joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484cf0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x94
mov eax, dword [esp + 0x9c]
push esi
push 0x40
lea ecx, [esp + 0x1c]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.00484b00
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.00484c30
mov esi, dword [esp + 0xb0]
add esp, 0x14
xor edx, edx
mov cl, byte [esp + edx + 4]
mov al, cl
and cl, 0xf
sar al, 4
and al, 0xf
cmp al, 0xa
movsx eax, al
jge 0x484d6a
add eax, 0x30
jmp 0x484d6d
add eax, 0x57
mov byte [esi], al
cmp cl, 0xa
movsx eax, cl
jge 0x484d7c
add eax, 0x30
jmp 0x484d7f
add eax, 0x57
mov byte [esi + 1], al
inc edx
add esi, 2
cmp edx, 0x10
jl 0x484d50
pop esi
add esp, 0x94
ret

Function at 0x484da0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x90]
push ebp
mov ebp, dword [esp + 0x90]
push esi
push edi
mov ecx, 0x10
xor eax, eax
mov edi, ebp
mov esi, dword [esp + 0xa0]
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
test esi, esi
mov dword [esp + 0x14], 0x9d14e9a1
mov dword [esp + 0x18], 0x593b6b0e
je 0x484e2b
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x28
jne 0x484e0f
mov byte [esi + 0x20], al
mov ecx, 0x20
jmp 0x484e19
cmp ecx, 0x38
jle 0x484e19
mov ecx, 0x38
mov eax, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x50ada4
test ecx, ecx
je 0x484e5f
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x38
jle 0x484e4a
mov ecx, 0x38
xor eax, eax
test ecx, ecx
jle 0x484e5f
mov dl, byte [eax + 0x50ada4]
xor byte [esp + eax + 0x1c], dl
inc eax
cmp eax, ecx
jl 0x484e50
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.00484cf0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.01d0a8e3
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + ebp]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x10], esi
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
cdq
and edx, 3
and ecx, 3
add eax, edx
rep movsb byte es:[edi], byte [esi]
sar eax, 2
xor ecx, ecx
test eax, eax
jle 0x484ec4
mov esi, ebp
mov dl, byte [esi]
add esi, 4
mov byte [ecx + ebx], dl
inc ecx
cmp ecx, eax
jl 0x484eb7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x485a90
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 0x118
mov ecx, 0x3f
mov eax, 0x80808080
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x41
mov cl, al
sub cl, 0x41
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x5a
jle 0x485ab2
mov eax, 0x61
mov dl, al
sub dl, 0x47
mov byte [esp + eax + 0x28], dl
inc eax
cmp eax, 0x7a
jle 0x485ac6
mov eax, 0x30
mov cl, al
add cl, 4
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x39
jle 0x485ada
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x53], 0x3e
mov byte [esp + 0x57], 0x3f
mov byte [esp + 0x65], 0
mov dword [esp + 0x18], ebp
je 0x485c6d
mov ebx, dword [esp + 0x130]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x12c]
xor eax, eax
lea esi, [edx + ecx]
movsx ecx, byte [esi + eax]
mov dl, byte [esp + ecx + 0x28]
test dl, 0x80
jne 0x485c3e
mov byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 4
jl 0x485b3c
mov esi, dword [esp + 0x138]
mov edx, dword [esp + 0x10]
cmp edx, dword [esi]
jle 0x485ba6
mov eax, dword [esp + 0x14]
push eax
call fcn.004918a7
mov ecx, dword [esi]
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
mov dword [esp + 0x2c], eax
rep movsb byte es:[edi], byte [esi]
call fcn.004917be
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
add esp, 8
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov dl, ch
mov al, cl
sar dl, 4
shl al, 2
or dl, al
mov eax, dword [esp + 0x14]
mov byte [ebx + ebp], dl
inc ebp
inc eax
mov cl, ch
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x1e]
mov dl, al
inc edi
sar dl, 2
shl cl, 4
or dl, cl
mov ecx, dword [esp + 0x14]
shl al, 6
or al, byte [esp + 0x1f]
mov byte [ebx + ebp], dl
inc ebp
mov edx, edi
inc ecx
inc edx
mov byte [ebx + ebp], al
mov al, byte [esp + 0x22]
inc ebp
inc ecx
inc edx
mov dword [esp + 0x10], edi
cmp al, 0x3d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
je 0x485c53
mov cl, byte [esp + 0x23]
xor eax, eax
cmp cl, 0x3d
setne al
add eax, 2
cmp eax, 3
jl 0x485c53
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], edx
cmp edx, ecx
jae 0x485c74
jmp 0x485b2c
push ecx
push str.Illegal_character__c_in_input._n
call fcn.0049388d
add esp, 8
push 1
call fcn.00492904
mov eax, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [eax], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
mov ebx, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [ecx], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x49310c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x49312c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00494898
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x49314f
test byte [esp + 8], 2
je 0x49314f
call fcn.0049490b
mov dword [eax], 0xd
call fcn.00494914
mov dword [eax], 5
jmp 0x493128
xor eax, eax
ret

Function at 0x4a47f5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4a482d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004a2882
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004a285a
jmp 0x4a4839
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4a5eeb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4a5f2d
call fcn.004abc0f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4a5f2d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4a5f24
xor eax, eax
jmp 0x4a5f35
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004a5f3b
pop edi
pop esi
pop ebx
ret 4

Function at 0x4ac13f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4ac16d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4ac18b
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004ac0a5
jmp 0x4ac18b
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4ac18b
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004ac0a5
test edi, edi
mov eax, edi
jne 0x4ac175
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xda3fa4
Capabilities:
Encode data using xor

Disassembly:
jmp 0xda3fae
or byte [eax], al
loopne 0xda3fb5
add byte [eax], al
add byte [eax], al
add byte [eax - 0x18], ah
add byte [eax], al
add byte [eax], al
pushal
call 0xda3fb4
pop ebp
sub ebp, 0x10
sub ebp, 0x9a3fa4
jmp 0xda3fca
mov eax, 0x9a3fa4
add eax, ebp
add eax, 0x4c
mov ecx, 0x59f
mov edx, 0xeec49897
xor byte [eax], dl
inc eax
dec ecx
jne 0xda3fe1
jmp 0xda3ff4
add byte [eax], al
jge 0xda3fd1
mov ebp, 0x1c5a1cda
push ds
sbb al, 0x5a
sbb al, 0x1e
stosd dword es:[edi], eax
xchg edi, eax
xchg edi, eax
xchg edi, eax
push ss
push esi
outsd dx, dword [esi]
xchg edi, eax
xchg edi, eax
xchg edi, eax
xchg esp, eax
pop edx
das
xchg ecx, eax
xchg edi, eax
xchg edi, eax
xchg edi, eax
sub eax, 0x979797bf
pushal
jne 0xda3fa5
pop edi
sbb al, 0x16
wait
xchg edi, eax
xchg edi, eax
xchg edi, eax
xchg esp, eax
push edx
mov edi, 0x8b84dfff
xchg edi, eax
dec ebx
mov ebx, 0xbb9697e9
mov bl, 0xff
push eax
mov ecx, 0x927f1beb
xchg edi, eax
xchg edi, eax
xchg edi, eax
jle 0xda3fee
xchg edi, eax
xchg edi, eax
xchg edi, eax
sbb dh, bl
mov bl, 0x6b
push ds
mov ebx, 0x1ccac3b3
adc bl, byte [edi + 0x1c979797]
add bl, byte [ebx + 0x1c979797]
sbb al, byte [edi + 0x56979797]
jle 0xda3feb
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
adc al, 0x55
xchg ebx, eax
ficomp word [eax + 0x68686312]
push 0x979b55ca
sbb al, 0x1b
mov bl, 0x93
xchg edi, eax
xchg edi, eax
xchg edi, eax
invalid
Function at 0x401911
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4241a4]
push ebx
xor eax, ebp
push esi
push edi
mov dword [ebp + 0x194], eax
call fcn.00401782
mov edx, eax
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x74], bx
mov ecx, 0x81
lea edi, [ebp - 0x72]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x74]
push eax
push edx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x7c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x401986
lea eax, [esi + esi]
push eax
call fcn.00412eee
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x40198d
xor eax, eax
jmp 0x401a19
push edi
push esi
push ebx
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
mov esi, 0x424448
je 0x401a05
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x415818
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x401a05
mov eax, dword [ebp - 0x78]
push dword [eax + 0x30]
mov ecx, dword [eax + 0xc]
push dword [eax + 0x2c]
mov edx, dword [eax + 8]
push dword [eax + 0x28]
movzx ebx, cx
push dword [eax + 0x24]
push dword [eax + 0x20]
push dword [eax + 0x18]
push dword [eax + 0x1c]
push dword [eax]
push dword [eax + 0x14]
push dword [eax + 0x10]
movzx eax, dx
push ecx
push edx
push ebx
shr ecx, 0x10
push ecx
push eax
shr edx, 0x10
push edx
push str.FileVersion_:__d._d._d._d___FileVersionMS_:_0x_08x__FileVersionLS_:_0x_08x__ProductVersionMS_:_0x_08x__ProductVersionLS_:_0x_08x__Signature_:_0x_08x__FileFlags_:_0x_08x__FileFlagsMask_:_0x_08x__FileOS_:_0x_08x__FileType_:_0x_08x__FileSubType_:_0x_08x__FileDateMS_:_0x_08x__FileDateLS_:_0x_08x__
push 0x168
push esi
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x4c
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
mov ax, word [0x424448]
neg ax
pop ecx
sbb eax, eax
and eax, esi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413159
add ebp, 0x198
leave
ret
Function at 0x401bad
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x4241a4]
push ebx
mov ebx, dword [ebp + 0x90]
push edi
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x40
xor eax, eax
test ebx, ebx
mov byte [ebp - 0x80], 0
pop ecx
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x401be9
xor eax, eax
jmp 0x401c3d
lea edi, [ebx + 1]
mov al, byte [edi]
test al, al
push esi
je 0x401c39
mov esi, edi
sub esi, ebx
cmp al, 0x5c
jne 0x401c31
push esi
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR71.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov byte [ebp + esi - 0x80], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401c21
test al, 0x10
jne 0x401c31
push 0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401c56
inc edi
mov al, byte [edi]
inc esi
test al, al
jne 0x401bf7
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp + 0x84]
pop edi
xor ecx, ebp
pop ebx
call fcn.00413159
add ebp, 0x88
leave
ret 4
xor eax, eax
jmp 0x401c3c

Function at 0x401c5a
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4241a4]
and word [ebp - 0x7c], 0
mov edx, dword [ebp + 0x198]
xor eax, ebp
push edi
mov dword [ebp + 0x18c], eax
xor eax, eax
test edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x7a]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x80], edx
stosw word es:[edi], ax
jne 0x401c9a
xor eax, eax
jmp 0x401d02
lea edi, [edx + 2]
mov ax, word [edi]
test ax, ax
push ebx
push esi
je 0x401cfd
mov ebx, edi
sub ebx, edx
cmp ax, 0x5c
jne 0x401cf1
mov esi, ebx
sar esi, 1
shl esi, 1
push esi
push edx
lea eax, [ebp - 0x7c]
push eax
call sub.MSVCR71.dll_memcpy
and word [ebp + esi - 0x7c], 0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401cde
test al, 0x10
jne 0x401cee
push 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x401d1a
mov edx, dword [ebp - 0x80]
inc edi
inc edi
mov ax, word [edi]
inc ebx
inc ebx
test ax, ax
jne 0x401cab
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop edi
call fcn.00413159
add ebp, 0x190
leave
ret 4
xor eax, eax
jmp 0x401d00
Function at 0x40918a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
push esi
xor ebx, ebx
cmp dword [0x425bc4], ebx
push edi
mov esi, ecx
je 0x4091a1
xor eax, eax
jmp 0x40925e
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
jne 0x409202
push 0x11f
push ebx
push str.C:TSLOG_CONFIG_
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
cmp eax, 0xffffffff
mov dword [esi + 0x24], eax
je 0x40925b
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, str.C:TSLOG_CONFIGTSLOG.ini
push ebp
call edi
cmp eax, 0xffffffff
jne 0x4091f8
mov ebx, str.C:TSLOG_CONFIGTSLOG.txt
push ebx
call edi
cmp eax, 0xffffffff
jne 0x4091f6
push ebp
call edi
cmp eax, 0xffffffff
jne 0x4091f6
push ebx
call edi
cmp eax, 0xffffffff
je 0x40919a
xor ebx, ebx
push ebx
mov ecx, esi
call fcn.004082b7
jmp 0x40925b
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x40922e
cmp eax, 0x102
je 0x40919a
push 0x11f
push ebx
push str.C:TSLOG_CONFIG_
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [esi + 0x24], eax
jmp 0x40919a
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
or dword [esi + 0x24], 0xffffffff
push ebx
mov ecx, esi
call fcn.004082b7
test eax, eax
je 0x40925b
push 0x11f
push ebx
push str.C:TSLOG_CONFIG_
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [esi + 0x24], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x40cc33
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4241a4]
push ebx
xor eax, ebp
push esi
push edi
mov dword [ebp + 0x194], eax
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x74], bx
mov ecx, 0x81
lea edi, [ebp - 0x72]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x74]
push eax
push ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x7c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
je 0x40cca1
lea eax, [esi + esi]
push eax
call fcn.00412eee
mov edi, eax
cmp edi, ebx
pop ecx
jne 0x40cca5
xor eax, eax
jmp 0x40cd09
push edi
push esi
push ebx
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x40ccb9
xor esi, esi
jmp 0x40cd00
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x415818
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40ccb5
mov eax, dword [ebp - 0x78]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
push str._d._d._d._d
push 0x168
mov esi, 0x425c30
push esi
call dword [sym.imp.MSVCR71.dll__snwprintf]
add esp, 0x1c
push edi
call sub.MSVCR71.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, esi
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413159
add ebp, 0x198
leave
ret
Function at 0x40e6b1
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x41477e
call fcn.00413240
sub esp, 0x244
mov eax, dword [0x4241a4]
push ebx
push esi
xor eax, ebp
xor ebx, ebx
mov dword [ebp - 0x10], eax
push edi
mov esi, ecx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x238], ebp
push ebx
push dword [ebp - 0x238]
push str.int___thiscall_CBugReporter::Init_void_
call fcn.00407881
mov edi, eax
add esp, 0xc
cmp edi, ebx
mov eax, 0x41a6b0
jne 0x40e6ff
mov edi, eax
push ebx
push ebx
push ebx
push esi
push eax
push 0x41a684
push edi
lea ecx, [ebp - 0x250]
call fcn.00409792
mov dword [ebp - 4], ebx
cmp edi, ebx
jne 0x40e71e
push ebp
pop ebp
xor eax, eax
mov word [ebp - 0x218], bx
mov ecx, 0x81
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 1
push str.XLBugHandler.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x40e776
xor esi, esi
jmp 0x40e7bd
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str._XL_SetBugReportRootDir_4
push eax
call edi
push str._XL_InitBugHandler_20
push dword [esi + 0x14]
mov dword [esi], eax
call edi
push str._XL_SetPeerID_4
push dword [esi + 0x14]
mov dword [esi + 4], eax
call edi
push str._XL_SetReportShowMode_4
push dword [esi + 0x14]
mov dword [esi + 8], eax
call edi
push str._XL_SetAlwaysSendReport_4
push dword [esi + 0x14]
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
xor esi, esi
inc esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x234]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00409a0c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413159
leave
ret
Function at 0x40f701
Capabilities:
Create thread

Disassembly:
mov eax, 0x4148e7
call fcn.00413240
sub esp, 0x20
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], ebp
push 1
push dword [ebp - 0x14]
push str.void___cdecl_SendHttpStat_const_wchar_t__const_wchar_t__
call fcn.00407881
mov esi, eax
add esp, 0xc
cmp esi, ebx
mov eax, 0x41b5a8
jne 0x40f737
mov esi, eax
push ebx
push ebx
push ebx
push ebx
push eax
push 0x41b588
push esi
lea ecx, [ebp - 0x2c]
call fcn.00409792
mov dword [ebp - 4], ebx
cmp esi, ebx
jne 0x40f753
push ebp
pop ebp
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x10], ebx
je 0x40f79a
cmp dword [ebp + 0xc], ebx
je 0x40f79a
push 8
call fcn.00412ea4
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x40f782
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040d162
jmp 0x40f784
xor eax, eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x10]
push ecx
push ebx
push eax
push 0x40f53b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00409a0c
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40fadd
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x414954
call fcn.00413240
sub esp, 0x424
mov eax, dword [0x4241a4]
push ebx
push esi
xor eax, ebp
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x430], edi
cmp word [0x426340], di
mov dword [ebp - 0x428], eax
mov esi, 0x426340
jne 0x40fc40
mov dword [ebp - 0x424], edi
mov dword [ebp - 4], 1
lea eax, [ebp - 0x42c]
push str.Core_
push eax
call fcn.0040ec7d
pop ecx
pop ecx
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x424]
call fcn.0040d884
mov byte [ebp - 4], 1
push dword [ebp - 0x42c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0x424], edi
jne 0x40fb69
xor eax, eax
jmp 0x40fb75
push dword [ebp - 0x424]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ebx, dword [sym.imp.MSVCR71.dll_wcsncpy]
push eax
push dword [ebp - 0x424]
push esi
call ebx
and word [ebp - 0x420], 0
mov word [ebp - 0x218], di
mov edx, 0x81
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x216]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x41e]
rep stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
mov edi, 0x104
push edi
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...xmp.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push esi
push str.coredir
push 0x41b7d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push edi
lea eax, [ebp - 0x218]
push eax
push esi
call ebx
add esp, 0xc
mov byte [ebp - 4], 0
push dword [ebp - 0x424]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edi, edi
mov ebx, str.XMP::GetCoreDir
push ebx
call fcn.00403aec
test eax, eax
pop ecx
jne 0x40fc76
push 1
push esi
push str.Path_:
push edi
push ebx
call fcn.00408cd1
pop ecx
pop ecx
mov ecx, eax
call fcn.0040e3a9
mov ecx, eax
call fcn.0040d585
mov ecx, eax
call fcn.0040e37d
mov ecx, dword [ebp - 0x428]
push esi
call fcn.0040cdd6
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x430], 1
mov eax, dword [ebp - 0x428]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.00413159
leave
ret