joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3037260
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0x14], 0
jne 0x3037286
cmp dword [ebp + 0x18], 0
je 0x303727a
cmp dword [ebp + 0x1c], 0
jne 0x3037286
push 0x57
call sym.dbghelp.dll_SymGetLineFromNameW64
jmp 0x30373d5
mov eax, dword [ebp + 8]
push eax
call sym.dbghelp.dll_SymGetLineFromNameW64
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x30372a4
push 6
call sym.dbghelp.dll_SymGetLineFromNameW64
jmp 0x30373d5
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call sym.dbghelp.dll_SymGetLineFromNameW64
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x30372cc
push 0x7e
call sym.dbghelp.dll_SymGetLineFromNameW64
jmp 0x30373d5
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x303738b
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 0x14]
push ecx
call dword [0x31185fc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x303730e
push 0x57
call sym.dbghelp.dll_SymGetLineFromNameW64
jmp 0x30373d5
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp + 0x1c], eax
cmp dword [ebp + 0x1c], 0
jne 0x3037339
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push 0x57
call sym.dbghelp.dll_SymGetLineFromNameW64
jmp 0x30373d5
mov ecx, dword [ebp + 0x1c]
push ecx
call sym.dbghelp.dll_SymGetLineFromNameW64
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x303737f
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x303737f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x1c]
je 0x303737f
mov ecx, dword [ebp - 4]
push ecx
call sym.dbghelp.dll_SymGetLineFromNameW64
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x30373b1
mov eax, dword [ebp + 0x1c]
push eax
call sym.dbghelp.dll_SymGetLineFromNameW64
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x30373b1
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 4], 0
jne 0x30373c0
push 0x57
call sym.dbghelp.dll_SymGetLineFromNameW64
jmp 0x30373d5
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sym.dbghelp.dll_SymGetLineFromNameW64
mov esp, ebp
pop ebp
ret 0x18
Function at 0x3037f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x3037f5f
pop dword [ebp - 0x50]
mov eax, 0x3037f5f
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x69f22
push 0
mov eax, 0x3547e1d3
add eax, 0xcdb82ef5
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x48c24096
add ecx, 0xb73e0aa0
xor edi, edi
add edi, eax
mov edx, 0x8778eaa0
sub edx, 0x8464daa0
add edx, dword [ebp - 0x50]
mov esi, 0xe1e783ed
sub esi, 0xfa7664f6
mov dword [ebp - 0x18], 0xbd8350f9
mov ebx, dword [edx]
mov dword [ebp - 0x28], 0x279f10e7
xor ebx, esi
add dword [ebp - 0x10], eax
mov dword [edi], ebx
xor dword [ebp - 0x48], 0x20b3afa2
add edi, 0x490ab8a9
sub edi, 0x490ab8a5
add edx, 0x7c8b1083
sub edx, 0x7c8b107f
loop 0x3037fbb
add eax, 0x600b7af0
add eax, 0x9ff5a4bb
xor ebx, ebx
add ebx, eax
add eax, 0x879b352c
sub eax, 0x879b3527
mov ecx, 0x3000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x46ca80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46caad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46caad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11000]
push edi
or ebp, 0xffffffff
jmp 0x419632
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419639
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419628
pushfd
xor eax, eax
inc eax
popfd
add ebx, ebx
jne 0x41964b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419640
jne 0x41965c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419640
xor ecx, ecx
sub eax, 3
jb 0x419670
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4196e2
push eax
pop ebp
add ebx, ebx
jne 0x41967b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4196ac
inc ecx
add ebx, ebx
jne 0x419698
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41968d
jne 0x4196a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41968d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4196cc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4196bd
jmp 0x41962e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4196cc
add edi, ecx
jmp 0x41962e
pop esi
push esi
pop edi
mov ecx, 0x5ce
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4196ea
cmp byte [edi], 0
jne 0x4196ea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
push ebx
pop eax
loop 0x4196ef
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x41975e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x191e8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1924c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41971c
push edi
pop ecx
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19250]
test eax, eax
je 0x419758
mov dword [ebx], eax
add ebx, 4
jmp 0x419739
call dword [esi + 0x19254]
popal
jmp 0x40e274
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4bac2d01
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data_1
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3ecf617b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x401ae8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebx, section..text
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
sub ebx, 0x1000
mov dword [0x4028f4], ebx
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x401b11
push esp
mov eax, str.contents
mov dword [ebp - 4], eax
lea eax, [0x401187]
mov dword [ebp - 0x24], eax
mov ecx, dword [0x4028f4]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0x67
push dword [0x4028f4]
call dword [sym.imp.USER32.dll_LoadBitmapA]
xor eax, eax
push eax
push dword [0x4028f4]
push eax
push eax
push 0x1f4
push 0x2f4
push 0x578
push 0xce4
push 0
mov ecx, str.frantically
push eax
push str.contents
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x402904], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x402904]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401bc9
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401bb0
pop ebp
ret 0x10
Function at 0x404910
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505c26
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x54e758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
jne 0x40494c
xor eax, eax
jmp 0x4049b5
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004dd4c0
add esp, 0xc
call fcn.00405310
push 0x510890
test al, al
lea eax, [ebp - 0x218]
push esi
push eax
je 0x4049d1
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x21c]
call fcn.004067e0
push edi
push ebx
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
push str.ADBlockMasterTray
lea ecx, [ebp - 0x21c]
call fcn.00407cd0
lea ecx, [ebp - 0x21c]
mov ebx, eax
call fcn.004071f0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b994
mov esp, ebp
pop ebp
ret
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x220]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4049b3
mov dword [ebp - 4], 1
call fcn.00404ec0
mov ecx, eax
test ecx, ecx
je 0x404aee
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 2
lea eax, [ebp - 0x218]
test edi, edi
je 0x404a46
push edi
push eax
lea eax, [ebp - 0x21c]
push 0x51093c
push eax
call fcn.00404dd0
add esp, 0x10
jmp 0x404a5b
push eax
lea eax, [ebp - 0x21c]
push str.__s_
push eax
call fcn.00404dd0
add esp, 0xc
mov esi, dword [ebp - 0x21c]
mov edi, dword [esi - 0xc]
add edi, edi
cmp dword [esi - 4], 1
jle 0x404a80
push dword [esi - 0xc]
lea ecx, [ebp - 0x21c]
call fcn.00404d40
mov esi, dword [ebp - 0x21c]
push edi
push esi
push 1
push 0
push str.ADBlockMasterTray
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esi - 8]
mov ebx, eax
push esi
call fcn.004e0a58
add esp, 8
test eax, eax
js 0x404ae4
cmp eax, dword [esi - 8]
jg 0x404ae4
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4049b3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4049b3
push 0x80070057
call fcn.00404b90
push 0x80004005
call fcn.00404b90
int3
Function at 0x404c50
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x505c58
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x54e758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x404c8d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
call fcn.00404fa0
add esp, 8
test eax, eax
jne 0x404cba
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
call fcn.00405310
test al, al
je 0x404cfb
lea ecx, [ebp + 8]
call fcn.004067e0
push 1
push str.ADBlockMasterTray
lea ecx, [ebp + 8]
mov dword [ebp - 4], esi
call fcn.00408690
lea ecx, [ebp + 8]
mov esi, eax
call fcn.004071f0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404d2a
push str.ADBlockMasterTray
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40ceb0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506698
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x54e758]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push dword [esi]
push 1
push str.protect_days
push str.general
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov dword [ebp - 4], 0
call fcn.00404ec0
mov ecx, eax
test ecx, ecx
je 0x40cf65
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [edi + 1]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x10]
push 0x511378
push eax
call fcn.00404dd0
add esp, 0xc
push dword [esi]
mov esi, dword [ebp - 0x10]
push esi
push str.protect_days
push str.general
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40cf54
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404b90
int3
Function at 0x40e150
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.0049ba10
mov eax, dword [0x54e758]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.004dd4c0
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x40e246
test edi, edi
je 0x40e246
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x40e246
cmp eax, 0x3fff
ja 0x40e246
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40e246
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x510958
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40e246
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.004dd4c0
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
lea eax, [esi - 1]
push eax
push edi
call fcn.0040def0
add esp, 0x28
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b994
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0049b994
mov esp, ebp
pop ebp
ret

Function at 0x40e3d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40e441
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40e441
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x40e441
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x40e441
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x40
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40e43b
push esi
push ebx
push edi
call fcn.004dc9c0
add esp, 0xc
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x40e43b
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ed20
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x54e758]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp dword [edi + 0x1c], 0
je 0x40ed52
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b994
mov esp, ebp
pop ebp
ret 4
push ebx
push esi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004dd4c0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x40eda5
lea eax, [ebp - 0x20c]
push eax
call ebx
sub esi, 1
jne 0x40ed97
push 0x511794
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ee62
mov dword [edi + 0x1c], 1
cmp dword [edi], 0
jne 0x40ee38
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x40ee62
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CurlInit
push eax
call esi
push str.CurlUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x40ee38
call eax
mov dword [edi + 0xc], eax
cmp dword [edi + 8], 0
je 0x40ee62
cmp dword [edi + 4], 0
je 0x40ee62
cmp dword [edi + 0xc], 0
je 0x40ee62
pop esi
pop ebx
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049b994
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0049b994
mov esp, ebp
pop ebp
ret 4
Function at 0x40fd60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506a77
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x54e758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x6c], ebx
sub esp, 8
mov eax, esp
mov dword [eax], 0x511538
mov dword [eax + 4], 6
lea eax, [ebp - 0x28]
push eax
call fcn.00422870
add esp, 0xc
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.0040d210
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push str.ADBlockMaster_tray.log
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 1
push str._s_s
push eax
call fcn.00404dd0
add esp, 0x10
lea ecx, [ebp - 0x60]
call fcn.0040d210
mov esi, dword [ebp - 0x5c]
lea eax, [ebp - 0x60]
push esi
push str._s.on
push eax
mov byte [ebp - 4], 2
call fcn.00404dd0
mov edi, dword [ebp - 0x60]
add esp, 0xc
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40fe1a
mov byte [ebx + 4], al
jmp 0x40fed4
push 0x28
mov byte [ebx + 4], 1
call fcn.0049b9c8
mov ebx, eax
mov dword [ebp - 0x64], eax
add esp, 4
mov dword [ebp - 0x70], ebx
mov byte [ebp - 4], 3
test ebx, ebx
je 0x40fe88
mov dword [ebx], vtable.Utils::LogAppender.0
mov ecx, esi
mov dword [ebx + 4], 0
xor eax, eax
mov byte [ebx + 8], 1
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 7
mov word [ebx + 0xc], ax
lea eax, [ecx + 2]
mov dword [ebp - 0x68], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fe65
sub ecx, dword [ebp - 0x68]
sar ecx, 1
push ecx
push esi
lea ecx, [ebx + 0xc]
call fcn.0040e940
mov dword [ebx + 0x24], 0xffffffff
jmp 0x40fe8d
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov ecx, dword [ebp - 0x6c]
mov byte [ebp - 4], 2
mov dword [ecx + 0x20], ebx
mov eax, dword [ebx]
mov ebx, dword [eax]
lea eax, [ebp - 0x58]
push eax
call fcn.0040fc50
push str._____________________log_start_____________________________r_n
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
call fcn.0040f3e0
add esp, 0xc
mov ecx, dword [ebp - 0x64]
push eax
mov byte [ebp - 4], 5
call ebx
lea ecx, [ebp - 0x40]
call fcn.00407010
lea ecx, [ebp - 0x58]
call fcn.00407010
lea edx, [edi - 0x10]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40feee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x40ff03
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x40ff39
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ff2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ff55
push edx
push ecx
call fcn.0049b6ec
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b994
mov esp, ebp
pop ebp
ret
call fcn.004e0859
int3
Function at 0x4101a0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506aab
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x54e758]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x20], 8
lea edi, [esi + 0xc]
lea ebx, [esi + 0x24]
jb 0x4101de
mov edi, dword [edi]
push 0x180
push 0x40
push 0x8101
push edi
push ebx
call fcn.004e4bc9
add esp, 0x14
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x410291
push 1
push 2
lea ecx, [ebp - 0xc4]
call fcn.004061c0
push str._error.__
push edi
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 0
push str.open
push eax
call fcn.004058d0
add esp, 8
push eax
call fcn.004058d0
add esp, 8
push eax
call fcn.004058d0
add esp, 8
mov ecx, eax
push 0x51181c
push dword [ebp - 0x2c]
call fcn.00407420
push eax
call fcn.004058d0
add esp, 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00410340
cmp dword [eax + 0x14], 8
jb 0x410270
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x28]
call fcn.00407010
lea ecx, [ebp - 0xc4]
mov dword [ebp - 4], 0xffffffff
call fcn.00407850
mov eax, dword [ebx]
cmp eax, 0xffffffff
je 0x4102a7
push 2
push 0
push eax
call fcn.004e526c
add esp, 0xc
jmp 0x4102aa
or eax, 0xffffffff
mov dword [esi + 4], eax
test eax, eax
jne 0x410319
push 0x51184c
lea ecx, [ebp - 0x28]
call fcn.00406430
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x4102c9
mov eax, dword [eax]
mov ecx, dword [ebx]
cmp ecx, 0xffffffff
je 0x4102df
push edx
push eax
push ecx
call fcn.004e5833
add esp, 0xc
mov edi, eax
jmp 0x4102e2
or edi, 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x410312
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x410308
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410335
push edx
push ecx
call fcn.0049b6ec
add esp, 8
test edi, edi
jle 0x410319
add dword [esi + 4], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049b994
mov esp, ebp
pop ebp
ret
call fcn.004e0859
int3