joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407fbb
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x527ce4], 0
jne 0x408118
push ebx
xor eax, eax
push esi
inc eax
push edi
mov word [0x527ce4], ax
call fcn.004136a7
mov esi, eax
mov ebx, 0x4c0604
push 0x401
lea eax, [ebp - 0x510]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x510]
add ecx, eax
push ecx
call fcn.0040972a
xor edi, edi
lea eax, [ebp - 0x10c]
push edi
push edi
push edi
push eax
push edi
push edi
push dword [esi]
call fcn.0040d952
lea eax, [ebp - 0x510]
push 0x4c04f0
push eax
call fcn.00447146
add esp, 0x28
test eax, eax
je 0x40805b
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00409732
pop ecx
pop ecx
test eax, eax
je 0x408066
push edi
push ebx
push dword [esi]
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.0040c264
call fcn.0043a9ec
push 0x43aa0d
call fcn.00441a49
call fcn.0043f1ca
mov dword [esp], 0x43f202
call fcn.00441a49
call fcn.0040fb6e
mov dword [esp], 0x40fc3d
call fcn.00441a49
call fcn.00441171
call fcn.0040cbad
call fcn.0040f770
mov dword [esp], 0x40f91b
call fcn.00441a49
call fcn.0042c305
mov dword [esp], 0x42c412
call fcn.00441a49
call fcn.0040fc33
mov dword [esp], fcn.00446a1d
call fcn.00441a49
call fcn.00414108
call fcn.0042bf08
call fcn.00446a1d
call fcn.00420925
call fcn.0040dfda
call fcn.00413eb6
mov dword [esp], fcn.00413f9b
call fcn.00441a49
call fcn.00420d74
mov dword [esp], 0x420e09
call fcn.00441a49
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
Function at 0x40ba53
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x334
mov eax, dword [0x514d34]
xor eax, esp
mov dword [esp + 0x330], eax
mov eax, dword [esp + 0x33c]
push ebp
push esi
mov esi, dword [esp + 0x340]
push edi
push 0x519
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor edi, edi
push edi
push edi
push edi
push edi
push edi
push esi
push esi
call fcn.0040d952
lea eax, [esp + 0x14c]
push eax
call fcn.0040e111
add esp, 0x20
push edi
push edi
push edi
push edi
push esi
call fcn.00447230
pop ecx
add eax, esi
push eax
lea eax, [esp + 0x144]
push edi
push eax
call fcn.0040d952
push str.dbghelp.dll
push esi
call fcn.00446fa0
add esp, 0x24
mov dword [str.dbghelp.dll], esi
mov ebp, 0x50b244
cmp dword [str.dbghelp.dll], edi
je 0x40bc39
push ebx
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x40bb12
push str.MiniDumpWriteDump
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x40bb1f
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add ebp, 4
cmp dword [ebp], edi
jne 0x40bae8
jmp 0x40bc38
push 0x105
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push edi
push edi
lea eax, [esp + 0x38]
push eax
push edi
push edi
push eax
call fcn.0040d952
push edi
push edi
push edi
push edi
push edi
push esi
push esi
call fcn.0040d952
lea eax, [esp + 0x16c]
push eax
call fcn.0040e0d1
add esp, 0x3c
push edi
push edi
push edi
push edi
push esi
call fcn.00447230
pop ecx
add eax, esi
push eax
lea eax, [esp + 0x148]
push edi
push eax
call fcn.0040d952
lea eax, [esp + 0x48]
push eax
push esi
call fcn.00446fa0
push str..DMP
push esi
call fcn.00446fa0
add esp, 0x2c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40bbac
test al, 1
je 0x40bbac
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
push 0x80
push 2
push edi
push 2
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40bc31
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x20], eax
test ecx, ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x24], ecx
push eax
push edi
lea eax, [esp + 0x28]
mov dword [esp + 0x30], edi
cmove eax, edx
mov dword [esp + 0x20], 0x40bf20
push eax
push dword [0x50b20c]
mov dword [esp + 0x2c], edi
push ebx
call fcn.0040bf82
pop ecx
pop ecx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [esp + 0x30]
