joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4026b2
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x413082
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x138
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x68], eax
push ebx
push esi
mov esi, dword [ebp + 0x74]
push edi
xor edi, edi
push 0x124
lea eax, [ebp - 0xbc]
push edi
push eax
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc0], edi
call fcn.00508d00
add esp, 0xc
cmp esi, edi
je 0x41323d
cmp byte [esi], 0
je 0x41323d
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
or edi, 0xffffffff
cmp ebx, edi
mov dword [ebp - 0xc4], ebx
jne 0x413105
push str._GetLastError_
push dword [ebp + 0x78]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED:__s
call fcn.004020c2
add esp, 0x10
mov eax, edi
jmp 0x413240
lea eax, [ebp - 0xc0]
push eax
push ebx
mov dword [ebp - 0xc0], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x41314d
push str._GetLastError_
push dword [ebp + 0x78]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_Process32First___FAILED:__s
call fcn.004020c2
add esp, 0x10
push 0x76f
push str..Console.c
push str.TerminateProcessByNameCaseSens
push ebx
call fcn.00403134
jmp 0x4130fe
mov dword [ebp - 0xc8], edi
mov ebx, str..Console.c
mov edi, str.TerminateProcessByNameCaseSens
xor eax, eax
cmp dword [ebp + 0x78], eax
push esi
je 0x413219
cmp dword [ebp + 0x7c], eax
lea eax, [ebp - 0x9c]
push eax
je 0x41317c
call fcn.0050dc60
jmp 0x413181
call fcn.0050da80
test eax, eax
pop ecx
pop ecx
jne 0x4131dd
push dword [ebp - 0xb8]
and dword [ebp - 0xc8], 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4131d7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4131ca
push str._GetLastError_
lea eax, [ebp - 0x9c]
push eax
push str.:1:TerminateProcessByName___encountered_a_problem:_TerminateProcess___FAILED_to_terminate__s:__s:_trying_once_more_with_higher_privilege...
call fcn.00401375
add esp, 0xc
push 0x7a0
push ebx
push edi
push esi
call fcn.00403134
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xc4]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41315d
push 0x7f9
push ebx
push edi
push dword [ebp - 0xc4]
call fcn.00403134
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc8]
jmp 0x413240
cmp dword [ebp + 0x7c], eax
lea eax, [ebp - 0x9c]
push eax
je 0x413236
call fcn.0050e4b0
test eax, eax
pop ecx
pop ecx
jne 0x413187
jmp 0x4131dd
call fcn.004020db
jmp 0x41322a
or eax, 0xffffffff
mov ecx, dword [ebp + 0x68]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x6c
leave
ret
Function at 0x4027fc
Capabilities:
Reference sql statements

Disassembly:
jmp 0x48013b
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
mov ebx, dword [ebp + 0xa0]
push esi
push edi
mov edi, dword [ebp + 0x9c]
mov esi, 0xff
push esi
lea eax, [ebp - 0x6f]
push 0
push eax
mov dword [ebp - 0x7c], ebx
mov byte [ebp - 0x70], 0
call fcn.00508d00
add esp, 0xc
test ebx, ebx
je 0x48018b
push ebx
call fcn.00401ff5
pop ecx
test edi, edi
jne 0x4801a1
push edi
call fcn.00402527
pop ecx
mov edi, eax
mov dword [ebp - 0x80], 1
jmp 0x4801a5
and dword [ebp - 0x80], 0
test edi, edi
jne 0x4801b0
xor eax, eax
jmp 0x480296
and dword [ebp - 0x74], 0
push str.SELECT_STORE_PROFILE.STORE_NUM__COMPANY.NAME_FROM_STORE_PROFILE__COMPANY_WHERE_STORE_PROFILE.COMPANY_IDCOMPANY.ID
push edi
call fcn.0040245f
test eax, eax
pop ecx
pop ecx
je 0x480277
and dword [ebp - 0x78], 0
push 2
push 9
push esi
lea eax, [ebp - 0x70]
push eax
push edi
call fcn.00401ce4
add esp, 0x14
test eax, eax
je 0x480286
mov ebx, 0x58af30
cmp dword [ebp - 0x78], 0xde
jge 0x480286
cmp dword [ebp - 0x74], 0
jne 0x480258
lea eax, [ebp - 0x70]
push eax
call fcn.00510940
cmp dword [ebp - 0x7c], 0
pop ecx
mov dword [ebp - 0x74], eax
je 0x480258
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.0050e4b0
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x70]
je 0x48024b
push dword [ebp + 0xa4]
push ebx
push eax
call fcn.0050e4b0
pop ecx
pop ecx
inc eax
push eax
push dword [ebp - 0x7c]
call fcn.00402abd
push dword [ebp - 0x7c]
call fcn.0040290f
add esp, 0x10
jmp 0x480258
push eax
push str.:7:GetStoreNumberTAMSii___FAILED:_Store_name_field_not_found:___s_
call fcn.004020c2
pop ecx
pop ecx
inc dword [ebp - 0x78]
push 2
push 9
push esi
lea eax, [ebp - 0x70]
push eax
push edi
call fcn.00401ce4
add esp, 0x14
test eax, eax
jne 0x4801ec
jmp 0x480286
push str.:7:GetStoreNumberTAMSii___FAILED:_ExecuteODBCFormat___FAILED.
call fcn.004020c2
and dword [ebp - 0x74], 0
pop ecx
cmp dword [ebp - 0x80], 0
je 0x480293
push edi
call fcn.0040141f
pop ecx
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x94
leave
ret
Function at 0x40291e
Capabilities:
Create directory

Disassembly:
jmp 0x42d212
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
mov ebx, dword [ebp + 0xa0]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], edi
je 0x42d3cc
cmp byte [ebx], 0x30
je 0x42d3cc
mov esi, 0x104
push esi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.00508d00
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.00402abd
lea eax, [ebp - 0x70]
push 0x22
push eax
call fcn.0040224d
add esp, 0x20
cmp dword [ebp + 0xa4], edi
mov ebx, str.CreateDirectorySuper
jbe 0x42d2a7
push 0xf83
push str..File.c
push ebx
push edi
push edi
lea eax, [ebp - 0x70]
push eax
push 0x42aad7
push edi
push edi
call fcn.00401f3c
mov dword [ebp - 0x7c], eax
jmp 0x42d2aa
mov dword [ebp - 0x7c], edi
cmp dword [ebp - 0x7c], edi
jne 0x42d303
cmp dword [ebp + 0xa4], edi
jbe 0x42d2cd
push str._GetLastError_
push edi
push dword [ebp - 0x78]
push str.:8:CreateDirectorySuper___FAILED_to_create_thread_to_create_directory___s_._NumThreads_d:__s
call fcn.004020c2
add esp, 0x10
push edi
push dword [ebp - 0x78]
push edi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
cmp eax, edi
je 0x42d2fb
cmp eax, 0x50
je 0x42d2fb
cmp eax, 0xb7
je 0x42d2fb
cmp eax, 0x4c7
je 0x42d2fb
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42d3cc
xor eax, eax
inc eax
jmp 0x42d3ce
call fcn.00401e97
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], edi
jmp 0x42d337
cmp dword [ebp - 0x74], 0x103
jne 0x42d36c
call fcn.00401e97
sub eax, dword [ebp - 0x80]
cmp eax, dword [ebp + 0xa4]
ja 0x42d346
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call esi
test eax, eax
jne 0x42d316
jmp 0x42d36c
push dword [ebp - 0x78]
call fcn.00401e97
sub eax, dword [ebp - 0x80]
push eax
push str.:5:CreateDirectorySuper___timed_out_after__ldms_while_creating___s_
call fcn.00401375
add esp, 0xc
mov dword [ebp - 0x74], edi
mov dword [0x635668], 0x5b4
push 0xfb7
push str..File.c
push ebx
push dword [ebp - 0x7c]
call fcn.00403134
push dword [0x635668]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
cmp dword [ebp - 0x74], edi
jne 0x42d2fb
push dword [ebp - 0x78]
call fcn.00401096
test eax, eax
pop ecx
jne 0x42d3c4
push dword [0x635668]
push str._GetLastError_
push dword [ebp + 0xa4]
push dword [ebp - 0x78]
push str.:3:FYI:_CreateDirectorySuper__s___lu___FAILED:__s_ld
call fcn.00401375
add esp, 0x14
push dword [0x635668]
call esi
xor eax, eax
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x98
leave
ret
Function at 0x402f95
Capabilities:
Terminate process

Disassembly:
jmp 0x45d52b
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push 0x103
xor ebx, ebx
lea eax, [ebp - 0x7f]
push ebx
push eax
mov byte [ebp - 0x80], 0
call fcn.00508d00
push 5
call fcn.00401528
add esp, 0x10
call fcn.004021ee
test eax, eax
je 0x45d722
mov eax, dword [ebp + 0x94]
dec eax
je 0x45d682
dec eax
dec eax
je 0x45d601
dec eax
je 0x45d722
dec eax
je 0x45d722
push ebx
push ebx
call fcn.004031fc
push eax
lea eax, [ebp - 0x80]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.0050dd60
lea eax, [ebp - 0x80]
push eax
call fcn.00402b5d
add esp, 0x18
test eax, eax
je 0x45d5df
push 1
call fcn.00401230
test eax, eax
pop ecx
je 0x45d5cf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x20001
push ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0x5aba30
call fcn.00401528
mov dword [esp], str._n___Paula_has_left_the_building.__She_is_no_longer_here.
call fcn.00401528
mov dword [esp], str._n___Please_press_any_key_to_terminate_this_window...
jmp 0x45d6f8
push esi
push edi
push ebx
push ebx
call fcn.004031fc
push eax
lea eax, [ebp - 0x80]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.0050dd60
lea eax, [ebp - 0x80]
push eax
call fcn.00402b5d
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
test eax, eax
mov edi, 0x3e8
je 0x45d653
push 1
call fcn.00401230
test eax, eax
pop ecx
je 0x45d643
push edi
call esi
push 0x20001
push ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
call fcn.004017df
push str._n_nPAULA_has_left..._n
call fcn.0040205e
pop ecx
push 3
pop ebx
push ebx
push str._rThis_screen_will_terminate_in__d_seconds.
call fcn.0040205e
pop ecx
pop ecx
push edi
call esi
dec ebx
test ebx, ebx
jg 0x45d666
pop edi
pop esi
jmp 0x45d722
push ebx
push ebx
call fcn.004031fc
push eax
lea eax, [ebp - 0x80]
push str._sSoundsPaulaLeft.wav
push eax
call fcn.0050dd60
lea eax, [ebp - 0x80]
push eax
call fcn.00402b5d
add esp, 0x18
test eax, eax
je 0x45d6cf
push 1
call fcn.00401230
test eax, eax
pop ecx
je 0x45d6bf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x20001
push ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0x5aba30
call fcn.00401528
mov dword [esp], str._n___Paula_has_left_the_building.__She_is_no_longer_here.
call fcn.00401528
mov dword [esp], str._n___You_will_have_to_reclick_Paula_to_get_her_to_come_back.
call fcn.00401528
mov dword [esp], str._n___Press_any_key_to_close_this_window...
call fcn.00401528
mov dword [esp], str._n_n_n_n
call fcn.00401528
mov dword [esp], str.Press_any_key_to_exit..._n_n_n_n_n_n_n
call fcn.00401528
mov dword [esp], 0xea60
call fcn.004026f3
pop ecx
call fcn.00402d0b
cmp dword [ebp + 0x94], 5
pop ebx
je 0x45d73c
push dword [ebp + 0x94]
call fcn.00515860
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.00508cf0
add ebp, 0x88
leave
ret
Function at 0x4032a1
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x41971f
call fcn.0040215d
test eax, eax
je 0x41972c
xor eax, eax
inc eax
ret
jmp fcn.004026d5

Function at 0x405f33
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0050d630
push esi
push edi
xor esi, esi
push 0xffc
lea eax, [ebp - 0x1004]
push esi
push eax
mov edi, ecx
mov dword [ebp - 0x1008], esi
call fcn.00508d00
add esp, 0xc
cmp dword [ebp + 8], esi
mov dword [ebp - 4], esi
jne 0x405f70
xor eax, eax
jmp 0x40603a
shr edi, 2
mov eax, 0x40000
cmp edi, eax
jbe 0x405f7e
mov edi, eax
push ebx
shr edi, 2
mov ebx, 0x400
cmp edi, ebx
jbe 0x405fa8
push 0xa1a
push str..Archive.c
push 1
push 4
push edi
call fcn.00509d00
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x405fb0
mov edi, ebx
lea esi, [ebp - 0x1008]
xor ebx, ebx
cmp dword [0x5f2e54], ebx
mov dword [ebp - 8], ebx
je 0x40601f
cmp dword [ebp + 0xc], 0
je 0x405fdf
push 0
lea eax, [ebp - 4]
push eax
mov eax, edi
shl eax, 2
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
shr dword [ebp - 4], 2
jmp 0x405ff1
push dword [ebp + 8]
push edi
push 4
push esi
call fcn.0050d5f0
add esp, 0x10
mov dword [ebp - 4], eax
xor ecx, ecx
cmp dword [ebp - 4], ecx
jbe 0x406015
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
add ebx, dword [esi + eax*4]
inc eax
cmp eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jb 0x405ffb
add ebx, dword [ebp - 4]
cmp dword [0x5f2e54], ecx
jne 0x405fbd
test ebx, ebx
jne 0x40601f
cmp dword [ebp - 8], ebx
je 0x40601f
inc ebx
test esi, esi
je 0x406037
lea eax, [ebp - 0x1008]
cmp esi, eax
je 0x406037
push 1
push esi
call fcn.0050a6d0
pop ecx
pop ecx
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x413082
Capabilities:
Enumerate processes
Terminate process

Disassembly:
jmp 0x413082
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x138
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x68], eax
push ebx
push esi
mov esi, dword [ebp + 0x74]
push edi
xor edi, edi
push 0x124
lea eax, [ebp - 0xbc]
push edi
push eax
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xc0], edi
call fcn.00508d00
add esp, 0xc
cmp esi, edi
je 0x41323d
cmp byte [esi], 0
je 0x41323d
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
or edi, 0xffffffff
cmp ebx, edi
mov dword [ebp - 0xc4], ebx
jne 0x413105
push str._GetLastError_
push dword [ebp + 0x78]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED:__s
call fcn.004020c2
add esp, 0x10
mov eax, edi
jmp 0x413240
lea eax, [ebp - 0xc0]
push eax
push ebx
mov dword [ebp - 0xc0], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x41314d
push str._GetLastError_
push dword [ebp + 0x78]
push esi
push str.:5:TerminateProcessByName__s___d__FAILED:_Process32First___FAILED:__s
call fcn.004020c2
add esp, 0x10
push 0x76f
push str..Console.c
push str.TerminateProcessByNameCaseSens
push ebx
call fcn.00403134
jmp 0x4130fe
mov dword [ebp - 0xc8], edi
mov ebx, str..Console.c
mov edi, str.TerminateProcessByNameCaseSens
xor eax, eax
cmp dword [ebp + 0x78], eax
push esi
je 0x413219
cmp dword [ebp + 0x7c], eax
lea eax, [ebp - 0x9c]
push eax
je 0x41317c
call fcn.0050dc60
jmp 0x413181
call fcn.0050da80
test eax, eax
pop ecx
pop ecx
jne 0x4131dd
push dword [ebp - 0xb8]
and dword [ebp - 0xc8], 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4131d7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4131ca
push str._GetLastError_
lea eax, [ebp - 0x9c]
push eax
push str.:1:TerminateProcessByName___encountered_a_problem:_TerminateProcess___FAILED_to_terminate__s:__s:_trying_once_more_with_higher_privilege...
call fcn.00401375
add esp, 0xc
push 0x7a0
push ebx
push edi
push esi
call fcn.00403134
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xc4]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41315d
push 0x7f9
push ebx
push edi
push dword [ebp - 0xc4]
call fcn.00403134
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc8]
jmp 0x413240
cmp dword [ebp + 0x7c], eax
lea eax, [ebp - 0x9c]
push eax
je 0x413236
call fcn.0050e4b0
test eax, eax
pop ecx
pop ecx
jne 0x413187
jmp 0x4131dd
call fcn.004020db
jmp 0x41322a
or eax, 0xffffffff
mov ecx, dword [ebp + 0x68]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x6c
leave
ret
Function at 0x4132c6
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4132c6
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0xac], eax
push ebx
push esi
mov esi, dword [ebp + 0xb8]
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x78]
push ebx
push eax
mov dword [ebp - 0x7c], ebx
call fcn.00508d00
add esp, 0xc
cmp esi, ebx
je 0x4133cf
cmp byte [esi], bl
je 0x4133cf
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x41333c
push dword [ebp + 0xbc]
push esi
push str.CountProcesses__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED_
call fcn.004020c2
add esp, 0xc
or eax, 0xffffffff
jmp 0x4133d1
lea eax, [ebp - 0x7c]
push eax
push edi
mov dword [ebp - 0x7c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x41337c
push dword [ebp + 0xbc]
push esi
push str.CountProcesses__s___d__FAILED:_Process32First___FAILED_
call fcn.004020c2
add esp, 0xc
push 0x8e7
push str..Console.c
push str.CountProcesses
push edi
call fcn.00403134
jmp 0x413334
mov dword [ebp - 0x80], ebx
cmp dword [ebp + 0xbc], ebx
push esi
lea eax, [ebp - 0x58]
push eax
je 0x413399
call fcn.0050da80
test eax, eax
pop ecx
pop ecx
je 0x4133a4
jmp 0x4133a7
call fcn.004020db
test eax, eax
pop ecx
pop ecx
je 0x4133a7
inc dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41337f
push 0x90b
push str..Console.c
push str.CountProcesses
push edi
call fcn.00403134
mov eax, dword [ebp - 0x80]
jmp 0x4133d1
xor eax, eax
mov ecx, dword [ebp + 0xac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0xb0
leave
ret
Function at 0x4139de
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x4139de
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1a4]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x1a8]
mov esi, 0x207
xor ebx, ebx
push esi
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.00508d00
add esp, 0xc
cmp dword [ebp + 0x1ac], ebx
mov dword [ebp - 0x7c], ebx
jge 0x413a3d
mov dword [ebp + 0x1ac], esi
push 0x208
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.00508d00
push dword [ebp - 0x78]
call fcn.00401ff5
push edi
call fcn.004010dc
add esp, 0x14
test eax, eax
je 0x413a65
xor eax, eax
jmp 0x413ab9
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
je 0x413a9f
push esi
push str._GetLastError_
push edi
push str.:4:GetRegString___s___FAILED:_RegQueryValueEx___FAILED:__s_ld
call fcn.00401375
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x413a61
mov eax, dword [ebp + 0x1ac]
dec eax
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
call fcn.00402abd
mov eax, dword [ebp - 0x78]
add esp, 0xc
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x198
leave
ret
Function at 0x4150a5
Capabilities:
Set console window title

Disassembly:
mov eax, dword [0x63198c]
test eax, eax
push ebp
push edi
mov edi, dword [esp + 0xc]
je 0x4150e6
xor ebp, ebp
inc ebp
test eax, eax
mov dword [0x631990], ebp
je 0x4150ce
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x63198c]
test edi, edi
je 0x4150d8
test eax, eax
jne 0x4150b4
jmp 0x4150e9
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
jmp 0x4151f7
xor ebp, ebp
inc ebp
test edi, edi
je 0x4151f5
push esi
push 0x104
push edi
mov esi, 0x631998
push esi
call fcn.00402abd
push edi
call fcn.00401ff5
mov cl, byte [0x631998]
add esp, 0x10
xor edx, edx
xor eax, eax
jmp 0x415142
test edx, edx
je 0x41512c
cmp cl, 0x29
jne 0x415123
xor edx, edx
mov byte [eax + 0x631aa0], 0x20
jmp 0x41513b
cmp cl, 0x28
jne 0x415135
mov edx, ebp
jmp 0x415123
mov byte [eax + 0x631aa0], cl
mov cl, byte [eax + 0x631999]
inc eax
test cl, cl
jne 0x415118
push ebx
mov ebx, 0x631aa0
push ebx
push esi
mov byte [eax + 0x631aa0], cl
call fcn.0050dc60
test eax, eax
pop ecx
pop ecx
je 0x4151d4
call fcn.00403099
test eax, eax
jne 0x4151d4
and dword [esp + 0x14], eax
and dword [0x631990], eax
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ebp, 0x631990
cmp dword [0x62f26c], 0
jne 0x4151c8
cmp dword [esp + 0x14], 0
mov dword [0x63198c], 1
je 0x4151a2
push ebx
call edi
push ebp
push 0x2ee
jmp 0x4151ab
push esi
call edi
push ebp
push 0x5dc
call fcn.00401dde
xor eax, eax
cmp dword [esp + 0x1c], eax
pop ecx
sete al
cmp dword [0x631990], 0
pop ecx
mov dword [esp + 0x14], eax
je 0x41517d
push esi
call edi
and dword [0x63198c], 0
jmp 0x4151f3
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
and dword [0x63198c], 0
push 0x3e8
mov dword [0x631990], ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
pop ebx
pop esi
xor eax, eax
pop edi
pop ebp
ret 4
Function at 0x415325
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x415325
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xac]
push ebx
push esi
mov esi, dword [ebp + 0xa8]
push edi
mov ebx, 0xff
push ebx
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x6b]
push 0
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], pe_nt_image_headers32
mov byte [ebp - 0x6c], 0
call fcn.00508d00
and word [ebp - 0x70], 0
xor eax, eax
and dword [ebp - 0x78], eax
lea edi, [ebp - 0x6e]
push esi
stosw word es:[edi], ax
call fcn.0040183e
add esp, 0x10
test eax, eax
je 0x415394
xor eax, eax
jmp 0x415458
push dword [ebp - 0x74]
lea esi, [ebp - 0x6c]
push dword [ebp - 0x7c]
mov eax, esi
push ebx
push eax
jmp 0x4153e6
lea eax, [ebp - 0x6c]
cmp esi, eax
je 0x4153b4
push 1
push esi
call fcn.0050a6d0
pop ecx
pop ecx
mov eax, dword [ebp - 0x80]
push 0x1594
lea edi, [eax + eax]
push str..Console.c
push 1
lea eax, [edi + 0xa]
push eax
push 1
mov dword [ebp - 0x80], edi
call fcn.00509d00
mov esi, eax
add esp, 0x14
test esi, esi
je 0x41538d
push dword [ebp - 0x74]
dec edi
push dword [ebp - 0x7c]
push edi
push esi
call fcn.0050f620
add esp, 0x10
cmp eax, 0xffffffff
je 0x4153a3
mov edi, dword [ebp + 0xa0]
mov ebx, dword [ebp + 0xa4]
lea ecx, [ebp - 0x78]
push ecx
mov word [ebp - 0x70], di
mov word [ebp - 0x6e], bx
push dword [ebp - 0x70]
push eax
push esi
call fcn.00401645
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
test eax, eax
jne 0x415444
cmp byte [0x6313b3], al
jne 0x415444
push str._GetLastError_
push esi
push ebx
push edi
push str.:3:OutConsole__d___d___s__FAILED:_WriteConsoleOutputCharacter___FAILED:__s
call fcn.00401375
add esp, 0x14
mov byte [0x6313b3], 1
lea eax, [ebp - 0x6c]
cmp esi, eax
je 0x415455
push 1
push esi
call fcn.0050a6d0
pop ecx
pop ecx
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x98
leave
ret