joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x486ed3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x486eba
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48d880
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c019e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0048e1a0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x50e51c
call fcn.004b0c79
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x48d913
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004b0c79
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x48d90c
push 0
mov ecx, eax
call fcn.00484980
mov dword [esi + 0xc], eax
jmp 0x48d915
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x48d915
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4b3306
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b333e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b1393
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b136b
jmp 0x4b334a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b49f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b4a3a
call fcn.004ba4b5
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b4a3a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b4a31
xor eax, eax
jmp 0x4b4a42
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b4a48
pop edi
pop esi
pop ebx
ret 4
Function at 0x4ba9e5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4baa13
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4baa31
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004ba94b
jmp 0x4baa31
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4baa31
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004ba94b
test edi, edi
mov eax, edi
jne 0x4baa1b
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x7b2d12cf
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x39d681e
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x413c54
Capabilities:
Encode data using base64

Disassembly:
rol eax, cl
neg al
neg edx
rol ax, 0x2e
ror edx, 3
xchg dword [esp + ecx - 0x425a5aa], ecx
xor dword [esp + 2], ecx
ror word [esp + 3], 0xe4
xor ebx, edx
ror dword [esp + 8], 0x6c
jb 0x424404
jb 0x41740c
adc ebp, edx
lea ecx, [eax*2 + 0x7b302636]
and dword [esp + 2], eax
rol dword [esp + 6], cl
pop ecx
pop eax
pop eax
jns loc.00411a16
movzx eax, word [esi]
mov ecx, 0x7707fbb8
mov edx, ecx
or ecx, edx
lea esi, [edx + esi - 0x7707fbb6]
xor ax, bx
xor ecx, ecx
inc cx
neg ax
sar ecx, cl
bts cx, 0xb1
inc ax
jmp 0x40d42b
xor eax, 0xefa0c29f
dec eax
sub ecx, ecx
rol eax, 2
sub word [esp + edx - 0x10a79faa], cx
btc ecx, ecx
lea eax, [eax + edx - 0x3ac7653e]
xor ebx, eax
add ebp, eax
movzx eax, word [esp + edx*2 - 0x214f3f56]
xor al, ch
lea eax, [eax - 0x1ffb704a]
pop edx
jp loc.00411a16
add esi, 4
mov ecx, 0x425a5b2
xor edx, ebx
inc edx
push eax
ror edx, 2
jmp 0x40b9d2
bswap ecx
neg eax
mov dword [esp + edx*8 - 0x7149e38], 0x34af7c2e
rol ecx, cl
sbb word [esp + edx*2 - 0x1c5278d], 0xfdae
xor eax, 0x623dc34
xor dword [esp + edx*2 - 0x1c5278e], 0x2a191512
seto byte [esp + edx - 0xe293c6]
neg eax
inc eax
sar word [esp + edx - 0xe293c7], 0xc1
rol ecx, 0x3f
call fcn.00421788
push edx
lea esi, [esi + edx - 0x10a79fa7]
rol ecx, 0x11
neg cl
sub dword [esp + edx - 0x10a79fab], ecx
xor eax, ebx
jmp 0x40bdba

Function at 0x41c1b4
Capabilities:
Encode data using xor

Disassembly:
xor al, bl
add al, 0x82
xor al, cl
dec dl
rol dx, 4
bts ecx, ecx
adc al, 0x39
xor al, cl
xor bl, al
lea edx, [ecx*4 - 0x47def35a]
or cx, 0xada1
sbb edi, 2
jmp 0x4132b2
btr ecx, edx
mov word [edi], ax
sub edx, 0xdaa73d9a
jle loc.00411a16
xor ebx, eax
inc ecx
mov dword [esp + edx*2], ecx
add ebp, eax
movzx eax, byte [esi + edx*2]
pop ecx
lea esi, [esi + edx*2 + 1]
inc cx
bts edx, 0x8c
jae 0x40a6db
Function at 0x424d28
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
bswap eax
shl eax, 2
shl cl, 0xc1
inc edx
ror edx, 2
neg edx
not cx
ror edx, 3
xor ebx, edx
imul ecx, ecx
sub ecx, eax
and ecx, 0x19b70c00
adc ebp, edx
movzx edx, ax
btr dx, dx
bts eax, eax
movzx eax, byte [esi + ecx*2 - 0x21261000]
bswap ecx
xor ecx, 0x5086fe18
pop edx
movzx edx, ax
xor ebx, ecx
btr eax, 0xad
mov dword [esp + eax - 0x4218], eax
jb 0x40d6a9
adc ebp, ecx
bt eax, eax
lea ecx, [eax - 0x3978584f]
inc al
mov dword [esp + eax*4 - 0x10864], ebp
ret
Function at 0x401040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x1c]
push eax
push 0
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0040e5e0
add esp, 0xc
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x20]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010ad
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4010af
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4010c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.00418130
mov eax, dword [0x425090]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 0x808]
push eax
push 0x400
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
mov word [ebp - 0x1010], dx
push 0x7fe
push 0
lea eax, [ebp - 0x100e]
push eax
call fcn.0040e5e0
add esp, 0xc
lea ecx, [ebp - 0x808]
mov dword [ebp - 0x101c], ecx
mov edx, dword [ebp - 0x101c]
add edx, 2
mov dword [ebp - 0x1020], edx
mov eax, dword [ebp - 0x101c]
mov cx, word [eax]
mov word [ebp - 0x1022], cx
add dword [ebp - 0x101c], 2
cmp word [ebp - 0x1022], 0
jne 0x401129
mov edx, dword [ebp - 0x101c]
sub edx, dword [ebp - 0x1020]
sar edx, 1
mov dword [ebp - 0x1028], edx
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x80c], 0
mov dword [ebp - 0x1018], 0
jmp 0x40118f
mov ecx, dword [ebp - 0x1018]
add ecx, 1
mov dword [ebp - 0x1018], ecx
mov edx, dword [ebp - 0x1018]
cmp edx, dword [ebp - 0x1014]
jae 0x4011f8
mov eax, dword [ebp - 0x1018]
mov ecx, dword [ebp - 0x1018]
mov dx, word [ebp + ecx*2 - 0x808]
mov word [ebp + eax*2 - 0x1010], dx
mov eax, dword [ebp - 0x1018]
movzx ecx, word [ebp + eax*2 - 0x1010]
cmp ecx, 0x5c
jne 0x4011f6
lea edx, [ebp - 0x1010]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4011f6
push 0
lea eax, [ebp - 0x1010]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x80c], 1
jmp 0x401180
mov eax, dword [ebp - 0x80c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040cbaa
mov esp, ebp
pop ebp
ret
Function at 0x4014e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x40
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040cca0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x401534
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0040cefc
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.0040d100
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.0040d1c9
add esp, 4
mov eax, 1
jmp 0x401536
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4020d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d07b
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x425090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x426f74]
and eax, 1
jne 0x40212b
mov ecx, dword [0x426f74]
or ecx, 1
mov dword [0x426f74], ecx
mov ecx, 0x426f70
call fcn.00406aa0
push 0x41d660
call fcn.0040db73
add esp, 4
mov ecx, 0x426f70
call fcn.00406f50
test eax, eax
jne 0x4021eb
push 1
push 0x2e
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4021eb
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00406fe0
mov dword [ebp - 4], 0
push str.22MILES_
lea ecx, [ebp - 0x220]
call fcn.004073e0
lea ecx, [ebp - 0x220]
call fcn.00407ca0
push eax
call fcn.004023c0
add esp, 4
test eax, eax
jne 0x4021c0
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00406ac0
mov eax, dword [ebp - 0x224]
jmp 0x40228f
mov ecx, dword [ebp - 0x220]
push ecx
push 0x421640
push 0x426f70
call fcn.0040a690
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00406ac0
mov ecx, 0x426f70
call fcn.00406f50
test eax, eax
jle 0x40228d
cmp dword [ebp + 0xc], 0
je 0x40226f
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x228]
add eax, 2
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x228]
mov dx, word [ecx]
mov word [ebp - 0x22e], dx
add dword [ebp - 0x228], 2
cmp word [ebp - 0x22e], 0
jne 0x40221b
mov eax, dword [ebp - 0x228]
sub eax, dword [ebp - 0x22c]
sar eax, 1
mov dword [ebp - 0x234], eax
je 0x40226f
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, 0x426f70
call fcn.00407ca0
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00402460
add esp, 0xc
jmp 0x40228f
mov eax, dword [0x426f70]
push eax
push 0x421640
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040a690
add esp, 0xc
mov eax, 1
jmp 0x40228f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cbaa
mov esp, ebp
pop ebp
ret
Function at 0x4023c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x422910
push 0x40f910
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x425090]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x402425
mov dword [ebp - 0x1c], 0
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xfffffffe
jmp 0x40243e
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402e80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d54b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x425090]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.TDBridge.0
mov ecx, dword [ebp - 0x18]
add ecx, 0x20
call fcn.00403910
mov dword [ebp - 4], 0
xor ecx, ecx
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [edx], ecx
mov byte [edx + 4], cl
mov eax, dword [ebp - 0x18]
mov byte [eax + 4], 0x6e
mov ecx, dword [ebp - 0x18]
mov byte [ecx + 5], 0x76
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, 0x20
call fcn.00401ca0
cmp dword [ebp - 0x14], 0
je 0x402f15
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x402f50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
push str._wnd
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00401ea0
test eax, eax
je 0x402ff1
push 0
push str._wnd
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00401f00
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
call fcn.00407ca0
push eax
call fcn.00401a30
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
lea ecx, [ebp - 4]
call fcn.00406ac0
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x402ff1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], 0
push 0x4218a4
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00401ea0
test eax, eax
je 0x40303d
push 0
push 0x4218a4
lea edx, [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00401f00
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.00407ca0
push eax
call fcn.00401a30
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 8]
call fcn.00406ac0
push str._pid
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00401ea0
test eax, eax
je 0x4030ab
push 0
push str._pid
lea edx, [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.00401f00
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
call fcn.00407ca0
push eax
call fcn.00401a30
add esp, 4
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], eax
lea ecx, [ebp - 0xc]
call fcn.00406ac0
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
jbe 0x4030ab
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
push 0x4037d0
push 0
push 0
call fcn.0040deee
add esp, 0x18
mov esp, ebp
pop ebp
ret 4
Function at 0x403b30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d43e
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x425090]
xor eax, ebp
mov dword [ebp - 0x28], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x290]
call fcn.00406aa0
mov dword [ebp - 4], 0
push str.Temp_swfplayer_
lea eax, [ebp - 0x290]
push eax
call fcn.004020d0
add esp, 8
lea ecx, [ebp - 0x14]
call fcn.00406aa0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x290]
push ecx
push str._s.
lea edx, [ebp - 0x14]
push edx
call fcn.0040a690
add esp, 0xc
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00407ca0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10], eax
xor ecx, ecx
cmp dword [ebp - 0x10], 0xffffffff
setne cl
mov dword [ebp - 0x3c], ecx
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x3c], 0
je 0x403cd1
movzx ecx, word [ebp - 0x260]
cmp ecx, 0x2e
je 0x403cb8
mov edx, dword [ebp - 0x28c]
and edx, 0x10
je 0x403cb8
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x29c], eax
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x298], ecx
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x29c]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 0x298]
push 0
push 0x23c34600
push eax
push edx
call fcn.00416970
mov dword [ebp - 0x2a0], eax
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp - 0x294], ecx
cmp dword [ebp - 0x2a0], 0x168
jbe 0x403cb8
lea edx, [ebp - 0x290]
push edx
lea ecx, [ebp - 0x2a4]
call fcn.00406fc0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2a4]
call fcn.004070a0
lea ecx, [ebp - 0x2a4]
call fcn.00407ca0
push eax
call fcn.00403ab0
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a4]
call fcn.00406ac0
lea ecx, [ebp - 0x28c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ebp - 0x3c], eax
jmp 0x403bee
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00406ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.00406ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.0040cbaa
mov esp, ebp
pop ebp
ret
Function at 0x403d20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d29c
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x425090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x228]
call fcn.00406fe0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.00406aa0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x228]
call fcn.00407ca0
push eax
call fcn.00401540
add esp, 8
lea ecx, [ebp - 0x224]
call fcn.00406aa0
mov byte [ebp - 4], 2
push 1
push 0x1a
lea edx, [ebp - 0x21c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x403dc3
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00407080
lea ecx, [ebp - 0x220]
call fcn.00406f50
test eax, eax
jle 0x403e28
lea ecx, [ebp - 0x22c]
call fcn.00406aa0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x224]
push edx
push str._s_s
lea eax, [ebp - 0x22c]
push eax
call fcn.0040a690
add esp, 0x10
push 0
lea ecx, [ebp - 0x22c]
call fcn.00407ca0
push eax
call fcn.00401210
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x22c]
call fcn.00406ac0
push 0
lea ecx, [ebp - 0x228]
call fcn.00407ca0
push eax
call fcn.00401210
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x224]
call fcn.00406ac0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x220]
call fcn.00406ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00406ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040cbaa
mov esp, ebp
pop ebp
ret
Function at 0x404ef0
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d243
mov eax, dword fs:[0]
push eax
sub esp, 0x274
mov eax, dword [0x425090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x280], ecx
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004017d0
add esp, 8
test eax, eax
jne 0x404f43
jmp 0x405082
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x21c]
push edx
lea ecx, [ebp - 0x10]
call fcn.00406fe0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
push 0x421a04
lea eax, [ebp - 0x10]
push eax
call fcn.0040a6c0
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.00406aa0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
push ecx
call fcn.004016a0
add esp, 4
mov dword [ebp - 0x27c], 0
push 0x40
push 0
lea edx, [ebp - 0x278]
push edx
call fcn.0040e5e0
add esp, 0xc
mov dword [ebp - 0x27c], 0x44
mov dword [ebp - 0x22c], 0
xor eax, eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x27c]
push edx
lea ecx, [ebp - 0x230]
call fcn.00407ca0
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.00407ca0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405057
push str.Ankown_error_occurred__restart_successful.
call fcn.00402700
add esp, 4
mov eax, dword [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405064
push str.Ankown_error_occurred__faid_to_restart.
call fcn.00402700
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00406ac0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00406ac0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040cbaa
mov esp, ebp
pop ebp
ret 4