joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa50
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a3fc5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x34
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
movq qword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
call fcn.0042cba0
movzx esi, al
test al, al
jne 0x40ab1a
lea ecx, [ebp - 0x2c]
call fcn.0040c540
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [ebp - 0x18]
test eax, eax
je 0x40ab86
cmp edx, 8
jb 0x40ab1a
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ab10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abee
push edx
push ecx
call fcn.0044235d
add esp, 8
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov byte [ebp - 4], 1
call fcn.00401520
cmp dword [eax + 0x14], 8
jb 0x40ab46
mov eax, dword [eax]
push eax
push ecx
lea edx, [ebp - 0x2c]
mov ecx, 0x4bc354
call fcn.00422f70
mov edx, dword [ebp - 0x18]
add esp, 8
cmp edx, 8
jb 0x40abc2
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40abb8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abe9
jmp 0x40abb8
cmp edx, 8
jb 0x40ab1a
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40ab10
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40abee
jmp 0x40ab10
push edx
push ecx
call fcn.0044235d
add esp, 8
lea ecx, [ebp - 0x44]
call fcn.00410810
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004452a7
call fcn.004452a7
int3
Function at 0x40c130
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a41be
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], 0
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x48], 1
call fcn.00409800
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 0x10
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmovae eax, dword [ebp - 0x44]
push eax
call esi
push 0x4bbca0
call esi
cmp dword [ebp - 0x30], 0x10
lea edx, [ebp - 0x44]
push dword [ebp - 0x34]
cmovae edx, dword [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.00409930
add esp, 4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
cmovae eax, dword [ebp - 0x2c]
push eax
call esi
push 0x4bbca0
call esi
cmp dword [ebp - 0x18], 0x10
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x60]
cmovae edx, dword [ebp - 0x2c]
call fcn.00409800
cmp dword [ebp - 0x4c], 0x10
lea eax, [ebp - 0x60]
cmovae eax, dword [ebp - 0x60]
push eax
call esi
push 0x4bbca0
call esi
mov edx, dword [ebp - 0x18]
cmp edx, 0x10
jb 0x40c246
mov ecx, dword [ebp - 0x2c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c23c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2e2
push edx
push ecx
call fcn.0044235d
add esp, 8
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
cmp edx, 0x10
jb 0x40c288
mov ecx, dword [ebp - 0x44]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c27e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2e2
push edx
push ecx
call fcn.0044235d
add esp, 8
lea eax, [ebp - 0x60]
mov ecx, edi
push eax
call fcn.00407130
mov edx, dword [ebp - 0x4c]
cmp edx, 0x10
jb 0x40c2c3
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40c2b9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40c2e7
push edx
push ecx
call fcn.0044235d
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret 4
call fcn.004452a7
call fcn.004452a7
int3
Function at 0x40f740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
mov dword [ebp - 0x10], eax
mov edi, edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
push eax
push 0
push ecx
push 0x40f590
push 0
push 0
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
call esi
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push 0
push edi
push 0x40f3c0
push 0
push 0
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov edi, eax
test ebx, ebx
je 0x40f7c2
mov eax, dword [ebp - 0x10]
mov esi, 1
test eax, eax
je 0x40f7b9
mov dword [eax], ebx
jmp 0x40f7c2
push ebx
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40f7fe
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x40f7e5
mov dword [eax], edi
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret 8
push edi
call ecx
pop edi
lea eax, [esi + 1]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441dc6
mov esp, ebp
pop ebp
ret 8

Function at 0x40f820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x63002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
push edi
mov dword [esi], eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x24], 0x760073
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x320032
mov dword [ebp - 0x18], 0x300031
mov dword [ebp - 0x14], 0x300032
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f890
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407400
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
Function at 0x40f8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x63002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0x760073
lea edx, [ecx + 2]
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x330032
mov dword [ebp - 0x18], 0x330030
mov dword [ebp - 0x14], 0x310030
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f930
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407400
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00441dc6
mov esp, ebp
pop ebp
ret

Function at 0x40f960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x72002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
push edi
mov dword [esi], eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x24], 0x700069
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x330032
mov dword [ebp - 0x18], 0x330030
mov dword [ebp - 0x14], 0x390032
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f9d0
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407400
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441dc6
mov esp, ebp
pop ebp
ret

Function at 0x40fa00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x73002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
push edi
mov dword [esi], eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x24], 0x70006e
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x330032
mov dword [ebp - 0x18], 0x330030
mov dword [ebp - 0x14], 0x300033
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fa70
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407400
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
Function at 0x40faa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x2c], 0x63002f
xor eax, eax
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], esi
push edi
mov dword [esi], 0
lea edx, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x28], 0x720073
mov dword [ebp - 0x24], 0x75006c
mov dword [ebp - 0x20], 0x32006e
mov dword [ebp - 0x1c], 0x320030
mov dword [ebp - 0x18], 0x300033
mov dword [ebp - 0x14], 0x310034
mov dword [ebp - 0x10], 0x730030
mov dword [ebp - 0xc], 0x6e0069
mov dword [ebp - 8], 0x78
mov word [esi], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fb20
sub ecx, edx
lea eax, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00407400
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441dc6
mov esp, ebp
pop ebp
ret

Function at 0x40fb50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040faa0
cmp dword [ebp - 8], 8
lea esi, [ebp - 0x1c]
cmovae esi, dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
test eax, eax
je 0x40fb91
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40fb91
mov esi, 1
jmp 0x40fb93
xor esi, esi
mov edx, dword [ebp - 8]
cmp edx, 8
jb 0x40fbc9
mov ecx, dword [ebp - 0x1c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fbbf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fbda
push edx
push ecx
call fcn.0044235d
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
call fcn.004452a7
int3
Function at 0x40fbe0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a46fd
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.0040f960
mov dword [ebp - 4], 0
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
cmp edx, 8
mov ecx, dword [ebp - 0x28]
cmovae esi, ecx
test edi, edi
je 0x40fcfd
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push esi
push edi
call ebx
mov ecx, eax
test ecx, ecx
je 0x40fcf7
cmp dword [ebp - 0x2c], 0
je 0x40fcea
cmp dword [ebp - 0x30], 0
je 0x40fcea
mov eax, dword [ebp - 0x18]
lea esi, [ecx + eax*2]
mov edi, esi
cmp word [edi], 0
je 0x40fcea
cmp word [edi + 2], 0x22
jne 0x40fcea
push 0x4bc5a8
add edi, 4
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x40fcea
mov eax, esi
cdq
mov ecx, eax
mov esi, edx
mov eax, ebx
cdq
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
sbb edx, esi
add eax, 0xfffffffc
adc edx, 0xffffffff
shrd eax, edx, 1
push eax
push edi
call fcn.00407400
cmp word [ebx + 2], 0
je 0x40fcea
cmp word [ebx + 4], 0x22
jne 0x40fcea
push 0x4bc5a8
add ebx, 6
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40fcea
mov ecx, dword [ebp - 0x30]
cdq
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
sub edi, eax
sbb esi, edx
shrd edi, esi, 1
push edi
push ebx
call fcn.00407400
mov edx, dword [ebp - 0x14]
mov esi, 1
mov ecx, dword [ebp - 0x28]
jmp 0x40fcff
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
xor esi, esi
cmp edx, 8
jb 0x40fd2f
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40fd25
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40fd4d
push edx
push ecx
call fcn.0044235d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
call fcn.004452a7
int3
Function at 0x410250
Capabilities:
Check mutex on windows
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.CSBSCP202303011621mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x38], ebx
call esi
cmp eax, 0xb7
jne 0x4102b9
test ebx, ebx
je 0x410291
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push eax
push str.HandleSelfCheckSvcRun
push str._s:CreateMutex___alreadly_run:_d
call fcn.00401620
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
push 0
push 0x325
push 0
push 0
xor edx, edx
xor ecx, ecx
call fcn.0040d520
xorps xmm0, xmm0
xor edx, edx
push 1
movups xmmword [ebp - 0x1c], xmm0
call fcn.0040a060
mov edi, dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x1c]
push eax
call edi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.0040ccd0
test eax, eax
je 0x410329
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
call fcn.0040f740
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
nop
push 0x3e8
test esi, esi
je 0x41034e
push esi
call ebx
jmp 0x410354
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x2c], xmm0
call edi
mov ax, word [ebp - 0x2c]
cmp ax, word [ebp - 0x1c]
jne 0x41037f
mov ax, word [ebp - 0x2a]
cmp ax, word [ebp - 0x1a]
jne 0x41037f
mov ax, word [ebp - 0x26]
cmp ax, word [ebp - 0x16]
je 0x410340
call fcn.00406890
test eax, eax
jne 0x4103c5
push 1
xor edx, edx
call fcn.0040a060
push 0
push 1
push 0
xor edx, edx
call fcn.0040b230
lea eax, [ebp - 0x1c]
push eax
call edi
push 0
push 0
push 0
push 0
push 0
push 0x326
push 0
push 0
xor edx, edx
xor ecx, ecx
call fcn.0040d520
jmp 0x410340
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4103d2
push esi
call edi
mov eax, dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 1
test eax, eax
je 0x410408
push 0x4e20
push eax
call ebx
cmp eax, 0x102
jne 0x410403
push 0
push dword [ebp - 0x30]
call esi
push dword [ebp - 0x30]
call edi
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x410429
push 0x4e20
push eax
call ebx
mov ebx, dword [ebp - 0x34]
cmp eax, 0x102
jne 0x410426
push 0
push ebx
call esi
push ebx
call edi
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x410433
push eax
call edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
Function at 0x411370
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4785
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.RECSU202210121837mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call esi
cmp eax, 0xb7
jne 0x4113e0
test ebx, ebx
je 0x4113c6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push eax
push str.RunEntryChromeSvcUpdate
push str._s:CreateMutex___alreadly_run:_d
call fcn.00401620
add esp, 0xc
jmp 0x411522
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 1
lea esi, [eax + 5]
call fcn.00406050
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x411442
mov eax, esi
dec esi
test eax, eax
jle 0x411442
push 0xc8
call edi
lea edx, [ebp - 0x28]
call fcn.00406050
test eax, eax
je 0x411428
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41147d
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
sub esp, 0x14
xor edx, edx
push 1
push ecx
call fcn.0040edc0
test eax, eax
je 0x41147d
push eax
call esi
call fcn.00411000
test ebx, ebx
je 0x411489
push ebx
call esi
call fcn.0040eff0
test eax, eax
je 0x4114a2
push 0x1f4
call edi
call fcn.0040eff0
test eax, eax
jne 0x411492
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x4114d8
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4114ce
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411540
push edx
push ecx
call fcn.0044235d
add esp, 8
mov edx, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp edx, 8
jb 0x411522
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411518
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411540
push edx
push ecx
call fcn.0044235d
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
call fcn.004452a7
int3
Function at 0x411bd0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4905
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4cc00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.RECTT202210121837mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
cmp eax, 0xb7
jne 0x411c3f
test esi, esi
je 0x411c25
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push eax
push str.RunEntryChromeTimerTask
push str._s:CreateMutex___alreadly_run:_d
call fcn.00401620
add esp, 0xc
jmp 0x411d5a
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 1
call fcn.00401520
cmp dword [eax + 0x14], 8
jb 0x411c7f
mov eax, dword [eax]
push eax
push ecx
lea edx, [ebp - 0x28]
mov ecx, str.CMSPathCs
call fcn.00422f70
add esp, 8
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 4], 0
mov edi, eax
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x411ce3
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411cd9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411d77
push edx
push ecx
call fcn.0044235d
add esp, 8
test edi, edi
jne 0x411cef
lea edx, [ebp - 0x40]
call fcn.00406050
call fcn.00406890
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x411d1d
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
sub esp, 0x14
xor edx, edx
push 1
push ecx
call fcn.0040edc0
test eax, eax
je 0x411d1d
push eax
call edi
test esi, esi
je 0x411d24
push esi
call edi
mov edx, dword [ebp - 0x2c]
cmp edx, 8
jb 0x411d5a
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411d50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411d7c
push edx
push ecx
call fcn.0044235d
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00441dc6
mov esp, ebp
pop ebp
ret
call fcn.004452a7
call fcn.004452a7
int3