joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4055a0
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x410
mov edx, dword [eax]
mov eax, dword [edx - 8]
test eax, eax
jne 0x4055bc
add esp, 0x410
ret 4
cmp eax, 0x104
jle 0x4055ce
xor eax, eax
add esp, 0x410
ret 4
push edi
mov ecx, 0x104
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 4]
push ecx
push 0x2710
push 0x4605d4
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [esp + 4], 0
pop edi
jne 0x405606
xor eax, eax
add esp, 0x410
ret 4
lea edx, [esp]
push 0x4605d0
push edx
call fcn.00441b72
add esp, 8
test eax, eax
jne 0x405625
add esp, 0x410
ret 4
push eax
call fcn.00441ac4
add esp, 4
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, 1
add esp, 0x410
ret 4
Function at 0x405c00
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x454180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov ebp, ecx
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0
call fcn.00407850
mov eax, dword [esp + 0x24]
xor esi, esi
mov cx, word [eax]
test cx, cx
je 0x405c6e
mov edi, dword [sym.imp.USER32.dll_CharNextW]
cmp cx, 0x5c
jne 0x405c4f
test esi, esi
jne 0x405c51
mov esi, eax
jmp 0x405c51
xor esi, esi
push eax
call edi
mov cx, word [eax]
test cx, cx
jne 0x405c41
test esi, esi
je 0x405c6e
mov word [esi], cx
mov eax, dword [esp + 0x24]
sub esi, eax
sar esi, 1
mov dword [eax - 8], esi
mov eax, 0x4605e4
test eax, eax
je 0x405c82
push 0x4605e4
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x4605e4
push eax
lea ecx, [esp + 0x2c]
call fcn.00407720
mov eax, dword [esp + 0x24]
xor edi, edi
mov ecx, dword [eax - 8]
test ecx, ecx
jle 0x405d5a
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp word [eax + edi*2], 0x5c
jne 0x405d4c
lea ecx, [esp + 0x10]
push edi
push ecx
lea ecx, [esp + 0x2c]
call fcn.00403530
mov edx, dword [esp + 0x10]
mov byte [esp + 0x1c], 1
push edx
call ebx
test eax, eax
jne 0x405d18
mov eax, dword [esp + 0x10]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov esi, eax
test esi, esi
jne 0x405d9c
mov esi, dword [ebp + 4]
mov ecx, dword [esi + 4]
push ecx
push esi
mov ecx, ebp
call fcn.004070b0
mov dword [esi + 4], eax
mov ecx, dword [eax + 4]
lea edx, [esp + 0x10]
mov dword [ecx], eax
add eax, 8
push edx
push eax
call fcn.00407bf0
mov eax, dword [ebp + 8]
add esp, 8
inc eax
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x10]
mov edx, dword [0x46005c]
mov byte [esp + 0x1c], 0
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x405d4c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x405d4c
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00439890
add esp, 4
mov eax, dword [esp + 0x24]
inc edi
cmp edi, dword [eax - 8]
jl 0x405ca8
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x405d85
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x405d85
mov edx, dword [esp + 0x24]
add edx, 0xfffffff4
push edx
call fcn.00439890
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x405dcb
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x405dcb
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00439890
add esp, 4
mov eax, dword [esp + 0x24]
mov edx, dword [0x46005c]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x405dfa
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x405dfa
mov edx, dword [esp + 0x24]
add edx, 0xfffffff4
push edx
call fcn.00439890
add esp, 4
mov eax, esi
jmp 0x405d87
Function at 0x406190
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x10
mov eax, dword [0x46063c]
mov ecx, dword [0x460640]
mov dx, word [esp + 0x14]
mov dword [esp], eax
lea eax, [esp]
mov dword [esp + 4], ecx
push eax
mov word [esp + 4], dx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x4061ca
xor eax, eax
xor edx, edx
add esp, 0x10
ret 4
xor ecx, ecx
lea edx, [esp + 8]
mov dword [esp + 8], ecx
push edx
push ecx
lea eax, [esp + 8]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x4061f2
xor edx, edx
add esp, 0x10
ret 4
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
add esp, 0x10
ret 4

Function at 0x406430
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x28
push ebx
xor eax, eax
push ebp
push esi
mov dword [esp + 0x20], eax
mov esi, ecx
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x1c]
mov edx, dword [esi + 0x34]
push edi
mov dword [esp + 0x2c], eax
push ecx
mov dword [esp + 0x34], eax
push 0x18
push edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x40], eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov esi, dword [esi + 4]
push esi
mov dword [esp + 0x18], esi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebp, eax
push ebp
mov dword [esp + 0x1c], ebp
call esi
push ebp
mov ebx, eax
call esi
mov esi, dword [esp + 0x3c]
mov edi, eax
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
mov ecx, dword [esi + 8]
sub eax, edx
mov edx, dword [esi]
push eax
sub ecx, edx
push ecx
push ebp
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edx, dword [esp + 0x10]
mov ebp, eax
mov eax, dword [edx + 0x34]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push ebp
push edi
mov dword [esp + 0x44], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 4]
push 0xcc0020
push eax
sub edx, eax
mov eax, dword [esi + 8]
push ecx
push ebx
sub eax, ecx
push edx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x3c]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push ebx
call esi
mov edx, dword [esp + 0x10]
push edx
push edi
call esi
push ebp
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
test ebp, ebp
mov esi, eax
je 0x40651b
push ebp
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebp, dword [sym.imp.GDI32.dll_DeleteDC]
test edi, edi
je 0x406528
push edi
call ebp
test ebx, ebx
je 0x40652f
push ebx
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x4082e0
Capabilities:
Delete file

Disassembly:
mov eax, 0x2020
call fcn.00441bd0
mov edx, dword [esp + 0x2024]
test edx, edx
jne 0x4082fe
xor eax, eax
add esp, 0x2020
ret
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x24]
push 0x1000
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x14], 3
call fcn.00441b85
add esp, 0xc
lea edx, [esp + 4]
lea ecx, [esp + 0x24]
mov word [esp + 0x14], 0x614
push edx
mov dword [esp + 0x10], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
pop edi
inc eax
add esp, 0x2020
ret

Function at 0x408360
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x4542c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 4], edi
mov dword [esi + 0x18], edi
lea eax, [esi + 0x1c]
mov dword [esp + 0x14], edi
cmp eax, edi
je 0x408396
lea ecx, [eax - 0x1c]
jmp 0x408398
xor ecx, ecx
push eax
add ecx, 8
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0x3c]
mov byte [esp + 0x14], 1
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
call fcn.004046c0
mov dword [esi + 0x92c], edi
mov dword [esi + 0x930], edi
mov ecx, 0x200
xor eax, eax
lea edi, [esi + 0x12c]
mov dword [esi], 0x4585b8
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4086d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
mov dword [0x468410], eax
call fcn.004087c0
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.00408ae0
mov eax, dword [esi + 4]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0x92c]
lea edi, [esi + 0x3c]
push ecx
mov ecx, edi
call fcn.00406550
mov edx, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
mov ecx, dword [esp + 0x14]
sub edx, 0x31
push edx
mov edx, dword [esp + 0x14]
sub eax, 2
add ecx, 0x169
push eax
add edx, 0xd3
push ecx
push edx
mov ecx, edi
call fcn.00405010
mov ebp, dword [esi + 4]
lea ebx, [edi + 8]
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x468384
mov dword [ebx + 4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4683b8]
push 0x468384
mov dword [ebx + 8], eax
mov dword [0x4683b8], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x468358]
push 0
push 0x403230
push ebp
push 0x11b
push ecx
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov edx, dword [esi + 0x40]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret 8
Function at 0x408980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push 0x454338
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
and eax, 0xffff
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
xor ebp, ebp
cmp esi, ebp
jne 0x4089c2
xor eax, eax
jmp 0x408ac8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
cmp edi, ebp
jne 0x4089d7
xor eax, eax
jmp 0x408ac8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
cmp esi, ebp
jne 0x4089f3
xor eax, eax
jmp 0x408ac8
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, ebp
jne 0x408a0f
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x408ac8
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebp
jne 0x408a2f
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x408ac8
mov ecx, edi
mov edi, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x20], ebp
push ebx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [esp + 0x20]
xor esi, esi
cmp eax, ebp
je 0x408a60
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebp
push edx
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x408aa9
mov edi, dword [esp + 0x20]
push 0x10
call int.004379f0
mov esi, eax
cmp esi, ebp
je 0x408aa7
lea eax, [esp + 0x28]
mov dword [esi], 0x4585cc
push eax
push edi
mov dword [esp + 0x30], ebp
call fcn.00437cf0
mov ecx, dword [esp + 0x28]
mov dword [esi + 8], eax
mov dword [esi + 4], ecx
jmp 0x408aa9
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
cmp eax, ebp
je 0x408ac6
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, esi
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0xc
Function at 0x409300
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push esi
mov esi, ecx
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov eax, dword [esp + 8]
mov cx, ax
cmp cx, 0x61
jb 0x409346
cmp cx, 0x7a
ja 0x409346
add eax, 0xffffffe0
and eax, 0xffff
add esi, 0x12c
push eax
push 0x460760
push 0x400
push esi
call fcn.00409370
add esp, 0x10
pop edi
pop esi
add esp, 0x208
ret
Function at 0x40c7a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push esi
test eax, eax
je 0x40c7cc
mov esi, dword [esp + 8]
push 5
mov eax, dword [esi - 0x5c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esi - 0x60]
call fcn.0040bd50
mov eax, 1
pop esi
ret 8
mov esi, dword [esp + 8]
push 0
mov ecx, dword [esi - 0x5c]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x630]
test eax, eax
je 0x40c7f0
push 1
lea ecx, [esi - 0x60]
call fcn.0040bd50
mov eax, 1
pop esi
ret 8
Function at 0x40e740
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, ecx
push edi
push 0
push 0
mov ecx, dword [esi + 4]
push 0x1004
push ecx
mov dword [esi + 0x2c], eax
call ebx
mov edx, dword [esi + 4]
push 0
push 0
push 0x1028
push edx
mov edi, eax
call ebx
mov ebx, eax
cmp edi, ebx
jle 0x40e7a8
mov eax, dword [esi + 0x2c]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x2c]
sub edi, ebx
push 0
push edi
push 0
push 2
push ecx
call dword [sym.imp.USER32.dll_SetScrollRange]
push 1
push 0
mov ecx, esi
call fcn.0040e3c0
pop edi
pop esi
pop ebx
ret 4
mov edx, dword [esi + 0x2c]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
ret 4
Function at 0x410e50
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1814
call fcn.00441bd0
push ebx
push ebp
push esi
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x824]
push 0x800
rep stosd dword es:[edi], eax
lea eax, [esp + 0x828]
push 0x4612e4
push eax
call fcn.00441b85
mov esi, dword [esp + 0x1838]
push 0x800
lea ecx, [esp + 0x834]
push esi
push ecx
call fcn.00442185
push 0x800
lea edx, [esp + 0x840]
push 0x4612b8
push edx
call fcn.00442185
push 0x800
lea eax, [esp + 0x84c]
push esi
push eax
call fcn.00442185
push 0x800
lea ecx, [esp + 0x858]
push str.vL
push ecx
call fcn.00442185
mov edx, dword [esp + 0x1864]
push 0x800
lea eax, [esp + 0x864]
push edx
push eax
call fcn.00442185
add esp, 0x48
lea ecx, [esp + 0x824]
push 0x800
push 0x461278
push ecx
call fcn.00442185
add esp, 0xc
lea edx, [esp + 0x824]
push 0x14
push esi
push edx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebp, eax
xor ebx, ebx
cmp ebp, 6
jne 0x411083
push 0xc8
push 0x461234
push 0x4609c8
call fcn.004536d2
add esp, 0xc
test eax, eax
jne 0x41106e
mov ecx, 0x1ff
lea edi, [esp + 0x26]
mov word [esp + 0x24], bx
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x24]
push eax
push ecx
push edx
push str.Path
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x30], 1
mov dword [esp + 0x38], 0x800
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x411063
lea eax, [esp + 0x24]
push str.360ver.dll
lea ecx, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x411063
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], ebx
call fcn.004110a0
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp eax, ebx
je 0x411063
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ebx
push 1
push ecx
mov dword [esp + 0x24], ebx
call fcn.004111c0
test eax, eax
jne 0x411037
cmp dword [esp + 0x14], ebx
jne 0x411063
push 1
lea edx, [esp + 0x28]
push 0x460830
push edx
call fcn.00410e50
add esp, 0xc
push 5
push ebx
push ebx
push 0x460b60
jmp 0x411077
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x411063
push str.IsBetaVersion
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp edi, ebx
je 0x41106e
push 5
push ebx
push ebx
push 0x460b60
jmp 0x411077
push 5
push ebx
push ebx
push 0x4609c8
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x1830], ebx
je 0x411092
push ebx
call fcn.00442074
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x1814
ret
Function at 0x4111c0
Capabilities:
Check if file exists
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x144
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 3
push 0
push 3
push 0x80
push str..360SelfProtection
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 0
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x411247
lea eax, [esp + 0x18]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
lea edx, [esp + 0x24]
push 4
push edx
push 0x22204c
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x411247
mov eax, dword [esp + 0x10]
test eax, eax
je 0x411247
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x144
ret 0x10
mov eax, dword [esp + 0x15c]
mov ebp, dword [esp + 0x158]
test eax, eax
je 0x411276
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x411276
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x144
ret 0x10
mov eax, dword [esp + 0x160]
test eax, eax
je 0x411333
xor edi, edi
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push ebp
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x411321
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x24]
push 0x40
push ecx
push esi
call ebx
test eax, eax
je 0x411316
cmp dword [esp + 0x10], 0x40
jne 0x411316
cmp word [esp + 0x1c], 0x5a4d
jne 0x411316
mov edx, dword [esp + 0x58]
push edi
push edi
push edx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [esp + 0x58]
jne 0x411316
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x64]
push 0xf8
push ecx
push esi
call ebx
test eax, eax
je 0x411316
cmp dword [esp + 0x10], 0xf8
jne 0x411316
cmp dword [esp + 0x5c], 0x4550
jne 0x411316
cmp word [esp + 0x62], di
je 0x411316
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x411333
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x144
ret 0x10
mov edi, dword [esp + 0x164]
test edi, edi
je 0x411344
mov dword [edi], 0
lea edx, [esp + 0x10]
xor esi, esi
push edx
push ebp
mov dword [esp + 0x18], 0xffffffff
call fcn.00411110
add esp, 8
test eax, eax
je 0x411381
mov ecx, dword [esp + 0x10]
cmp ecx, 3
je 0x411375
cmp ecx, 0xffffffff
je 0x411375
mov eax, 1
jmp 0x411377
xor eax, eax
xor edx, edx
cmp ecx, 3
sete dl
mov esi, edx
test edi, edi
je 0x411387
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret 0x10
Function at 0x411790
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x454985
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], eax
lea ebx, [esi + 0x20]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.00410190
lea eax, [esi + 0x5c]
cmp eax, edi
je 0x4117d9
lea ecx, [eax - 0x5c]
jmp 0x4117db
xor ecx, ecx
push eax
add ecx, 8
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0x64]
mov byte [esp + 0x18], 2
call fcn.0042e4e0
lea ecx, [esi + 0x80]
mov byte [esp + 0x18], 3
call fcn.0042e4e0
lea ecx, [esi + 0x9c]
mov byte [esp + 0x18], 4
call fcn.0042e4e0
lea ecx, [esi + 0xb8]
mov byte [esp + 0x18], 5
call fcn.0042e4e0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0xd4], edi
mov dword [esi + 0xd8], edi
mov dword [esi + 0xdc], edi
mov dword [esi + 0xe0], edi
mov dword [esi + 0xe4], edi
mov dword [esi + 0xe8], edi
mov dword [esi + 0xf8], edi
mov dword [esi + 0xfc], edi
mov dword [esi + 0x100], edi
mov dword [esi + 0x104], edi
mov dword [esi + 0xec], edi
mov dword [esi + 0xf0], edi
mov dword [esi + 0xf4], edi
mov dword [esi], 0x458790
mov eax, esi
pop edi
mov dword [ebx], 0x45878c
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4143b0
Capabilities:
Check os version

Disassembly:
sub esp, 0x114
push edi
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 8]
pop edi
cmp eax, 5
jne 0x4143ee
mov ecx, dword [esp + 8]
mov eax, 1
cmp ecx, eax
je 0x4143f0
xor eax, eax
add esp, 0x114
ret

Function at 0x415180
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x454f89
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00410190
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor edi, edi
mov dword [esi + 0x40], edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], eax
lea eax, [esi + 0x5c]
cmp eax, edi
je 0x4151c3
lea ecx, [eax - 0x5c]
jmp 0x4151c5
xor ecx, ecx
push eax
add ecx, 0x44
push 0x40
push 0xd
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
call fcn.0042e4e0
lea ecx, [esi + 0x8c]
mov byte [esp + 0x14], 3
call fcn.0042e4e0
mov dword [esi + 0xa8], 1
mov dword [esi + 0xb0], edi
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov ecx, dword [str.lF_F]
mov dword [esi + 0xc0], ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xc4], edi
mov dword [esi + 0xac], edi
mov dword [esi], 0x4587f4
mov dword [esi + 0x3c], 0x4587e8
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret