joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4015d0
Capabilities:
Capture screenshot

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff8
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
push ebx
sub esp, 0x48
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 4]
mov ebx, dword [edi]
mov dword [ebp - 0x28], eax
cmp ecx, 0x3e7
jle 0x4016b0
mov eax, 0xa
mov edx, 0xa
mov dword [ebp - 0x18], 0xa
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [0x408038]
mov dword [esp], esi
lea edi, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.gdi32.dll_SelectObject]
mov dword [ebp - 0x30], eax
call eax
mov dword [ebp - 0x2c], eax
mov eax, ebx
sub esp, 8
mov ebx, edi
mov edi, eax
mov dword [esp + 0x20], 0xcc0020
imul eax, dword [ebx], 0x17
add ebx, 4
mov dword [esp + 4], edi
add edi, 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x10], 0x17
mov dword [esp + 0xc], 0xc
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_BitBlt]
lea eax, [ebp - 0x14]
sub esp, 0x24
cmp eax, ebx
jne 0x401639
mov eax, dword [ebp - 0x2c]
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
call eax
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
test ecx, ecx
js 0x4016f8
mov eax, ecx
mov edx, 0x51eb851f
imul edx
mov eax, ecx
sar eax, 0x1f
sar edx, 5
sub edx, eax
imul eax, edx, 0x64
sub ecx, eax
mov edi, ecx
mov eax, ecx
mov dword [ebp - 0x20], edx
mov edx, 0x66666667
sar ecx, 0x1f
imul edx
sar edx, 2
sub edx, ecx
lea eax, [edx + edx*4]
mov dword [ebp - 0x1c], edx
add eax, eax
sub edi, eax
mov dword [ebp - 0x18], edi
jmp 0x401614
neg ecx
mov edx, 0xa
mov edi, ecx
jmp 0x4016ce
Function at 0x403dc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x403e18
cmp byte [esi + ebx - 1], 0xa
je 0x403dec
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x408f44], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x4048e0
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x404950
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x4049db
cmp ax, 9
je 0x4049c8
cmp ax, 0x20
je 0x4049c8
mov dword [ebp - 0x54], 0
xor edi, edi
nop
cmp ax, 0x5c
je 0x404a30
cmp ax, 0x22
je 0x404a40
mov dword [ebp - 0x54], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x4049db
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x404980
test edi, 1
jne 0x404980
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x4049c8
cmp ax, 0x20
je 0x4049c8
lea eax, [ebp - 0x50]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x24], 1
je 0x404a58
movzx esi, word [ebp - 0x20]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x54], 1
jmp 0x40499b
and dword [ebp - 0x54], 1
jne 0x404994
xor edi, 1
jmp 0x40499b
mov eax, 1
mov esi, 1
mov word [ebp - 0x20], ax
jmp 0x4049f4
Function at 0x40633a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x40635e
xor eax, eax
test eax, eax
je 0x406370
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406370
xor ecx, ecx
jmp 0x406373
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x40645f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x448e04], 0
push esi
jne 0x406496
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406470
mov dword [ecx*4 + 0x448e00], eax
inc ecx
cmp ecx, 0x100
jl 0x40646b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4064c7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x448e00]
xor eax, esi
inc ecx
dec edx
jne 0x4064a9
pop edi
not eax
pop esi
ret 0xc

Function at 0xae1b6d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae1b6d
ret

Function at 0x40fbde
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
mov byte [ebp - 0x1c], 0x49
cmp byte [ebp + 0xc], al
mov dword [ebp - 4], eax
mov byte [ebp - 0x1b], 0x6e
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x6c
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], al
je 0x40fc44
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 0xd], 0x69
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0xb], 0x61
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], al
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00402e7f
mov eax, dword [ebp + 8]
leave
ret 8

Function at 0x4297c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x429803
mov eax, dword [ecx + 0x74]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x4297e1
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x51dea0
Capabilities:
Terminate process

Disassembly:
test byte [0x5cc2e8], 0x20
jne 0x51debe
vmovq xmm0, xmm0
vcvttpd2qq xmm0, xmm0
vmovd eax, xmm0
vpextrd edx, xmm0, 1
ret
mov ecx, esp
add esp, 0xfffffff8
and esp, 0xfffffff8
movsd qword [esp], xmm0
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov esp, ecx
btr edx, 0x1f
sbb ecx, ecx
cmp edx, 0x41e00000
jae 0x51df1e
cvttsd2si eax, xmm0
cdq
ret
mov ecx, edx
bts edx, 0x14
shr ecx, 0x14
and edx, 0x1fffff
sub ecx, 0x433
jge 0x51df18
neg ecx
push ebx
xor ebx, ebx
shrd ebx, eax, cl
je 0x51df11
cvttss2si ebx, dword [0x532bec]
pop ebx
shrd eax, edx, cl
shr edx, cl
ret
shld edx, eax, cl
shl eax, cl
ret
cmp edx, 0x43e00000
jae 0x51df37
test ecx, ecx
je 0x51dee8
call 0x51dee8
neg eax
adc edx, 0
neg edx
ret
jecxz 0x51df3f
ja 0x51df3f
test eax, eax
je 0x51df47
cvttss2si ecx, dword [0x532be8]
mov edx, SysReAllocStringLen
xor eax, eax
ret

Function at 0x51e623
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x51e662
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x51e662
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x51e662
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x51e662
cmp dword [ecx + 0x74], 0xe
jbe 0x51e662
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x52adc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x52aded
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x52aded
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call fcn.1000106f
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..retplne
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x42232adc
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..reloc
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x550a6599
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401050
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, ecx
or eax, 0xffffffff
mov cl, byte [edx]
test cl, cl
je 0x4010f6
nop
movzx ecx, cl
lea edx, [edx + 1]
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x401060
not eax
ret
Function at 0x40b3a0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1094
call fcn.00485230
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0x1000
mov dword [ebp - 0x1094], eax
lea eax, [ebp - 0x1008]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1008]
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
push 0x800
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x1008]
push edi
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
mov dword [ebp - 0x1088], 0
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1044], 0x6a09e667
xorps xmm0, xmm0
mov dword [ebp - 0x1040], 0xbb67ae85
movlpd qword [ebp - 0x1090], xmm0
push 0x800
push eax
mov dword [ebp - 0x103c], 0x3c6ef372
mov dword [ebp - 0x1038], 0xa54ff53a
mov dword [ebp - 0x1034], 0x510e527f
mov dword [ebp - 0x1030], 0x9b05688c
mov dword [ebp - 0x102c], 0x1f83d9ab
mov dword [ebp - 0x1028], 0x5be0cd19
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
lea ecx, [ebp - 0x1090]
add eax, eax
push eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1020]
push eax
call fcn.0048e860
cmp dword [ebp - 0x100c], 0x10
lea edi, [ebp - 0x1020]
jb 0x40b4bc
mov edi, dword [ebp - 0x1020]
test edi, edi
je 0x40b50a
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b4c1
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x40b50a
lea eax, [ebx + ebx]
call fcn.00485200
mov esi, esp
test esi, esi
je 0x40b504
push ebx
push esi
push 0xffffffffffffffff
xor eax, eax
push edi
push eax
push 3
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x40b50c
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
xor eax, eax
push eax
push 0x100
push dword [ebp - 0x1094]
call esi
mov edx, dword [ebp - 0x100c]
add esp, 0xc
cmp edx, 0x10
jb 0x40b559
mov ecx, dword [ebp - 0x1020]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40b54f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40b54f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004823d1
add esp, 8
lea esp, [ebp - 0x10a0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40bf80
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov bl, byte [esp + 8]
mov eax, 5
push ebp
push esi
xor esi, esi
mov ebp, ecx
test bl, bl
push edi
mov edi, dword [sym.imp.mfc140u.dll_CWnd::ShowWindow]
cmovne esi, eax
push esi
lea ecx, [ebp + 0xc70]
call edi
push esi
push dword [ebp + 0x680]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
lea ecx, [ebp + 0x4198]
call edi
push esi
lea ecx, [ebp + 0x36a0]
call edi
xor eax, eax
mov ecx, 5
test bl, bl
cmove eax, ecx
lea ecx, [ebp + 0x3568]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
push dword [ebp + 0x680]
call esi
push 1
push 0
push dword [ebp + 0x41b8]
call esi
push 1
push 0
push dword [ebp + 0xc90]
call esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x40ca50
Capabilities:
Create directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x55b090]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x40ca81
call fcn.004a4d30
cmp eax, 0xffffffff
jne 0x40ca81
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x40cb3a
push esi
mov esi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x40caa0
cmp dx, 0x5c
jne 0x40caa2
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x40ca94
cmp esi, ebx
je 0x40caeb
sub esi, ebx
lea eax, [esp + 0x214]
and esi, 0xfffffffe
push esi
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
cmp esi, 0x208
jae 0x40cb51
xor eax, eax
lea edx, [esp + 0x214]
mov ecx, edi
mov word [esp + esi + 0x214], ax
call fcn.0040ca50
xor eax, eax
mov word [esp + 0xc], ax
test edi, edi
je 0x40cb0a
push edi
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
push ebx
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.004a4d30
cmp eax, 0xffffffff
jne 0x40cb39
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
mov ecx, dword [esp + 0x418]
pop edi
pop ebx
xor ecx, esp
call fcn.00482396
add esp, 0x414
ret
call fcn.00482902
int3
Function at 0x412580
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x109c
call fcn.00485230
mov eax, dword [0x55b090]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp + 0x18]
push 0x1000
mov dword [ebp - 0x1098], eax
lea eax, [ebp - 0x1008]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1008]
push esi
push 0x800
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x1008]
add esp, 0xc
push edi
push 0x800
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x1008]
push ebx
push 0x800
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x1008]
push dword [ebp - 0x1094]
push 0x800
push eax
call esi
add esp, 0xc
mov dword [ebp - 0x1088], 0
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1044], 0x6a09e667
xorps xmm0, xmm0
mov dword [ebp - 0x1040], 0xbb67ae85
movlpd qword [ebp - 0x1090], xmm0
push 0x800
push eax
mov dword [ebp - 0x103c], 0x3c6ef372
mov dword [ebp - 0x1038], 0xa54ff53a
mov dword [ebp - 0x1034], 0x510e527f
mov dword [ebp - 0x1030], 0x9b05688c
mov dword [ebp - 0x102c], 0x1f83d9ab
mov dword [ebp - 0x1028], 0x5be0cd19
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
add esp, 8
lea ecx, [ebp - 0x1090]
add eax, eax
push eax
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1020]
push eax
call fcn.0048e860
cmp dword [ebp - 0x100c], 0x10
lea edi, [ebp - 0x1020]
jb 0x4126d1
mov edi, dword [ebp - 0x1020]
test edi, edi
je 0x412713
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4126d6
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x412713
lea eax, [ebx + ebx]
call fcn.00485200
mov esi, esp
test esi, esi
je 0x412713
push ebx
push esi
push 0xffffffffffffffff
xor eax, eax
push edi
push eax
push 3
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, esi
jmp 0x412715
xor eax, eax
push eax
push 0x100
push dword [ebp - 0x1098]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov edx, dword [ebp - 0x100c]
add esp, 0xc
cmp edx, 0x10
jb 0x412766
mov ecx, dword [ebp - 0x1020]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41275c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x41275c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004823d1
add esp, 8
lea esp, [ebp - 0x10a8]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00482396
mov esp, ebp
pop ebp
ret 0x18