9c
xor al, al
jmp 0x406dda
cmp dword [ebp - 0x20], esi
jle 0x406dcb
push dword [ebx + esi*4]
lea ecx, [ebp - 0x1c]
call fcn.00401fbc
cmp dword [ebp - 0xc], 0
je 0x406dbd
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.004047dc
lea ecx, [ebp - 0x1c]
call fcn.0040203f
inc esi
cmp esi, dword [ebp - 0x20]
jl 0x406da1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [edi]
cmp eax, dword [edi + 4]
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043af96
leave
ret 8

Function at 0x408b17
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x46600c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [eax + 0x14], 8
jb 0x408b38
mov eax, dword [eax]
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x408b5f
mov eax, dword [ebp - 0x2b8]
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043af96
leave
ret 4
Function at 0x409593
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x46600c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x260]
mov esi, ecx
push 0x27f4
push eax
call fcn.00403449
mov ecx, eax
call fcn.0041aa54
cmp dword [ebp - 0x24c], 8
lea eax, [ebp - 0x260]
cmovae eax, dword [ebp - 0x260]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0043cc90
add esp, 0xc
push 0x3ec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov edi, eax
test edi, edi
je 0x409657
push edi
call ebx
test eax, eax
je 0x409657
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x409657
xor eax, eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x218]
push eax
call fcn.0043ef4e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [esi + 0x240]
call fcn.0040206a
jmp 0x409677
push edi
call ebx
test eax, eax
je 0x409677
cmp dword [esi + 0x254], 8
lea eax, [esi + 0x240]
jb 0x40966f
mov eax, dword [eax]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edi, [esi + 0x240]
mov edx, edi
lea ecx, [ebp - 0x230]
call fcn.0040336e
push eax
mov ecx, edi
call fcn.004023e5
lea ecx, [ebp - 0x230]
call fcn.0040203f
mov edx, str.__DSPT
mov ecx, edi
call fcn.0040c210
cmp byte [esi + 0x80], 0
je 0x409797
cmp dword [esi + 0x78], 0
je 0x409797
lea ecx, [esi + 0x68]
mov edx, edi
call fcn.0040bfd0
test al, al
jne 0x409797
lea ecx, [ebp - 0x280]
call fcn.004051c0
lea eax, [esi + 0x2c4]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040241c
lea ecx, [ebp - 0x248]
call fcn.0040c2d0
push 0x25
push 0x3a
pop edx
lea ecx, [ebp - 0x248]
call fcn.0040c140
add esp, 4
push 0x25
push 0x5c
pop edx
call fcn.0040c140
add esp, 4
lea ecx, [ebp - 0x230]
mov esi, 0x45a560
push esi
call fcn.00401fbc
lea eax, [ebp - 0x230]
push eax
push ecx
lea ecx, [ebp - 0x280]
call fcn.00405274
lea ecx, [ebp - 0x230]
mov bl, al
call fcn.0040203f
test bl, bl
je 0x409781
push esi
lea ecx, [ebp - 0x230]
call fcn.00401fbc
push edi
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x230]
push eax
push ecx
lea ecx, [ebp - 0x280]
call fcn.004053c9
lea ecx, [ebp - 0x230]
call fcn.0040203f
lea ecx, [ebp - 0x248]
call fcn.0040203f
lea ecx, [ebp - 0x280]
call fcn.00405264
lea ecx, [ebp - 0x260]
call fcn.0040203f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043af96
leave
ret
Function at 0x414b50
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x46600c]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x414bd2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x414bd2
test ecx, ecx
je 0x414bce
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x414b90
xor eax, eax
jmp 0x414bd7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x414be1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043af96
add esp, 0xc
ret 0xc
Function at 0x417220
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x46600c]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x20c
lea eax, [esp + 0xc]
mov edi, ecx
push 0
push eax
call fcn.0043cc90
add esp, 0xc
lea eax, [esp + 8]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4173c2
push ebx
xor eax, eax
push ebp
mov word [esp + 0x21a], ax
lea eax, [esp + 0x10]
push esi
push eax
call fcn.0043ef4e
mov ecx, dword [edi + 0x14]
mov ebp, eax
add esp, 4
mov dword [esp + 0x10], ecx
cmp ebp, ecx
ja 0x4172bb
mov ebx, edi
cmp ecx, 8
jb 0x417297
mov ebx, dword [edi]
lea esi, [ebp*2]
mov dword [edi + 0x10], ebp
push esi
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0043c190
add esp, 0xc
xor eax, eax
mov word [esi + ebx], ax
jmp 0x4173a7
cmp ebp, 0x7ffffffe
ja 0x4173da
mov esi, ebp
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x4172db
mov esi, 0x7ffffffe
jmp 0x4172f9
mov edx, ecx
mov eax, 0x7ffffffe
shr edx, 1
sub eax, edx
cmp ecx, eax
jbe 0x4172f1
mov esi, 0x7ffffffe
jmp 0x4172f9
lea eax, [edx + ecx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x41730b
or ecx, 0xffffffff
jmp 0x417313
cmp ecx, 0x1000
jb 0x41733a
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.0043b1a7
add esp, 4
test eax, eax
je 0x4173df
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
jmp 0x41734d
test ecx, ecx
je 0x41734b
push ecx
call fcn.0043b1a7
add esp, 4
mov ebx, eax
jmp 0x41734d
xor ebx, ebx
mov dword [edi + 0x14], esi
lea eax, [esp + 0x14]
lea esi, [ebp*2]
mov dword [edi + 0x10], ebp
push esi
push eax
push ebx
call fcn.0043c710
xor eax, eax
add esp, 0xc
mov word [esi + ebx], ax
mov eax, dword [esp + 0x10]
cmp eax, 8
jb 0x4173a5
lea ecx, [eax*2 + 2]
mov eax, dword [edi]
cmp ecx, 0x1000
jb 0x41739b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4173df
mov eax, edx
push ecx
push eax
call fcn.0043b1d7
add esp, 8
mov dword [edi], ebx
pop esi
pop ebp
pop ebx
mov al, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0043af96
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
xor al, al
pop edi
xor ecx, esp
call fcn.0043af96
add esp, 0x214
ret
call fcn.00402330
call fcn.0043f174
int3