joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f290
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0xcfc
lea eax, [esp + 0x144]
push ebp
mov ebp, ecx
mov ecx, dword [esp + 0xd04]
push esi
push edi
push eax
push ecx
mov ecx, ebp
call fcn.0040eff0
lea edi, [esp + 0x150]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x14f], 0x5c
je 0x40f32b
mov ecx, 0x104
lea eax, [esp + 0x150]
cmp byte [eax], 0
je 0x40f2e4
inc eax
dec ecx
jne 0x40f2d9
jmp 0x40f32b
test ecx, ecx
je 0x40f32b
lea edx, [esp + 0xc]
test edx, edx
je 0x40f2f9
mov eax, 0x104
sub eax, ecx
jmp 0x40f2fd
mov eax, dword [esp + 0xc]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x150]
je 0x40f32b
mov esi, 0x4417f4
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40f323
mov byte [eax], cl
inc eax
dec edx
jne 0x40f314
jmp 0x40f327
test edx, edx
jne 0x40f328
dec eax
mov byte [eax], 0
lea eax, [esp + 0x150]
lea ecx, [esp + 0x538]
push eax
push 0x442b00
push 0x104
push ecx
call fcn.0042b070
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x538]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
test edi, edi
je 0x40f456
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x154]
push ecx
push edx
push 0x441c7c
lea eax, [esp + 0x930]
push 0x104
push eax
call fcn.0042b070
add esp, 0x14
lea ecx, [esp + 0x924]
push ecx
mov ecx, ebp
call fcn.0040f230
test eax, eax
je 0x40f445
mov esi, 0x441e44
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f3dc
test cl, cl
je 0x40f3d8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f3dc
add eax, 2
add esi, 2
test cl, cl
jne 0x40f3b8
xor eax, eax
jmp 0x40f3e1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f445
mov esi, 0x441e40
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f412
test cl, cl
je 0x40f40e
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f412
add eax, 2
add esi, 2
test cl, cl
jne 0x40f3ee
xor eax, eax
jmp 0x40f417
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f445
mov esi, dword [esp + 0xd10]
lea eax, [esp + 0x40]
push esi
push eax
mov ecx, ebp
call fcn.0040f850
push esi
mov ecx, ebp
call fcn.0040ed10
test eax, eax
je 0x40f445
mov ecx, esi
push ecx
mov ecx, ebp
call fcn.0040ee30
lea edx, [esp + 0x14]
push edx
push edi
call ebx
test eax, eax
jne 0x40f371
pop ebx
pop edi
pop esi
pop ebp
add esp, 0xcfc
ret 4
Function at 0x40f470
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x914
push ebx
push ebp
mov ebp, dword [esp + 0x920]
push esi
mov dword [esp + 0xc], ecx
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp - 1], 0x5c
je 0x40f4ed
mov ecx, 0x104
mov eax, ebp
cmp byte [eax], 0
je 0x40f4aa
inc eax
dec ecx
jne 0x40f49f
jmp 0x40f4ed
test ecx, ecx
je 0x40f4ed
lea eax, [esp + 0x10]
test eax, eax
je 0x40f4bf
mov eax, 0x104
sub eax, ecx
jmp 0x40f4c3
mov eax, dword [esp + 0x10]
mov edx, 0x104
sub edx, eax
lea eax, [eax + ebp]
je 0x40f4ed
mov esi, 0x4417f4
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40f4e5
mov byte [eax], cl
inc eax
dec edx
jne 0x40f4d6
jmp 0x40f4e9
test edx, edx
jne 0x40f4ea
dec eax
mov byte [eax], 0
push ebp
push 0x442b00
lea ecx, [esp + 0x15c]
push 0x104
push ecx
call fcn.0042b070
add esp, 0x10
lea edx, [esp + 0x14]
lea eax, [esp + 0x154]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
test edi, edi
je 0x40f5ef
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x53c]
push ecx
push ebp
push 0x441c7c
push 0x104
push edx
call fcn.0042b070
mov ecx, dword [esp + 0x24]
add esp, 0x14
lea eax, [esp + 0x53c]
push eax
call fcn.0040f230
test eax, eax
je 0x40f5cc
mov esi, 0x441e44
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f58d
test cl, cl
je 0x40f589
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f58d
add eax, 2
add esi, 2
test cl, cl
jne 0x40f569
xor eax, eax
jmp 0x40f592
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40f5cc
mov esi, 0x441e40
lea eax, [esp + 0x40]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40f5c3
test cl, cl
je 0x40f5bf
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40f5c3
add eax, 2
add esi, 2
test cl, cl
jne 0x40f59f
xor eax, eax
jmp 0x40f5c8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40f5dd
lea eax, [esp + 0x14]
push eax
push edi
call ebx
test eax, eax
je 0x40f5ef
jmp 0x40f52b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x914
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x914
ret 4
Function at 0x40f850
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43745b
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x3ec
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push eax
mov ecx, dword [ebp + 0x20]
push 4
push 0x110a
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
test edi, edi
je 0x40f925
lea edx, [esp + 0x10]
push edi
push edx
mov ecx, ebp
call sub.MFC42.DLL_CTreeCtrl::GetItemText
push 0x64
mov ecx, eax
mov dword [esp + 0x408], 0
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esp + 0x40c]
mov esi, eax
mov dl, byte [ecx]
mov bl, byte [esi]
mov al, dl
cmp dl, bl
jne 0x40f8e3
test al, al
je 0x40f8df
mov dl, byte [ecx + 1]
mov bl, byte [esi + 1]
mov al, dl
cmp dl, bl
jne 0x40f8e3
add ecx, 2
add esi, 2
test al, al
jne 0x40f8bb
xor eax, eax
jmp 0x40f8e8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x404], 0xffffffff
sete bl
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x40faa0
mov eax, dword [ebp + 0x20]
push edi
push 1
push 0x110a
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
test edi, edi
jne 0x40f891
mov edx, dword [esp + 0x410]
lea ecx, [esp + 0x14]
push ecx
push edx
mov ecx, ebp
xor edi, edi
call fcn.0040eff0
mov ecx, 0x3e8
lea eax, [esp + 0x14]
cmp byte [eax], 0
je 0x40fa2f
inc eax
dec ecx
jne 0x40f944
mov ebx, dword [esp + 0x40c]
lea ecx, [esp + 0x14]
push ecx
mov ecx, ebp
call fcn.0040f470
mov esi, eax
mov eax, dword [esp + 0x410]
cmp eax, 0xffff0000
jne 0x40fa8b
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40f99d
push esi
push 0xffff0002
push 0xffff0000
push 5
push 5
push ebx
mov ecx, ebp
call fcn.0040fac0
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 5
jne 0x40f9c2
push esi
push 0xffff0002
push 0xffff0000
push 2
push 2
push ebx
mov ecx, ebp
call fcn.0040fac0
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x40f9ec
cmp byte [ebx], 0x41
jne 0x40f9ec
push esi
push 0xffff0002
push 0xffff0000
push 4
push 4
push ebx
mov ecx, ebp
call fcn.0040fac0
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x40fa16
cmp byte [ebx], 0x41
je 0x40fa16
push esi
push 0xffff0002
push 0xffff0000
push 3
push 3
push ebx
mov ecx, ebp
call fcn.0040fac0
mov edi, eax
test edi, edi
jne 0x40faa0
push esi
push 0xffff0002
push 0xffff0000
push 5
push 5
jmp 0x40fa96
test ecx, ecx
je 0x40f951
lea eax, [esp + 0x10]
test eax, eax
je 0x40fa48
mov eax, 0x3e8
sub eax, ecx
jmp 0x40fa4c
mov eax, dword [esp + 0x10]
mov edx, 0x3e8
sub edx, eax
lea eax, [esp + eax + 0x14]
je 0x40f951
mov ebx, dword [esp + 0x40c]
mov esi, ebx
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40fa7e
mov byte [eax], cl
inc eax
dec edx
jne 0x40fa68
dec eax
mov byte [eax], 0
jmp 0x40f958
test edx, edx
jne 0x40fa83
dec eax
mov byte [eax], 0
jmp 0x40f958
push esi
push 0xffff0002
push eax
push 1
push 0
push ebx
mov ecx, ebp
call fcn.0040fac0
mov edi, eax
mov ecx, dword [esp + 0x3fc]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3f8
ret 8
Function at 0x40fac0
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x34
test eax, eax
mov edx, ecx
jne 0x40fafb
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x50]
push ecx
push eax
push 0x23
mov ecx, edx
call sub.MFC42.DLL_CTreeCtrl::InsertItem
add esp, 0x34
ret 0x18
push edi
mov ecx, 0xd
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x3c]
mov edx, dword [edx + 0x20]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0xffff0002
push ecx
push 0
push 0x1100
push edx
mov dword [esp + 0x1c], 0x63
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 1
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
add esp, 0x34
ret 0x18
Function at 0x410690
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
sub esp, 0x354
push ebx
push ebp
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x25d]
mov byte [esp + 0x25c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x18]
push 0x441c58
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea ebp, [esp + 0x11c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x18]
sub ebp, eax
mov dword [esp + 0xc], eax
cmp ebp, 0x7fffffff
ja 0x41071d
push 0x441e48
push ebp
push eax
call fcn.00402320
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x120]
mov dword [esp + 0x11c], ebx
rep stosd dword es:[edi], eax
lea edx, [esp + 0x11c]
lea eax, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x41075c
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x354
ret
push esi
test byte [esp + 0x120], 0x10
jne 0x410812
mov ecx, dword [0x44f62c]
cmp ebp, 0x7fffffff
mov dword [esp + 0x14], ebx
mov edi, dword [ecx]
ja 0x4107aa
mov eax, dword [esp + 0x10]
cmp ebp, ebx
mov esi, ebp
je 0x4107aa
lea edx, [esp + 0x14c]
mov ecx, eax
sub edx, ecx
mov cl, byte [edx + eax]
cmp cl, bl
je 0x4107a3
mov byte [eax], cl
inc eax
dec esi
jne 0x410794
jmp 0x4107a7
cmp esi, ebx
jne 0x4107a8
dec eax
mov byte [eax], bl
cmp edi, dword [0x44f62c]
je 0x410807
mov edx, dword [edi + 8]
mov esi, 0x104
lea eax, [esp + 0x260]
mov cl, byte [edx]
cmp cl, bl
je 0x4107d0
mov byte [eax], cl
inc eax
inc edx
dec esi
jne 0x4107c1
jmp 0x4107d4
cmp esi, ebx
jne 0x4107d5
dec eax
mov byte [eax], bl
lea edx, [esp + 0x1c]
lea eax, [esp + 0x260]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4107f6
mov dword [esp + 0x14], 1
mov edi, dword [edi]
mov eax, dword [0x44f62c]
cmp edi, eax
jne 0x4107b2
cmp dword [esp + 0x14], ebx
jne 0x410812
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x120]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41075d
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0x354
ret
Function at 0x410c30
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x43757c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x24], edi
call sub.MFC42.DLL_CString::CString_4
mov al, byte [esp + 0xf]
xor ebx, ebx
push 0xc
mov dword [esp + 0x3c], ebx
mov byte [edi + 4], al
call sub.MFC42.DLL_operatornew
mov dword [eax], eax
mov dword [eax + 4], eax
add esp, 4
mov dword [edi + 8], eax
mov dword [edi + 0xc], ebx
mov byte [esp + 0x38], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
mov esi, eax
push ecx
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, ebx
je 0x410d57
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
cmp ecx, ebx
jle 0x410d57
push ebp
mov dword [esp + 0x20], eax
mov eax, dword [eax]
cmp eax, ebx
je 0x410d32
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 2
call sub.MFC42.DLL_CString::MakeUpper
mov esi, dword [edi + 8]
push 0xc
mov ebp, dword [esi + 4]
call sub.MFC42.DLL_operatornew
add esp, 4
cmp esi, ebx
mov ecx, esi
jne 0x410cec
mov ecx, eax
cmp ebp, ebx
mov dword [eax], ecx
jne 0x410cf4
mov ebp, eax
mov dword [eax + 4], ebp
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
lea ecx, [eax + 8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
cmp ecx, ebx
mov byte [esp + 0x3c], 3
je 0x410d1d
lea edx, [esp + 0x14]
push edx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [edi + 0xc]
lea ecx, [esp + 0x14]
inc eax
mov byte [esp + 0x3c], 1
mov dword [edi + 0xc], eax
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
inc ecx
add eax, 4
