joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fd74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48fef5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ae54c], 0
jne 0x48fed2
push 0x4afc5c
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x48fecb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4ae54c], 0
jne 0x48feb3
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e2c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ca0
push eax
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.00408a7c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x48ff0c
call fcn.00409fd4
mov eax, dword [ebp - 0xc]
call fcn.00404ca0
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueA
test eax, eax
jne 0x48fe34
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404e2c
jmp 0x48fe6b
lea eax, [ebp - 8]
mov edx, 0x48ff2c
call fcn.00404878
xor eax, eax
push ebp
push 0x48fe61
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00468d60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48fe6b
mov eax, dword [ebp - 8]
call fcn.00404ca0
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4ae54c], eax
cmp dword [0x4ae54c], 0
jne 0x48fe9e
mov ecx, dword [0x4aea60]
mov dl, 1
mov eax, dword [0x407e00]
call fcn.0040d048
call fcn.0040421c
push 0x48ff38
mov eax, dword [0x4ae54c]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4afc74], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fed2
push 0x4afc5c
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48fefc
lea eax, [ebp - 0x18]
call fcn.004047e0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404804
ret
Function at 0x4a65f8
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, eax
cmp byte [ebx + 0x87], 0
je 0x4a6633
cmp dword [ebx + 0x5c], 0
je 0x4a6633
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb8]
mov edx, eax
mov eax, esi
call fcn.0049ea9c
xor eax, eax
mov dword [ebx + 0x5c], eax
mov byte [ebx + 0x87], 0
cmp dword [ebx + 0x5c], 0
jne 0x4a677e
cmp dword [ebx + 0x7c], 0
jne 0x4a6659
mov dl, 1
mov eax, dword [0x41b584]
call fcn.0040395c
mov dword [ebx + 0x7c], eax
cmp dword [ebx + 0xc], 0
je 0x4a6757
mov eax, dword [ebx + 0xc]
push eax
mov al, byte [0x4a6784]
push eax
mov al, byte [0x4a6788]
push eax
push 0
mov eax, dword [ebx + 0x7c]
push eax
mov eax, dword [0x4aea88]
push eax
mov ecx, dword [ebx + 0x68]
mov dl, 1
mov eax, dword [0x47fb38]
call fcn.004822b4
mov dword [ebp - 4], eax
xor edx, edx
push ebp
push 0x4a6750
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebx + 0x5c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0049ea9c
lea eax, [ebx + 0x10]
push eax
mov eax, dword [ebx + 0x5c]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xc0]
mov edx, eax
mov eax, esi
call fcn.0049ea9c
mov eax, dword [ebx + 0x40]
push eax
lea eax, [ebx + 0x70]
mov ecx, 1
mov edx, dword [0x49c298]
call fcn.00405ce0
add esp, 4
mov eax, dword [ebx + 0x30]
cmp eax, 0x1a
jge 0x4a6723
mov edx, dword [0x4aecb8]
mov al, byte [edx + eax]
mov byte [ebx + 0x74], al
jmp 0x4a6734
cmp eax, 0x1007
jne 0x4a6730
mov byte [ebx + 0x74], 0x18
jmp 0x4a6734
mov byte [ebx + 0x74], 0
mov eax, dword [ebx + 0x40]
mov dword [ebx + 0x78], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a677e
mov eax, dword [ebp - 4]
call fcn.0040398c
ret
lea eax, [ebx + 0x5c]
push eax
push 0
push 0
mov eax, dword [ebx + 0x64]
push eax
mov esi, dword [ebx + 0x68]
mov eax, dword [esi + 0x1a8]
push eax
mov eax, dword [eax]
call dword [eax + 0xb4]
mov edx, eax
mov eax, esi
call fcn.0049ea9c
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x402407
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4024cb
push dword [esi + 0x878]
lea ecx, [ebp - 4]
push 0x20
pop edx
call fcn.004023e0
add esp, 4
push dword [esi + 0x87c]
mov edi, eax
push 2
pop edx
call fcn.004023e0
add esp, 4
push dword [esi + 0x884]
or edi, eax
push 4
pop edx
call fcn.004023e0
add esp, 4
push dword [esi + 0x880]
xor edx, edx
inc edx
or edi, eax
call fcn.004023e0
add esp, 4
push dword [esi + 0x888]
mov edx, 0x100
or edi, eax
call fcn.004023e0
add esp, 4
or eax, edi
je 0x4024cb
push dword [ebp + 8]
mov esi, 0x4142d0
push str.Setting_the_attributes_of__s
mov ecx, esi
call fcn.0040a89c
pop ecx
pop ecx
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov ebx, eax
test ebx, ebx
jne 0x4024cb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
call fcn.0040a8f8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4024cb
mov dword [eax], edi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x403575
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
mov esi, 0x208
xor ebx, ebx
push esi
lea eax, [ebp - 0x41e]
push ebx
push eax
mov word [ebp - 0x420], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x20e]
push ebx
push eax
mov word [ebp - 0x210], bx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x25
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x4035df
push 0x104
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
jmp 0x4035f3
push dword [ebp + 0xc]
mov eax, 0x104
lea edi, [ebp - 0x210]
call fcn.004060c1
pop ecx
lea eax, [ebp - 0x210]
push eax
lea esi, [ebp - 0x420]
call fcn.0040631d
pop ecx
push ebx
lea ecx, [ebp - 0x210]
call fcn.004062ff
mov ecx, dword [ebp + 8]
push eax
mov eax, esi
push eax
push dword [ebp + 0xc]
call fcn.0040347c
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4053dc
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
push esi
push edi
jne 0x4053f3
xor eax, eax
jmp 0x4054d5
mov eax, dword [ebp + 0xc]
call fcn.0040533f
test eax, eax
je 0x4053ec
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4054d2
push 7
pop ecx
mov byte [ebp - 0x3c], bl
xor eax, eax
lea edi, [ebp - 0x3b]
rep stosd dword es:[edi], eax
push ebx
stosw word es:[edi], ax
push ebx
push dword [ebp + 0x10]
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push esi
call edi
push 0x13
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.00406ae9
add esp, 0xc
test eax, eax
je 0x4054cb
push 0x13
push dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4054cb
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.00405546
push ebx
push ebx
push dword [ebp + 0x10]
push esi
call edi
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push 0x13
lea eax, [ebp - 0x3c]
push eax
push esi
call fcn.00406b08
add esp, 0xc
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x405e56
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
leave
ret
Function at 0x405fdd
Capabilities:
Get file size
Read file on windows
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_EmptyClipboard]
push dword [ebp + 8]
call fcn.00405e24
cmp eax, 0xffffffff
pop ecx
mov dword [ebp - 8], eax
je 0x40606f
push ebx
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
lea eax, [esi + 2]
push eax
push 0x2000
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x406058
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
mov edi, eax
lea eax, [ebp - 0xc]
push eax
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x406058
shr esi, 1
and word [edi + esi*2], 0
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
jmp 0x406061
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
jmp 0x406078
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x406248
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x406445
Capabilities:
Get common file path

Disassembly:
cmp word [0x4152d8], 0
push esi
mov esi, 0x4152d8
jne 0x406466
push 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov dword [0x4154e4], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x4154e4]
pop ecx
pop ecx
pop esi
ret

Function at 0x406910
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x410484
push eax
push eax
push dword [esp + 0x14]
push 0x4110e8
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x406dd3
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
push ebx
push esi
push edi
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406e39
cmp word [ebp - 0x224], 0x2e
jne 0x406e1f
cmp word [ebp - 0x222], si
jne 0x406e1f
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x406df8
jmp 0x406e32
mov edi, dword [ebp + 0xc]
mov ecx, 0x94
lea esi, [ebp - 0x250]
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4076fc
Capabilities:
Enumerate files on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi]
cmp eax, 0xffffffff
push edi
jne 0x407736
lea edi, [esi + 4]
mov ecx, edi
call fcn.004062ff
mov dword [esi + 0x28c], eax
lea eax, [esi + 0x290]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [esi], eax
mov dword [esp + 8], ecx
jmp 0x407751
lea ecx, [esi + 0x290]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov dword [esp + 8], eax
jne 0x407758
call fcn.004077a2
cmp dword [esp + 8], 0
je 0x40779a
push ebx
lea edi, [esi + 0x4e0]
lea ebx, [esi + 0x2bc]
push ebp
add esi, 0x768
push esi
call sub.msvcrt.dll_wcslen
push ebx
mov ebp, eax
call sub.msvcrt.dll_wcslen
lea eax, [eax + ebp + 1]
cmp eax, 0x143
pop ecx
pop ecx
jae 0x407794
push ebx
push esi
mov eax, edi
call fcn.004063cb
pop ecx
pop ecx
jmp 0x407798
and word [edi], 0
pop ebp
pop ebx
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret

Function at 0x407f08
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x414c20
push dword [esp + 0xc]
push esi
push 0x410484
push dword [esp + 0x14]
push 0x414e30
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x407f2d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040f2e0
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x414c20
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x410484
push dword [ebp + 8]
push 0x414e30
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x407f9c
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x407fa0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040f2e0
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x414c20
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x410484
push dword [ebp + 8]
mov esi, 0x414e30
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x408007
cmp dword [ebp + 0x10], 0
jne 0x408007
xor eax, eax
jmp 0x408015
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret
Function at 0x408368
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00406248
test eax, eax
pop ecx
je 0x4083ef
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x414c20
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x414e30
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x411228
push esi
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x414eb8
mov dword [0x414eb4], eax
call fcn.00407f08
push 0x3f
push str.TranslatorName
mov esi, 0x414f38
call fcn.00407f08
push 0xff
push str.TranslatorURL
mov esi, 0x414fb8
call fcn.00407f08
add esp, 0x18
pop edi
pop esi
ret

Function at 0x4094ea
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040f2e0
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x40a2de
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push ebp
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push esi
push edi
mov esi, eax
xor edi, edi
cmp dword [esi + 0x2a8], edi
je 0x40a3a4
cmp dword [esi + 0x2b0], edi
je 0x40a375
push 0x2b0
lea eax, [esp + 0x230]
push edi
push eax
mov dword [esp + 0x234], edi
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push edi
push eax
mov word [esp + 0x34], di
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push edi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x29c], eax
push eax
jmp 0x40a395
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
push edi
push eax
mov dword [esi + 0x29c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x29c]
push 1
push 0x1003
push dword [esi + 0x294]
call ebx
cmp dword [esi + 0x2ac], edi
je 0x40a3da
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebp
push edi
push eax
mov dword [esi + 0x2a0], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2a0]
push edi
push 0x1003
push dword [esi + 0x294]
call ebx
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push edi
mov dword [esi + 0x298], eax
call ebp
push 0x1000
push 0x10
push 0x10
push edi
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push edi
mov dword [esp + 0x14], eax
call ebp
push 0x1000
push 0x10
push 0x10
push edi
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push edi
push dword [esi + 0x298]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x298]
call ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x298]
call ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x298]
mov esi, dword [esi + 0x294]
push eax
push edi
push 0x1208
push esi
call fcn.00403a8d
pop ecx
push eax
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret
Function at 0x40a723
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, eax
mov dword [ebp - 4], edi
call fcn.0040a7cc
cmp dword [ebp + 0xc], edi
je 0x40a791
push edi
push edi
push 4
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
mov dword [esi], 1
je 0x40a7ba
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
test eax, eax
push 2
jne 0x40a775
push 0x411560
push dword [esi + 4]
jmp 0x40a7b0
push edi
push edi
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push 0x4115f0
push dword [esi + 4]
call fcn.00405e56
pop ecx
pop ecx
jmp 0x40a7c3
push dword [ebp + 8]
call fcn.00405e3d
cmp eax, 0xffffffff
pop ecx
mov dword [esi + 4], eax
mov dword [esi], 1
je 0x40a7ba
push 2
push 0x411560
push eax
call fcn.00406b08
add esp, 0xc
jmp 0x40a7c3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x40aeeb
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.0040f2e0
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x6b0]
push str._LogFile
call fcn.004075fa
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40af36
mov esi, dword [edi + 0x6b0]
push str._LogFileAppend
call fcn.004075fa
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40af36
mov dword [ebp - 4], 1
test ebx, ebx
jl 0x40b047
and word [ebp - 0x804], 0
mov esi, 0x7fe
push esi
lea eax, [ebp - 0x802]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x804]
push eax
mov eax, dword [edi + 0x6b0]
lea ecx, [ebx + 1]
call fcn.004075ea
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x804]
push 0x5c
push eax
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
jne 0x40b033
xor edi, edi
push esi
lea eax, [ebp - 0x1002]
push edi
push eax
mov word [ebp - 0x1004], di
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x1802]
push edi
push eax
mov word [ebp - 0x1804], di
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
call sub.msvcrt.dll_wcscpy
add esp, 0x20
lea eax, [ebp - 0x1804]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
lea eax, [ebp - 0x1804]
push eax
call sub.msvcrt.dll_wcslen
mov ebx, eax
lea eax, [ebp - 0x1004]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [ebx + eax + 1]
cmp eax, esi
pop ecx
pop ecx
jae 0x40b02c
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1804]
push eax
lea eax, [ebp - 0x804]
call fcn.004063cb
pop ecx
pop ecx
jmp 0x40b033
mov word [ebp - 0x804], di
push dword [ebp - 4]
lea eax, [ebp - 0x804]
push eax
mov eax, 0x4142d0
call fcn.0040a723
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b6c6
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
sub eax, 0x9c61
push ebx
push esi
push edi
mov esi, ecx
je 0x40b880
sub eax, 0xa
je 0x40b7f0
sub eax, 4
jne 0x40b88d
mov ebx, dword [ebp + 8]
push 0x7fe
push eax
mov dword [ebx + 0x268], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x874], ax
lea eax, [ebp - 0x872]
push eax
mov dword [ebp - 0xc], 0x100
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x874]
push eax
mov eax, dword [esi + 0x690]
add eax, 0xad4
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x874]
push eax
lea edi, [ebp - 0x1c]
call fcn.004071e5
add ebx, 0x3c
push ebx
mov ebx, edi
call fcn.00407298
push 0x40
xor ebx, ebx
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x690]
mov dword [ebp - 0x74], 0x44
mov dword [ebp - 0x48], 1
mov ax, word [eax + 0x12d4]
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, ebx
jne 0x40b7a8
mov eax, 0x410484
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x74]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
je 0x40b7d4
push dword [ebp - 0x2c]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
call esi
push dword [ebp - 0x28]
call esi
jmp 0x40b7e3
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x268], eax
lea esi, [ebp - 0x1c]
call fcn.004071c0
jmp 0x40b88d
mov ecx, dword [ebp + 8]
and dword [ebp - 8], 0
lea edi, [ecx + 0x268]
and dword [edi], 0
mov edx, dword [esi + 0x6a8]
mov eax, dword [esi + 0x690]
push edi
mov ebx, 0x22c
push edx
add eax, ebx
add ecx, 0x3c
push eax
push ecx
call fcn.00402894
add esp, 0x10
test eax, eax
je 0x40b82d
mov dword [ebp - 8], 1
mov eax, dword [edi]
test eax, eax
je 0x40b839
mov dword [esi + 0x6ac], eax
and dword [edi], 0
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x690]
add ecx, 0x3c
push edi
add eax, ebx
push ecx
call fcn.00402407
test eax, eax
pop ecx
pop ecx
je 0x40b85e
mov dword [ebp - 8], 1
mov edi, dword [edi]
test edi, edi
je 0x40b86a
mov dword [esi + 0x6ac], edi
cmp dword [ebp - 8], 0
je 0x40b878
mov eax, dword [ebp + 8]
call fcn.00402fbf
inc dword [esi + 0x6a8]
jmp 0x40b88d
mov eax, dword [ebp + 8]
mov dword [eax + 0x260], 1
pop edi
pop esi
pop ebx
leave
ret 4