joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f3f2
Capabilities:
Get common file path

Disassembly:
push 0x278
mov eax, 0x4a3862
call fcn.0049fa2f
mov ebx, ecx
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x284], ebx
mov eax, dword fs:[0x2c]
xor esi, esi
mov dword [ebp - 0x284], ebx
mov edi, 0x4cb43c
mov ecx, dword [eax]
mov eax, dword [0x4cb438]
cmp eax, dword [ecx + 4]
jle 0x47f46f
push 0x4cb438
call fcn.0043898e
cmp dword [0x4cb438], 0xffffffff
pop ecx
jne 0x47f46f
push 0x4b9024
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0043898e
push 0x4a6690
call fcn.0043898e
or dword [ebp - 4], 0xffffffff
mov dword [esp], 0x4cb438
call fcn.0043898e
pop ecx
cmp dword [0x4cb44c], 0
jne 0x47f590
push 0x20a
lea eax, [ebp - 0x21c]
push esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
call fcn.0043898e
test al, al
je 0x47f563
push str.LogSession
lea ecx, [ebp - 0x24c]
call fcn.0043898e
lea ecx, [ebp - 0x24c]
mov dword [ebp - 4], 1
call fcn.00477e85
mov ebx, eax
lea ecx, [ebp - 0x264]
push 0x4adacc
mov eax, dword [ebx]
mov edi, dword [eax + 0x40]
call fcn.0043898e
mov esi, eax
push str.IE_is_protected_mode_
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 2
call fcn.0043898e
push esi
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 3
push eax
mov ecx, edi
call dword [0x4a75c0]
mov ecx, ebx
call edi
lea ecx, [ebp - 0x234]
call fcn.0046a23d
lea ecx, [ebp - 0x264]
call fcn.0046a23d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.0046a23d
lea ecx, [ebp - 0x27c]
call fcn.00474779
mov esi, eax
mov edi, 0x4cb43c
cmp esi, edi
je 0x47f550
mov ecx, edi
call fcn.0046d98d
push esi
mov ecx, edi
call fcn.0043898e
lea ecx, [ebp - 0x27c]
call fcn.0046d98d
mov ebx, dword [ebp - 0x280]
jmp 0x47f590
lea eax, [ebp - 0x21c]
push eax
push esi
push esi
push 0x801a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
lea ecx, [ebp - 0x21c]
mov eax, 0x4b9024
cmovne ecx, eax
push ecx
mov ecx, edi
call fcn.0043898e
push edi
mov ecx, ebx
call fcn.004723ba
mov eax, ebx
call fcn.0049f9de
ret

Function at 0x47f7a8
Capabilities:
Get session user name

Disassembly:
push 0x254
mov eax, 0x4a38b6
call fcn.0049fa2f
mov esi, ecx
mov dword [ebp - 0x260], esi
xor eax, eax
mov dword [ebp - 0x260], esi
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x260], 0x100
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x25c]
call fcn.0043898e
and dword [ebp - 4], 0
lea edx, [ebp - 0x25c]
lea ecx, [ebp - 0x22c]
call fcn.0046ee68
push str.AdobeHeadlights
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.0043898e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x22c]
cmp dword [ebp - 0x218], 0x10
lea ecx, [ebp - 0x244]
push dword [ebp - 0x21c]
cmovae eax, dword [ebp - 0x22c]
push eax
call fcn.0046a372
push eax
mov ecx, esi
call fcn.00469e2b
lea ecx, [ebp - 0x244]
call fcn.0046a23d
lea ecx, [ebp - 0x22c]
call fcn.0046a23d
lea ecx, [ebp - 0x25c]
call fcn.0046d98d
mov eax, esi
call fcn.0049f9de
ret
Function at 0x47fe6f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xf4
mov eax, 0x4a39c0
call fcn.0049fa2f
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], eax
cmp dword [ecx], ebx
jne 0x47fe97
xor al, al
jmp 0x47ff75
push 0x802
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x4c], 0x400
call fcn.0043898e
mov dword [esp], 0x802
mov edi, eax
push ebx
push edi
call dword [sym.imp.VCRUNTIME140.dll_memset]
add esp, 0xc
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47fec9
mov eax, dword [esi]
lea ecx, [ebp - 0x4c]
push ecx
push edi
lea ecx, [ebp - 0x44]
push ecx
push ebx
push eax
mov eax, dword [ebp - 0x50]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cdq
cmp eax, ebx
jne 0x47ff55
cmp edx, ebx
jne 0x47ff55
cmp dword [ebp - 0x44], 4
jne 0x47ff48
mov esi, dword [edi]
push ecx
lea ecx, [ebp - 0x100]
call fcn.0048014f
push esi
lea ecx, [ebp - 0xf0]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___int_]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047276e
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x28]
push eax
call fcn.0043898e
lea ecx, [ebp - 0x28]
call fcn.0046d98d
lea ecx, [ebp - 0x98]
call fcn.0048011f
lea ecx, [ebp - 0x98]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
jmp 0x47ff51
mov ecx, dword [ebp - 0x48]
push edi
call fcn.0043898e
mov bl, 1
jmp 0x47ff6c
push esi
mov edx, str.Query_registry_value_with_key:
lea ecx, [ebp - 0x40]
call fcn.0043898e
pop ecx
lea ecx, [ebp - 0x40]
call fcn.0046d98d
push edi
call fcn.0048844b
pop ecx
mov al, bl
call fcn.0049f9de
ret 8

Function at 0x48ab60
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
push esi
xor esi, esi
cmp ecx, edx
je 0x48ab95
nop
movsx eax, byte [ecx]
inc ecx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor esi, eax
rol esi, 0xd
add esi, 0xfaddaf14
lea esi, [esi + esi*4]
cmp ecx, edx
jne 0x48ab70
mov eax, 3
mov ecx, esi
mul esi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x1e
imul ecx, ecx, 0x7fffffff
sub esi, ecx
or esi, 0x40000000
mov eax, esi
pop esi
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x402ee4
pop dword [ebp - 0x50]
mov eax, 0x8d8e7ca2
sub eax, 0x8d4e4dbe
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xb28f4338
sub dword [ebp - 0x60], 0x643cfded
mov dword [ebp - 0x5c], 0x4d56b38f
add dword [ebp - 0x5c], 0xe4dc98b6
mov dword [ebp - 0x58], 0xe74e1698
add dword [ebp - 0x58], 0x64fe2d96
mov dword [ebp - 0x54], 0xcce04b7e
sub dword [ebp - 0x54], 0xcce04b7e
lea eax, [ebp - 0x60]
push eax
mov eax, 0x601fc102
add eax, 0xa020c002
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x74f16ae4
add dword [ebp - 0x60], 0xff80fe72
mov dword [ebp - 0x5c], 0xdfc694b6
add dword [ebp - 0x5c], 0x61a5ccbf
mov dword [ebp - 0x58], 0x47def3be
add dword [ebp - 0x58], 0x1b9078ae
mov dword [ebp - 0x54], 0x87c2e0e1
sub dword [ebp - 0x54], 0x87c2e0e1
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x9e2d30ee
sub eax, 0x9decafee
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c24b
push 0
call eax
mov ecx, 0x803cab12
add ecx, 0x7fc3b15c
mov edi, eax
mov esi, 0x6f1fc50f
sub esi, 0x6ed8e10f
add esi, dword [ebp - 0x50]
mov ebx, 0x5329d039
sub dword [ebp - 4], 0xc08fc193
mov edx, dword [esi]
xor dword [ebp - 0x28], esi
add edx, ebx
add dword [ebp - 0x44], 0xf6517f03
mov dword [edi], edx
sub dword [ebp - 0x24], 0xa867880c
add edi, 0x7d3957e9
sub edi, 0x7d3957e5
add esi, 4
loop 0x403000
add eax, 0x1648b
xor ebx, ebx
add ebx, eax
add eax, 0x212484f2
add eax, 0xdedb7b13
mov ecx, 0x2c1fea9c
add ecx, 0xd4201564
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x40317b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
jl 0x4031a6
mov ecx, dword [0x42a298]
push esi
add eax, ecx
push esi
push eax
mov dword [0x418ed4], eax
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_SetFilePointer]
push 4
call fcn.00403283
cmp eax, esi
jl 0x40327d
lea eax, [ebp + 8]
push 4
push eax
push dword [0x40a01c]
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp + 8]
add dword [0x418ed4], 4
call fcn.00403283
mov ebx, eax
cmp ebx, esi
jl 0x40327b
cmp dword [ebp + 0x10], esi
jne 0x403249
cmp dword [ebp + 8], esi
jle 0x40327b
mov esi, 0x414ed0
cmp dword [ebp + 8], 0x4000
mov eax, dword [ebp + 8]
jl 0x40320b
mov eax, 0x4000
push eax
push esi
push dword [0x40a01c]
mov dword [ebp - 4], eax
call fcn.00402ed5
test eax, eax
je 0x40326d
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call fcn.00402ed5
test eax, eax
je 0x403245
mov eax, dword [ebp - 4]
sub dword [ebp + 8], eax
add dword [0x418ed4], eax
add ebx, eax
cmp dword [ebp + 8], 0
jg 0x4031fa
jmp 0x40327b
push 0xfffffffffffffffe
jmp 0x40326f
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x403254
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push esi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a01c]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x403272
push 0xfffffffffffffffd
pop eax
jmp 0x40327d
mov ebx, dword [ebp - 4]
add dword [0x418ed4], ebx
mov eax, ebx
pop esi
pop ebx
leave
ret 0x10
Function at 0x9e7440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9e748c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9e7452
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9e74f0
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9e7542
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9e7548
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9ffa35
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009ff6f5

Function at 0xa0482f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a046ae

Function at 0xa09de0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xa09e0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xa09e0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xfd33a8
Capabilities:
Encode data using xor

Disassembly:
inc esp
inc esp
and eax, 0x4576d2
add bl, ch
jmp 0xfd33b2
add byte [esp + eax], dh
add byte [eax], al
add byte [eax], al
add byte [eax - 0x18], ah
add byte [eax], al
add byte [eax], al
jmp 0xfd33b2
pushal
call 0xfd33b8
pop ebp
sub ebp, 0x10
sub ebp, 0xbd33a8
jmp 0xfd33ce
mov eax, 0xbd33a8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
mov edx, 0x8ba7822e
xor byte [eax], dl
inc eax
dec ecx
jne 0xfd33e5
jmp 0xfd33f8
movsd dword es:[edi], dword [esi]
jecxz 0xfd33a0
cmpsd dword [esi], dword es:[edi]
adc ch, byte [esi]
scasd eax, dword es:[edi]
out dx, eax
salc
sub eax, 0x2e2a96e3
xchg esp, eax
push es
fxch st(4)
sub eax, 0x22afa5e6
sub eax, 0xa4aa3eb
shl byte [edi + 0x4aa30a2a], cl
or dl, dl
cmpsd dword [esi], dword es:[edi]
sub cl, byte [edx]
inc esi
and dword cs:[edi], ecx
inc esi
mov byte [edx], cl
mov dl, 0x2e
das
add cl, byte [edx]
inc esi
mov al, 0x57
cmp byte [ebx - 0x3a], ch
sub ebp, dword [esi]
invalid
Function at 0x407f80
Capabilities:
Create directory

Disassembly:
push esi
push ebx
push eax
mov eax, 0x2010
call fcn.0040f1ec
sub esp, eax
mov eax, dword [esp + eax]
mov esi, eax
mov eax, dword [0x42c0a0]
test eax, eax
je 0x408020
xor ebx, ebx
test eax, eax
jg 0x407fbb
jmp 0x407fd8
add ebx, 1
cmp dword [0x42c0a0], ebx
jle 0x407fd8
mov eax, dword [ebx*4 + 0x42b0a0]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x407fb0
jmp 0x408012
mov dword [esp], esi
call sub.msvcrt.dll_wcslen
cmp eax, 2
jne 0x407fec
cmp word [esi + 2], 0x3a
je 0x408012
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
sub esp, 8
test eax, eax
je 0x408068
mov ebx, dword [0x42c0a0]
cmp ebx, 0x3ff
jle 0x408080
mov eax, 1
add esp, 0x2014
pop ebx
pop esi
ret
mov ecx, 0x1000
mov edx, str.HOME
lea eax, [esp + 0x10]
call fcn.00407710
test al, al
je 0x40809b
lea eax, [esp + 0x10]
mov ebx, dword [0x42c0a0]
mov dword [esp], eax
call sub.msvcrt.dll__wcsdup
mov dword [ebx*4 + 0x42b0a0], eax
mov eax, dword [0x42c0a0]
add eax, 1
mov dword [0x42c0a0], eax
jmp 0x407fa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x408004
xor eax, eax
jmp 0x408017
mov dword [esp], esi
call sub.msvcrt.dll__wcsdup
add dword [0x42c0a0], 1
mov dword [ebx*4 + 0x42b0a0], eax
jmp 0x408012
mov eax, str.HOME
call fcn.00407eb0
lea esi, [esi]
lea esi, [esi]

Function at 0x408230
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x424040]
test eax, eax
je 0x408269
mov dword [esp + 4], 0x1388
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
test eax, eax
jne 0x408280
mov eax, dword [0x424040]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
cmp byte [0x429080], 0
jne 0x4082a0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [0x424040]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
sub esp, 8
jmp 0x408258
mov edx, 0x414
lea edi, [esp + 0x12]
mov dword [esp + 0x12], 0
mov esi, dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [esp + 0x16], 3
mov ebx, 0x14
mov dword [esp + 0x1a], 0x4290a0
mov dword [esp + 0x1e], 0x417204
mov word [esp + 0x22], dx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x417204
mov dword [esp], edi
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
sub esp, 4
jmp 0x408373
test al, 0x10
je 0x408272
mov dword [esp], 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x414
sub esp, 4
mov dword [esp + 0x12], 0
mov dword [esp + 0x16], 3
mov dword [esp + 0x1a], 0x4290a0
mov dword [esp + 0x1e], 0x417204
mov word [esp + 0x22], ax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x417204
mov dword [esp], edi
call esi
sub esp, 4
sub ebx, 1
je 0x408272
mov dword [esp], 0x4290a0
call ebp
sub esp, 4
cmp eax, 0xffffffff
jne 0x408308
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401a40
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
push str.GlobalShareMemProc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x401b11
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401b11
call fcn.004016c0
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x431350
push 0x67
push esi
call edi
push 0x64
push 0x4313b8
push 0x6d
push esi
call edi
mov eax, esi
call fcn.00401b20
mov eax, dword [ebp + 0x14]
push eax
mov eax, esi
call fcn.00401bb0
add esp, 4
test eax, eax
jne 0x401abc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
call esi
test eax, eax
je 0x401aff
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
nop
lea edx, [esp + 0xc]
push edx
call edi
lea eax, [esp + 0xc]
push eax
call ebx
push 0
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
call esi
test eax, eax
jne 0x401ae0
call fcn.00401990
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404930
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x422ea2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor ebx, ebx
mov dword [esp + 0xc], ebx
lea eax, [ebp + 0x54]
push esi
mov dword [ebp], 0x428fa4
push edi
mov dword [esp + 0x18], eax
mov dword [eax], vtable.std::ios_base.0
mov dword [esp + 0x24], ebx
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov eax, 1
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebp]
mov edi, dword [edx + 4]
add edi, ebp
push ebx
push ebx
mov ecx, edi
mov dword [edi + 0x24], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], 0x201
mov dword [edi + 0x14], 6
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
call fcn.00402fc0
push 4
call fcn.0040a90f
add esp, 4
cmp eax, ebx
je 0x4049d3
mov ecx, eax
call fcn.004028e0
jmp 0x4049d5
xor eax, eax
lea esi, [ebp + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x24], eax
mov dword [edi + 0x28], esi
mov dword [edi + 0x2c], ebx
call fcn.00406940
cmp dword [edi + 0x28], ebx
mov byte [edi + 0x30], al
jne 0x404a04
mov eax, dword [edi + 8]
or eax, 4
or eax, 4
push ebx
push eax
mov ecx, edi
call fcn.00402fc0
mov dword [edi + 4], ebx
mov dword [esp + 0x24], 4
mov eax, dword [ebp]
mov ecx, dword [eax + 4]
mov dword [ecx + ebp], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
mov dword [esp + 0x18], esi
call fcn.004065e0
mov byte [esp + 0x24], 5
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov edx, dword [0x4315d4]
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 4
Function at 0x4065e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4223eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esp + 4], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00409cdf
mov dword [esp + 0x10], 0
push 4
call fcn.0040a90f
add esp, 4
test eax, eax
je 0x40662a
mov ecx, eax
call fcn.004028e0
jmp 0x40662c
xor eax, eax
mov dword [esi + 0x38], eax
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x409060
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x422de9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
xor edi, edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 4]
push ecx
mov dword [esi], vtable.Share::FileSystem::CFolder.0
call fcn.004073e0
mov byte [esp + 0x14], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov byte [esp + 0x14], 2
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov byte [esp + 0x14], 3
mov ecx, esi
call fcn.00409160
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.004072e0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 0x24

Function at 0x4094d0
Capabilities:
Create thread

Disassembly:
push ebx
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x409522
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x409522
push esi
push ebx
mov byte [esi + 0x10], 1
mov dword [esi + 0x14], ebx
push 0x409610
call fcn.0040cd32
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0xc]
add esp, 0xc
test ecx, ecx
je 0x409522
mov edx, dword [esi + 0xc]
test edx, edx
je 0x409522
mov eax, dword [esi + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp eax, ebx
je 0x409522
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
mov al, 1
pop ebx
ret
xor al, al
pop ebx
ret
Function at 0x409530
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4222fe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
call fcn.00408fd0
mov dword [esp + 8], eax
mov byte [edi + 0x11], 1
mov al, byte [edi + 0x12]
xor ebx, ebx
test al, al
mov dword [esp + 0xc], edx
jne 0x4095da
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
test byte [0x4315d0], 1
jne 0x40959b
or dword [0x4315d0], 1
mov dword [esp + 0x1c], ebx
call esi
mov dword [0x4315cc], eax
mov dword [esp + 0x1c], 0xffffffff
call esi
sub eax, dword [0x4315cc]
mov ecx, eax
xor eax, eax
sub ecx, dword [esp + 8]
sbb eax, dword [esp + 0xc]
add ecx, 1
adc eax, ebx
cmp eax, ebx
ja 0x4095cb
jb 0x4095c2
cmp ecx, 0x1388
jae 0x4095cb
mov cl, byte [edi + 0x12]
test cl, cl
je 0x409570
jmp 0x4095da
mov edx, dword [edi + 0xc]
push 0xff
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov byte [edi + 0x11], bl
mov byte [edi + 0x12], 1
mov byte [edi + 0x13], bl
mov dword [edi + 0x14], ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a253
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e454]
jne 0x40a25d
repz ret
jmp fcn.004109a8

Function at 0x40cb6d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x40cb9a
call fcn.00410648
mov dword [eax], esi
call fcn.00410635
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040aa7f
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x40cb76
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40cbc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041065b
pop ecx
call fcn.00410635
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x40cbf0
test al, 1
je 0x40cbf0
test byte [esp + 0xc], 2
je 0x40cbf0
call fcn.00410648
mov dword [eax], 5
call fcn.00410635
mov dword [eax], 0xd
jmp 0x40cbc0
xor eax, eax
pop esi
ret