joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c10
Capabilities:
Create directory

Disassembly:
mov eax, 0x4034
call fcn.004076b0
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x4030], eax
mov eax, dword [esp + 0x4038]
push esi
mov esi, dword [esp + 0x4040]
push 0x1000
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.0040d300
push 0x1000
lea eax, [esp + 0x1044]
push esi
push eax
call fcn.0040d300
add esp, 0x18
cmp byte [esp + 0x1033], 0
jne 0x403dda
cmp byte [esp + 0x2033], 0
jne 0x403dda
push ebp
lea ebp, [esp + 0x38]
lea ecx, [ebp + 1]
mov al, byte [ebp]
inc ebp
test al, al
jne 0x403c81
push ebx
push edi
lea eax, [esp + 0x1040]
sub ebp, ecx
push 0x421404
push eax
call fcn.0040d424
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x403d84
nop dword [eax]
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403cb5
sub ecx, edx
inc ebp
add ebp, ecx
cmp ebp, 0xfff
jae 0x403d69
lea edi, [esp + 0x40]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x403cd2
mov ax, word [0x421404]
mov esi, ebx
mov word [edi], ax
mov al, byte [ebx]
inc ebx
test al, al
jne 0x403ce7
lea edi, [esp + 0x40]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403cf5
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
push 0x421404
rep movsb byte es:[edi], byte [esi]
push 0
call fcn.0040d424
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x403d84
push 0x1000
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x2048]
push eax
call fcn.00404980
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2050]
push eax
call fcn.0040dc8d
add esp, 0x14
test eax, eax
jns 0x403cb0
lea eax, [esp + 0x2040]
push eax
call fcn.0040ea81
add esp, 4
jmp 0x403cb0
xor eax, eax
pop edi
pop ebx
pop ebp
pop esi
mov ecx, dword [esp + 0x4030]
xor ecx, esp
call fcn.0040769e
add esp, 0x4034
ret
push 0x1000
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x2048]
push eax
call fcn.00404980
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x2050]
push eax
call fcn.0040dc8d
add esp, 0x14
test eax, eax
jne 0x403dc6
lea eax, [esp + 0x40]
push eax
push str.WARNING:_file_already_exists_but_should_not:__s_n
call fcn.00401860
add esp, 8
lea eax, [esp + 0x40]
push 0x4225d0
push eax
call fcn.00402700
add esp, 8
jmp 0x403d6b
mov ecx, dword [esp + 0x4034]
xor eax, eax
pop esi
xor ecx, esp
call fcn.0040769e
add esp, 0x4034
ret

Function at 0x4040f0
Capabilities:
Set environment variable

Disassembly:
push esi
push edi
push 0
push dword [esp + 0x10]
push 0
call fcn.00404980
add esp, 0xc
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
mov esi, eax
call fcn.00409836
add esp, 4
mov eax, esi
pop edi
pop esi
ret
Function at 0x404120
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x2068
call fcn.004076b0
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x2064], eax
mov eax, dword [esp + 0x206c]
push 0x1000
push eax
lea eax, [esp + 0x6c]
mov dword [esp + 8], 0
push eax
call fcn.00404980
push 1
push 0x16
call fcn.0040f631
push 1
push 2
call fcn.0040f631
push 1
push 0xf
call fcn.0040f631
push 1
push 0x15
call fcn.0040f631
add esp, 0x2c
mov dword [esp + 4], 0xc
lea eax, [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
mov dword [esp + 0x24], 0
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], ax
call fcn.0040a79d
push eax
call fcn.0040e75c
push eax
call fcn.0040f199
push 1
mov dword [esp + 0x68], eax
call fcn.0040a79d
push eax
call fcn.0040e75c
push eax
call fcn.0040f199
push 2
mov dword [esp + 0x78], eax
call fcn.0040a79d
push eax
call fcn.0040e75c
push eax
call fcn.0040f199
add esp, 0x24
mov dword [esp + 0x60], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 1
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404277
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp]
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.0040769e
add esp, 0x2068
ret
push str.Error_creating_child_process__n
push 0x4225f4
call fcn.00401890
mov ecx, dword [esp + 0x206c]
add esp, 8
xor ecx, esp
or eax, 0xffffffff
call fcn.0040769e
add esp, 0x2068
ret
Function at 0x412d7a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412bf9

Function at 0x4170c3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416a31

Function at 0x4170ce
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416c6c
Function at 0x4095f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545d68
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5dd024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5e37c8]
cmp eax, dword [ecx + 4]
jle 0x4096b8
push 0x5e37c8
call fcn.005259b1
add esp, 4
cmp dword [0x5e37c8], 0xffffffff
jne 0x4096b8
mov dword [ebp - 4], 1
xor eax, eax
mov dword [0x5e37dc], 0
mov dword [0x5e37e0], 0
mov dword [0x5e37dc], 0
mov dword [0x5e37e0], 7
mov word [0x5e37cc], ax
mov byte [ebp - 4], 1
push 0x57c670
call fcn.00525869
add esp, 4
mov byte [ebp - 4], 0
push 0x5e37c8
call fcn.00525967
add esp, 4
cmp dword [0x5e37dc], 0
jne 0x40976d
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40976d
add eax, eax
cmp eax, 0x208
jae 0x4097a6
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x220], ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 7
lea edx, [ecx + 2]
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409724
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c60
mov dword [ebp - 4], 4
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x5e37cc
call fcn.00486f10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f30
push 0x5e37cc
mov ecx, esi
call fcn.00406c50
mov dword [ebp - 4], 0
mov dword [ebp - 0x234], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005255bb
mov esp, ebp
pop ebp
ret
call fcn.00525ba9
int3
Function at 0x409880
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x545ee9
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x5dd024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x238], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x234], 0
cmp dword [edx + 0x14], 8
jb 0x4098d0
mov edx, dword [edx]
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x40990f
xorps xmm0, xmm0
movups xmmword [edi], xmm0
movq qword [edi + 0x10], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x234], 1
jmp 0x4099f0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov dword [ebp - 0x220], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x220], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409965
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.00407c60
mov dword [ebp - 4], 3
lea eax, [ebp - 0x230]
push 1
sub esp, 0x18
mov dword [ebp - 0x238], esp
mov esi, esp
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x240], esp
push eax
call fcn.00406c50
mov byte [ebp - 4], 4
mov byte [ebp - 4], 3
mov ecx, esi
call fcn.00486fe0
add esp, 0x18
mov byte [ebp - 4], 5
mov byte [ebp - 4], 3
mov ecx, edi
call fcn.00487410
mov byte [ebp - 4], 3
mov dword [ebp - 0x234], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x230]
call fcn.00407f30
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005255bb
mov esp, ebp
pop ebp
ret
Function at 0x409fe0
Capabilities:
Create directory
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54620b
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x5dd024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x5e37e4]
cmp eax, dword [esi + 4]
jle 0x40a06b
push 0x5e37e4
call fcn.005259b1
add esp, 4
cmp dword [0x5e37e4], 0xffffffff
jne 0x40a06b
mov dword [ebp - 4], 0
mov ecx, 0x5e37e8
call fcn.0040a200
mov byte [ebp - 4], 0
push 0x57c6c0
call fcn.00525869
mov dword [ebp - 4], 0xffffffff
push 0x5e37e4
call fcn.00525967
add esp, 8
mov eax, dword [0x5e37ac]
cmp eax, dword [esi + 4]
jle 0x40a0e7
push 0x5e37ac
call fcn.005259b1
add esp, 4
cmp dword [0x5e37ac], 0xffffffff
jne 0x40a0e7
mov dword [ebp - 4], 2
xor eax, eax
mov dword [0x5e37c0], 0
mov dword [0x5e37c4], 0
mov dword [0x5e37c0], 0
mov dword [0x5e37c4], 7
mov word [0x5e37b0], ax
mov byte [ebp - 4], 2
push 0x57c620
call fcn.00525869
mov dword [ebp - 4], 0xffffffff
push 0x5e37ac
call fcn.00525967
add esp, 8
cmp dword [edi + 0x14], 8
mov esi, edi
mov ebx, dword [edi + 0x10]
jb 0x40a0f4
mov esi, dword [edi]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x40a111
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x40a100
push edx
push edi
lea eax, [ebp - 0x6c]
mov ecx, 0x5e37e8
push eax
call fcn.0040ad70
mov esi, dword [eax + 4]
test esi, esi
je 0x40a135
cmp esi, dword [0x5e37ec]
je 0x40a135
add esi, 0x20
jmp 0x40a13a
mov esi, 0x5e37b0
cmp dword [esi + 0x10], 0
je 0x40a15a
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40a14a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, esi
jmp 0x40a1e2
cmp dword [edi + 0x14], 8
mov edx, edi
jb 0x40a164
mov edx, dword [edi]
push ecx
lea ecx, [ebp - 0x58]
call fcn.004097b0
add esp, 4
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x40]
push edi
call fcn.00406c50
mov byte [ebp - 4], 6
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x58]
push eax
call fcn.00406c50
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x60]
mov ecx, 0x5e37e8
push eax
call fcn.0040a480
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x28]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0xb
mov ecx, eax
call fcn.00407f30
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00407f30
mov esi, dword [ebp - 0x60]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00407f30
lea eax, [esi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005255bb
mov esp, ebp
pop ebp
ret
Function at 0x40b830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54668d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5dd024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], 0
mov dword [edi], 0
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 4]
sub eax, 0x200
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 0xe
ja 0x40b8b4
push 0x10
call ebx
bt ax, 0xf
jb 0x40b958
push 0x11
call ebx
bt ax, 0xf
jb 0x40b958
push 0x12
call ebx
bt ax, 0xf
jb 0x40b958
mov eax, dword [esi + 4]
sub eax, 0x100
cmp eax, 9
ja 0x40b99e
push 0x11
call ebx
bt ax, 0xf
jae 0x40b8e2
mov eax, dword [esi + 8]
cmp eax, 0x58
je 0x40b8e2
cmp eax, 0x43
je 0x40b8e2
cmp eax, 0x56
jne 0x40b958
push 0x12
call ebx
bt ax, 0xf
jae 0x40b8fa
mov eax, dword [esi + 8]
cmp eax, 0x25
je 0x40b958
cmp eax, 0x27
je 0x40b958
cmp dword [esi + 4], 0x100
jne 0x40b99e
mov eax, dword [esi + 8]
cmp eax, 8
jne 0x40b950
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx + 0x14]
call fcn.00415580
mov dword [ebp - 0x54], eax
test eax, eax
je 0x40b927
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x40b965
mov dl, 1
call fcn.00415660
test al, al
je 0x40b965
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b5e0
mov eax, dword [esi + 8]
add eax, 0xffffff90
cmp eax, 0xb
ja 0x40b99e
mov dword [edi], 1
mov eax, 1
jmp 0x40b9a7
mov dword [edi], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.0040b5e0
mov eax, 1
jmp 0x40b9a7
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005255bb
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cc30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x546cfd
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5dd024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
je 0x40cd6a
mov eax, dword [0x5e34f8]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d0a0
mov dword [ebp - 4], 0
mov edx, eax
mov ecx, 0x5e34f8
call fcn.0040d000
mov bl, al
mov dword [ebp - 4], 0xffffffff
or esi, 0xffffffff
mov edx, dword [ebp + 8]
mov ecx, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40ccb1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x40cd0a
mov eax, dword [0x5e34f8]
mov ecx, edi
push dword [eax - 0xc]
lea eax, [ebp + 8]
push eax
call fcn.0040d230
mov dword [ebp - 4], 2
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40cd4b
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40cd4b
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40cd0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0040d160
mov dword [ebp - 4], 5
mov ecx, 0x58992c
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40cd80
test dx, dx
je 0x40cd47
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40cd80
add eax, 4
add ecx, 4
test dx, dx
jne 0x40cd25
xor edi, edi
jmp 0x40cd85
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40cd6a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
sbb edi, edi
or edi, 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
lea edx, [eax - 0x10]
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40cda4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40cd6a
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x415230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5456e0
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5dd024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4152b5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4152b5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x415297
cmp esi, edx
jae 0x4152b5
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x415285
cmp esi, edx
jae 0x4152b5
cmp word [esi], 0
je 0x4152b5
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415740
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5485e0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x5dd024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x44], 0
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x5e3834]
cmp eax, dword [ecx + 4]
jle 0x415837
push 0x5e3834
call fcn.005259b1
add esp, 4
cmp dword [0x5e3834], 0xffffffff
jne 0x415837
mov dword [ebp - 4], 1
mov dword [0x5e3838], 0
mov dword [0x5e383c], 0
mov dword [0x5e3840], 0
mov byte [ebp - 4], 2
mov dword [0x5e3844], 0
mov dword [0x5e3848], 0
mov dword [0x5e384c], 0
mov byte [ebp - 4], 3
mov dword [0x5e3850], 0
mov dword [0x5e3854], 0
mov dword [0x5e3858], 0
mov byte [ebp - 4], 1
push 0x57c970
call fcn.00525869
mov byte [ebp - 4], 0
push 0x5e3834
call fcn.00525967
add esp, 8
push 0x58a148
push str.html
mov edx, 0x58a15c
lea ecx, [ebp - 0x28]
call fcn.00409a10
add esp, 8
mov dword [ebp - 4], 5
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.00486d00
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 8
jb 0x415870
mov eax, dword [eax]
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x50], 0x5895fc
mov dword [ebp - 0x4c], edi
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x40]
call fcn.00407f30
cmp edi, 0xffffffff
jne 0x4158de
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 5
push edi
mov dword [ebp - 0x50], 0x5895fc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], 0
jmp 0x415963
mov eax, dword [0x5e383c]
lea ecx, [ebp - 0x28]
push ecx
cmp eax, dword [0x5e3840]
je 0x415906
mov ecx, eax
mov dword [ebp - 0x58], eax
call fcn.00406c50
mov byte [ebp - 4], 8
add dword [0x5e383c], 0x18
jmp 0x415911
push eax
mov ecx, 0x5e3838
call fcn.00490940
cmp dword [ebx + 0x14], 8
mov ecx, ebx
jb 0x41591b
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
lea edx, [ebp - 0x48]
push 0
push edx
add eax, eax
mov dword [ebp - 0x48], 0
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
lea ecx, [ebp - 0x28]
call fcn.00486d00
mov dword [ebp - 0x44], 1
mov byte [ebp - 4], 5
mov dword [ebp - 0x50], 0x5895fc
test edi, edi
je 0x415963
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00407f30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005255bb
mov esp, ebp
pop ebp
ret
Function at 0x4163b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54891d
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x5dd024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov edi, edx
cmp dword [edx + 0x14], 8
mov eax, dword [edx + 0x10]
jb 0x4163ea
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add eax, eax
je 0x41640b
mov edx, eax
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x4163f7
mov edx, dword [ebp + 0xc]
push esi
push edx
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.0040ad70
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x41643c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebx + 8], 0x5d1745d
je 0x41659f
lea eax, [ebx + 4]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
push 0x2c
mov dword [ebp - 0x14], 0
call fcn.005255fd
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
push dword [ebp + 0xc]
lea eax, [edi + 8]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.00406c50
mov byte [ebp - 4], 1
xorps xmm0, xmm0
movq qword [edi + 0x20], xmm0
mov dword [edi + 0x28], 0
mov dword [ebp - 4], 3
mov eax, dword [ebx + 8]
inc eax
movss xmm3, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x5a3940]
mov eax, dword [ebx + 0x1c]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
cvtpd2ps xmm0, xmm0
addsd xmm1, qword [eax*8 + 0x5a3940]
movaps xmm2, xmm0
cvtpd2ps xmm1, xmm1
divss xmm2, xmm1
comiss xmm2, xmm3
jbe 0x41652f
divss xmm0, xmm3
call fcn.0040ae00
call fcn.005452c0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [ebx + 0x1c]
cmp eax, ecx
jae 0x416513
cmp eax, 0x200
jae 0x416511
shl eax, 3
cmp eax, ecx
jae 0x416513
mov eax, ecx
push eax
mov ecx, ebx
call fcn.004166f0
push esi
lea eax, [edi + 8]
mov ecx, ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040ad70
mov edx, dword [eax]
jmp 0x416532
mov edx, dword [ebp - 0x20]
mov eax, dword [ebx + 8]
mov ecx, dword [edx + 4]
inc eax
mov dword [ebx + 8], eax
mov dword [edi], edx
mov dword [edi + 4], ecx
mov dword [ecx], edi
mov dword [edx + 4], edi
mov eax, dword [ebx + 0x18]
mov dword [ebp + 0xc], ecx
and eax, esi
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x14], 0
mov esi, dword [ecx + eax*8]
cmp esi, dword [ebx + 4]
jne 0x416565
mov dword [ecx + eax*8], edi
jmp 0x416577
cmp esi, edx
jne 0x41656e
mov dword [ecx + eax*8], edi
jmp 0x41657b
mov edx, dword [ebp + 0xc]
cmp dword [ecx + eax*8 + 4], edx
jne 0x41657b
mov dword [ecx + eax*8 + 4], edi
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.00523945
int3
Function at 0x418e80
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x418efa
mov esi, dword [esp + 0x10]
mov ecx, 1
mov edx, dword [esi]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or ecx, eax
jge 0x418eb5
push edi
mov ecx, esi
call fcn.00408d50
mov edx, dword [esi]
push edi
push edx
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x418edc
mov ecx, dword [esi]
test ecx, ecx
je 0x418ee0
push dword [ecx - 8]
push ecx
call fcn.0052d09f
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x418efa
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x418efa
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
push 0x80070057
call fcn.00408fc0
int3