joyce8/EMBER2024-capa huggingface dataset:
Function at 0x104d129
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
test esi, esi
jne 0x104d149
mov ecx, ebx
call fcn.0104c960
xor eax, eax
inc eax
jmp 0x104d17c
lea eax, [esi + esi + 2]
push edi
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
test edi, edi
pop ecx
je 0x104d17b
inc esi
push esi
push edi
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push edi
mov ecx, ebx
call fcn.0104cd51
push edi
mov esi, eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
ret 4

Function at 0x104d2ca
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
mov esi, ecx
lea ecx, [ebp - 8]
push ecx
push 0x20019
xor edi, edi
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp + 8]
mov eax, dword [esi]
mov ecx, esi
xor ebx, ebx
call dword [eax + 8]
cmp eax, 2
jne 0x104d30a
xor eax, eax
jmp 0x104d410
cmp eax, edi
je 0x104d323
jle 0x104d410
and eax, 0xffff
or eax, 0x80070000
jmp 0x104d410
mov eax, dword [esi]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x42c]
push ecx
push edi
push dword [ebp - 8]
mov ecx, esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], 0x20a
call dword [eax + 0x10]
cmp eax, edi
je 0x104d35c
jle 0x104d35a
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp dword [ebp - 0x14], edi
je 0x104d36d
cmp word [ebp - 0x42c], di
je 0x104d36d
mov dword [ebp - 0xc], edi
cmp ebx, edi
jl 0x104d3d0
cmp dword [ebp - 0xc], edi
je 0x104d3d0
mov edi, 0x105
push edi
lea ecx, [ebp - 0x220]
push ecx
push 0
jmp 0x104d3c0
inc dword [ebp - 0x10]
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 8]
mov ecx, esi
call fcn.0104d2ca
mov ebx, eax
test ebx, ebx
jne 0x104d3a6
and dword [ebp - 0x10], eax
jmp 0x104d3b5
cmp ebx, 1
jne 0x104d3b1
and dword [ebp - 0xc], 0
jmp 0x104d3b5
test ebx, ebx
jl 0x104d3ce
push edi
lea ecx, [ebp - 0x220]
push ecx
push dword [ebp - 0x10]
push dword [ebp - 8]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
test eax, eax
je 0x104d387
xor edi, edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
jl 0x104d40e
cmp dword [ebp - 0xc], edi
je 0x104d400
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, edi
je 0x104d400
jle 0x104d3fe
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, edi
jl 0x104d40e
xor eax, eax
cmp dword [ebp - 0xc], edi
sete al
jmp 0x104d410
mov eax, ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.0104ab5e
leave
ret 8

Function at 0x104df41
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x104df59
test al, 0x10
jne 0x104df59
xor eax, eax
inc eax
jmp 0x104df5b
xor eax, eax
ret 4
Function at 0x104df5e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x104df7a
test al, 0x10
jne 0x104df7a
test al, 1
je 0x104df7a
xor eax, eax
inc eax
jmp 0x104df7c
xor eax, eax
ret 4

Function at 0x104df7f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x104df97
test al, 0x10
je 0x104df97
xor eax, eax
inc eax
jmp 0x104df99
xor eax, eax
ret 4

Function at 0x104e745
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
call fcn.0104df41
push esi
mov dword [ebp + 8], eax
mov ebx, 0x80
call fcn.0104eab7
test eax, eax
je 0x104e77b
xor eax, eax
inc eax
jmp 0x104e7bc
cmp dword [ebp + 8], 0
push esi
je 0x104e7cd
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
push 0
push ebx
push 3
push 0
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x104e7b9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
push esi
je 0x104e819
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 5
pop eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
pop ebx
call fcn.0104ab5e
leave
ret 4
call fcn.0104df7f
test eax, eax
je 0x104e7da
push 3
jmp 0x104e7bb
push 0x103
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
and word [ebp - 6], 0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call fcn.0104e136
lea eax, [ebp - 0x20c]
push eax
call fcn.0104df7f
test eax, eax
jne 0x104e78a
push 4
jmp 0x104e7bb
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x104e7bc
Function at 0x104e823
Capabilities:
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
push esi
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
call fcn.0104df41
push edi
mov dword [ebp + 8], eax
mov esi, 0x80
call fcn.0104eab7
test eax, eax
je 0x104e859
xor eax, eax
inc eax
jmp 0x104e8a8
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
je 0x104e8b9
call fcn.0104df5e
test eax, eax
je 0x104e86f
push 2
jmp 0x104e8a6
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
push ebx
push esi
push 4
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x104e8a4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
push esi
je 0x104e904
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
pop eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.0104ab5e
leave
ret 4
call fcn.0104df7f
test eax, eax
je 0x104e8c6
push 3
jmp 0x104e8a6
push 0x103
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
mov word [ebp - 6], bx
call fcn.0104e136
lea eax, [ebp - 0x20c]
push eax
call fcn.0104df7f
test eax, eax
jne 0x104e878
push 4
jmp 0x104e8a6
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], ebx
jne 0x104e916
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
jmp 0x104e8a7

Function at 0x10553a4
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
test eax, eax
jne 0x10553b3
inc eax
jmp 0x10553fa
cmp eax, 2
jne 0x10553bf
and dword [esi], 0
xor eax, eax
jmp 0x10553fa
push ebx
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10553f0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10553e0
call edi
mov edi, eax
jmp 0x10553f0
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
and dword [esi], 0
and word [ebx], 0
mov eax, edi
pop ebx
pop edi
pop esi
ret
Function at 0x10558ec
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x106ed40]
xor eax, dword [esp + 0x214]
push ebp
push esi
mov ebp, ecx
xor esi, esi
cmp dword [ebp + 0x414], esi
mov dword [esp + 0x218], eax
jne 0x105591d
mov eax, 0x80004005
jmp 0x1055a33
cmp dword [ebp], esi
je 0x1055932
cmp dword [esp + 0x220], esi
je 0x1055944
mov ecx, ebp
call fcn.010553a4
mov ecx, ebp
call fcn.010558a6
test eax, eax
jne 0x105594b
mov dword [ebp], 2
xor eax, eax
jmp 0x1055a33
push ebx
push edi
lea eax, [esp + 0x18]
push eax
mov ebx, 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
jne 0x1055988
call edi
test eax, eax
jg 0x1055978
call edi
mov esi, eax
jmp 0x1055993
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp dword [esp + 0x10], ebx
jbe 0x1055993
mov esi, 0x8007006f
test esi, esi
jl 0x1055a0d
lea ebx, [ebp + 4]
push ebx
push 0
push 0x1005e4c
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x10559cd
call edi
test eax, eax
jg 0x10559bd
call edi
mov esi, eax
jmp 0x10559cd
call edi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x1055a0d
mov esi, dword [ebp + 0x414]
push ebx
lea ecx, [esp + 0x14]
call fcn.0101e638
cmp byte [eax + 4], 0
je 0x10559eb
xor eax, eax
jmp 0x10559f6
mov eax, dword [eax]
test eax, eax
jne 0x10559f6
mov eax, 0x1003060
mov ecx, dword [esi]
push eax
push esi
call dword [ecx + 0x24]
mov esi, eax
lea eax, [esp + 0x10]
push eax
call fcn.0105f3f3
test esi, esi
jge 0x1055a25
lea edi, [ebp + 4]
push edi
call fcn.0104ea9f
test eax, eax
jne 0x1055a25
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [edi], 0
xor eax, eax
test esi, esi
setge al
pop edi
pop ebx
mov dword [ebp], eax
mov eax, esi
mov ecx, dword [esp + 0x218]
xor ecx, dword [esp + 0x21c]
pop esi
pop ebp
call fcn.0104ab5e
add esp, 0x214
ret 4
Function at 0x105dd4b
Capabilities:
Get hostname

Disassembly:
push esi
push dword [esp + 0xc]
xor esi, esi
push dword [esp + 0xc]
push 3
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x105dd84
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x105dd74
call esi
mov esi, eax
jmp 0x105dd84
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
ret 8

Function at 0x105e7f9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
cmp dword [0x107342c], 0
mov dword [ebp - 4], eax
jne 0x105e85b
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x105e84e
cmp dword [ebp - 0x108], 2
jne 0x105e84e
cmp dword [ebp - 0x114], 5
jb 0x105e84e
mov dword [0x107060c], ecx
jmp 0x105e855
and dword [0x107060c], 0
mov dword [0x107342c], ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, dword [0x107060c]
call fcn.0104ab5e
leave
ret

Function at 0x105e86d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x106ed40]
xor eax, dword [ebp + 4]
cmp dword [0x1073430], 0
mov dword [ebp - 4], eax
jne 0x105e8d7
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x105e8ca
cmp dword [ebp - 0x108], 2
jne 0x105e8ca
cmp dword [ebp - 0x114], 5
jb 0x105e8ca
cmp dword [ebp - 0x110], ecx
jb 0x105e8ca
mov dword [0x1070610], ecx
jmp 0x105e8d1
and dword [0x1070610], 0
mov dword [0x1073430], ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, dword [0x1070610]
call fcn.0104ab5e
leave
ret

Function at 0x105e920
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
mov eax, esi
cdq
idiv dword [esp + 0xc]
mov eax, dword [esp + 8]
mov al, byte [edx + eax]
xor byte [esi + ecx], al
inc esi
cmp esi, 0x10
jb 0x105e923
pop esi
ret 8

Function at 0x105fd2f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100785c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x105fd85
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1007898
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x105fd78
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x105fd87
xor eax, eax
pop esi
leave
ret 4
Function at 0x106160e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.010615fa
test al, al
je 0x106162a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x106166c
cmp dword [ebp + 8], 0
jne 0x1061634
xor eax, eax
jmp 0x106166c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0104ae00
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01060371
neg eax
sbb eax, eax
and eax, edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 8

Function at 0x10617d4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
call fcn.010615fa
test al, al
je 0x10617ed
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x106182e
cmp dword [ebp + 8], 0
jne 0x10617f8
or eax, 0xffffffff
jmp 0x106182e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
lea eax, [esi + 2]
add eax, 3
and eax, 0xfffffffc
call fcn.0104ae00
mov edi, esp
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01060371
neg eax
sbb eax, eax
and eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret 4

Function at 0x10618e1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.010615fa
test al, al
je 0x1061901
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1061968
mov edi, dword [ebp + 0x10]
lea esi, [edi + edi]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0104ae00
mov dword [ebp + 0x10], esp
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, eax
test ebx, ebx
je 0x1061957
push 0xffffffffffffffff
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01060390
mov ebx, eax
test ebx, ebx
jne 0x1061954
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1061954
mov eax, dword [ebp + 0xc]
and word [esi + eax - 2], 0
mov ebx, edi
dec ebx
jmp 0x1061966
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1061966
test edi, edi
jle 0x1061966
and word [eax], 0
mov eax, ebx
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x1061bc2
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.010615fa
test al, al
je 0x1061be5
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1061c41
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x1061c32
cmp dword [ebp + 0x10], 0
je 0x1061c32
lea esi, [edi + edi]
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.0104ae00
mov ebx, esp
push esi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x1061c23
push eax
push edi
push ebx
push dword [ebp + 0x10]
call fcn.01060390
jmp 0x1061c41
test edi, edi
jle 0x1061c2e
mov eax, dword [ebp + 0x10]
and word [eax], 0
xor eax, eax
jmp 0x1061c41
push edi
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x401a60
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x54
push ebx
push ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x3c], eax
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
mov dword [esp + 0x44], eax
call ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x4c], eax
push ecx
mov dword [esp + 0x64], str.Warcraft_III_Root
call dword [sym.imp.USER32.dll_RegisterClassA]
mov ebp, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea edx, [esp + 0x10]
push edx
call ebp
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
add eax, ecx
push 0
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, edx
push 0
cdq
sub eax, edx
mov edi, eax
sar esi, 1
sar edi, 1
sub esi, 0x10
sub edi, 0x10
call ebx
push eax
push 0
call ebp
push eax
push 0x10
push 0x10
push edi
push esi
push 0x80000000
push str.Iniciando_Warcraft_III
push str.Warcraft_III_Root
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 1
push eax
mov dword [0x40aad0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x40aad0]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [0x40aad0]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
je 0x401b8a
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [0x40aad0]
push 0
push 0
lea edx, [esp + 0x28]
push ecx
push edx
call edi
lea eax, [esp + 0x20]
push eax
call ebx
lea ecx, [esp + 0x20]
push ecx
call ebp
mov edx, dword [0x40aad0]
push 0
push 0
push 0
lea eax, [esp + 0x2c]
push edx
push eax
call esi
test eax, eax
jne 0x401b52
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret

Function at 0x401ba0
Capabilities:
Create thread

Disassembly:
push esi
call fcn.00401a60
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 1
push 0
mov dword [0x40aadc], 1
call esi
push 0
push 0
push 1
push 0
mov dword [0x40aad4], eax
call esi
push 0
push 0x2000
push 0x4018b0
mov dword [0x40aad8], eax
call fcn.0040205b
mov eax, dword [0x40aad0]
add esp, 0xc
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0x40aad0]
pop esi
ret
Function at 0x404af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40a4e0
cmp edx, dword [eax]
je 0x404b12
add eax, 8
inc ecx
cmp eax, 0x40a570
jl 0x404b03
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40a4e0]
jne 0x404c40
mov eax, dword [0x40aae8]
cmp eax, 1
je 0x404c1a
test eax, eax
jne 0x404b43
cmp dword [0x4080c0], 1
je 0x404c1a
cmp edx, 0xfc
je 0x404c40
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404b7a
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00405510
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402920
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404bbd
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402920
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40751c
push edi
call fcn.004059c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00405510
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00405520
lea eax, [ebp - 0xa0]
push 0x4074fc
push eax
call fcn.00405520
push dword [esi + 0x40a4e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00405520
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405935
add esp, 0x2c
pop edi
jmp 0x404c40
lea eax, [ebp + 8]
lea esi, [esi + 0x40a4e4]
push 0
push eax
push dword [esi]
call fcn.00402920
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x414f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ecx + 0xb886], cl
add cl, ch
mov byte [0x8b00000a], al
inc ebx
and al, 0x8b
dec ebx
sbb byte [ebx + 0x51500c53], cl
mov ecx, dword [ebp + 4]
push edx
push ecx
call dword [0x474044]
jmp case.default.0x414e4d

Function at 0x415180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edx
mov edx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [ebp + 4]
push ecx
push edx
push eax
call dword [0x474068]
jmp case.default.0x414e4d
jo 0x415107
ror byte [edi], 0x8e
and eax, 0x8b000008
push esp
and al, 0x64
mov edi, dword [esp + 0x4c]
lea ecx, [esi + edx]
cmp ecx, edi
jl case.default.0x414e4d
mov ecx, dword [esp + 0x68]
mov edi, dword [esp + 0x50]
add eax, ecx
cmp eax, edi
jl case.default.0x414e4d
cmp edx, dword [esp + 0x54]
jg case.default.0x414e4d
cmp ecx, dword [esp + 0x58]
jg case.default.0x414e4d
mov eax, dword [ebx + 0x44]
test eax, eax
jne 0x4151d3
mov dword [esp + 0x10], 2
jmp 0x4151fd
mov eax, dword [ebx + 0x3c]
cmp eax, 8
jg 0x4151ef
cmp eax, 1
jge 0x4151ea
mov dword [esp + 0x10], 1
jmp 0x4151fd
cmp eax, 8
jle 0x4151f9
mov dword [esp + 0x10], 8
jmp 0x4151fd
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x94]
mov dword [esp + 0x108], 0
lea edi, [eax - 6]
test edi, edi
jle 0x415246
lea esi, [ebx + 0x48]
mov dword [esp + 0x34], edi
mov ecx, dword [esi]
push ecx
lea ecx, [esp + 0xfc]
call fcn.004165d0
mov eax, dword [esp + 0x34]
add esi, 0xc
dec eax
mov dword [esp + 0x34], eax
jne 0x41521d
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x64]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0xe0], edx
add esi, edx
mov edx, dword [esp + 0x70]
lea eax, [esp + 0xe0]
add edx, ecx
push eax
mov dword [esp + 0xec], esi
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xf0], edx
call dword [0x4744fc]
test eax, eax
jne case.default.0x414e4d
mov eax, dword [esp + 0x30]
cmp ebp, dword [eax + 0xbc]
jne 0x4152ba
add eax, 0xc0
mov ecx, dword [eax]
mov dword [esp + 0xa8], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0xac], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0xb0], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0xb4], edx
jmp 0x4152e6
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov dword [esp + 0xa8], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0xac], ecx
mov dword [esp + 0xb0], edx
mov dword [esp + 0xb4], eax
lea ecx, [esp + 0x1a0]
call fcn.00436340
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x100]
neg eax
sbb eax, eax
push 0xcc0020
and eax, ecx
mov ecx, dword [esp + 0x14]
push edi
push eax
lea edx, [esp + 0xb4]
push ecx
lea eax, [esp + 0xf0]
push edx
push eax
push ebp
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x264], 2
call fcn.004371d0
mov dword [esp + 0x1a0], 0x4cce00
mov esi, 0x4ccde0
lea ecx, [esp + 0x218]
mov byte [esp + 0x248], 3
mov dword [esp + 0x218], esi
call fcn.00416540
lea ecx, [esp + 0x1f8]
mov byte [esp + 0x248], 1
mov dword [esp + 0x1f8], esi
call fcn.00416540
jmp case.default.0x414e4d