joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
xor esi, esi
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 8]
sar eax, 2
test eax, eax
je 0x46c27c
cmp ebx, esi
je 0x46c26e
mov eax, dword [edi + 8]
push 0
mov ebx, dword [eax + esi*4]
push dword [ebx + 0x158]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x150]
test eax, eax
je 0x46c26b
cmp dword [ebx + 0x14c], 2
jne 0x46c259
push 1
push dword [eax + 0x158]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x150]
push dword [eax + 0x158]
call dword [sym.imp.USER32.dll_SetFocus]
mov ebx, dword [ebp - 4]
mov eax, dword [edi + 0xc]
inc esi
sub eax, dword [edi + 8]
sar eax, 2
cmp esi, eax
jb 0x46c220
push 0
push ebx
push 0x130c
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 8]
push 1
mov ecx, dword [ecx + ebx*4]
call fcn.00468040
mov eax, dword [edi + 8]
push 0
push 0
mov esi, dword [eax + ebx*4]
mov ebx, dword [sym.imp.USER32.dll_InvalidateRect]
push dword [esi + 0x158]
call ebx
push dword [esi + 0x158]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x174], 0
je 0x46c2d2
push dword [esi + 0x158]
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0
push 0
push dword [edi]
call ebx
push dword [edi]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x48e2aa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4ad403
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x55c640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00490045
mov dword [ebp - 0x14], eax
cmp dword [0x567588], esi
jne 0x4ad4f6
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4ad483
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4ad5d6
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4ad5d6
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4ad5d6
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x567588], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x56758c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x567590], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x567598], eax
test eax, eax
je 0x4ad4f3
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x567594], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4ad51b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4ad50e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4ad530
push 4
pop eax
jmp 0x4ad5d8
cmp dword [ebp - 0x14], esi
je 0x4ad530
push dword [0x567588]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4ad515
mov eax, dword [0x567594]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4ad58e
cmp dword [0x567598], edi
je 0x4ad58e
push eax
call ebx
push dword [0x567598]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4ad58e
test eax, eax
je 0x4ad58e
call ecx
test eax, eax
je 0x4ad583
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4ad583
test byte [ebp - 8], 1
jne 0x4ad58e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4ad5be
mov eax, dword [0x56758c]
cmp eax, edi
je 0x4ad5bb
push eax
call ebx
test eax, eax
je 0x4ad5bb
call eax
mov esi, eax
test esi, esi
je 0x4ad5bb
mov eax, dword [0x567590]
cmp eax, edi
je 0x4ad5bb
push eax
call ebx
test eax, eax
je 0x4ad5bb
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x567588]
call ebx
test eax, eax
je 0x4ad5d6
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4ad5d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484516
mov esp, ebp
pop ebp
ret
Function at 0x4e4b90
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0xc]
movzx edx, word [eax]
mov eax, dword [esp + 0x10]
mov ebx, dword [ebx]
mov dword [esp + 4], ebx
cmp ebx, eax
jb 0x4e4bb0
xor eax, eax
pop ebx
pop ecx
ret
push esi
mov esi, dword [esp + 0x1c]
sub eax, ebx
cmp esi, eax
push edi
cmova esi, eax
xor edi, edi
test esi, esi
je 0x4e4c00
mov edi, dword [esp + 0x1c]
push ebp
mov ebp, ebx
mov ebx, esi
sub ebp, edi
mov edi, edi
movzx eax, byte [edi + ebp]
lea edi, [edi + 1]
mov ecx, edx
shr ecx, 8
xor ecx, eax
add eax, edx
imul eax, eax, 0x3193
mov edx, 0x58bf
mov byte [edi - 1], cl
sub edx, eax
and edx, 0xffff
dec ebx
jne 0x4e4bd0
mov ebx, dword [esp + 0x10]
mov edi, esi
pop ebp
mov eax, dword [esp + 0x14]
lea ecx, [ebx + esi]
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
mov word [eax], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x505370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x515bfb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x55c640]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
xchg dword [esi], eax
xor eax, eax
mov dword [esi + 0x18], 7
push 0xffffffffffffffff
lea ecx, [esi + 4]
mov dword [ecx + 0x10], 0
push eax
push dword [esp + 0x24]
mov word [ecx], ax
call fcn.00451bc0
xor eax, eax
mov dword [esi + 0x30], 7
push 0xffffffffffffffff
lea ecx, [esi + 0x1c]
mov dword [esp + 0x18], 0
mov dword [ecx + 0x10], 0
push eax
push dword [esp + 0x28]
mov word [ecx], ax
call fcn.00451bc0
mov dword [esi + 0x48], 0xf
mov eax, esi
mov dword [esi + 0x44], 0
mov byte [esi + 0x34], 0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8

Function at 0x505620
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x515de8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x55c640]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55c640]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, dword [esp + 0x88]
lea eax, [esp + 0x14]
mov ebx, dword [esp + 0x80]
mov ebp, dword [esp + 0x84]
push edi
push ebx
push eax
call fcn.00507de0
add esp, 0xc
test edi, edi
je 0x505683
cmp dword [edi], 0
jne 0x505780
mov eax, dword [esp + 0x14]
cmp eax, 4
jne 0x50569c
push edi
push ebp
push ebx
call fcn.00505800
add esp, 0xc
jmp 0x505780
cmp eax, 3
jne 0x5056b1
push edi
push ebp
push ebx
call fcn.005057a0
add esp, 0xc
jmp 0x505780
cmp eax, 2
jne 0x5056fd
cmp dword [ebp + 0x14], 8
jb 0x5056c1
mov eax, dword [ebp]
jmp 0x5056c3
mov eax, ebp
cmp dword [ebx + 0x14], 8
jb 0x5056cd
mov ecx, dword [ebx]
jmp 0x5056cf
mov ecx, ebx
push 1
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x5056e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x5056e7
xor eax, eax
push str.boost::filesystem::copy_file
push edi
push ebp
push ebx
push eax
call fcn.005068a0
add esp, 0x14
jmp 0x505780
test edi, edi
jne 0x505762
push str.boost::filesystem::copy
lea ecx, [esp + 0x24]
call fcn.0044b740
mov dword [esp + 0x78], edi
call fcn.004098c0
mov esi, eax
mov dword [esp + 0x14], 0x32
push 0x32
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
sub esp, 0xc
mov byte [esp + 0x24], al
movq xmm0, qword [esp + 0x20]
lea ecx, [esp + 0x44]
mov eax, esp
push ebp
push ebx
movq qword [eax], xmm0
mov dword [eax + 8], esi
lea eax, [esp + 0x34]
push eax
call fcn.00504ff0
push 0x558020
lea eax, [esp + 0x3c]
push eax
call fcn.0048993b
call fcn.004098c0
mov esi, eax
mov dword [edi], 0x32
push 0x32
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
mov byte [edi + 4], al
mov dword [edi + 8], esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00484516
add esp, 0x68
ret
Function at 0x5057a0
Capabilities:
Create directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 8
jb 0x5057b0
mov eax, dword [esi]
jmp 0x5057b2
mov eax, esi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x14], 8
jb 0x5057c0
mov ecx, dword [edi]
jmp 0x5057c2
mov ecx, edi
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
test eax, eax
jne 0x5057d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x5057da
xor eax, eax
push str.boost::filesystem::copy_directory
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.005068a0
add esp, 0x14
pop edi
pop esi
ret

Function at 0x505b80
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x515c88
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x55c640]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55c640]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x8c]
cmp dword [ebx + 0x14], 8
jb 0x505bca
mov eax, dword [ebx]
jmp 0x505bcc
mov eax, ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x505beb
test edi, edi
je 0x505be4
mov ecx, edi
call fcn.005055d0
mov al, 1
jmp 0x505ce2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x567df8]
mov ebp, eax
mov dword [esp + 0x14], 0
mov byte [esp + 0x18], 0
test cl, 1
jne 0x505c32
or ecx, 1
mov dword [0x567de8], 0x25c5e09b
mov dword [0x567df8], ecx
mov dword [0x567dec], 0x8fafd21e
mov dword [0x567de0], 0x53dd00
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 0x567de0
push eax
lea eax, [esp + 0x24]
push ebx
push eax
call fcn.00507c40
add esp, 0xc
cmp dword [esp + 0x20], 3
jne 0x505c65
test edi, edi
je 0x505ce0
mov ecx, edi
call fcn.005055d0
jmp 0x505ce0
test edi, edi
jne 0x505cc7
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x2c]
call fcn.0044b740
mov dword [esp + 0x80], edi
call fcn.004098c0
mov esi, eax
mov dword [esp + 0x14], ebp
push ebp
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
sub esp, 0xc
mov byte [esp + 0x24], al
movq xmm0, qword [esp + 0x20]
lea ecx, [esp + 0x4c]
mov eax, esp
push ebx
movq qword [eax], xmm0
mov dword [eax + 8], esi
lea eax, [esp + 0x38]
push eax
call fcn.00505100
push 0x558020
lea eax, [esp + 0x44]
push eax
call fcn.0048993b
call fcn.004098c0
mov esi, eax
mov dword [edi], ebp
push ebp
mov ecx, esi
mov edx, dword [esi]
mov edx, dword [edx + 0x18]
call edx
mov byte [edi + 4], al
mov dword [edi + 8], esi
xor al, al
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00484516
add esp, 0x70
ret
Function at 0x5074c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp dword [esi + 0x14], 8
jb 0x5074d3
mov eax, dword [esi]
jmp 0x5074d5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x5074fd
push dword [esp + 0x18]
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00507160
add esp, 0xc
mov eax, dword [eax]
pop esi
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x50750a
call fcn.005055d0
test ebx, 0x400
je 0x507540
push esi
call fcn.00506e90
add esp, 4
test al, al
je 0x507535
test bl, 0x10
mov eax, 4
mov ecx, 0xb
pop esi
cmovne eax, ecx
pop ebx
add esp, 8
ret
pop esi
mov eax, 9
pop ebx
add esp, 8
ret
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret

Function at 0x507ae0
Capabilities:
Check if file exists
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x507aec
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x507b2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x507b2a
cmp eax, 3
je 0x507b2a
cmp eax, 0x7b
je 0x507b2a
cmp eax, 0xf
je 0x507b2a
cmp eax, 0x15
je 0x507b2a
cmp eax, 0x57
je 0x507b2a
cmp eax, 0xa1
je 0x507b2a
cmp eax, 0x35
je 0x507b2a
xor al, al
ret
mov al, 1
ret

Function at 0x507b30
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 8
jb 0x507b3c
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x507b7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x507b7a
cmp eax, 3
je 0x507b7a
cmp eax, 0x7b
je 0x507b7a
cmp eax, 0xf
je 0x507b7a
cmp eax, 0x15
je 0x507b7a
cmp eax, 0x57
je 0x507b7a
cmp eax, 0xa1
je 0x507b7a
cmp eax, 0x35
je 0x507b7a
xor al, al
ret
mov al, 1
ret
Function at 0x507c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x515f50
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x55c640]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x55c640]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov ebp, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
jb 0x507c88
mov eax, dword [edi]
jmp 0x507c8a
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x507caa
push ebp
push edi
push ebx
call fcn.00507160
add esp, 0xc
jmp 0x507db8
test eax, 0x400
je 0x507d79
cmp dword [edi + 0x14], 8
jb 0x507cbf
mov eax, dword [edi]
jmp 0x507cc1
mov eax, edi
push eax
lea ecx, [esp + 0x24]
call fcn.00505410
cmp dword [esp + 0x34], 8
lea eax, [esp + 0x20]
push 0
cmovae eax, dword [esp + 0x24]
push 0x2000000
push 3
push 0
push 7
push 0
push eax
mov dword [esp + 0x60], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x44], 2
jb 0x507d15
push dword [esp + 0x20]
call fcn.00485250
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
cmp esi, 0xffffffff
je 0x507c9a
push edi
call fcn.00506e90
add esp, 4
test al, al
jne 0x507d6a
mov eax, dword [esp + 0x1c]
push eax
push edi
call fcn.00507060
add esp, 8
mov dword [ebx], 9
mov dword [ebx + 4], eax
mov dword [esp + 0x44], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x507db8
push esi
mov dword [esp + 0x48], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x507d84
mov ecx, ebp
call fcn.005055d0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 3
push eax
push edi
test al, 0x10
jne 0x507d9e
mov dword [esp + 0x1c], 2
call fcn.00507060
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [ecx]
add esp, 8
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
mov eax, ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00484516
add esp, 0x34
ret
Function at 0x507de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
cmp dword [esi + 0x14], 8
jb 0x507df3
mov eax, dword [esi]
jmp 0x507df5
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x507e1d
push dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push esi
call fcn.00507160
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x507e2a
call fcn.005055d0
test ebx, 0x400
je 0x507e53
push esi
call fcn.00506e90
add esp, 4
mov dword [esp + 8], 4
push ebx
push esi
test al, al
jne 0x507e6a
mov dword [esp + 0x10], 9
jmp 0x507e6a
mov dword [esp + 8], 3
push ebx
push esi
test bl, 0x10
jne 0x507e6a
mov dword [esp + 0x10], 2
call fcn.00507060
mov dword [esp + 0x14], eax
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
pop esi
mov dword [eax + 4], ecx
pop ebx
add esp, 8
ret
Function at 0x509040
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x516240
mov eax, dword fs:[0]
push eax
push ebx
push ebp
mov eax, dword [0x55c640]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 0x14], 3
lea ebx, [ebx]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x98]
mov ebx, dword [esp + 0x74]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
cmp ebp, dword [esp + 0x54]
jne 0x509091
cmp ecx, eax
je 0x50910c
cmp ebx, dword [esp + 0x94]
jne 0x5090a0
cmp dword [esp + 0x78], edx
je 0x50910c
cmp dword [esp + 0x70], 8
lea eax, [esp + 0x5c]
push dword [esp + 0x6c]
cmovae eax, dword [esp + 0x60]
lea ecx, [esp + 0x20]
push eax
push dword [esp + 0x34]
push 0
call fcn.0045afe0
test eax, eax
js 0x50915b
cmp dword [esp + 0x30], 8
lea eax, [esp + 0x1c]
push dword [esp + 0x2c]
cmovae eax, dword [esp + 0x20]
lea ecx, [esp + 0x60]
push eax
push dword [esp + 0x74]
push 0
call fcn.0045afe0
test eax, eax
js 0x509154
lea eax, [esp + 0x1c]
push eax
call fcn.00509300
lea eax, [esp + 0x60]
push eax
call fcn.00509300
add esp, 8
jmp 0x509070
cmp ebp, dword [esp + 0x54]
jne 0x509142
cmp ecx, eax
jne 0x509142
cmp ebx, dword [esp + 0x94]
jne 0x509129
cmp dword [esp + 0x78], edx
jne 0x509129
xor ebx, ebx
jmp 0x50915e
cmp ecx, eax
jne 0x509142
xor ebx, ebx
mov eax, 1
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x50915e
xor ebx, ebx
xor eax, eax
test al, al
sete bl
lea ebx, [ebx*2 - 1]
jmp 0x50915e
mov ebx, 1
jmp 0x50915e
or ebx, 0xffffffff
cmp dword [esp + 0x30], 8
jb 0x509171
push dword [esp + 0x1c]
call fcn.00485250
add esp, 4
xor eax, eax
mov dword [esp + 0x30], 7
cmp dword [esp + 0x50], 8
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
jb 0x50919b
push dword [esp + 0x3c]
call fcn.00485250
add esp, 4
xor eax, eax
mov dword [esp + 0x50], 7
cmp dword [esp + 0x70], 8
mov dword [esp + 0x4c], 0
mov word [esp + 0x3c], ax
jb 0x5091c5
push dword [esp + 0x5c]
call fcn.00485250
add esp, 4
xor eax, eax
mov dword [esp + 0x70], 7
cmp dword [esp + 0x90], 8
mov dword [esp + 0x6c], 0
mov word [esp + 0x5c], ax
jb 0x5091f2
push dword [esp + 0x7c]
call fcn.00485250
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x401384
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push edi
mov dword [ebp - 4], ecx
call esi
push eax
call fcn.0040b8f9
push dword [eax + 0x1c]
mov edi, dword [sym.imp.USER32.dll_GetDC]
call edi
push eax
call fcn.00410cfe
test eax, eax
je 0x4013b9
mov eax, dword [eax + 4]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0xc
push eax
call ebx
mov dword [ebp - 8], eax
call esi
push eax
call fcn.0040b8f9
push dword [eax + 0x1c]
call edi
push eax
call fcn.00410cfe
xor edi, edi
cmp eax, edi
jne 0x4013e4
xor eax, eax
jmp 0x4013e7
mov eax, dword [eax + 4]
push 0xe
push eax
call ebx
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x20
push eax
call fcn.00402b50
mov esi, eax
pop ecx
inc esi
pop ecx
cmp esi, 1
jne 0x40140b
mov esi, str.00000809
lea eax, [ebp - 0x124]
push 0x104
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x124]
push 0x5c
push eax
call fcn.00402b50
imul ebx, dword [ebp - 8]
and byte [eax + 1], 0
inc eax
pop ecx
lea eax, [ebp - 0x124]
pop ecx
cmp ebx, 8
push esi
push eax
jge 0x40144b
push str._s_s.016
jmp 0x401450
push str._s_s.256
lea eax, [ebp - 0x124]
push eax
call fcn.00402ae0
add esp, 0x10
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4014dc
mov ebx, dword [ebp - 4]
mov ecx, ebx
lea eax, [ebx + 0x40]
lea esi, [ebx + 0x3c]
push eax
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.00401684
lea eax, [ebp - 0x20]
push eax
push 0x18
push dword [esi]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x4014a3
xor esi, esi
jmp 0x4014a6
mov esi, dword [eax + 0x1c]
call fcn.00419f80
push 0x7f00
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push edi
push edi
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push edi
push edi
push 0x90000000
push edi
push edi
push edi
push eax
push edi
call fcn.0040c5f7
push eax
push edi
mov ecx, ebx
call fcn.0040beed
jmp 0x4014de
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402f70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4205b8
push 0x407678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x42ab6c], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x42ab68], ecx
shl ecx, 8
add ecx, edx
mov dword [0x42ab64], ecx
shr eax, 0x10
mov dword [0x42ab60], eax
call fcn.004062b0
test eax, eax
jne 0x402fda
push 0x1c
call fcn.00403150
add esp, 4
call fcn.004052c0
test eax, eax
jne 0x402fed
push 0x10
call fcn.00403150
add esp, 4
mov dword [ebp - 4], 0
call fcn.00407460
call fcn.00404770
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x42c278], eax
call fcn.00407300
mov dword [0x42ab50], eax
test eax, eax
je 0x403020
mov eax, dword [0x42c278]
test eax, eax
jne 0x40302a
push 0xffffffffffffffff
call fcn.00403890
add esp, 4
call fcn.00407050
call fcn.00406f60
call fcn.00403860
mov esi, dword [0x42c278]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x403109
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x403071
test al, al
je 0x403071
and eax, 0xff
push eax
call fcn.00406f00
add esp, 4
test eax, eax
je 0x40304b
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40304b
cmp byte [esi], 0x22
jne 0x40307a
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x40308a
cmp al, 0x20
ja 0x40308a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40307a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x4030ab
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x4030b0
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00403890
jmp 0x4030ee
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40307a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x403109

Function at 0x403150
Capabilities:
Terminate process

Disassembly:
cmp dword [0x42ab58], 1
jne 0x40315e
call fcn.00407750
mov eax, dword [esp + 4]
push eax
call fcn.00407790
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]