joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b249f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b24d7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b052c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b0504
jmp 0x4b24e3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b3b95
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b3bd7
call fcn.004b990a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b3bd7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b3bce
xor eax, eax
jmp 0x4b3bdf
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b3be5
pop edi
pop esi
pop ebx
ret 4

Function at 0x4b9e3a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b9e68
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b9e86
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b9da0
jmp 0x4b9e86
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b9e86
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b9da0
test edi, edi
mov eax, edi
jne 0x4b9e70
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402cb6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor ecx, ecx
mov dword [esi], eax
test eax, eax
setne cl
mov al, cl
pop esi
pop ebp
ret 0x18

Function at 0x402ce4
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x4175b8
call fcn.00412450
sub esp, 0xc
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
lea edi, [esi + 0x68]
lea ecx, [edi + 0xc]
call fcn.00401924
push 0
push 0x1f4
mov ecx, edi
call fcn.00405bc2
lea eax, [ebp - 0x18]
push 0x45
push eax
call fcn.004058d2
pop ecx
pop ecx
push dword [eax]
and dword [ebp - 4], 0
add esi, 0x6c
mov ecx, esi
call fcn.00405a30
push dword [ebp - 0x18]
call fcn.00403330
pop ecx
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x402e84
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x417642
call fcn.00412450
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi], 0x41937c
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
push 0xf
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00401b85
push edi
push edi
push edi
lea ecx, [esi + 0x38]
push 1
mov byte [ebp - 4], 1
mov dword [esi + 0x30], edi
call fcn.004059b5
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
call fcn.00402f17
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x41934c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x403515
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jbe 0x403540
push ebx
push edi
movzx edi, byte [edx]
movzx ebx, al
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x42102c]
xor eax, edi
inc edx
dec esi
jne 0x403526
pop edi
pop ebx
mov dword [ecx], eax
pop esi
ret 8

Function at 0x40437e
Capabilities:
Create directory

Disassembly:
mov eax, 0x4178b4
call fcn.00412450
sub esp, 0x18
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
je 0x40439e
mov al, 1
jmp 0x4043f5
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
je 0x4043ad
xor al, al
jmp 0x4043f5
push ebx
lea ecx, [ebp - 0x18]
push dword [ebp + 8]
call fcn.0040182a
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040377c
push dword [eax]
call fcn.0040436b
push dword [ebp - 0x24]
mov bl, al
call fcn.00403330
push dword [ebp - 0x18]
call fcn.00403330
add esp, 0x18
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x4045fd
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
jne 0x404610
xor al, al
ret
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x4046b2
Capabilities:
Delete directory
Set file attributes

Disassembly:
mov eax, 0x417930
call fcn.00412450
sub esp, 0x6c
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.00401a79
mov esi, dword [ebp + 8]
push 0x5c
lea eax, [ebp - 0x18]
xor ebx, ebx
push esi
push eax
mov dword [ebp - 4], ebx
call fcn.00404e88
lea eax, [ebp - 0x18]
push 0x2a
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 1
call fcn.00404e88
add esp, 0x18
mov byte [ebp - 0x34], bl
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040209d
push dword [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.00403330
pop ecx
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x38]
push eax
call fcn.0040534c
test al, al
je 0x40476c
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x18]
sub esp, 0xc
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.0040209d
call fcn.004047c3
add esp, 0x10
cmp al, bl
jne 0x404710
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00403330
pop ecx
lea ecx, [ebp - 0x38]
call fcn.00404f09
push dword [ebp - 0x18]
call fcn.00403330
push dword [ebp - 0x48]
call fcn.00403330
pop ecx
xor al, al
pop ecx
jmp 0x4047b0
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00403330
pop ecx
lea ecx, [ebp - 0x38]
call fcn.00404f09
mov eax, dword [esi]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
je 0x40479c
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
setne bl
push dword [ebp - 0x18]
call fcn.00403330
push dword [ebp - 0x48]
call fcn.00403330
pop ecx
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x404aec
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, 0x104
push edi
mov edi, 0x105
cmp dword [esi + 8], ebx
jg 0x404b0a
push edi
mov ecx, esi
call fcn.00401e58
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov ecx, esi
mov edi, eax
call fcn.00404d53
test edi, edi
jbe 0x404b29
cmp edi, ebx
ja 0x404b29
push 1
pop eax
jmp 0x404b2b
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x404c55
Capabilities:
Delete file

Disassembly:
mov eax, 0x4179c0
call fcn.00412450
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
lea ecx, [ebp - 0x1c]
call fcn.00404d06
push esi
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00404ba3
test al, al
je 0x404ce5
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x404cd0
push dword [esi]
call fcn.004052b3
test al, al
pop ecx
je 0x404cb3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00404c30
push dword [ebp - 0x18]
call fcn.00403330
pop ecx
jmp 0x404c69
push dword [esi]
call fcn.0040436b
test al, al
pop ecx
jne 0x404cce
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x404ce5
jmp 0x404c9c
mov bl, 1
lea ecx, [ebp - 0x1c]
call fcn.00404c30
push dword [ebp - 0x18]
call fcn.00403330
pop ecx
mov al, bl
jmp 0x404cf8
lea ecx, [ebp - 0x1c]
call fcn.00404c30
push dword [ebp - 0x18]
call fcn.00403330
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405129
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x417a18
call fcn.00412450
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
mov eax, dword [esi]
push 0
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
push 0
mov dword [edi + 0x18], eax
push dword [esi + 0x1c]
call fcn.004128f0
mov ecx, dword [esi + 0x20]
xor ebx, ebx
add eax, ecx
lea ecx, [ebp - 0x18]
mov dword [edi + 0x20], eax
lea eax, [esi + 0x2c]
adc edx, ebx
push eax
mov dword [edi + 0x24], edx
call fcn.00401a91
and dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_AreFileApisANSI]
neg eax
sbb eax, eax
inc eax
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004051e3
add esp, 0xc
push eax
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 1
call fcn.00401924
push dword [ebp - 0x24]
call fcn.00403330
push dword [ebp - 0x18]
call fcn.00403330
mov eax, dword [esi + 0x24]
pop ecx
pop ecx
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4054b5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4054dc
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x4054dc
xor al, al
jmp 0x4054fc
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.004128f0
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x407d5f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x417eff
call fcn.00412450
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
push 8
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
pop edi
mov edx, 0x4194e8
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x4194e0
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.00403d72
push dword [esi + 8]
mov ecx, ebx
call fcn.00403d72
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403d72
push dword [esi + 0xc]
mov ecx, edi
call fcn.00403d72
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x4083c9
Capabilities:
Create thread

Disassembly:
mov eax, 0x4180b9
call fcn.00412450
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [ebp - 0x14], esi
mov dword [esi + 4], 0x419558
lea ecx, [esi + 0xc]
mov dword [esi + 8], edi
call fcn.00408531
push 4
lea ecx, [esi + 0x5c]
pop ebx
mov dword [ebp - 4], edi
push ebx
call fcn.00407195
mov dword [esi + 0x5c], 0x419550
lea ecx, [esi + 0x70]
push ebx
mov byte [ebp - 4], 1
call fcn.00407195
mov dword [esi + 0x70], 0x419548
lea eax, [esi + 0x84]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ebx
mov dword [eax], 0x419540
mov dword [esi + 0x98], edi
push edi
push edi
push edi
lea ecx, [esi + 0x9c]
push edi
mov byte [ebp - 4], bl
call fcn.004059b5
lea eax, [esi + 0xa0]
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], ebx
mov dword [eax], 0x4192ec
push edi
push edi
push edi
lea ecx, [esi + 0xb4]
push edi
mov byte [ebp - 4], 6
call fcn.004059b5
push edi
push edi
push edi
lea ecx, [esi + 0xb8]
push 1
mov byte [ebp - 4], 7
call fcn.004059b5
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 8
push eax
push edi
push esi
push 0x40851f
push edi
push edi
mov dword [esi], 0x41952c
mov dword [esi + 4], 0x419520
call dword [sym.imp.KERNEL32.DLL_CreateThread]
cmp eax, edi
mov dword [esi + 0x98], eax
jne 0x4084cd
lea eax, [ebp - 0x10]
push 0x41a120
push eax
mov dword [ebp - 0x10], 0x425d1
call fcn.004124b4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4087ef
Capabilities:
Create thread

Disassembly:
mov eax, 0x418153
call fcn.00412450
sub esp, 0xcc
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x78]
mov ecx, dword [edi + 0x18]
push dword [ecx + eax*8 + 4]
lea eax, [ecx + eax*8]
lea ecx, [ebp - 0xd8]
push dword [eax]
call fcn.00407ecf
lea esi, [edi + 0x70]
lea eax, [ebp - 0xd8]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00409138
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx + eax*4 - 4]
call fcn.0040801d
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [edi + 0xb8]
mov ecx, dword [edx + ecx*4 - 4]
mov dword [ecx + 0x64], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
lea ecx, [edi + 0xa0]
mov eax, dword [eax + 0x68]
push dword [eax]
call fcn.00403450
mov dword [ebp - 0x14], ebx
add edi, 0x84
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004091e3
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
mov edx, dword [edi + 0xc]
mov eax, dword [ecx + eax*4 - 4]
mov ecx, dword [edi + 8]
lea esi, [edx + ecx*4 - 4]
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push 0x4088e5
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [esi], eax
pop edi
pop esi
cmp eax, ebx
pop ebx
jne 0x4088ca
lea eax, [ebp - 0x10]
push 0x41a120
push eax
mov dword [ebp - 0x10], 0x425d0
call fcn.004124b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.00408092
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x40acc6
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x41853b
call fcn.00412450
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x28], edi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], edi
call fcn.00405d8e
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1d30], edi
mov dword [esi], 0x4196d0
mov dword [esi + 4], 0x4196c0
mov dword [esi + 8], 0x4196ac
mov dword [esi + 0xc], 0x41969c
mov dword [esi + 0x10], 0x419688
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40ae18
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x418553
call fcn.00412450
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4196d0
mov dword [esi + 4], 0x4196c0
mov dword [esi + 8], 0x4196ac
mov dword [esi + 0xc], 0x41969c
mov dword [esi + 0x10], 0x419688
push dword [esi + 0x1d30]
and dword [ebp - 4], 0
lea edi, [esi + 0x1d30]
call fcn.00403330
and dword [edi], 0
pop ecx
lea ecx, [esi + 0x30]
call fcn.0040ae90
or dword [ebp - 4], 0xffffffff
add esi, 0x18
mov ecx, esi
call fcn.004060af
mov ecx, esi
call fcn.0041060a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40f53d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0xe0]
mov ecx, ebx
call fcn.00403d19
push dword [esi + 0x44]
mov ecx, ebx
call fcn.00403d72
lea edi, [esi + 0xf4]
mov ecx, edi
call fcn.00403d19
push dword [esi + 0x6c]
mov ecx, edi
call fcn.00403d72
xor eax, eax
xor edi, edi
cmp dword [esi + 0x6c], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
jle 0x40f604
jmp 0x40f589
xor eax, eax
mov ecx, dword [esi + 0x70]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ecx + edx*4]
cmp byte [ecx + 0x3c], 0
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x40f5b4
cmp dword [ebp - 8], eax
jne 0x40f5d4
push 0xffffffffffffffff
lea ecx, [esi + 0xf4]
call fcn.00403450
jmp 0x40f5f9
cmp dword [ebp - 8], eax
jne 0x40f5d4
cmp edi, dword [esi + 0x44]
jge 0x40f609
push dword [ebp - 0xc]
mov ecx, ebx
call fcn.00403450
mov eax, dword [esi + 0x5c]
cmp dword [eax + edi*4], 0
jne 0x40f5d4
inc edi
jmp 0x40f5b9
push edi
lea ecx, [esi + 0xf4]
call fcn.00403450
cmp byte [ebp - 1], 0
jne 0x40f5f9
inc dword [ebp - 8]
mov eax, dword [esi + 0x5c]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + edi*4]
jb 0x40f5f9
inc edi
and dword [ebp - 8], 0
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [esi + 0x6c]
jl 0x40f587
pop edi
pop esi
pop ebx
leave
ret
push 1
lea ecx, [ebp - 8]
call fcn.0040cd5e
mov eax, dword [eax]
push 0x41c118
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004124b4
Function at 0x40a2c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
test byte [0x415750], 8
jne 0x40a300
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
setne al
lea esp, [ebp - 8]
pop ecx
movzx eax, al
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov eax, ebx
call sym._wine_dbgstr_an.constprop.0_2
mov dword [esp + 0xc], str.__s__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.MACRO_FileExist
mov dword [esp + 4], 0x415750
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x40a2dd

Function at 0x40abf0
Capabilities:
Hide graphical window

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x34
test byte [0x415750], 8
jne 0x40ac28
mov eax, dword [0x41578c]
test eax, eax
je 0x40ac1a
mov edx, dword [eax + 0x10]
test edx, edx
je 0x40ac50
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
mov dword [esp + 0xc], 0x41771f
mov dword [esp + 8], str.MACRO_History
mov dword [esp + 4], 0x415750
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_2
jmp 0x40ac0a
mov dword [esp + 0x2c], eax
mov eax, dword [0x415784]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], 0x4177c4
mov dword [esp + 4], str.WHHistory
mov dword [esp], 0
call dword [sym.imp.user32.dll_CreateWindowExA]
sub esp, 0x30
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.user32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
sub esp, 8
leave
lea esp, [ecx - 4]
ret
Function at 0x40e490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3ec
test byte [0x415988], 8
jne 0x40e630
mov ecx, dword [sym.imp.user32.dll_LoadStringA]
mov eax, dword [0x415784]
lea esi, [ebp - 0x27a]
mov dword [esp + 0xc], 0xff
mov dword [esp + 8], esi
mov dword [ebp - 0x3dc], ecx
mov dword [esp + 4], 0x12c
mov dword [esp], eax
call ecx
mov edi, dword [sym.imp.ucrtbase.dll_strlen]
sub esp, 0x10
mov dword [esp], esi
call edi
mov ecx, dword [ebp - 0x3dc]
lea ebx, [esi + eax + 1]
mov eax, 0x70
mov word [ebx + 4], ax
mov eax, dword [0x415784]
add ebx, 6
mov dword [ebx - 6], 0x6c682e2a
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0xff
mov dword [esp + 4], 0x12b
mov dword [esp], eax
call ecx
sub esp, 0x10
mov dword [esp], ebx
call edi
lea eax, [ebx + eax + 1]
lea ebx, [ebp - 0x37e]
mov dword [eax], 0x2a2e2a
mov byte [eax + 4], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3d6], 0x58
sub esp, 8
mov byte [eax], 0
mov eax, dword [0x41578c]
test eax, eax
je 0x40e56e
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3d2], eax
mov eax, dword [0x415784]
mov dword [ebp - 0x3ca], esi
mov dword [ebp - 0x3ce], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3aa], ebx
mov dword [ebp - 0x3ba], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c6], 0
mov dword [ebp - 0x3b6], eax
lea eax, [ebp - 0x3d6]
mov dword [ebp - 0x3c2], 0
mov dword [ebp - 0x3be], 1
mov dword [ebp - 0x3b2], 0
mov dword [ebp - 0x3ae], 0
mov dword [ebp - 0x3a6], 0
mov dword [ebp - 0x3a2], 0x800005
mov dword [ebp - 0x39e], 0
mov dword [ebp - 0x39a], 0
mov dword [ebp - 0x396], 0
mov dword [ebp - 0x392], 0
mov dword [ebp - 0x38e], 0
mov dword [esp], eax
call dword [0x41e2e8]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0x41859d
mov dword [esp + 8], str.WINHELP_GetOpenFileName
mov dword [esp + 4], 0x415988
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_3
jmp 0x40e4a9
Function at 0x411ee0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x418a77
mov dword [esp], eax
call sym._fprintf.constprop.0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
nop
Function at 0x4139c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x413a1b
cmp byte [esi + ebx - 1], 0xa
je 0x4139ef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x41d224], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret