joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456c60
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b75a8]
cmp dword [eax + 0x30], 0
je 0x456d0a
cmp dword [ebx + 0x94], 0
jne 0x456d04
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x456bf0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x456d04
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x456cca
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x456d04
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004145a8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x456cd9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x457a24
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x457a59
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047e8
jmp 0x457a66
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040474c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x458dc8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x458e36
mov eax, esi
call fcn.0044357c
test al, al
je 0x458e36
mov eax, dword [ebx + 0x84]
call fcn.004431dc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x458e36
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x458e2a
push 0
mov eax, dword [ebx + 0x84]
call fcn.004431dc
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043b608
jmp 0x458e36
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00458c04
pop esi
pop ebx
ret

Function at 0x459840
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
je 0x45985c
push esi
mov esi, edx
mov edx, eax
lodsb al, byte [esi]
xor edx, eax
shr eax, 8
shl edx, 2
xor eax, dword [edx + 0x461764]
dec ecx
jne 0x459847
pop esi
ret
Function at 0x40506b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
invalid

Function at 0x406bec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe4
mov eax, dword [0x4c74a4]
push ebx
push esi
inc eax
mov esi, ecx
mov dword [esp + 0x18], esi
je 0x406c29
sbb byte [ebx + 0x4c74a4], ah
push edi
cmp eax, 0x30
jge 0x43e847
xor ebx, ebx
mov byte [esp + 0x13], 1
mov eax, ebx
mov byte [esp + 0x22], 1
lea ecx, [esp + 0xa8]
mov dword [esp + 0x14], eax
mov byte [esp + 0x24], bl
call fcn.00405906
mov edi, dword [ebp + 8]
lea ecx, [esp + 0xa8]
push 0x8000
push edi
call fcn.00405956
test al, al
je 0x43e861
lea ecx, [esp + 0x98]
call fcn.004077c7
lea ecx, [esp + 0x98]
call fcn.00420b9b
lea ecx, [esp + 0x88]
call fcn.004077c7
lea edx, [esp + 0x88]
mov ecx, edi
call fcn.004048ae
mov edi, dword [esp + 0xb8]
lea eax, [esp + 0x44]
mov esi, dword [esp + 0xbc]
lea ecx, [esp + 0xa8]
push eax
lea eax, [esp + 0x64]
mov dword [esp + 0x48], 0x18
push eax
call fcn.004059b0
push ebx
push esi
push edi
lea ecx, [esp + 0xb4]
call fcn.00405c4e
cmp dword [esp + 0x70], 0x21335541
je 0x43e87b
lea ecx, [esp + 0x50]
call fcn.004077c7
lea ecx, [esp + 0x28]
call fcn.004077c7
push ebx
lea eax, [esp + 0x2c]
add byte [ebx - 0x3074ef15], cl
push dword [eax]
leave
push 0x244b9fc8
pop ebp
ret

Function at 0x40a000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x118
mov eax, dword [0x4c7480]
mov dword [esp + 4], ecx
push esi
push edi
Function at 0x40fe40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0x10]
Function at 0x415e58
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edx, dword [eax + 4]
mov edi, dword [eax]
add edx, edx
mov eax, 0x1505
test edx, edx
jle 0x415e80
movzx ecx, byte [esi + edi]
imul eax, eax, 0x21
add eax, ecx
inc esi
cmp esi, edx
jl 0x415e72
pop edi
pop esi
pop ebp
ret 4

Function at 0x4200eb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, ecx
cmp byte [edi + 9], 0
jne 0x455cea
test ecx, esi
pop ebx
add eax, dword [eax]
cmp byte [edi + 8], 0
jne 0x420118
mov eax, dword [edi + 4]
mov byte [edi + 9], 1
jmp 0x420113
jne 0x45000f
push esi
movzx ecx, byte [eax + 0x4a5750]
movzx eax, word [ebx + 2]
leave
push ebx
xor eax, dword [ebx]
enter 0x75ff, 0x1c
call dword [ebx + ecx*2]
mov ecx, dword [ebp - 8]
call 0x7d4149d7
dec ecx
add byte [ebx + ebp*8], dl
mov eax, dword [ecx]
je 0x450029
cmp eax, 0xff89fc19
jne 0x450038
cmp dword [esi + 0x498bb0b0], 0xfffffffc
jne 0x450038
mov dword [esi + 0x498bb0b0], edi
mov ecx, dword [ecx - 0x18]
mov ebx, dword [ecx - 0x7b]
adc al, 0x4b
call 0x14ca59c8
dec ebx
cld
jl 0x44fff9
sbb eax, 0xe9ff89fc
or cl, byte [ebx - 4]
dec dword [ebx + 0x50401845]
movzx eax, word [ebx]
push dword [ebp + 0x14]
push esi
movzx eax, byte [eax + 0x4a5750]
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call dword [ebx + eax*2]
mov ebx, dword [ebp - 8]
mov ecx, ebx
call 0x7d4149d7
dec ecx
add byte [eax + ebp*8], dl
mov ebx, dword [ecx - 0x7b]
invalid
or byte [ebx - 0x5c17fb08], al
inc eax
add dword [eax], eax
mov byte [esi + 9], 0
jmp 0x450036

Function at 0x42800a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x14
push 0x4bbd38
call fcn.00428b40
call fcn.0042a048
movzx esi, ax
push 2
call fcn.0043508a
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x427ec1
xor ebx, ebx
jmp 0x427ef4
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x427ebd
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x427ebd
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x427ef4
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.00428dbc
test eax, eax
jne 0x427f08
push 0x1c
call fcn.00427fe3
pop ecx
call fcn.00429d26
test eax, eax
jne 0x427f19
push 0x10
call fcn.00427fe3
pop ecx
call fcn.00429e0b
and dword [ebp - 4], 0
call fcn.0042d812
test eax, eax
jns 0x427f33
push 0x1b
call fcn.00427fe3
pop ecx
call dword [0x48f37c]
mov dword [0x4c5228], eax
call fcn.00435173
mov dword [0x4c41f0], eax
call fcn.00434d6b
test eax, eax
jns 0x427f59
push 8
call fcn.004232f5
pop ecx
call fcn.00434fa8
test eax, eax
jns 0x427f6a
push 9
call fcn.004232f5
pop ecx
push 1
call fcn.0042332f
pop ecx
test eax, eax
je 0x427f7d
push eax
call fcn.004232f5
pop ecx
call fcn.004351d0
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x427f9f
push esi
call fcn.00423598
call fcn.00423320
jmp 0x427fd4
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00428b85
ret
call fcn.004350d7
jmp 0x427e93
Function at 0x433718
Capabilities:
Authenticate hmac
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
in al, dx
in al, 0x49
add byte [eax + ecx], ah
cmp eax, 0x80000000
jae 0x433737
movlpd xmm0, qword [0x31d8e9c0]
invalid
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
cmp dword [0x4c4ae4], eax
je 0x433755
push dword [0x14c5184]
add byte [eax], al
inc esi
mov dword [ebp - 0x14377418], ebx
add eax, 0x437cabb9
add byte [ebx + 0x49ba1445], cl
add al, ch
xchg edi, eax
mov ecx, fcn.00437cab
mov eax, dword [ebp + 0x14]
mov edx, 0x97e80049
push esi
cmp eax, edx
jg 0x418307
inc dword [ebx + 0x64746983]
cmp eax, 0x19
jg 0x41827d
inc dword [ebx + 0x660049f4]
push 2
pop edx
sub eax, edx
je 0x821e2e8b
dec eax
je 0x84b83c59
cmp dword [ebp + 5], eax
je 0x821e2f4a
dec eax
je 0x84b83c3e
cmp dword [ebp + 5], eax
je 0xff7db893
dec eax
je 0x4337fc
sub eax, 9
jne 0x855237da
sahf
inc ebp
fadd dword [ebx]
and edi, 0xfffffffc
or ebx, 0xffffffdc
mov ah, 0x40
dec ecx
invalid
in al, dx
jmp 0x8f528bd5
mov al, byte [eax]
fdiv qword [eax - 0xb6c0]
mov dword [ebp - 0x61ef8ac0], esi
inc ebp
fadd dword [ecx - 0x2064ffb7]
loopne 0x4337f6
or dword [ebx*8 + 0xdde05d], 0xffffff8d
inc ebp
fcomp st(5)
pop ebp
call 0xdd933f01
pop ebp
invalid

Function at 0x452ff2
Capabilities:
Authenticate hmac
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
push 0x1e
mov eax, ecx
pop edx
sub eax, edx
je 0x45300e
dec eax
je 0x453009
dec eax
je 0x453005
xor eax, eax
jmp 0x453011
push 0x27
jmp 0x453010
push 0x1a
pop edi
jmp 0x453013
push 0xd
pop eax
mov edi, eax
cmp dword [ebp - 0x3c], 0
mov ebx, dword [ebp - 8]
je 0x453072
lea edx, [ebx - 2]
mov ax, word [edx]
and ax, word [ebp + 0x663afed4]
cmp ax, word [ebp + 0x663afeb8]
jne 0x453072
mov ax, word [edx]
mov ecx, 0xfc00
and ax, cx
mov ecx, 0xdc00
cmp ax, cx
movzx ebx, word [ebx - 2]
push 0x1e
pop eax
cmp cx, ax
ja 0x41812c
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x50], eax
jle 0x41812c

Function at 0x45b15b
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x7ebf700
push ds
je 0x45b172
xchg ebp, eax
rcr byte [ebp - 0x3e], 0x10
add byte [ebp - 0x75], dl
in al, dx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor ecx, 0x3b
add byte [esi + 0x23], ah
int1
cmp esi, ebx
add byte [esi + 0x23], ah
sar dword [ecx - 0x717a900], 0xaf
sti
dec dword [ebx + 0x46a0843]
pop ecx
cmp dword [esi + 0xc], eax
jae 0x45b1c6
push 8
pop edx
cmp eax, edx
jb 0x45b195
mov edx, eax
mov dword [esi + 0xc], edx
xor ecx, ecx
mov eax, edx
push 4
pop edx
dec dword [ebx + 0x4004917]
mov ecx, eax
mov dword [ebp - 0x20], ecx
insd dword es:[edi], dx
pop esi
xor esi, esi
movd dword [eax + eax], mm0
mov edi, eax
pop ecx
je 0x45b1c0
dec dword [edi]
add al, 0xe8
rcr byte [esi + 0x74], cl
or al, 0xff
push 4
mov dword [esi + 4], edi
pop ecx
mov eax, dword [ebx + 8]
xor ecx, ecx
invalid
Function at 0x10805058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x108051a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1080507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1080506a
add dl, dl
jne 0x10805089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x108050dc
xor eax, eax
add dl, dl
jne 0x10805096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1080517d
add dl, dl
jne 0x108050a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108050b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108050bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108050c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x108050d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10805075
mov eax, 1
add dl, dl
jne 0x108050ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x108050f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x108050e1
sub eax, ebx
mov ebx, 1
jne 0x10805128
mov ecx, 1
add dl, dl
jne 0x1080510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10805119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10805105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10805075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1080513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1080514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10805136
cmp eax, 0x7d00
jae 0x1080516d
cmp eax, 0x500
jb 0x10805168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10805075
cmp eax, 0x7f
ja 0x10805170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10805075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1080519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10805075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40a780
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c308
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x49b7c0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0xc]
call fcn.00402aa0
mov ecx, dword [esp + 0x34]
push eax
mov dword [esp + 0x30], 0
call fcn.0040a620
lea ecx, [esp + 8]
mov esi, eax
call fcn.00402040
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 8

Function at 0x40af70
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47c202
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49b7c0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
push edi
mov eax, esi
call fcn.0040bff0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.00407600
test esi, esi
mov dword [esp + 0x18], ebx
jne 0x40afbb
call fcn.0043c2f0
mov ebp, dword [esi + 4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], esi
call fcn.00407600
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esi
je 0x40afdf
cmp eax, esi
je 0x40afe4
call fcn.0043c2f0
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x20]
je 0x40affe
add eax, 0x10
call fcn.00409950
test eax, eax
jge 0x40b086
xor eax, eax
mov ebp, vtable.Variant.0
mov ebx, 1
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x80], eax
lea eax, [esp + 0x24]
push eax
push edi
lea ecx, [esp + 0x44]
push ecx
call fcn.0040b820
mov byte [esp + 0x80], bl
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ecx
push eax
lea edx, [esp + 0x28]
push edx
mov eax, esi
call fcn.0040b2d0
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 4]
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x1c], edx
mov byte [esp + 0x84], 0
call fcn.0040b270
mov dword [esp + 0x80], 0xffffffff
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebp
call fcn.00409d60
cmp dword [esp + 0x14], 0
jne 0x40b092
call fcn.0043c2f0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
cmp eax, dword [ecx + 4]
jne 0x40b0a8
call fcn.0043c2f0
mov eax, dword [esp + 0x18]
add eax, 0x30
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0x40e0e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47c1c7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49b7c0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x48c288
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.0040f110
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.0040fac0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4a06e8]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40ed80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47c177
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49b7c0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [edi], 0x48c298
mov dword [edi + 0x54], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 4]
push esi
mov dword [esp + 0x20], ebx
push edi
mov dword [esp + 0x18], 1
call fcn.0040f080
mov dword [esp + 0x1c], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
call fcn.0040fac0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x4a06e8]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40fac0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x47937b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49b7c0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0045950c
push 4
mov dword [esp + 0x20], 0
call fcn.0041de63
mov edi, eax
add esp, 4
test edi, edi
je 0x40fb40
call fcn.00459314
mov dword [edi], eax
call fcn.00459148
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.004590ba
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40fb35
add eax, 1
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004590db
jmp 0x40fb42
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x4100e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x47bbab
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x49b7c0]
xor eax, esp
mov dword [esp + 0x124], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49b7c0]
xor eax, esp
push eax
lea eax, [esp + 0x13c]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0x14]
call fcn.00405e70
push 0
push 0x1a
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x150], 0
mov ebp, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0
call ebp
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x18]
call fcn.00405ea0
mov eax, dword [str.MacromediaFlash_PlayerSharedObjects]
push eax
mov esi, eax
call fcn.00401a20
add esp, 4
mov ebx, eax
push esi
lea eax, [esp + 0x18]
call fcn.0040c530
lea ecx, [esp + 0x14]
call fcn.00402060
mov esi, eax
call fcn.00410200
push 0
push 0x1c
lea edx, [esp + 0x38]
push edx
push 0
call ebp
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
call fcn.00405ea0
mov eax, dword [str.GoogleChromeUser_DataDefaultPepper_DataShockwave_FlashWritableRootSharedObjects]
push eax
mov esi, eax
call fcn.00401a20
add esp, 4
mov ebx, eax
push esi
lea eax, [esp + 0x18]
call fcn.0040c530
lea ecx, [esp + 0x14]
call fcn.00402060
mov esi, eax
call fcn.00410200
lea ecx, [esp + 0x14]
call fcn.00402040
mov ecx, dword [esp + 0x13c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x124]
xor ecx, esp
call fcn.0043bdb2
add esp, 0x134
ret
Function at 0x4102d0
Capabilities:
Create directory
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47bb23
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x49b7c0]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49b7c0]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1a4]
lea eax, [esp + 0x188]
push eax
mov esi, 0x48c394
lea edi, [esp + 0x1c]
mov dword [esp + 0x184], 0
call fcn.0040c430
add esp, 4
lea ecx, [esp + 0x34]
push ecx
mov ecx, eax
call fcn.00402060
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, edi
mov esi, eax
call fcn.00402040
cmp esi, 0xffffffff
jne 0x41036a
lea ecx, [esp + 0x188]
call fcn.00402040
xor al, al
jmp 0x410420
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov bl, 0x10
test byte [esp + 0x34], bl
je 0x410394
lea eax, [esp + 0x60]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x410380
sub eax, edx
cmp eax, 8
je 0x41044a
lea edx, [esp + 0x34]
push edx
push esi
call edi
test eax, eax
jne 0x410372
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x190]
push eax
mov ecx, ebp
call fcn.00402210
push 0x48c398
call fcn.00401a20
add esp, 4
mov ebx, eax
push 0x48c398
mov eax, ebp
call fcn.0040c530
lea esi, [esp + 0x18]
call fcn.00416bc0
push 0
push eax
or eax, 0xffffffff
mov esi, ebp
mov byte [esp + 0x188], 1
call fcn.004099b0
lea ecx, [esp + 0x18]
call fcn.00402040
push 0
mov ecx, ebp
call fcn.00402060
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, 1
lea ecx, [esp + 0x188]
sete bl
call fcn.00402040
mov al, bl
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.0043bdb2
add esp, 0x170
ret 0x20
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x190]
push eax
mov ecx, ebp
call fcn.00402210
push 0x48c398
call fcn.00401a20
add esp, 4
mov ebx, eax
push 0x48c398
mov eax, ebp
call fcn.0040c530
lea ecx, [esp + 0x60]
push ecx
call fcn.00401a20
add esp, 4
lea edx, [esp + 0x60]
mov ebx, eax
push edx
mov eax, ebp
call fcn.0040c530
lea ecx, [esp + 0x188]
call fcn.00402040
mov al, 1
jmp 0x410420