joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452ea8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x46ebd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, 0xffff
mov edi, ecx
cmp ax, si
jne 0x411c51
xor eax, eax
jmp 0x411dd7
mov eax, dword [edi + 0x24]
mov ecx, dword [eax]
test ecx, ecx
je 0x411c7d
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x411c7d
dec dword [eax]
mov edi, dword [edi + 0x24]
mov eax, dword [edi]
lea ecx, [eax + 2]
mov dword [edi], ecx
mov word [eax], si
mov ax, si
jmp 0x411dd7
cmp dword [edi + 0x54], 0
je 0x411dd2
mov ecx, dword [edi + 0x10]
lea edx, [edi + 0x48]
cmp dword [ecx], edx
jne 0x411ca7
mov edx, dword [edi + 0x3c]
mov eax, dword [edi + 0x40]
mov dword [ecx], edx
mov ecx, dword [edi + 0x20]
mov dword [ecx], eax
mov edx, dword [edi + 0x30]
sub eax, eax
sar eax, 1
mov dword [edx], eax
cmp dword [edi + 0x44], 0
jne 0x411cd2
mov edi, dword [edi + 0x54]
push edi
push esi
call fcn.0043a3e6
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, si
jne 0x411dd7
mov eax, ecx
jmp 0x411dd7
movzx edx, si
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x30], edx
call fcn.00412590
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x18]
lea ecx, [ecx]
mov edx, eax
cmp ebx, 0x10
jae 0x411cfc
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
mov ebx, dword [ebp - 0x1c]
add ebx, edx
push ebx
push eax
lea eax, [ebp - 0x38]
push eax
lea edx, [ebp - 0x2e]
push edx
mov edx, dword [esi + 0x14]
lea eax, [ebp - 0x30]
push eax
lea eax, [edi + 0x4c]
push eax
call edx
test eax, eax
js 0x411dca
cmp eax, 1
jg 0x411d92
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp ebx, 0x10
jae 0x411d3e
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
sub esi, ecx
je 0x411d67
cmp ebx, 0x10
jae 0x411d4d
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0043af0f
add esp, 0x10
cmp esi, eax
jne 0x411dca
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x30]
mov byte [edi + 0x4a], 1
cmp dword [ebp - 0x38], edx
jne 0x411dbc
test esi, esi
jne 0x411cf0
cmp dword [ebp - 0x1c], 0x20
jae 0x411dca
push esi
lea ebx, [esi + 8]
lea esi, [ebp - 0x2c]
call fcn.004125f0
jmp 0x411ce7
cmp eax, 3
jne 0x411dca
mov eax, dword [edi + 0x54]
mov ecx, dword [ebp - 0x30]
call fcn.00411580
movzx esi, word [ebp + 8]
test al, al
jne 0x411daf
mov esi, 0xffff
lea ecx, [ebp - 0x2c]
call fcn.00409c50
mov ax, si
jmp 0x411dd7
lea ecx, [ebp - 0x2c]
call fcn.00409c50
mov ax, word [ebp + 8]
jmp 0x411dd7
lea ecx, [ebp - 0x2c]
call fcn.00409c50
mov eax, 0xffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438b64
mov esp, ebp
pop ebp
ret 4
Function at 0x4128f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452f78
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x46ebd0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x412a8c
cmp byte [ebx + 0x4a], 0
je 0x412a8c
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffff
mov ecx, ebx
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x412a80
lea esi, [ebp - 0x2c]
call fcn.00412590
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x41296e
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
mov edx, dword [esi + 0x18]
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
call edx
sub eax, 0
je 0x4129a7
dec eax
je 0x4129ab
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x412a87
call fcn.00409c50
xor al, al
jmp 0x412a8e
mov byte [ebx + 0x4a], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x4129bb
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x4129e8
cmp edi, 0x10
jae 0x4129ca
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.0043af0f
add esp, 0x10
cmp esi, eax
jne 0x412a78
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x4a], 0
je 0x412a84
test esi, esi
jne 0x412962
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x412aa9
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x412aa9
cmp edi, esi
jae 0x412a61
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00409e50
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x412962
mov ecx, eax
cmp edi, 0x10
jae 0x412a3d
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x412a58
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x41295c
test esi, esi
jne 0x412a33
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x412a70
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x41295c
lea ecx, [ebp - 0x2c]
call fcn.00409c50
xor al, al
jmp 0x412a8e
lea ecx, [ebp - 0x2c]
call fcn.00409c50
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438b64
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.0044e666
int3
Function at 0x412ba0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4528fb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x46ebd0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0044e957
push 4
mov dword [ebp - 4], 0
call fcn.004146f2
mov edi, eax
add esp, 4
test edi, edi
je 0x412c1c
call fcn.0044f079
mov dword [edi], eax
call fcn.0044ee38
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.0044e918
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x412c12
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0044e940
jmp 0x412c1e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41ac22
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x41ac69
call fcn.00414ff6
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ac69
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x41ac85
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041a722
mov esi, eax
test edi, edi
je 0x41ac83
test ebx, ebx
je 0x41ac83
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41cf54
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x46ebd0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x41cf99
push 0x456b78
push 4
push eax
call fcn.00439421
push eax
call fcn.004043f0
add esp, 0x10
jmp 0x41cfaf
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41d02f
push edi
call fcn.0043befe
mov edi, dword [eax]
call fcn.0043befe
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0043b5e2
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0043befe
cmp dword [eax], 0
je 0x41d003
call fcn.0043befe
push dword [eax]
call fcn.00415079
pop ecx
jmp 0x41d00a
call fcn.0043befe
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x41d02f
cmp dword [ebp - 0x234], esi
jae 0x41d02f
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x41d031
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00438b64
leave
ret
Function at 0x41d570
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x46ebd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.00404050
pop ecx
cmp eax, esi
je 0x41d65a
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x41d65a
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.0043bb10
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x41d65a
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x41d65a
cmp esi, 0x14
jge 0x41d65a
push 0x10
push 0
push edi
call fcn.0043dab2
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x41d649
call fcn.0043befe
cmp dword [eax], 0x22
je 0x41d649
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.0043b603
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x41d61f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x472298], 0
jne 0x41d6e5
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x41d70e
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.0041cf54
pop ecx
pop ecx
test eax, eax
jne 0x41d710
inc edi
cmp edi, esi
jl 0x41d6eb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438b64
leave
ret 8
Function at 0x41e9bb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x41ea03
call fcn.00414ff6
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41ea03
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x41ea46
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x41ea2f
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x41ea2f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x68], 0
je 0x41ea43
mov ecx, dword [esi + 0x68]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4205a3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4205c7
cmp dword [edi + 0x74], 0
jne 0x4205c7
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00414ff6
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00420564
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x424c96
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x451482
call fcn.0043ba02
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x424cbb
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x424d0d
call fcn.0041b710
push eax
lea ecx, [ebp - 0x10]
call fcn.00401970
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043b4f7
push eax
call fcn.004043f0
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401a40
mov eax, esi
call fcn.0043bada
ret 8
Function at 0x438b64
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46ebd0]
jne 0x438b6e
repz ret
jmp fcn.0043f89e

Function at 0x4481e2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46ebd0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0043f2c6
and dword [ebp - 0x14], 0
cmp dword [0x4733c0], 0
mov dword [ebp - 0x18], eax
jne 0x448295
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44833d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45b1f4
push ebx
call edi
test eax, eax
je 0x44833d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x45b1e4
push ebx
mov dword [0x4733c0], eax
call edi
push eax
call esi
push 0x45b1d0
push ebx
mov dword [0x4733c4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4733c8], eax
call edi
push eax
call esi
mov dword [0x4733d0], eax
test eax, eax
je 0x448295
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4733cc], eax
mov eax, dword [0x4733cc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4482ee
cmp dword [0x4733d0], ecx
je 0x4482ee
push eax
call esi
push dword [0x4733d0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4482ee
test ebx, ebx
je 0x4482ee
call edi
test eax, eax
je 0x4482e5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4482e5
test byte [ebp - 8], 1
jne 0x4482ee
or dword [ebp + 0x10], 0x200000
jmp 0x448321
mov eax, dword [0x4733c4]
cmp eax, dword [ebp - 0x18]
je 0x448321
push eax
call esi
test eax, eax
je 0x448321
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x448321
mov eax, dword [0x4733c8]
cmp eax, dword [ebp - 0x18]
je 0x448321
push eax
call esi
test eax, eax
je 0x448321
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4733c0]
call esi
test eax, eax
je 0x44833d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44833f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438b64
leave
ret
Function at 0x401300
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x62c
mov eax, dword [0x427070]
xor eax, esp
mov dword [esp + 0x628], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22e]
push ecx
mov word [esp + 0x230], ax
call fcn.00401f80
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x32]
push eax
mov word [esp + 0x34], dx
call fcn.00401f80
mov eax, 0x428da0
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401356
sub eax, edx
sar eax, 1
jne 0x401398
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
push 0x428da0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x428da0
call fcn.004027d8
add esp, 8
test eax, eax
je 0x401398
xor ecx, ecx
mov word [eax], cx
mov eax, 0x428da0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4013a0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x4013d0
push 0x428da0
lea edx, [esp + 0x228]
push 0x104
push edx
call fcn.00402298
add esp, 0xc
push 0x104
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x40142a
call fcn.00401130
test eax, eax
je 0x40142a
mov ecx, eax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401400
sub ecx, esi
sar ecx, 1
cmp ecx, 0x104
jae 0x40142a
push eax
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.00402298
add esp, 0xc
lea ebx, [esp + 0x1c]
mov esi, ebx
call fcn.00401760
mov byte [esp + 0xc], 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x10]
push eax
sub esp, 0xc
mov eax, esp
lea ecx, [esp + 0x238]
mov dword [eax], ecx
mov edx, 0x104
xor esi, esi
mov dword [eax + 4], esi
lea ecx, [esp + 0x238]
mov dword [eax + 8], edx
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.004018c0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x452]
push ecx
mov word [esp + 0x454], ax
call fcn.00401f80
lea edx, [esp + 0x24c]
push edx
push 0x424a9c
push 1
mov edi, 0x104
lea esi, [esp + 0x460]
call fcn.004010e0
add esp, 0x34
mov eax, esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x428d84], eax
test eax, eax
je 0x4014f1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4014f1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x628]
xor ecx, esp
call fcn.00401aee
add esp, 0x62c
ret
push 0x424ab0
call fcn.00402a34
mov ecx, dword [esp + 0x638]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00401aee
add esp, 0x62c
ret

Function at 0x401aee
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427070]
jne 0x401af8
repz ret
jmp fcn.00402ef3
Function at 0x4025d7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x67
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push dword [0x40101e]
pop dword [0x40167f]
lea eax, [0x40194f]
mov dword [0x401687], eax
mov dword [0x401683], 0
call 0x402697
push ebx
insb byte es:[edi], dx
arpl word gs:[eax + 0x61], si
and byte [ecx + ebp*2 + 0x72], ah
arpl word gs:[edi + ebp*2 + 0x72], si
jns 0x402695
ja 0x4026df
imul esp, dword [ebx + 0x68], 0x6e6f6320
je 0x4026e5
outsb dx, byte [esi]
je 0x4026a3
ja 0x4026ee
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte [edx + 0x65], ah
and byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x402702
jae 0x402706
cmp al, byte fs:[eax]
cmp al, byte [eax]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x20c]
mov dword [0x40168b], eax
mov dword [0x40168f], 3
mov dword [0x401693], 0
push 0x40167f
call dword [sym.imp.SHELL32.DLL_SHBrowseForFolderA]
test eax, eax
je 0x40270c
add byte [ebp - 0x20b7b], cl
jmp dword [ebx + 0x40168b]
lea ebx, [0x40194f]
push ebx
push eax
call dword [sym.imp.SHELL32.DLL_SHGetPathFromIDListA]
push 0
add byte [edx], ch
push 0
push 0x1101
add dword [ecx], edx
add byte [eax], al
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
add bh, bh
adc eax, sym.imp.USER32.DLL_SendMessageA
push 0
push 0
push 0
push 0x40273c
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x40273a
inc eax
inc eax
add bl, ch
push 0x65
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
leave
ret
Function at 0x402697
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x67
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x68
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push dword [0x40101e]
pop dword [0x40167f]
lea eax, [0x40194f]
mov dword [0x401687], eax
mov dword [0x401683], 0
call 0x402697
push ebx
insb byte es:[edi], dx
arpl word gs:[eax + 0x61], si
and byte [ecx + ebp*2 + 0x72], ah
arpl word gs:[edi + ebp*2 + 0x72], si
jns 0x402695
ja 0x4026df
imul esp, dword [ebx + 0x68], 0x6e6f6320
je 0x4026e5
outsb dx, byte [esi]
je 0x4026a3
ja 0x4026ee
insb byte es:[edi], dx
insb byte es:[edi], dx
and byte [edx + 0x65], ah
and byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x402702
jae 0x402706
cmp al, byte fs:[eax]
cmp al, byte [eax]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x20c]
mov dword [0x40168b], eax
mov dword [0x40168f], 3
mov dword [0x401693], 0
push 0x40167f
call dword [sym.imp.SHELL32.DLL_SHBrowseForFolderA]
test eax, eax
je 0x40270c
add byte [ebp - 0x20b7b], cl
jmp dword [ebx + 0x40168b]
lea ebx, [0x40194f]
push ebx
push eax
call dword [sym.imp.SHELL32.DLL_SHGetPathFromIDListA]
push 0
add byte [edx], ch
push 0
push 0x1101
add dword [ecx], edx
add byte [eax], al
push dword [0x401062]
call dword [sym.imp.USER32.DLL_SendMessageA]
add bh, bh
adc eax, sym.imp.USER32.DLL_SendMessageA
push 0
push 0
push 0
push 0x40273c
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
jmp 0x40273a
inc eax
inc eax
add bl, ch
push 0x65
push 0x65
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
push 0x66
push dword [0x40101e]
call dword [sym.imp.USER32.DLL_GetDlgItem]
push 1
push eax
call dword [sym.imp.USER32.DLL_EnableWindow]
leave
ret