joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001519
Capabilities:
Contain obfuscated stackstrings
Copy file
Create a process with modified i/o handles and window
Create directory
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x1001b004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.10002840
push esi
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10002840
push esi
lea eax, [ebp - 0x310]
push ebx
push eax
call fcn.10002840
add esp, 0x24
lea eax, [ebp - 0x108]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x1000158b
cmp byte [ebp + eax - 0x108], 0x5c
je 0x10001590
sub eax, 1
jne 0x10001581
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x107]
add eax, ecx
push eax
lea eax, [ebp - 0x310]
push eax
call edi
lea eax, [ebp - 0x108]
push str.Libraries
push eax
call fcn.100023a0
pop ecx
pop ecx
test eax, eax
jne 0x1000173f
push 0x44
lea eax, [ebp - 0x3a4]
push ebx
push eax
call fcn.10002840
add esp, 0xc
mov dword [ebp - 0x378], 0x101
xor eax, eax
mov dword [ebp - 0x32c], 0x555c3a43
mov word [ebp - 0x374], ax
mov ebx, 0x65697261
mov dword [ebp - 0x328], 0x73726573
push eax
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x324], 0x6275505c
push eax
mov dword [ebp - 0x320], 0x5c63696c
mov dword [ebp - 0x31c], 0x7262694c
mov dword [ebp - 0x318], ebx
mov dword [ebp - 0x314], 0x73
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
push 0x10017ddc
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x20c]
push 0
push eax
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.kave8.dll
lea eax, [ebp - 0x108]
push eax
call edi
mov dword [ebp - 0x33c], ebx
lea eax, [ebp - 0x350]
xor ebx, ebx
mov dword [ebp - 0x350], 0x555c3a43
push ebx
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x34c], 0x73726573
push eax
mov dword [ebp - 0x348], 0x6275505c
mov dword [ebp - 0x344], 0x5c63696c
mov dword [ebp - 0x340], 0x7262694c
mov dword [ebp - 0x338], 0x616b5c73
mov dword [ebp - 0x334], 0x2e386576
mov dword [ebp - 0x330], 0x6c6c64
call esi
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x3a4]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10001738
call fcn.10001229
call fcn.1000144f
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10001229
call fcn.1000144f
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001776
mov esp, ebp
pop ebp
ret
Function at 0x10001ce0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x10001e35
push 0
push 0
push 0
push 0x10002b90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [ebp + 0x10], 0
jne 0x10001ea3
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1000c624]
push esi
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1000e7d4]
cmp eax, dword [esi + 4]
jle 0x10001d76
push 0x1000e7d4
call fcn.10007175
add esp, 4
cmp dword [0x1000e7d4], 0xffffffff
jne 0x10001d76
push 0x10008160
mov dword [0x1000e7d8], 0x100093cc
call fcn.100074de
push 0x1000e7d4
call fcn.10007124
add esp, 8
mov eax, dword [0x1000e7c4]
cmp eax, dword [esi + 4]
jle 0x10001dba
push 0x1000e7c4
call fcn.10007175
add esp, 4
cmp dword [0x1000e7c4], 0xffffffff
jne 0x10001dba
push 0x10008140
mov dword [0x1000e7c8], 0x100091cc
call fcn.100074de
push 0x1000e7c4
call fcn.10007124
add esp, 8
call fcn.100010b0
test al, al
je 0x10001e1a
mov eax, dword [0x1000e7d0]
cmp eax, dword [esi + 4]
jle 0x10001e07
push 0x1000e7d0
call fcn.10007175
add esp, 4
cmp dword [0x1000e7d0], 0xffffffff
jne 0x10001e07
push 0x10008130
mov dword [0x1000e7cc], 0x10009364
call fcn.100074de
push 0x1000e7d0
call fcn.10007124
add esp, 8
call fcn.10002fc0
test al, al
je 0x10001e1a
mov eax, 1
pop esi
pop ebp
ret 0xc
push 0
push str.Erro:_ClientPatch.dll
push 0x10009394
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x10001ea3
cmp dword [ebp + 0x10], eax
je 0x10001ea3
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1000c624]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1000e7d4]
cmp eax, dword [ecx + 4]
jle 0x10001e91
push 0x1000e7d4
call fcn.10007175
add esp, 4
cmp dword [0x1000e7d4], 0xffffffff
jne 0x10001e91
push 0x10008160
mov dword [0x1000e7d8], 0x100093cc
call fcn.100074de
push 0x1000e7d4
call fcn.10007124
add esp, 8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x10004f60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1000c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1000c624]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1000c648]
cmp eax, dword [ecx + 4]
jle 0x10004fc3
push 0x1000c648
call fcn.10007175
add esp, 4
cmp dword [0x1000c648], 0xffffffff
jne 0x10004fc3
push 0x10008150
mov dword [0x1000c64c], 0x10009370
call fcn.100074de
push 0x1000c648
call fcn.10007124
add esp, 8
mov eax, dword [ebp + 8]
push esi
mov cl, byte [eax + 0x8ad]
mov dl, byte [eax + 0x75b]
mov al, byte [eax + 0x75a]
test cl, cl
je 0x10005075
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 0
test dl, dl
je 0x10005035
test al, al
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4f5a0e
je 0x1000501c
call esi
test eax, eax
je 0x100050f9
mov dword [0x4f5a0e], 0x1c8
jmp 0x100050e9
call esi
test eax, eax
je 0x100050f9
mov dword [0x4f5a0e], 0x1c9
jmp 0x100050e9
test al, al
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4f5a0e
je 0x1000505f
call esi
test eax, eax
je 0x100050f9
mov dword [0x4f5a0e], 0x1c7
jmp 0x100050e9
call esi
test eax, eax
je 0x100050f9
mov dword [0x4f5a0e], 0x1c6
jmp 0x100050e9
test dl, dl
je 0x100050bb
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test al, al
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4f5a0e
je 0x100050a9
call esi
test eax, eax
je 0x100050f9
mov dword [0x4f5a0e], 0x1b8
jmp 0x100050e9
call esi
test eax, eax
je 0x100050f9
mov dword [0x4f5a0e], 0x1b7
jmp 0x100050e9
test al, al
je 0x1000510d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4f5a0e
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x100050f9
mov dword [0x4f5a0e], 0x1b6
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push 0x4f5a0e
call esi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007116
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10007116
mov esp, ebp
pop ebp
ret
Function at 0x10005760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1000c040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.WINMM.dll_timeGetTime]
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, 0x66
je 0x1000578f
cmp esi, 0x46
jne 0x10005831
cmp byte [0x1000c655], 0
sete al
mov byte [0x1000c655], al
movzx eax, al
push eax
call fcn.100043d0
add esp, 4
mov dword [ebp - 8], 0x40
cmp byte [0x1000c655], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
je 0x100057f0
mov dword [ebp - 0x18], str.Modo_foto_On
call edi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
call dword [0x1000c094]
jmp 0x10005817
mov dword [ebp - 0x1c], str.Modo_foto_Off
call edi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call edi
cmp esi, 0x6f
je 0x1000592f
cmp esi, 0x4f
je 0x1000592f
cmp esi, 0x61
je 0x10005851
cmp esi, 0x41
jne 0x1000591d
mov al, byte [0x1000c654]
test al, al
jne 0x100058bb
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], str.Macro_de_Pergaminho_Ativado
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call edi
mov byte [0x1000c654], 1
jmp 0x10005968
cmp al, 1
jne 0x1000591d
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], str.Macro_de_Pergaminho_Desativado
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call edi
mov byte [0x1000c654], 0
jmp 0x10005968
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007116
mov esp, ebp
pop ebp
ret
mov eax, 0xc
mov word [ebp - 0x14], ax
mov eax, 0xe04
mov word [ebp - 0x10], ax
mov ecx, dword ds:[0x13fa9d4]
add ecx, 0xdfc
xor eax, eax
mov ax, word ds:[ecx]
mov word [ebp - 0xe], ax
lea eax, [ebp - 0x14]
push 0xc
push eax
mov eax, 0x54b02d
call eax
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.10007116
mov esp, ebp
pop ebp
ret
Function at 0x10005fd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 0x667
push esi
push edi
cmp word [ebx + 4], ax
jne 0x10006029
push 0x1770
push 0
push 0x1000cb58
call sub.VCRUNTIME140.dll_memset
push 0x1770
lea ecx, [ebx + 0xc]
push ecx
push 0x1000cb58
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebx + 0x177c]
add esp, 0x18
mov dword [0x1000c65c], ecx
jmp 0x100061ed
mov ecx, 0x1000
mov eax, 0x1000e7e0
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10006033
movsx eax, word [ebx]
test eax, eax
je 0x10006083
cmp eax, 0x1000
ja 0x1000605d
push eax
push ebx
push 0x1000e7e0
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x10006083
push 0x1000
push 0
push 0x1000e7e0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov eax, 0x367
cmp word [ebx + 4], ax
jne 0x100060a8
cmp word [ebx + 0x1e], 0x1a
jne 0x100060a8
mov ecx, dword ds:[0x13fa9d4]
add ecx, 0xdfc
xor eax, eax
mov ax, word ds:[ecx]
movzx eax, word [ebx + 4]
mov edx, 0xd1d
cmp ax, dx
jne 0x100060de
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4a571c
mov dword [ebp - 8], 0x40
call esi
mov dword [0x4a571c], 0xff00cd00
jmp 0x1000611c
mov ecx, 0xd1e
cmp ax, cx
jne 0x10006131
mov word [ebx + 4], dx
mov edi, dword [0x1000e848]
test edi, edi
je 0x100061ed
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4a571c
mov dword [ebp - 8], 0x40
call esi
mov dword [0x4a571c], edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push 0x4a571c
call esi
jmp 0x100061ed
mov ecx, 0xaf1
cmp ax, cx
jne 0x10006199
mov esi, dword [ebx + 0xa4]
lea eax, [ebx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call edi
mov dword [0x49b50b], esi
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call edi
jmp 0x100061ed
mov ecx, 0x666
cmp ax, cx
jne 0x100061db
movups xmm0, xmmword [ebx + 0xc]
movups xmmword [0x1000cb14], xmm0
movups xmm0, xmmword [ebx + 0x1c]
movups xmmword [0x1000cb24], xmm0
movups xmm0, xmmword [ebx + 0x2c]
movups xmmword [0x1000cb34], xmm0
movq xmm0, qword [ebx + 0x3c]
movq qword [0x1000cb44], xmm0
mov eax, dword [ebx + 0x44]
mov dword [0x1000cb4c], eax
jmp 0x100061ed
mov ecx, 0x370
cmp ax, cx
jne 0x100061ed
mov eax, dword [ebx + 0xc]
mov dword [0x1000cb10], eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007116
mov esp, ebp
pop ebp
ret 8
Function at 0x100065f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4c
mov eax, dword [0x1000c040]
xor eax, esp
mov dword [esp + 0x48], eax
cmp dword [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
jne 0x100066b9
mov eax, 0x20d
cmp word [esi + 4], ax
jne 0x100066b9
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
movzx eax, byte [esp + 0x1f]
xorps xmm0, xmm0
push eax
movzx eax, byte [esp + 0x22]
push eax
movzx eax, byte [esp + 0x25]
push eax
movzx eax, byte [esp + 0x28]
push eax
movzx eax, byte [esp + 0x2b]
push eax
movzx eax, byte [esp + 0x2e]
push eax
lea eax, [esp + 0x38]
movaps xmmword [esp + 0x38], xmm0
push str._02X:_02X:_02X:_02X:_02X:_02X
push eax
mov word [esp + 0x50], 0
call fcn.10001f00
lea ecx, [esp + 0x40]
add esp, 0x20
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10006678
sub ecx, edx
cmp ecx, 0xc
jge 0x1000668e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [esi + 0x54]
xorps xmm0, xmm0
lea eax, [esp + 0x20]
movups xmmword [edx], xmm0
mov ecx, eax
mov word [edx + 0x10], 0
sub edx, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x100066a5
mov dword [esi + 0x50], 0
mov ecx, dword [esp + 0x4c]
pop esi
xor ecx, esp
call fcn.10007116
mov esp, ebp
pop ebp
ret
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401028
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4751d1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push 0
mov dword [esp + 8], esi
call fcn.00462714
push str.Launcher
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0
mov dword [esi], 0x47f9e8
mov dword [esi + 0xa4], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
push 1
push 1
push eax
mov byte [esp + 0x38], 1
call fcn.004455b0
add esp, 0xc
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 0
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x401510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x475329
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::StringLength]
add esp, 4
push eax
push edi
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x402440
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x475534
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call dword [0x47f138]
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
call dword [0x47f138]
mov eax, dword [str.launcherpatch.exe.cab]
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_3]
push 0x2e
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
call sub.MFC71.DLL_AfxGetModuleState
mov edi, dword [eax + 4]
test edi, edi
je 0x40255d
mov edx, dword [esp + 8]
mov eax, dword [0x4db7c0]
push edx
push eax
lea ecx, [esp + 0x18]
push str.__s_s_
push ecx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
mov edx, dword [edi + 0x48]
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0x98]
push edx
push eax
push ecx
lea edx, [esp + 0x28]
push str.__d__d__s
push edx
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Format]
add esp, 0x24
push 5
push 0
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetString]
push eax
lea ecx, [esp + 0x1c]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetString]
push eax
mov eax, dword [esi + 0x20]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test eax, eax
jne 0x40258e
push 0x30
push str.ERROR
push str.CreateProcess_Patch_Prime
mov ecx, esi
call sub.MFC71.DLL_CWnd::MessageBoxA
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x18]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x402d20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4755c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x1c]
push edi
xor edi, edi
mov ecx, esi
mov dword [esp + 8], edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetManager]
push eax
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_1]
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x24]
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, edi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
push eax
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::Concatenate]
mov esi, dword [esp + 0x30]
add esp, 0x14
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT_2]
lea ecx, [esp + 8]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4038c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4756f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x22c
mov eax, dword [0x4cb030]
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x22c], eax
call dword [0x47f138]
lea ecx, [esp + 0x10]
mov dword [esp + 0x23c], 0
call dword [0x47f138]
mov byte [esp + 0x18], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x23c], 1
stosb byte es:[edi], al
call sub.MFC71.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::IsEmpty]
test al, al
jne 0x403a6c
push 0x5c
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::ReverseFind]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Left]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 2
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::IsEmpty]
test al, al
jne 0x403a06
push 0
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetAt]
cmp al, 0x22
jne 0x403a06
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetLength]
dec eax
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x14]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::Right]
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x240], 3
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_1]
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], 1
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
push 0x5c
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator_2]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::GetString]
push eax
mov ecx, 0x4db7c0
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
mov byte [esp + 0x120], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
push 0
push 5
lea edx, [esp + 0x128]
stosw word es:[edi], ax
push edx
push 0
stosb byte es:[edi], al
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x120]
push eax
mov ecx, 0x4db7c4
call dword [sym.imp.MFC71.DLL_ATL::CStringT::operator]
jmp 0x403a7f
push 0
push str.Error
push str.SetAppPath_Error
mov ecx, esi
call sub.MFC71.DLL_CWnd::MessageBoxA
lea ecx, [esp + 0x10]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
lea ecx, [esp + 0xc]
call dword [sym.imp.MFC71.DLL_ATL::CStringT::CStringT]
mov ecx, dword [esp + 0x234]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x22c]
call fcn.00462cf9
pop edi
pop esi
mov esp, ebp
pop ebp
ret