joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003fd90
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1007bba3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.1006f7cc
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.10074e34
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.10076350
test eax, eax
je 0x1003feac
mov ecx, dword [esp + 0x3c]
call fcn.10074e61
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x1003fe70
push edi
mov ecx, esi
call fcn.100724ab
mov ecx, esi
call fcn.10040050
cmp dword [esp + 0x38], 1
jne 0x1003fea5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.100725e6
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x100420a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100420d3
push esi
call fcn.10050450
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x100420cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10042159
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10042142
mov eax, dword [esi + 8]
test eax, eax
je 0x100420f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1004213e
cmp eax, 2
je 0x10042142
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100420ea
cmp eax, 3
je 0x1004211d
cmp eax, 1
jne 0x100420ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100420ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100420ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.10042180
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10042168
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.10042180
add esp, 4
pop esi
ret

Function at 0x100429f0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x10042a11
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x10042a11
mov eax, dword [eax + 0x44]
test eax, eax
je 0x10042a11
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10042e60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x10042e6b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x10042f6e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x10082a38]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10082a38]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10082a38]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10082a38]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10082a38]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10082a38]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10082a38]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10082a38]
xor eax, edx
inc ecx
dec edi
jne 0x10042e86
pop edi
test esi, esi
je 0x10042f90
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10082a38]
xor eax, edx
inc ecx
dec esi
jne 0x10042f72
pop esi
pop ebx
not eax
ret
Function at 0x100705a8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x100705e0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1006e679
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1006e651
jmp 0x100705ec
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x10071c99
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10071cdb
call fcn.10077635
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10071cdb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x10071cd2
xor eax, eax
jmp 0x10071ce3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10071ce9
pop edi
pop esi
pop ebx
ret 4
Function at 0x1000ea1b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1000ea2a
pop dword [ebp - 0x20]
mov eax, 0x472c02e2
sub eax, 0x372b18b8
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3cce1
push 0
mov eax, 0x3e3227ff
add eax, 0xd1d0c8ed
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x228b6bbe
add ecx, 0xdd74cefb
mov ebx, eax
mov edi, 0xa6eedeca
add edi, 0x6915b936
add edi, dword [ebp - 0x20]
mov edx, 0x4f744b23
add edx, 0x9da279fb
sub dword [ebp - 4], 0x4eec5233
mov esi, dword [edi]
add dword [ebp - 0x10], esi
add esi, edx
add dword [ebp - 0x14], ecx
mov dword [ebx], esi
xor dword [ebp - 0x1c], 0xcad1676
add ebx, 0xf22e8d48
sub ebx, 0xf22e8d44
add edi, 4
loop 0x1000ea89
add eax, 0xddb7
mov ebx, eax
add eax, 5
mov ecx, 0x59fec5e7
sub ecx, 0x49fec5e7
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476004]
jne 0x401010
repz ret
jmp fcn.00401562

Function at 0x409246
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405eb4
and dword [ebp - 4], 0
cmp dword [0x4787a0], 0
mov ebx, eax
jne 0x4092f7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4093a8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4093a8
push eax
call fcn.00405e42
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4787a0], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4787a4], eax
call esi
push eax
call fcn.00405e42
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4787a8], eax
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x4787b0], eax
test eax, eax
je 0x4092f7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405e42
pop ecx
mov dword [0x4787ac], eax
mov eax, dword [0x4787ac]
cmp eax, ebx
je 0x40934f
cmp dword [0x4787b0], ebx
je 0x40934f
push eax
call fcn.00405ebd
push dword [0x4787b0]
mov esi, eax
call fcn.00405ebd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40934f
test edi, edi
je 0x40934f
call esi
test eax, eax
je 0x409346
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409346
test byte [ebp - 0xc], 1
jne 0x40934f
or dword [ebp + 0x10], 0x200000
jmp 0x409388
mov eax, dword [0x4787a4]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409388
mov eax, dword [0x4787a8]
cmp eax, ebx
je 0x409388
push eax
call fcn.00405ebd
pop ecx
test eax, eax
je 0x409388
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4787a0]
call fcn.00405ebd
pop ecx
test eax, eax
je 0x4093a8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4093aa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40de73
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040931a
mov dword [ebp - 0x14], eax
cmp dword [0x4ae4c0], esi
jne 0x40df66
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40def3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40e046
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40e046
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e046
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ae4c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ae4c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ae4c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ae4d0], eax
test eax, eax
je 0x40df63
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ae4cc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40df8b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40df7e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40dfa0
push 4
pop eax
jmp 0x40e048
cmp dword [ebp - 0x14], esi
je 0x40dfa0
push dword [0x4ae4c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40df85
mov eax, dword [0x4ae4cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40dffe
cmp dword [0x4ae4d0], edi
je 0x40dffe
push eax
call ebx
push dword [0x4ae4d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40dffe
test eax, eax
je 0x40dffe
call ecx
test eax, eax
je 0x40dff3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40dff3
test byte [ebp - 8], 1
jne 0x40dffe
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40e02e
mov eax, dword [0x4ae4c4]
cmp eax, edi
je 0x40e02b
push eax
call ebx
test eax, eax
je 0x40e02b
call eax
mov esi, eax
test esi, esi
je 0x40e02b
mov eax, dword [0x4ae4c8]
cmp eax, edi
je 0x40e02b
push eax
call ebx
test eax, eax
je 0x40e02b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ae4c0]
call ebx
test eax, eax
je 0x40e046
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40e048
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404429
mov esp, ebp
pop ebp
ret
Function at 0x20001420
Capabilities:
Hide graphical window

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
jne 0x2000144a
mov esi, 0x80000000
xor edi, edi
mov ebx, esi
xor ebp, ebp
jmp 0x200014c6
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
xor eax, eax
mov dword [esp + 0x18], edx
push 0x88
push eax
lea edx, [esp + 0x18]
push 0x88800000
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
sub esi, edi
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x10]
push eax
sub edi, edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, esi
add eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
mov eax, dword [esp + 0x1c]
sub eax, edi
add eax, edx
cdq
sub eax, edx
mov ebp, eax
sar ebx, 1
sar ebp, 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0
push 0
push edi
push esi
push ebp
push ebx
push 0x88800000
push str.Macromedia_Splash_Screen
push str.SplashScreenWindowClass
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x20001517
mov ecx, dword [esp + 0x3c]
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x20001530
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov dword [esp + 4], 0
call fcn.20001580
mov esi, eax
test esi, esi
je 0x20001578
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x200012f0
push 0x20000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x20001571
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
pop esi
mov eax, dword [esp]
pop ecx
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret
Function at 0x20001710
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x24
xor ecx, ecx
push ebx
mov dword [esp + 0x14], ecx
push ebp
mov dword [esp + 0x1c], ecx
push esi
mov dword [esp + 0x24], ecx
xor eax, eax
mov dword [esp + 0x28], ecx
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov ebx, 3
call fcn.20001530
mov ebp, dword [esp + 0x38]
mov esi, eax
push ebp
call fcn.20002a70
test eax, eax
jne 0x2000175f
mov edi, 7
jmp 0x200017ea
lea edx, [esp + 0x14]
push edx
call fcn.20001d20
mov edi, eax
test edi, edi
jne 0x200017ea
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.20001850
mov edi, eax
test edi, edi
jne 0x200017ea
mov edx, dword [esp + 0x10]
push str.ProjectorMain
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x2000179f
mov edi, 4
jmp 0x200017ea
test esi, esi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x18
je 0x200017bf
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0x200015f0
mov ecx, dword [0x20008ab0]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
push edx
push ebp
call eax
mov ebx, eax
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
je 0x200017fb
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x20001806
push eax
call esi
push ebp
call fcn.20002ad0
mov eax, ebx
sub eax, 0
je 0x2000183f
dec eax
je 0x20001819
dec eax
jne 0x20001823
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test edi, edi
je 0x2000182e
push edi
push ebp
call fcn.20001a10
xor eax, eax
pop edi
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0x24
ret 0x10
mov edi, 1
jmp 0x20001827
Function at 0x20001850
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x204
lea eax, [esp + 0x104]
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
mov edi, dword [esp + 0x21c]
xor esi, esi
push eax
mov dword [ebp], esi
push 0x100
xor ebx, ebx
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x2000189a
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0x204
ret 8
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.20001e40
test eax, eax
je 0x200018d3
lea edx, [esp + 0x10]
push str.proj.dll
push edx
call fcn.200019b0
mov esi, eax
mov dword [edi], 2
test esi, esi
jne 0x2000198d
mov ebx, 6
jmp 0x2000198d
lea eax, [esp + 0x10]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x20001944
lea ecx, [esp + 0x10]
push ecx
call fcn.20001690
test al, al
je 0x20001944
lea edx, [esp + 0x10]
push str.proj.dll
push edx
call fcn.200019b0
mov esi, eax
test esi, esi
je 0x20001914
mov dword [edi], 1
jmp 0x2000198d
lea eax, [esp + 0x10]
push str.Xtras
push eax
call fcn.20001670
test al, al
je 0x20001944
lea ecx, [esp + 0x10]
push str.proj.dll
push ecx
call fcn.200019b0
mov esi, eax
test esi, esi
je 0x20001944
mov dword [edi], 3
jmp 0x2000198d
lea edx, [esp + 0x10]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x20001988
lea eax, [esp + 0x10]
push str.MacromedShockwave_8
push eax
call fcn.20001670
test al, al
je 0x20001988
lea ecx, [esp + 0x10]
push str.proj.dll
push ecx
call fcn.200019b0
mov esi, eax
test esi, esi
je 0x20001988
mov dword [edi], 4
jmp 0x2000198d
mov ebx, 3
lea edx, [esp + 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp], esi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x204
ret 8

Function at 0x200019b0
Capabilities:
Set current directory

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x104
lea ecx, [esp]
push esi
push edi
mov edi, dword [esp + 0x110]
push eax
push edi
push ecx
xor esi, esi
call fcn.20001610
test eax, eax
je 0x200019f6
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x200019f6
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop esi
add esp, 0x104
ret 8
mov eax, esi
pop edi
pop esi
add esp, 0x104
ret 8
Function at 0x20001ae0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
sub esp, 0x210
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
push edi
push eax
push 0x20019
push 0
push str..htm
push 0x80000000
call ebx
test eax, eax
jne 0x20001c28
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0x208
push eax
call ebp
mov esi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x20001c28
mov edi, str._shellopencommand
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0x20019
lea ecx, [esp + 0x20]
push 0
push ecx
push 0x80000000
call ebx
test eax, eax
jne 0x20001c28
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x24], 0x208
call ebp
mov esi, eax
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x20001c28
mov edi, 0x200080a8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x228]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 4
Function at 0x20001d20
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x204
push esi
push edi
push str.msvcrt.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x20001e1e
lea eax, [esp + 0x10c]
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jne 0x20001d6f
mov ecx, dword [esp + 0x210]
pop edi
mov eax, 5
mov dword [ecx], esi
pop esi
add esp, 0x204
ret 4
lea edx, [esp + 8]
push 0
push edx
call fcn.20001e40
test eax, eax
je 0x20001d94
lea eax, [esp + 8]
push str.msvcrt.dll
push eax
call fcn.200019b0
mov esi, eax
test esi, esi
jne 0x20001dfa
lea ecx, [esp + 8]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x20001dcd
lea edx, [esp + 8]
push edx
call fcn.20001690
test al, al
je 0x20001dcd
lea eax, [esp + 8]
push str.msvcrt.dll
push eax
call fcn.200019b0
mov esi, eax
test esi, esi
jne 0x20001dfa
lea ecx, [esp + 8]
push str.Xtras
push ecx
call fcn.20001670
test al, al
je 0x20001df5
lea edx, [esp + 8]
push str.msvcrt.dll
push edx
call fcn.200019b0
mov esi, eax
test esi, esi
jne 0x20001dfa
mov edi, 2
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, edi
pop edi
mov ecx, dword [esp + 0x20c]
mov dword [ecx], esi
pop esi
add esp, 0x204
ret 4
mov edx, dword [esp + 0x210]
mov eax, edi
pop edi
mov dword [edx], esi
pop esi
add esp, 0x204
ret 4