joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409160
Capabilities:
Parse pe header

Disassembly:
push ebx
push ecx
push esi
push edi
sub esp, 0xc
mov ecx, eax
mov edi, edx
xor ebx, ebx
xor edx, edx
call fcn.004016c0
mov ebx, 2
lea edx, [esp + 4]
mov eax, ecx
call fcn.004012d0
cmp eax, 2
sete al
mov byte [esp + 8], al
test al, al
je 0x409242
xor esi, esi
cmp word [esp + 4], 0x5a4d
jne 0x4091f5
mov esi, 0x3c
mov eax, ecx
xor ebx, ebx
mov edx, esi
call fcn.004016c0
mov ebx, 4
mov edx, esp
mov eax, ecx
call fcn.004012d0
cmp eax, 4
sete al
mov byte [esp + 8], al
test al, al
je 0x4091f5
mov esi, dword [esp]
mov eax, ecx
xor ebx, ebx
mov edx, esi
call fcn.004016c0
mov ebx, 2
lea edx, [esp + 4]
mov eax, ecx
call fcn.004012d0
cmp eax, 2
sete al
mov byte [esp + 8], al
cmp byte [esp + 8], 0
je 0x409242
mov edx, dword [esp + 4]
cmp dx, 0x454c
je 0x409259
cmp dx, 0x584c
je 0x409259
cmp dx, 0x454e
je 0x409266
cmp dx, 0x4550
je 0x409273
test esi, esi
jne 0x409280
mov ebx, edi
mov edx, esi
mov eax, ecx
call fcn.004079f0
mov byte [esp + 8], al
test al, al
jne 0x409242
mov ebx, edi
mov edx, esi
mov eax, ecx
call fcn.00408100
mov byte [esp + 8], al
mov eax, ecx
xor ebx, ebx
xor edx, edx
call fcn.004016c0
mov al, byte [esp + 8]
add esp, 0xc
pop edi
pop esi
pop ecx
pop ebx
ret
mov ebx, edi
mov edx, esi
mov eax, ecx
call fcn.00407fb0
jmp 0x409242
mov ebx, edi
mov edx, esi
mov eax, ecx
call fcn.00407cc0
jmp 0x409242
mov ebx, edi
mov edx, esi
mov eax, ecx
call fcn.00408220
jmp 0x409242
mov byte [esp + 8], 0
jmp 0x409242

Function at 0x41c970
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 0x20
mov ebp, eax
mov esi, edx
mov edi, ebx
mov ebx, 0x20
mov eax, esp
xor edx, edx
call fcn.0040f620
cmp byte [esi], 0
je 0x41c9ca
mov al, byte [esi]
movzx ecx, al
mov eax, ecx
cdq
shl edx, 3
sbb eax, edx
sar eax, 3
mov edx, eax
mov eax, ecx
sar eax, 0x1f
xor ecx, eax
sub ecx, eax
and ecx, 7
xor ecx, eax
sub ecx, eax
mov eax, 1
shl eax, cl
mov ecx, eax
movzx eax, byte [esp + edx]
or eax, ecx
inc esi
mov byte [esp + edx], al
cmp byte [esi], 0
jne 0x41c990
xor esi, esi
test edi, edi
jbe 0x41ca0b
mov ebx, ebp
mov al, byte [ebx]
movzx edx, al
mov eax, edx
mov ecx, edx
sar eax, 0x1f
xor ecx, eax
sub ecx, eax
and ecx, 7
xor ecx, eax
sub ecx, eax
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, edx
cdq
shl edx, 3
sbb eax, edx
sar eax, 3
movzx eax, byte [esp + eax]
test eax, ecx
jne 0x41ca0b
inc esi
inc ebx
cmp esi, edi
jb 0x41c9d2
mov eax, esi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x41e6f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 0x20
mov ebp, eax
mov esi, edx
mov edi, ebx
mov ebx, 0x20
mov eax, esp
xor edx, edx
call fcn.0040f620
cmp byte [esi], 0
je 0x41e74a
mov al, byte [esi]
movzx ecx, al
mov eax, ecx
cdq
shl edx, 3
sbb eax, edx
sar eax, 3
mov edx, eax
mov eax, ecx
sar eax, 0x1f
xor ecx, eax
sub ecx, eax
and ecx, 7
xor ecx, eax
sub ecx, eax
mov eax, 1
shl eax, cl
mov ecx, eax
movzx eax, byte [esp + edx]
or eax, ecx
inc esi
mov byte [esp + edx], al
cmp byte [esi], 0
jne 0x41e710
xor esi, esi
test edi, edi
jbe 0x41e78b
mov ebx, ebp
mov al, byte [ebx]
movzx edx, al
mov eax, edx
mov ecx, edx
sar eax, 0x1f
xor ecx, eax
sub ecx, eax
and ecx, 7
xor ecx, eax
sub ecx, eax
mov eax, 1
shl eax, cl
mov ecx, eax
mov eax, edx
cdq
shl edx, 3
sbb eax, edx
sar eax, 3
movzx eax, byte [esp + eax]
test eax, ecx
jne 0x41e78b
inc esi
inc ebx
cmp esi, edi
jb 0x41e752
mov eax, esi
add esp, 0x20
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x403d4c
Capabilities:
Encode data using xor
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xbc
mov edx, dword [esp + 0xc0]
push ebx
push ebp
push esi
mov eax, dword [edx + 0xf8]
mov esi, dword [esp + 0xd0]
push edi
push 0x10
pop ecx
lea edi, [esp + 0x8c]
mov dword [esp + 0x18], 0x3c6ef372
rep movsd dword es:[edi], dword [esi]
mov esi, dword [edx + 0xf4]
lea edi, [esp + 0x4c]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [eax]
mov ecx, 0x6a09e667
mov edi, dword [eax + 4]
xor esi, 0x510e527f
mov eax, dword [edx + 0xfc]
xor edi, 0x9b05688c
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x28], ecx
mov ecx, 0xbb67ae85
mov dword [esp + 0x30], ecx
mov edx, dword [eax]
mov eax, dword [eax + 4]
xor edx, 0x1f83d9ab
mov ecx, dword [esp + 0x5c]
xor eax, 0x5be0cd19
mov dword [esp + 0x44], eax
xor ebp, ebp
mov eax, dword [esp + 0x68]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x48], ebp
mov ebp, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], 0xa54ff53a
mov dword [esp + 0x40], ebx
mov dword [esp + 0x34], ecx
movzx eax, byte [eax + 0x42f328]
mov eax, dword [esp + eax*4 + 0x8c]
add eax, ecx
mov ecx, dword [esp + 0x14]
add ecx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
xor ecx, esi
mov esi, dword [esp + 0x34]
ror ecx, 0x10
add eax, ecx
xor esi, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
ror esi, 0xc
mov dword [esp + 0x34], esi
movzx eax, byte [eax + 0x42f329]
mov eax, dword [esp + eax*4 + 0x8c]
add eax, esi
mov esi, dword [esp + 0x14]
add esi, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], esi
xor esi, ecx
mov ecx, dword [esp + 0x28]
ror esi, 8
add ecx, esi
xor eax, ecx
mov dword [esp + 0x28], ecx
ror eax, 7
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
movzx eax, byte [eax + 0x42f32a]
mov eax, dword [esp + eax*4 + 0x8c]
add eax, dword [esp + 0x1c]
add ecx, eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
xor ecx, edi
mov edi, dword [esp + 0x1c]
ror ecx, 0x10
add eax, ecx
xor edi, eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x10]
ror edi, 0xc
mov dword [esp + 0x1c], edi
movzx eax, byte [eax + 0x42f32b]
mov eax, dword [esp + eax*4 + 0x8c]
add eax, edi
mov edi, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
xor edi, ecx
mov ecx, dword [esp + 0x30]
ror edi, 8
add ecx, edi
xor eax, ecx
mov dword [esp + 0x30], ecx
ror eax, 7
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
movzx eax, byte [eax + 0x42f32c]
mov eax, dword [esp + eax*4 + 0x8c]
invalid
Function at 0x4062ed
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x264
push edi
mov edi, dword [esp + 0x280]
mov eax, ecx
mov dword [esp + 4], eax
cmp edi, 0x18
ja 0x4064e2
push ebx
push ebp
xor ebp, ebp
lea ebx, [eax + 0x4b4]
push esi
mov esi, ebp
cmp dword [ebx + 0x134], edi
jne 0x406351
push dword [esp + 0x27c]
mov ecx, ebx
call fcn.0040d9d3
test al, al
je 0x406351
push 0x10
push dword [esp + 0x288]
lea eax, [ebx + 0x102]
push eax
call fcn.0041d710
add esp, 0xc
test eax, eax
je 0x4064ec
inc esi
invalid

Function at 0x406543
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1d0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1e4]
push edi
push 0x40
pop ebp
cmp esi, ebp
jbe 0x406598
lea eax, [esp + 0x170]
push eax
call fcn.0040e222
push esi
push dword [esp + 0x1e8]
lea eax, [esp + 0x178]
push eax
call fcn.0040e268
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x174]
push eax
call fcn.0040e17b
push 0x20
lea ebx, [esp + 0x54]
pop esi
jmp 0x40659f
mov ebx, dword [esp + 0x1e4]
xor edi, edi
mov edx, edi
test esi, esi
je 0x4065c4
mov ebp, ebx
lea eax, [esp + 0x10]
sub ebp, eax
lea ecx, [esp + 0x10]
add ecx, edx
mov al, byte [ecx + ebp]
xor al, 0x36
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x4065af
push 0x40
pop ebp
cmp esi, ebp
jae 0x4065de
mov eax, ebp
lea ecx, [esp + 0x10]
sub eax, esi
add ecx, esi
push eax
push 0x36
push ecx
call fcn.0041d1e0
add esp, 0xc
lea eax, [esp + 0x90]
push eax
call fcn.0040e222
push ebp
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.0040e268
push dword [esp + 0x1f0]
lea eax, [esp + 0x94]
push dword [esp + 0x1f0]
push eax
call fcn.0040e268
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x94]
push eax
call fcn.0040e17b
lea eax, [esp + 0x100]
push eax
call fcn.0040e222
test esi, esi
je 0x406654
lea eax, [esp + 0x10]
sub ebx, eax
lea ecx, [esp + 0x10]
add ecx, edi
mov al, byte [ebx + ecx]
xor al, 0x5c
inc edi
mov byte [ecx], al
cmp edi, esi
jb 0x406642
cmp esi, ebp
jae 0x40666e
mov eax, ebp
lea ecx, [esp + 0x10]
sub eax, esi
add ecx, esi
push eax
push 0x5c
push ecx
call fcn.0041d1e0
add esp, 0xc
push ebp
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x108]
push eax
call fcn.0040e268
push 0x20
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x108]
push eax
call fcn.0040e268
push dword [esp + 0x1f4]
lea eax, [esp + 0x104]
push eax
call fcn.0040e17b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d0
ret 0x14
Function at 0x4095e6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, ecx
test ebp, ebp
jne 0x4095f9
mov al, 1
jmp 0x4096ea
cmp dword [edi + 0xc], 1
jne 0x40960a
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push ebx
push esi
and dword [esp + 0x18], 0
xor bl, bl
cmp dword [edi + 0xc], 0
je 0x40965f
xor esi, esi
test ebp, ebp
je 0x409681
mov eax, ebp
sub eax, esi
cmp eax, 0x4000
jb 0x40962f
mov eax, 0x4000
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
mov eax, dword [esp + 0x20]
add eax, esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
invalid

Function at 0x409834
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041c240
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409879
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040ac19
test al, al
je 0x409879
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4098a7
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041c240
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040b1b4
movzx eax, word [eax]
cmp eax, 0x2e
je 0x4098d8
cmp eax, 0x20
je 0x4098d8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40990b
push esi
call fcn.00409820
test al, al
jne 0x40991e
push 0x800
lea eax, [ebp - 0x1000]
push eax
push esi
call fcn.0040ac19
test al, al
je 0x40991e
push 0
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40991e
cmp byte [ebp + 0xc], 0
je 0x40991a
push dword [ebp + 0x10]
push esi
call fcn.00409ae4
xor eax, eax
jmp 0x409936
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409933
cmp eax, 3
je 0x409933
xor eax, eax
inc eax
jmp 0x409936
push 2
pop eax
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x409ae4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041c240
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x409b34
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040ac19
test al, al
je 0x409b34
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
invalid
xchg ebp, eax
Function at 0x409c91
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1250
call fcn.0041c240
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1260]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x126c]
or ebp, 0xffffffff
push eax
cmp esi, ebp
jne 0x409d2b
push dword [esp + 0x126c]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov esi, eax
cmp esi, ebp
jne 0x409d52
push 0x800
lea eax, [esp + 0x264]
push eax
push dword [esp + 0x1270]
call fcn.0040ac19
test al, al
je 0x409d04
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call ebx
mov esi, eax
cmp esi, ebp
jne 0x409d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x409d1e
cmp eax, 3
je 0x409d1e
cmp eax, 0x12
je 0x409d1e
xor eax, eax
inc eax
jmp 0x409d20
xor eax, eax
mov byte [edi + 0x1044], al
jmp 0x409e00
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x409d4a
mov esi, ebp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [edi + 0x1044], al
cmp esi, ebp
je 0x409e00
mov ebx, 0x800
push ebx
push dword [esp + 0x126c]
push edi
call fcn.0040e847
push ebx
lea eax, [esp + 0x40]
push eax
push edi
call fcn.0040b23f
mov ecx, dword [esp + 0x2c]
xor eax, eax
add eax, dword [esp + 0x30]
mov dword [edi + 0x1000], eax
mov eax, dword [esp + 0x10]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1028], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x102c], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1030], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1034], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x1038], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x103c], eax
lea eax, [esp + 0x24]
mov dword [edi + 0x1004], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.0040f4ba
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 0x1018]
call fcn.0040f4ba
lea eax, [esp + 0x1c]
push eax
lea ecx, [edi + 0x1020]
call fcn.0040f4ba
and dword [edi + 0x1040], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1250
ret 0xc
Function at 0x40e098
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
invalid
inc eax
adc al, dh
loope 0x40e097

Function at 0x40e222
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x40e2e1
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x140
push edi
mov edi, dword [esp + 0x148]
test edi, edi
jne 0x40e316
push 0x20
lea eax, [esp + 0x128]
push eax
call fcn.0040dc0c
push 0x100
lea eax, [esp + 0x28]
push eax
call fcn.0040dc0c
jmp 0x40e573
mov eax, dword [edi + 0x28]
push ebx
push ebp
push esi
push dword [eax]
call fcn.00422ce8
mov dword [esp + 0x34], eax
mov eax, dword [edi + 0x28]
push dword [eax + 4]
call fcn.00422ce8
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0x28]
push dword [eax + 8]
call fcn.00422ce8
mov dword [esp + 0x44], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0xc]
call fcn.00422ce8
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x10]
call fcn.00422ce8
mov dword [esp + 0x54], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x14]
call fcn.00422ce8
mov dword [esp + 0x5c], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x18]
call fcn.00422ce8
mov dword [esp + 0x64], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x1c]
call fcn.00422ce8
mov dword [esp + 0x6c], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x20]
call fcn.00422ce8
mov dword [esp + 0x74], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x24]
call fcn.00422ce8
mov dword [esp + 0x7c], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x28]
call fcn.00422ce8
mov dword [esp + 0x84], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x2c]
call fcn.00422ce8
mov dword [esp + 0x8c], eax
mov eax, dword [edi + 0x28]
push 0x30
pop ebp
push dword [eax + ebp]
call fcn.00422ce8
mov dword [esp + 0x94], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x34]
call fcn.00422ce8
mov dword [esp + 0x9c], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x38]
call fcn.00422ce8
mov dword [esp + 0xa4], eax
mov eax, dword [edi + 0x28]
push dword [eax + 0x3c]
call fcn.00422ce8
add esp, 0x40
mov dword [esp + 0x6c], eax
lea ebx, [esp + 0x68]
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub ebp, 1
jne 0x40e421
mov eax, dword [edi]
xor edx, edx
mov ebx, dword [edi + 0x10]
mov ebp, eax
mov dword [esp + 0x2c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x1c]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov esi, ebx
invalid
Function at 0x40f25b
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x40f2d6
push ebp
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x40f40b
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
jne 0x40f2b2
push str.CreateThread_failed
push 0x43bbf8
call fcn.004069e4
pop ecx
pop ecx
mov ecx, 0x43bbf8
call fcn.00420f99
push 2
mov ecx, 0x43bbf8
call fcn.004069df
mov dword [edi], ebp
inc dword [esi + 0x84]
mov eax, dword [0x44149c]
test eax, eax
je 0x40f2cc
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x40f26b
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x417cb5
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 0x14]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
push esi
push 0
push ebp
mov dword [ebx + 8], ebp
mov byte [ebx + 0x1e], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x20]
mov ecx, ebx
call fcn.00417a22
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x18], eax
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebx + 4], 0
je 0x417d1f
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
push edi
push ebx
push dword [ebx]
sub esi, eax
lea edi, [eax + 1]
push 0
push ebp
sub esi, 2
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push esi
push dword [esp + 0x2c]
xor esi, esi
push edi
push 0x40000000
push esi
push 0x430090
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 4], eax
pop edi
cmp dword [ebx + 0x10], esi
jne 0x417da1
test ebp, ebp
je 0x417db7
cmp dword [ebx + 0x18], esi
jne 0x417db7
cmp dword [ebx + 0x14], esi
je 0x417db7
push dword [ebx + 0x14]
mov ecx, ebx
call fcn.00417ad8
mov esi, eax
test esi, esi
je 0x417db7
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.004216d0
pop ecx
jmp 0x417db7
test eax, eax
je 0x417db7
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x41803d
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x43073c
push 1
push ebx
push 0x43080c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x41810e
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x4307fc
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x418105
cmp byte [ebp + 8], bl
je 0x418090
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x4180ad
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
cmp dword [ebp + 0x1c], ebx
jne 0x4180bf
push 0x42f5dc
jmp 0x4180c2
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4180d7
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4180e8
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
js 0x4180fc
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4181bc
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x41873f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0041c240
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.004181bc
cmp byte [0x44874e], 0
jne 0x4187d4
push 6
push dword [0x43914c]
lea eax, [ebp - 0x1020]
push eax
call fcn.0040b1d0
push eax
call fcn.00410101
test eax, eax
jne 0x4187d4
push 0x42f4f4
call fcn.00418556
lea eax, [ebp - 0x1020]
push eax
call fcn.004216b5
xor ecx, ecx
push 0x1e
push ecx
mov word [ebp + eax*2 - 0x101e], cx
lea eax, [ebp - 0x20]
push eax
call fcn.0041d1e0
add esp, 0x10
mov dword [ebp - 0x1c], 3
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esp, ebp
pop ebp