joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ff10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x720d54]
xor edx, edx
cmp eax, edx
jne 0x48ff36
xor eax, eax
mov byte [eax + 0x720c54], al
inc eax
cmp eax, 0x100
jl 0x48ff1e
mov dword [0x720d54], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x720c54
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x48ffc7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x48ff9a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x48ff68
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x490040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x490093
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x49007a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x496a20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ce01e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00497340
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x6db974
call fcn.004bd15e
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x496ab3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004bd15e
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x496aac
push 0
mov ecx, eax
call fcn.0048db40
mov dword [esi + 0xc], eax
jmp 0x496ab5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x496ab5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4ade52
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4ade72
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004aef6d
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4ade95
test byte [esp + 8], 2
je 0x4ade95
call fcn.004aefe0
mov dword [eax], 0xd
call fcn.004aefe9
mov dword [eax], 5
jmp 0x4ade6e
xor eax, eax
ret

Function at 0x4bf837
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4bf86f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004bd8c4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004bd89c
jmp 0x4bf87b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c0f29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c0f6b
call fcn.004c6c0e
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c0f6b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c0f62
xor eax, eax
jmp 0x4c0f73
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c0f79
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c713e
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c716c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c718a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c70a4
jmp 0x4c718a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c718a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c70a4
test edi, edi
mov eax, edi
jne 0x4c7174
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4e1ff4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004043b0
xor eax, eax
push ebp
push 0x4e208f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004041c0
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.0040454c
mov eax, dword [ebp - 4]
call fcn.004041c0
mov edi, eax
test edi, edi
jle 0x4e2079
mov ebx, 1
mov eax, dword [ebp + 8]
call fcn.00404418
mov ecx, dword [ebp - 8]
movzx edx, si
shr edx, cl
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
xor dl, cl
mov byte [eax + ebx - 1], dl
mov eax, dword [ebp + 8]
mov eax, dword [eax]
movzx eax, byte [eax + ebx - 1]
add si, ax
imul ax, si, 0x3af5
add ax, 0x705d
mov esi, eax
inc ebx
dec edi
jne 0x4e2040
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e2096
lea eax, [ebp - 4]
call fcn.00403f00
ret
Function at 0x5e21a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], dx
bt ax, ax
jmp 0x5e2d2f
mov dx, 0x881c
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x5e2711
not cl
call 0x5e232a
lea esp, [esp + 2]
jmp 0x5e2711
ja 0x5e21e4
mov dx, 0x881c
lea esp, [esp + 2]
jmp 0x5e27b8

Function at 0x5e232a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, 0x4b89773c
rdtsc
jmp 0x5e225f
bsf dx, si
jne 0x5e2207
mov eax, 0x4b89773c
rdtsc
jmp 0x5e225f
mov dx, 0xdc25
lea esp, [esp + 2]
jmp fcn.005e2271
mov dword [esi], edx
not ax
mov edx, 0x24903083
sub esp, 2
jge 0x5e222c
jl 0x5e2287
xor edi, dword [ecx + reloc.WINMM.dll_midiStreamOut]
sbb byte [ebx + 0x52], bh
int 0x5c
scasd eax, dword es:[edi]
mov edx, dword [ecx + edi]
mov ch, byte [esp]
lea eax, reloc.WINMM.dll_midiStreamOut
mov cx, 0x7d48
jmp 0x5e2242
sub esp, 8
jo 0x5e2295
jno 0x5e22c4
mov ebp, 0x3ccdaa34
invalid
mov dx, 0xdc25
lea esp, [esp + 2]
jmp fcn.005e2271
lea ecx, [edx - 0xcc]
lea esp, [esp + 4]
mov ax, 0xe4f8
jmp 0x5e2305
and ecx, 0x3c
mov eax, dword [esp]
sub esi, 4
lea eax, [esi + esi]
jmp 0x5e221d
lea ecx, [edx - 0xcc]
lea esp, [esp + 4]
mov ax, 0xe4f8
jmp 0x5e2305
jmp 0x5e22b3
lea ecx, [edi + 0x50]
xchg ah, al
mov edx, 0xc2e505dd
cmp esi, ecx
ja fcn.005e22d4
call fcn.005e2a02
xchg ebp, eax
add eax, 0xbe0ffc95
and eax, 0xbe4324b6
jg 0x5e234c
dec esi
fnstcw word [eax]
sbb esi, dword [edx - 0x73]
adc al, 8
mov ax, 0x3d0d
btc ax, di
jge 0x5e22ed
jl 0x5e22b3
invalid

Function at 0x5e2409
Capabilities:
Execute anti-debugging instructions

Disassembly:
setae ah
bswap eax
call fcn.005e2427
inc edx
fimul dword [eax + 0x2f]
ficomp dword [edi]
mov ebx, 0xef9c0d92
test al, 0xc2
rol dl, 0
jmp 0x5e23f3
add esp, 1
rol dl, 0
jmp 0x5e23f3
jmp 0x5e244b
lea eax, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 1]
jmp 0x5e248b
mov ah, 0x17
not ax
bswap eax
mov al, 0xa4
mov eax, dword [esp]
jmp 0x5e2521
lea esp, [esp + 4]
neg dl
neg eax
jbe 0x5e2475
ja 0x5e24d4
mov al, 0xa4
mov eax, dword [esp]
jmp 0x5e2521
mov ah, 0x17
not ax
bswap eax
call fcn.005e24be
mov esp, 0x7908321d
push edi
xchg dword [esp + 0x20], ebp
bswap eax
neg ah
lea eax, [ecx - 0x73]
jmp 0x5e2607
inc dl
neg eax
jne 0x5e250b
mov eax, 0xbaf95140
clc
jmp 0x5e2571
mov dword [esp + 8], ebx
push dword [esp + 0x40]
ret 0x44
mov eax, 0xe6bf5ae3
push edi
jmp 0x5e2555
cmc
xchg dword [esp + 0x20], ebp
not al
pushal
lea eax, [ebp + 0x92]
mov eax, esi
jmp 0x5e254a
mov al, byte [esp]
xor eax, esi
lea ebp, [ebp - 0x49]
lea eax, reloc.WINMM.dll_midiStreamOut
mov eax, ebp
mov ah, dh
jmp 0x5e25aa

Function at 0x5e2427
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
add esp, 2
jb 0x5e240e
add esp, 1
lea eax, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 1]
jmp 0x5e248b

Function at 0x5e36b4
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
jp 0x5e372f
jnp 0x5e36fe
in eax, 0x65
cmc
pushfd
outsd dx, dword [esi]
fist word [0x9e630496]
and byte [edi - 0x7899c6d2], al
ret 0xd1f6
push word [esp + 1]
push word [esp + 1]
bsf dx, dx
mov ah, byte [esp + 1]
lea esp, [esp + 1]
Function at 0x5e370d
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsf eax, esp
jmp 0x5e399a
mov edx, ebp
pushal
mov dword [esp + 0x1c], ecx
popal
call fcn.005e378d
mov byte [0x2ed3b426], al
cwde
xlatb
or dword ds:[eax - reloc.WINMM.dll_midiStreamOut], ebp
je 0x5e3757
add dword [esi + 0xf], esp
mov esp, 0x24648ad2
add dword [ebp - reloc.WINMM.dll_midiStreamOut], ecx
and al, 4
fldenv [ecx + 0x2f]
jbe 0x5e3716
mov edx, ebp
call fcn.005e38e0
mov edx, esp
mov dh, byte [esp]
jmp 0x5e39c2
push eax
ret

Function at 0x5fd457
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 2], bl
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x5fd4c9
mov dword [esp], ebx
jmp 0x5fd499
pushfd
mov dword [esp], ebx
mov esp, ecx
pushfd
jmp 0x5fd4b2
lea edi, [eax + ecx - 0x40]
jmp 0x5fd4e6
sub ecx, eax
jge 0x5fd495
pushfd
jmp 0x5fd47f
add esp, 2
lea esp, [esp + 2]
push esi
jmp 0x5fd572
sub esp, 4
js 0x5fd4d0
add esp, 2
call 0x5fd4f4
insd dword es:[edi], dx
pushal
push edx
mov word [esp + 0x17], bp
xchg dword [esp + 0x24], esi
lea esi, [esi + 0x17]
call fcn.005fd536
push edx
sbb byte [ebx - 0x73], bh
and al, 2
jmp 0x5fd4d7
sub esp, 0x1b
jae 0x5fd5d3
lea esp, [esp + 3]
jmp 0x5fd5b1
mov esi, edx
jmp 0x5fd5bb
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
jmp 0x5fd5df
mov edi, ecx
mov ecx, eax
jmp 0x5fd5f8
lea esp, [esp + 3]
mov dword [esp + 0x14], edi
lea esp, [esp + 0x14]
push ecx
jmp 0x5fd59b
pop ecx
jmp 0x5fd746
cld
rep movsb byte es:[edi], byte [esi]
jmp 0x5fd5e2
pop edi
pop esi
popfd
jmp 0x5fd6f7

Function at 0x5fd538
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 2
clc
xchg dword [esp + 0x30], esi
cmc
call fcn.005fd560
popfd
jbe 0x5fd555
mov dword [ecx], ebx
js 0x5fd4d5
aas
test al, 0xcb
bound ecx, qword [edi]
enter 0xf66, 0xffffffffffffffb3
loopne 0x5fd564
and bh, 0xfe
invalid
add ebx, ebp
add al, 0x6a
test dword [edi], esi
push dword [esp + 0x34]
ret 0x38
Function at 0x60bcae
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, word [esp]
lea edi, [ebx - 0xac]
mov al, dh
neg al
jmp 0x60be22
lea esp, [esp + 3]
lea esp, [esp + 1]
lea esp, [esp + 0x20]
js 0x60b958
jns 0x60bc98
fimul dword [ebp - 0x23]
movsb byte es:[edi], byte [esi]
push edi
out 0x5c, al
scasd eax, dword es:[edi]
mov dh, 0xa1
mov ch, bh
lea ecx, reloc.WINMM.dll_midiStreamOut
pushal
mov word [esp + 0x17], bx
call fcn.0060bd28
mov eax, dword [ebp + 8]
lea edi, reloc.WINMM.dll_midiStreamOut
add esi, ebx
jmp 0x60bd5d

Function at 0x60bccc
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
pushal
lea esp, [esp + 0x1f]
lea esp, [esp + 1]
jmp 0x60ba75
lea esp, [esp + 4]
je 0x5d00c3
jne 0x60ba91
lea esp, [esp + 0x24]
lea esi, reloc.WINMM.dll_midiStreamOut
jmp 0x60bd04
push edx
mov edx, ebp
add edx, 0xfffffff0
jmp 0x60bd40
mov dword [edx], eax
pop edx
jmp 0x60b8b1

Function at 0x60bd28
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub eax, ecx
push di
mov byte [esp], dh
mov word [esp], cx
lea esp, [esp + 2]
jmp 0x60bcdc
jmp 0x60bcf3

Function at 0x627f7c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0x5052472a
lea edx, [esi*4]
jmp 0x627ff8
mov al, byte [esp]
clc
rdtsc
jmp 0x627fe2
setae al
jmp 0x627fc7
inc ebp
mov ax, sp
xchg dx, ax
push ebp
pop word [esp]
jmp 0x62800e
lea edx, reloc.WINMM.dll_midiStreamOut
add bl, al
jle 0x627fdd
setae al
mov al, byte [esp]
clc
rdtsc
jmp 0x627fe2
lea esp, [esp + 2]
mov dx, word [ecx + edi]
lea eax, [ebp*4]
sub esp, 0x12
jp 0x628152
bswap eax
mov cx, bp
lea esp, [esp + 2]
jmp 0x62804a
mov word [esi], dx
neg dh
jo 0x628081
mov dl, byte [esp]
mov edx, dword [esp]
jmp 0x5fd395
bswap eax
mov cx, bp
lea esp, [esp + 2]
jmp 0x62804a
mov edx, dword [esp]
jmp 0x5fd395
mov dl, byte [esp]
jmp 0x62806b
jmp 0x628060

Function at 0x6d3a4f
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebp
lea eax, [edx*4]
mov ah, byte [esp + 5]
push dword [esp + 0x16]
lea eax, [edi*4]
xchg dx, cx
bt di, dx
pop cx
jmp 0x6d39e8
xchg ebx, edx
rcl eax, cl
xor esi, 0x40722675
push dword [esp + 0xe]
dec esi
jmp 0x6d39fe
Function at 0x6d3ede
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
mov ebx, dword [esp + 2]
xchg dx, bx
shr di, cl
rol bl, cl
rdtsc
jmp 0x6d3ec6
pushfd
bt edx, esp
mov cx, word [esp]
push word [esp]
xchg ecx, ebp
mov word [esp + 4], dx
jmp 0x6d3e69
lea esp, [esp + 0xa]
neg al
xchg dh, bl
mov eax, dword [esp]
mov dx, word [esp]
cld
jmp 0x6d3e7f
xchg dx, si
inc edi
mov bh, dl
neg ecx
mov edx, dword [esp]
neg ah
jmp 0x6d3ef5
mov byte [esp + 2], bh
neg dl
add esp, 4
rcr ax, cl
rdtsc
std
jmp 0x6d3eb0
xchg byte [esp + 4], ch
setle al
xchg word [esp + 5], bp
pop word [esp + 6]
mov eax, dword [esp + 9]
jmp 0x6d3e9e
xchg si, ax
clc
call 0x6d3efe
fimul word [edi]
mov ebp, 0x240c88d8
sbb ebx, 0xf6175ec7
jmp 0x6d3f49
add esp, 3
inc cl
lea esp, [esp + 1]
lea edx, reloc.WINMM.dll_midiStreamOut
jmp 0x6d3f1c
lea esi, reloc.WINMM.dll_midiStreamOut
xchg ebx, ebp
push dword [esp + 3]
mov di, word [esp + 5]
mov word [esp + 2], sp
mov dword [esp + 1], ebp
jmp 0x6d3f32

Function at 0x6d3f7b
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 6], edx
btc si, si
mov ebp, ebx
pop bx
mov al, byte [esp + 4]
jmp 0x6d3f99
add esp, 0xe
setl cl
jmp 0x6d3f65
mov dword [esp + 6], ebp
mov di, word [esp + 0x12]
push word [esp + 0x28]
bswap edi
jmp 0x6d3fe8
mov byte [esp + 0xc], bh
xchg ah, dl
push dword [esp + 4]
stc
mov ebp, dword [esp + 0x16]
mov bx, 0xc836
jmp 0x6d3f83
add esp, 0x1e
setle ah
mov bp, cx
mov byte [esp + 8], ah
mov cx, di
jmp 0x6d3fd2

Function at 0x6d45a0
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg byte [esp + 2], ah
mov dword [esp + 3], esi
jmp 0x6d458a
Function at 0x6d4acd
Capabilities:
Access peb ldr_data
Packed with generic packer
Parse pe header

Disassembly:
call fcn.006d41e3
push eax
jmp 0x6d41de
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x6d4892
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x6d48ef
push word [esp + 1]
mov word [esp + 1], dx
lea esp, [esp + 2]
jmp 0x6d4a1f
Function at 0x4014a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xorps xmm0, xmm0
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm0
mov dword [esi + 0x18], 0
mov eax, dword [0x49d5cc]
test eax, eax
je 0x4014d4
cmp dword [eax + 0x1fc], 0
jne 0x401671
push ebx
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
push 0
push 0
push 0
push 0
push esi
mov dword [0x49d428], 0
call ebx
test eax, eax
je 0x401652
push edi
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
nop
push 0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x40160a
mov ecx, dword [0x49d544]
xor ebx, ebx
test ecx, ecx
je 0x401553
mov eax, dword [ecx + 4]
mov dword [ebp - 4], eax
test eax, eax
je 0x401553
nop dword [eax + eax]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MMFS2.dll_Ordinal_536]
push esi
push eax
call edi
test eax, eax
jne 0x401604
cmp dword [ebp - 4], ebx
je 0x401553
mov ecx, dword [0x49d544]
jmp 0x401530
mov eax, dword [0x49d5cc]
test eax, eax
je 0x4015f6
mov ecx, 0x4000
test word [eax + 0x16], cx
je 0x4015f6
push dword [0x49d5a0]
call dword [sym.imp.MMFS2.dll_Ordinal_19]
test eax, eax
je 0x401591
push esi
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
test eax, eax
mov eax, 1
cmovne ebx, eax
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x4015a2
cmp eax, 0x104
jne 0x4015f2
mov edi, dword [esi + 8]
cmp edi, 0x10
je 0x4015f2
cmp edi, 0x11
je 0x4015f2
mov ecx, dword [0x49d5cc]
test ecx, ecx
je 0x4015f2
mov ecx, dword [ecx + 0xb4]
test ecx, ecx
je 0x4015f2
cmp eax, 0x104
je 0x4015d9
mov eax, 0x2000
test word [esi + 0xe], ax
jne 0x4015d9
xor edx, edx
jmp 0x4015de
mov edx, 1
push ecx
mov ecx, dword [0x49d5a8]
push edi
call fcn.00459f70
add esp, 8
test eax, eax
jne 0x401604
test ebx, ebx
jne 0x401604
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov ebx, dword [sym.imp.USER32.dll_PeekMessageW]
mov eax, dword [ebp - 8]
test eax, eax
je 0x401638
test al, 1
je 0x40161e
cmp dword [esi + 4], 0x111
je 0x401651
test al, 2
je 0x40162b
cmp dword [esi + 4], 0x201
je 0x401651
test al, 4
je 0x401638
cmp dword [esi + 4], 0x202
je 0x401651
push 0
push 0
push 0
push 0
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x401500
pop edi
push 0
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x49d430
push 0
push 0xb
push 0
call dword [sym.imp.MMFS2.dll_Ordinal_31]
mov dword [0x49d428], eax
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409f70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
push 0x104
mov esi, ecx
call fcn.00464894
mov edi, eax
add esp, 8
test edi, edi
je 0x409fb6
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 8]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push edi
mov esi, eax
call fcn.004648aa
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40b450
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov edx, ebx
push esi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b460
sub edx, ecx
sar edx, 1
push 2
lea eax, [edx + 4]
push eax
call fcn.00464894
mov esi, eax
add esp, 8
mov dword [ebp - 4], esi
test esi, esi
jne 0x40b48f
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0x104
call fcn.00464894
mov edi, eax
add esp, 8
test edi, edi
jne 0x40b4b8
push esi
call fcn.004648aa
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor esi, esi
sub ecx, ebx
nop
movzx eax, word [ebx]
lea ebx, [ebx + 2]
mov word [ecx + ebx - 2], ax
test ax, ax
jne 0x40b4c0
mov ebx, dword [ebp - 4]
push 0x5c
push ebx
call fcn.004622e5
add esp, 8
test eax, eax
je 0x40b4e8
xor ecx, ecx
mov word [eax + 2], cx
cmp word [ebx], 0x5c
jne 0x40b510
cmp word [ebx + 2], 0x5c
jne 0x40b510
lea eax, [ebx + 4]
push 0x5c
push eax
call fcn.00462387
add esp, 8
test eax, eax
je 0x40b5b3
lea ebx, [eax + 2]
jmp 0x40b521
cmp word [ebx + 2], 0x3a
jne 0x40b521
cmp word [ebx + 4], 0x5c
jne 0x40b521
add ebx, 6
push 0x5c
push ebx
call fcn.00462387
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b5b0
mov ecx, dword [ebp - 4]
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push ecx
push edi
call fcn.00465e1e
push edi
call fcn.00465fec
add esp, 0x10
test eax, eax
je 0x40b577
push edi
call fcn.00465ff7
add esp, 4
test eax, eax
je 0x40b564
mov esi, 1
jmp 0x40b577
push edi
call fcn.00465fec
add esp, 4
test eax, eax
mov eax, 1
cmovne esi, eax
lea eax, [ebx + 2]
mov dword [ebp - 8], ebx
push 0x5c
push eax
call fcn.00462387
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40b595
mov ecx, dword [ebp - 8]
test esi, esi
je 0x40b535
mov ebx, dword [ebp - 4]
push edi
call fcn.004648aa
push ebx
call fcn.004648aa
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
mov edx, edi
mov ecx, ebx
sub edx, ebx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x40b5c0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b5d5
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x40b5f8
cmp word [edi + ecx*2 - 2], 0x5c
jne 0x40b5f8
xor eax, eax
mov word [edi + ecx*2 - 2], ax
push edi
call fcn.00465fec
add esp, 4
test eax, eax
je 0x40b598
push edi
call fcn.00465ff7
add esp, 4
test eax, eax
je 0x40b61c
mov esi, 1
jmp 0x40b598
push edi
call fcn.00465fec
add esp, 4
mov ecx, 1
test eax, eax
cmovne esi, ecx
jmp 0x40b598
Function at 0x40d940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [edi + 0xbc]
mov eax, dword [ecx + 0x14]
add esi, edi
mov edx, dword [edi + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0x18]
mov ecx, 1
mov dword [esi + 0xc], eax
mov eax, 0x100
mov dword [esi + 0x10], 1
test word [edi + 0x94], ax
jne 0x40d986
mov dword [esi + 0x10], 0
xor ecx, ecx
mov dword [esi + 0x14], 0
lea eax, [edx + 0x3a]
mov ebx, dword [edi + 0x78]
test bl, 4
je 0x40d99d
test byte [eax], 1
je 0x40d9c7
and ebx, 0xfffffffb
mov dword [edi + 0x78], ebx
mov ebx, eax
mov ecx, dword [esi + 0x10]
or ecx, 0x200
mov dword [esi + 0x10], ecx
test byte [ebx], 2
je 0x40d9c7
mov eax, dword [edx + 0x46]
or ecx, 0x400
mov dword [esi + 0x14], eax
mov eax, ebx
mov dword [esi + 0x10], ecx
test dword [edi + 0x78], 0x400
je 0x40d9d9
or ecx, 0x4000
mov dword [esi + 0x10], ecx
test byte [eax], 4
je 0x40d9e7
or ecx, 0x100
mov dword [esi + 0x10], ecx
mov eax, dword [ebp + 8]
mov ebx, 1
test byte [eax + 6], 2
je 0x40da14
or ecx, 0x80
mov word [esi + 0x20], bx
mov dword [esi + 0x10], ecx
cmp word [edi + 0x18], 3
jne 0x40da19
mov eax, 0x2000
or word [edi + 0x7c], ax
jmp 0x40da19
or word [esi + 0x20], 0x20
mov ecx, dword [edx + 0x3c]
mov dword [esi + 0x18], ecx
mov eax, dword [edx + 0x40]
mov dword [esi + 0x1c], eax
cmp cx, 0xd
jne 0x40da78
mov ecx, dword [0x49d5cc]
movsx edx, word [edx]
cmp edx, dword [ecx + 0x194]
jge 0x40da6b
mov eax, dword [ecx + 0x198]
movzx eax, word [eax + edx*2]
mov dword [ecx + 0x1a0], eax
lea edx, [eax + eax*2]
shl edx, 4
add edx, dword [ecx + 0x400]
je 0x40da6b
mov ecx, dword [edx + 0x28]
test ecx, ecx
je 0x40da6b
mov edx, dword [edx + 0xc]
call fcn.0044d670
jmp 0x40da6d
xor eax, eax
mov dword [esi + 0x1c], eax
test eax, eax
jne 0x40da78
mov word [esi + 0x18], ax
cmp dword [edi + 0xcc], 0
jne 0x40da9d
or word [esi + 0x20], 2
mov eax, ebx
or dword [esi + 0x10], 8
mov ecx, dword [esi + 0x10]
movzx ecx, cx
pop edi
mov word [esi + 0x22], cx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 0x10]
pop edi
mov word [esi + 0x22], ax
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret