joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431004]
jne 0x401010
repz ret
jmp fcn.00401788

Function at 0x405655
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004030b9
and dword [ebp - 4], 0
cmp dword [0x432db0], 0
mov ebx, eax
jne 0x405706
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4057b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4057b7
push eax
call fcn.00403047
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x432db0], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x432db4], eax
call esi
push eax
call fcn.00403047
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x432db8], eax
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x432dc0], eax
test eax, eax
je 0x405706
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00403047
pop ecx
mov dword [0x432dbc], eax
mov eax, dword [0x432dbc]
cmp eax, ebx
je 0x40575e
cmp dword [0x432dc0], ebx
je 0x40575e
push eax
call fcn.004030c2
push dword [0x432dc0]
mov esi, eax
call fcn.004030c2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40575e
test edi, edi
je 0x40575e
call esi
test eax, eax
je 0x405755
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405755
test byte [ebp - 0xc], 1
jne 0x40575e
or dword [ebp + 0x10], 0x200000
jmp 0x405797
mov eax, dword [0x432db4]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405797
mov eax, dword [0x432db8]
cmp eax, ebx
je 0x405797
push eax
call fcn.004030c2
pop ecx
test eax, eax
je 0x405797
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432db0]
call fcn.004030c2
pop ecx
test eax, eax
je 0x4057b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4057b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e6e2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x440d24]
push dword [0x440a40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret

Function at 0x42e771
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp ebx, 0x19f
jne 0x42e786
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x42e7c2
push esi
and dword [ebp - 8], 0
lea esi, [ebp - 8]
mov dword [ebp - 4], 5
call fcn.0042e766
mov eax, dword [ebp - 8]
add eax, 0x46
mov dword [ebp - 4], eax
sub dword [ebp - 4], 0xa
sub dword [ebp - 4], 0x3c
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 4]
add eax, edi
xor byte [eax], cl
inc edi
cmp edi, ebx
jl 0x42e78e
pop esi
pop edi
cmp ebx, 0x2d
jne 0x42e7d9
or dword [0x440d34], 0xffffffff
mov dword [0x440d30], 0xa62e7790
leave
ret
Function at 0x4036db
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x104
jb 0x412807
push edi
push dword [ebp + 8]
push 0x403634
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov edi, eax
test edi, edi
jl 0x412811
push dword [ebp + 8]
push 0x40360c
push 0x403730
push 4
call fcn.004173ad
add esp, 0x10
mov eax, edi
pop edi
pop ebp
ret 8
mov eax, 0x80070057
jmp 0x40372b
push 0x41abdc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040258e
jmp 0x403711

Function at 0x4037ab
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x220]
call fcn.00401415
xor ebx, ebx
cmp esi, ebx
je 0x412a37
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.004036db
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x4038e6
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x412a41
lea eax, [ebp - 0x20c]
push eax
push 0x403660
mov esi, 0x403910
push esi
push 4
call fcn.004173ad
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
je 0x412a50
mov ecx, edi
mov dword [ebp - 0x21c], ebx
call fcn.00401435
push eax
push 0x40396c
push esi
push 4
mov dword [ebp - 0x218], eax
call fcn.004173ad
add esp, 0x10
push ebx
lea eax, [ebp - 0x21c]
push eax
push 4
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412a6f
xor esi, esi
cmp dword [ebp - 0x218], ebx
jbe 0x4038da
push esi
mov ecx, edi
call fcn.004040df
push eax
mov ecx, edi
call fcn.004042ff
mov eax, dword [eax]
push dword [ebp - 0x214]
mov ecx, eax
call fcn.004043be
inc esi
cmp esi, dword [ebp - 0x218]
jb 0x4038b2
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x210]
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004013d7
leave
ret 4
mov esi, 0x80070057
jmp 0x4038ec
mov dword [ebp - 0x210], 0x8000ffff
jmp 0x4038e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x412a64
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x4038e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x412a83
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x4038da
Function at 0x4043be
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea esi, [ecx + 0x20c]
push dword [esi]
lea edi, [ecx + 4]
push edi
push 0x404488
push 0x404428
push 4
xor ebx, ebx
call fcn.004173ad
add esp, 0x14
push ebx
lea eax, [ebp - 4]
push eax
push 0x208
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
test eax, eax
je 0x41246a
push ebx
lea eax, [ebp - 4]
push eax
push 4
push esi
push dword [ebp + 8]
call edi
test eax, eax
je 0x41246a
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41247e
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x40441c
Function at 0x407fac
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415386
push dword [ebp + 0x34]
fld qword [ebp + 0x38]
mov ebx, 0x408124
push dword [ebp + 0x1c]
push ecx
push ecx
fstp qword [esp]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x4080b0
push ebx
push 3
call fcn.004173ad
add esp, 0x2c
push dword [ebp + 0x40]
lea esi, [ebp + 0x1c]
push dword [ebp + 0x34]
sub esp, 0x18
push 6
pop ecx
mov edi, esp
push dword [ebp + 0x18]
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 0x14]
mov ecx, dword [0x437008]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004083f3
mov edi, eax
xor esi, esi
cmp edi, esi
jl 0x4153a5
mov ecx, dword [0x437008]
call fcn.00407f60
mov edi, eax
cmp edi, esi
jl 0x4153ad
cmp dword [ebp + 0x1c], 3
je 0x40804e
cmp dword [ebp + 0x1c], 2
jne 0x4080a3
push dword [ebp + 8]
mov ecx, dword [0x43700c]
call fcn.00404187
test eax, eax
je 0x4080a3
push 0x21c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, esi
je 0x408080
push esi
push dword [ebp + 0x1c]
mov ecx, eax
push esi
push dword [ebp + 8]
call fcn.0040438d
mov esi, eax
test esi, esi
je 0x4080a3
push dword [ebp + 8]
push 0x404068
push ebx
push 4
call fcn.004173ad
mov ecx, dword [0x43700c]
add esp, 0x10
push esi
call fcn.004041e9
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x3c
push dword [ebp + 8]
push 0x415458
push 0x408124
push 3
call fcn.004173ad
xor eax, eax
add esp, 0x10
inc eax
jmp 0x4080a5
push edi
push 0x415410
jmp 0x4153b3
push edi
push 0x4153c8
push ebx
push 1
call fcn.004173ad
add esp, 0x10
jmp 0x4080a3
Function at 0x40a07c
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x40a250
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x41a659
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40a238
push dword [esi + 0x24]
call edi
push 0x40a220
push dword [esi + 0x24]
mov dword [esi], eax
call edi
push 0x40a208
push dword [esi + 0x24]
mov dword [esi + 4], eax
call edi
push 0x40a1ec
push dword [esi + 0x24]
mov dword [esi + 8], eax
call edi
push 0x40a1d4
push dword [esi + 0x24]
mov dword [esi + 0xc], eax
call edi
push 0x40a1c0
push dword [esi + 0x24]
mov dword [esi + 0x10], eax
call edi
push 0x40a1ac
push dword [esi + 0x24]
mov dword [esi + 0x14], eax
call edi
push 0x40a19c
push dword [esi + 0x24]
mov dword [esi + 0x18], eax
call edi
push 0x40a18c
push dword [esi + 0x24]
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
cmp dword [esi], ebx
je 0x40a183
cmp dword [esi + 4], ebx
je 0x40a183
cmp dword [esi + 8], ebx
je 0x40a183
cmp dword [esi + 0xc], ebx
je 0x40a183
cmp dword [esi + 0x10], ebx
je 0x40a183
cmp dword [esi + 0x14], ebx
je 0x40a183
cmp dword [esi + 0x18], ebx
je 0x40a183
cmp dword [esi + 0x1c], ebx
je 0x40a183
cmp eax, ebx
je 0x40a183
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004013d7
leave
ret
mov ecx, esi
call fcn.0040732b
jmp 0x40a172
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x40a172
push 0x41a6ac
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0040ffa6
test eax, eax
jl 0x40a172
lea eax, [ebp - 0x20c]
push eax
call edi
mov dword [esi + 0x24], eax
cmp eax, ebx
je 0x40a172
jmp 0x40a0cd
Function at 0x40d406
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp esi, ebx
je 0x415b07
cmp dword [ebp + 8], ebx
je 0x415b11
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
mov dword [esi], ebx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x415b1b
mov eax, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
mov dword [ebp + 0xc], eax
cmp eax, ebx
je 0x415b32
push dword [ebp - 8]
call sub.msvcrt.dll_malloc
pop ecx
mov dword [esi], eax
cmp eax, ebx
je 0x40d4ba
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
push ebx
call edi
test eax, eax
je 0x415b3c
push dword [ebp + 0xc]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
mov ebx, 0x8007000e
jmp 0x40d4a8
mov eax, 0x80004003
jmp 0x40d4b4
mov eax, 0x80070057
jmp 0x40d4b4
cmp eax, ebx
jle 0x40d4b3
and eax, 0xffff
or eax, 0x80070000
jmp 0x40d4b3
mov eax, 0x8007000e
jmp 0x40d4b3
call fcn.0041d761
push dword [esi]
mov edi, eax
call sub.msvcrt.dll_free
mov dword [esi], ebx
pop ecx
mov ebx, edi
jmp 0x40d4a8

Function at 0x40d4f2
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x41137d
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x4137ec
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x41380a
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413800
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab90
jmp 0x413826
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41381e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab40
push 0x413850
push 1
call fcn.004173ad
add esp, 0x10
test edi, edi
jge 0x40d529
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d529
Function at 0x40d533
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x41102d
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x4138e8
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x413906
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4138fc
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab90
jmp 0x413922
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41391a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab40
push 0x413948
push 1
call fcn.004173ad
add esp, 0x10
test edi, edi
jge 0x40d56a
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d56a

Function at 0x40d578
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x4111f1
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x4139e0
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4139fe
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4139f4
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab90
jmp 0x413a1a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413a12
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab40
push 0x413a40
push 1
call fcn.004173ad
add esp, 0x10
test edi, edi
jge 0x40d5af
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d5af

Function at 0x40d5b9
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x410885
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x413ae4
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x413b02
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413af8
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab90
jmp 0x413b1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413b16
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab40
push 0x413b48
push 1
call fcn.004173ad
add esp, 0x10
test edi, edi
jge 0x40d5f0
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d5f0
Function at 0x40d5fa
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x4113c8
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x4136f0
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x41370e
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413704
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab90
jmp 0x41372a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413722
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab40
push 0x413750
push 1
call fcn.004173ad
add esp, 0x10
test edi, edi
jge 0x40d631
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d631

Function at 0x40d63b
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push esi
push edi
mov esi, ecx
lea eax, [esi + 8]
push eax
push 4
push esi
push 0x411413
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
test eax, eax
je 0x4135ec
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x41360a
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x413600
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab90
jmp 0x413626
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x41361e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
push edi
push 0x41ab40
push 0x413650
push 1
call fcn.004173ad
add esp, 0x10
test edi, edi
jge 0x40d672
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d672
Function at 0x40dd99
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
lea eax, [ebx + 0x18]
push eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x220], ebx
call fcn.00401415
xor edi, edi
cmp esi, edi
je 0x412c7b
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, ebx
call fcn.004036db
mov ebx, eax
cmp ebx, edi
jl 0x40deab
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x412c85
lea eax, [ebp - 0x20c]
push eax
push 0x411738
mov esi, 0x40ded0
push esi
push 4
call fcn.004173ad
add esp, 0x10
push edi
push 0x80
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
je 0x412c8f
push edi
lea ecx, [ebp - 0x224]
push ecx
push 4
lea ecx, [ebp - 0x210]
push ecx
push eax
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x210], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x412caa
push dword [ebp - 0x210]
push 0x40396c
push esi
push 4
call fcn.004173ad
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x210], edi
ja 0x412cc5
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004013d7
leave
ret 4
mov ebx, 0x80070057
jmp 0x40deab
mov ebx, 0x8000ffff
jmp 0x40deab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x412ca3
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x40deab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x412cbe
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x40de9f
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x214]
mov dword [ebp - 0x218], edi
call fcn.0041fd19
mov ebx, eax
cmp ebx, edi
jl 0x40de9f
mov ecx, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
call fcn.00402af6
inc esi
cmp esi, dword [ebp - 0x210]
jae 0x40de9f
jmp 0x412cc5

Function at 0x40ec34
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0x104
jb 0x4127c9
push edi
push dword [ebp + 8]
push 0x403634
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
mov edi, eax
test edi, edi
jl 0x4127d3
push dword [ebp + 8]
push 0x40360c
push 0x40ec88
push 4
call fcn.004173ad
add esp, 0x10
mov eax, edi
pop edi
pop ebp
ret 8
mov eax, 0x80070057
jmp 0x40ec84
push 0x41abdc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040258e
jmp 0x40ec6a
Function at 0x40ecfb
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
lea eax, [edi + 0x18]
push eax
lea ecx, [ebp - 0x220]
call fcn.00401415
xor ebx, ebx
cmp esi, ebx
je 0x4129e0
push 0x104
lea eax, [ebp - 0x20c]
push eax
mov ecx, edi
call fcn.0040ec34
cmp eax, ebx
mov dword [ebp - 0x210], eax
jl 0x40ee36
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x4129ea
lea eax, [ebp - 0x20c]
push eax
push 0x403660
mov esi, 0x40ee60
push esi
push 4
call fcn.004173ad
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
je 0x4129f9
mov ecx, edi
mov dword [ebp - 0x21c], ebx
call fcn.00401435
push eax
push 0x40396c
push esi
push 4
mov dword [ebp - 0x218], eax
call fcn.004173ad
add esp, 0x10
push ebx
lea eax, [ebp - 0x21c]
push eax
push 4
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x412a18
xor esi, esi
cmp dword [ebp - 0x218], ebx
jbe 0x40ee2a
push esi
mov ecx, edi
call fcn.004040df
push eax
mov ecx, edi
call fcn.004042ff
mov eax, dword [eax]
push dword [ebp - 0x214]
mov ecx, eax
call fcn.0040eeb7
inc esi
cmp esi, dword [ebp - 0x218]
jb 0x40ee02
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x210]
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004013d7
leave
ret 4
mov esi, 0x80070057
jmp 0x40ee3c
mov dword [ebp - 0x210], 0x8000ffff
jmp 0x40ee36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x412a0d
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x40ee36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x412a2c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x210], eax
jmp 0x40ee2a

Function at 0x40eeb7
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea esi, [ecx + 0x20c]
push dword [esi]
lea edi, [ecx + 4]
push edi
push 0x404488
push 0x40ef20
push 4
xor ebx, ebx
call fcn.004173ad
add esp, 0x14
push ebx
lea eax, [ebp - 4]
push eax
push 0x208
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
test eax, eax
je 0x41244f
push ebx
lea eax, [ebp - 4]
push eax
push 4
push esi
push dword [ebp + 8]
call edi
test eax, eax
je 0x41244f
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x412463
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
jmp 0x40ef15