joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403862
Capabilities:
Copy file

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x40387a
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [esi]
sub esp, 0x14
push ebx
test ecx, ecx
je 0x4038f8
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x4038f8
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, eax
mov eax, dword [esi]
push eax
push dword [eax + 0xc]
lea ecx, [ebp - 8]
call fcn.004096ea
jmp 0x4038da
lea ecx, [ebp - 8]
call fcn.0040fe3a
cmp dword [eax + 0x18], 8
jb 0x4038c3
mov eax, dword [eax + 4]
jmp 0x4038c6
add eax, 4
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x403919
lea ecx, [ebp - 8]
call fcn.00403a7f
mov eax, dword [esi]
push eax
push dword [eax + 0x10]
lea ecx, [ebp - 0x10]
call fcn.004096ea
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.00403aae
test al, al
je 0x4038b0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 1
je 0x40390e
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esi + 4]
push edi
call fcn.00403960
pop ecx
pop ecx
pop ebx
leave
ret

Function at 0x40391c
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
mov dword [ebp + 0xc], esi
call fcn.00403b65
add esp, 0xc
test esi, esi
pop esi
je 0x40395c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x40395c
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x403960
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 8], 0
je 0x40398d
push dword [esp + 4]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40398d
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
ret
Function at 0x403b65
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x484
mov eax, dword [0x4bca50]
xor eax, esp
mov dword [esp + 0x480], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
call fcn.004018f6
mov eax, dword [esp + 0x28]
dec eax
push eax
lea ecx, [esp + 0x18]
call fcn.00403205
cmp word [eax], 0x5c
je 0x403bbc
push 0x4aca20
lea ecx, [esp + 0x18]
call fcn.0040197d
push 0x4acb64
lea ecx, [esp + 0x18]
call fcn.0040197d
cmp dword [esp + 0x2c], 8
mov eax, dword [esp + 0x18]
jae 0x403bd9
lea eax, [esp + 0x18]
lea ecx, [esp + 0x30]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
jne 0x403c14
xor esi, esi
push 0
push 1
lea ecx, [esp + 0x1c]
call fcn.00401a58
mov ecx, dword [esp + 0x48c]
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0047099a
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [esp + 0x284]
push 0
push eax
call fcn.00470920
add esp, 0xc
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push 0x4acb68
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x403ca2
push 0x4aca18
lea eax, [esp + 0x60]
push eax
call edi
test eax, eax
je 0x403ca2
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x14]
lea eax, [esp + 0x288]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test byte [esp + 0x30], 0x10
je 0x403c96
push esi
lea eax, [esp + 0x284]
push ebx
push eax
call fcn.00403b65
add esp, 0xc
cmp dword [ebx], 0
je 0x403ca2
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x403ca2
lea edi, [esp + 0x280]
call fcn.0040387a
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x403c2b
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
inc esi
jmp 0x403bf0
Function at 0x407559
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp + 0x18c], eax
mov eax, dword [ebp + 0x198]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push edi
mov edi, ecx
push str.HKCT
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x78], 0x100
call esi
test eax, eax
je 0x4075e4
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x4075e4
push str.HKCU
push edi
call esi
test eax, eax
je 0x4075dd
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x4075dd
push str.HKLM
push edi
call esi
test eax, eax
je 0x4075d6
push 0x4ad0dc
push edi
call esi
test eax, eax
jne 0x4075dd
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x4075e9
mov eax, closesocket
jmp 0x4075e9
mov eax, closesocket
lea ecx, [ebp - 0x7c]
push ecx
push 1
xor esi, esi
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40762d
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push esi
push dword [ebp - 0x80]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x7c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x40762d
cmp dword [ebp - 0x78], esi
jbe 0x40762d
xor eax, eax
inc eax
jmp 0x40762f
xor eax, eax
mov ecx, dword [ebp + 0x18c]
pop edi
xor ecx, ebp
pop esi
call fcn.0047099a
add ebp, 0x190
leave
ret

Function at 0x40b040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x390]
sub esp, 0x410
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp + 0x38c], eax
mov eax, dword [ebp + 0x3a4]
push ebx
mov ebx, dword [ebp + 0x3a0]
push esi
mov esi, dword [ebp + 0x398]
push edi
mov edi, dword [ebp + 0x39c]
push 0x400
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00470920
or dword [ebp - 0x80], 0xffffffff
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push edi
push esi
mov dword [ebp - 0x7c], 0x200
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ecx, dword [ebp - 0x78]
pop edi
pop esi
pop ebx
test eax, eax
je 0x40b0c2
call fcn.00403990
mov eax, 0x80004005
jmp 0x40b0cd
lea eax, [ebp - 0x74]
push eax
call fcn.00401a34
xor eax, eax
mov ecx, dword [ebp + 0x38c]
xor ecx, ebp
call fcn.0047099a
add ebp, 0x390
leave
ret

Function at 0x40b0e2
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x10]
cmp dword [eax + 0x18], 8
mov ecx, dword [eax + 0x14]
jb 0x40b0f4
mov eax, dword [eax + 4]
jmp 0x40b0f7
add eax, 4
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
and eax, 0x80004005
ret
Function at 0x40b11b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
push 0x400
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00470920
or dword [ebp - 0x408], 0xffffffff
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
mov dword [ebp - 0x410], 0x200
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x40b19d
mov eax, dword [ebp + 0x18]
mov dword [esi], eax
mov eax, 0x80004005
jmp 0x40b1a7
mov eax, dword [ebp - 0x404]
mov dword [esi], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047099a
leave
ret
Function at 0x40bfd1
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x418]
sub esp, 0x498
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp + 0x414], eax
mov eax, dword [ebp + 0x420]
push esi
push edi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x424]
push 0x400
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x14]
push 0
push eax
mov edi, ecx
call fcn.00470920
add esp, 0xc
mov esi, 0x4ad0c2
push esi
lea ecx, [ebp - 0x40]
call fcn.004024f8
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40c028
sub eax, ecx
lea ecx, [ebp - 0x40]
push ecx
sar eax, 1
push eax
push edi
call fcn.0040b34b
add esp, 0xc
push esi
lea ecx, [ebp - 0x24]
call fcn.004024f8
mov eax, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40c052
sub eax, ecx
lea ecx, [ebp - 0x24]
push ecx
sar eax, 1
push eax
push ebx
call fcn.0040b34b
add esp, 0xc
push esi
lea ecx, [ebp - 8]
call fcn.004024f8
mov edi, 0x4acb48
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40c081
sub eax, ecx
lea ecx, [ebp - 8]
push ecx
sar eax, 1
push eax
push edi
call fcn.0040b34b
add esp, 0xc
push esi
lea ecx, [ebp - 0x5c]
call fcn.004024f8
mov eax, dword [ebp - 0x7c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40c0ac
sub eax, ecx
lea ecx, [ebp - 0x5c]
push ecx
sar eax, 1
push eax
push dword [ebp - 0x7c]
call fcn.0040b34b
mov esi, dword [ebp - 0x58]
add esp, 0xc
push 0x10
pop eax
cmp dword [ebp - 0x44], eax
jae 0x40c0d8
lea esi, [ebp - 0x58]
mov edx, dword [ebp - 4]
cmp dword [ebp + 0x10], eax
jae 0x40c0e3
lea edx, [ebp - 4]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0xc], eax
jae 0x40c0ee
lea ecx, [ebp - 0x20]
cmp dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x3c]
jae 0x40c0f9
lea eax, [ebp - 0x3c]
push esi
push 0x3ff
lea esi, [ebp + 0x14]
push esi
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
lea ecx, [ebp - 0x78]
call fcn.004018f6
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40c11a
sub eax, ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp + 0x14]
push eax
call fcn.0040b2c3
mov ecx, dword [ebp - 0x80]
add esp, 0xc
push 0xffffffffffffffff
xor edi, edi
push edi
lea eax, [ebp - 0x78]
push eax
call fcn.004019a1
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x78]
call fcn.00401a58
push edi
push esi
lea ecx, [ebp - 0x5c]
call fcn.004028c7
push edi
push esi
lea ecx, [ebp - 8]
call fcn.004028c7
push edi
push esi
lea ecx, [ebp - 0x24]
call fcn.004028c7
push edi
push esi
lea ecx, [ebp - 0x40]
call fcn.004028c7
mov ecx, dword [ebp + 0x414]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0047099a
add ebp, 0x418
leave
ret
Function at 0x40c226
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
neg eax
mov dword [esi], eax
xor ecx, ebp
xor eax, eax
call fcn.0047099a
leave
ret

Function at 0x40c4f6
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x114
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.00470920
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x7c], 6
jb 0x40c546
cmp dword [ebp - 0x70], 2
jne 0x40c546
xor eax, eax
inc eax
jmp 0x40c548
xor eax, eax
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.0047099a
add ebp, 0x98
leave
ret

Function at 0x40c55d
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x40c575
mov eax, 0x80004005
jmp 0x40c60b
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, edi
jne 0x40c583
mov esi, 0x4acb48
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x3c]
push edi
push eax
call fcn.00470920
add esp, 0xc
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
cmp dword [ebp + 0x14], edi
je 0x40c5b2
call fcn.0040c4f6
mov dword [ebp - 0x30], str.runas
test eax, eax
jne 0x40c5b9
mov dword [ebp - 0x30], str.open
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x38], 0x440
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40c5f7
mov eax, dword [ebp + 0x18]
cmp eax, edi
je 0x40c5f3
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
jmp 0x40c609
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov eax, 0x80004005
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40c927
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x4bca50]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [esp + 0x14]
call fcn.0040cb6f
push 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], 7
call fcn.00401cdf
and dword [esp + 0x48], 0
push edi
lea ecx, [esp + 0x30]
call fcn.00401a34
lea eax, [esp + 0x2c]
push eax
call fcn.0040cbe0
mov ecx, esi
call fcn.0040c9e4
mov eax, dword [esp + 0x20]
mov esi, eax
cmp eax, dword [esp + 0x24]
jbe 0x40c98d
call fcn.004705d9
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], esi
lea esi, [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.0041372e
mov eax, dword [eax + 0x1c]
test eax, eax
jne 0x40c9d7
mov edi, 0x8618000a
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.00401a58
lea esi, [esp + 0x14]
call fcn.0040cb97
mov ecx, dword [esp + 0x4c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.0047099a
mov esp, ebp
pop ebp
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edi, edi
jmp 0x40c9ae
Function at 0x40c9e4
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
test eax, 0xffffffe0
jne 0x40ca11
xor eax, eax
inc eax
jmp 0x40cb60
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp eax, 0xffffffff
jne 0x40ca2f
mov eax, 0x8618000b
jmp 0x40cb60
lea esi, [ebp - 0x250]
call fcn.0040cbc4
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x248], eax
cmp dword [edi + 0xc], eax
jbe 0x40ca4d
call fcn.004705d9
mov eax, dword [edi]
mov esi, 0x22c
push esi
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.00470920
add esp, 0xc
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x238], esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x40cb4a
mov edi, dword [ebp - 0x250]
mov ebx, dword [ebp - 0x24c]
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x240], ebx
test edi, edi
je 0x40caad
cmp edi, dword [ebp - 0x258]
je 0x40cab2
call fcn.004705d9
cmp ebx, dword [ebp - 0x248]
je 0x40cb38
lea esi, [ebp - 0x244]
call fcn.0041372e
cmp dword [eax + 0x1c], 0
jne 0x40cb17
call fcn.0041372e
cmp dword [eax + 0x18], 8
jb 0x40cadb
mov eax, dword [eax + 4]
jmp 0x40cade
add eax, 4
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40cb17
lea esi, [ebp - 0x244]
call fcn.0041372e
push dword [ebp - 0x230]
mov esi, eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [esi + 0x1c], eax
test edi, edi
jne 0x40cb34
call fcn.004705d9
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x40cb2c
call fcn.004705d9
add ebx, 0x20
jmp 0x40ca9b
mov eax, dword [edi]
jmp 0x40cb22
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x23c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40ca89
push dword [ebp - 0x23c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047099a
leave
ret
Function at 0x40f253
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea esi, [ebx + 0x10c]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push edi
push 0x1c
cdq
pop ecx
idiv ecx
test eax, eax
je 0x40f466
push esi
push dword [esi + 0xc]
lea ecx, [ebp - 0x44]
call fcn.004096ea
lea ecx, [ebp - 0x44]
call fcn.0040fe3a
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401918
push esi
push dword [esi + 0xc]
lea ecx, [ebp - 0x44]
call fcn.004096ea
mov edi, dword [ebp - 0x40]
push edi
push dword [esi + 0x10]
lea eax, [edi + 0x1c]
push eax
call fcn.00410eb4
mov eax, dword [esi + 0x10]
add esp, 0xc
push eax
add eax, 0xffffffe4
push eax
mov ecx, esi
call fcn.0040faa2
add dword [esi + 0x10], 0xffffffe4
push esi
push edi
lea ecx, [ebp - 0x44]
call fcn.004096ea
mov eax, dword [ebx + 0x78]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx + 0x60]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x50], eax
mov eax, dword [ebx + 0x60]
lea edi, [ebp - 0x54]
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x54], eax
call fcn.00418a79
test al, al
jne 0x40f45a
call fcn.00418a4e
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, eax
call fcn.0040bec0
test eax, eax
je 0x40f320
call fcn.00419004
jmp 0x40f2e6
call fcn.00418a4e
mov esi, dword [eax + 0x1c]
test esi, esi
je 0x40f45a
lea edi, [ebx + 0xdc]
mov ecx, edi
call fcn.0040f6a1
lea ecx, [ebx + 0xf4]
call fcn.0040f6a1
push str..exe
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.00410e7f
add esp, 0xc
push eax
mov ecx, edi
call fcn.0040f646
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x78]
call fcn.00401a58
push esi
lea ecx, [ebx + 0xf4]
call fcn.0040f646
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 8], 7
call fcn.00401cdf
lea eax, [ebp - 0x20]
add esi, 0x16c
push eax
mov dword [ebp - 0x50], esi
call fcn.0040e38d
test eax, eax
je 0x40f434
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x44]
push eax
lea esi, [ebx + 0x60]
push esi
call fcn.004184da
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [esi]
lea edi, [ebp - 0x5c]
lea esi, [ebp - 0x44]
mov dword [ebp - 0x5c], eax
call fcn.00418a79
test al, al
jne 0x40f432
call fcn.00418a4e
mov esi, dword [eax + 0x1c]
push str..exe
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [esi + 0x1a8], 5
call fcn.00410e7f
add esp, 0xc
push eax
lea ecx, [ebx + 0xdc]
call fcn.0040f646
push 0
push 1
lea ecx, [ebp - 0x78]
call fcn.00401a58
push esi
lea ecx, [ebx + 0xf4]
call fcn.0040f646
mov esi, dword [ebp - 0x50]
lea eax, [ebp - 0x20]
push eax
call fcn.0040e38d
test eax, eax
jne 0x40f3a8
xor edi, edi
lea eax, [ebp - 0x48]
push eax
push edi
push ebx
push 0x40eea0
push edi
push edi
call fcn.00471725
add esp, 0x18
push edi
push 1
lea ecx, [ebp - 0x20]
mov dword [ebx + 0xd8], eax
call fcn.00401a58
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.00401a58
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0047099a
leave
ret
Function at 0x41185a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 8], ebx
jne 0x41186c
xor eax, eax
jmp 0x4118da
push edi
lea eax, [esi + 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp + 8]
push eax
lea edi, [esi + 0x28]
call fcn.00411b0b
lea eax, [esi + 0x1bc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
cmp dword [esi + 0x1d4], ebx
jne 0x4118ba
lea eax, [ebp + 8]
push eax
push ebx
push esi
push 0x4119db
push ebx
push ebx
mov dword [ebp + 8], ebx
call fcn.00471725
add esp, 0x18
mov dword [esi + 0x1d4], eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4118d7
push ebx
push ebx
push 0x720
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
pop esi
pop ebx
pop ebp
ret 4

Function at 0x411c2e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4bca50]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00470920
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.00401a34
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0047099a
leave
ret

Function at 0x411dfa
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 0xc]
push esi
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x411e22
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x411e6a
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411e15
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x411e4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x411e69
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 0x10]
call fcn.004032fe
add esp, 0xc
pop edi
pop esi
pop ebp
ret

Function at 0x411e6d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x411e94
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x411edc
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x411e87
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x411ebd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80004005
jmp 0x411edb
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push edi
push dword [ebp + 0x10]
call fcn.004032fe
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x4126d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebp + 8], edi
je 0x412702
lea eax, [ebp + 8]
push eax
push edi
add esi, 0xffffffdc
push esi
push 0x412972
push edi
push edi
mov dword [ebp + 8], edi
call fcn.00471725
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41271b
lea eax, [esi - 0x24]
call fcn.0041346c
push 0x64
push edi
push 0x65a
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
xor eax, eax
pop esi
pop ebp
ret 4