joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d640
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x440374]
xor eax, esp
mov dword [esp + 0x20c], eax
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 0x21c]
push ebx
mov ebx, dword [esp + 0x228]
push ebp
push esi
mov esi, dword [esp + 0x220]
test esi, esi
mov edx, 4
push edi
mov edi, dword [esp + 0x230]
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
lea ebp, [edx - 3]
jne 0x40d6a1
mov eax, 2
jmp 0x40d725
test ecx, ecx
je 0x40d697
test eax, eax
je 0x40d6c4
cmp byte [eax], 0
je 0x40d6c4
push eax
push ecx
lea eax, [esp + 0x24]
push str._s_s
push eax
call fcn.00415328
add esp, 0x10
jmp 0x40d6d7
push ecx
lea ecx, [esp + 0x20]
push 0x4393b4
push ecx
call fcn.00415328
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d70f
lea ecx, [esp + 0x14]
push ecx
push ebx
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [esp + 0x20]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40d714
mov ebp, 2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40d723
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415063
add esp, 0x210
ret

Function at 0x40d770
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov eax, dword [0x440374]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x469fd4]
test eax, eax
push ebx
mov ebx, dword [esp + 0x810]
push ebp
push edi
mov edi, dword [esp + 0x814]
mov ebp, 1
jne 0x40d7c9
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x40d7c9
pop edi
lea eax, [ebp + 1]
pop ebp
pop ebx
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00415063
add esp, 0x804
ret
cmp byte [esp + 0x81c], 0
push esi
je 0x40d7e6
lea eax, [esp + 0x10]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40d7f7
push 0x800
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, eax
test esi, esi
je 0x40d83b
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.00416bd0
add esp, 8
test edi, edi
mov byte [eax], 0
je 0x40d825
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40d818
sub eax, edx
jmp 0x40d827
xor eax, eax
add esi, eax
add esi, 0xa
push esi
call fcn.00414b94
add esp, 4
test eax, eax
mov dword [ebx], eax
jne 0x40d842
mov eax, 2
jmp 0x40d881
push esi
push 0
push eax
call fcn.00415080
add esp, 0xc
test edi, edi
je 0x40d86a
mov ecx, dword [ebx]
push edi
lea eax, [esp + 0x14]
push eax
push str._s_s
push ecx
call fcn.00415328
add esp, 0x10
jmp 0x40d87f
mov eax, dword [ebx]
lea edx, [esp + 0x10]
push edx
push 0x4393b4
push eax
call fcn.00415328
add esp, 0xc
mov eax, ebp
mov ecx, dword [esp + 0x810]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415063
add esp, 0x804
ret
Function at 0x40de80
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x4379fe
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x440374]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea ecx, [esi + 0x3a0]
call fcn.004102d0
lea ecx, [esi + 0x3ac]
mov dword [esp + 0x18], 0
call fcn.004102d0
push 0x200
lea eax, [esi + 0x198]
push 0
push eax
mov dword [esi + 0x194], 0xffffffff
call fcn.00415080
push 0x190
lea edi, [esi + 4]
push 0
push edi
mov dword [esi + 0x398], 0x50
call fcn.00415080
add esp, 0x18
push edi
push 0x101
call sub.WSOCK32.dll_WSAStartup
neg eax
sbb eax, eax
add eax, 1
mov dword [esi], eax
mov dword [esi + 0x3b8], 0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x40e000
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, 1
jne 0x40e017
mov eax, 2
pop esi
ret 0xc
mov edx, dword [esp + 0x10]
test edx, edx
je 0x40e00e
cmp dword [ecx + 0x194], 0xffffffff
jne 0x40e031
mov eax, 0xc
pop esi
ret 0xc
push 0
push edx
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.WSOCK32.dll_send
test eax, eax
jg 0x40e048
mov esi, 0xf
mov eax, esi
pop esi
ret 0xc

Function at 0x40e1c0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [esp + 0x114]
push esi
lea ecx, [esp + 4]
push ecx
push 0
push 0
lea edx, [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x120]
push edx
mov esi, 1
push 0xffffffffffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], esi
call sub.WSOCK32.dll_select
cmp eax, esi
lea eax, [esi + 0xd]
jne 0x40e208
mov eax, esi
pop esi
add esp, 0x10c
ret 8

Function at 0x40e280
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40e2f5
push 0x40
push esi
call fcn.004152d9
add esp, 8
test eax, eax
jne 0x40e29a
mov eax, esi
push eax
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x40e2f5
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
mov byte [esp + 8], cl
movzx ecx, byte [eax + 2]
mov byte [esp + 9], dl
movzx edx, byte [eax + 3]
mov byte [esp + 0xa], cl
mov byte [esp + 0xb], dl
mov eax, dword [esp + 8]
push eax
call sub.WSOCK32.dll_inet_ntoa
test eax, eax
je 0x40e2f5
mov edx, dword [esp + 0xc]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x40e2e0
mov eax, 1
pop esi
ret 8
mov eax, 0xd
pop esi
ret 8
Function at 0x40e760
Capabilities:
Connect socket
Connect udp socket
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
mov eax, dword [0x440374]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, dword [esp + 0x20]
test edi, edi
mov esi, ecx
mov eax, 1
jne 0x40e795
lea eax, [edi + 2]
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00415063
add esp, 0x14
ret 8
cmp dword [esi + 0x194], 0xffffffff
jne 0x40e835
mov eax, dword [esp + 0x24]
push ebx
push edi
mov dword [esi + 0x398], eax
call fcn.0040e220
mov ebx, eax
cmp ebx, 1
jne 0x40e834
movzx ecx, word [esi + 0x398]
xor eax, eax
push ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call sub.WSOCK32.dll_htons
push edi
mov word [esp + 0x12], ax
mov word [esp + 0x10], 2
call sub.WSOCK32.dll_inet_addr
push 0
push ebx
push 2
mov dword [esp + 0x1c], eax
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [esi + 0x194], eax
jne 0x40e81b
lea eax, [ebx + 0xb]
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00415063
add esp, 0x14
ret 8
push 0x10
lea edx, [esp + 0x10]
push edx
push eax
call sub.WSOCK32.dll_connect
cmp eax, 0xffffffff
jne 0x40e832
mov ebx, 0xd
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
call fcn.00415063
add esp, 0x14
ret 8

Function at 0x40ecf0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, 1
jne 0x40ed07
pop esi
lea eax, [ebx + 1]
pop ebx
ret 0x14
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x40ed19
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
ret 0x14
cmp dword [ecx + 0x194], 0xffffffff
jne 0x40ed2d
pop edi
pop esi
mov eax, 0xc
pop ebx
ret 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40ed42
push eax
call fcn.0040e910
mov ebx, eax
cmp ebx, 1
jne 0x40eda6
push ebp
mov ebp, dword [esp + 0x14]
push 2
push edi
push esi
push ebp
call sub.WSOCK32.dll_recv
test eax, eax
mov edi, dword [esp + 0x20]
mov dword [edi], eax
jge 0x40ed67
pop ebp
pop edi
pop esi
mov eax, 5
pop ebx
ret 0x14
je 0x40eda3
push 0xd
push esi
call fcn.00416fc2
add esp, 8
test eax, eax
je 0x40ed85
cmp byte [eax + 1], 0xa
jne 0x40ed85
sub eax, esi
add eax, 2
mov dword [edi], eax
mov eax, dword [esp + 0x1c]
push eax
push 0
push esi
call fcn.00415080
mov ecx, dword [edi]
add esp, 0xc
push 0
push ecx
push esi
push ebp
call sub.WSOCK32.dll_recv
mov dword [edi], eax
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret 0x14
Function at 0x40edb0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
test esi, esi
mov ebx, 1
jne 0x40edc7
pop esi
lea eax, [ebx + 1]
pop ebx
ret 0x14
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x40edd9
lea eax, [edi + 2]
pop edi
pop esi
pop ebx
ret 0x14
cmp dword [ecx + 0x194], 0xffffffff
jne 0x40eded
pop edi
pop esi
mov eax, 0xc
pop ebx
ret 0x14
mov eax, dword [esp + 0x20]
test eax, eax
je 0x40edfd
push eax
call fcn.0040e910
mov ebx, eax
push edi
push 0
push esi
call fcn.00415080
mov eax, dword [esp + 0x1c]
add esp, 0xc
push 0
push edi
push esi
push eax
call sub.WSOCK32.dll_recv
test eax, eax
mov ecx, dword [esp + 0x1c]
mov dword [ecx], eax
jge 0x40ee26
mov ebx, 5
pop edi
pop esi
mov eax, ebx
pop ebx
ret 0x14

Function at 0x40fce0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, 1
mov dword [esi], 0
jne 0x40fd01
pop edi
mov eax, 2
pop esi
ret
cmp eax, 0xffffffff
jne 0x40fd0e
pop edi
mov eax, 5
pop esi
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x40fd22
mov edi, 7
mov eax, edi
pop edi
pop esi
ret

Function at 0x40fd30
Capabilities:
Check if file exists
Delete file

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, 1
jne 0x40fd45
mov eax, 2
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40fd60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40fd60
mov esi, 2
mov eax, esi
pop esi
ret

Function at 0x40fe20
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, 1
jne 0x40fe35
mov eax, 2
pop esi
ret
mov edx, dword [esp + 0xc]
test edx, edx
je 0x40fe2e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40fe2e
cmp eax, 0xffffffff
jne 0x40fe51
mov eax, 7
pop esi
ret
push edi
mov edi, dword [esp + 0x18]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
pop edi
jne 0x40fe6c
mov esi, 2
mov eax, esi
pop esi
ret

Function at 0x40fe70
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
push esi
mov esi, 1
jne 0x40fe85
mov eax, 2
pop esi
ret
mov edx, dword [esp + 0xc]
test edx, edx
je 0x40fe7e
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40fe7e
cmp eax, 0xffffffff
jne 0x40fea1
mov eax, 7
pop esi
ret
push edi
mov edi, dword [esp + 0x18]
push 0
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
pop edi
jne 0x40febc
mov esi, 2
mov eax, esi
pop esi
ret
Function at 0x40ff00
Capabilities:
Get file version info
Identify system language via api

Disassembly:
sub esp, 0x218
mov eax, dword [0x440374]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x220]
push ebx
push edi
mov edi, dword [esp + 0x224]
xor ebx, ebx
push 0x1ff
lea ecx, [esp + 0x21]
push ebx
push ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
call fcn.00415080
add esp, 0xc
cmp edi, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 1
jne 0x40ff73
pop edi
lea eax, [ebx + 2]
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00415063
add esp, 0x218
ret
push esi
lea edx, [esp + 0x18]
push edx
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x40ffa2
pop esi
pop edi
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.00415063
add esp, 0x218
ret
push ebp
push esi
call fcn.00414b94
mov ebp, eax
add esp, 4
cmp ebp, ebx
jne 0x40ffbf
mov dword [esp + 0x10], 2
jmp 0x410091
push esi
push ebx
push ebp
call fcn.00415080
mov eax, dword [esp + 0x28]
add esp, 0xc
push ebp
push esi
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40ffe8
mov dword [esp + 0x10], 2
jmp 0x410091
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push str.VarFileInfoTranslation
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41003c
cmp dword [esp + 0x18], 4
jne 0x41003c
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, eax
shr ecx, 0x10
and ecx, 0xff
push ecx
mov edx, eax
shr edx, 0x18
push edx
movzx ecx, al
movzx edx, ah
push ecx
push edx
lea eax, [esp + 0x34]
push str.StringFileInfo_02X_02X_02X_02XFileVersion
push eax
call fcn.00415328
add esp, 0x18
jmp 0x410058
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
push ecx
lea edx, [esp + 0x28]
push str.StringFileInfo_04X04B0FileVersion
push edx
call fcn.00415328
add esp, 0xc
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x41007b
mov dword [esp + 0x10], 2
jmp 0x410091
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x410085
cmp ebp, ebx
je 0x41009e
push ebp
call fcn.00414c03
add esp, 4
mov ecx, dword [esp + 0x224]
mov eax, dword [esp + 0x10]
pop ebp
pop esi
pop edi
pop ebx
xor ecx, esp
call fcn.00415063
add esp, 0x218
ret
Function at 0x410160
Capabilities:
Get file size

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x14]
test edi, edi
mov dword [esp + 8], 0
mov ebx, 1
jne 0x41017f
pop edi
lea eax, [ebx + 1]
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [esp + 0x1c]
mov eax, ebp
sub eax, 1
je 0x4101b2
sub eax, 1
je 0x4101a6
sub eax, 1
je 0x41019f
pop ebp
pop edi
mov eax, 5
pop ebx
pop ecx
ret
mov eax, 0x40000000
jmp 0x4101b7
mov eax, 0x40000000
mov ecx, 2
jmp 0x4101bc
mov eax, connect
mov ecx, 3
push esi
push 0
push 0x80
push ecx
push 0
push 3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, dword [esp + 0x18]
mov dword [esi], eax
jne 0x4101ef
push 2
push edi
push esi
call fcn.0040fc50
mov ebx, eax
add esp, 0xc
cmp ebx, 1
jne 0x410232
cmp ebp, 3
jne 0x410232
mov ecx, dword [esi]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x41021a
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
lea eax, [ebp + 4]
pop ebp
pop edi
pop ebx
pop ecx
ret
mov edx, dword [esi]
push 0
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x410232
mov ebx, 7
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x412a50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00412730
push 0
push 0
push 3
push 0
push 0
push connect
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x412a8a
xor eax, eax
jmp 0x412ba7
push 2
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 8], eax
push 0
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 8]
add eax, 4
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x320], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x320], 0
jne 0x412ad8
xor eax, eax
jmp 0x412ba7
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x324], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x324], 0
jne 0x412b0c
mov ecx, dword [ebp - 0x10]
call fcn.00412730
xor eax, eax
jmp 0x412ba7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x324]
mov eax, dword [ebp - 8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x32c], 4
mov edx, dword [ebp - 8]
add edx, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x328], edx
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x328]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x324]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
call fcn.00413290
test eax, eax
jne 0x412b92
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x10]
call fcn.00412730
xor eax, eax
jmp 0x412ba7
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x415063
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x440374]
jne 0x41506d
repz ret
jmp fcn.00418f1c
Function at 0x41e81f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x440d40]
je 0x41e83a
inc edi
cmp edi, 0x17
jb 0x41e82b
cmp edi, 0x17
jae 0x41e9ba
push ebp
push 3
call fcn.0042b6df
cmp eax, 1
pop ecx
je 0x41e986
push 3
call fcn.0042b6df
test eax, eax
pop ecx
jne 0x41e86e
cmp dword [0x440410], 1
je 0x41e986
cmp ebx, 0xfc
je 0x41e9b9
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x472548
push ebp
call fcn.0041f012
add esp, 0xc
test eax, eax
je 0x41e8a4
push esi
push esi
push esi
push esi
push esi
call fcn.0041557f
add esp, 0x14
push 0x104
mov esi, 0x472561
push esi
push 0
mov byte [0x472665], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41e8e8
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0041f012
add esp, 0xc
test eax, eax
je 0x41e8e8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041557f
add esp, 0x14
push esi
call fcn.00414af0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x41e92d
push esi
call fcn.00414af0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x47285c
push 0x43a11c
sub ecx, eax
push ecx
push eax
call fcn.00423636
add esp, 0x14
test eax, eax
je 0x41e92d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041557f
add esp, 0x14
jmp 0x41e92f
xor esi, esi
push 0x43a118
push ebx
push ebp
call fcn.0042357f
add esp, 0xc
test eax, eax
je 0x41e94f
push esi
push esi
push esi
push esi
push esi
call fcn.0041557f
add esp, 0x14
push dword [edi*8 + 0x440d44]
push ebx
push ebp
call fcn.0042357f
add esp, 0xc
test eax, eax
je 0x41e971
push esi
push esi
push esi
push esi
push esi
call fcn.0041557f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0042b522
add esp, 0xc
jmp 0x41e9b9
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x41e9b9
cmp ebp, 0xffffffff
je 0x41e9b9
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x440d44]
push dword [esi]
call fcn.00414af0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42b522
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004188a5
xor ebx, ebx
cmp dword [0x472a70], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42b5f8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42b6d8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x43b3e8
push edi
call esi
cmp eax, ebx
je 0x42b6d8
push eax
call fcn.00418837
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x472a70], eax
call esi
push eax
call fcn.00418837
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x472a74], eax
call esi
push eax
call fcn.00418837
mov dword [0x472a78], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041c3c5
test eax, eax
pop ecx
pop ecx
je 0x42b5c6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041557f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42b5f8
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00418837
cmp eax, ebx
pop ecx
mov dword [0x472a80], eax
je 0x42b5f8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00418837
pop ecx
mov dword [0x472a7c], eax
mov eax, dword [0x472a7c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42b67d
cmp dword [0x472a80], ecx
je 0x42b67d
push eax
call fcn.004188ae
push dword [0x472a80]
mov esi, eax
call fcn.004188ae
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42b67d
cmp edi, ebx
je 0x42b67d
call esi
cmp eax, ebx
je 0x42b64a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42b64a
test byte [ebp - 0x18], 1
jne 0x42b67d
lea eax, [ebp - 0x10]
push eax
call fcn.0041c474
test eax, eax
pop ecx
je 0x42b665
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041557f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x42b674
or dword [ebp + 0x10], 0x200000
jmp 0x42b6b8
or dword [ebp + 0x10], 0x40000
jmp 0x42b6b8
mov eax, dword [0x472a74]
cmp eax, dword [ebp - 8]
je 0x42b6b8
push eax
call fcn.004188ae
cmp eax, ebx
pop ecx
je 0x42b6b8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42b6b8
mov eax, dword [0x472a78]
cmp eax, dword [ebp - 8]
je 0x42b6b8
push eax
call fcn.004188ae
cmp eax, ebx
pop ecx
je 0x42b6b8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x472a70]
call fcn.004188ae
cmp eax, ebx
pop ecx
je 0x42b6d8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42b6da
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret