joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422464
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push esi
push str.InitializeCriticalSectionEx
push 0x435e88
push str.InitializeCriticalSectionEx
push 4
call fcn.0042232c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42249c
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
pushal
pushfd
test eax, edx
jo 0x4224fd
mov ecx, 0x1d6aaf9e
mov eax, eax
xor edi, edx
sbb eax, 0xfa33c08b
and esi, edi
mov edx, eax
rol esi, 0x1f
test ebx, 0x11b20d8c
or eax, 0x417211b2
cmp esi, 0x7c6c1ff

Function at 0x4224ab
Capabilities:
Hash data using murmur3

Disassembly:
or eax, 0x417211b2
ror ecx, 6
rol esi, 0xe
neg ecx
mov dword [0x4629fc], 0x5143a75
mov eax, edx
dec esi
add eax, eax
invalid

Function at 0x4224e5
Capabilities:
Hash data using murmur3

Disassembly:
std
neg eax
sub esi, esi
mov ecx, 0x1d92a8

Function at 0x422500
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0040a6ef
rol esi, 7
test ecx, eax
jb 0x422524
neg eax
not esi
neg esi
fimul word [eax - 0x75]
sbb eax, 0x43e211
fimul word [eax - 0x75]
sbb eax, 0x43e211
shr eax, 0x19
xchg eax, eax
xor dword [0x4627ae], 0x1fca4db8
daa
inc esi
add byte [eax - 0x3ee035b3], bh
out dx, al
or al, byte [eax - 0x1e]
invalid
xchg eax, eax
inc eax
rol esi, 6
mov ecx, 0x602c44
inc esp
sub al, 0x60
add byte [ecx], cl
adc eax, 0x4627b5

Function at 0x422510
Capabilities:
Hash data using murmur3

Disassembly:
call fcn.0040a6ef
rol esi, 7
test ecx, eax
jb 0x422524
neg eax
not esi
neg esi
fimul word [eax - 0x75]
sbb eax, 0x43e211
fimul word [eax - 0x75]
sbb eax, 0x43e211
shr eax, 0x19
xchg eax, eax
xor dword [0x4627ae], 0x1fca4db8
daa
inc esi
add byte [eax - 0x3ee035b3], bh
out dx, al
or al, byte [eax - 0x1e]
invalid
xchg eax, eax
inc eax
rol esi, 6
mov ecx, 0x602c44
inc esp
sub al, 0x60
add byte [ecx], cl
adc eax, 0x4627b5

Function at 0x422530
Capabilities:
Hash data using murmur3

Disassembly:
adc esi, edi
fiadd word [edx - 0x79]
inc edx
xchg edi, eax
rol eax, 9
inc edx
dec eax

Function at 0x422533
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
adc esi, edi
fiadd word [edx - 0x79]
inc edx
xchg edi, eax
rol eax, 9
inc edx
dec eax

Function at 0x422948
Capabilities:
Hash data using murmur3

Disassembly:
push edi
inc esi
add al, ch
mov edx, 0x48fffe27

Function at 0x422953
Capabilities:
Hash data using murmur3

Disassembly:
fmul dword [ecx + 0x4626c235]
add byte [esi + 0x33], al
ret 0xc12b
invalid

Function at 0x42295e
Capabilities:
Hash data using murmur3

Disassembly:
fmul dword [ecx + 0x4626c235]
add byte [esi + 0x33], al
ret 0xc12b
invalid
Function at 0x40292e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push edx
push ecx
mov esi, dword [ebp + 0xc]
sub eax, eax
test esi, esi
je 0x4029ed
mov eax, 0x41bb10
mov edi, eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4029ed
test esi, 3
je 0x40296f
xor al, byte [esi]
inc esi
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x402958
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x4029d3
jmp 0x40297e
xor eax, dword [esi]
add esi, 4
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40297e
mov ecx, edx
test ecx, ecx
je 0x4029ed
jmp 0x4029de
xor al, byte [esi]
inc esi
movzx ebx, al
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4029de
pop ecx
pop edx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x402cf7
Capabilities:
Set file attributes

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test eax, eax
jne 0x402d0f
jmp dword [sym.imp.KERNEL32.DLL_GetLastError]
xor eax, eax
ret

Function at 0x402e7f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402e96
test al, 0x10
je 0x402e96
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x40ebb4
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x58
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret
Function at 0x40ef95
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x68
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
ret

Function at 0x40f0a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
test eax, eax
je 0x40f219
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov edi, dword [esi + 0x20]
mov dword [ebp - 8], eax
mov eax, edi
mov edx, ebx
mov cl, 3
call fcn.004184d0
push 0
push 0x40
push edx
push eax
call fcn.00418410
mov dword [ebp - 4], eax
mov ecx, ebx
mov eax, ecx
sar ecx, 0x1f
or ecx, edi
xor edx, edx
or eax, edx
mov dword [ebp - 0xc], ecx
mov ebx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edi, eax
shld ebx, edi, 8
mov ecx, eax
shrd ecx, edx, 8
shl edi, 8
xor ecx, edi
shr edx, 8
xor edx, ebx
mov edi, 0xff00ff
and ecx, edi
and edx, edi
mov edi, dword [ebp - 0xc]
shld edi, eax, 8
shl eax, 8
xor ecx, eax
xor edx, edi
mov eax, ecx
mov edi, edx
shrd eax, edi, 0x10
mov ebx, eax
mov eax, ecx
mov dword [ebp - 0xc], edx
shld edx, eax, 0x10
shl eax, 0x10
xor ebx, eax
shr edi, 0x10
xor edi, edx
mov eax, 0xffff
and ebx, eax
and edi, eax
mov eax, dword [ebp - 0xc]
shld eax, ecx, 0x10
shl ecx, 0x10
xor ebx, ecx
xor edi, eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x20], ebx
xor ebx, ebx
mov dword [esi + 0x24], edi
cmp eax, ebx
jbe 0x40f1af
mov byte [eax + esi + 0x28], 0x80
inc eax
cmp eax, 0x38
jae 0x40f17e
push 0x38
pop ecx
sub ecx, eax
push ecx
lea eax, [eax + esi + 0x28]
push ebx
push eax
call sub.msvcrt.dll_memset
jmp 0x40f1be
cmp eax, 0x40
jae 0x40f197
push 0x40
pop ecx
sub ecx, eax
push ecx
lea eax, [eax + esi + 0x28]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edi, [esi + 0x28]
push edi
push esi
call fcn.0040ed49
push 0x38
push ebx
push edi
call sub.msvcrt.dll_memset
add esp, 0x14
jmp 0x40f1c1
push 0x38
lea edi, [esi + 0x28]
push ebx
push edi
call sub.msvcrt.dll_memset
mov byte [edi], 0x80
add esp, 0xc
mov eax, dword [esi + 0x20]
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x64], eax
lea eax, [esi + 0x28]
push eax
push esi
call fcn.0040ed49
mov edi, dword [ebp - 8]
pop ecx
pop ecx
xor edx, edx
mov eax, dword [esi + edx*4]
rol eax, 0x10
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esi + edx*4], ecx
mov dword [edi], ecx
add edi, 4
inc edx
cmp edx, 8
jl 0x40f1de
push 0x68
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x411663
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xd0
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
ret
Function at 0x411ada
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [edi]
and dword [ebp - 4], 0
push ebx
mov ebx, dword [esi]
mov edx, dword [ebp - 4]
xor eax, dword [ecx + edx*4]
mov dword [ebp - 8], eax
call fcn.00411a9a
xor eax, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
mov ebx, dword [ebp - 8]
jl 0x411ae8
mov edx, eax
mov eax, dword [ecx + 0x40]
mov ecx, dword [ecx + 0x44]
xor eax, edx
xor ecx, ebx
mov dword [edi], ecx
mov dword [esi], eax
pop ebx
leave
ret

Function at 0x411b17
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0x41d070
lea ecx, [ebx + 0x48]
push edi
mov edx, 0x100
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x411b2c
cmp eax, 0x41e070
jl 0x411b27
mov edx, 0x41d028
xor ecx, ecx
mov eax, ebx
sub edx, ebx
mov dword [ebp - 8], 0x12
xor esi, esi
mov dword [ebp - 0xc], 4
mov edi, dword [ebp + 8]
movzx edi, byte [ecx + edi]
shl esi, 8
or esi, edi
inc ecx
cmp ecx, dword [ebp + 0xc]
jl 0x411b6f
xor ecx, ecx
dec dword [ebp - 0xc]
jne 0x411b5b
mov edi, dword [edx + eax]
xor edi, esi
mov dword [eax], edi
add eax, 4
dec dword [ebp - 8]
jne 0x411b52
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea esi, [ebp - 0xc]
lea edi, [ebp - 8]
mov ecx, ebx
call fcn.00411ada
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add dword [ebp - 4], 2
shl eax, 2
cmp dword [ebp - 4], 0x12
mov dword [eax + ebx], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + ebx + 4], ecx
jl 0x411b8e
lea eax, [ebx + 0x4c]
mov dword [ebp - 0x14], 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x80
lea esi, [ebp - 0xc]
lea edi, [ebp - 8]
mov ecx, ebx
call fcn.00411ada
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax - 4], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
add eax, 8
dec dword [ebp - 0x10]
mov dword [ebp - 4], eax
jne 0x411bcc
dec dword [ebp - 0x14]
jne 0x411bc2
pop edi
pop esi
leave
ret

Function at 0x411c7c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jbe 0x411ccf
mov ecx, dword [ebp + 0x10]
push ebx
push edi
mov edx, dword [ebp + 8]
mov eax, dword [esi + edx]
mov edi, dword [esi + edx + 4]
push 0x11
pop ebx
xor eax, dword [ecx + ebx*4]
mov dword [ebp - 4], eax
call fcn.00411a9a
xor eax, edi
mov edi, dword [ebp - 4]
dec ebx
cmp ebx, 1
jg 0x411c9a
mov ebx, dword [ecx]
mov edx, eax
mov eax, dword [ecx + 4]
xor eax, edx
mov edx, dword [ebp + 8]
xor ebx, edi
mov dword [esi + edx], ebx
mov dword [esi + edx + 4], eax
add esi, 8
cmp esi, dword [ebp + 0xc]
jb 0x411c8d
pop edi
pop ebx
pop esi
leave
ret
Function at 0x412721
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, dl
push ebx
push eax
mov byte [ebp - 3], dl
mov byte [ebp - 2], 0x1b
call fcn.004126fd
pop ecx
mov bl, al
mov byte [ebp - 1], 0x80
mov byte [ebp - 4], 1
mov byte [ebp - 5], 0
cmp dl, 2
jae 0x41274f
mov al, dl
jmp 0x4127c7
push esi
jmp 0x4127ba
cmp byte [ebp - 1], bl
jb 0x412783
movzx esi, bl
movzx eax, byte [ebp - 1]
cdq
idiv esi
mov cl, al
imul byte [ebp - 3]
xor byte [ebp - 2], al
mov al, byte [ebp - 4]
imul cl
xor byte [ebp - 5], al
movzx eax, byte [ebp - 2]
push eax
call fcn.004126fd
pop ecx
mov byte [ebp - 1], al
cmp al, bl
jae 0x41275a
cmp byte [ebp - 1], 0
je 0x4127c3
cmp bl, byte [ebp - 1]
jb 0x4127ba
movzx esi, byte [ebp - 1]
movzx eax, bl
cdq
idiv esi
mov cl, al
imul byte [ebp - 2]
xor byte [ebp - 3], al
mov al, byte [ebp - 5]
imul cl
xor byte [ebp - 4], al
movzx eax, byte [ebp - 3]
push eax
call fcn.004126fd
mov bl, al
pop ecx
cmp bl, byte [ebp - 1]
jae 0x412792
test bl, bl
jne 0x412752
mov al, byte [ebp - 4]
jmp 0x4127c6
mov al, byte [ebp - 5]
pop esi
pop ebx
leave
ret

Function at 0x4127ca
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
inc eax
xor ecx, ecx
mov edx, eax
and dl, 0x80
movzx edx, dl
neg edx
sbb edx, edx
mov dword [ecx + 0x825560], eax
and edx, 0x11b
add eax, eax
add ecx, 4
xor eax, edx
cmp ecx, 0x74
jb 0x4127cf
push ebx
xor ebx, ebx
mov dl, bl
call fcn.00412721
movzx eax, al
lea ecx, [eax + eax]
xor ecx, eax
add ecx, ecx
xor ecx, eax
add ecx, ecx
xor ecx, eax
add ecx, ecx
xor eax, ecx
mov ecx, eax
shr ecx, 8
xor cl, al
xor cl, 0x63
mov byte [ebx + 0x8255e0], cl
movzx ecx, bl
mov eax, ecx
shl eax, 3
xor eax, ecx
shl eax, 2
xor eax, ecx
add eax, eax
mov edx, eax
shr edx, 8
xor dl, al
xor dl, 5
call fcn.00412721
mov byte [ebx + 0x8256e0], al
inc ebx
cmp ebx, 0x100
jb 0x4127f6
mov byte [0x81f9d0], 1
pop ebx
ret
Function at 0x415d43
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x1c]
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_IsBadWritePtr]
test eax, eax
je 0x415d62
xor eax, eax
jmp 0x415df3
push edi
push ebx
xor edi, edi
push edi
push dword [ebp + 0x18]
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 0xc], edi
je 0x415df0
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415ddf
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x415dcb
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call esi
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
cmp dword [ebp - 0xc], edi
jne 0x415de4
xor eax, eax
inc eax
jmp 0x415df2
cmp dword [ebp + 0x14], edi
je 0x415df0
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x18]
call fcn.004018bd
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x415df6
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push edi
push dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.DLL_IsBadWritePtr]
test eax, eax
je 0x415e18
xor eax, eax
jmp 0x415f96
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
mov byte [edi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
je 0x415e35
xor eax, eax
jmp 0x415f95
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov byte [ebp - 0x118], bl
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x415e9f
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 8]
test eax, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
je 0x415e93
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 0x14]
push edi
call fcn.004018bd
xor eax, eax
inc eax
jmp 0x415f95
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x220]
push eax
call ebx
mov eax, dword [ebp + 0xc]
cmp eax, 0x26
jne 0x415ed3
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x220]
push eax
push str.ProgramFilesDir
jmp 0x415eec
cmp eax, 0x2b
jne 0x415ef8
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x220]
push eax
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
jmp 0x415f51
cmp eax, 0x1a
jne 0x415f13
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x220]
push eax
push str.AppData
jmp 0x415f47
cmp eax, 0x1c
jne 0x415f2e
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x220]
push eax
push str.Local_AppData
jmp 0x415f47
cmp eax, 5
jne 0x415f6e
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x220]
push eax
push str.My_Pictures
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.00415d43
add esp, 0x18
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 0x14]
push edi
call fcn.004018bd
xor eax, eax
inc eax
jmp 0x415f94
cmp eax, 0x25
jne 0x415f7f
push dword [ebp + 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
jmp 0x415f8a
cmp eax, 0x24
jne 0x415f92
push dword [ebp + 0x14]
push edi
call ebx
neg eax
sbb eax, eax
neg eax
jmp 0x415f94
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret

Function at 0x415f99
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0xffffffff
jne 0x415fb3
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
xor eax, eax
inc eax
pop ebp
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call fcn.00415df6
add esp, 0x10
pop ebp
ret
Function at 0x416532
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x818]
push 0x800
push eax
mov ebx, 0x4194d2
push ebx
push 0x4194d0
push str.description
call esi
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenA]
lea eax, [ebp - 0x818]
push eax
call edi
test eax, eax
jne 0x41657c
xor eax, eax
jmp 0x4165f6
and dword [ebp - 4], 0
push 0xa
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll__itoa]
add esp, 0xc
push dword [ebp + 8]
lea eax, [ebp - 0x818]
push 0x800
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push str.data
call esi
lea eax, [ebp - 0x818]
push eax
call edi
test eax, eax
je 0x416578
lea eax, [ebp - 0x818]
push eax
call fcn.00416505
pop ecx
test eax, eax
je 0x416578
mov ecx, dword [ebp - 4]
push eax
mov dword [ecx*4 + 0x81fe78], eax
call fcn.004160ba
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x4a
pop ecx
jl 0x416580
push 4
push 0x22
call fcn.004160ff
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4167af
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [0x81feb8]
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [0x81fe78]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 1
push ebx
call esi
push dword [0x81fe80]
push 7
push ebx
call esi
push dword [0x81fe84]
push 2
push ebx
call esi
push dword [0x81fed0]
push 0x454
push ebx
call esi
push dword [0x81fec8]
mov edi, 0x110
push edi
push 0x81fd68
call fcn.004018bd
push dword [0x81fecc]
push edi
push 0x81fc58
call fcn.004018bd
push edi
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x81fb44
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
cmp dword [ebp - 0x164], 0
je 0x41687c
push dword [ebp - 0x164]
push 1
push 0x172
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push dword [ebp - 0x164]
push 1
push 0x172
push 0x450
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push dword [0x81fec0]
push 0x452
push ebx
call esi
push dword [0x81fec4]
push 0x453
push ebx
call esi
push dword [0x81febc]
lea eax, [ebp - 0x378]
push edi
push eax
call fcn.004018bd
lea eax, [ebp - 4]
push eax
push 0x104
lea eax, [ebp - 0x268]
push eax
xor edi, edi
push edi
push edi
lea eax, [ebp - 0x378]
push eax
push 0x2400
mov dword [ebp - 4], 0x81fb44
call dword [sym.imp.KERNEL32.DLL_FormatMessageA]
lea eax, [ebp - 0x268]
push eax
push 0x44d
push ebx
call esi
push 0x81fb18
push 0x44f
push ebx
call fcn.004162ca
push 0x81f9d8
push 0x451
push ebx
call fcn.004162ca
add esp, 0x18
push str.SHELL32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
cmp esi, edi
je 0x416945
push 0x92
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
cmp eax, edi
je 0x41693e
push edi
push eax
push 0x170
push 0x455
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
push dword [0x821f5c]
push ebx
call fcn.0041612b
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41779d
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
call fcn.00417412
mov dword [0x822bc8], eax
test eax, eax
jne 0x4179ad
push ebx
mov ebx, 0x110
push ebx
lea eax, [ebp - 0x114]
push eax
push 0x3ea
push dword [0x821f5c]
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jne 0x4177fd
push ebx
lea eax, [ebp - 0x114]
push eax
push 0x821f68
call fcn.0040326c
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x8218f8
call fcn.004018bd
cmp dword [0x821b1c], 0
je 0x417834
push 0x3eb
push dword [0x821f5c]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
neg eax
sbb eax, eax
neg eax
mov dword [0x822bb0], eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 1
push dword [0x821f5c]
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
push 0
push 9
push dword [0x821f5c]
call esi
push eax
call edi
push 0
push 0x3f2
push dword [0x821f5c]
call esi
push eax
call edi
push 0
push 0x3eb
push dword [0x821f5c]
call esi
push eax
call edi
push 5
push 0x41a
push dword [0x821f5c]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x114]
push eax
call fcn.00417613
and dword [ebp - 4], 0
mov dword [0x822bc8], eax
mov dword [esp], 0x821a0c
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jle 0x4178d9
push 0x3ec
push dword [0x821f5c]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
neg eax
sbb eax, eax
neg eax
jmp 0x4178dc
mov eax, dword [ebp - 4]
cmp dword [0x822bc8], 0
jne 0x4179aa
test eax, eax
je 0x4179aa
push 0
push 0x3ec
push dword [0x821f5c]
call esi
push eax
call edi
lea eax, [ebp - 0x114]
push eax
call fcn.00402ed5
pop ecx
mov esi, 0x821a0c
push esi
push ebx
lea eax, [ebp - 0x114]
push eax
call fcn.00402086
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.0040326c
lea eax, [ebp - 0x224]
push eax
call fcn.00402f07
push ebx
lea eax, [ebp - 0x334]
push eax
push esi
call fcn.0040322f
add esp, 0x1c
lea eax, [ebp - 0x444]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
mov esi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryA]
lea eax, [ebp - 0x224]
push eax
call esi
push 5
push 0
push 0x822078
lea eax, [ebp - 0x334]
push eax
push str.open
push dword [0x821f5c]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x4179a1
mov dword [0x822bc8], 0x6d67
lea eax, [ebp - 0x444]
push eax
call esi
pop edi
pop esi
pop ebx
leave
ret