joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4031c5
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xce4
mov eax, dword [0x42300c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x423028]
xor ebx, ebx
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x80c], esi
push edi
cmp esi, 0xffffffff
jne 0x4032ca
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, esi
je 0x40320c
mov esi, eax
mov dword [ebp - 0x80c], esi
jmp 0x403222
push ecx
push 0x71
push str.z:_build_build_src_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea ecx, [ebp - 0x8c0]
call fcn.0040162d
xor ebx, ebx
inc ebx
test bl, 1
je 0x403235
lea ecx, [ebp - 0x8c0]
and ebx, 0xfffffffe
call fcn.004016bf
mov edi, dword [sym.imp.KERNEL32.dll_TlsFree]
cmp esi, 0xffffffff
jne 0x403295
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x403255
mov esi, eax
mov dword [ebp - 0x80c], esi
jmp 0x40326b
push ecx
push 0x7b
push str.z:_build_build_src_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea ecx, [ebp - 0x970]
or ebx, 2
call fcn.0040162d
test bl, 2
je 0x40327e
lea ecx, [ebp - 0x970]
and ebx, 0xfffffffd
call fcn.004016bf
push 0xffffffffffffffff
call edi
test bl, 8
je 0x403295
lea ecx, [ebp - 0xad0]
and ebx, 0xfffffff7
call fcn.004016bf
mov ecx, esi
mov edx, 0x423028
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x4032ca
push esi
call edi
test bl, 0x10
je 0x4032be
lea ecx, [ebp - 0xb80]
and ebx, 0xffffffef
call fcn.004016bf
mov esi, dword [0x423028]
mov dword [ebp - 0x80c], esi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4032ee
push ecx
push 0x8d
push str.z:_build_build_src_security_sandbox_chromium_base_threading_thread_local_storage.cc
lea ecx, [ebp - 0xa20]
or ebx, 4
call fcn.0040162d
test bl, 4
je 0x403301
lea ecx, [ebp - 0xa20]
and ebx, 0xfffffffb
call fcn.004016bf
mov edi, 0x800
lea eax, [ebp - 0x808]
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test bl, 0x20
je 0x403339
lea ecx, [ebp - 0xc30]
and ebx, 0xffffffdf
call fcn.004016bf
push edi
call dword [sym.imp.mozglue.dll_moz_xmalloc]
pop ecx
push eax
push dword [ebp - 0x80c]
mov edi, eax
mov dword [ebp - 0x810], eax
mov ecx, 0x200
lea esi, [ebp - 0x808]
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test bl, 0x40
je 0x403373
lea ecx, [ebp - 0xce0]
call fcn.004016bf
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x810]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040c535
mov esp, ebp
pop ebp
ret
Function at 0x40338a
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1414
call fcn.0040d260
mov eax, dword [0x42300c]
xor eax, esp
mov dword [esp + 0x1410], eax
mov eax, dword [0x423028]
and dword [esp + 4], 0
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0xc], eax
push edi
mov ecx, 0x200
lea edi, [esp + 0x18]
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push ebx
call dword [sym.imp.mozglue.dll_free]
pop ecx
call fcn.00403573
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
push dword [esp + 0x14]
mov ecx, 0x300
lea edi, [esp + 0x81c]
mov esi, 0x423d10
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ebx, pe_nt_image_headers32
xor cl, cl
lea edi, [esp + 0x820]
xor esi, esi
mov edx, dword [esp + esi*8 + 0x18]
test edx, edx
je 0x403441
cmp dword [edi - 8], 0
je 0x403441
mov eax, dword [esp + esi*8 + 0x1c]
cmp eax, dword [edi]
jne 0x403441
cmp dword [edi - 4], 0
je 0x403441
and dword [esp + esi*8 + 0x18], 0
push edx
call dword [edi - 4]
pop ecx
mov cl, 1
inc esi
add edi, 0xc
cmp esi, 0x100
jl 0x403419
dec ebx
test ebx, ebx
jle 0x403456
test cl, cl
jne 0x40340e
push 0
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x141c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c535
mov esp, ebp
pop ebp
ret

Function at 0x403477
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x423028]
sub esp, 0x168
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 0xffffffff
je 0x40349a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x40349f
call fcn.004031c5
or dword [edi + 4], 0xffffffff
and dword [edi + 8], 0
call fcn.00403573
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov ebx, dword [0x42497c]
xor ecx, ecx
lea eax, [ebx + 1]
add eax, ecx
movzx edx, al
imul eax, edx, 0xc
cmp dword [eax + 0x423d10], 0
je 0x4034dc
inc ecx
cmp ecx, 0x100
jl 0x4034bd
jmp 0x403502
imul eax, edx, 0xc
mov dword [0x42497c], edx
and dword [eax + 0x423d14], 0
mov dword [eax + 0x423d10], 1
mov dword [edi + 4], edx
mov eax, dword [eax + 0x423d18]
mov dword [edi + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
push ecx
mov ecx, dword [edi + 4]
call fcn.0040316c
mov esi, str.z:_build_build_src_security_sandbox_chromium_base_threading_thread_local_storage.cc
pop ecx
test eax, eax
je 0x403539
push eax
push 0x11b
push esi
lea ecx, [ebp - 0xb4]
call fcn.00401668
lea ecx, [ebp - 0xb4]
call fcn.004016bf
push ecx
mov ecx, dword [edi + 4]
call fcn.00403197
pop ecx
test eax, eax
je 0x403564
push eax
push 0x11c
push esi
lea ecx, [ebp - 0x164]
call fcn.00401668
lea ecx, [ebp - 0x164]
call fcn.004016bf
mov dword [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4036e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
test esi, esi
jne 0x4036fc
xor al, al
jmp 0x4037d4
mov ecx, dword [ebx + 4]
mov eax, dword [ecx + 0x3c]
push dword [eax + ecx + 0x78]
mov ecx, ebx
call fcn.0040380f
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4036f5
push edi
mov edi, dword [ebp + 8]
cmp edi, 0xffff
ja 0x403728
mov word [esi], di
jmp 0x4037cd
push dword [eax + 0x20]
mov ecx, ebx
call fcn.0040380f
mov ecx, dword [ebp - 0xc]
mov edx, eax
mov dword [ebp - 0x10], edx
mov esi, edx
mov ecx, dword [ecx + 0x18]
lea eax, [edx + ecx*4]
mov dword [ebp - 8], eax
cmp edx, eax
je 0x4037d1
sub eax, esi
sar eax, 2
mov eax, eax
test eax, eax
jns 0x40375b
add eax, 1
sar eax, 1
lea eax, [esi + eax*4]
mov ecx, ebx
push dword [eax]
mov dword [ebp - 4], eax
call fcn.0040380f
mov cl, byte [edi]
mov edx, edi
jmp 0x40377a
cmp cl, byte [eax]
jne 0x40377e
inc edx
inc eax
mov cl, byte [edx]
test cl, cl
jne 0x403772
movzx eax, byte [eax]
movzx ecx, byte [edx]
sub ecx, eax
je 0x4037a3
test ecx, ecx
jle 0x403797
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
add esi, 4
jmp 0x40379d
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp esi, eax
jne 0x40374d
jmp 0x4037a8
mov eax, dword [ebp - 4]
mov esi, eax
test ecx, ecx
jne 0x4037d1
mov edi, dword [ebp - 0xc]
mov ecx, ebx
push dword [edi + 0x24]
call fcn.0040380f
sub esi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
sar esi, 2
mov ax, word [eax + esi*2]
add ax, word [edi + 0x10]
mov word [ecx], ax
mov al, 1
jmp 0x4037d3
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4037dc
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [ecx + 4]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4037ec
xor al, al
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4037e9
mov ecx, 0xe0
cmp word [eax + 0x14], cx
jne 0x4037e9
add ecx, 0x2b
cmp word [eax + 0x18], cx
sete al
ret
Function at 0x4075fc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push dword [ebp + 8]
push edi
push 0x8000004
push edi
mov dword [esi], edi
push 0xffffffffffffffff
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push eax
mov ecx, esi
call fcn.00402af6
cmp dword [esi], edi
je 0x407641
cmp dword [esi], 0xffffffff
je 0x407641
push dword [ebp + 8]
push edi
push edi
push 6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
pop edi
mov eax, esi
pop esi
pop ecx
pop ebp
ret 4
Function at 0x408d42
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x42300c]
xor eax, esp
mov dword [esp + 0x270], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x28], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x28]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0xc], eax
call fcn.0040a26e
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
cmp byte [eax + 4], 0
je 0x408de2
push ebx
push dword [esp + 0x10]
push dword [esp + 0x24]
push dword [esp + 0x2c]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [esp + 0x3c]
push dword [esp + 0x30]
push edi
push esi
call dword [esp + 0x38]
test eax, eax
je 0x408de2
xor eax, eax
inc eax
jmp 0x408ee4
mov edx, esi
mov ecx, str.CreateProcessW
call fcn.00402821
call fcn.0040a26e
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 8]
cmp dword [eax], 1
jle 0x408ee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0x10
pop edx
mov ecx, ebx
mov dword [esp + 0x14], eax
call fcn.0040a3e6
pop ecx
test al, al
je 0x408ed8
call fcn.0040a38d
mov edi, eax
test edi, edi
je 0x408ed8
and dword [esp + 0xc], 0
lea eax, [esp + 0x70]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x408e5d
cmp eax, 0x104
lea ecx, [esp + 0x70]
push 0
pop eax
cmovae ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [edi + 8]
add eax, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
xor eax, eax
push 0x34
push eax
lea eax, [esp + 0x44]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x34], 0x10
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.0040948e
add esp, 0x18
test eax, eax
jne 0x408ed8
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [esp + 0x44], 0
jne 0x408ee2
mov edx, esi
mov ecx, str.CreateProcessW
call fcn.00402936
jmp 0x408dda
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c535
mov esp, ebp
pop ebp
ret 0x2c
Function at 0x40ba05
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x42300c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, dword [0x424ae4]
test esi, esi
jne 0x40ba5a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x40ba42
xor al, al
jmp 0x40ba83
push str.GetUserDefaultLocaleName
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x424ae4], esi
test esi, esi
je 0x40ba3e
push edi
mov edi, 0xaa
lea eax, [ebp - 0xb0]
push edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb0]
push edi
push eax
call esi
neg eax
pop edi
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040c535
mov esp, ebp
pop ebp
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x40596d
pop dword [ebp - 0x3c]
mov eax, 0x4a1e601f
add eax, 0xb621f94e
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xfd90d7ec
sub dword [ebp - 0x4c], 0xaf3e92a1
mov dword [ebp - 0x48], 0x5328db22
sub dword [ebp - 0x48], 0x20f58edd
mov dword [ebp - 0x44], 0xabda3a1e
sub dword [ebp - 0x44], 0x5f8df5f0
mov dword [ebp - 0x40], 0x934ebe25
add dword [ebp - 0x40], 0x6cb141db
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x3e198939
sub eax, 0x3dd918d9
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xd56cc264
add dword [ebp - 0x4c], 0x9f05a6f2
mov dword [ebp - 0x48], 0x72ffc7e5
sub dword [ebp - 0x48], 0x31936670
mov dword [ebp - 0x44], 0x73ce81ed
add dword [ebp - 0x44], 0xefa0ea7f
mov dword [ebp - 0x40], 0xc653b673
sub dword [ebp - 0x40], 0xc653b673
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x34513
push 0
call eax
mov ecx, 0x3e67
xor edx, edx
add edx, eax
mov esi, 0xb1530dcb
sub esi, 0xb1120dcb
add esi, dword [ebp - 0x3c]
mov ebx, 0xed3aeca7
mov edi, dword [esi]
xor dword [ebp - 0x14], edi
xor edi, ebx
add dword [ebp - 0x24], esi
mov dword [edx], edi
sub dword [ebp - 4], edx
add edx, 0xa9877540
add edx, 0x56788ac4
add esi, 0x5bc18a85
sub esi, 0x5bc18a81
loop 0x405a80
add eax, 0xefab7309
sub eax, 0xefaa869a
xor ebx, ebx
add ebx, eax
add eax, 0xa9417052
sub eax, 0xa941704d
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040595e
jmp 0x406676

Function at 0x414dd2
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], edi
mov edx, 0x29c39769
push edx
mov esi, dword [esp]
add esp, 4
add ecx, 4
sub edx, 0x1f3e1cc1
sub eax, edx
sub eax, esi
cmp ecx, ebx
jne fcn.00414dd2
or esi, esi
add eax, 0xf948195b
dec edx
ret
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401029
or eax, 0xffffffff
jmp 0x40103c
mov edx, dword [ebp - 4]
and edx, 1
je 0x40103a
mov eax, 1
jmp 0x40103c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x40105e
or eax, 0xffffffff
jmp 0x401071
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x40106f
mov eax, 1
jmp 0x401071
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4011a0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x10], 0xfffffc19
mov dword [ebp - 0xc], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x4011eb
mov dword [ebp - 0x10], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x401227
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea edx, [ebp - 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401227
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x401240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0xfffffc19
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xc], 0
jle 0x401329
mov eax, dword [ebp + 0xc]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401f10
add esp, 0xc
push 0
push 0x8000080
push 3
push 0
push 3
push SysReAllocString
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x4012cb
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x401329
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40130b
mov dword [ebp - 0x14], 0xfffffffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x401329
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0xc]
je 0x40131c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], ecx
jmp 0x401329
cmp dword [ebp - 0x18], 0xffffffff
je 0x401339
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x401350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x28], 0xfffffc19
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
cmp dword [ebp + 0x14], 0
je 0x4013a9
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401120
add esp, 8
cmp eax, 0xffffffff
jne 0x4013a9
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jle 0x401452
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4013ea
mov dword [ebp - 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x401452
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 0
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40142a
mov dword [ebp - 0x28], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x401452
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x20]
je 0x401444
mov dword [ebp - 0x28], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
jmp 0x40144b
mov dword [ebp - 0x28], 0
jmp 0x401452
cmp dword [ebp - 0x2c], 0xffffffff
je 0x401462
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0x14], 0
je 0x40147e
cmp dword [ebp - 4], 1
jne 0x40147e
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004011a0
add esp, 8
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret
Function at 0x401490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0xfffffc19
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0xc], 0
jle 0x401591
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x401504
mov dword [ebp - 0x14], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x401591
push 0
lea ecx, [ebp - 8]
push ecx
push 0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push 2
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40153d
mov dword [ebp - 0x14], 0xfffffffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x401591
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401569
mov dword [ebp - 0x14], 0xfffffffd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
je 0x401583
mov dword [ebp - 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
jmp 0x40158a
mov dword [ebp - 0x14], 0
jmp 0x401591
cmp dword [ebp - 0x18], 0xffffffff
je 0x4015a1
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x401ef4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43e2c4]
jne 0x401efe
repz ret
jmp fcn.00404156