joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b2fa
Capabilities:
Get common file path
Get disk size
Timestomp file

Disassembly:
mov eax, 0x423f88
call fcn.00408b60
sub esp, 0x240
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x10]
mov ecx, edi
call fcn.0041411c
test byte [ebp + 0xd], 0x10
je 0x41b3cb
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call fcn.00419211
test eax, eax
je 0x41b3cb
lea ecx, [ebp - 0x10]
call fcn.00414046
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00413e07
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x41b36a
mov ebx, dword [ebp - 0x2c]
imul ebx, dword [ebp - 0x30]
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
add eax, eax
cmp ebx, eax
jle 0x41b3bf
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov eax, dword [ebp - 0x1c]
push 0x105
mov ecx, edi
and byte [eax], 0
call fcn.004144cc
push eax
push 0
lea eax, [ebp - 0x24c]
push 0x426f4c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.0041451b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00414191
mov eax, dword [edi]
xor ebx, ebx
cmp dword [eax - 8], ebx
je 0x41b488
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.00413636
test eax, eax
je 0x41b488
push dword [ebp + 8]
lea ecx, [esi + 0xc]
call fcn.004142d9
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x41b439
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.004192c3
pop ecx
lea eax, [ebp - 0x20]
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_SetFileTime]
lea eax, [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_GetFileSecurityA]
push eax
push ebx
push ebx
push 4
push dword [ebp + 8]
mov dword [ebp + 0xc], ebx
call esi
test eax, eax
je 0x41b483
push dword [ebp + 0xc]
call fcn.00412f5c
mov ebx, eax
pop ecx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push ebx
push 4
push dword [ebp + 8]
call esi
test eax, eax
je 0x41b47c
push ebx
push 4
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
push ebx
call fcn.00412f98
pop ecx
push 1
pop eax
jmp 0x41b49f
mov ecx, edi
call fcn.0041411c
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00413636
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x41c923
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x41c940
cmp dword [0x43574c], edi
jne 0x41ca92
cmp word [0x435758], di
mov dword [0x43574c], 1
jne 0x41c972
push str.MSH_SCROLL_LINES_MSG
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
xor ecx, ecx
cmp eax, edi
setne cl
inc ecx
mov dword [0x435754], eax
mov word [0x435758], cx
cmp word [0x435758], 2
jne 0x41c9ae
push str.Magellan_MSWHEEL
push str.MouseZ
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x41c9ae
mov ecx, dword [0x435754]
cmp ecx, edi
je 0x41c9ae
push edi
push edi
push ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x435750], eax
jmp 0x41ca97
push 0x94
lea eax, [ebp - 0x9c]
push edi
push eax
call fcn.00408b80
add esp, 0xc
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x94
mov dword [0x435750], 3
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x41ca92
cmp dword [ebp - 0x8c], 1
je 0x41ca02
cmp dword [ebp - 0x8c], 2
jne 0x41ca92
cmp dword [ebp - 0x98], 4
jae 0x41ca71
lea eax, [ebp + 8]
push eax
push 1
push edi
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41ca92
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x80
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.WheelScrollLines
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41ca66
push 0xa
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.004087f0
add esp, 0xc
mov dword [0x435750], eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41ca92
cmp dword [ebp - 0x8c], 2
jne 0x41ca92
cmp dword [ebp - 0x98], 4
jb 0x41ca92
push edi
push 0x435750
push edi
push 0x68
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [0x435750]
pop edi
leave
ret

Function at 0x41d7e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x7c], 0
je 0x41d824
push dword [ebp + 8]
call fcn.00422452
mov esi, eax
test esi, esi
je 0x41d84f
lea eax, [ebp + 0x10]
push 4
push eax
push 4
push 0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
sete al
jmp 0x41d84f
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push 0x427b94
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10]
push dword [esi + 0x90]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
leave
ret 0xc
Function at 0x4213fd
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x423d0a
call fcn.00408b60
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CNoTrackObject.0
xor eax, eax
push 0xa
lea ecx, [esi + 0x30]
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00412a65
push 0xa
lea ecx, [esi + 0x4c]
mov byte [ebp - 4], 1
call fcn.00412a65
push 0xa
lea ecx, [esi + 0x68]
mov byte [ebp - 4], 2
call fcn.00412888
mov ecx, dword [ebp - 0xc]
mov dword [esi], vtable.AFX_MODULE_THREAD_STATE.0
mov dword [esi + 0xc], 0x54
mov dword [esi + 0x28], 0x412f40
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x42179e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x423da8
call fcn.00408b60
sub esp, 0x120
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
mov dword [ebp - 0x14], ebx
call fcn.0041d66c
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x4217e4
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.0041d67e
cmp eax, ebx
je 0x4217df
mov edx, dword [eax]
push ebx
push ebx
push 0xfffffffffffffffc
push ebx
mov ecx, eax
call dword [edx + 0x14]
cmp dword [ebp - 0x1c], ebx
jne 0x4217c4
cmp dword [edi + 0x7c], ebx
je 0x4218bb
push str.Software_
lea ecx, [ebp - 0x10]
call fcn.004141ff
push dword [edi + 0x7c]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.00414478
lea eax, [ebp - 0x10]
push 0x4268c8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004143a5
push dword [edi + 0x90]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004143a5
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.00414191
lea eax, [ebp - 0x18]
mov esi, 0x80000001
push eax
push esi
mov ecx, edi
call fcn.004218cd
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, ebx
jne 0x42188f
lea eax, [ebp - 0x12c]
push 0x104
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
jne 0x421886
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
push esi
call fcn.004218cd
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00414191
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00414191
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4218cd
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x423dbc
call fcn.00408b60
sub esp, 0x110
push ebx
push esi
lea eax, [ebp - 0x14]
push edi
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x42198c
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, 0xff
lea eax, [ebp - 0x11c]
push ebx
push eax
push esi
push dword [ebp - 0x14]
call edi
mov esi, eax
test esi, esi
jne 0x42196c
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x18]
push eax
call fcn.004141ff
mov ecx, dword [ebp - 0x1c]
and dword [ebp - 4], esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
call fcn.004218cd
mov esi, eax
xor eax, eax
test esi, esi
setne al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
mov byte [ebp - 0xd], al
call fcn.00414191
cmp byte [ebp - 0xd], 0
jne 0x42196c
lea eax, [ebp - 0x11c]
push ebx
push eax
push 0
push dword [ebp - 0x14]
jmp 0x421916
cmp esi, 0x103
je 0x42197c
cmp esi, 0x3f2
jne 0x42198c
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x421cbc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x421cea
mov eax, dword [esp + 0xc]
cmp eax, dword [esi + 8]
jl 0x421d8c
cmp dword [esp + 0x10], 0
je 0x421d8c
test esi, esi
jne 0x421d26
push 0x10
call fcn.00421ad9
test eax, eax
je 0x421cff
mov dword [eax], vtable.CThreadData.0
mov esi, eax
jmp 0x421d01
xor esi, esi
and dword [esi + 8], 0
and dword [esi + 0xc], 0
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [edi + 0x14]
call fcn.00421a7b
lea eax, [edi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x421d3e
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x421d4e
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x421d5a
call fcn.00411e4f
mov eax, dword [esi + 8]
mov ecx, eax
imul ecx, ecx, 0x3fffffff
add ecx, dword [edi + 0xc]
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
push 0
lea eax, [ecx + eax*4]
push eax
call fcn.00408b80
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [esi + 8], eax
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
pop edi
mov dword [eax + edx*4], ecx
pop esi
ret 8

Function at 0x421dc1
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 1
mov ebx, ecx
pop edi
cmp dword [esi + 8], edi
mov dword [ebp - 4], edi
jle 0x421e14
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x421df7
mov ecx, dword [ebx + 0x10]
cmp dword [ecx + edi*8 + 4], eax
je 0x421df7
mov eax, dword [esi + 0xc]
cmp dword [eax + edi*4], 0
je 0x421e0e
and dword [ebp - 4], 0
jmp 0x421e0e
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x421e07
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0xc]
and dword [eax + edi*4], 0
inc edi
cmp edi, dword [esi + 8]
jl 0x421dd8
cmp dword [ebp - 4], 0
je 0x421e53
lea edi, [ebx + 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [ebx + 0x14]
call fcn.00421a8e
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x421e49
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
push 0
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4226e5
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00409780
pop ecx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
je 0x422761
mov edi, 0x80000000
and byte [eax], 0
lea eax, [ebp + 8]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x422761
lea eax, [ebp - 0x108]
xor ebx, ebx
push 0x105
push eax
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x42273e
push 1
pop ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x422761
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.00409280
pop ecx
test eax, eax
pop ecx
jne 0x42270c
push esi
call fcn.00408af0
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40b39d
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp eax, ebx
je 0x40b545
cmp word [eax], bx
je 0x40b545
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40b541
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp eax, ebx
jle 0x40b538
push dword [ebp + 0x10]
call fcn.0040be91
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x40b538
cmp dword [ebp + 0x10], 0xffffffff
push edi
mov edi, dword [ebp + 8]
jne 0x40b414
push 2
jmp 0x40b417
push dword [ebp + 0x10]
push edi
call fcn.0040c013
mov esi, eax
cmp esi, ebx
je 0x40b52e
cmp edi, 0xffffffff
jne 0x40b42e
mov edi, esi
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x30], edi
mov edi, dword [ebp - 4]
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 4]
add edi, 8
push edi
push ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x14], ebx
push dword [0x42f91c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x28], eax
cmp eax, ebx
je 0x40b472
mov dword [eax + 4], edi
mov eax, dword [esi + 0x28]
mov dword [eax], ebx
mov eax, dword [esi + 0x28]
add eax, 8
mov dword [esi + 0x44], eax
cmp dword [ebp + 0x10], 0xffffffff
je 0x40b47f
mov dword [esi + 0x34], 1
push esi
push dword [ebp + 0xc]
call fcn.00411bb0
pop ecx
pop ecx
mov dword [ebp + 0x10], ebx
mov edi, 0x4000
cmp dword [ebp - 4], ebx
jle 0x40b52b
mov eax, dword [ebp + 0x10]
lea ecx, [edi + eax]
cmp ecx, dword [ebp - 4]
jle 0x40b4ab
mov edi, dword [ebp - 4]
sub edi, eax
push edi
push dword [ebp + 0xc]
call fcn.00411c90
pop ecx
pop ecx
mov dword [ebp + 8], eax
cmp eax, ebx
je 0x40b51b
push ebx
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 8]
add dword [ebp + 0x10], eax
cmp dword [esi + 0x14], ebx
jne 0x40b4e4
push eax
push dword [ebp + 8]
call fcn.0040bf7a
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jl 0x40b4f0
push 1
jmp 0x40b4f1
push ebx
push dword [ebp - 8]
push dword [ebp + 0xc]
call fcn.00415b00
add esp, 0xc
cmp eax, ebx
je 0x40b50d
mov eax, dword [ebp - 4]
cmp dword [ebp + 0x10], eax
jl 0x40b49b
jmp 0x40b52b
push dword [ebp + 0xc]
call fcn.00411df0
pop ecx
mov dword [esi + 0x18], eax
jmp 0x40b522
mov dword [esi + 0x18], 1
push dword [ebp + 0xc]
push esi
call fcn.0040bf3a
mov dword [esi + 0x2c], ebx
push dword [ebp + 0xc]
call fcn.00414500
pop ecx
pop edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x40b547
xor eax, eax
pop esi
pop ebx
leave
ret 0xc
Function at 0x40f7c2
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x40f811
push dword [esp + 0x10]
push 0x40f740
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x42fba4]
cmp esi, ebx
je 0x40f865
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x40f809
cmp byte [esi + 0x10], bl
je 0x40f809
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x40f7e6
jmp 0x40f865
mov esi, dword [0x42fba4]
cmp esi, ebx
je 0x40f865
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40f85e
cmp byte [esi + 0x11], bl
je 0x40f83b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x40f851
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x42fba4
call fcn.00411371
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x40f81c
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x40f8c7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [0x42fc08]
call fcn.004111dd
or dword [ebp - 4], 0xffffffff
mov ebx, eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
movzx ecx, word [eax]
test cx, cx
je 0x40f98c
mov edx, dword [ebp + 8]
push 2
pop esi
cmp cx, 0x20
jne 0x40f908
add eax, esi
cmp word [eax], 0x20
je 0x40f900
movzx ecx, word [eax]
mov dword [ebp - 8], 1
cmp ecx, 0x22
jne 0x40f943
add eax, esi
movzx ecx, word [eax]
mov edi, eax
test cx, cx
je 0x40f93f
cmp cx, 0x22
je 0x40f933
add eax, esi
movzx ecx, word [eax]
test cx, cx
jne 0x40f923
cmp word [eax], 0
je 0x40f93f
mov edx, eax
add eax, esi
jmp 0x40f968
mov edx, eax
jmp 0x40f968
test cx, cx
je 0x40f964
mov edi, eax
cmp cx, 0x20
je 0x40f95a
add eax, esi
movzx ecx, word [eax]
test cx, cx
jne 0x40f94a
cmp word [eax], 0
mov edx, eax
je 0x40f968
jmp 0x40f93b
and dword [ebp - 8], 0
mov ecx, dword [ebx]
cmp ecx, dword [ebp - 4]
jne 0x40f976
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x40f997
xor edi, edi
cmp dword [ebp - 8], edi
je 0x40f980
inc dword [ebp - 4]
movzx ecx, word [eax]
test cx, cx
jne 0x40f8fa
cmp dword [ebp + 8], 0
jne 0x40f9a7
mov eax, dword [ebp - 4]
jmp 0x40f9ad
test edi, edi
je 0x40f9aa
sub edx, edi
sar edx, 1
mov dword [ecx], edx
inc dword [ebx]
mov eax, edi
jmp 0x40f9ad
mov ecx, dword [ebp + 8]
and dword [ecx], 0
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4104f7
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x41056d
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea eax, [ebp + eax*2 - 0x20c]
jmp 0x41054e
movzx edx, word [eax - 2]
cmp edx, 0x20
je 0x41054b
cmp edx, 0x5c
je 0x41054b
cmp edx, 0x2f
jne 0x410558
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x410538
xor ecx, ecx
mov word [eax], cx
push ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x41056f
xor eax, eax
leave
ret 4

Function at 0x4105f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x410625
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x410940
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x410a43
cmp word [esi], ax
je 0x410a43
mov eax, dword [esp + 0xc]
mov ecx, dword [0x42fc28]
push edi
push eax
push ecx
call fcn.004110c5
mov edi, eax
test edi, edi
je 0x410a3e
mov eax, dword [esp + 0x18]
cmp eax, 0x19
jne 0x4109de
cmp dword [edi + 4], 0
mov eax, esi
lea edx, [eax + 2]
je 0x4109b0
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x410990
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
push edx
push esi
push edi
call fcn.00410a50
pop edi
pop esi
pop ecx
ret 0xc
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4109b0
sub eax, edx
push 0
sar eax, 1
lea ecx, [esp + 0xc]
push ecx
lea edx, [eax + eax]
mov eax, dword [edi]
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor ecx, ecx
cmp eax, 2
setne cl
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [ecx - 1]
and eax, 0xfde9
push eax
call fcn.00410b50
mov esi, eax
test esi, esi
je 0x410a3e
cmp dword [edi + 4], 0
je 0x410a18
mov eax, dword [esp + 0x14]
push eax
push esi
push edi
call fcn.00410a50
mov dword [esp + 8], eax
jmp 0x410a2e
mov edx, dword [esp + 0x14]
mov eax, dword [edi]
push 0
lea ecx, [esp + 0xc]
push ecx
push edx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [0x42f91c]
push esi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x410a50
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x410a85
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x410afa
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x410ae7
dec ecx
je 0x410ad2
sub ecx, 2
je 0x410abf
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.004105f0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x410b27
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc

Function at 0x412690
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edx]
mov eax, dword [eax + 0x1f0]
test cx, cx
je 0x4126b6
mov edi, edi
imul eax, eax, 0xf4243
movzx ecx, cx
add edx, 2
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x4126a0
ret