cmp ecx, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
jl 0x410cb6
mov esi, dword [esp + 0x24]
pop ebp
push esi
mov ecx, edi
call fcn.0042a312
mov ecx, dword [esp + 0x30]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x411e30
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x208
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x109]
mov byte [esp + 0x108], 0
mov byte [esp + 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 5]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10c]
push eax
call fcn.00402c90
add esp, 8
test eax, eax
jne 0x411e88
pop edi
add esp, 0x208
ret
push ebp
push esi
lea esi, [esp + 0x110]
lea ecx, [esp + 0xc]
mov edx, 0x104
lea eax, [esp + 0xc]
sub esi, ecx
mov cl, byte [esi + eax]
test cl, cl
je 0x411eaf
mov byte [eax], cl
inc eax
dec edx
jne 0x411ea0
jmp 0x411eb3
test edx, edx
jne 0x411eb4
dec eax
push 1
lea edx, [esp + 0x10]
push 1
push edx
mov byte [eax], 0
call fcn.00405c50
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x411ee8
lea ecx, [esp + 0xc]
push 0
push ecx
call ebp
mov edx, 0x104
lea eax, [esp + 0xc]
mov cl, byte [esi + eax]
test cl, cl
je 0x411f00
mov byte [eax], cl
inc eax
dec edx
jne 0x411ef1
jmp 0x411f04
test edx, edx
jne 0x411f05
dec eax
push 1
lea edx, [esp + 0x10]
push 2
push edx
mov byte [eax], 0
call fcn.00405c50
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call edi
test eax, eax
jne 0x411f2c
lea ecx, [esp + 0xc]
push eax
push ecx
call ebp
mov edx, 0x104
lea eax, [esp + 0xc]
mov cl, byte [esi + eax]
test cl, cl
je 0x411f44
mov byte [eax], cl
inc eax
dec edx
jne 0x411f35
jmp 0x411f48
test edx, edx
jne 0x411f49
dec eax
push 1
lea edx, [esp + 0x10]
push 3
push edx
mov byte [eax], 0
call fcn.00405c50
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call edi
test eax, eax
jne 0x411f70
lea ecx, [esp + 0xc]
push eax
push ecx
call ebp
mov edx, 0x104
lea eax, [esp + 0xc]
mov cl, byte [esi + eax]
test cl, cl
je 0x411f88
mov byte [eax], cl
inc eax
dec edx
jne 0x411f79
jmp 0x411f8c
test edx, edx
jne 0x411f8d
dec eax
push 1
lea edx, [esp + 0x10]
push 4
push edx
mov byte [eax], 0
call fcn.00405c50
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call edi
test eax, eax
jne 0x411fb4
lea ecx, [esp + 0xc]
push eax
push ecx
call ebp
pop esi
pop ebp
mov eax, 1
pop edi
add esp, 0x208
ret
Function at 0x411fe0
Capabilities:
Log keystrokes via application hook
Set global application hook

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
call esi
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push eax
push 0
push 0x411fd0
push 5
call edi
call esi
push eax
push 0
push 0x411fd0
push 3
call edi
call esi
push eax
push 0
push 0x411fd0
push 4
call edi
call esi
push eax
push 0
push 0x411fd0
push 0xc
call edi
call esi
push eax
push 0
push 0x411fd0
push 9
call edi
call esi
push eax
push 0
push 0x411fd0
push 0xb
call edi
call esi
push eax
push 0
push 0x411fd0
push 3
call edi
call esi
push eax
push 0
push 0x411fd0
push 1
call edi
call esi
push eax
push 0
push 0x411fd0
push 0
call edi
call esi
push eax
push 0
push 0x411fd0
push 2
call edi
call esi
push eax
push 0
push 0x411fd0
push 0xd
call edi
call esi
push eax
push 0
push 0x411fd0
push 7
call edi
call esi
push eax
push 0
push 0x411fd0
push 0xe
call edi
call esi
push eax
push 0
push 0x411fd0
push 0xffffffffffffffff
call edi
call esi
push eax
push 0
push 0x411fd0
push 0xa
call edi
call esi
push eax
push 0
push 0x411fd0
push 6
call edi
pop edi
pop esi
ret
Function at 0x412db0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x108
push esi
mov esi, ecx
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00404e40
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x412e02
mov eax, dword [esi + 0x20]
push 0x1000
push 0x44114c
push 0x448a3c
push eax
call edi
mov ecx, esi
call fcn.004152c0
call fcn.00406140
test eax, eax
jne 0x412e27
mov ecx, dword [esi + 0x20]
push 0x1000
push 0x44114c
push 0x448a08
push ecx
call edi
mov ecx, esi
call fcn.004152c0
call fcn.004052c0
test eax, eax
jne 0x412e4c
mov edx, dword [esi + 0x20]
push 0x1000
push 0x44114c
push 0x4489e8
push edx
call edi
mov ecx, esi
call fcn.004152c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 8], 1
ja 0x412e71
mov dword [esi + 0x43c], 0
jmp 0x412e8e
mov eax, dword [eax + 4]
push 0x4489d0
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x412e8e
mov dword [esi + 0x43c], 1
mov ecx, dword [esi + 0x528]
call fcn.004111a0
test eax, eax
jne 0x412eb5
mov edx, dword [esi + 0x20]
push eax
push 0x44114c
push 0x4489bc
push edx
call edi
mov ecx, esi
call fcn.004152c0
mov eax, dword [esi + 0x528]
push 0x4418e8
push 0x4489a4
push eax
call fcn.004112c0
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.00405450
mov eax, dword [esi + 0x528]
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x448988
push eax
call fcn.004112c0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
push 0x448974
rep stosd dword es:[edi], eax
call fcn.00404dd0
push 0x442894
call fcn.00404dd0
push 0x44895c
call fcn.00404dd0
push 0x448948
call fcn.00404dd0
push 0x448934
call fcn.00404dd0
add esp, 0x20
mov ecx, esi
call fcn.00420530
pop edi
pop esi
add esp, 0x108
ret
Function at 0x4152c0
Capabilities:
Suspend thread
Terminate process
Terminate thread

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
call fcn.004096c0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0xc], eax
mov eax, dword [0x44f740]
push eax
call edi
xor ebp, ebp
lea ecx, [esi + 0x4a0]
mov dword [0x44f740], ebp
call fcn.0040c370
mov ecx, esi
call fcn.0041ff30
cmp dword [esi + 0x41c], ebp
je 0x41530c
mov ecx, dword [esi + 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi + 0x2f4]
cmp eax, ebp
je 0x41531f
push eax
call edi
mov dword [esi + 0x2f4], ebp
mov eax, dword [esi + 0x2f8]
cmp eax, ebp
je 0x415340
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 0x2f8]
push edx
call edi
mov dword [esi + 0x2f8], ebp
mov eax, dword [esi + 0x440]
cmp eax, ebp
je 0x415359
push eax
call fcn.0042a030
add esp, 4
mov dword [esi + 0x440], ebp
cmp dword [esi + 0x410], ebp
je 0x41539a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x448b64
lea edi, [esi + 0x4d0]
call ebx
push eax
mov ecx, edi
call fcn.00401880
push ebp
call ebx
push eax
mov ecx, edi
call fcn.00401880
mov ecx, dword [esp + 0x10]
call fcn.00409520
push eax
mov ecx, edi
call fcn.00401880
pop ebx
lea ecx, [esi + 0x460]
call fcn.00426da0
lea ecx, [esi + 0x474]
call fcn.00429aa0
lea ecx, [esi + 0x4d0]
call fcn.00401830
mov ecx, dword [esi + 0x4e4]
call fcn.0040dc20
lea ecx, [esi + 0x4e8]
call fcn.00427920
lea ecx, [esi + 0x51c]
call fcn.004012e0
mov ecx, dword [esi + 0x528]
call fcn.00411130
cmp dword [esi + 0x1eb8], ebp
je 0x4153f8
mov ecx, dword [esp + 0xc]
call fcn.00409300
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x41a040
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x438028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
call fcn.004096c0
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x1c]
test eax, eax
jne 0x41a070
mov eax, 0x44e4fc
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov esi, dword [esp + 0x24]
test eax, eax
jne 0x41a0c6
mov al, byte [esi + 0x7c]
test al, al
jne 0x41a0c6
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x41a11c
mov ecx, dword [esp + 0xc]
push ecx
push 0
lea ecx, [edi + 0x474]
call fcn.00429af0
test eax, eax
jne 0x41a11c
mov edx, dword [esp + 0x28]
push 1
push edx
push esi
push ebx
mov ecx, edi
call fcn.00419680
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
push 1
push 0x186a6
push esi
mov ecx, edi
call fcn.00419e60
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc