joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eddf
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb88
push edi
push esi
push 0x75
lea eax, [ebp - 0x475]
push eax
push dword [ebp + 8]
call fcn.0040f9d0
lea edi, [ebp - 0x400]
add edi, dword [ebp - 0x43b]
mov esi, dword [ebp - 0x455]
jmp 0x40f00b
cmp byte [esi], 0xa
jne 0x40effe
cmp byte [esi - 2], 0xa
jne 0x40effe
mov cl, byte [esi]
mov byte [edi], cl
inc esi
inc edi
mov byte [edi], 0
mov byte [ebp - 0x437], 1
mov dword [ebp - 0x449], esi
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x475]
push eax
call fcn.0040ec30
lea eax, [ebp - 0x414]
push eax
call fcn.0040f318
mov word [ebp - 0x43d], ax
cmp byte [ebp - 0x414], 0x33
jne 0x40ef23
mov byte [ebp - 0x435], 1
lea eax, [ebp - 0x400]
push eax
call sub.USER32.dll_CharLowerA
lea eax, [ebp - 0x400]
push eax
call sub.KERNEL32.dll_lstrlenA
mov ecx, eax
lea edi, [ebp - 0x400]
mov al, 0x6c
repne scasb al, byte es:[edi]
push edi
push ecx
dec edi
mov esi, str.location:
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
mov esi, edi
pop ecx
pop edi
jne 0x40ee95
push 0x200
lea eax, [ebp - 0x200]
push eax
call sub.KERNEL32.dll_RtlZeroMemory
mov edi, esi
lea esi, [ebp - 0x200]
cmp byte [edi], 0x20
jne 0x40eed6
mov al, 0x20
mov ecx, 0x200
repe scasb al, byte es:[edi]
dec edi
jmp 0x40eede
mov al, byte [edi]
mov byte [esi], al
inc edi
inc esi
cmp byte [edi], 0
je 0x40eeed
cmp byte [edi], 0xd
je 0x40eeed
cmp byte [edi], 0xa
jne 0x40eed8
lea eax, [ebp - 0x475]
push eax
call fcn.0040ea98
lea eax, [ebp - 0x200]
push eax
pop dword [ebp - 0x418]
lea eax, [ebp - 0x475]
push eax
call fcn.0040ead2
lea eax, [ebp - 0x475]
push eax
call fcn.0040e85f
jmp 0x40effa
cmp word [ebp - 0x43d], 0xcc
je 0x40ef37
cmp byte [ebp - 0x414], 0x34
jne 0x40ef48
lea eax, [ebp - 0x475]
push eax
call fcn.0040ea98
jmp 0x40effa
cmp byte [ebp - 0x414], 0x32
je 0x40ef5e
cmp byte [ebp - 0x414], 0x35
jne 0x40efee
push str.multipart_
lea eax, [ebp - 0x400]
push eax
call fcn.0040f02a
cmp eax, 0
jbe 0x40ef90
mov byte [ebp - 0x42f], 1
mov byte [ebp - 0x42e], 1
lea eax, [ebp - 0x475]
push eax
call fcn.0040ed54
jmp 0x40effa
push str.accept_ranges:
lea eax, [ebp - 0x400]
push eax
call fcn.0040f02a
cmp eax, 0
ja 0x40efb1
cmp word [ebp - 0x43d], 0xce
jne 0x40efba
mov byte [ebp - 0x42f], 1
jmp 0x40efd7
push str.Content_Range:
lea eax, [ebp - 0x400]
push eax
call fcn.0040f02a
cmp eax, 0
jbe 0x40efd7
mov byte [ebp - 0x42f], 1
cmp dword [ebp - 0x404], 2
jne 0x40efec
lea eax, [ebp - 0x475]
push eax
call fcn.0040f1e6
jmp 0x40effa
lea eax, [ebp - 0x475]
push eax
call fcn.0040ea98
jmp 0x40f013
mov cl, byte [esi]
mov byte [edi], cl
inc edi
inc esi
inc dword [ebp - 0x43b]
dec eax
or eax, eax
jne 0x40ee12
push 0x75
push dword [ebp + 8]
lea eax, [ebp - 0x475]
push eax
call fcn.0040f9d0
pop esi
pop edi
leave
ret 4
Function at 0x40f215
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x30]
sub ecx, eax
push ecx
push dword [esi + 0x2c]
push dword [ebp + 8]
call fcn.0040f2ab
cmp eax, 1
jne 0x40f2a6
push eax
lea eax, [esi + 0x30]
push eax
push 0x4004667f
push dword [esi + 0xc]
call sub.WSOCK32.dll_ioctlsocket
pop eax
cmp dword [esi + 0x30], 0
je 0x40f295
push 0x42
push dword [esi + 0x30]
push dword [esi + 0x1c]
call sub.KERNEL32.dll_GlobalReAlloc
mov dword [esi + 0x1c], eax
push eax
call sub.KERNEL32.dll_GlobalLock
mov dword [esi + 0x20], eax
push 0
push dword [esi + 0x30]
push dword [esi + 0x20]
push dword [esi + 0xc]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x40f286
mov eax, 0
jmp 0x40f295
mov dword [esi + 0x30], eax
push eax
push dword [esi + 0x20]
push dword [ebp + 8]
call fcn.0040f2ab
cmp eax, 1
jne 0x40f2a6
cmp byte [esi + 0x3f], 1
jne 0x40f2a6
push esi
call fcn.0040ea98
pop esi
leave
ret 4

Function at 0x40f2ab
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x28], 0
je 0x40f2cf
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x28]
jbe 0x40f2cf
mov eax, dword [esi + 0x28]
sub eax, dword [esi + 0x34]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x28]
jne 0x40f2e1
mov dword [esi + 0x6d], 1
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x65]
call sub.KERNEL32.dll_WriteFile
push eax
cmp eax, 1
jne 0x40f312
mov eax, dword [ebp - 4]
add dword [esi + 0x34], eax
add dword [esi + 0x48], eax
cmp dword [esi + 0x69], 0
je 0x40f312
push dword [ebp + 8]
call fcn.0040e4b3
pop eax
pop esi
leave
ret 0xc
Function at 0x4154fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x41cc0c], 0
push esi
push edi
jne 0x415566
push 0x419e84
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x415566
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x415566
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41555f
push edi
push eax
push dword [ebp + 0xc]
call fcn.004154da
add esp, 0xc
cmp eax, dword [0x417350]
jne 0x41556b
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [0x417350]
pop edi
pop esi
pop ebp
ret

Function at 0x41556f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x41cc0c], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x417350]
jne 0x4156ac
test eax, eax
je 0x41559c
cmp byte [eax], 0
jne 0x4156ac
push ebx
mov ebx, 0x105
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push ebx
push eax
push dword [0x41cc04]
call edi
test eax, eax
je 0x4155e0
lea eax, [ebp - 0x108]
push eax
call fcn.00415337
and byte [eax], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.004156ba
add esp, 0xc
mov esi, eax
cmp esi, dword [0x417350]
jne 0x4156a6
lea eax, [ebp - 0x108]
push ebx
push eax
push 0
call edi
test eax, eax
je 0x41561f
lea eax, [ebp - 0x108]
push eax
call fcn.00415337
and byte [eax], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.004156ba
add esp, 0xc
mov esi, eax
cmp esi, dword [0x417350]
jne 0x4156a6
mov edi, dword [ebp + 0xc]
push edi
push 0x419e90
call fcn.004156ba
mov esi, eax
pop ecx
cmp esi, dword [0x417350]
pop ecx
jne 0x4156a6
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x415664
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004156ba
pop ecx
mov esi, eax
pop ecx
cmp esi, dword [0x417350]
jne 0x4156a6
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x41568f
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.004156ba
pop ecx
mov esi, eax
pop ecx
cmp esi, dword [0x417350]
jne 0x4156a6
push edi
push str.PATH
call fcn.00415863
pop ecx
mov esi, eax
pop ecx
pop edi
mov eax, esi
pop ebx
jmp 0x4156b7
push dword [ebp + 0xc]
push eax
call fcn.004156ba
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x4165c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
lea eax, [ebp + 8]
push esi
push eax
call fcn.004151f6
mov eax, dword [ebp + 8]
push 4
lea edi, [eax + esi]
lea eax, [edi + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.004151f6
mov eax, dword [ebp - 4]
push 4
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.004151f6
add esp, 0x24
cmp dword [ebp - 8], 0x4550
je 0x416620
push str.PELD:_peGetProcAddress:_invalid_instance_handle_or_corrupt_memory_image
call fcn.00415e67
jmp 0x4166e2
mov eax, dword [ebp - 4]
push 8
lea eax, [eax + edi + 0x78]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004151f6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ebx, 0x10000
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], ecx
jb 0x416652
push str.PELD:_peGetProcAddress:_export_section___64K
jmp 0x416616
push eax
call fcn.00415094
mov esi, eax
pop ecx
test esi, esi
jne 0x416666
push str.PELD:_peGetProcAddress:_picosMalloc_error
jmp 0x416616
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
add eax, edi
push eax
push esi
call fcn.004151f6
mov ecx, dword [ebp + 0xc]
add esp, 0xc
cmp ecx, ebx
jae 0x416685
sub cx, word [esi + 0x10]
jmp 0x4166d3
mov eax, esi
xor ebx, ebx
sub eax, dword [ebp + 8]
add dword [esi + 0x20], eax
cmp dword [esi + 0x18], ebx
jbe 0x4166bc
xor eax, eax
jmp 0x41669b
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x20]
mov eax, dword [edx + eax*4]
sub eax, dword [ebp + 8]
add eax, esi
push eax
push ecx
call fcn.00414f16
pop ecx
test eax, eax
pop ecx
je 0x4166bc
inc ebx
movzx eax, bx
cmp eax, dword [esi + 0x18]
jb 0x416698
movzx eax, bx
cmp eax, dword [esi + 0x18]
jae 0x4166db
mov ecx, esi
sub ecx, dword [ebp + 8]
add dword [esi + 0x24], ecx
mov ecx, dword [esi + 0x24]
mov cx, word [ecx + eax*2]
movzx eax, cx
cmp eax, dword [esi + 0x14]
jb 0x4166e6
push esi
call fcn.004150da
pop ecx
xor eax, eax
jmp 0x4166fe
mov ecx, esi
push esi
sub ecx, dword [ebp + 8]
add dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx + eax*4]
call fcn.004150da
pop ecx
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402437
Capabilities:
Terminate process

Disassembly:
jmp 0x4345d4
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x4345e5
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.004037a1
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x4024c3
Capabilities:
Query environment variable

Disassembly:
jmp 0x43d79d
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x43d7b1
xor edi, edi
jmp 0x43d7e8
push ebx
push esi
call fcn.0043d6a7
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004029b9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x43d7d8
push ebx
push esi
push edi
call fcn.00403657
add esp, 0xc
push 0
call fcn.00403c5b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x4036ca
Capabilities:
Parse pe header

Disassembly:
jmp 0x409199
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4091d8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4091d8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4091d8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4091d8
cmp dword [ecx + 0x74], 0xe
jbe 0x4091d8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40fa90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [0x6ea470], eax
xor eax, eax
nop
add eax, 1
mov ecx, dword [eax*4 + 0x6ea46c]
mov edx, ecx
shr edx, 0x1e
xor edx, ecx
imul edx, edx, 0x6c078965
add edx, eax
mov dword [eax*4 + 0x6ea470], edx
cmp eax, 0x26f
jl 0x40fa98
mov dword [0x5f5030], 0x270
ret

Function at 0x40fad0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov eax, 0xffffffff
mov esi, esi
add eax, 1
mov ecx, dword [eax*4 + 0x6ea474]
mov ebx, dword [eax*4 + 0x6ea470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6eaaa4]
mov dword [eax*4 + 0x6ea470], edx
cmp eax, 0xe2
jl 0x40fad8
mov eax, 0xe2
lea esi, [esi]
add eax, 1
mov ecx, dword [eax*4 + 0x6ea474]
mov ebx, dword [eax*4 + 0x6ea470]
mov edx, ecx
and edx, 1
neg edx
and edx, 0x9908b0df
and ebx, 0x80000000
and ecx, 0x7fffffff
or ebx, ecx
shr ebx, 1
xor edx, ebx
xor edx, dword [eax*4 + 0x6ea0e4]
mov dword [eax*4 + 0x6ea470], edx
cmp eax, 0x26e
jl 0x40fb28
mov edx, dword [0x6ea470]
mov ecx, dword [0x6eae2c]
mov eax, edx
and eax, 1
neg eax
and eax, 0x9908b0df
and ecx, 0x80000000
and edx, 0x7fffffff
or ecx, edx
shr ecx, 1
xor eax, ecx
xor eax, dword [0x6eaaa0]
mov dword [0x6eae2c], eax
mov dword [0x5f5030], 0
pop ebx
ret

Function at 0x40fbb0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebx
mov ebx, dword [0x5f5030]
add dword [0x5f5030], 1
mov eax, dword [0x6e9020]
cmp eax, dword [0x5f4780]
jne 0x40fbd3
cmp ebx, 0x271
jb 0x40fbf4
mov eax, dword [0x6e9020]
call fcn.0040fa90
not dword [0x6e9020]
mov eax, dword [0x6e9020]
mov dword [0x5f4780], eax
mov ebx, 0x270
mov esi, esi
cmp ebx, 0x270
jne 0x40fc10
call fcn.0040fad0
xor ebx, ebx
mov dword [0x5f5030], 1
lea esi, [esi]
mov edx, dword [ebx*4 + 0x6ea470]
mov eax, edx
shr eax, 0xb
xor eax, edx
mov edx, eax
shl edx, 7
and edx, 0x9d2c5680
xor edx, eax
mov ecx, edx
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, edx
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebx
ret
Function at 0x411760
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
push edi
mov ax, word [0x5f44c0]
cmp ax, 0xcb
je 0x41186c
cmp ax, 0xcc
je 0x41186c
lea esi, [esi]
mov edx, dword [0x6eb070]
test edx, edx
je 0x411795
mov eax, dword [0x6eaf20]
call edx
mov ebx, eax
jmp 0x41179a
mov ebx, 0x6eaf24
cmp word [0x6eaf10], 0
jle 0x4117c0
mov eax, 0x6eaef0
call fcn.004119d0
mov eax, ebx
call fcn.00411320
mov eax, ebx
call fcn.00411390
lea esi, [esi]
mov edi, dword [ebx]
jmp 0x4117e2
mov esi, dword [edi + 4]
mov eax, dword [edi]
and eax, 1
jne 0x4117dd
mov edx, edi
mov eax, ebx
call fcn.00410790
jmp 0x4117e0
and dword [edi], 0xfffffffe
mov edi, esi
test edi, edi
jne 0x4117c8
mov dword [ebx], 0
mov dword [ebx + 0x88], 0
cmp word [0x6eaf10], 0
jle 0x41186c
mov edx, 0x6eae30
mov eax, ebx
call fcn.004108d0
mov edi, eax
test edi, edi
je 0x41183c
mov eax, dword [0x6eaec4]
mov dword [edi + 0xc], eax
cmp dword [0x6eaec4], 0
je 0x411830
mov eax, dword [0x6eaec4]
mov dword [eax + 8], edi
mov eax, dword [ebx + 0x94]
mov dword [0x6eaec4], eax
nop
sub word [0x6eaf10], 1
cmp word [0x6eaf10], 0
sete bl
mov eax, 0x6eaef0
call fcn.004119f0
test bl, bl
je 0x41186c
mov eax, 0x6eaef0
call fcn.004119c0
lea esi, [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x413a20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov byte [ebp - 0x20], al
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00413a00
push ebp
push 0x414e20
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x20], 0xff
je 0x413b4a
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
mov word [ebp - 8], ax
mov word [ebp - 6], 0x3a
mov word [ebp - 4], 0
mov word [ebp - 2], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040be10
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
test edx, edx
jne 0x413aaf
mov edx, 0x6ea2f0
push edx
push esi
lea eax, [ebp - 8]
push eax
call sub.kernel32.dll_GetFullPathNameW
mov ebx, eax
test ebx, ebx
jne 0x413b01
call sub.kernel32.dll_GetLastError
call fcn.004043b0
lea eax, [ebp - 0x10]
call fcn.0040a590
movzx eax, byte [ebp - 0x20]
sub eax, 0xffffffc0
lea edx, [ebp - 0x14]
call fcn.0040ab40
mov edx, dword [ebp - 0x14]
mov ecx, 0x664390
lea eax, [ebp - 0x10]
call fcn.0040a8c0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
call fcn.0040b5c0
jmp 0x413b98
mov eax, esi
mov edx, 0
sub eax, 1
sbb edx, 0
mov ecx, ebx
xor edi, edi
cmp edx, edi
jne 0x413b1a
cmp eax, ecx
je 0x413b24
mov eax, dword [ebp - 0x1c]
mov edx, ebx
call fcn.0040be10
cmp byte [0x5f4750], 0
jne 0x413b98
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040c490
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b6d0
lea esi, [esi]
jmp 0x413b98
push 0
push 0
call sub.kernel32.dll_GetCurrentDirectoryW
mov esi, eax
lea edx, [esi - 1]
mov eax, dword [ebp - 0x1c]
call fcn.0040be10
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
test eax, eax
jne 0x413b6e
mov eax, 0x6ea2f0
push eax
push esi
call sub.kernel32.dll_GetCurrentDirectoryW
cmp byte [0x5f4750], 0
jne 0x413b98
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx]
lea edx, [ebp - 0x18]
call fcn.0040c490
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
call fcn.0040b6d0
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00413a00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x413fb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x6ea260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00414190
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x6ea260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.004038c0
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5f4540], eax
mov ebx, eax
jmp 0x414153
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x414038
cmp byte [ebx], 0
je 0x41415c
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x4140b3
mov al, byte [ebx]
cmp al, 1
jb 0x4140a8
sub al, 0x20
jbe 0x414078
sub al, 2
je 0x41408c
jmp 0x4140a8
mov al, byte [ebp - 0x114]
test al, al
je 0x4140b8
add dword [ebp - 0x110], 1
jmp 0x4140b0
cmp byte [ebx + 1], 0x22
je 0x4140a3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4140b0
add ebx, 1
jmp 0x4140b0
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x414068
test dword [ebp - 0x10c], 0xffffffff
je 0x41414c
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00414190
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x6ea260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x414143
mov al, byte [ebx]
cmp al, 1
jb 0x414138
sub al, 0x20
jbe 0x414108
sub al, 2
je 0x41411c
jmp 0x414138
mov al, byte [ebp - 0x114]
test al, al
je 0x414148
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x414140
cmp byte [ebx + 1], 0x22
je 0x414133
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x414140
add ebx, 1
jmp 0x414140
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4140f8
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x41403b
mov ebx, dword [ebp - 0x10c]
mov dword [0x6ea250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x6ea260
call fcn.004115a0
mov eax, dword [0x6ea260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x430e60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.0042f500
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00413d30
mov dword [ebp - 0x20], eax
mov eax, 0x66a64c
push eax
push dword [0x6ea2d0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x430eb8
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
mov esi, esi
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, 0x5f53a0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x430f34
or dword [ebp - 0x30], 0x800
cmp dword [0x60f060], 6
jb 0x430f0c
or dword [ebp - 0x30], 0x20000
mov esi, esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov esi, esi
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x432030
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4320c8
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x4320c8
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.00432010
push ebp
push 0x414e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00432010
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432790
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.00432770
push ebp
push 0x414e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x43285c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.004cbdc0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.004cbd10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.004cc4d0
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.004cd6e0
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4328b3
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.00432750
push ebp
push 0x414e20
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00432750
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.00432770
pop ebx
mov esp, ebp
pop ebp
ret