joyce8/EMBER2024-capa huggingface dataset:
Function at 0x84ece0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x885028
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 0x50]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 8]
mov ebp, dword [esi + 0xc]
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 8]
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], eax
cmp dword [ecx + 4], ebp
jl 0x84ee27
jg 0x84ed45
mov ecx, dword [ecx]
cmp ecx, eax
jb 0x84ee27
cmp dword [esi], 0
je 0x84ee27
cmp dword [esi + 0x1c], 1
jne 0x84edbb
mov edx, dword [esi + 0x18]
push 0
push 1
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov eax, dword [esi + 0x10]
add dword [esi + 8], eax
mov ecx, dword [esi + 0x14]
lea eax, [edi + 0x50]
adc dword [esi + 0xc], ecx
push eax
lea esi, [edi + 8]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
mov ecx, dword [edi + 8]
mov edx, dword [eax + 0xc]
cmp edx, dword [ecx + 0xc]
jg 0x84eda8
jl 0x84ed92
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 8]
ja 0x84eda8
mov esi, eax
mov eax, dword [eax]
mov edx, dword [eax + 0xc]
cmp edx, dword [ecx + 0xc]
jl 0x84ed92
jg 0x84eda8
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 8]
jbe 0x84ed92
cmp esi, ecx
je 0x84edb5
mov edx, dword [ecx]
mov dword [edi + 8], edx
mov dword [esi], ecx
mov dword [ecx], eax
lea eax, [edi + 0x50]
push eax
jmp 0x84edf7
mov eax, dword [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
dec dword [edi + 0x4c]
mov esi, dword [edi + 8]
mov ecx, dword [esi]
mov dword [edi + 8], ecx
cmp dword [edi + 0x70], 5
jb 0x84ede1
push esi
call fcn.007c8563
add esp, 4
jmp 0x84edfd
lea ebp, [edi + 0x50]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [edi + 0x6c]
mov dword [esi], edx
inc dword [edi + 0x70]
mov dword [edi + 0x6c], esi
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [edi + 8]
mov ebp, dword [esi + 0xc]
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
cmp dword [ecx + 4], ebp
jg 0x84ed45
jl 0x84ee27
mov eax, ecx
mov ecx, dword [eax]
cmp ecx, dword [esp + 0x18]
jae 0x84ed45
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x18]
mov edx, ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x8516e0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x8853c1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x30]
mov dword [edi], 0
lea ebx, [esi + 0x128]
mov ebp, 1
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x148], 0
mov dword [esp + 0x28], ebp
je 0x85177d
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x140]
call fcn.00851650
push eax
mov ecx, edi
call fcn.0084fd20
mov eax, dword [esp + 0x18]
mov ebp, eax
test eax, eax
je 0x85177d
mov eax, dword [eax + 0x18]
test eax, eax
je 0x851774
push eax
call fcn.00803053
add esp, 4
push ebp
call fcn.007c8563
add esp, 4
cmp dword [esi + 0x148], 0x64
jae 0x851793
mov ecx, dword [esi + 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x85adb0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x885f9c
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push 0
push eax
lea edi, [esi + 0x54]
push edi
push ecx
push edx
mov ecx, esi
call fcn.005d8d70
push edi
mov dword [esp + 0x24], 0
mov dword [esi], fcn.0085ab40
mov dword [esi + 0xc], 0x48f4f4
mov dword [esi + 0x10], 0x48f4d8
mov dword [esi + 0x50], 0x48f4c4
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [esp + 0x30]
lea ebx, [esi + 0x6c]
push eax
mov ecx, ebx
mov byte [esp + 0x24], 1
call fcn.0085b1b0
mov ecx, dword [esp + 0x34]
push 1
push 0x429c04
push ecx
push edi
push esi
push 0
lea ecx, [esi + 0xf8]
mov byte [esp + 0x38], 2
call fcn.005d9060
mov dword [esi + 0xf0], 0x48f494
mov dword [esi + 0xf8], 0x48f458
mov dword [esi + 0x104], 0x48f40c
mov dword [esi + 0x108], 0x48f3f4
mov dword [esi + 0x190], esi
mov dword [esi + 0x194], ebx
lea ecx, [esi + 0x1a0]
mov byte [esp + 0x20], 3
call fcn.005d9aa0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14

Function at 0x85b6c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x80], 0
jne 0x85b70f
mov eax, dword [esi + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 0
push esi
push 0x85b400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x80], eax
test eax, eax
jne 0x85b70f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x85b711
and eax, 0xffff
or eax, 0x80070000
pop esi
pop ecx
ret
xor eax, eax
pop esi
pop ecx
ret
Function at 0x85cf50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x886254
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
lea edi, [esi + 0x4c]
mov dword [esi + 4], edi
push 2
lea ecx, [esi + 0x14]
mov dword [esp + 0x20], 0
mov dword [esi], 0x48f7dc
call fcn.0085d920
push 2
lea ecx, [esi + 0x30]
mov byte [esp + 0x20], 1
call fcn.0085d920
push 2
mov ecx, edi
mov byte [esp + 0x20], 2
call fcn.0085d920
fldz
push 0x18
fstp dword [esi + 0xc]
mov byte [esp + 0x20], 3
mov dword [esi + 0x10], 2
mov dword [esi + 0x68], 1
call fcn.007c8529
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c], 4
test eax, eax
je 0x85cff0
push 0x20
mov ecx, eax
call fcn.0085d690
jmp 0x85cff2
xor eax, eax
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x433004]
jne 0x40100a
repz ret
jmp fcn.004015a1

Function at 0x409543
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004031c9
and dword [ebp - 4], 0
cmp dword [0x435284], 0
mov ebx, eax
jne 0x4095f4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4096a5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4096a5
push eax
call fcn.00403157
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435284], eax
call esi
push eax
call fcn.00403157
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435288], eax
call esi
push eax
call fcn.00403157
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43528c], eax
call esi
push eax
call fcn.00403157
pop ecx
mov dword [0x435294], eax
test eax, eax
je 0x4095f4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403157
pop ecx
mov dword [0x435290], eax
mov eax, dword [0x435290]
cmp eax, ebx
je 0x40964c
cmp dword [0x435294], ebx
je 0x40964c
push eax
call fcn.004031d2
push dword [0x435294]
mov esi, eax
call fcn.004031d2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40964c
test edi, edi
je 0x40964c
call esi
test eax, eax
je 0x409643
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409643
test byte [ebp - 0xc], 1
jne 0x40964c
or dword [ebp + 0x10], 0x200000
jmp 0x409685
mov eax, dword [0x435288]
cmp eax, ebx
je 0x409685
push eax
call fcn.004031d2
pop ecx
test eax, eax
je 0x409685
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409685
mov eax, dword [0x43528c]
cmp eax, ebx
je 0x409685
push eax
call fcn.004031d2
pop ecx
test eax, eax
je 0x409685
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435284]
call fcn.004031d2
pop ecx
test eax, eax
je 0x4096a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4096a7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401030
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x414
mov eax, dword [0x4ce028]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
lea edx, [esp + 4]
push edx
push 1
push 0
mov dword [esp + 0xc], 0
mov eax, dword [eax + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010b9
push 0x401
push eax
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0x401
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
push ecx
jmp 0x4010ba
push ebx
mov ecx, esi
call dword [0x4bd7a0]
mov ecx, dword [esp + 0x410]
xor ecx, esp
mov eax, esi
call fcn.0042bebe
add esp, 0x414
ret 4

Function at 0x4010e0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
mov eax, dword [edx + 4]
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0x4bd9a4
push 0
push str.SOFTWARENewGenRebirthEdu
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401140
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp]
add eax, eax
push eax
push esi
push 1
push 0
push str.RAExamDBZIP
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret

Function at 0x401150
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
mov eax, dword [edx + 4]
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0x4bd9a4
push 0
push str.SOFTWARENewGenRebirthEdu
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4011ab
mov edx, dword [esp]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push eax
push 0x4bea64
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret 4
Function at 0x402830
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4bc3b9
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
push esi
push edi
mov eax, dword [0x4ce028]
xor eax, esp
push eax
lea eax, [esp + 0xe0]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 8
mov dword [esp + 0x1c], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call sub.mfc90u.dll_CWinApp::InitInstance
call sub.mfc90u.dll_AfxOleInit
push 0
call sub.mfc90u.dll_AfxEnableControlContainer
add esp, 4
push 0x4be38c
mov ecx, esi
call sub.mfc90u.dll_CWinApp::SetRegistryKey
push str.Rebirth
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40291a
lea ecx, [esp + 0x10]
call dword [0x4bd7a8]
push str.KcLep
lea ecx, [esp + 0x14]
push str._s___._r_n_____.
push ecx
mov dword [esp + 0xf4], 0
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
mov edx, dword [esp + 0x1c]
add esp, 0xc
push 0
push 0
push edx
call sub.mfc90u.dll_AfxMessageBox
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004029a0
test eax, eax
jne 0x40294d
push eax
push eax
push str.KcLep______._n_nKcLep______n__.
call sub.mfc90u.dll_AfxMessageBox
xor eax, eax
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x1c]
push eax
call fcn.00403110
lea ecx, [esp + 0x1c]
mov dword [esp + 0xe8], 1
mov dword [esi + 0x20], ecx
call sub.mfc90u.dll_CDialog::DoModal
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0xec], 0xffffffff
call fcn.00403220
xor eax, eax
mov ecx, dword [esp + 0xe0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402ae0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x4b9e19
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ce028]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x2c]
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x402bd4
push esi
call sub.mfc90u.dll_new__
mov edi, eax
add esp, 4
cmp edi, ebx
je 0x402bcb
mov ecx, dword [esp + 0x2c]
push edi
push esi
push ebx
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x402bcb
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x4be568
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x402bcb
mov eax, dword [esp + 0x14]
movzx esi, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx ebp, word [eax + 0xe]
xor ecx, ecx
cmp cx, si
jae 0x402bcb
push ecx
push 0x4be56c
lea ecx, [esp + 0x34]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Find_1]
test eax, eax
jl 0x402bcb
mov edx, 3
cmp dx, si
ja 0x402bb4
mov eax, 8
cmp ax, bx
ja 0x402bb4
mov ecx, 5
cmp cx, bp
jbe 0x402bcb
push edi
call sub.mfc90u.dll_delete
add esp, 4
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
xor eax, eax
jmp 0x402be3
push edi
call sub.mfc90u.dll_delete
add esp, 4
lea ecx, [esp + 0x2c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4

Function at 0x403030
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b9d8a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4ce028]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov ecx, esi
mov dword [esp + 0xc], 0
call dword [0x4bd7a8]
mov ecx, dword [esp + 0x24]
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0x400
push ecx
push 0
mov dword [esp + 0x30], 0
push 0x1300
mov dword [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov edx, dword [esp + 8]
push edx
push 0x4be694
push esi
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
mov eax, dword [esp + 0x14]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x403ca0
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b9d37
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4ce028]
xor eax, esp
mov dword [esp + 0x224], eax
push ebp
push esi
push edi
mov eax, dword [0x4ce028]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x10]
call dword [0x4bd7a8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x240], 0
call sub.mfc90u.dll_CFileFind::CFileFind
push 0
push 0x10
lea edx, [esp + 0x34]
push edx
mov byte [esp + 0x24c], 1
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
call esi
mov edi, dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
push str._sKcLep
push ecx
call edi
mov edx, dword [esp + 0x1c]
add esp, 0xc
push 0
push edx
lea ecx, [esp + 0x1c]
call sub.mfc90u.dll_CFileFind::FindFile
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x403d68
mov eax, dword [esp + 0x10]
push eax
call ebp
push 0
push 0x19
lea ecx, [esp + 0x34]
push ecx
push 0
call esi
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x14]
push str._sKcLep
push eax
call edi
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0
push ecx
lea ecx, [esp + 0x1c]
call sub.mfc90u.dll_CFileFind::FindFile
test eax, eax
je 0x403da4
mov edx, dword [esp + 0x10]
push edx
call ebp
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [esp + 0x14]
mov byte [esp + 0x240], 0
call fcn.0042baa8
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0042bebe
add esp, 0x234
ret
Function at 0x404210
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4ce028]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x208
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x104
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0x208]
mov ax, word [esp]
xor ecx, esp
call fcn.0042bebe
add esp, 0x20c
ret

Function at 0x404320
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ba229
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ce028]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.Rebirth
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
cmp eax, 0xb7
jne 0x4043d7
mov ebp, dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
lea ecx, [ecx]
lea ecx, [esp + 0x14]
call dword [0x4bd7a8]
push str.KcLep
lea eax, [esp + 0x18]
push 0x4bebf8
push eax
mov dword [esp + 0x2c], 0
call ebp
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0
push 0
push ecx
call sub.mfc90u.dll_AfxMessageBox
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
test esi, esi
je 0x4043c1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Rebirth
push 0
push 0
call edi
mov esi, eax
call ebx
cmp eax, 0xb7
je 0x404370
test esi, esi
je 0x4043e2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x404800
Capabilities:
Copy file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4ba4c2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ce028]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea ecx, [esp + 0x18]
call dword [0x4bd7a8]
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
call dword [0x4bd7a8]
push str.ExamSave.exe
push str.KcLepExamDB
mov byte [esp + 0x2c], 1
call fcn.00404210
mov esi, dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
movzx eax, ax
push eax
lea ecx, [esp + 0x24]
push str._c:_s_s
push ecx
call esi
add esp, 0x14
push str.ExamSave.exe
push str.KcLep
call fcn.00404210
movzx edx, ax
push edx
lea eax, [esp + 0x20]
push str._c:_s_s
push eax
call esi
mov ecx, dword [esp + 0x2c]
mov edi, dword [sym.imp.MSVCR90.dll__waccess]
push 0
push ecx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x4048de
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
push edx
push eax
call ebx
test eax, eax
jne 0x4048de
mov ecx, dword [esp + 0x14]
push 0x80
push ecx
call ebp
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
push edx
push eax
call ebx
push str.KcLepExam.exe
push str.KcLepExamDB
call fcn.00404210
movzx ecx, ax
push ecx
lea edx, [esp + 0x24]
push str._c:_s_s
push edx
call esi
add esp, 0x14
push str.KcLepExam.exe
push str.KcLep
call fcn.00404210
movzx eax, ax
push eax
lea ecx, [esp + 0x20]
push str._c:_s_s
push ecx
call esi
mov edx, dword [esp + 0x2c]
push 0
push edx
call edi
add esp, 0x1c
cmp eax, 0xffffffff
je 0x40495c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call ebx
test eax, eax
jne 0x40495c
mov edx, dword [esp + 0x14]
push 0x80
push edx
call ebp
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ecx
call ebx
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x405790
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0xc
mov eax, dword [0x4ce028]
xor eax, esp
mov dword [esp + 8], eax
push esi
lea eax, [esp + 4]
push eax
push 0x4bd94c
push 1
push 0
push 0x4bd95c
mov esi, ecx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40581d
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x4bd9a4
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0
push esi
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x4bd96c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jge 0x405832
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, 0x80004005
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0042bebe
add esp, 0xc
ret
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push ebx
push eax
call edx
mov esi, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0042bebe
add esp, 0xc
ret