joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401717
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
lea ecx, [esi + 8]
call fcn.0040d7e3
push dword [ebp + 0xc]
lea edi, [esi + 0xc]
mov ecx, edi
call fcn.00401506
push 0x5c
mov ecx, edi
call fcn.00401606
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x401479
push edi
push edi
mov dword [0x41a5b8], esi
mov dword [0x41a5c0], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x41a5e8], 2
mov dword [0x41a5bc], eax
je 0x401774
call fcn.00407971
push 0xffffffffffffffff
push dword [0x41a5bc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x41a5c0]
cmp eax, edi
mov dword [0x41a654], edi
je 0x4017c4
cmp eax, 1
je 0x4017b8
cmp eax, 2
je 0x4017b4
cmp eax, 3
je 0x4017b0
cmp eax, 0x67
jle 0x4017aa
cmp eax, 0x6a
jle 0x401819
push eax
push 0x14
push edi
jmp 0x401811
push 0x12
jmp 0x4017ba
push 0x13
jmp 0x4017ba
push 0x11
push edi
call fcn.00407845
pop ecx
pop ecx
jmp 0x401819
cmp dword [0x41a658], edi
jne 0x401819
lea eax, [ebp + 8]
push eax
push dword [0x41a5bc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
mov ecx, dword [ebp + 8]
je 0x4017eb
cmp ecx, edi
jne 0x4017eb
xor eax, eax
jmp 0x40181e
mov eax, 0x80070000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x4017fd
push ecx
push 0x21
jmp 0x4017ad
and ecx, 0xffff
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.00407845
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 8

Function at 0x401b99
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401bda
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x401bbc
push eax
jmp 0x401bd0
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401bda
test al, 0x10
jne 0x401bda
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
xor eax, eax
inc eax
pop esi
ret
Function at 0x401fc1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push esi
push edi
push 0x40
lea eax, [ebp - 0x68]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x402141
push str.STATIC
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402141
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 0xe
je 0x402141
push str.IMAGES
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx eax, ax
push eax
xor esi, esi
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
cmp ebx, esi
je 0x402141
push ebx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, esi
je 0x402141
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x402141
push ebx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, 0x10
jb 0x402141
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
push dword [ebp - 0x10]
mov edi, eax
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 8]
push eax
push esi
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40213a
cmp dword [ebp - 8], esi
je 0x40213a
lea eax, [ebp - 0xc]
push eax
push 0x4168b0
push esi
push esi
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0xc]
cmp eax, esi
je 0x402141
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 4], esi
je 0x40212c
push dword [ebp - 4]
call fcn.00401e96
pop ecx
lea ecx, [ebp - 0x28]
push ecx
push 0x18
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push 6
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp - 4]
push esi
push 0x172
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
inc eax
jmp 0x402143
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026e4
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x412e61
call fcn.00412800
sub esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.004015ee
and dword [ebp - 4], 0
cmp dword [ebp - 0x10], 1
jg 0x40270d
push 1
lea ecx, [ebp - 0x18]
call fcn.004013d6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push 1
push dword [ebp - 0x18]
push eax
call esi
test eax, eax
jne 0x402735
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x402768
push ebx
mov ebx, dword [edi]
inc eax
push eax
push eax
lea ecx, [ebp - 0x18]
call fcn.00402148
push eax
push ebx
call esi
lea ecx, [ebp - 0x18]
call fcn.004023bd
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.0040153f
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x402b30
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
mov eax, 0x412ee2
call fcn.00412800
sub esp, 0x25c
push ebx
push esi
push edi
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00402384
and dword [ebp - 4], 0
push 0x4153b4
lea ecx, [ebp - 0x18]
call fcn.004023d5
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
je 0x402c17
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00401506
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.00401606
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x18]
call fcn.004023d5
test byte [ebp - 0x268], 0x10
je 0x402be2
push 0x4153b0
lea eax, [ebp - 0x23c]
push eax
call ebx
test eax, eax
je 0x402bfa
push 0x4153a8
lea eax, [ebp - 0x23c]
push eax
call ebx
test eax, eax
je 0x402bfa
push dword [ebp - 0x18]
call fcn.00402b30
pop ecx
jmp 0x402bf6
push 0
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x402c34
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x402c34
lea eax, [ebp - 0x268]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402b86
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0
push dword [ebp + 8]
call esi
test eax, eax
je 0x402c34
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x402c34
xor esi, esi
inc esi
jmp 0x402c36
xor esi, esi
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x402c54
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
cmp dword [0x41a660], 0
je 0x402c61
xor eax, eax
inc eax
ret
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402c77
xor eax, eax
inc eax
pop esi
ret
test al, 0x10
jne 0x402c95
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x402c91
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret
xor eax, eax
pop esi
ret
push esi
call fcn.00402b30
pop ecx
pop esi
ret

Function at 0x402f01
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x412f4a
call fcn.00412800
sub esp, 0x18
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push edi
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call esi
lea ecx, [ebp - 0x24]
mov edi, eax
call fcn.004015ee
lea eax, [edi + 2]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
call fcn.00402148
inc edi
push edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x24]
call fcn.00402148
push eax
push dword [ebp + 0xc]
call esi
lea ecx, [ebp - 0x24]
call fcn.004023bd
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call fcn.004014d4
push dword [ebp - 0x24]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x403058
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x403075
xor eax, eax
jmp 0x4030ce
test al, 0x10
je 0x403086
push 0x10
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
jmp 0x4030ce
mov eax, dword [0x41a5ec]
test eax, eax
je 0x4030c2
cmp eax, 2
jne 0x4030cb
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4030c2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 0xc]
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jge 0x4030cb
push esi
call fcn.0040302b
pop ecx
jmp 0x4030ce
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x4033b6
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x412fa2
call fcn.00412800
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
push edi
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x10], ebx
call fcn.00402384
xor esi, esi
cmp dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
jg 0x4033f1
push esi
lea ecx, [ebp - 0x24]
call fcn.004013d6
mov ax, word [edi + ebx*2 - 2]
cmp ax, 0x5c
mov edi, dword [ebp - 0x24]
je 0x403405
cmp ax, 0x2f
jne 0x40340e
mov word [edi + ebx*2 - 2], si
dec ebx
mov dword [ebp - 0x10], ebx
mov esi, ebx
jmp 0x403434
mov ax, word [edi + esi*2]
cmp ax, 0x2f
je 0x403427
cmp ax, 0x5c
je 0x403427
dec esi
test esi, esi
jg 0x403412
test esi, esi
je 0x4034ce
and word [edi + esi*2], 0
push edi
call fcn.00401b99
test eax, eax
pop ecx
je 0x403423
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x403468
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.00403058
test eax, eax
pop ecx
pop ecx
jne 0x403502
push edi
call fcn.00401b99
test eax, eax
pop ecx
je 0x4034cb
cmp esi, ebx
jge 0x4034f0
mov eax, dword [ebp - 0x10]
sub eax, esi
inc eax
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi*2]
push eax
lea ebx, [edi + esi*2]
push ebx
call sub.msvcrt.dll_memcpy
xor edx, edx
add esp, 0xc
cmp word [ebx], dx
je 0x403499
inc esi
lea eax, [edi + esi*2]
jmp 0x4034b0
mov cx, word [eax]
cmp cx, 0x5c
je 0x4034b5
cmp cx, 0x2f
je 0x4034b5
inc esi
inc eax
inc eax
cmp word [eax], dx
jne 0x40349e
push edi
mov word [edi + esi*2], dx
call fcn.00401b99
test eax, eax
pop ecx
je 0x4034cb
cmp esi, dword [ebp - 0x10]
jl 0x403477
jmp 0x4034f0
push edi
jmp 0x4034f6
cmp ebx, 2
mov ecx, dword [ebp + 8]
jne 0x4034f5
mov ax, word [ecx]
or ax, 0x20
cmp ax, 0x61
jb 0x4034f5
cmp ax, 0x7a
ja 0x4034f5
cmp word [ecx + 2], 0x3a
jne 0x4034f5
xor esi, esi
inc esi
jmp 0x403504
push ecx
push 0xc
push 1
call fcn.00407845
add esp, 0xc
xor esi, esi
or dword [ebp - 4], 0xffffffff
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x403cb6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
xor edi, edi
cmp dword [0x41a010], esi
je 0x403ce0
mov eax, 0x41a010
mov ecx, eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 8]
je 0x403ce0
add eax, 0x10
inc edi
cmp dword [eax], esi
mov ecx, eax
jne 0x403ccf
shl edi, 4
mov eax, dword [edi + 0x41a01c]
cmp eax, esi
jne 0x403da1
cmp dword [0x41a248], 0xffffffff
jne 0x403d05
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x41a248], eax
cmp word [0x41a244], 0xffff
jne 0x403d1c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [0x41a244], ax
mov ax, word [0x41a240]
cmp ax, 0xffff
jne 0x403d33
call fcn.00401daf
mov word [0x41a240], ax
mov ecx, dword [edi + 0x41a018]
cmp ecx, esi
push ebx
mov ebx, dword [edi + 0x41a014]
mov dword [ebp - 4], esi
je 0x403d6d
mov edx, 0x419
cmp dword [0x41a248], edx
je 0x403d62
cmp word [0x41a244], dx
je 0x403d62
cmp ax, dx
jne 0x403d6d
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi + 4]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
lea ecx, [esi + 1]
push ecx
push eax
push esi
push ebx
push 0
push dword [ebp - 4]
mov dword [edi + 0x41a01c], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [edi + 0x41a01c]
pop ebx
pop edi
pop esi
leave
ret

Function at 0x4042f0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov eax, 0x413120
call fcn.00412800
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
call fcn.004015ee
xor esi, esi
inc esi
cmp dword [ebp - 0x14], 2
mov dword [ebp - 4], esi
jg 0x404323
push 2
lea ecx, [ebp - 0x1c]
call fcn.004013d6
mov edi, dword [ebp - 0x1c]
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
call esi
xor ecx, ecx
cmp eax, ebx
mov word [edi], bx
mov dword [ebp - 0x18], ecx
jbe 0x404357
lea edi, [eax + 1]
push edi
lea ecx, [ebp - 0x1c]
call fcn.00402148
push eax
push edi
call esi
lea ecx, [ebp - 0x1c]
call fcn.004023bd
mov ecx, dword [ebp - 0x18]
lea edi, [ecx + 0xf]
lea esi, [ecx + ecx]
push edi
lea ecx, [ebp - 0x1c]
call fcn.00402148
push ebx
push dword [ebp + 0xc]
add eax, esi
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.004023bd
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404395
inc ebx
cmp ebx, 0xfff
jl 0x40435d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004014d4
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], 1
mov byte [ebp - 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4043c7
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x413132
call fcn.00412800
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x41a648], esi
jle 0x40442b
mov eax, dword [0x41a64c]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
lea ecx, [ebp - 0x18]
call fcn.004014d4
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00403e24
mov eax, dword [0x41a64c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
pop ecx
push dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
inc esi
cmp esi, dword [0x41a648]
pop ecx
jl 0x4043df
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x404d5e
Capabilities:
Get common file path

Disassembly:
mov eax, 0x413237
call fcn.00412800
sub esp, 0x2a4
push ebx
push esi
push edi
push 3
call fcn.00403cb6
push 2
mov dword [0x41a5e4], eax
call fcn.00403cb6
push 5
mov dword [0x41a5e0], eax
call fcn.00403cb6
push 0x15
mov dword [0x41a5dc], eax
call fcn.00403cb6
push 0x16
mov dword [0x41a5d8], eax
call fcn.00403cb6
push 0x17
mov dword [0x41a5d4], eax
call fcn.00403cb6
xor edi, edi
add esp, 0x18
mov dword [0x41a5d0], eax
mov dword [0x41a5c8], edi
mov dword [0x41a5cc], edi
xor ebx, ebx
mov esi, 0x41a640
push edi
push ebx
lea eax, [ebp - 0x2b0]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x404e79
push ebx
lea eax, [ebp - 0xa4]
push str.7zSfxFolder_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x24]
call fcn.00402334
lea eax, [ebp - 0xa4]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], edi
call fcn.00401506
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401506
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00402f8d
cmp dword [edi + 0x41a280], ebx
jne 0x404e63
push dword [edi + 0x41a284]
lea ecx, [ebp - 0x24]
call fcn.00401506
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401506
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00402f8d
add edi, 8
cmp edi, 0x28
jb 0x404e33
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00401ca7
xor edi, edi
inc ebx
cmp ebx, 0x40
jl 0x404dd1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x408720
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x408728
mov dword [ecx*4 + 0x41a7a0], eax
inc ecx
cmp ecx, 0x100
jb 0x408723
pop esi
ret

Function at 0x40874f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
mov eax, ecx
mov ecx, edx
jbe 0x408776
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x41a7a0]
inc ecx
dec esi
jne 0x40875c
pop esi
ret 4

Function at 0x40d726
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x413b6f
call fcn.00412800
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
push 8
pop edi
mov edx, 0x4164fc
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x416520
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.0040f3cb
push dword [esi + 8]
mov ecx, ebx
call fcn.0040f3cb
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f3cb
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f3cb
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x40d732
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x413b6f
call fcn.00412800
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
mov dword [ebp - 4], eax
mov dword [esi + 4], eax
mov ecx, dword [ebp + 8]
mov dword [esi + 8], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0x10]
push 8
pop edi
mov edx, 0x4164fc
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], edi
mov dword [ecx], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x24], edx
lea ebx, [esi + 0x38]
mov edx, 0x416520
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], 4
mov dword [ebx], edx
lea edi, [esi + 0x4c]
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 4
mov dword [edi], edx
push dword [esi + 8]
mov byte [ebp - 4], 5
call fcn.0040f3cb
push dword [esi + 8]
mov ecx, ebx
call fcn.0040f3cb
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f3cb
push dword [esi + 0xc]
mov ecx, edi
call fcn.0040f3cb
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x40e515
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e53b
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40e53b
xor al, al
jmp 0x40e55b
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00412980
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x40fd6f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.msvcrt.dll__beginthreadex]
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.0040fd36
add esp, 0x1c
leave
ret
Function at 0x412a82
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x4168d8
call fcn.00412a30
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x400000], 0x5a4d
jne 0x412ad6
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x412ad6
movzx ecx, word [eax + 0x400018]
cmp ecx, 0x10b
je 0x412aee
cmp ecx, 0x20b
je 0x412adb
mov dword [ebp - 0x1c], ebx
jmp 0x412b05
cmp dword [eax + 0x400084], 0xe
jbe 0x412ad6
xor ecx, ecx
cmp dword [eax + 0x4000f8], ebx
jmp 0x412aff
cmp dword [eax + 0x400074], 0xe
jbe 0x412ad6
xor ecx, ecx
cmp dword [eax + 0x4000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x41aba4], edi
mov dword [0x41aba8], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x41a78c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x41a788]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x41aba0], eax
call fcn.00412d58
cmp dword [0x41a5b0], ebx
jne 0x412b62
push fcn.00412d58
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00412d46
push 0x415344
push 0x415340
call sub.msvcrt.dll__initterm
mov eax, dword [0x41a784]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x41a780]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x41533c
push 0x415300
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x412bed
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x412bcd
cmp cl, 0x22
jne 0x412bbe
cmp byte [eax], 0x22
jne 0x412bd6
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x412be1
cmp cl, 0x20
jbe 0x412bd2
test byte [ebp - 0x54], 1
je 0x412bf8
movzx ecx, word [ebp - 0x50]
jmp 0x412bfb
cmp byte [eax], 0x20
jbe 0x412bd6
inc eax
mov dword [ebp - 0x20], eax
jmp 0x412bed
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call fcn.004053d0
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x412c19
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x412c55
mov eax, esi
jmp 0x412c69
call fcn.00412a6b
ret