joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403770
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55eb12
mov eax, dword fs:[0]
push eax
sub esp, 0x338
push ebx
push esi
push edi
mov eax, dword [0x5befcc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x14], eax
call fcn.004120f3
call fcn.004042e0
test eax, eax
jne 0x403966
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, 1
mov ebx, eax
cmp dword [ebp - 0x10], esi
jle 0x403841
mov edx, dword [ebx + esi*4]
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4037e0
sub ecx, edi
sar ecx, 1
push ecx
push 0x5a2068
push edx
call fcn.005481b5
add esp, 0xc
test eax, eax
je 0x40383c
mov edx, dword [ebx + esi*4]
mov eax, edx
lea edi, [eax + 2]
nop word [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403810
sub eax, edi
sar eax, 1
push eax
push str._qn
push edx
call fcn.005481b5
add esp, 0xc
test eax, eax
je 0x40383c
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x4037d4
xor edi, edi
jmp 0x403841
mov edi, 1
test ebx, ebx
je 0x40384c
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
jne 0x403966
push edi
push 0x65
lea ecx, [ebp - 0x344]
call fcn.00406923
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x29c]
mov dword [ebp - method.CDialog.virtual_0], 0x5a1ddc
call fcn.0040829e
mov dword [ebp - method.CStatic.virtual_0], vtable.CStatic.0
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.0040829e
mov dword [ebp - method.CStatic.virtual_0], vtable.CStatic.0
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 2
call fcn.0040829e
mov dword [ebp - method.CComboBox.virtual_0], vtable.CComboBox.0
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 3
call fcn.0040829e
mov dword [ebp - method.CButton.virtual_0], vtable.CButton.0
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 4
call fcn.0040829e
mov dword [ebp - 0x9c], vtable.CButton.0
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x344]
mov dword [ebp - 4], 5
mov dword [eax + 0x20], ecx
call fcn.00406f47
cmp eax, 1
jne 0x403910
push dword [ebp - 0x1c]
call fcn.00403990
lea ecx, [ebp - 0x9c]
call fcn.00407b2f
lea ecx, [ebp - 0x11c]
call fcn.00407b2f
lea ecx, [ebp - 0x19c]
call fcn.00407b74
lea ecx, [ebp - 0x21c]
call fcn.00407cc2
lea ecx, [ebp - 0x29c]
call fcn.00407cc2
lea ecx, [ebp - 0x344]
call fcn.00406982
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00404b50
push eax
call fcn.00403990
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406c11
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.00414c0c
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x406c48
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00406c67
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x40a2a2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40a2e7
call fcn.00414c0c
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40a2e7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40a303
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0041014c
mov ebx, eax
test edi, edi
je 0x40a301
test esi, esi
je 0x40a301
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40adeb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x40aea9
cmp dword [esi + 0x20], 0
je 0x40aea9
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40aea9
cmp dword [ebp + 8], 0
je 0x40aea9
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.00414c0c
push 0x56f898
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x40ae7a
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40aea9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.0041adf5
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x40ae9a
test edi, edi
je 0x40ae9a
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x40aea5
mov ecx, esi
call fcn.0040ab8d
mov eax, ebx
jmp 0x40aeab
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40f467
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x55f18e
call fcn.005417f7
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x40f48d
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40f4ed
call fcn.00406556
push eax
lea ecx, [ebp - 0x10]
call fcn.00404e5c
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call dword [0x56d984]
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.0054986c
push eax
call fcn.00404f41
add esp, 0x14
test esi, esi
je 0x40f4e0
push esi
call fcn.005492d2
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00402330
mov eax, ebx
call fcn.005417c0
ret 8

Function at 0x41413a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41418d
push esi
push dword [ebp + 8]
call fcn.00414323
mov edi, eax
test edi, edi
je 0x414188
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x414188
mov eax, dword [ebp - 8]
jmp 0x41419f
mov eax, dword [ebp + 0x10]
jmp 0x41419f
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x41d95d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
mov edi, dword [esi + 0xc]
jne 0x41d9b3
push 5
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x41d98c
call fcn.00417bb9
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x41d9a1
call fcn.00417bb9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x41d9b3
call fcn.00417bb9
call fcn.00414c0c
cmp dword [eax + 0x3c], 0
je 0x41d9c8
push edi
mov ecx, ebx
call fcn.0041d08d
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.0041db9a
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x41d9f1
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x41d9fd
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41e89a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [edi + 4]
call fcn.0040f390
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
mov esi, eax
mov ecx, edi
and esi, 3
call fcn.0041eab3
cmp esi, 3
je 0x41e8d8
mov dword [edi + 0xc], 1
cmp dword [edi], 0
je 0x41e921
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x41e8fb
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.00406146
jmp 0x41e90c
push 0xff
mov ecx, esi
call fcn.00405714
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00406169
jmp 0x41e945
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41e945
push dword [esi]
push dword [ebp - 4]
call fcn.00418dc1
pop edi
pop esi
leave
ret 0xc

Function at 0x41ea0a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0041eab3
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41ea52
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00406146
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00406169
jmp 0x41ea5d
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00418dc1
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x42a85a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
push edi
test esi, esi
jne 0x42a874
call fcn.00414c0c
mov esi, dword [eax + 0xc]
push 0x57470c
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42a8ca
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42a8ca
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42a8a9
xor esi, esi
jmp 0x42a8bf
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0042a8d3
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
jmp 0x42a8cc
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x484070
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x563d57
call fcn.0054182b
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406654
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x5a207c
call fcn.00411ef8
cmp eax, 0xffffffff
jne 0x48414a
push 0
push 0x5a1fe4
lea ecx, [ebp - 0x4d0]
call fcn.00411ef8
cmp eax, 0xffffffff
jne 0x48414a
push 0
push 0x57028c
lea ecx, [ebp - 0x4d0]
call fcn.00411ef8
cmp eax, 0xffffffff
jne 0x48414a
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406654
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x484119
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56d984]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00402330
jmp 0x484183
lea eax, [ebp - 0x218]
push eax
call fcn.005492d2
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0040583c
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00402330
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x484170
mov edi, dword [ebp - 0x4cc]
jmp 0x484183
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x56d984]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00402330
mov eax, edi
call fcn.005417d5
ret
Function at 0x4c390e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x4c3908
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4c3902
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4c38f3
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.004c36ae
inc ecx
push cs
pop ebx
jbe 0x4c38e4
inc ebp
test al, 0x50
call fcn.004c36be
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004c3673
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
sal bh, cl
int1
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4c399c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
invalid
inc ebp

Function at 0x4c3a06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 0x88], eax
call fcn.004c36ae
bound ebp, qword [edx + 0x458d3f60]
call 0x513497a4
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
invalid
inc ebp

Function at 0x4c3a4a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004c36be
push eax
push esi
push dword [ebp + 8]
Function at 0x4c4581
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosd dword es:[edi], eax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.004c368c
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte es:[ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
stosd dword es:[edi], eax
cld
invalid
call dword [ebp - 0x73]
test dword [esp + edi*8 - 0x17af0001], edx
xor esi, eax
invalid
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004c3673
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.004c36ae
xchg dword [ebp + 0x32], ebp
fild qword [eax + 4]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x50c09f
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.00551335
pop ecx
test eax, eax
jne 0x50c0e1
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00414658
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x50c0a7
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
leave
ret
Function at 0x401ce0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x401d38
cmp byte [esi + ebx - 1], 0xa
je 0x401d0c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4030f8], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x401e30
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x10]
push ebx
mov ebx, eax
sub esp, 0x10
mov dword [ebp - 0x10], 0
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x401ea8
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
jne 0x401ea8
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov esi, eax
test eax, eax
je 0x401ea8
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._GetUserNameExW_12
sub esp, 0xc
test al, al
jne 0x401eaa
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esi, cs:[esi]
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401f20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x34
cmp edx, 0xffffffff
je 0x402060
mov ebx, edx
mov edi, edx
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x14], eax
call eax
lea ecx, [ebp - 0x10]
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x401f80
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x20], edx
call edx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [ebp - 0x1c], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x18], eax
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x401f73
mov edx, dword [ebp - 0x20]
call edx
mov ecx, dword [ebp - 0x18]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
lea ebx, [ebp - 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], esi
mov esi, dword [ebp - 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call esi
mov esi, dword [ebp - 0x14]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call esi
mov ecx, dword [ebp - 0x18]
sub esp, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
mov edi, eax
mov ebx, eax
jmp 0x401f38

Function at 0x402790
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop