joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402f81
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0x124]
push esi
mov byte [ebp - 1], 0
call dword [0x40a2c8]
test eax, eax
je 0x403029
push edi
xor eax, eax
push 0xe
pop ecx
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x208]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ecx
mov ecx, dword [esi + 0xc10]
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x24], ecx
call dword [0x40a2ac]
test eax, eax
pop edi
je 0x403029
cmp byte [esi + 0xa0c], 0
je 0x403025
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [0x40a074]
add esi, 0xa08
mov eax, dword [esi]
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
call dword [0x40a070]
test eax, eax
je 0x403029
mov eax, dword [esi]
cmp eax, dword [ebp + 8]
jne 0x403029
mov byte [ebp - 1], 1
xor eax, eax
cmp byte [ebp - 1], al
setne al
push eax
push dword [ebx + 8]
push 0x5f4
push dword [ebx + 4]
call dword [0x40a318]
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 4

Function at 0x4057a7
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x4099d3
call fcn.004093e0
sub esp, 0x4c
mov eax, dword [0x40d238]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
lea edi, [esi + 0x2a]
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x4c], ecx
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x4058c7
lea ebx, [esi + 0xc]
push ebx
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x4058c7
mov ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.00402ee8
test eax, eax
je 0x4058c7
push edi
lea ecx, [ebp - 0x4c]
call fcn.004055fb
push dword [eax]
lea eax, [ebp - 0x48]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00408e47
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00401365
push edi
lea ecx, [ebp - 0x54]
call fcn.004055fb
push dword [eax]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 3
call fcn.00408dee
pop ecx
pop ecx
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.00401365
lea eax, [ebp - 0x50]
push eax
push 0x20006
push ebx
lea ecx, [ebp - 0x48]
call dword [0x40a1c0]
push eax
push dword [ebp - 0x58]
call dword [0x40a00c]
test eax, eax
jne 0x405897
lea ecx, [ebp - 0x2c]
call dword [0x40a1c0]
push eax
push dword [ebp - 0x50]
call dword [0x40a010]
push dword [ebp - 0x50]
mov edi, eax
call dword [0x40a014]
cmp edi, ebx
jne 0x405897
inc ebx
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call dword [0x40a1bc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call dword [0x40a1bc]
mov eax, ebx
jmp 0x4058dc
push 0
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004093bb
leave
ret 4
Function at 0x4058f7
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x2a]
push edi
mov dword [ebp - 4], ecx
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x405973
lea ebx, [esi + 0xc]
push ebx
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x405973
mov ecx, dword [ebp - 4]
lea eax, [ebp + 8]
push eax
push ebx
call fcn.00402ee8
test eax, eax
je 0x405973
push edi
lea ecx, [ebp - 4]
call fcn.004055fb
push dword [eax]
push dword [ebp + 8]
call dword [0x40a2b8]
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401365
test edi, edi
je 0x40595b
cmp edi, 2
jne 0x405973
push 1
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
inc eax
jmp 0x405988
push 0
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x405a31
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00402ee8
test eax, eax
je 0x405b22
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.004055fb
mov eax, dword [eax]
mov esi, dword [0x40a00c]
lea ecx, [ebp + 8]
push ecx
mov edi, 0x20006
push edi
push 0
push eax
push dword [ebp - 4]
call esi
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00401365
cmp ebx, 2
jne 0x405ad4
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
call fcn.004055fb
lea ecx, [ebp + 8]
push ecx
push dword [eax]
push dword [ebp - 4]
call dword [0x40a008]
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.00401365
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.004055fb
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
push edi
push 0
push eax
push dword [ebp - 4]
call esi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00401365
test ebx, ebx
jne 0x405b1d
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
call fcn.004055fb
mov eax, dword [eax]
push 4
lea ecx, [ebp + 0x18]
push ecx
push 4
push ebx
push eax
push dword [ebp + 8]
call dword [0x40a004]
mov ecx, dword [ebp + 0xc]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.00401365
push dword [ebp + 8]
call dword [0x40a014]
test bl, bl
je 0x405b1d
xor eax, eax
inc eax
jmp 0x405b1f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x405b26
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4099f6
call fcn.004093e0
sub esp, 0x38
mov eax, dword [0x40d238]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor eax, ebp
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x40], edx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edx
xor esi, esi
push eax
mov dword [ebp - 0x38], esi
call fcn.00402ee8
test eax, eax
je 0x405c7e
push edi
lea ecx, [ebp - 0x44]
call fcn.004055fb
push dword [eax]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call dword [0x40a1c8]
mov ecx, dword [ebp - 0x44]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.00401365
push ebx
lea ecx, [ebp - 0x30]
call fcn.004055fb
mov eax, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
mov edi, 0x20006
push edi
push esi
mov esi, dword [0x40a00c]
push eax
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], eax
call fcn.00401365
cmp dword [ebp - 0x3c], 2
jne 0x405c0c
push ebx
lea ecx, [ebp - 0x30]
call fcn.004055fb
mov eax, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
push eax
push dword [ebp - 0x38]
call dword [0x40a008]
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00401365
push ebx
lea ecx, [ebp - 0x30]
call fcn.004055fb
mov eax, dword [eax]
lea ecx, [ebp - 0x34]
push ecx
push edi
push 0
push eax
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], eax
call fcn.00401365
cmp dword [ebp - 0x3c], 0
jne 0x405c6d
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.004055fb
mov esi, dword [eax]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call dword [0x40a1c4]
shl eax, 1
push eax
lea ecx, [ebp - 0x2c]
call dword [0x40a1c0]
push eax
push dword [ebp + 0x14]
push 0
push esi
push dword [ebp - 0x34]
call dword [0x40a004]
mov ecx, dword [ebp - 0x40]
mov ebx, eax
neg ebx
sbb bl, bl
add ecx, 0xfffffff0
inc bl
call fcn.00401365
push dword [ebp - 0x34]
call dword [0x40a014]
test bl, bl
je 0x405c6d
xor esi, esi
inc esi
jmp 0x405c6f
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call dword [0x40a1bc]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004093bb
leave
ret 0x14
Function at 0x405c99
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 4], edi
je 0x405d8c
cmp dword [esi + 8], edi
jbe 0x405d8c
lea ebx, [esi + 0xc]
push ebx
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x405d8c
push ebx
call dword [0x40a2c0]
push ebx
lea ecx, [ebp + 8]
call fcn.004055fb
mov eax, dword [eax]
push edi
push 0x80
push 4
push edi
push edi
push 0x40000000
push eax
call dword [0x40a088]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00401365
cmp ebx, 0xffffffff
je 0x405d33
mov eax, dword [esi + 0x114]
sub eax, edi
je 0x405d3f
dec eax
je 0x405d39
dec eax
jne 0x405d4a
mov eax, dword [esi + 0x11c]
mov dword [ebp + 8], eax
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 0x118]
push ebx
call dword [0x40a084]
cmp eax, 0xffffffff
jne 0x405d4a
push edi
push dword [esi + 8]
jmp 0x405d90
push 2
push edi
push edi
jmp 0x405d27
push ebx
call dword [0x40a080]
test eax, eax
je 0x405d33
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0x120]
mov dword [ebp - 4], edi
push dword [esi + 0x124]
push ebx
call dword [0x40a07c]
push ebx
mov dword [ebp + 8], eax
call dword [0x40a114]
cmp dword [ebp + 8], edi
je 0x405d33
push 1
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
mov eax, dword [ebp + 8]
jmp 0x405da0
push edi
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x405da7
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 4], 0
push edi
je 0x405e29
cmp dword [esi + 8], 0
jbe 0x405e29
lea edi, [esi + 0xc]
push edi
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x405e29
push edi
call dword [0x40a2c0]
test eax, eax
jne 0x405dec
push 1
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
inc eax
jmp 0x405e3e
push edi
lea ecx, [ebp + 8]
call fcn.004055fb
push dword [eax]
call dword [0x40a08c]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401365
test edi, edi
je 0x405e12
push 1
jmp 0x405e14
push 0
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
mov eax, edi
jmp 0x405e3e
push 0
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x405e44
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x409a16
call fcn.004093e0
sub esp, 0x2a4
mov eax, dword [0x40d238]
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, ebp
xor ebx, ebx
cmp dword [esi + 4], ebx
mov dword [ebp - 0x10], eax
push edi
je 0x406086
cmp dword [esi + 8], ebx
jbe 0x406086
lea edi, [esi + 0xc]
push edi
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x406086
cmp dword [esi + 0x120], ebx
jbe 0x406086
cmp dword [esi + 0x124], ebx
je 0x406086
push edi
call dword [0x40a2c0]
test eax, eax
jne 0x405ec8
push 1
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
inc eax
jmp 0x40609a
mov eax, dword [esi + 0x124]
mov edi, dword [eax]
add eax, 4
push eax
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0x2b0], edi
call fcn.004055fb
push 0x40a8a4
push dword [ebp - 0x2a4]
lea eax, [ebp - 0x29c]
push eax
mov dword [ebp - 4], ebx
call dword [0x40a2bc]
mov ebx, dword [0x40a2c8]
lea eax, [ebp - 0x29c]
push eax
call ebx
test eax, eax
jne 0x405f21
push eax
lea eax, [ebp - 0x29c]
push eax
call dword [0x40a098]
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004055fb
mov eax, dword [eax]
push edi
push dword [ebp - 0x2a4]
mov edi, dword [0x40a094]
push eax
call edi
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff0
mov dword [ebp - 0x2a8], eax
call fcn.00401365
cmp dword [ebp - 0x2a8], 0
jne 0x40607f
lea ecx, [ebp - 0x2a4]
call fcn.00401559
push eax
call ebx
test eax, eax
je 0x405fe6
and dword [ebp - 0x2a0], 0
call dword [0x40a234]
push 0xa
lea ecx, [ebp - 0x94]
push ecx
push eax
call dword [0x40a238]
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.00404d16
add esp, 0x18
lea ecx, [ebp - 0x2ac]
mov byte [ebp - 4], 1
call fcn.00401559
push eax
call ebx
test eax, eax
je 0x406012
mov ecx, dword [ebp - 0x2ac]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401365
inc dword [ebp - 0x2a0]
cmp dword [ebp - 0x2a0], 0x64
jl 0x405f7c
push 0
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
mov ecx, dword [ebp - 0x2a4]
add ecx, 0xfffffff0
call fcn.00401365
mov eax, dword [ebp - 0x2a8]
jmp 0x40609a
lea ecx, [ebp - 0x2ac]
call fcn.00401559
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00401559
push eax
call dword [0x40a090]
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.004055fb
push dword [ebp - 0x2b0]
mov eax, dword [eax]
push dword [ebp - 0x2a4]
push eax
call edi
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff0
mov dword [ebp - 0x2a8], eax
call fcn.00401365
mov ecx, dword [ebp - 0x2ac]
add ecx, 0xfffffff0
call fcn.00401365
cmp dword [ebp - 0x2a8], 0
je 0x405fe6
push 1
jmp 0x405fe8
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004093bb
leave
ret 4
Function at 0x4060b5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
push edi
je 0x40614c
cmp dword [esi + 8], ebx
jbe 0x40614c
lea edi, [esi + 0xc]
push edi
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x40614c
push edi
call dword [0x40a2c0]
test eax, eax
je 0x406120
push edi
lea ecx, [ebp + 8]
call fcn.004055fb
push dword [eax]
call dword [0x40a17c]
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401365
cmp edi, ebx
je 0x406120
push str.DllRegisterServer
push edi
call dword [0x40a174]
cmp eax, ebx
jne 0x406126
push edi
call dword [0x40a184]
push ebx
push dword [esi + 8]
jmp 0x406150
call eax
test eax, eax
jl 0x40612f
xor ebx, ebx
inc ebx
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
push edi
call dword [0x40a184]
mov eax, ebx
jmp 0x406160
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x406167
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x409a30
call fcn.004093e0
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
push edi
je 0x406231
cmp dword [esi + 8], ebx
jbe 0x406231
lea edi, [esi + 0xc]
push edi
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x406231
push edi
call dword [0x40a2c0]
push ebx
mov dword [ebp - 0x18], ebx
call dword [0x40a340]
lea ecx, [ebp + 8]
call fcn.00402107
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.0040234f
push edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 1
call fcn.004055fb
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.0040244c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov edi, eax
mov byte [ebp - 4], bl
call fcn.00401365
cmp edi, ebx
mov edi, dword [ebp - 0x10]
je 0x406200
mov edi, ebx
lea ecx, [ebp + 8]
call fcn.00402436
call dword [0x40a33c]
push edi
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402766
xor eax, eax
inc eax
jmp 0x406245
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x406256
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x409a5a
call fcn.004093e0
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
push edi
je 0x406391
cmp dword [esi + 8], ebx
jbe 0x406391
lea edi, [esi + 0xc]
push edi
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x406391
lea eax, [esi + 0x111]
push eax
mov dword [ebp - 0x20], eax
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x406391
push edi
call dword [0x40a2c0]
push ebx
mov dword [ebp - 0x24], ebx
call dword [0x40a340]
lea ecx, [ebp - 0x10]
call fcn.00402107
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0040234f
push edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x14], ebx
call fcn.004055fb
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040244c
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], bl
call fcn.00401365
cmp dword [ebp - 0x1c], ebx
jne 0x40635d
cmp dword [ebp - 0x14], ebx
je 0x40630a
mov edi, dword [ebp - 0x14]
jmp 0x406360
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
call fcn.004055fb
mov esi, eax
push edi
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.004055fb
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0040257e
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401365
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00401365
cmp esi, ebx
mov esi, dword [ebp + 8]
jne 0x40635d
xor edi, edi
inc edi
jmp 0x406360
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x10]
call fcn.00402436
call dword [0x40a33c]
push edi
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00402766
xor eax, eax
inc eax
jmp 0x4063a5
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x406acc
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x409ac1
call fcn.004093e0
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
push edi
mov dword [ebp - 0x10], ecx
je 0x406b5e
cmp dword [esi + 8], ebx
jbe 0x406b5e
lea edi, [esi + 0xc]
push edi
call fcn.0040940c
test eax, eax
pop ecx
jbe 0x406b5e
push edi
call dword [0x40a2c0]
test eax, eax
jne 0x406b1d
push 1
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
inc eax
jmp 0x406b72
push edi
lea ecx, [ebp + 8]
call fcn.004055fb
push dword [eax]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004069bf
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov edi, eax
call fcn.00401365
cmp edi, ebx
je 0x406b48
push 1
jmp 0x406b49
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
mov eax, edi
jmp 0x406b72
push ebx
push dword [esi + 8]
push 0x5f4
push dword [esi + 4]
call dword [0x40a318]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4071da
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, dword [0x40a104]
push esi
push edi
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, ecx
call ebp
cmp eax, edi
mov dword [esi + 0xdc], eax
jne 0x4071fc
xor eax, eax
jmp 0x407244
push ebx
mov ebx, dword [0x40a068]
push eax
call ebx
push edi
push edi
push 1
push edi
call ebp
cmp eax, edi
mov dword [esi + 0xe0], eax
je 0x407241
push eax
call ebx
push edi
push edi
push esi
push 0x406c4a
push edi
push edi
call dword [0x40a228]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0xd8], eax
je 0x407241
cmp eax, edi
je 0x407241
xor eax, eax
inc eax
jmp 0x407243
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x407248
Capabilities:
Create thread

Disassembly:
push esi
push edi
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x30], edi
jne 0x407265
push edi
push edi
push 1
push edi
call dword [0x40a104]
cmp eax, edi
mov dword [esi + 0x30], eax
je 0x40729d
push edi
push edi
push esi
push 0x40711f
push edi
push edi
call dword [0x40a228]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0xbc], eax
je 0x40728c
cmp eax, edi
je 0x40728c
xor eax, eax
inc eax
jmp 0x40729f
mov eax, dword [esi + 0x30]
cmp eax, edi
je 0x40729d
push eax
call dword [0x40a114]
mov dword [esi + 0x30], edi
xor eax, eax
pop edi
pop esi
ret

Function at 0x4072a2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, dword [0x40a104]
push esi
push edi
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, ecx
call ebp
cmp eax, edi
mov dword [esi + 0xc4], eax
jne 0x4072c4
xor eax, eax
jmp 0x40730c
push ebx
mov ebx, dword [0x40a068]
push eax
call ebx
push edi
push edi
push 1
push edi
call ebp
cmp eax, edi
mov dword [esi + 0xc8], eax
je 0x407309
push eax
call ebx
push edi
push edi
push esi
push 0x407132
push edi
push edi
call dword [0x40a228]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0xc0], eax
je 0x407309
cmp eax, edi
je 0x407309
xor eax, eax
inc eax
jmp 0x40730b
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x407310
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, dword [0x40a104]
push esi
push edi
xor edi, edi
push edi
push edi
push 1
push edi
mov esi, ecx
call ebp
cmp eax, edi
mov dword [esi + 0xd0], eax
jne 0x407332
xor eax, eax
jmp 0x40737a
push ebx
mov ebx, dword [0x40a068]
push eax
call ebx
push edi
push edi
push 1
push edi
call ebp
cmp eax, edi
mov dword [esi + 0xd4], eax
je 0x407377
push eax
call ebx
push edi
push edi
push esi
push 0x407186
push edi
push edi
call dword [0x40a228]
add esp, 0x18
cmp eax, 0xffffffff
mov dword [esi + 0xcc], eax
je 0x407377
cmp eax, edi
je 0x407377
xor eax, eax
inc eax
jmp 0x407379
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x407773
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x409ba1
call fcn.004093e0
sub esp, 0x640
mov eax, dword [0x40d238]
push ebx
push esi
push edi
xor eax, ebp
mov dword [ebp - 0x648], ecx
mov edx, 0x82
mov dword [ebp - 0x10], eax
xor ebx, ebx
xor eax, eax
mov ecx, edx
mov word [ebp - 0x21c], bx
lea edi, [ebp - 0x21a]
rep stosd dword es:[edi], eax
mov ecx, edx
mov word [ebp - 0x428], bx
lea edi, [ebp - 0x426]
rep stosd dword es:[edi], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x428]
push eax
push ebx
call dword [0x40a154]
mov ebx, dword [0x40a22c]
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x21c]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call dword [0x40a2c4]
push str...ProgramXLBugHandler.dll
lea eax, [ebp - 0x21c]
push eax
call dword [0x40a2cc]
lea eax, [ebp - 0x21c]
push eax
call dword [0x40a2c8]
test eax, eax
je 0x407838
lea eax, [ebp - 0x21c]
push eax
call fcn.00407487
mov ecx, eax
call fcn.004011a8
xor edx, edx
cmp eax, edx
jne 0x40783f
xor eax, eax
jmp 0x407980
xor eax, eax
mov word [ebp - 0x644], dx
mov ecx, 0x86
lea edi, [ebp - 0x642]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x648]
mov eax, dword [eax]
cmp eax, edx
je 0x4078b7
mov dword [ebp - 0x648], edx
mov ecx, dword [eax]
mov dword [ebp - 4], edx
lea edx, [ebp - 0x648]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x407892
cmp dword [ebp - 0x648], 0
je 0x407892
push dword [ebp - 0x648]
call dword [0x40a29c]
push esi
push dword [ebp - 0x648]
lea eax, [ebp - 0x644]
push eax
call ebx
or dword [ebp - 4], 0xffffffff
add esp, 0xc
push dword [ebp - 0x648]
call dword [0x40a2a4]
jmp 0x4078d8
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x644]
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x644]
push eax
call dword [0x40a2c4]
push str.Temp
lea eax, [ebp - 0x644]
push eax
call dword [0x40a2cc]
lea eax, [ebp - 0x644]
push eax
call fcn.00407487
mov ecx, eax
call fcn.00401154
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x64c]
push eax
call fcn.00401923
pop ecx
pop ecx
xor esi, esi
inc esi
lea ecx, [ebp - 0x64c]
mov dword [ebp - 4], esi
call fcn.00401559
push eax
push 0x40a998
push str._bug
lea eax, [ebp - 0x428]
push eax
push 0x40a980
call fcn.00407487
mov ecx, eax
call fcn.0040115f
push 0x1e
push esi
call fcn.00407487
mov ecx, eax
call fcn.0040117c
push 0
call fcn.00407487
mov ecx, eax
call fcn.00401170
push esi
call fcn.00407487
mov ecx, eax
call fcn.00401188
mov ecx, dword [ebp - 0x64c]
add ecx, 0xfffffff0
call fcn.00401365
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.004093bb
leave
ret