joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a31f
Capabilities:
Check if file exists
Create shortcut via ishelllink

Disassembly:
push 0x18
mov eax, 0x512016
call fcn.004d02ab
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
call dword [0x51a7d4]
mov edi, eax
cmp edi, ebx
jge 0x40a35d
push edi
push str.CHECK_COM_hr___x:_hr
push 0x539
push str.d:code_sharecube_branches_branch_wps_release_srcclientincludexlive_xlive_hlp.h
push 9
pop esi
call fcn.0040f52f
add esp, 0x10
jmp 0x40a4d7
mov dword [ebp - 0x10], ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x10]
push eax
push 0x51b7d0
push 1
push ebx
push 0x51e490
call dword [0x51a7e4]
mov edi, eax
cmp edi, ebx
jge 0x40a3a1
push edi
push str.CHECK_COM_hr___x:_hr
push 0x53f
push str.d:code_sharecube_branches_branch_wps_release_srcclientincludexlive_xlive_hlp.h
push 9
pop esi
call fcn.0040f52f
add esp, 0x10
jmp 0x40a4cb
lea eax, [ebp - 0x14]
push eax
call fcn.0040df3e
mov byte [ebp - 4], 3
lea edi, [ebp - 0x14]
call fcn.0040a095
push 0x52c108
mov eax, edi
call fcn.0040d65b
push dword [ebp - 0x14]
call dword [0x51a4b0]
test eax, eax
jne 0x40a3f0
push str.ERROR_CHECK_BOOLEX:pathKliveExe.FileExists__
push 0x545
push str.d:code_sharecube_branches_branch_wps_release_srcclientincludexlive_xlive_hlp.h
push 5
pop ecx
mov edi, 0x80004005
call fcn.0040ef48
jmp 0x40a4be
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push str._SendTo
push eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 0x51d560
push eax
call dword [ecx]
mov edi, eax
cmp edi, ebx
jge 0x40a445
push edi
push str.CHECK_COM_hr___x:_hr
push 0x54b
push str.d:code_sharecube_branches_branch_wps_release_srcclientincludexlive_xlive_hlp.h
push 9
pop esi
call fcn.0040f52f
add esp, 0x10
jmp 0x40a4b1
lea eax, [ebp - 0x1c]
push eax
call fcn.004028b3
mov byte [ebp - 4], 6
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.004029d3
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 6
call fcn.0040a1a1
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jge 0x40a498
push edi
push str.CHECK_COM_hr___x:_hr
push 0x550
push str.d:code_sharecube_branches_branch_wps_release_srcclientincludexlive_xlive_hlp.h
push 9
pop esi
call fcn.0040f52f
add esp, 0x10
jmp 0x40a4a5
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
push ebx
push dword [ebp - 0x1c]
push eax
call dword [ecx + 0x18]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.004028da
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
push eax
call fcn.0040a11e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
call fcn.004025f7
mov byte [ebp - 4], bl
lea eax, [ebp - 0x10]
push eax
call fcn.0040a06d
call dword [0x51a7d8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004028da
mov eax, edi
call fcn.004d0383
ret
Function at 0x40a8ed
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x56a5a0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x50f39e
call fcn.004d02ab
mov eax, dword [ebp + 0x214]
and dword [ebp - 0x1c], 0
xor esi, esi
mov dword [ebp - 0x18], eax
inc esi
lea eax, [ebp - 0x14]
push esi
push eax
mov ebx, str.ConfigPath
call fcn.0040d2b0
pop ecx
pop ecx
mov dword [ebp - 4], esi
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.004022e5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x14]
call fcn.004028da
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
jne 0x40a9b1
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.004ce6f0
add esp, 0xc
push ebx
push 0x1a
lea eax, [ebp]
push eax
push ebx
call dword [0x51a48c]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004022e5
mov byte [ebp - 4], 4
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
call fcn.00403a2e
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
call fcn.004025f7
push str.KingsoftKlive_
mov eax, edi
call fcn.0040d65b
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.004029d3
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], bl
lea eax, [ebp - 0x10]
push eax
call fcn.004025f7
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.004c9b4d
add ebp, 0x20c
leave
ret

Function at 0x40bbf1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40bbff
push 0xd
pop eax
jmp 0x40bc32
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [0x51a3cc]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40bc06
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [0x51a008]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x40cdfb
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [0x51a008]
ret 0xc

Function at 0x40d18b
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x56a5a0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x50f2c1
call fcn.004d02ab
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
call fcn.0040df3e
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
xor eax, eax
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
call fcn.004ce6f0
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp]
push eax
push edi
call dword [0x51a48c]
cmp eax, edi
je 0x40d235
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004022e5
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
call fcn.00403a2e
mov byte [ebp - 4], bl
lea eax, [ebp - 0x14]
push eax
call fcn.004025f7
push str.Kingsoft
mov eax, edi
call fcn.0040d65b
push str.klive
mov eax, edi
call fcn.0040d65b
mov eax, dword [ebp - 0x10]
jmp 0x40d23a
mov eax, 0x527fec
push eax
push esi
call fcn.004025b6
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.004025f7
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.004c9b4d
add ebp, 0x20c
leave
ret

Function at 0x41236a
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x514173
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x56a5a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
push dword [ebp + 8]
lea esi, [esp + 0x18]
mov edi, ebx
call fcn.00411d49
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebx]
lea edi, [esp + 0xc]
mov dword [esp + 0xc], eax
call fcn.00412747
mov esi, dword [esp + 0x18]
test al, al
jne 0x4123d1
push dword [ebp + 8]
lea eax, [esi + 0xc]
call fcn.00411e3d
pop ecx
test al, al
je 0x41242f
lea eax, [esp + 0xc]
push eax
call fcn.004028b3
and dword [esp + 0x38], 0
push eax
push dword [ebp + 8]
lea eax, [esp + 0x24]
push eax
call fcn.00412300
mov byte [esp + 0x38], 1
push esi
push dword [esp + 0x18]
push eax
lea eax, [esp + 0x30]
push eax
mov eax, ebx
call fcn.00412176
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
mov byte [esp + 0x38], 0
lea eax, [esp + 0x1c]
push eax
call fcn.00412817
or dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.004028da
lea esi, [esp + 0x14]
call fcn.0041233a
add eax, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x41404f
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, eax
push esi
lea eax, [ebx - 1]
push edi
mov esi, ecx
cmp eax, 7
jbe 0x414068
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
lea ecx, [esi + 0x6af70]
lea eax, [esi + 0x6af78]
mov dword [eax], edi
cmp dword [ecx], edi
jne 0x414088
mov dword [eax], 1
mov dword [ecx], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
push edi
push eax
mov dword [esi + 0x6af6c], edi
call fcn.004ce6f0
mov eax, ebx
shl eax, 3
movzx ecx, word [eax + 0x5289d2]
mov dword [esi + 0x6af98], ecx
movzx ecx, word [eax + 0x5289d0]
mov dword [esi + 0x6af9c], ecx
movzx ecx, word [eax + 0x5289d4]
mov dword [esi + 0x6afa0], ecx
movzx eax, word [eax + 0x5289d6]
add esp, 0xc
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x4140eb
mov eax, dword [esp + 0x10]
or word [eax], 4
jmp 0x4140f8
cmp ebx, 8
jl 0x4140f8
mov eax, dword [esp + 0x10]
or word [eax], 2
push 0x10000
lea ebx, [esi + 0x1af70]
push ebx
push esi
mov dword [esi + 0x6af84], edi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
cmp eax, edi
je 0x414160
cmp eax, 0xffffffff
je 0x414160
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x414138
call fcn.004142f8
mov dword [esi + 0x6af7c], edi
movzx eax, byte [ebx + edi]
mov ecx, dword [esi + 0x6af7c]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
inc edi
mov dword [esi + 0x6af7c], eax
cmp edi, 2
jb 0x41413e
jmp 0x414170
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
ret
Function at 0x414414
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x414611
push edi
mov edi, 0x7fff
cmp dword [esi + 0x6af90], 3
jb 0x41448e
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, edi
mov dword [esi + 0x6af7c], eax
mov eax, dword [esi + eax*4 + 0x4af70]
and ecx, edi
mov dword [esi + ecx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af84]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af7c]
mov dword [esi + eax*4 + 0x4af70], ecx
cmp dword [ebp - 4], 0
je 0x4144d1
mov eax, dword [esi + 0x6af84]
sub eax, dword [ebp - 4]
cmp eax, 0x7efa
ja 0x4144d1
mov ecx, dword [esi + 0x6af90]
lea eax, [esi + 0x6afa0]
cmp dword [eax], ecx
jbe 0x4144b6
mov dword [eax], ecx
push dword [ebp - 4]
mov ecx, esi
call fcn.00414174
mov ebx, eax
mov eax, dword [esi + 0x6af90]
add esp, 4
cmp ebx, eax
jbe 0x4144d1
mov ebx, eax
cmp ebx, 3
jb 0x414591
mov edx, dword [esi + 0x6af84]
sub edx, dword [esi + 0x6af88]
lea ecx, [ebx - 3]
mov eax, esi
call fcn.00413a7d
sub dword [esi + 0x6af90], ebx
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x6af90]
cmp ebx, dword [esi + 0x6af98]
ja 0x41455f
cmp eax, 3
jb 0x41455f
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
xor ecx, eax
and ecx, edi
mov dword [esi + 0x6af7c], ecx
mov ecx, dword [esi + ecx*4 + 0x4af70]
and edx, edi
dec ebx
mov dword [esi + edx*4 + 0x2af70], ecx
mov eax, dword [esi + 0x6af7c]
mov dword [ebp - 4], ecx
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
jne 0x41450d
jmp 0x4145b1
add dword [esi + 0x6af84], ebx
mov eax, dword [esi + 0x6af84]
lea edx, [eax + esi]
movzx ecx, byte [edx + 0x1af70]
lea eax, [esi + 0x6af7c]
mov dword [eax], ecx
movzx edx, byte [edx + 0x1af71]
shl ecx, 5
xor edx, ecx
xor ebx, ebx
and edx, edi
mov dword [eax], edx
jmp 0x4145b7
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
xor edx, edx
mov eax, esi
call fcn.00413a7d
dec dword [esi + 0x6af90]
mov dword [ebp - 8], eax
inc dword [esi + 0x6af84]
cmp dword [ebp - 8], 0
je 0x4145f2
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
jl 0x4145d0
lea edx, [ecx + esi + 0x1af70]
jmp 0x4145d2
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 0
sub eax, ecx
push edx
mov ecx, esi
call fcn.004138dd
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x414603
call fcn.004142f8
cmp dword [esi + 0x6af90], 0
jne 0x41443e
pop edi
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
jl 0x414624
lea edx, [ecx + esi + 0x1af70]
jmp 0x414626
xor edx, edx
mov eax, dword [esi + 0x6af84]
push 1
sub eax, ecx
push edx
mov ecx, esi
call fcn.004138dd
pop ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x4151ce
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x4151d9
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x41528b
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x528a20]
inc ecx
sub edi, 8
dec esi
jne 0x4151f0
pop ebx
test edi, edi
je 0x4152a4
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x528a20]
inc ecx
dec edi
jne 0x41528f
pop esi
not eax
pop edi
ret

Function at 0x4152a9
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [ecx]
movsx edx, dl
xor edx, eax
push esi
mov esi, 0xff
and edx, esi
mov edx, dword [edx*4 + 0x528a20]
shr eax, 8
xor edx, eax
mov eax, dword [ecx + 8]
mov dword [ecx], edx
movzx edx, dl
add edx, dword [ecx + 4]
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 4], edx
shr edx, 0x18
xor edx, eax
and edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x528a20]
pop esi
mov dword [ecx + 8], eax
ret
Function at 0x415468
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
push edi
call dword [0x51a31c]
test eax, eax
jne 0x41548d
mov eax, 0x200
jmp 0x415610
mov ecx, dword [ebp - 0x4c]
xor eax, eax
xor ebx, ebx
mov edx, ecx
inc eax
and edx, eax
mov dword [ebp - 8], ebx
je 0x4154a1
mov dword [ebp - 8], eax
test cl, 2
je 0x4154aa
or dword [ebp - 8], 2
test cl, 4
je 0x4154b3
or dword [ebp - 8], 4
mov eax, ecx
and eax, 0x10
je 0x4154be
or dword [ebp - 8], 0x10
test cl, 0x20
je 0x4154c7
or dword [ebp - 8], 0x20
cmp eax, ebx
je 0x4154d4
or dword [ebp - 8], 0x40000000
jmp 0x4154db
or dword [ebp - 8], 0x80000000
or dword [ebp - 8], 0x1000000
cmp edx, ebx
jne 0x4154ed
or dword [ebp - 8], 0x800000
push ebx
push edi
call dword [0x51a318]
mov dword [ebp - 0x10], eax
cmp eax, 0x28
jbe 0x41558e
mov esi, dword [0x51a338]
push ebx
push ebx
push ebx
push edi
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 4]
push eax
push edi
mov edi, dword [0x51a370]
call edi
push ebx
push ebx
push 0x24
push dword [ebp + 8]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call edi
mov eax, 0x54ad
cmp word [ebp - 4], ax
jne 0x41558e
mov eax, dword [ebp - 0x14]
lea ecx, [eax + 0x34]
cmp dword [ebp - 0x10], ecx
jbe 0x41558e
push ebx
push ebx
push eax
push dword [ebp + 8]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 0x18]
cmp eax, 0x5a4d
je 0x415587
cmp eax, 0x454e
je 0x415587
cmp eax, 0x454c
je 0x415587
cmp eax, 0x4550
jne 0x41558e
or dword [ebp - 8], 0x400000
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x41559a
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x4155a6
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov esi, dword [ebp + 0x14]
cmp esi, ebx
je 0x4155e2
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.004153ed
push dword [ebp - 0x34]
mov dword [esi], eax
push dword [ebp - 0x38]
mov dword [esi + 4], edx
call fcn.004153ed
push dword [ebp - 0x44]
mov dword [esi + 8], eax
push dword [ebp - 0x48]
mov dword [esi + 0xc], edx
call fcn.004153ed
add esp, 0x18
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [ebp + 0x18]
cmp esi, ebx
je 0x41560e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.0041540f
movzx eax, word [ebp - 4]
movzx ecx, word [ebp - 8]
shl eax, 0x10
add esp, 0x10
or eax, ecx
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4176ae
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x56a5a0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x50f074
call fcn.004d02ab
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x18], edi
call fcn.004ce6f0
add esp, 0xc
push ebx
push 5
lea eax, [ebp]
push eax
push ebx
call dword [0x51a48c]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004022e5
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
call fcn.0040d06c
lea eax, [ebp - 0x10]
push eax
push edi
call fcn.004029d3
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], bl
lea eax, [ebp - 0x10]
push eax
call fcn.004025f7
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.004c9b4d
add ebp, 0x20c
leave
ret
Function at 0x41c662
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x56a5a0]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 0xc
mov eax, 0x50ee66
call fcn.004d02ab
mov eax, dword [ebp + 0x41c]
mov edi, ecx
mov dword [ebp - 0x18], edi
call fcn.0041acf7
push 5
xor esi, esi
push esi
push esi
push edi
push 0x530958
push esi
call dword [0x51a480]
mov dword [ebp - 0x14], eax
cmp eax, 0x20
ja 0x41c81f
mov ebx, dword [0x51a004]
lea eax, [ebp - 0x10]
push eax
push 1
push esi
push str..htm
push 0x80000000
call ebx
cmp eax, esi
jne 0x41c81f
lea eax, [ebp - 0x10]
push eax
lea edi, [ebp]
call fcn.0041c84a
cmp eax, esi
jne 0x41c81f
mov esi, dword [0x51a2f0]
push str._shellopencommand
mov eax, edi
push eax
call esi
lea eax, [ebp - 0x10]
push eax
push 1
push 0
mov eax, edi
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x41c81f
lea eax, [ebp - 0x10]
push eax
call fcn.0041c84a
test eax, eax
jne 0x41c81f
mov eax, edi
push str.__1_
push eax
call fcn.004cbbe7
mov ebx, dword [0x51a3cc]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x41c762
lea eax, [ebp]
push 0x52e594
push eax
call fcn.004cbbe7
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x41c762
lea eax, [ebp]
push eax
call ebx
lea edi, [ebp + eax*2 - 2]
jmp 0x41c767
xor eax, eax
mov word [edi], ax
push 0x52d4b4
push edi
call esi
push dword [ebp - 0x18]
push edi
call esi
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
lea eax, [ebp]
push eax
call ebx
mov edi, eax
inc edi
push esi
mov eax, edi
cdq
push 2
push edx
push eax
mov dword [ebp - 0x14], edi
call fcn.004d5390
cmp edx, esi
jg 0x41c7b4
jl 0x41c7a3
cmp eax, 0x7fffffff
ja 0x41c7b4
push edx
push eax
lea ecx, [ebp - 0x14]
call fcn.0040e152
mov edi, dword [ebp - 0x14]
pop ecx
pop ecx
jmp 0x41c7b9
mov eax, 0x80070057
cmp eax, esi
jge 0x41c7c1
xor eax, eax
jmp 0x41c7f6
cmp edi, 0x400
jg 0x41c7df
push edi
call fcn.0040e0aa
pop ecx
test al, al
je 0x41c7df
mov eax, edi
call fcn.004dd0c0
mov eax, esp
jmp 0x41c7e8
push edi
lea esi, [ebp - 0x10]
call fcn.0040e067
push 3
push edi
lea ecx, [ebp]
push ecx
mov esi, eax
call fcn.0040e007
push 5
push eax
call dword [0x51a2ec]
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0
je 0x41c81f
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
push eax
mov dword [ebp - 0x10], esi
call fcn.004cad3f
pop ecx
test esi, esi
jne 0x41c80c
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004c9b4d
add ebp, 0x414
leave
ret 4
Function at 0x423fc7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ebx
push edi
test esi, esi
je 0x423fd8
lea eax, [esi + 0x50]
jmp 0x423fda
xor eax, eax
lea edi, [esi + 4]
push eax
mov ebx, edi
call fcn.00427be2
push 1
push 1
mov eax, esi
call fcn.00424037
mov ebx, dword [esi + 0x88]
call fcn.00427e00
cmp dword [esi + 0x94], 0
je 0x424010
push 0x1f4
mov ecx, esi
call fcn.00427a43
push 0
push dword [esi + 8]
call dword [0x51a500]
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4274dc
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 0
call dword [eax + 0x28]
push esi
call fcn.0042c56a
push 1
push dword [esi + 8]
call dword [0x51a500]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
xor eax, eax
pop esi
ret 4

Function at 0x4279d7
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 0
call dword [eax + 0x28]
push esi
call fcn.0042c82c
push 1
push dword [esi + 8]
call dword [0x51a500]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
xor eax, eax
pop esi
ret 4

Function at 0x428725
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 0
call dword [eax + 0x28]
push esi
call fcn.0042ce5f
push 1
push dword [esi + 8]
call dword [0x51a500]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
xor eax, eax
pop esi
ret 4

Function at 0x428a6c
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 0
call dword [eax + 0x28]
push esi
call fcn.0042d001
push 1
push dword [esi + 8]
call dword [0x51a500]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
xor eax, eax
pop esi
ret 4

Function at 0x428db6
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 0
call dword [eax + 0x28]
push esi
call fcn.0042d1a3
push 1
push dword [esi + 8]
call dword [0x51a500]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
xor eax, eax
pop esi
ret 4

Function at 0x4290fd
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
push 0
call dword [eax + 0x28]
push esi
call fcn.0042d345
push 1
push dword [esi + 8]
call dword [0x51a500]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x20]
xor eax, eax
pop esi
ret 4