joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4002c730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40072bd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov edi, dword [esp + 0x1c]
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.40053821
mov dword [esp + 0x14], 0
lea ecx, [esi + 0x14]
mov dword [esi], vtable.boost::system::system_error.0
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
lea eax, [edi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.400029ce
mov dword [esi], vtable.boost::lock_error.0
mov dword [esp + 0x14], 1
mov dword [esi + 0x2c], vtable.boost::exception.0
mov ecx, dword [edi + 0x30]
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x4002c7b7
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [edi + 0x34]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov dword [esi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4002cb20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40072c68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov esi, edx
mov dword [esp + 0xc], 0
mov edi, ecx
push esi
mov dword [esp + 0xc], edi
call fcn.40053821
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x14]
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
lea eax, [esi + 0x14]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.400029ce
mov ecx, dword [esp + 0x10]
mov eax, edi
mov dword [edi + 0x2c], vtable.boost::exception.0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.1.0
mov dword [edi + 0x2c], vtable.boost::exception_detail::error_info_injector_class_boost::lock_error_.0
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40034490
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x400730d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push edi
push dword [esp + 0x30]
mov edi, ecx
lea ecx, [esp + 0xc]
push ecx
mov eax, dword [edi]
mov ecx, dword [eax + 0xc]
call fcn.40033950
sub esp, 0x18
mov dword [esp + 0x40], 0
mov ecx, esp
lea eax, [esp + 0x20]
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.400029ce
mov eax, dword [esp + 0x4c]
mov ecx, edi
push eax
push eax
push dword [esp + 0x50]
call fcn.400341e0
cmp dword [esp + 0x1c], 0x10
jb 0x4003450e
push dword [esp + 8]
call fcn.40053016
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop edi
add esp, 0x28
ret 8

Function at 0x40034b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4007314b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 8], edi
mov dword [edi], eax
lea ecx, [edi + 0x2c]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
lea eax, [esp + 0x1c]
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov byte [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov byte [edi + 0x28], 0
push eax
push 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
call fcn.4000fec0
mov dword [edi + 0x38], 0
mov dword [esp + 0x14], 0
mov ecx, dword [edi]
push 0x4007c3c2
push 0x4007c3c0
mov eax, dword [ecx + 0x138]
mov dword [ecx + 0x13c], eax
mov eax, dword [edi]
mov dword [eax + 0x18], 0
mov eax, dword [edi + 4]
mov ecx, dword [eax]
call fcn.40035540
mov dword [edi + 0x3c], eax
mov eax, dword [edi + 4]
push 0x40083d9e
push 0x40083d9c
mov ecx, dword [eax]
call fcn.40035540
mov dword [edi + 0x40], eax
mov eax, dword [edi + 4]
push 0x400839c6
push str.lower
mov ecx, dword [eax]
call fcn.40035540
mov dword [edi + 0x44], eax
mov eax, dword [edi + 4]
push 0x40083bb2
push str.upper
mov ecx, dword [eax]
call fcn.40035540
mov dword [edi + 0x48], eax
mov eax, dword [edi + 4]
push 0x40083bea
push str.alpha
mov ecx, dword [eax]
call fcn.40035540
mov ecx, dword [edi]
mov dword [edi + 0x4c], eax
mov eax, dword [edi + 0x3c]
mov dword [ecx + 0x140], eax
mov eax, edi
mov ecx, dword [esp + 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4

Function at 0x40035770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
sub ebx, esi
xor ecx, ecx
inc ebx
xor eax, eax
shr ebx, 1
push edi
xor edi, edi
cmp esi, edx
cmova ebx, ecx
test ebx, ebx
je 0x400357b2
jmp 0x40035790
mov edx, eax
lea esi, [esi + 2]
mov ecx, eax
shl edx, 6
shr ecx, 2
inc edi
add edx, ecx
movzx ecx, word [esi - 2]
add ecx, 0x9e3779b9
add ecx, edx
xor eax, ecx
cmp edi, ebx
jne 0x40035790
pop edi
pop esi
pop ebx
ret
Function at 0x40042740
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x400738ac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], edi
mov dword [edi + 0x28], 0x400847d8
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
mov esi, dword [esp + 0x28]
mov dword [esp + 0x20], 0
push esi
mov dword [esp + 0x14], 1
call fcn.40053821
mov dword [edi], vtable.boost::regex_error.0
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov dword [esp + 0x20], 1
lea ebp, [esi + 0x14]
mov dword [edi + 0x14], vtable.boost::exception.0
mov ecx, dword [ebp + 4]
mov dword [edi + 0x18], ecx
test ecx, ecx
je 0x400427c5
mov eax, dword [ecx]
call dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x24], eax
mov dword [esp + 0x20], 2
lea ecx, [edi + 0x14]
mov eax, dword [edi + 0x28]
mov edx, ebp
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [edi + 0x14], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
mov eax, dword [edi + 0x28]
mov esi, dword [eax + 4]
lea eax, [esi - 8]
mov dword [esi + edi + 0x24], eax
call fcn.40002115
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x40042d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov dword [esp], 0x4007d330
mov dword [esp + 4], 0x4008481c
mov dword [esp + 8], 0x40084820
mov dword [esp + 0xc], 0x4008482c
mov dword [esp + 0x10], 0x40084830
mov dword [esp + 0x14], 0x40083168
mov dword [esp + 0x18], str.C_______B_
mov dword [esp + 0x1c], 0x40084824
mov dword [esp + 0x20], 0x40084828
mov dword [esp + 0x24], 0x4008483c
mov dword [esp + 0x28], 0x40084840
mov dword [esp + 0x2c], 0x40084834
mov dword [esp + 0x30], 0x40084838
mov dword [esp + 0x34], 0x4008484c
mov dword [esp + 0x38], 0x40084850
mov dword [esp + 0x3c], 0x40084844
mov dword [esp + 0x40], 0x40084848
mov dword [esp + 0x44], 0x4008485c
mov dword [esp + 0x48], 0x40084868
mov dword [esp + 0x4c], 0x40084854
mov dword [esp + 0x50], 0x40084858
mov dword [esp + 0x54], 0x40084874
mov dword [esp + 0x58], 0x4007d330
mov dword [esp + 0x5c], 0x4007d330
mov dword [esp + 0x60], 0x40084878
mov dword [esp + 0x64], 0x4008486c
mov dword [esp + 0x68], 0x4007c554
mov dword [esp + 0x6c], 0x40084870
mov dword [esp + 0x70], 0x40084884
mov dword [esp + 0x74], 0x40084888
mov dword [esp + 0x78], str.nrafxctveE:ZGQXPN_pR
mov dword [esp + 0x7c], 0x40084880
mov dword [esp + 0x80], 0x40084894
mov dword [esp + 0x84], 0x40084898
mov dword [esp + 0x88], 0x4008488c
mov dword [esp + 0x8c], 0x40084890
mov dword [esp + 0x90], 0x400848a4
mov dword [esp + 0x94], 0x400848a8
mov dword [esp + 0x98], 0x4008489c
mov dword [esp + 0x9c], 0x4007d330
mov dword [esp + 0xa0], 0x4007d330
mov dword [esp + 0xa4], 0x4007d330
mov dword [esp + 0xa8], 0x4007d330
mov dword [esp + 0xac], 0x4007d330
mov dword [esp + 0xb0], 0x4007d330
mov dword [esp + 0xb4], 0x4007d330
mov dword [esp + 0xb8], 0x4007d330
mov dword [esp + 0xbc], 0x400848a0
mov dword [esp + 0xc0], 0x400848b4
mov dword [esp + 0xc4], 0x400848b8
mov dword [esp + 0xc8], 0x40084818
mov dword [esp + 0xcc], 0x400848ac
mov dword [esp + 0xd0], 0x400848b0
mov dword [esp + 0xd4], 0x400848c4
mov dword [esp + 0xd8], 0x400848c8
mov dword [esp + 0xdc], 0x400848bc
mov dword [esp + 0xe0], 0x400848c0
mov dword [esp + 0xe4], 0x400848d8
mov dword [esp + 0xe8], 0x400848dc
mov dword [esp + 0xec], 0x400848cc
cmp cl, 0x3c
jb 0x40042fba
mov eax, 0x4007d330
add esp, 0xf0
ret
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x40042fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x98
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x4004312d
add eax, 4
cmp word [eax], cx
jb 0x40043125
sub eax, 2
cmp cx, word [eax]
jb 0x40043144
cmp cx, word [eax + 2]
ja 0x40043144
mov al, 1
add esp, 0x98
ret
xor al, al
add esp, 0x98
ret
Function at 0x4004cd70
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x400742a0
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
test esi, esi
je 0x4004cf12
cmp word [esi], 0
je 0x4004cf12
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.40001ce1
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4004cdc2
push 0x80004005
call fcn.40001ad1
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
test esi, 0xffff0000
jne 0x4004cdec
movzx eax, si
lea ecx, [ebp - 0x10]
push eax
call fcn.40007342
jmp 0x4004cdff
push esi
call fcn.40054188
add esp, 4
lea ecx, [ebp - 0x10]
push eax
push esi
call fcn.40007835
push ebx
push edi
push 1
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x10]
call fcn.4000d78b
push 0x4007ea24
push dword [eax]
call fcn.400550d7
mov edx, dword [ebp - 0x14]
add esp, 8
test eax, eax
setne bl
add edx, 0xfffffff0
or edi, 0xffffffff
mov eax, edi
lea ecx, [edx + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4004ce49
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4004ceae
mov eax, dword [ebp - 0x10]
mov esi, dword [eax - 0xc]
test esi, esi
jns 0x4004ce61
push 0x80070057
call fcn.40001ad1
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x4004ce7e
push esi
lea ecx, [ebp - 0x10]
call fcn.40007396
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x10]
push dword [eax - 8]
push eax
call fcn.40054e5c
mov edx, eax
add esp, 8
test edx, edx
js 0x4004ce57
mov ecx, dword [ebp - 0x10]
cmp edx, dword [ecx - 8]
jg 0x4004ce57
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov word [eax + edx*2], cx
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x4004cedc
cmp eax, 0x50
je 0x4004cedc
cmp eax, 0xb7
je 0x4004cedc
xor bl, bl
jmp 0x4004cede
mov bl, 1
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4004ceff
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov al, bl
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
xor al, al
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4004cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x400742e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0
call fcn.40001ce1
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x4004cf7c
push 0x80004005
call fcn.40001ad1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
push 0x1a
mov ebx, 1
mov dword [ebp - 0x18], 0
push 0
mov dword [ebp - 0x14], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4004d0bf
mov eax, dword [esi]
mov ecx, ebx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, 0x208
or eax, ecx
jge 0x4004cfd1
push 0x208
mov ecx, esi
call fcn.40007396
mov ecx, dword [esi]
cmp dword [ecx - 8], 0x208
jge 0x4004cfe6
push 0x80070057
call fcn.40001ad1
mov dword [ecx - 0xc], 0x208
xor edx, edx
mov eax, dword [esi]
push ecx
mov word [eax + 0x410], dx
push dword [ebp - 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [esi]
test eax, eax
jne 0x4004d00c
xor ecx, ecx
jmp 0x4004d01e
push dword [eax - 8]
push eax
call fcn.40054e5c
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x4004cfdc
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x4004cfdc
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, dword [esi]
cmp dword [eax - 0xc], edx
je 0x4004d063
push 1
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.4000d78b
push 0x4007ea24
push dword [eax]
mov ebx, 3
mov dword [ebp - 0x14], ebx
call fcn.400550d7
add esp, 8
mov byte [ebp - 0xd], 1
test eax, eax
jne 0x4004d067
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0
test bl, 2
je 0x4004d096
mov edx, dword [ebp - 0x1c]
and ebx, 0xfffffffd
add edx, 0xfffffff0
mov dword [ebp - 0x14], ebx
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4004d096
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x4004d0b6
push 0x4007ea24
call fcn.40054188
add esp, 4
mov ecx, esi
push eax
push 0x4007ea24
call fcn.4000e154
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4004e8d0
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40074458
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x614
push ebx
push esi
mov ebx, ecx
push 0x400
lea eax, [ebp - 0x620]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.40054740
add esp, 0xc
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x620]
push eax
push ebx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
jne 0x4004e938
xor bl, bl
jmp 0x4004e9b5
mov eax, dword [ebp - 0x10]
push edi
shr eax, 2
mov edi, 0x100
cmp eax, edi
cmovb edi, eax
xor esi, esi
test edi, edi
je 0x4004e9b2
nop
push 0x208
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.40054740
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x104
push eax
push dword [ebp + esi*4 - 0x620]
push ebx
call dword [sym.imp.PSAPI.DLL_GetModuleFileNameExW]
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x220]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + esi*4 - 0x620]
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x4004e9e8
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [eax + 8]
call eax
test al, al
je 0x4004e9b2
inc esi
cmp esi, edi
jb 0x4004e950
mov bl, 1
pop edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x4004e9d4
mov esi, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x18
call fcn.4005232d
int3
Function at 0x40051310
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x400700f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
push edi
mov ebx, edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0
call fcn.40001ce1
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4005135f
push 0x80004005
call fcn.40001ad1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], 0
push ebx
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
jns 0x4005138d
push 0x80070057
call fcn.40001ad1
mov eax, dword [esi]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x400513a8
push edi
mov ecx, esi
call fcn.40007396
push edi
push dword [esi]
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi]
test eax, eax
jne 0x400513bc
xor ecx, ecx
jmp 0x400513ce
push dword [eax - 8]
push eax
call fcn.40054e5c
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x40051383
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x40051383
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
pop edi
mov word [eax + ecx*2], dx
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40051870
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x400518d2
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
mov eax, dword [esi + 8]
test eax, eax
je 0x400518d2
push 0x384
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x400518ac
push 1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
test eax, eax
je 0x400518d9
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
pop esi
ret 4
mov dword [esi + 4], 0xffffffff
pop esi
ret 4
Function at 0x400518e0
Capabilities:
Create thread
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
xor eax, eax
mov dword [ebp - 0x2c], 0x28
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x24], eax
mov esi, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, 0x400
cmp ax, cx
jne 0x40051947
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
test ax, ax
je 0x40051956
mov ecx, 0x800
cmp ax, cx
jne 0x40051977
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
test ax, ax
je 0x4005196e
mov ecx, 0x400
cmp ax, cx
jne 0x40051977
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
movzx eax, ax
mov dword [ebp - 8], eax
mov dword [esi], edi
mov dword [esi + 0x14], 0xa
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 0x18], 0
mov dword [esi + 0x10], eax
je 0x400519df
lea eax, [esi + 0xc]
push eax
push 0
push esi
push 0x40051460
push 0
push 0
call fcn.4005b3ba
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x400519df
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_MessageBoxIndirectW]
test eax, eax
jne 0x400519e2
push 1
push dword [ebp - 0x1c]
push ebx
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40059afc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x40059b0f
xor eax, eax
jmp 0x40059bb2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0
jmp 0x40059b4e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 0x18]
jae 0x40059bb0
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.40059aac
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x40059bae
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x40059bb2
jmp 0x40059b45
xor eax, eax
mov esp, ebp
pop ebp
ret