joyce8/EMBER2024-capa huggingface dataset:
Function at 0x517b20
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x5b339c]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
mov ebp, dword [esp + 0x224]
push esi
mov esi, dword [esp + 0x22c]
push edi
mov edi, dword [esp + 0x234]
xor ebx, ebx
push 0x57ea28
mov ecx, edi
mov dword [esp + 0x14], ebx
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esi + 0x18], 8
jb 0x517b6b
mov esi, dword [esi + 4]
jmp 0x517b6e
add esi, 4
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x517bc6
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x517bc6
cmp dword [esp + 0x18], 1
jne 0x517bc6
lea edx, [esp + 0x1c]
push edx
mov ecx, edi
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov bl, 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.0051973e
add esp, 0x218
ret

Function at 0x517bf0
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
cmp dword [eax + 0x18], 8
mov dword [esp + 4], ebx
jb 0x517c07
mov eax, dword [eax + 4]
jmp 0x517c0a
add eax, 4
mov edx, dword [esp + 0xc]
push ebx
lea ecx, [esp + 8]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x517c7b
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x14], ebx
jbe 0x517c70
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x18], 8
mov edx, dword [eax + 0x14]
jb 0x517c44
mov eax, dword [eax + 4]
jmp 0x517c47
add eax, 4
cmp dword [ecx + 0x18], 8
jb 0x517c52
mov ecx, dword [ecx + 4]
jmp 0x517c55
add ecx, 4
lea edx, [edx + edx + 2]
push edx
push eax
mov eax, dword [esp + 0xc]
push 1
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x517c70
mov bl, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret
Function at 0x517c80
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
cmp dword [eax + 0x18], 8
mov dword [esp + 4], ebx
jb 0x517c97
mov eax, dword [eax + 4]
jmp 0x517c9a
add eax, 4
mov edx, dword [esp + 0xc]
push ebx
lea ecx, [esp + 8]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x517cf7
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x14], ebx
jbe 0x517cec
cmp dword [eax + 0x18], 8
jb 0x517ccd
mov eax, dword [eax + 4]
jmp 0x517cd0
add eax, 4
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x517cec
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret

Function at 0x517d00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5b339c]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov ebx, dword [esp + 0x230]
push ebp
mov ebp, dword [esp + 0x228]
push esi
mov esi, dword [esp + 0x230]
push edi
mov edi, dword [esp + 0x238]
push 0x57ea28
mov ecx, ebx
mov byte [esp + 0x17], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
cmp dword [esi + 0x18], 8
jb 0x517d59
mov esi, dword [esi + 4]
jmp 0x517d5c
add esi, 4
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push esi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x517dfa
push 0x208
push eax
lea ecx, [esp + 0x28]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 8
mov dword [esp + 0x18], 0x208
jb 0x517d9e
mov edi, dword [edi + 4]
jmp 0x517da1
add edi, 4
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x517de7
cmp dword [esp + 0x1c], 1
jne 0x517de7
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov ecx, dword [esp + 0x14]
push ecx
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x517dfe
mov ecx, dword [esp + 0x14]
mov bl, byte [esp + 0x13]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0x517dfe
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x228]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051973e
add esp, 0x21c
ret
Function at 0x517e20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
xor ebx, ebx
cmp dword [eax + 0x18], 8
mov dword [esp + 4], ebx
jb 0x517e37
mov eax, dword [eax + 4]
jmp 0x517e3a
add eax, 4
mov edx, dword [esp + 0xc]
lea ecx, [esp + 4]
push ecx
push 0x20019
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x517e9b
mov eax, dword [esp + 0x14]
cmp dword [eax + 0x18], 8
jb 0x517e64
mov eax, dword [eax + 4]
jmp 0x517e67
add eax, 4
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push ecx
push edx
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x517e90
cmp dword [esp + 0x10], 3
jne 0x517e90
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
pop ecx
ret
Function at 0x517ea0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x5372bc
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x5b339c]
xor eax, esp
mov dword [esp + 0x22c], eax
push ebx
push esi
push edi
mov eax, dword [0x5b339c]
xor eax, esp
push eax
lea eax, [esp + 0x240]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x254]
cmp dword [ebx + 0x18], 8
mov esi, dword [esp + 0x250]
mov dword [esp + 0x14], esi
lea edi, [ebx + 4]
jb 0x517ef9
mov eax, dword [edi]
jmp 0x517efb
mov eax, edi
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x517fb1
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x104
lea edx, [esp + 0x38]
push edx
push 0
push eax
call esi
test eax, eax
jne 0x517fa2
lea ecx, [esp + 0x18]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24c], 0
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.00517ea0
add esp, 8
mov dword [esp + 0x248], 0xffffffff
lea ecx, [esp + 0x18]
test al, al
je 0x517f9c
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x10]
push 0x104
lea eax, [esp + 0x38]
push eax
push 0
push ecx
call esi
test eax, eax
je 0x517f34
jmp 0x517fa2
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
cmp dword [ebx + 0x18], 8
jb 0x517fbb
mov eax, dword [edi]
jmp 0x517fbd
mov eax, edi
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete al
mov ecx, dword [esp + 0x240]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.0051973e
add esp, 0x23c
ret

Function at 0x51973e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5b339c]
jne 0x519748
repz ret
jmp fcn.00519e92
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x403203
pop dword [ebp - 0x50]
mov eax, 0xc58f3e6
add eax, 0xf3e73e1d
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x99457c81
add dword [ebp - 0x60], 0xb50cc8ca
mov dword [ebp - 0x5c], 0x772e7775
add dword [ebp - 0x5c], 0xbb04d4d0
mov dword [ebp - 0x58], 0xab081d57
sub dword [ebp - 0x58], 0x5ebbd929
mov dword [ebp - 0x54], 0xc644993f
sub dword [ebp - 0x54], 0xc644993f
lea eax, [ebp - 0x60]
push eax
mov eax, 0xee34b820
add eax, 0x120bb844
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xbadbd46f
add dword [ebp - 0x60], 0xb99694e7
mov dword [ebp - 0x5c], 0x4451fbc5
add dword [ebp - 0x5c], 0xfd1a65b0
mov dword [ebp - 0x58], 0xcee94e08
sub dword [ebp - 0x58], 0x6b79e19c
mov dword [ebp - 0x54], 0xd9824480
sub dword [ebp - 0x54], 0xd9824480
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x381e5
push 0
call eax
mov ecx, 0x64c87835
sub ecx, 0x64c82a1c
mov ebx, eax
mov edi, 0x6ddec09c
add edi, 0x92623f64
add edi, dword [ebp - 0x50]
mov edx, 0x3af611bf
sub edx, 0xf294a2c6
sub dword [ebp - 0x40], 0xb2a7ff73
mov esi, dword [edi]
add dword [ebp - 0x38], 0xf414522d
add esi, edx
xor dword [ebp - 0x10], 0x9bb0a016
mov dword [ebx], esi
mov dword [ebp - 0x40], 0xd2201bbb
add ebx, 4
add edi, 0xdafa5155
sub edi, 0xdafa5151
loop 0x403320
add eax, 0x52b1e6b5
add eax, 0xad4f4482
mov ebx, eax
add eax, 0x9c6cfcaa
sub eax, 0x9c6cfca5
mov ecx, 0xeb29c244
add ecx, 0x15163dbc
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x40c600
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40c625
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40c630
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40c625
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x40c678
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40c66e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40c67a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x40c660
xor eax, eax
pop ebx
pop esi
ret

Function at 0x411280
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
xor eax, eax
mov ecx, 0x10
sub esp, 0x88
lea edi, [esp + 0x40]
mov dword [esp + 0x15], 0x6f727245
mov dword [esp + 0x19], 0x6c632072
mov dword [esp + 0x1d], 0x696e6165
mov dword [esp + 0x21], 0x7520676e
mov dword [esp + 0x25], 0x70732070
mov dword [esp + 0x29], 0x6b5f6e69
mov dword [esp + 0x2d], 0x20737965
mov dword [esp + 0x31], 0x20726f66
mov dword [esp + 0x35], 0x65726874
mov dword [esp + 0x39], 0x206461
mov dword [esp + 0x3d], 0
mov dword [esp + 0x7c], 0
rep stosd dword es:[edi], eax
call dword [0x4e236c]
lea edx, [esp + 0x3c]
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [0x4e24a8]
cmp byte [esp + 0x3c], 0
je 0x41135b
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x41132d
cmp eax, 0x6a
je 0x41134a
mov ecx, eax
add eax, 1
cmp byte [edx + eax], 0
jne 0x411328
cmp eax, 0x6a
je 0x41134a
add ecx, 2
mov byte [esp + eax + 0x15], 0xa
mov byte [esp + ecx + 0x15], 0
mov dword [esp], edx
call dword [0x4e23b8]
sub esp, 4
call fcn.004223f0
mov ecx, 0x28
mov eax, 0x27
lea edx, [esp + 0x15]
jmp 0x411340
Function at 0x4e0489
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not al
mov esi, ebx
lea eax, [edx]
mov edi, ebx
stc
mov al, ch
add esi, dword [edx + 0x24]
add edi, dword [edx + 0x1c]
jmp 0x4e0538
add eax, dword [ebx + 0x3c]
add edx, dword [eax + 0x78]
sbb edi, edx
dec ch
lea ecx, [edx - 0x65]
xor ch, 0xe4
adc cl, bh
lea ecx, [edi]
xchg ch, ch
add esi, dword [edx + 0x20]
inc edi
or ecx, 0xffffffff
inc ecx
jmp 0x4db9a3
mov edi, edx
lodsd eax, dword [esi]
lea edi, [eax + ebx]
cmp ecx, dword [edx + 0x18]
not dh
not dh
cld
lea eax, [eax]
nop
xchg edi, esp
xchg edi, esp
je 0x4e0488
mov edx, edx
not esp
not esp
cmp dh, 4
and eax, 0
jmp 0x4e0583
ret
mov edx, ebx
cld
mov esi, ebx
mov eax, ebx
jmp 0x4db980
xchg edx, esp
xchg edx, esp
nop
nop
ja 0x4e0583
nop
xor eax, 0x212827cc
sub eax, dword [esp + 4]
jne 0x4db99d
jmp 0x4db86a
test edx, 0x53e281cb
xchg dh, dl
movzx eax, word [esi + ecx*2]
mov esi, ebx
not dh
or dh, ah
dec dh
add esi, dword [edi + eax*4]
add dh, cl
ret 4
imul eax, eax, 0xf
xor edi, eax
xor edi, eax
push eax
movzx eax, byte [edi]
jmp 0x4e05a6
add esp, esi
sub esp, esi
sub dword [esp], eax
cld
xchg ch, al
xchg ch, al
cmc
nop
dec ebp
inc ebp
nop
clc
and edx, edx
inc edi
cmp byte [edi], 0
pop eax
jmp 0x4e04d6
Function at 0x401000
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40afbb
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x40e050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor esi, esi
push str.GlobalENPSetup
push esi
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4010ba
push 0x48
mov dword [ebp - 4], esi
call fcn.00403092
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
cmp edi, esi
je 0x401078
push edi
call fcn.00401ea0
mov dword [edi], vtable.CHydroMSIInstall.0
mov dword [edi + 0x40], esi
mov dword [edi + 0x44], esi
jmp 0x40107a
xor edi, edi
or esi, 0xffffffff
push 1
mov dword [ebp - 4], esi
call fcn.00402470
test eax, eax
je 0x4010ac
push edi
call fcn.00401490
test eax, eax
jne 0x4010ac
mov ecx, dword [ebp + 0x10]
mov ebx, edi
call fcn.00401140
test eax, eax
jne 0x4010ac
call fcn.00401440
test eax, eax
je 0x4010af
mov dword [ebp - 0x14], esi
test edi, edi
je 0x4010ba
mov esi, edi
call fcn.004010e0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402070
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov esi, eax
cmp dword [esi + 0x34], 0
je 0x40210d
cmp dword [esi + 0x3c], 0
je 0x40210d
push edi
push 0x3c
xor edi, edi
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.004055d0
add esp, 0xc
cmp dword [esi + 0x1c], 8
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x4040
mov dword [ebp - 0x30], str.open
mov dword [ebp - 0x2c], str.msiexec.exe
jb 0x4020c9
mov ecx, dword [esi + 8]
mov dword [ebp - 0x28], ecx
jmp 0x4020cf
add esi, 8
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x20], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x402102
mov eax, dword [ebp - 4]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xfffffffe
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4023e0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x24], 0
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, 8
je 0x40241d
cmp dword [ebp + 0x20], edi
jae 0x4023fb
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
cmp dword [ebp + 0x20], edi
jb 0x40245e
mov eax, dword [ebp + 0xc]
push eax
call fcn.004030f7
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x20
cmp dword [ebp + 0x20], edi
jae 0x402425
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40244b
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x20], edi
jae 0x40243b
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40244b
lea esi, [eax + 1]
jmp 0x40244d
xor esi, esi
cmp dword [ebp + 0x20], edi
jb 0x40245e
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004030f7
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
ret 0x20

Function at 0x403068
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e050]
jne 0x403072
repz ret
jmp fcn.00403f46

Function at 0x409cfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404de2
and dword [ebp - 4], 0
cmp dword [0x40f870], 0
mov ebx, eax
jne 0x409dad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409e5e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409e5e
push eax
call fcn.00404d70
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40f870], eax
call esi
push eax
call fcn.00404d70
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40f874], eax
call esi
push eax
call fcn.00404d70
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40f878], eax
call esi
push eax
call fcn.00404d70
pop ecx
mov dword [0x40f880], eax
test eax, eax
je 0x409dad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404d70
pop ecx
mov dword [0x40f87c], eax
mov eax, dword [0x40f87c]
cmp eax, ebx
je 0x409e05
cmp dword [0x40f880], ebx
je 0x409e05
push eax
call fcn.00404deb
push dword [0x40f880]
mov esi, eax
call fcn.00404deb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409e05
test edi, edi
je 0x409e05
call esi
test eax, eax
je 0x409dfc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409dfc
test byte [ebp - 0xc], 1
jne 0x409e05
or dword [ebp + 0x10], 0x200000
jmp 0x409e3e
mov eax, dword [0x40f874]
cmp eax, ebx
je 0x409e3e
push eax
call fcn.00404deb
pop ecx
test eax, eax
je 0x409e3e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409e3e
mov eax, dword [0x40f878]
cmp eax, ebx
je 0x409e3e
push eax
call fcn.00404deb
pop ecx
test eax, eax
je 0x409e3e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40f870]
call fcn.00404deb
pop ecx
test eax, eax
je 0x409e5e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e60
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401090
Capabilities:
Query environment variable

Disassembly:
push str.console_exe
call fcn.00401970
add esp, 4
test eax, eax
jne 0x4010ab
call fcn.00402850
jmp 0x401ac0
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push esi
push edi
push eax
push ecx
call dword [0x4057b4]
push 1
call dword [0x40581c]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401b20
call dword [0x40568c]
push eax
call dword [0x40579c]
add esp, 4
test eax, eax
je 0x401b17
push eax
push 0
push esi
call dword [0x405824]
add esp, 0xc
test eax, eax
jne 0x401b17
push esi
push 0x405254
call dword [0x40578c]
add esp, 8
push esi
call fcn.00401b70
add esp, 4
call fcn.004019d0
push 0x405234
mov edi, eax
call dword [sym.imp.MSVCR90.dll_getenv]
add esp, 4
test eax, eax
je 0x401b65
mov esi, dword [sym.imp.MSVCR90.dll___iob_func]
push 0x405244
call esi
push eax
call dword [0x4057a4]
add esp, 8
test eax, eax
je 0x401b65
push 0x40524c
call esi
push eax
call dword [0x4057ac]
add esp, 8
call dword [0x405684]
mov eax, edi
pop edi
pop esi
ret

Function at 0x401150
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push str.PYTHONSCRIPT
push 1
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp byte [0x406420], 0
mov esi, eax
jne 0x401178
push edi
call fcn.004010b0
add esp, 4
test esi, esi
jne 0x401195
push str.Could_not_locate_script_resource:
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call section..text
add esp, 8
pop edi
xor eax, eax
pop esi
ret
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
jne 0x4011ba
push str.Could_not_load_script_resource:
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call section..text
add esp, 8
pop edi
xor eax, eax
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [0x406524], eax
mov dword [0x40664c], eax
test eax, eax
jne 0x4011e8
push str.Could_not_lock_script_resource:
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
call section..text
add esp, 8
pop edi
xor eax, eax
pop esi
ret
mov ecx, dword [eax + 0xc]
mov dword [0x406644], ecx
lea ecx, [eax + 0x10]
mov dword [0x406524], ecx
cmp dword [eax], 0x78563412
je 0x401216
push str.Bug:_Invalid_script_resource
push 0
call section..text
add esp, 8
pop edi
xor eax, eax
pop esi
ret
mov eax, ecx
lea esi, [eax + 1]
jmp 0x401220
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401220
sub eax, esi
lea edx, [ecx + eax + 1]
mov dword [0x406524], edx
cmp byte [ecx], 0
je 0x40125e
push ecx
push 0x406420
push 0x4050c0
push 0x304
push 0x405de0
call dword [sym.imp.MSVCR90.dll__snprintf]
add esp, 0x14
pop edi
mov eax, 1
pop esi
ret
push 0x304
push 0x405de0
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
pop edi
mov eax, 1
pop esi
ret