joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407470
Capabilities:
Create process on windows

Disassembly:
push edi
push ebx
xor ebx, ebx
sub esp, 0x54
mov edx, dword [esp + 0x60]
cmp byte [edx], 0
jne 0x407490
add esp, 0x54
mov eax, ebx
pop ebx
pop edi
ret
lea edi, [esp + 0x14]
mov eax, ebx
mov ecx, 0xf
mov ebx, 1
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x440
mov dword [esp + 0x28], 0x445768
mov dword [esp], eax
mov dword [esp + 0x30], 5
call sym._ShellExecuteExA_4
sub esp, 4
call sym._GetLastError_0
mov eax, dword [esp + 0x64]
test eax, eax
je 0x407480
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sym._WaitForSingleObject_8
sub esp, 8
mov eax, ebx
add esp, 0x54
pop ebx
pop edi
ret

Function at 0x407600
Capabilities:
Terminate process

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp], 0x100001
mov dword [esp + 8], eax
call sym._OpenProcess_12
sub esp, 0xc
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._TerminateProcess_8
sub esp, 8
add esp, 0x1c
jmp sym._GetLastError_0

Function at 0x407720
Capabilities:
Enumerate processes

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14c
mov dword [esp + 4], 0
mov dword [esp], 2
mov edi, dword [esp + 0x160]
mov dword [esp + 0x18], 0x128
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov ebx, eax
lea esi, [esp + 0x18]
mov dword [esp], eax
mov dword [esp + 4], esi
call sym._Process32First_8
sub esp, 8
cmp eax, 1
lea ebp, [esp + 0x3c]
je 0x4077a0
xor esi, esi
mov dword [esp], ebx
call sym._CloseHandle_4
sub esp, 4
mov eax, esi
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edi
mov dword [esp], ebp
call sym._strcmp
test eax, eax
je 0x4077c0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._Process32Next_8
sub esp, 8
cmp eax, 1
je 0x407790
jmp 0x40776e
mov eax, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov dword [esp + 8], eax
call sym._OpenProcess_12
sub esp, 0xc
mov dword [esp], eax
call sym._CloseHandle_4
sub esp, 4
mov esi, dword [esp + 0x20]
jmp 0x407770
Function at 0x4078f0
Capabilities:
Log keystrokes

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov dword [esp], 0x2710
call sym._Sleep_4
sub esp, 4
call sym._GetCurrentProcessId_0
mov dword [esp], eax
call sym._AllowSetForegroundWindow_4
sub esp, 4
call sym._GetConsoleWindow_0
mov dword [esp], eax
mov ebx, eax
call sym._IsWindow_4
sub esp, 4
test eax, eax
jne 0x407932
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x1c], 0
call sym._GetForegroundWindow_0
mov edi, eax
call sym._GetCurrentThreadId_0
mov dword [esp], edi
mov esi, eax
mov dword [esp + 4], 0
call sym._GetWindowThreadProcessId_8
sub esp, 8
cmp esi, eax
mov edi, eax
je 0x407a30
mov dword [esp], esi
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call sym._AttachThreadInput_12
sub esp, 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], 0x2000
mov dword [esp + 8], eax
call sym._SystemParametersInfoA_16
sub esp, 0x10
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x2001
call sym._SystemParametersInfoA_16
sub esp, 0x10
mov dword [esp], 0xffffffff
call sym._AllowSetForegroundWindow_4
sub esp, 4
mov dword [esp], ebx
call sym._SetForegroundWindow_4
sub esp, 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], 3
mov dword [esp + 4], 0
mov dword [esp], 0x2001
mov dword [esp + 8], eax
call sym._SystemParametersInfoA_16
sub esp, 0x10
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], 0
call sym._AttachThreadInput_12
sub esp, 0xc
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
call sym._SetForegroundWindow_4
sub esp, 4
add esp, 0x20
pop ebx
pop esi
pop edi
ret

Function at 0x409fa0
Capabilities:
Execute command

Disassembly:
sub esp, 0x1c
mov dword [esp], str._nWILLI_Dateien_loeschen
call sym._printf
mov eax, 0x22
mov dword [esp], 0x450960
mov dword [0x45098c], 0x20205f5f
mov dword [0x450990], 0x2d2d2d2d
mov dword [0x450994], 0x2d2d2d2d
mov dword [0x450998], 0x2a202d2d
mov dword [0x45099c], 0x222a2e
mov dword [0x450960], 0x20646d63
mov dword [0x450964], 0x6420632f
mov dword [0x450968], 0x22206c65
mov dword [0x45096c], 0x5f5c3a45
mov dword [0x450970], 0x4e465541
mov dword [0x450974], 0x454d4841
mov dword [0x450978], 0x5f5f5c4e
mov dword [0x45097c], 0x2d2d2020
mov dword [0x450980], 0x2d2d2d2d
mov dword [0x450984], 0x2d2d2d2d
mov dword [0x450988], 0x2a2e2a20
mov word [0x45098c], ax
call sym._system
add esp, 0x1c
ret
Function at 0x414400
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4557a8
call sym._EnterCriticalSection_4
mov ebx, dword [0x4557a0]
sub esp, 4
test ebx, ebx
je 0x41444b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x414444
test esi, esi
je 0x414444
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x414420
mov dword [esp], 0x4557a8
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x414630
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x414680
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x414758
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x4146be
cmp eax, 4
jne 0x4146e0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x4146ce
cmp edx, 4
je 0x4146ce
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00414630

Function at 0x414a60
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
call sym._GetLastError_0
mov esi, eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call sym._SetLastError_4
sub esp, 4
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x414a90
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym._TlsSetValue_8
sub esp, 8
test eax, eax
je 0x414ab4
xor eax, eax
add esp, 0x1c
ret
add esp, 0x1c
jmp sym._GetLastError_0
Function at 0x420cd0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
cmp byte [0x444648], 0
jne 0x420da4
mov byte [0x444648], 1
call sym.___cxa_current_exception_type
test eax, eax
je 0x420e3e
mov ebx, dword [eax + 4]
xor eax, eax
cmp byte [ebx], 0x2a
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x1c], 0xffffffff
sete al
add ebx, eax
lea eax, [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call sym.___cxa_demangle
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x30
mov ebp, eax
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_after_throwing_an_instance_of_
lea edi, [esi + 0x40]
mov dword [esp + 0xc], edi
call sym._fwrite
cmp dword [esp + 0x1c], 0
mov dword [esp + 4], edi
je 0x420d9a
mov dword [esp], ebx
call sym._fputs
lea eax, [esi + 0x40]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x445b59
mov dword [esp + 0xc], eax
call sym._fwrite
cmp dword [esp + 0x1c], 0
je 0x420dd1
call sym.___cxa_rethrow
mov dword [esp], ebp
call sym._fputs
jmp 0x420d6b
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_recursively_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
call sym._abort
mov dword [esp], ebp
call sym._free
jmp 0x420d95
call sym._abort
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x2d
mov dword [esp + 4], 1
mov dword [esp], str.terminate_called_without_an_active_exception_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
jmp 0x420e39
Function at 0x402670
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 4]
push esi
lea ecx, [esp + 4]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x436304
push str.SOFTWARE360Safekiller
push connect
mov dword [esp + 0x20], 4
mov esi, 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4026ae
pop esi
add esp, 0xc
ret
lea eax, [esp + 4]
push 4
push eax
push 4
push 0x436304
push str.SOFTWARE360Safekiller
push connect
mov dword [esp + 0x1c], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x4029c0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x314
push esi
push edi
mov edi, 0x104
lea eax, [esp + 0x218]
push edi
push eax
push 0
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x218]
lea edx, [esp + 0x114]
push ecx
push str.__s___anti
push edi
push edx
call fcn.004073a0
add esp, 0x10
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push str.akCheck
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call esi
test eax, eax
je 0x402a7e
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push str.killrodog4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
mov dword [esp + 0x20], edi
call esi
test eax, eax
je 0x402a7e
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push str.killrodog
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
mov dword [esp + 0x20], edi
call esi
test eax, eax
jne 0x402b16
cmp dword [esp + 0xc], 1
jne 0x402b16
mov eax, dword [esp + 8]
test eax, eax
jbe 0x402b16
lea eax, [esp + 0x114]
lea ecx, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x402b16
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.killrodog4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call esi
push str.killrodog
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call esi
lea edi, [esp + 0x114]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push str.akCheck
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push connect
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
mov eax, 1
pop esi
add esp, 0x314
ret
pop edi
xor eax, eax
pop esi
add esp, 0x314
ret
Function at 0x4042b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov bl, 1
mov eax, dword [esi + 0x50]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x40430d
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 4]
mov dword [esp + 0x10], eax
push edx
mov dword [esp + 0x18], 0xfffffffe
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 0xc]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
shr eax, 2
test al, 1
je 0x40434a
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esi + 4]
and edi, 0xffff
push ecx
push edi
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 0x24]
push 1
push 0
push 0
push edx
push 0x436318
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
seta bl
test bl, bl
je 0x404381
mov al, byte [esi + 0x54]
push 1
or al, 2
push 0
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x405420
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [esp + 8]
push edi
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push str.CheckedValue
mov ebx, 4
push str.SoftwareMicrosoftWindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL
push connect
xor edi, edi
mov dword [esp + 0x24], ebx
call esi
test eax, eax
jne 0x405479
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov eax, dword [esp + 0x14]
jne 0x40546f
cmp eax, 1
je 0x405474
cmp eax, 2
jne 0x405479
mov edi, 1
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push connect
mov dword [esp + 0x24], ebx
call esi
test eax, eax
jne 0x4054b8
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov eax, dword [esp + 0x14]
jne 0x4054b2
cmp eax, 1
je 0x4054b7
cmp eax, 2
jne 0x4054b8
inc edi
lea eax, [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push str.Text
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push connect
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x4054f3
cmp dword [esp + 0x10], 1
jne 0x4054f3
cmp dword [esp + 0xc], 1
jbe 0x4054f3
inc edi
xor eax, eax
cmp edi, 3
setne al
pop edi
pop esi
test eax, eax
pop ebx
je 0x405517
mov ecx, dword [esp + 0x114]
test ecx, ecx
je 0x405517
call fcn.00405520
mov eax, 1
add esp, 0x110
ret
Function at 0x4061f0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
push 0x40f
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x406228
push 5
push eax
push eax
push str.http:__baike.360.cn_help.html
push 0x436318
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
pop esi
ret 0x10
push esi
push 0
push 0x4061e0
call fcn.00417810
mov ecx, eax
call fcn.00417a60
xor eax, eax
pop esi
ret 0x10
Function at 0x406a60
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x42dc48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x436cfc]
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov ecx, dword [ebx + 4]
push 0x401
push ecx
mov dword [esp + 0x28], 0
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
mov eax, dword [esp + 0x10]
mov esi, edi
mov ecx, dword [eax - 0xc]
lea ebp, [eax - 0xc]
cmp ecx, 1
jg 0x406ac1
cmp edi, dword [eax - 4]
jle 0x406b03
mov ebx, dword [eax - 8]
cmp edi, ebx
jge 0x406aca
mov esi, ebx
test esi, esi
jne 0x406b89
mov eax, dword [0x436cfc]
lea ecx, [ebx + 1]
lea edx, [ebp + 0xc]
push ecx
inc esi
push edx
push esi
push eax
mov dword [esp + 0x20], eax
call fcn.00406c30
mov eax, dword [esp + 0x20]
add esp, 0x10
push ebp
mov dword [eax - 8], ebx
call fcn.00407060
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx + 4]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push eax
push 0x401
push ecx
call ebp
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esp + 0x10]
mov eax, dword [edx - 0xc]
lea esi, [edx - 0xc]
cmp eax, 1
jle 0x406b61
lea ecx, [esp + 0x10]
call fcn.00407020
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
push eax
call fcn.00406d60
test eax, eax
je 0x406b61
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
inc ecx
add esi, 0xc
mov edx, dword [eax - 4]
push ecx
inc edx
push esi
push edx
push eax
call fcn.00406c30
add esp, 0x10
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
push eax
call edi
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x28]
test esi, esi
mov dword [ecx - 8], eax
mov edx, dword [esp + 0x10]
mov byte [eax + edx], 0
jne 0x406bb9
xor eax, eax
jmp 0x406bbc
lea edx, [esi + 0xd]
push edx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x406bb2
mov dword [eax], 1
mov byte [eax + esi + 0xc], 0
mov dword [eax + 4], esi
mov dword [eax + 8], esi
add eax, 0xc
jmp 0x406ad7
xor eax, eax
jmp 0x406aff
push esi
call edi
push esi
push eax
lea ecx, [esp + 0x18]
call fcn.00406e80
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
push eax
push 0x401
push ecx
call ebp
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [esp + 0x10]
mov ecx, dword [0x436d00]
pop edi
pop esi
lea edx, [eax - 0xc]
pop ebp
cmp edx, ecx
pop ebx
je 0x406c11
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.DLL_InterlockedDecrement]
test eax, eax
jg 0x406c11
mov eax, dword [esp]
add eax, 0xfffffff4
push eax
call fcn.0042d5f4
add esp, 4
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x4072d0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jbe 0x40738b
mov esi, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea ecx, [esp + 4]
push 0x5c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x407317
lea edx, [esp + 4]
push 0x2f
push edx
call esi
add esp, 8
test eax, eax
je 0x40738b
mov ecx, dword [esp + 0x110]
inc eax
push ecx
push str.tools_s
push 0x104
push eax
call fcn.004073a0
add esp, 0x10
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
test al, 0x10
jne 0x40738b
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x40737e
lea edx, [esp + 4]
mov esi, 0x104
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x407376
mov byte [eax], cl
inc eax
dec esi
jne 0x407358
dec eax
pop esi
mov byte [eax], 0
mov eax, 1
add esp, 0x104
ret
test esi, esi
jne 0x40737b
dec eax
mov byte [eax], 0
mov eax, 1
pop esi
add esp, 0x104
ret
xor eax, eax
pop esi
add esp, 0x104
ret
Function at 0x408140
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x42ddd1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov dword [esi], 0x42f5dc
lea edi, [esi + 0x448]
mov dword [esp + 0x28], 0xa
push edi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 0x464]
xor ebx, ebx
cmp eax, ebx
je 0x408196
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [esi + 0x464], ebx
mov eax, dword [esi + 0x468]
cmp eax, ebx
je 0x4081a8
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
mov ebp, dword [esi + 0x470]
lea edi, [esi + 0x46c]
mov eax, dword [ebp]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x4081f1
lea eax, [esp + 0x18]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.0040b000
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, edi
call fcn.0040bb20
cmp dword [esp + 0x10], ebp
jne 0x4081cd
mov eax, dword [edi + 4]
push eax
call fcn.0042d5f4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ebp, dword [esi + 0x440]
lea edi, [esi + 0x43c]
add esp, 4
mov byte [esp + 0x28], 9
mov eax, dword [ebp]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x408243
lea eax, [esp + 0x1c]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.0040b000
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, edi
call fcn.0040bae0
cmp dword [esp + 0x10], ebp
jne 0x40821f
mov eax, dword [edi + 4]
push eax
call fcn.0042d5f4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ebp, dword [esi + 0x434]
lea edi, [esi + 0x430]
add esp, 4
mov byte [esp + 0x28], 8
mov eax, dword [ebp]
cmp eax, ebp
mov dword [esp + 0x10], eax
je 0x408295
lea eax, [esp + 0x1c]
push ebx
push eax
lea ecx, [esp + 0x18]
call fcn.0040b000
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, edi
call fcn.0040baa0
cmp dword [esp + 0x10], ebp
jne 0x408271
mov eax, dword [edi + 4]
push eax
call fcn.0042d5f4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x418]
lea edi, [esi + 0x414]
add esp, 4
mov byte [esp + 0x28], 7
mov ecx, dword [eax]
push eax
lea eax, [esp + 0x20]
push ecx
push eax
mov ecx, edi
call fcn.0040b960
mov eax, dword [edi + 4]
push eax
call fcn.0042d5f4
add esp, 4
lea ecx, [esi + 0x3ec]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x28], 6
call fcn.004072c0
lea ecx, [esi + 0x394]
mov byte [esp + 0x28], 5
call fcn.00402210
lea ecx, [esi + 0x36c]
mov byte [esp + 0x28], 4
call fcn.00405c30
lea ecx, [esi + 0x34c]
mov byte [esp + 0x28], 3
call fcn.00404bb0
lea ecx, [esi + 0x218]
mov byte [esp + 0x28], 2
call fcn.00402250
lea ecx, [esi + 0x9c]
mov byte [esp + 0x28], 1
call fcn.004079b0
lea ecx, [esi + 0x20]
mov byte [esp + 0x28], bl
call fcn.0040c900
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret