joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458af8
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
cmp si, word [ebx + 0x44]
je 0x458b87
mov word [ebx + 0x44], si
test si, si
jne 0x458b77
push esp
call fcn.00407b2c
push dword [esp + 4]
push dword [esp + 4]
call sub.user32.dll_MsgWaitForMultipleObjects
mov edi, eax
test edi, edi
je 0x458b77
push 0
push edi
call sub.user32.dll_EnumChildWindows
mov ebp, eax
call sub.KERNEL32.DLL_ResumeThread
cmp ebp, eax
jne 0x458b77
movzx eax, word [esp]
mov word [esp + 8], ax
movzx eax, word [esp + 4]
mov word [esp + 0xa], ax
mov eax, dword [esp + 8]
push eax
push 0
push 0x84
push edi
call sub.user32.dll_GetSystemMenu
movzx eax, ax
or eax, 0x2000000
push eax
push edi
push 0x20
push edi
call sub.user32.dll_GetSystemMenu
jmp 0x458b8a
movsx edx, si
mov eax, ebx
call fcn.00458ad0
push eax
call sub.user32.dll_GetWindowLongW
inc dword [ebx + 0x48]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x45936c
Capabilities:
Get common file path
Get file attributes
Resume thread

Disassembly:
push ecx
mov eax, dword [0x490c98]
cmp byte [eax + 0xad], 0
jne 0x4593dd
cmp dword [0x490cb4], 0
jne 0x45939e
call sub.KERNEL32.DLL_ResumeThread
push eax
push 0
mov eax, 0x459328
push eax
push 3
call sub.user32.dll_IsWindowUnicode
mov dword [0x490cb4], eax
cmp dword [0x490cb0], 0
jne 0x4593b9
push 0
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [0x490cb0], eax
cmp dword [0x490cb8], 0
jne 0x4593dd
push esp
push 0
push 0
push 0x4592cc
push 0x3e8
push 0
call sub.KERNEL32.DLL_GetTempPathA
mov dword [0x490cb8], eax
pop edx
ret

Function at 0x4593e0
Capabilities:
Get disk size
Get thread local storage value
Resume thread

Disassembly:
cmp dword [0x490cb4], 0
je 0x4593f4
mov eax, dword [0x490cb4]
push eax
call sub.user32.dll_LoadStringA
xor eax, eax
mov dword [0x490cb4], eax
cmp dword [0x490cb8], 0
je 0x45943b
mov eax, dword [0x490cb0]
push eax
call sub.KERNEL32.DLL_InterlockedDecrement
call sub.KERNEL32.DLL_ResumeThread
cmp eax, dword [0x490cac]
je 0x459429
push 0xffffffffffffffff
mov eax, dword [0x490cb8]
push eax
call sub.KERNEL32.DLL_TlsGetValue
mov eax, dword [0x490cb8]
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
xor eax, eax
mov dword [0x490cb8], eax
ret
Function at 0x4595b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4595c7
add esp, 0xfffffff0
call fcn.00404614
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00420850
mov eax, dword [0x48b8e4]
cmp word [eax + 2], 0
jne 0x4595ef
mov eax, dword [0x48b8e4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b1b0
mov eax, dword [0x48b9f0]
cmp word [eax + 2], 0
jne 0x459609
mov eax, dword [0x48b9f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045b3bc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416f68]
call fcn.004042d8
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416f68]
call fcn.004042d8
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x416f68]
call fcn.004042d8
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x424f18]
call fcn.0042ad60
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4597c0
mov eax, dword [0x48b784]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetIconInfo
mov edx, eax
mov eax, esi
call fcn.0042b134
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45ba80
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x48b784]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_GetFileSize
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_GetLastActivePopup
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040e894
test eax, eax
je 0x459710
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.0040a1b8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040e8c8
test eax, eax
je 0x459724
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call fcn.004079e4
push eax
call fcn.004079c4
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00405440
mov byte [ebx + 0xd4], 0
push ebx
push 0x45acd8
call fcn.004219cc
mov dword [ebx + 0xc8], eax
mov eax, dword [0x48b5ac]
cmp byte [eax], 0
jne 0x459775
mov eax, ebx
call fcn.00459904
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.0045bc58
mov eax, ebx
call fcn.0045c7bc
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4597b5
call fcn.0040466c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b240
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0045c5f0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x45b26d
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
jmp 0x45b270
mov ebx, dword [ebp - 0x10]
push 2
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x48b88c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x18], eax
push 2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [0x48b88c]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
je 0x45b2ff
mov dword [ebp - 0x48], 0x28
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [0x48b774]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_EnableWindow
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
sub ecx, edx
sar ecx, 1
jns 0x45b2dc
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
sub edx, eax
sar edx, 1
jns 0x45b2ee
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindow
mov eax, dword [ebp - 0x10]
call fcn.00450170
mov dword [ebp - 0x14], eax
call fcn.0044ffcc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
call fcn.00459fa0
test al, al
je 0x45b324
or esi, 0x100000
xor ecx, ecx
push ebp
push 0x45b3a8
push dword fs:[ecx]
mov dword fs:[ecx], esp
push esi
mov eax, dword [ebp - 8]
push eax
push edi
push ebx
call sub.user32.dll_GetKeyboardLayoutNameA
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b3af
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
je 0x45b38e
push 0x1d
push 0
push 0
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x54]
sub ecx, edx
sar ecx, 1
jns 0x45b36b
adc ecx, 0
add ecx, edx
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x58]
sub edx, eax
sar edx, 1
jns 0x45b37d
adc edx, 0
add edx, eax
push edx
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_IsWindow
mov eax, dword [ebp - 0x14]
call fcn.00450234
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetTopWindow
mov eax, dword [ebp - 0x20]
call fcn.0044ffd4
ret
Function at 0x45b8e8
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45ba35
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045b85c
mov ebx, eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
je 0x45b931
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
jne 0x45b931
mov eax, dword [ebp - 4]
call fcn.0045beb0
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.00459220
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0043a3cc
mov edx, dword [ebp - 0xc]
mov eax, dword [0x490c98]
call fcn.0045bae0
mov byte [ebp - 5], 1
xor eax, eax
push ebp
push 0x45b9dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp word [eax + 0x12a], 0
je 0x45b987
lea ecx, [ebp - 5]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x12c]
call dword [ebx + 0x128]
cmp byte [ebp - 5], 0
je 0x45b9d2
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0xc0]
test ebx, ebx
jg 0x45b9a4
mov eax, dword [ebp - 4]
call fcn.0045b7f8
jmp 0x45b9d2
cmp dword [0x490cc4], 0
jne 0x45b9d2
push 0x45b880
push ebx
push 0
push 0
call sub.user32.dll_IsDialogMessageA
mov dword [0x490cc4], eax
cmp dword [0x490cc4], 0
jne 0x45b9d2
mov eax, dword [ebp - 4]
call fcn.0045b7f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45b9f1
call sub.KERNEL32.DLL_ResumeThread
mov edx, dword [0x48bbf8]
cmp eax, dword [edx]
jne 0x45ba0f
xor eax, eax
call fcn.0042006c
test al, al
je 0x45ba0f
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x45ba1a
call sub.user32.dll_MessageBoxA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ba3c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004051f4
ret

Function at 0x461d9c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x461e69
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x48a7bc], 0
jne 0x461e4c
push 0x461e7c
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x48a7bc], eax
cmp dword [0x48a7bc], 0
jne 0x461e24
call sub.KERNEL32.DLL_CloseHandle
push eax
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 8]
mov eax, dword [0x48b994]
call fcn.00407254
mov eax, dword [ebp - 8]
push eax
mov eax, 0x461e90
mov dword [ebp - 0x10], eax
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
pop eax
call fcn.0040ac30
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x45faac]
call fcn.0045fb2c
call fcn.00404b64
push 0x461e9c
mov eax, dword [0x48a7bc]
push eax
call sub.KERNEL32.DLL_RaiseException
mov dword [0x490e90], eax
mov eax, dword [ebp + 0xc]
push eax
movzx eax, word [ebp + 8]
push eax
call dword [0x490e90]
mov ebx, eax
jmp 0x461e4e
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461e70
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051f4
ret
Function at 0x4849d8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 4]
xor edi, edi
mov dword [ebp - 8], esp
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 2
sub esp, eax
lea eax, [ebp - 0x10]
mov dword [eax], esp
mov eax, ebx
call fcn.0040a164
mov esi, eax
push 0
push 0
push esi
push ebx
push 0
push 0
call sub.KERNEL32.DLL_GetStartupInfoA
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, eax
add eax, 3
and eax, 0xfffffffc
sub esp, eax
lea eax, [ebp - 0x18]
mov dword [eax], esp
test edi, edi
jne 0x484a3c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
jmp 0x484a4a
mov eax, dword [ebp - 0xc]
sub eax, edi
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [edx + eax*4], ecx
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push esi
push ebx
push 0
push 0
call sub.KERNEL32.DLL_GetStartupInfoA
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov word [eax + edx*2 - 2], 0
inc esi
add ebx, esi
inc edi
cmp edi, dword [ebp - 0xc]
jne 0x484a00
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [0x48b860]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp eax, 0x80020006
jne 0x484aa4
push ebp
call fcn.004849a4
pop ecx
jmp 0x484aa9
call fcn.00484124
mov esp, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4858ac
Capabilities:
Create thread

Disassembly:
push ebx
add esp, 0xffffff80
mov ebx, eax
push 0x80
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_CreateThread
cmp eax, 0x80
jg 0x4858cc
test eax, eax
jne 0x4858d5
mov eax, ebx
call fcn.004051d0
jmp 0x4858de
mov edx, ebx
mov eax, esp
call fcn.0040a3a4
add esp, 0x80
pop ebx
ret

Function at 0x48744c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
xor eax, eax
mov dword [ebp - 0x98], eax
xor eax, eax
push ebp
push 0x4874bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x90
lea eax, [ebp - 0x91]
push eax
call sub.KERNEL32.DLL_CreateThread
lea edx, [ebp - 0x98]
lea eax, [ebp - 0x91]
call fcn.0040a3a4
mov edx, dword [ebp - 0x98]
mov eax, 0x491c10
call fcn.00405224
call fcn.004873a8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4874c2
lea eax, [ebp - 0x98]
call fcn.004051d0
ret
Function at 0x401470
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapSetInformation]
push 4
lea eax, [ebp - 0x278]
mov dword [ebp - 0x278], 1
push eax
push 0x22
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
push dword [ebp + 0x10]
mov edx, 0x105
lea ecx, [ebp - 0x264]
call fcn.00401590
test eax, eax
js 0x401578
cmp word [ebp - 0x264], 0
push esi
lea esi, [ebp - 0x264]
je 0x4014ff
lea esp, [esp]
cmp word [esi], 0x3a
je 0x4014f7
add esi, 2
cmp word [esi], 0
jne 0x4014e0
lea esi, [ebp - 0x264]
jmp 0x40151e
xor eax, eax
mov word [esi], ax
add esi, 2
cmp word [esi], 0
je 0x4014ef
lea eax, [ebp - 0x264]
push 0x4010f0
push eax
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
add esp, 8
test eax, eax
jne 0x4014ef
push esi
mov edx, 0x29
lea ecx, [ebp - 0x58]
call fcn.00401590
pop esi
test eax, eax
js 0x401578
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_IIDFromString]
test eax, eax
js 0x401578
push 0
push 0
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoInitializeEx]
test eax, eax
js 0x401578
push 0
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.api_ms_win_core_com_private_l1_1_0.dll_CoRegisterSurrogateEx]
call dword [sym.imp.api_ms_win_core_com_l1_1_1.dll_CoUninitialize]
push 0
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.00401900
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401916
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
cmp edx, esi
je 0x401953
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [edx + 0xc]
jb 0x40194c
mov eax, dword [edx + 8]
add eax, dword [edx + 0xc]
cmp ecx, eax
jb 0x401958
add edx, 0x28
cmp edx, esi
jne 0x40193d
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401955
Function at 0x404680
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea ecx, [ebp - 8]
call fcn.00401dc0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401c90
lea ecx, [ebp - 0x18]
call fcn.00401cf0
movzx edx, al
test edx, edx
je 0x4046f8
lea ecx, [ebp - 0x18]
call fcn.00401d20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 0
je 0x4046f8
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x18]
call fcn.00401d40
push eax
call fcn.004064e0
add esp, 4
cmp eax, 0x2fa62ca8
jne 0x4046f6
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401d70
jmp 0x404709
jmp 0x4046b7
lea ecx, [ebp - 8]
call fcn.00401de0
movzx ecx, al
test ecx, ecx
jne 0x40468e
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x408700
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea ecx, [ebp - 8]
call fcn.00401dc0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x18]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401c90
lea ecx, [ebp - 0x18]
call fcn.00401cf0
movzx edx, al
test edx, edx
je 0x408778
lea ecx, [ebp - 0x18]
call fcn.00401d20
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 0xc], 0
je 0x408778
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x18]
call fcn.00401d40
push eax
call fcn.004064e0
add esp, 4
cmp eax, 0xfaba0065
jne 0x408776
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401d70
jmp 0x408789
jmp 0x408737
lea ecx, [ebp - 8]
call fcn.00401de0
movzx ecx, al
test ecx, ecx
jne 0x40870e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x42ece0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0
pop ebp
ret
Function at 0x10071ed0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x10071f6b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x10071f22
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x10071f22
cmp esi, ebx
jge 0x10071f22
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10071f65
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10071f65
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100783dc]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100783dc]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x10071f7d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x100721a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
mov eax, dword [ebp + 8]
je 0x100721c8
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x100721e2
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100279e0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.100762d0
leave
ret 4

Function at 0x100723b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x100723e6
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10072445
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100279e0
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100279e0
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.100279e0
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100762d0
leave
ret 0x10
Function at 0x10072460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100bb864]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10176174], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1007248c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x100724bd
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x100724bb
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100279e0
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x100724bd
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100762d0
leave
ret 8
Function at 0x403427
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x406720
call fcn.00403db0
push 1
call fcn.0040387d
pop ecx
test al, al
je 0x403411
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0040384b
mov byte [ebp - 0x24], al
mov eax, dword [0x4083fc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x403411
test eax, eax
jne 0x40332f
mov dword [0x4083fc], ecx
push 0x4051bc
push 0x4051b0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x403312
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x403401
push 0x4051ac
push 0x4051a4
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x4083fc], 2
jmp 0x403334
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004039ef
pop ecx
call fcn.00403b89
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x403365
push esi
call fcn.0040395b
pop ecx
test al, al
je 0x403365
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x4051a0]
call esi
call fcn.00403b8f
mov esi, eax
cmp dword [esi], edi
je 0x403383
push esi
call fcn.0040395b
pop ecx
test al, al
je 0x403383
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argv
mov edi, dword [eax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll___p___argc
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_narrow_environment
push eax
push edi
push dword [esi]
call main
add esp, 0xc
mov esi, eax
call fcn.00403cb4
test al, al
je 0x403418
test bl, bl
jne 0x4033b6
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push 0
push 1
call fcn.00403a0c
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x403401
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00403b95
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.00543000
jmp 0x4032a5
Function at 0x10001690
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100189e5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub dword [ebp + 0xc], 1
jne 0x1000172a
push 1
call fcn.10017844
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100018f0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1000171b
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x10001705
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
je 0x1000172a
push eax
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
push 6
mov dword [ebp - 0x18], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001762d
mov esp, ebp
pop ebp
ret 0xc