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
test esi, esi
cmovne edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
mov ecx, dword [esp + 0x33c]
mov ax, di
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00441a5e
add esp, 0x334
ret
Function at 0x40bc54
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xfe0]
mov eax, 0x1060
call fcn.00441db0
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0xfdc], eax
lea eax, [ebp + 0xac0]
push eax
call fcn.0040e171
cmp byte [ebp + 0xac0], 0
pop ecx
jne 0x40bc9f
lea eax, [ebp + 0xac0]
push eax
call fcn.0040c27e
cmp byte [ebp + 0xac0], 0
pop ecx
je 0x40bd1a
lea eax, [ebp + 0x7b0]
push eax
lea eax, [ebp + 0xac0]
push eax
call fcn.0040dc9b
lea eax, [ebp + 0x7b0]
push str.overlays
push eax
call fcn.00447146
add esp, 0x10
test eax, eax
jne 0x40bd1a
lea eax, [ebp + 0xac0]
push eax
call fcn.0040dcf0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xac0]
push eax
call fcn.0040dc9b
lea eax, [ebp - 0x7c]
push eax
call fcn.00447230
add esp, 0x10
cmp eax, 3
jne 0x40bd05
lea eax, [ebp + 0xac0]
push eax
call fcn.0040dcf0
jmp 0x40bd19
lea eax, [ebp + 0x7b0]
push eax
lea eax, [ebp + 0xac0]
push eax
call fcn.00446fa0
pop ecx
pop ecx
push ebx
push edi
lea eax, [ebp + 0xac0]
push str.axis.ini
push eax
call fcn.00446fa0
push 2
lea eax, [ebp - 0x80]
mov edi, 0x4c060e
push eax
push edi
push str.pwin
mov ebx, str.debug
lea eax, [ebp + 0xac0]
push ebx
push eax
call fcn.0041380c
push dword [ebp - 0x80]
call fcn.0040813e
cmp al, 0x59
lea eax, [ebp - 0x80]
push 2
push eax
push edi
push str.hline
lea eax, [ebp + 0xac0]
sete byte [0x527d2c]
push ebx
push eax
call fcn.0041380c
push dword [ebp - 0x80]
call fcn.0040813e
add esp, 0x40
cmp al, 0x59
lea eax, [ebp - 0x80]
sete byte [0x527d2d]
push 2
push eax
push edi
push str.logfile
lea eax, [ebp + 0xac0]
push ebx
push eax
call fcn.0041380c
push dword [ebp - 0x80]
call fcn.0040813e
add esp, 0x1c
cmp al, 0x59
jne 0x40be2e
push 2
lea eax, [ebp - 0x80]
push eax
push edi
push str.flush
lea eax, [ebp + 0xac0]
push ebx
push eax
call fcn.0041380c
push dword [ebp - 0x80]
call fcn.0040813e
add esp, 0x1c
cmp al, 0x59
lea eax, [ebp + 0x294]
sete byte [0x527d2f]
push eax
push 0x519
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp + 0x294]
push eax
push 0
push str.AXIS
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp + 0x294]
push eax
call fcn.0040cc97
mov dword [esp], 0x50b210
lea eax, [ebp + 0x294]
push 0
push eax
call fcn.0040cbb6
add esp, 0xc
mov ecx, dword [ebp + 0xfdc]
pop edi
xor ecx, ebp
pop ebx
call fcn.00441a5e
lea esp, [ebp + 0xfe0]
pop ebp
ret
Function at 0x40be45
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x4ba386
call fcn.00441d06
mov eax, dword [ebp + 0x28]
mov edi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
xor eax, eax
lea ecx, [ebp - 0x10]
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40beba
push eax
call fcn.00441cd2
mov esi, eax
pop ecx
test esi, esi
je 0x40beba
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp + 8]
push esi
push dword [ebp - 0x14]
cmovae ecx, dword [ebp + 8]
push dword [ebp - 0x10]
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40bed0
push esi
call fcn.00441cdb
pop ecx
xor bl, bl
push 0
push 1
lea ecx, [ebp + 8]
call fcn.0040758b
mov al, bl
call fcn.00441ce0
ret
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4c1278
push esi
call sub.VERSION.dll_VerQueryValueA
push esi
test eax, eax
je 0x40beb4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov ax, word [ecx + 0xa]
mov word [edi], ax
mov ax, word [ecx + 8]
mov word [ebx], ax
mov ax, word [ecx + 0xe]
mov word [edx], ax
mov ax, word [ecx + 0xc]
mov ecx, dword [ebp - 0x20]
mov word [ecx], ax
call fcn.00441cdb
pop ecx
mov bl, 1
jmp 0x40bebc

Function at 0x40c264
Capabilities:
Get common file path

Disassembly:
call fcn.0040fd2c
test ax, ax
je 0x40c279
push 0x40c05a
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
jmp fcn.0040bc54

Function at 0x40c27e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
push 0x209
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00446f90
push esi
call fcn.00447230
add esp, 0xc
cmp byte [eax + esi - 1], 0x5c
je 0x40c2ce
push 0x5c
push esi
call fcn.0040970e
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
Function at 0x40c2df
Capabilities:
Get common file path
Query environment variable
Set current directory
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x8c], eax
mov eax, dword [ebp + 0x98]
push ebx
push esi
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00446f90
lea eax, [ebp - 0x7c]
push 0x4c1278
push eax
call fcn.004478d0
add esp, 0x10
xor ebx, ebx
mov esi, 0x105
test eax, eax
je 0x40c353
lea eax, [ebp - 0x7c]
push eax
call fcn.00447230
pop ecx
cmp byte [ebp + eax - 0x7d], 0x5c
jne 0x40c353
lea eax, [ebp - 0x7c]
push eax
call fcn.00447230
movzx eax, ax
dec eax
pop ecx
cmp eax, esi
jae 0x40c44e
mov byte [ebp + eax - 0x7c], bl
cmp byte [0x527e40], bl
jne 0x40c366
push 0x527e40
call fcn.0040c27e
pop ecx
movsx eax, byte [ebp - 0x7c]
push eax
call fcn.0044778f
pop ecx
test ax, ax
je 0x40c3cb
cmp byte [ebp - 0x7b], 0x3a
jne 0x40c3cb
cmp byte [ebp - 0x7a], bl
jne 0x40c3cb
lea eax, [ebp - 0x7c]
mov byte [ebp - 0x80], 0x3d
push eax
lea eax, [ebp - 0x7f]
push eax
call fcn.00446f90
push eax
call fcn.004098b2
add esp, 0xc
lea eax, [ebp - 0x7c]
push esi
push eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [ebp - 0x7c]
push eax
call fcn.0040c454
pop ecx
test ax, ax
jne 0x40c3cb
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7c]
push ebx
push eax
push eax
call fcn.0040d952
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x40c42a
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x40c42a
movsx eax, byte [ebp - 0x7c]
push eax
call fcn.0044778f
pop ecx
test ax, ax
je 0x40c426
cmp byte [ebp - 0x7b], 0x3a
jne 0x40c426
push dword [ebp - 0x7c]
mov byte [ebp - 0x80], 0x3d
call fcn.0040813e
mov byte [ebp - 0x7f], al
lea eax, [ebp - 0x7c]
pop ecx
push eax
lea eax, [ebp - 0x80]
mov word [ebp - 0x7e], 0x3a
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x40c42a
xor eax, eax
jmp 0x40c437
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040c537
pop ecx
mov ecx, dword [ebp + 0x8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.00441a5e
lea esp, [ebp + 0x90]
pop ebp
ret
call fcn.00441f00
int3
Function at 0x40c454
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
lea eax, [ebp - 0x520]
push eax
call fcn.00446f90
cmp byte [ebp - 0x520], 0
pop ecx
pop ecx
je 0x40c4c4
lea esi, [ebp - 0x520]
xor ebx, ebx
lea eax, [ebp - 0x520]
push eax
call fcn.00447230
pop ecx
cmp byte [eax + esi - 1], 0x5c
jne 0x40c4d7
lea eax, [ebp - 0x520]
push eax
call fcn.00447230
dec eax
pop ecx
cmp eax, 0x519
jae 0x40c531
mov byte [ebp + eax - 0x520], bl
cmp byte [ebp - 0x520], bl
jne 0x40c48c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x520], bl
je 0x40c4c4
lea eax, [ebp - 0x520]
push eax
call fcn.00447230
pop ecx
cmp byte [eax + esi - 1], 0x3a
lea eax, [ebp - 0x520]
push eax
jne 0x40c502
call fcn.0040e327
pop ecx
jmp 0x40c4c7
call fcn.00447230
pop ecx
cmp eax, 0x104
jbe 0x40c513
xor eax, eax
jmp 0x40c4c7
lea eax, [ebp - 0x520]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40c52c
test al, 0x10
je 0x40c52c
xor ebx, ebx
inc ebx
mov ax, bx
jmp 0x40c4c7
call fcn.00441f00
int3

Function at 0x40cc97
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 8]
call fcn.0040d5d3
pop ecx
test ax, ax
jne 0x40ccb0
mov eax, 0xa8d
jmp 0x40cd0c
lea eax, [ebp - 4]
push eax
push 3
push dword [ebp + 8]
call fcn.0040ce6d
add esp, 0xc
test ax, ax
je 0x40cccd
mov eax, 0xaa2
jmp 0x40cd0c
push esi
push dword [ebp - 4]
call fcn.0040cd10
pop ecx
xor esi, esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40cd09
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x40cd02
push 0xfa
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 5
jl 0x40ccd9
mov eax, 0xaa2
jmp 0x40cd0b
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40d3c8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x40d3e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040d63f
pop ecx
ret
mov eax, dword [esp + 8]
xor edx, edx
mov word [eax], dx
test cl, 1
je 0x40d3f9
inc edx
mov word [eax], dx
test cl, 2
je 0x40d402
or word [eax], 2
test cl, 4
je 0x40d40b
or word [eax], 4
test cl, 0x20
je 0x40d414
or word [eax], 0x20
test cl, 0x10
je 0x40d41d
or word [eax], 0x10
xor eax, eax
ret

Function at 0x40d420
Capabilities:
Set file attributes

Disassembly:
mov cx, word [esp + 8]
xor eax, eax
test cl, 1
push 1
pop edx
cmovne eax, edx
test cl, 2
je 0x40d438
or eax, 2
test cl, 4
je 0x40d440
or eax, 4
test cl, 0x20
je 0x40d448
or eax, 0x20
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40d465
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040d63f
pop ecx
ret
xor eax, eax
ret
Function at 0x40d594
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d00a
add esp, 0xc
test ax, ax
je 0x40d5b4
mov eax, 0xa95
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40d5c8
mov eax, 0xa91
pop ebp
ret
push dword [ebp + 8]
call fcn.0040cd27
pop ecx
pop ebp
ret

Function at 0x40e327
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push edi
push esi
push eax
call fcn.00446f90
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.0040970e
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
xor ebx, ebx
mov edi, eax
inc ebx
cmp ebx, edi
jne 0x40e38d
push 0x4c34ec
push esi
call fcn.0040a2e2
pop ecx
pop ecx
test ax, ax
jne 0x40e38b
mov ax, bx
jmp 0x40e391
cmp ebx, edi
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
Function at 0x40ebac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
call fcn.00410d51
test ax, ax
je 0x40ebcf
push 0
push 2
push 1
push dword [ebp + 8]
call fcn.00410d5f
add esp, 0x10
jmp 0x40ec0c
push esi
push edi
push 0x40
xor esi, esi
mov dword [ebp - 0x54], 0x44
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00443240
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40f770
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf58
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.system.ini
push 0x14
mov esi, 0x52c970
push esi
push 0x4c060e
push str.woafont
push str.386Enh
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
call fcn.00447230
pop ecx
test ax, ax
jne 0x40f7d5
call fcn.0040fd2c
test ax, ax
je 0x40f7ca
push str.app850.fon
push esi
call fcn.00446f90
pop ecx
jmp 0x40f7d4
push str.Unable_to_Determine_Application_Font
call fcn.0042bf79
pop ecx
push esi
mov esi, dword [sym.imp.GDI32.dll_AddFontResourceA]
call esi
test eax, eax
jne 0x40f7f7
call fcn.0040fd2c
test ax, ax
jne 0x40f7f7
push str.Unable_to_Load_Application_Font
call fcn.0042bf79
pop ecx
call fcn.0040fd2c
test ax, ax
jne 0x40f907
push edi
push 0x519
lea eax, [ebp - 0xf58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0xa3c]
push eax
call fcn.00446f90
lea eax, [ebp - 0xa3c]
push 0x5c
push eax
call fcn.0040970e
lea eax, [ebp - 0xa3c]
push str.LINEDRAW.TTF
push eax
call fcn.00446fa0
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0x520]
push eax
call fcn.00446f90
lea eax, [ebp - 0x520]
push 0x5c
push eax
call fcn.0040970e
lea eax, [ebp - 0x520]
push str.LINEDRAW.FOT
push eax
call fcn.00446fa0
lea eax, [ebp - 0xa3c]
push eax
call fcn.0040d5d3
add esp, 0x34
xor edi, edi
test ax, ax
je 0x40f8c9
lea eax, [ebp - 0x520]
push eax
call fcn.0040d5d3
pop ecx
test ax, ax
jne 0x40f8c9
push edi
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0x520]
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateScalableFontResourceA]
test eax, eax
jne 0x40f8c9
push str.Unable_to_Create_LineDraw_Font
call fcn.0042bf79
pop ecx
lea eax, [ebp - 0x520]
push eax
call fcn.0040d5d3
pop ecx
test ax, ax
je 0x40f906
lea eax, [ebp - 0x520]
push eax
call esi
test eax, eax
jne 0x40f8f3
push str.Unable_to_Open_LineDraw_Font
call fcn.0042bf79
pop ecx
push edi
push edi
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
test eax, eax
je 0x40f8f3
pop edi
call fcn.0040f6fa
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00441a5e
mov esp, ebp
pop ebp
ret
Function at 0x40fb6e
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x50d238]
push 0x40fa5c
mov dword [ecx], eax
call fcn.00447cb2
push 1
call fcn.00447d18
mov eax, dword [0x50d254]
push dword [eax]
call fcn.0040fa78
add esp, 0xc
test eax, eax
je 0x40fc17
call fcn.004136a7
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [0x50d24c]
push ecx
push ecx
push dword [eax]
call fcn.0040d952
push str..ini
push dword [0x50d24c]
call fcn.00446fa0
push str.settings
push dword [0x50d250]
call fcn.00446f90
add esp, 0x2c
push 0x10
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x50d258]
push 0x11
mov word [ecx], ax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [0x50d25c]
mov word [ecx], ax
call fcn.0040f9a2
call fcn.00410fe3
call fcn.00411116
mov ecx, dword [0x50d27c]
mov word [ecx], ax
ret
push 0x10
push str.Error
push str.Cannot_Create_Application_Instance
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00447bf2
int3

Function at 0x40fd70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x40fdb1
cmp dword [ebp - 0x94], 6
jb 0x40fdb1
xor eax, eax
inc eax
jmp 0x40fdb3
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441a5e
mov esp, ebp
pop ebp
ret

Function at 0x410b95
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
call fcn.004123c5
test ax, ax
je 0x410c03
call fcn.00410eed
test ax, ax
je 0x410c03
lea eax, [ebp - 4]
push eax
push 1
push esi
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x410c03
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push str.TSAppCompat
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410bfa
cmp eax, dword [ebp - 0xc]
sbb eax, eax
neg eax
movzx esi, ax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, si
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410d5f
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x6e8]
sub esp, 0x768
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp + 0x6e4], eax
push ebx
mov ebx, dword [ebp + 0x6fc]
lea ecx, [ebp - 0x44]
push edi
mov edi, dword [ebp + 0x6f0]
mov dl, byte [edi]
lea eax, [edi + 1]
cmp dl, 0x22
cmove edi, eax
mov al, byte [edi]
test al, al
je 0x410db7
cmp dl, 0x22
sete dl
lea edx, [edx*2 + 0x20]
cmp al, dl
je 0x410db7
mov byte [ecx], al
inc ecx
inc edi
mov al, byte [edi]
test al, al
jne 0x410da9
cmp byte [edi], 0x22
mov byte [ecx], 0
jne 0x410dc0
inc edi
cmp byte [edi], 0x20
je 0x410dbf
push esi
call fcn.004125bf
test ax, ax
je 0x410e40
lea eax, [ebp - 0x44]
push 0x4c34d0
push eax
call fcn.0040a4e2
pop ecx
pop ecx
test ax, ax
je 0x410e40
lea eax, [ebp + 0x4d8]
push eax
call fcn.0045dc88
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0040a4e2
add esp, 0xc
test ax, ax
jne 0x410e40
lea eax, [ebp + 0x4d8]
push eax
call fcn.00447230
xor esi, esi
inc esi
sub esi, eax
lea eax, [ebp - 0x44]
push eax
call fcn.00447230
pop ecx
pop ecx
add eax, esi
push eax
lea eax, [ebp + 0x4d8]
push eax
call fcn.00447230
pop ecx
lea ecx, [ebp - 0x44]
add eax, ecx
push eax
mov eax, ecx
push eax
call fcn.00444bd0
add esp, 0xc
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00443240
lea eax, [ebp - 0x44]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x70], eax
add esp, 0xc
mov eax, dword [ebp + 0x6f4]
xor ecx, ecx
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x7c], 0x40
push eax
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x60], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop esi
test eax, eax
jne 0x410e93
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x410ed6
cmp dword [ebp + 0x6f8], 1
jne 0x410ea9
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
jmp 0x410ebd
cmp dword [ebp + 0x6f8], 2
jne 0x410ebd
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test ebx, ebx
je 0x410ecb
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp + 0x6e4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00441a5e
lea esp, [ebp + 0x6e8]
pop ebp
ret

Function at 0x410eed
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x514d34]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x410f2e
cmp dword [ebp - 0x94], 5
jb 0x410f2e
xor eax, eax
inc eax
jmp 0x410f30
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441a5e
mov esp, ebp
pop ebp
ret