joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4049e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x104
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x404a7d
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004043a0
mov esi, eax
mov ecx, esi
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404a23
sub ecx, edx
je 0x404a39
cmp byte [ecx + esi - 1], 0x5c
jne 0x404a39
mov byte [ecx + esi - 1], al
mov edx, esi
lea ecx, [edx + 1]
mov edi, edi
mov al, byte [edx]
inc edx
test al, al
jne 0x404a40
sub edx, ecx
or ecx, 0xffffffff
cmp edx, 0x104
cmovb ecx, edx
push ecx
push esi
push 0x104
push edi
call fcn.004dd247
push esi
call fcn.004dbc6f
add esp, 0x14
mov eax, edi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.004da4c1
mov esp, ebp
pop ebp
ret

Function at 0x404b10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jle 0x404b74
push 2
push esi
call fcn.004dbc31
mov edi, eax
add esp, 8
test edi, edi
je 0x404b74
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 8]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x404b5d
mov word [edi], ax
push edi
call fcn.004dd2eb
push edi
mov esi, eax
call fcn.004dbc6f
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
ret
push 0x16
call fcn.004ddb87
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
ret

Function at 0x404c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
dec edx
push edi
mov edi, ecx
cmp edx, 0xfe
ja case.0x404ca7.2
movzx eax, byte [edx + 0x404d7c]
jmp dword [eax*4 + 0x404d64]
mov esi, 0x2b
jmp 0x404ccf
mov esi, 0x23
jmp 0x404ccf
mov esi, 0x1c
jmp 0x404ccf
mov esi, 0x2a
jmp 0x404ccf
mov esi, 0x2c
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
mov eax, esi
or eax, 0x8000
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x404d0d
cmp esi, 0x2c
jne 0x404d52
lea edx, [esi - 0x2b]
mov ecx, edi
call fcn.00404c80
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20c]
push eax
call fcn.004043a0
mov esi, eax
add esp, 4
test esi, esi
je 0x404d52
push 0xffffffffffffffff
push esi
push 0x104
push edi
call fcn.004dd247
xor ecx, ecx
test eax, eax
push esi
cmovne edi, ecx
call fcn.004dbc6f
add esp, 0x14
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
Function at 0x405030
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x4050a6
test edi, edi
je 0x4050a6
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405055
sub ecx, edx
je 0x4050a6
lea eax, [ebp - 0x38]
push eax
push edi
call fcn.00404750
add esp, 8
test eax, eax
jne 0x4050a6
mov eax, dword [ebp - 0x24]
inc eax
push 1
push eax
call fcn.004dbc31
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x4050a6
push 0x57dec8
push edi
call fcn.00404690
mov edi, eax
add esp, 8
test edi, edi
jne 0x4050b9
push dword [esi]
call fcn.004dbc6f
add esp, 4
mov dword [esi], edi
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
push edi
push dword [ebp - 0x24]
push 1
push dword [esi]
call fcn.004ddefd
push edi
mov esi, eax
call fcn.004de123
mov ecx, dword [ebp - 4]
add esp, 0x14
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
Function at 0x406750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
add ecx, 0x4c
mov word [ebp - 4], 0
cmp dword [ecx + 0x14], 8
mov dword [ebp - 8], 0
jb 0x40676e
mov ecx, dword [ecx]
push str.rb__ccsUTF_8
push ecx
lea eax, [ebp - 8]
push eax
call fcn.004dd31c
mov eax, dword [ebp - 8]
add esp, 0xc
test eax, eax
je 0x4067c7
push eax
push 2
lea eax, [ebp - 4]
push 1
push eax
call fcn.004ddefd
push dword [ebp - 8]
call fcn.004de123
mov cl, byte [ebp - 4]
mov al, byte [ebp - 3]
add esp, 0x14
cmp cl, 0xff
jne 0x4067af
cmp al, 0xfe
je 0x4067b8
cmp al, 0xff
jne 0x4067c1
cmp cl, 0xfe
jne 0x4067c1
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x4067d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x8c], 1
jne 0x406808
call fcn.00406750
test al, al
jne 0x406808
mov eax, dword [ebx]
test eax, eax
je 0x406801
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
mov ecx, edi
call fcn.00407730
cmp dword [edi + 0x60], 8
lea esi, [edi + 0x4c]
jb 0x406815
mov eax, dword [esi]
jmp 0x406817
mov eax, esi
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4068af
cmp dword [esi + 0x14], 8
jb 0x40683f
mov esi, dword [esi]
push 0
push 0x80
push 1
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x40686a
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [edi + 0x8c], 1
push 0
lea ecx, [ebp - 4]
push ecx
jne 0x406898
push 2
lea ecx, [ebp + 8]
push ecx
push eax
mov dword [ebp + 8], 0xfeff
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
push 3
lea ecx, [ebp + 8]
push ecx
push eax
mov word [ebp + 8], 0xbbef
mov byte [ebp + 0xa], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4068c0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550e06
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4069be
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], eax
mov word [ebp - 0x234], ax
cmp word [ebp - 0x21c], ax
jne 0x40693e
xor ecx, ecx
jmp 0x406956
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406947
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00403d70
xor bl, bl
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x40699a
cmp eax, 0xb7
je 0x40699a
cmp eax, 0x50
jne 0x40699c
mov bl, 1
cmp dword [ebp - 0x220], 8
jb 0x4069b3
push dword [ebp - 0x234]
call fcn.004daf24
add esp, 4
test bl, bl
jne 0x4069be
xor al, al
jmp 0x406ac9
xor eax, eax
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], 0
mov word [ebp - 0x24c], ax
cmp word [ebp - 0x21c], ax
jne 0x4069e8
xor ecx, ecx
jmp 0x406a00
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4069f1
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x24c]
call fcn.00403d70
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
cmp word [esi], ax
jne 0x406a40
xor ecx, ecx
jmp 0x406a54
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x406a45
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x234]
call fcn.00403d70
lea edx, [ebp - 0x234]
lea ecx, [ebp - 0x24c]
mov byte [ebp - 4], 1
call fcn.0040dd50
mov byte [ebp - 4], 0
cmp dword [ebp - 0x220], 8
mov bl, al
jb 0x406a93
push dword [ebp - 0x234]
call fcn.004daf24
add esp, 4
test bl, bl
je 0x406ab0
lea ecx, [edi + 0x4c]
lea eax, [ebp - 0x24c]
cmp ecx, eax
je 0x406aae
push 0xffffffffffffffff
push 0
push eax
call fcn.00403f60
mov bl, 1
cmp dword [ebp - 0x238], 8
jb 0x406ac7
push dword [ebp - 0x24c]
call fcn.004daf24
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret 4
Function at 0x406cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 2]
mov edi, edi
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x406d00
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
sar esi, 1
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
add esi, esi
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
mov dword [ebp - 4], 0
call esi
push 0
lea eax, [ebp - 4]
push eax
push 4
push 0x57e038
push dword [ebx + 0x68]
mov dword [ebp - 4], 0
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x406d60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x406d70
push 2
push 0
push 0
push dword [ebx + 0x68]
sub esi, ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebx + 0x68]
mov dword [ebp - 4], 0
call esi
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x57e040
push dword [ebx + 0x68]
mov dword [ebp - 4], 0
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407730
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x551170
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x59de30]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
push edi
mov eax, dword [0x59de30]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
push 0xffffffffffffffff
push eax
lea esi, [edi + 0x4c]
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.00403f60
lea ecx, [esp + 0x10]
mov dword [esp + 0x80], 0
call fcn.0040de00
xor eax, eax
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], 0
mov word [esp + 0x40], ax
lea ecx, [esp + 0x40]
mov byte [esp + 0x80], 1
call fcn.0040dc40
lea eax, [esp + 0x40]
push eax
mov edx, 0x57e068
lea ecx, [esp + 0x5c]
call fcn.0040ae90
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x8c], 2
call fcn.00403c60
cmp dword [esp + 0x6c], 8
jb 0x40780b
push dword [esp + 0x58]
call fcn.004daf24
add esp, 4
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
lea edx, [esp + 0x28]
mov ecx, esi
mov byte [esp + 0x80], 3
call fcn.0040e090
lea edx, [esp + 0x28]
lea ecx, [esp + 0x10]
call fcn.0040de90
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x4078a9
cmp dword [esi + 0x10], 0
je 0x4078a9
cmp dword [esp + 0x20], 0
je 0x4078a9
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
cmp dword [esi + 0x14], 8
jb 0x40787f
mov esi, dword [esi]
push eax
push esi
call fcn.004df807
add esp, 8
test eax, eax
jne 0x4078a9
lea ecx, [edi + 0x98]
lea eax, [esp + 0x10]
cmp ecx, eax
je 0x4078a5
push 0xffffffffffffffff
push 0
push eax
call fcn.00403f60
mov bl, 1
jmp 0x4078ab
xor bl, bl
cmp dword [esp + 0x3c], 8
jb 0x4078be
push dword [esp + 0x28]
call fcn.004daf24
add esp, 4
xor eax, eax
cmp dword [esp + 0x54], 8
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
jb 0x4078e8
push dword [esp + 0x40]
call fcn.004daf24
add esp, 4
xor eax, eax
cmp dword [esp + 0x24], 8
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], 0
mov word [esp + 0x40], ax
jb 0x407912
push dword [esp + 0x10]
call fcn.004daf24
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
Function at 0x40d690
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x40d69f
lea eax, [ecx + 4]
pop ebp
ret
pop ebp
jmp fcn.0040fc40

Function at 0x40d8f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x40d901
mov eax, 4
pop ebp
ret
cmp dword [ecx + 4], ecx
jne 0x40d8fa
pop ebp
jmp fcn.00417a10

Function at 0x40e180
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.004dc520
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xor edx, edx
cmp dword [ecx + 0x14], 8
push edi
mov dword [ebp - 0x2008], edx
jb 0x40e1ac
mov ecx, dword [ecx]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call ebx
cmp dword [esi + 0x14], 8
mov edi, eax
jb 0x40e1d1
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push esi
call ebx
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40e207
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ecx]
push 0
lea eax, [ebp - 0x200c]
push eax
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e24f
push 0
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x200c]
lea eax, [ebp - 0x2004]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40e257
call esi
mov dword [ebp - 0x2008], eax
cmp dword [ebp - 0x200c], 0x1000
je 0x40e210
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
push ebx
call esi
mov edx, dword [ebp - 0x2008]
mov ecx, dword [ebp - 4]
xor eax, eax
test edx, edx
pop edi
sete al
pop esi
xor ecx, ebp
pop ebx
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
Function at 0x40e7d0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5513e8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x4c]
xor bl, bl
cmp dword [edi + 0x14], 8
jb 0x40e80c
mov eax, dword [edi]
jmp 0x40e80e
mov eax, edi
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
jne 0x40e836
xor al, al
jmp 0x40e8f6
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x40e855
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov bl, 1
jmp 0x40e861
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x40e8f4
cmp dword [ebp - 0x34], 0
jl 0x40e8f4
jg 0x40e883
cmp dword [ebp - 0x30], 0xa00000
jb 0x40e8f4
mov eax, dword [esi + 0x68]
lea ebx, [esi + 0x68]
test eax, eax
je 0x40e894
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
push 0xffffffffffffffff
push eax
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
call fcn.00403f60
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00419090
lea edx, [ebp - 0x2c]
mov ecx, edi
call fcn.0040e180
test al, al
je 0x40e8d8
mov ecx, esi
call fcn.00407aa0
mov eax, dword [esi]
push ebx
mov eax, dword [eax]
mov ecx, esi
call eax
cmp dword [ebp - 0x18], 8
mov bl, al
jb 0x40e8f4
push dword [ebp - 0x2c]
call fcn.004daf24
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret 4

Function at 0x40e920
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x40e96e
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
jne 0x40e96b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40e96b
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [esi], eax
cmp dword [esi], 0
setne bl
cmp dword [ebp + 0x1c], 8
jb 0x40e982
push dword [ebp + 8]
call fcn.004daf24
add esp, 4
pop esi
mov al, bl
pop ebx
pop ebp
ret 0x18
Function at 0x412960
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x59de30]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.004de2a0
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004050f0
push 1
push 0x57d56c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004dcc52
push 3
push 0x57e2c0
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004dcc52
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x310], ax
lea eax, [ebp - 0x30e]
push eax
call fcn.004de2a0
add esp, 0x40
lea eax, [ebp - 0x310]
push 0x104
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412a2c
push 0
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004da4c1
mov esp, ebp
pop ebp
ret
Function at 0x41ab50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551f43
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x59de30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5aecd0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx], 0x5aecd0
mov byte [ebp - 4], 1
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x57dfd1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00419320
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41b760
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x551f09
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59de30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x5aecd0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 5
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x2c]
mov dword [esi], vtable.TiXmlDeclaration.0
mov dword [ecx], 0x5aecd0
mov dword [esi + 0x30], 0x5aecd0
mov dword [esi + 0x34], 0x5aecd0
mov edi, dword [ebp + 8]
mov edx, edi
mov byte [ebp - 4], 3
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x41b801
sub edx, ebx
push edx
push edi
call fcn.00419320
mov edi, dword [ebp + 0xc]
mov edx, edi
lea ecx, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x41b820
sub edx, ecx
push edx
push edi
lea ecx, [esi + 0x30]
call fcn.00419320
mov edi, dword [ebp + 0x10]
mov edx, edi
lea ecx, [edx + 1]
jmp 0x41b840
mov al, byte [edx]
inc edx
test al, al
jne 0x41b840
sub edx, ecx
push edx
push edi
lea ecx, [esi + 0x34]
call fcn.00419320
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc