joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409570
Capabilities:
Create process on windows
Set current directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41b5a8
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x4095c1
mov ecx, dword [0x42a950]
push str.CSyncEngine::ProcessRegisterFile2ByRegSvr32__Unknown_file_path.
push 4
push ecx
call fcn.00404890
add esp, 0xc
or eax, 0xffffffff
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
mov edx, dword [esi]
mov eax, dword [0x42a950]
push edi
push edx
push str.CSyncEngine::ProcessRegisterFile2ByRegSvr32__Target_file___s
push 1
push eax
call fcn.00404890
add esp, 0x10
mov ecx, esi
push 0x5c
call sub.MFC42.DLL_CString::ReverseFind
mov edi, eax
lea ecx, [esp + 0xc]
push edi
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
inc edi
lea edx, [esp + 8]
push edi
push edx
mov ecx, esi
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::Mid
mov eax, dword [esp + 0xc]
mov byte [esp + 0x18], 1
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [esp + 8]
mov edx, dword [0x42a804]
push ecx
push edx
lea eax, [esp + 0x28]
push str._s_regsvr32.exe__s__s
push eax
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x30]
mov edx, dword [0x42a950]
add esp, 0x10
push ecx
push str.CSyncEngine::ProcessRegisterFile2ByRegSvr32__Cmd_Str___s
push 1
push edx
call fcn.00404890
mov eax, dword [esp + 0x30]
add esp, 0x10
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
pop edi
jg 0x4096e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
mov edx, dword [0x42a950]
push eax
push ecx
push str.CSyncEngine::ProcessRegisterFile2ByRegSvr32__WinExec__s__Fail__ErrCode___d
push 4
push edx
call fcn.00404890
mov ecx, dword [0x42a950]
add esp, 0x14
call fcn.00404d50
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
mov ecx, dword [0x42a950]
push eax
mov eax, dword [esi]
push eax
push str.CSyncEngine::ProcessRegisterFile2ByRegSvr32__File__s__is_registered._RetVal___d
push 2
push ecx
call fcn.00404890
add esp, 0x14
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xc]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x4098d0
Capabilities:
Create process on windows
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x41b610
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov byte [esp + 0x20], 1
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x14]
mov eax, dword [0x42a950]
push ecx
push edx
push str.CSyncEngine::ProcessRegisterFileByRegAsm__Cmd_Str_:__s__silent__s
push 1
push eax
call fcn.00404890
add esp, 0x14
mov ecx, esi
push 0x5c
call sub.MFC42.DLL_CString::ReverseFind
mov edi, eax
lea ecx, [esp + 0x10]
push edi
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
inc edi
lea edx, [esp + 0xc]
push edi
push edx
mov ecx, esi
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::Mid
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], 3
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea ecx, [esp + 0x2c]
push str.__silent
lea edx, [esp + 0x18]
push ecx
push edx
call sub.MFC42.DLL_operator_2
lea ecx, [esp + 0xc]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x2c], 4
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 5
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x20], 3
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jg 0x409a44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esi]
mov edx, dword [0x42a950]
push eax
push ecx
push str.CSyncEngine::ProcessRegisterFileByRegAsm__WinExec__s__Fail__ErrCode___d
push 4
push edx
call fcn.00404890
mov ecx, dword [0x42a950]
add esp, 0x14
call fcn.00404d50
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
mov ecx, dword [0x42a950]
push eax
mov eax, dword [esi]
push eax
push str.CSyncEngine::ProcessRegisterFileByRegAsm__File__s__is_registered._RetVal___d
push 2
push ecx
call fcn.00404890
add esp, 0x14
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x409ac0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
push edi
push 0x42a5c8
mov ecx, dword [esi + 0x2c]
add ecx, 0x37c
call fcn.00403990
mov ecx, dword [esi + 0x2c]
push 0x426e68
add ecx, 0x434
call fcn.00403990
mov edi, dword [esi + 0x38]
test edi, edi
je 0x409b62
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
mov edi, dword [edi]
mov esi, dword [eax + 8]
cmp dword [esi + 0x1c], 4
jne 0x409b57
mov eax, dword [esi + 0x14]
mov ecx, dword [0x42a950]
push eax
push str.CSyncEngine::HandleDeleteTypeFiles__Delete_Local_Flle___s
push 2
push ecx
call fcn.00404890
mov eax, dword [esi + 0x14]
add esp, 0x10
push eax
call ebx
test eax, eax
jne 0x409b57
call ebp
mov edx, dword [esi + 0x14]
push eax
mov eax, dword [0x42a950]
push edx
push str.CSyncEngine::HandleDeleteTypeFiles__DeleteFile__s__Error__ErrCode___d
push 2
push eax
call fcn.00404890
mov ecx, dword [0x42a950]
add esp, 0x14
call fcn.00404d50
test edi, edi
jne 0x409aff
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x40bd90
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41b880
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edx, dword [0x42a950]
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
push eax
push ecx
push str.CSyncEngine::GetProcessHandleByShellExecute__File_s__Parameters_s
mov esi, 1
push 2
push edx
mov dword [esp + 0x64], esi
call fcn.00404890
mov eax, dword [esp + 0x6c]
xor ebx, ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0x500
mov dword [esp + 0x2c], str.runas
mov ecx, dword [eax - 8]
add esp, 0x14
cmp ecx, ebx
je 0x40be16
mov dword [esp + 0x20], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], esi
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x40be86
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x42a950]
push eax
push str.CSyncEngine::GetProcessHandleByShellExecute__ShellExecuteEx___Fail__ErrNo___d
push 2
push edx
call fcn.00404890
add esp, 0x10
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x5c]
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret 8
mov esi, dword [esp + 0x44]
lea ecx, [esp + 0x58]
mov byte [esp + 0x50], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x5c]
mov dword [esp + 0x50], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x48]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 8
Function at 0x40f3f0
Capabilities:
Create directory
Create shortcut via ishelllink
Get common file path

Disassembly:
sub esp, 0xe08
push esi
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x411]
mov byte [esp + 0x410], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x211]
mov byte [esp + 0x210], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0
lea eax, [esp + 0x414]
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov ecx, dword [esp + 0xe14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x410]
push ecx
push edx
lea eax, [esp + 0x218]
push str._s_s
push eax
call esi
add esp, 0x10
lea ecx, [esp + 0x210]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40f499
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40f499
pop edi
or eax, 0xffffffff
pop esi
add esp, 0xe08
ret 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 8]
push edx
push 0x420314
push 1
push 0
push 0x420324
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40f5c2
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push 0x420334
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x40f5b8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xe1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0xe20]
test eax, eax
je 0x40f505
mov ecx, dword [esp + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0xe18]
lea ecx, [esp + 0x210]
push eax
push ecx
lea edx, [esp + 0x18]
push str._s_s.lnk
push edx
call esi
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x620]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x610]
push 0x104
push eax
lea ecx, [esp + 0x18]
push 0xffffffffffffffff
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x610]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
test eax, eax
je 0x40f593
mov eax, dword [0x42a950]
lea edx, [esp + 0x10]
push edx
push str.CXSyncApp::CreateProgramLink__Failed_to_create_link_on_the_desktop.___s_
push 4
push eax
jmp 0x40f5a6
mov edx, dword [0x42a950]
lea ecx, [esp + 0x10]
push ecx
push str.CXSyncApp::CreateProgramLink__Create_link_generation_successfully_on_the_desktop.___s_
push 1
push edx
call fcn.00404890
mov eax, dword [esp + 0x1c]
add esp, 0x10
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
xor eax, eax
pop esi
add esp, 0xe08
ret 0x10
Function at 0x40f5e0
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
sub esp, 0xc08
push edi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x20d]
mov byte [esp + 0x20c], 0
push 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x210]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 4]
push ecx
push 0x420314
push 1
push 0
push 0x420324
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40f743
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0x420334
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
jl 0x40f739
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc14]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x50]
mov eax, dword [esp + 0xc18]
test eax, eax
je 0x40f682
mov ecx, dword [esp + 4]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0xc10]
lea ecx, [esp + 0x20c]
push eax
push ecx
lea edx, [esp + 0x14]
push str._s_s.lnk
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x41c]
add esp, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40c]
push 0x104
push eax
lea ecx, [esp + 0x14]
push 0xffffffffffffffff
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0x40c]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
test eax, eax
je 0x40f714
mov eax, dword [0x42a950]
lea edx, [esp + 0xc]
push edx
push str.CXSyncApp::CreateDesktopLink__Failed_to_create_link_on_the_desktop.___s_
push 4
push eax
jmp 0x40f727
mov edx, dword [0x42a950]
lea ecx, [esp + 0xc]
push ecx
push str.CXSyncApp::CreateDesktopLink__Create_link_generation_successfully_on_the_desktop.___s_
push 1
push edx
call fcn.00404890
mov eax, dword [esp + 0x18]
add esp, 0x10
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop edi
add esp, 0xc08
ret 0xc
Function at 0x40fb90
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41bfdb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x240
push ebx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xc]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov ecx, 0x7f
lea edi, [esp + 0x49]
mov byte [esp + 0x48], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x25c]
lea ecx, [esp + 0x48]
push eax
push 0x424030
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [esp + 0x264]
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x3c
mov eax, dword [edx]
push ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], str.runas
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp eax, ebx
jne 0x40fc84
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x250], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0xc]
push str.Cant_Execute_Version_Management_Program__ErrCode___d
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x14]
add esp, 0xc
push ebx
push ebx
push eax
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp + 8]
mov dword [esp + 0x250], 0xffffffff
call sub.MFC42.DLL_CString::CString
or ax, 0xffff
jmp 0x40fc92
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ax, ax
mov ecx, dword [esp + 0x248]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24c
ret 8
Function at 0x40fcb0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x41c006
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], 0
rep stosd dword es:[edi], eax
mov ecx, 0x11
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x270], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x274]
mov edx, dword [esp + 0x278]
push edx
lea edx, [esp + 0x64]
mov ecx, dword [eax]
mov dword [esp + 0x2c], 0x42877c
push ecx
push str._s__s
push edx
mov dword [esp + 0x58], 1
mov word [esp + 0x5c], 5
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x60]
push eax
push ecx
push 0
push 0
push 0x30
push 0
push 0
push 0
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
jne 0x40fdfc
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_2
mov byte [esp + 0x268], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 4]
push str.Cant_Execute_Version_Management_Program__ErrCode___d
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0xc]
add esp, 0xc
push 0
push 0
push ecx
call sub.MFC42.DLL_AfxMessageBox_1
lea ecx, [esp]
mov byte [esp + 0x268], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 4]
mov dword [esp + 0x268], 0xffffffff
call sub.MFC42.DLL_CString::CString
or ax, 0xffff
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
add esp, 0x26c
ret 8
mov edx, dword [esp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
lea ecx, [esp + 8]
mov dword [esp + 0x26c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x264]
xor ax, ax
pop esi
mov dword fs:[0], ecx
add esp, 0x26c
ret 8
Function at 0x4153a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4153ab
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x4154ae
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x41f890]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x41f890]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x41f890]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x41f890]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x41f890]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x41f890]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x41f890]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x41f890]
xor eax, edx
inc ecx
dec edi
jne 0x4153c6
pop edi
test esi, esi
je 0x4154d0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x41f890]
xor eax, edx
inc ecx
dec esi
jne 0x4154b2
pop esi
pop ebx
not eax
ret

Function at 0x415e20
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
mov cl, byte [ebx]
mov eax, ebp
imul eax, dword [esp + 0x14]
test cl, cl
je 0x415e61
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0xc]
push 0
push ecx
push eax
mov eax, dword [ebx + 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x415e56
mov byte [ebx + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x14]
push esi
push edi
lea esi, [edx + eax]
cmp esi, ecx
jbe 0x415e74
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x10]
mov edi, dword [esp + 0x14]
mov ecx, eax
add esi, edx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x18]
pop edi
add ecx, eax
pop esi
div ebp
mov dword [ebx + 0x18], ecx
pop ebp
pop ebx
ret
Function at 0x416df0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
push edi
cmp dword [ebp], 0
jne 0x416ea8
cmp dword [ebp + 4], 0xffffffff
jne 0x416ea8
push ebx
lea ebx, [ebp + 0x138]
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, 0x424094
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
cmp esi, 1
jne 0x416e6d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x416e6d
pop edi
pop esi
mov eax, 0x2000000
pop ebp
pop ecx
ret 0xc
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0xc]
push eax
push esi
push ecx
push edi
call fcn.00415bb0
add esp, 0x10
test eax, eax
jne 0x416e90
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
push eax
call fcn.004160f0
add esp, 4
mov dword [ebp], eax
mov eax, dword [0x42b194]
pop edi
pop esi
pop ebp
pop ecx
ret 0xc
pop edi
pop esi
mov eax, 0x1000000
pop ebp
pop ecx
ret 0xc

Function at 0x4172e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x214]
test ebx, ebx
je 0x4173a8
mov al, byte [ebx]
test al, al
je 0x4173a8
push esi
push edi
mov esi, ebx
mov ecx, ebx
cmp al, 0x2f
je 0x41730e
cmp al, 0x5c
jne 0x417310
mov esi, ecx
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x417306
mov edi, dword [esp + 0x218]
cmp esi, ebx
je 0x417345
sub esi, ebx
lea eax, [esp + 0xc]
push esi
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__mbsnbcpy]
lea ecx, [esp + 0x18]
mov byte [esp + esi + 0x18], 0
push ecx
push edi
call fcn.004172e0
add esp, 0x14
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x110]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
pop ebx
add esp, 0x208
ret