joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa13080
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0xa51c54]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00a2ee50
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0xa1314f
mov eax, 0xa4c114
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0xa130c5
sub eax, edx
sar eax, 1
je 0xa1314f
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.00a43238]
push 0xa4c114
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00a2d398
push 0xa4c10c
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00a2ce3f
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0xa1314f
push eax
push 1
push 0x200
push esi
call fcn.00a2d6b5
mov eax, dword [esp + 0x14]
push eax
call fcn.00a2d0ed
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00a2cbc3
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00a2cbc3
add esp, 0x214
ret

Function at 0xa13330
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 0x3e8
mov dword [esp + 0x10], 0
call dword [0xa43250]
push 0xa4c1ac
lea eax, [esp + 0x10]
push 0xa76940
push eax
call fcn.00a2ce3f
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0xa13461
push 2
push 0
push eax
call fcn.00a2db2f
mov ecx, dword [esp + 0x18]
add esp, 0xc
push ecx
call fcn.00a2dd51
mov esi, eax
add esp, 4
push esi
call fcn.00a2284b
mov edx, dword [esp + 0x10]
add esp, 4
push 0
push 0
push edx
mov edi, eax
call fcn.00a2db2f
mov eax, dword [esp + 0x18]
add esp, 0xc
push eax
push esi
push 1
push edi
call fcn.00a2d6b5
add esp, 0x10
cmp esi, eax
jne 0xa13443
call dword [0xa4323c]
push eax
call fcn.00a2da71
add esp, 4
call fcn.00a2da83
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [0xa4cc50]
fmul qword [0xa4cc48]
fadd qword [0xa4cc40]
call fcn.00a2f6f0
cmp esi, eax
jl 0xa13443
mov ebx, edi
sub ebx, eax
add ebx, esi
call fcn.00a132e0
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00a2d0ed
add esp, 4
push 0xa76940
call dword [0xa43230]
push 0xa4c244
lea edx, [esp + 0x10]
push 0xa76940
push edx
call fcn.00a2ce3f
mov eax, dword [esp + 0x18]
add esp, 0xc
test eax, eax
je 0xa13461
push eax
push esi
push 1
push edi
call fcn.00a2cff4
add esp, 0x10
mov eax, dword [esp + 0xc]
test eax, eax
je 0xa13454
push eax
call fcn.00a2d0ed
add esp, 4
test edi, edi
je 0xa13461
push edi
call fcn.00a22856
add esp, 4
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0xa15330
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
xor ebp, ebp
push esi
mov ebx, ecx
push edi
mov edi, eax
mov dword [esp + 0x10], ebp
cmp ebx, ebp
je 0xa15421
cmp edi, 0xa
jb 0xa15421
lea eax, [edi*4]
mov dword [esp + 0x14], eax
inc eax
push eax
call fcn.00a2cc21
add esp, 4
mov esi, eax
push esi
push ebx
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.00a151b0
add esp, 8
test eax, eax
je 0xa1541a
mov eax, dword [esp + 0x1c]
push 0xa4b23c
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00a2ce3f
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
jne 0xa153a5
lea ebp, [eax - 2]
jmp 0xa153d0
mov edi, dword [esp + 0x14]
push eax
push edi
push 1
push esi
call fcn.00a2cff4
add esp, 0x10
cmp eax, edi
je 0xa153e7
mov ebp, 0xfffffffe
mov eax, dword [esp + 0x10]
test eax, eax
je 0xa153d0
push eax
call fcn.00a2d0ed
add esp, 4
test esi, esi
je 0xa153dd
push esi
call fcn.00a2cceb
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [0xa4323c]
call edi
xor edx, edx
mov ecx, 0x1f4
div ecx
mov ebx, edx
call edi
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, dword [esp + 0x10]
push eax
push ebx
push 1
add edx, esi
push edx
call fcn.00a2cff4
add esp, 0x10
jmp 0xa153bf
mov ebp, 0xfffffffd
jmp 0xa153bf
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret

Function at 0xa171a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0xa171a7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0xa17284
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xa4a580]
inc ecx
sub edx, 8
sub esi, 1
jne 0xa171c0
pop edi
test edx, edx
je 0xa172ab
jmp 0xa17290
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0xa4a580]
inc ecx
sub edx, 1
jne 0xa17290
not eax
pop esi
ret

Function at 0xa172b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xa4a580]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0xa4a580]
mov dword [edx + 8], ecx
ret
Function at 0xa17300
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0xa4a580]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0xa4a580]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0xa18700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xa1871e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0xa18712
cmp dword [edi + 0x7c], ebx
je 0xa1872d
call fcn.00a18ae0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00a18470
add esp, 0xc
test eax, eax
je 0xa18754
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x7e
call fcn.00a2cc21
mov esi, eax
add esp, 4
cmp esi, ebx
je 0xa18792
push 0x4000
call fcn.00a2cc21
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0xa1879f
push esi
call fcn.00a2cceb
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0xa187e7
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00a175c0
test eax, eax
jne 0xa187e7
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0xa1880e
mov cl, byte [edi + 0x39]
mov byte [esi + 0x7d], cl
jmp 0xa18814
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x7d], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x6d]
mov dword [esi + 0x79], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x71], 0x23456789
mov dword [esi + 0x75], 0x34567890
cmp ebp, ebx
je 0xa18851
lea ecx, [ecx]
mov cl, byte [ebp]
cmp cl, bl
je 0xa18851
call fcn.00a172b0
add ebp, 1
jne 0xa18840
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x401500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov edx, dword [0x40b078]
mov eax, dword [0x40b0ac]
push ebx
push ebp
push esi
mov esi, dword [0x40b074]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [eax + edx]
push 0x3fdc116f
mov dword [0x40b0b8], ecx
mov eax, dword [edi + 0x3c]
add eax, edi
sub ecx, esi
mov dword [0x40b0b8], ecx
mov ecx, dword [0x40b0b4]
mov esi, dword [eax + 0x78]
mov eax, dword [0x40b0b0]
add ecx, eax
add esi, edi
mov dword [0x40b060], ecx
mov ecx, dword [0x40b07c]
mov ebx, ecx
push 0xd9b822e0
imul ebx, ecx
mov dword [0x40b06c], ebx
mov ebx, dword [esi + 0x20]
push 0x3fe4dea1
add eax, edx
push 0x2f69bd42
push 0x44520000
add ebx, edi
mov dword [0x40b060], eax
call fcn.004016d0
add esp, 0x14
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x40b084]
mov eax, dword [0x40b0a4]
mov ecx, dword [0x40b068]
and edx, eax
mov dword [0x40b098], edx
mov edx, dword [0x40b070]
mov ebp, dword [esi + 0x1c]
add edx, ecx
mov ecx, dword [0x40b088]
mov dword [0x40b09c], edx
mov edx, dword [0x40b0ac]
add ebp, edi
and eax, edx
sub ecx, edx
mov dword [0x40b060], eax
mov eax, dword [esi + 0x24]
mov dword [0x40b0a4], ecx
mov esi, dword [esi + 0x18]
add eax, edi
mov dword [esp + 0x1c], 0
test esi, esi
mov dword [esp + 0x14], esi
jbe 0x401644
mov dword [esp + 0x10], ebx
mov ecx, dword [ebx]
mov esi, dword [esp + 0x20]
add ecx, edi
mov bl, byte [esi]
mov dl, bl
cmp bl, byte [ecx]
jne 0x40161f
test dl, dl
je 0x40161b
mov bl, byte [esi + 1]
mov dl, bl
cmp bl, byte [ecx + 1]
jne 0x40161f
add esi, 2
add ecx, 2
test dl, dl
jne 0x4015fb
xor ecx, ecx
jmp 0x401624
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x40164e
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
inc ecx
add ebx, 4
cmp ecx, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
jb 0x4015f3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x1c]
mov ecx, dword [0x40b080]
push 0x3fc3414d
push 0xb526829b
mov si, word [eax + edx*2]
mov eax, dword [0x40b060]
imul eax, dword [0x40b0ac]
push 0x3fda0f52
add ecx, eax
push 0x7d341ea5
push 0x446d8000
mov dword [0x40b0bc], eax
mov dword [0x40b0a8], ecx
call fcn.004016d0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x40b068]
and esi, 0xffff
imul edx, dword [0x40b074]
mov esi, dword [ebp + esi*4]
mov dword [0x40b08c], edx
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x401d40
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x407799
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
lea eax, [esp + 0x20]
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__::str_void_]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp eax, ebx
jne 0x401d79
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x401da5
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x401d9c
cmp al, 0xff
je 0x401d9c
dec al
mov byte [ecx], al
jmp 0x401da5
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov cl, byte [esp + 0xb]
push ebp
push edi
mov byte [esp + 0x18], cl
mov edi, 0x40c0a8
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x20], ebx
mov ebp, ecx
lea ecx, [esp + 0x1c]
push ebp
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x401e05
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov edx, ecx
mov esi, 0x40c0a8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Eos_unsigned_int_]
mov esi, dword [esp + 0x14]
mov al, byte [esi + 0x48]
add esi, 4
test al, 1
mov dword [esp + 0x40], ebx
je 0x401e21
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edi, dword [esi + 0x44]
mov eax, dword [esp + 0x1c]
and edi, 0xfffffffe
cmp eax, ebx
mov dword [esi + 0x44], edi
mov ecx, edi
pop edi
mov dword [esi + 0x3c], ebx
pop ebp
jne 0x401e3e
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
mov edx, dword [esp + 0x18]
push ecx
push edx
push eax
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_protected:_void___thiscall_std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__::_Init_char_const___unsigned_int__int_]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x401e81
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x401e78
cmp al, 0xff
je 0x401e78
dec al
pop esi
mov byte [ecx], al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov ecx, dword [esp + 0x30]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x4039e0
Capabilities:
Delete file
Get common file path
Print debug messages

Disassembly:
sub esp, 0x104
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov ebx, dword [0x40b088]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x40b070]
lea ecx, [esp + 0xc]
sub eax, ebx
push ecx
push 0x104
mov dword [0x40b0ac], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x40b064]
mov edx, dword [0x40b094]
mov edi, dword [esp + 0x114]
and eax, edx
mov edx, dword [0x40b0bc]
mov dword [0x40b0a4], eax
sub edx, eax
or ecx, 0xffffffff
xor eax, eax
mov dword [0x40b0a0], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x40b06c]
mov ecx, ebx
mov ebx, dword [0x40b0ac]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x40b070]
lea edx, [esp + 0xc]
sub eax, ecx
mov ecx, dword [0x40b0b4]
and ebx, ecx
push 0
push edx
mov dword [0x40b0bc], eax
mov dword [0x40b0ac], ebx
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
test eax, eax
jne 0x403ae0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x403ae0
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [0x40b0b4]
pop edi
pop esi
or eax, 0xffffffff
lea edx, [ecx + ecx]
pop ebx
mov dword [0x40b070], edx
add esp, 0x104
ret
push 0
push 0x4000080
push 1
push 0
push 0
lea eax, [esp + 0x20]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [0x40b0a4]
mov edx, dword [0x40b060]
add edx, ecx
push WaitForSingleObject
push 0x5e3
mov esi, eax
mov dword [0x40b090], edx
call fcn.00401eb0
add esp, 8
fstp st(0)
push 0x40c0a8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp esi, 0xffffffff
jne 0x403b9e
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x40b09c]
push 0x3fed8471
imul eax, dword [0x40b0b4]
push 0x63b08e2
push 0x3fe67af2
push 0xf62cf5e6
push 0x44580000
mov dword [0x40b0ac], eax
call fcn.004016d0
add esp, 0x14
push 0
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ecx, dword [0x40b08c]
mov edx, dword [0x40b080]
add ecx, edx
mov dword [0x40b0a0], ecx
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x104
ret
Function at 0x404800
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x407ae0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x40b0a8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [0x40b0b0]
push ebx
and eax, ecx
mov ecx, dword [0x40b068]
push esi
mov dword [0x40b0b8], eax
mov eax, dword [0x40b09c]
push edi
mov dword [ebp - 0x10], esp
sub ecx, eax
push 0x8097
mov dword [0x40b0a8], ecx
call fcn.00403bb0
add esp, 4
fstp st(0)
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, dword [0x40b0a0]
push 0xa
imul edx, dword [0x40b060]
push 0
push 0x40
push 0x3000
push 0x4dc5c
push 0
mov dword [0x40b07c], edx
call fcn.004049d0
mov ecx, dword [0x40b09c]
mov dword [ebp - 0x14], eax
imul ecx, dword [0x40b0b0]
test eax, eax
mov dword [0x40b0b8], ecx
jne 0x4048b3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [0x40b08c]
mov edi, dword [0x40b064]
lea eax, [ebp - 0x30]
sub edx, edi
push eax
mov dword [0x40b09c], edx
call fcn.00402a70
mov eax, dword [ebp - 0x2c]
add esp, 4
test eax, eax
je 0x4048f7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4048ee
cmp al, 0xff
je 0x4048ee
dec al
mov byte [ecx], al
jmp 0x4048f7
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
push 0
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageA]
mov ecx, dword [0x40b0bc]
mov edx, dword [0x40b06c]
lea eax, [ebp - 0x18]
add edx, ecx
push 0x408cf8
push eax
mov dword [0x40b0ac], edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0x33
call sub.MSVCRT.dll__CxxThrowException
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x1c]
push 0x408cf8
push ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x1c], 0x33
call sub.MSVCRT.dll__CxxThrowException
mov edx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x14]
mov ecx, 0x13717
lea esi, [edx + 0x4dc74]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x40b0b0]
mov ecx, dword [0x40b09c]
sub eax, ecx
mov ecx, dword [0x40b0bc]
mov dword [0x40b094], eax
mov eax, dword [0x40b074]
sub ecx, eax
mov eax, 0x404997
mov dword [0x40b0b4], ecx
ret

Function at 0x404da0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [0x40b8ec]
mov ecx, dword [0x40b8b0]
add ecx, eax
push 0x40c0a8
mov dword [0x40b8d0], ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [0x40b8a8]
mov ecx, dword [0x40b8ac]
sub edx, ecx
push 0
mov dword [0x40b8d4], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
fld dword [0x408728]
ret
Function at 0x80a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x80a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x833074
push ecx
mov edi, eax
call fcn.0081e198
mov esi, eax
add esp, 8
test esi, esi
jne 0x80a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0081e02e
push esi
call fcn.0081dfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x80d850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x80d8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x838720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x80d8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0081e1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x80d8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x838720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x80d92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0081f082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x80d957
mov word [eax], si
add eax, 2
push eax
call fcn.0081f030
add esp, 4
jmp 0x80d959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x80d8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x80d8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x80dff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret