joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410010
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438500
mov eax, dword fs:[0]
push eax
mov eax, 0x1144
call fcn.004276e0
mov eax, dword [0x4441a0]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x14]
call fcn.00401d60
mov dword [ebp - 4], 0
mov dword [ebp - 0x13c], 0x114
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x138], 6
jb 0x410109
mov dword [ebp - 0x140], 0
lea ecx, [ebp - 0x140]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x140], 0
je 0x410109
xor edx, edx
mov word [ebp - 0x944], dx
push 0x7fe
push 0
lea eax, [ebp - 0x942]
push eax
call fcn.004135e0
add esp, 0xc
mov dword [ebp - 0x144], 0x800
lea ecx, [ebp - 0x144]
push ecx
lea edx, [ebp - 0x944]
push edx
push 0
push 0
push str.Progid
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x140]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x944]
push edx
lea ecx, [ebp - 0x14]
call fcn.00401770
lea ecx, [ebp - 0x14]
call fcn.00401c20
test eax, eax
jne 0x410122
push str.http
lea ecx, [ebp - 0x14]
call fcn.00401770
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x18]
call fcn.00401d60
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
push eax
push str._s_shell
lea ecx, [ebp - 0x18]
push ecx
call fcn.00401690
add esp, 0xc
lea edx, [ebp - 0x10]
push edx
push 1
push 0
lea ecx, [ebp - 0x18]
call fcn.0040f250
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x10], 0
je 0x410224
xor eax, eax
mov word [ebp - 0x114c], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x114a]
push ecx
call fcn.004135e0
add esp, 0xc
mov dword [ebp - 0x948], 0x800
lea edx, [ebp - 0x948]
push edx
lea eax, [ebp - 0x114c]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 0
movzx eax, word [ebp - 0x114c]
test eax, eax
jne 0x4101ec
push str.open
lea ecx, [ebp - 0x114c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x114c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push str._s_shell_s
lea ecx, [ebp - 0x18]
push ecx
call fcn.00401690
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
push 1
push 0
lea ecx, [ebp - 0x18]
call fcn.0040f250
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1150], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00401e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401e00
mov eax, dword [ebp - 0x1150]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00412dbc
mov esp, ebp
pop ebp
ret
Function at 0x4107d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4441a0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004135e0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x210]
push edx
push str.ProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.00401770
push str.Internet_ExplorerIEXPLORE.EXE
mov ecx, dword [ebp + 8]
add ecx, 4
call fcn.004117c0
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
push str._nohome
mov ecx, dword [ebp + 8]
add ecx, 8
call fcn.00401770
push str.__1____1_0____
mov ecx, dword [ebp + 8]
add ecx, 0xc
call fcn.00401770
push str.IExplore
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.00401770
push str.WWW_OpenURLNewWindow
mov ecx, dword [ebp + 8]
add ecx, 0x14
call fcn.00401770
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412dbc
mov esp, ebp
pop ebp
ret
Function at 0x411b20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea ecx, [ebp + 8]
call fcn.00401c20
test eax, eax
jle 0x411b66
lea ecx, [ebp + 8]
call fcn.0040f250
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x411b66
mov eax, dword [ebp - 4]
and eax, 0x10
jne 0x411b66
mov dword [ebp - 8], 1
lea ecx, [ebp + 8]
call fcn.00401e00
mov eax, dword [ebp - 8]
jmp 0x411b78
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.00401e00
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x412dbc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4441a0]
jne 0x412dc6
repz ret
jmp fcn.00418fa2

Function at 0x428248
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00419cfa
and dword [ebp - 4], 0
cmp dword [0x446c38], 0
mov ebx, eax
jne 0x4282f9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4283aa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4283aa
push eax
call fcn.00419c88
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x446c38], eax
call esi
push eax
call fcn.00419c88
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x446c3c], eax
call esi
push eax
call fcn.00419c88
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x446c40], eax
call esi
push eax
call fcn.00419c88
pop ecx
mov dword [0x446c48], eax
test eax, eax
je 0x4282f9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419c88
pop ecx
mov dword [0x446c44], eax
mov eax, dword [0x446c44]
cmp eax, ebx
je 0x428351
cmp dword [0x446c48], ebx
je 0x428351
push eax
call fcn.00419d03
push dword [0x446c48]
mov esi, eax
call fcn.00419d03
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x428351
test edi, edi
je 0x428351
call esi
test eax, eax
je 0x428348
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x428348
test byte [ebp - 0xc], 1
jne 0x428351
or dword [ebp + 0x10], 0x200000
jmp 0x42838a
mov eax, dword [0x446c3c]
cmp eax, ebx
je 0x42838a
push eax
call fcn.00419d03
pop ecx
test eax, eax
je 0x42838a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42838a
mov eax, dword [0x446c40]
cmp eax, ebx
je 0x42838a
push eax
call fcn.00419d03
pop ecx
test eax, eax
je 0x42838a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x446c38]
call fcn.00419d03
pop ecx
test eax, eax
je 0x4283aa
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4283ac
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431e50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x447290
push 0x43bfe8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x431e70
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x431e9f
xor eax, eax
jmp 0x431eed
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
push 0
push 0
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.dbghelp.dll_MiniDumpWriteDump
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x431f00
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4441a0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004135e0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x418], dx
push 0x206
push 0
lea eax, [ebp - 0x416]
push eax
call fcn.004135e0
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0
call fcn.00431e30
add esp, 4
push edx
push eax
lea edx, [ebp - 0x210]
push edx
push str._sHntvC_llx.tmp
push 0x104
lea eax, [ebp - 0x418]
push eax
call fcn.00411c60
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431fbd
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00412dbc
mov esp, ebp
pop ebp
ret
Function at 0x433cd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
add ecx, 0x1ec
call fcn.00433360
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetParent]
push 0x86000000
push 0xfffffffffffffff0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 8]
add ecx, 0x24
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x24]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 8]
call dword [sym.imp.SkinUI.dll_public:_int___thiscall_ATL::CWindowImplBaseT_class_ATL::CWindow__class_ATL::CWinTraits_1442840576__0__::DestroyWindow_void_]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x434b50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x5c]
add eax, 0x18
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00434b10
add esp, 8
push 0
call fcn.00434af0
add esp, 4
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x4c]
push eax
call fcn.00434b10
add esp, 8
mov ecx, dword [ebp - 0x38]
cmp ecx, dword [ebp - 0x10]
jne 0x434bb4
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x14]
jne 0x434bb4
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x18]
jne 0x434bb4
mov dword [ebp - 0x60], 1
jmp 0x434bbb
mov dword [ebp - 0x60], 0
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
je 0x434bdf
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 0x64]
cmp dword [eax + 0x18], 0
jne 0x434be6
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + 0x1c], 0
jne 0x434be6
mov dword [ebp - 0x50], 1
mov ecx, dword [ebp - 0x5c]
add ecx, 4
call fcn.0040f250
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x434c03
mov dword [ebp - 0x50], 1
mov eax, dword [ebp - 0x50]
mov esp, ebp
pop ebp
ret

Function at 0x434c10
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 0xa8
call fcn.00409c90
test eax, eax
je 0x434c63
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb8], 0
je 0x434c61
push 0
push 0
push 0x2001
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb8]
mov edx, dword [edx]
mov eax, dword [edx]
call eax
push str.UpdateMiniCfg_failed_after_10s_updateagain
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x434c7c
push str.UpdateMiniCfg
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
add ecx, 0xa8
call fcn.00409c20
mov esp, ebp
pop ebp
ret
Function at 0x436210
Capabilities:
Check os version
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4441a0]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x104
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402460
add esp, 8
xor edx, edx
mov word [eax + 2], dx
mov dword [ebp - 4], 0
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x436273
mov ecx, dword [ebp - 0x11c]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 6
jl 0x436307
push 0x104
mov edx, dword [ebp + 0xc]
push edx
push str.ALLUSERSPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00413158
add esp, 4
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 - 2]
cmp edx, 0x5c
je 0x4362d7
mov eax, dword [ebp + 0xc]
push eax
call fcn.00413158
add esp, 4
mov ecx, 0x5c
mov edx, dword [ebp + 0xc]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00413158
add esp, 4
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax*2], cx
push str.HunanTV
mov eax, dword [ebp + 0xc]
push eax
call fcn.004134dd
add esp, 8
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x43c7b4
mov edx, dword [ebp + 0xc]
push edx
call fcn.004134dd
add esp, 8
jmp 0x43631c
push 0x103
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041352a
add esp, 0xc
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00412dbc
mov esp, ebp
pop ebp
ret
Function at 0x4369d0
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4378c2
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x4441a0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
push 0
call fcn.00401220
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x436a72
lea ecx, [ebp - 0x14]
call fcn.00401d60
mov dword [ebp - 4], 0
push 0x446dd8
push str._sHunanTV.exe
lea eax, [ebp - 0x14]
push eax
call fcn.00401690
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.0040f250
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x436a63
push 5
push 0
push str._mini
lea ecx, [ebp - 0x14]
call fcn.0040f250
push eax
push 0x43c90c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00401e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4014c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x40151b
cmp byte [esi + ebx - 1], 0xa
je 0x4014ef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x405084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401af0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x405094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x401cb0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x405094]
movzx eax, al
bt eax, esi
jae 0x401d10
mov ecx, dword [0x405084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x401bb6
test byte [0x402018], 8
jne 0x401c50
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x402028], 8
jne 0x401c00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x401b85
cmp esi, 3
jbe 0x401bc0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4030f0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x401b85
mov ecx, dword [0x405094]
test ecx, ecx
je 0x401cf0
mov dword [esp], 0x402028
call dword [0x405094]
test al, 8
je 0x401b5c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x401b5c
mov ebx, dword [0x405094]
test ebx, ebx
je 0x401cd0
mov dword [esp], 0x402018
call dword [0x405094]
test al, 8
je 0x401b49
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x401b4f
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401b10
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401c5a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x405094
call sym._load_func.part.0
jmp 0x401c0e
mov eax, 0xffffffff
jmp 0x401bb6
Function at 0x401e70
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call dbg.wmain
mov dword [esp], eax
call sym._exit
Function at 0x40187c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4181f3
call fcn.00417bb0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push 0xf
mov dword [ebp - 0x10], esi
mov dword [esi], 0x41b444
mov dword [esi + 4], 0x41b420
lea ecx, [esi + 0x10]
mov dword [esi + 8], 0x41b410
mov dword [esi + 0xc], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004021d8
lea ecx, [esi + 0x20]
push 0xf
mov dword [ebp - 4], ebx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004021d8
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
call fcn.0040194c
lea eax, [esi + 0xa0]
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], 4
mov dword [eax], 0x41b34c
lea ecx, [esi + 0xc8]
mov byte [esi + 0xb4], 1
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xc4], bl
push 0xf
mov byte [ebp - 4], 3
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.004021d8
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x41b3d8
mov dword [esi + 4], 0x41b3b4
mov dword [esi + 8], 0x41b3a4
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4041e5
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 8

Function at 0x404223
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42199c], 0
jne 0x40425a
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040426f
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call fcn.004041e5
push dword [ebp - 0xc]
mov bl, al
call fcn.00403149
pop ecx
mov al, bl
pop ebx
jmp 0x40426b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
leave
ret 8

Function at 0x4042c1
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42199c], 0
jne 0x4042f4
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040426f
push dword [eax]
call fcn.004041fb
push dword [ebp - 0xc]
mov bl, al
call fcn.00403149
pop ecx
mov al, bl
pop ebx
jmp 0x404302
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret 4

Function at 0x404392
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42199c], 0
jne 0x4043c5
push ebx
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
call fcn.0040426f
push dword [eax]
call fcn.0040437e
push dword [ebp - 0xc]
mov bl, al
call fcn.00403149
pop ecx
mov al, bl
pop ebx
jmp 0x4043d5
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret 4