joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409760
Capabilities:
Get file version info

Disassembly:
sub esp, 0x634
mov eax, dword [0x43d768]
xor eax, esp
mov dword [esp + 0x630], eax
mov edx, dword [esp + 0x644]
mov eax, dword [esp + 0x638]
mov ecx, dword [esp + 0x63c]
push ebx
mov ebx, dword [esp + 0x644]
push ebp
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x654]
push eax
lea edx, [esp + 0x230]
push edx
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str..exe
lea eax, [esp + 0x230]
push eax
call ebp
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x230]
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jne 0x4097fa
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x630]
xor ecx, esp
call fcn.00419ef4
add esp, 0x634
ret
push esi
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x40993a
mov eax, dword [esp + 0x20]
push esi
push edi
push eax
lea ecx, [esp + 0x23c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x409933
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x409933
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push ecx
push edx
lea eax, [esp + 0x440]
push str._04X_04X
push eax
call edi
lea ecx, [esp + 0x448]
push ecx
lea edx, [esp + 0x3c]
push str.StringFileInfo_sFileDescription
push edx
call edi
add esp, 0x1c
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x409933
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
push eax
push ecx
call ebp
lea edx, [esp + 0x438]
push edx
lea eax, [esp + 0x2c]
push str.StringFileInfo_sFileVersion
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x409933
mov ecx, dword [esp + 0x65c]
mov edx, dword [esp + 0x18]
push 0x11f
push ecx
push edx
call fcn.00409430
add esp, 0xc
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x10]
push eax
push ebx
call ebp
lea ecx, [esp + 0x438]
push ecx
lea edx, [esp + 0x2c]
push str.StringFileInfo_sLegalCopyright
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40993e
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x40995a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, 1
mov ecx, dword [esp + 0x640]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00419ef4
add esp, 0x634
ret
Function at 0x40a1f0
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.00409fd0
add esp, 4
test eax, eax
jne 0x40a209
mov eax, 1
pop esi
ret
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
ret

Function at 0x40a220
Capabilities:
Delete file
Move file
Read .ini file
Set file attributes

Disassembly:
sub esp, 0x424
mov eax, dword [0x43d768]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
mov ebx, dword [esp + 0x42c]
push ebx
call fcn.00409fd0
add esp, 4
test eax, eax
jne 0x40a264
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00419ef4
add esp, 0x424
ret
push esi
push 0x80
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call fcn.00408d40
test eax, eax
je 0x40a33d
cmp eax, 1
je 0x40a33d
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x16]
mov eax, 0x66666667
imul ecx
movzx eax, word [esp + 0x12]
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
movzx edx, word [esp + 0x14]
push ecx
movzx ecx, word [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0x230]
push str.._02d_02d_02d_02d
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push ebx
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
lea eax, [esp + 0x1c]
push eax
push ebx
call esi
test eax, eax
jne 0x40a31b
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00419ef4
add esp, 0x424
ret
push 4
push 0
lea ecx, [esp + 0x20]
push ecx
call esi
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00419ef4
add esp, 0x424
ret
push edi
push 0xfffe
call fcn.0040b201
add esp, 4
push str.WININIT.INI
push 0x7fff
mov edi, eax
push edi
push str.Rename
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
cmp word [edi], 0
mov esi, edi
je 0x40a380
jmp 0x40a370
mov dx, word [esi]
add esi, 2
test dx, dx
jne 0x40a370
cmp word [esi], dx
jne 0x40a370
push 0x432708
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40a394
push str.WININIT.INI
push edi
xor ecx, ecx
push str.Rename
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
test eax, eax
jne 0x40a3dc
push edi
call fcn.0040b20c
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.00419ef4
add esp, 0x424
ret
push str.WININIT.INI
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edi
call fcn.0040b20c
mov ecx, dword [esp + 0x430]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00419ef4
add esp, 0x424
ret
Function at 0x40a5a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x14]
push ecx
xor eax, eax
push edx
mov word [ebx], ax
call fcn.0040a420
add esp, 8
test eax, eax
jne 0x40a5cd
mov eax, 1
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 8]
push eax
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push str.UserEntrySubPath
push edx
mov dword [esp + 0x20], 0
call edi
test eax, eax
jne 0x40a683
mov eax, dword [esp + 8]
test eax, eax
je 0x40a683
push esi
push eax
call fcn.0040b201
mov edx, dword [esp + 0x20]
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x18]
push ecx
push 0
push str.UserEntrySubPath
push edx
call edi
test eax, eax
je 0x40a65b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call fcn.0040b20c
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 8
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0040b20c
add esp, 4
pop esi
pop edi
mov eax, 1
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x40a6a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x61c
mov eax, dword [0x43d768]
xor eax, esp
mov dword [esp + 0x618], eax
push esi
mov esi, dword [esp + 0x624]
push edi
mov edi, dword [esp + 0x62c]
lea eax, [esp + 0x210]
push eax
call fcn.00409980
add esp, 4
test eax, eax
je 0x40a783
mov edx, dword [0x44222c]
lea ecx, [esp + 0x418]
push ecx
push edx
lea eax, [esp + 0x218]
push eax
call fcn.0040a0b0
push 0x104
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.0041a6b0
mov ecx, dword [0x4421c4]
add esp, 0x18
lea edx, [esp + 0x418]
push edx
mov edx, dword [0x4421bc]
push 0x104
lea eax, [esp + 0x10]
push eax
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x40a783
cmp word [esp + 8], 0
je 0x40a783
mov eax, dword [esp + 0x630]
push 0x11f
push eax
push edi
call fcn.00409430
add esp, 0xc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x618]
xor ecx, esp
call fcn.00419ef4
add esp, 0x61c
ret
mov ecx, dword [esp + 0x620]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.00419ef4
add esp, 0x61c
ret
Function at 0x40a7a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
mov eax, dword [0x43d768]
xor eax, esp
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0xc], ecx
mov word [ecx], dx
lea ecx, [esp + 4]
push ecx
push eax
call fcn.0040a420
add esp, 8
test eax, eax
jne 0x40a7e5
mov eax, 1
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00419ef4
add esp, 0x1c
ret
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
push str.PrnID
push ecx
mov dword [esp + 0x1c], 0
call esi
test eax, eax
jne 0x40a8ea
mov eax, dword [esp + 4]
test eax, eax
je 0x40a8ea
push edi
push eax
call fcn.0040b201
mov ecx, dword [esp + 0x10]
add esp, 4
lea edx, [esp + 8]
push edx
mov edi, eax
push edi
lea eax, [esp + 0x18]
push eax
push 0
push str.PrnID
push ecx
call esi
test eax, eax
je 0x40a881
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call fcn.0040b20c
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00419ef4
add esp, 0x1c
ret
xor esi, esi
cmp dword [esp + 8], esi
jle 0x40a8c0
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
movzx eax, byte [esi + edi]
push eax
lea ecx, [esp + 0x24]
push str._02X
push ecx
call ebx
mov eax, dword [esp + 0x28]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
push eax
call ebp
inc esi
cmp esi, dword [esp + 0x10]
jl 0x40a897
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0040b20c
add esp, 4
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00419ef4
add esp, 0x1c
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00419ef4
add esp, 0x1c
ret

Function at 0x40b0be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b116
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x432bfc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b109
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40b118
xor eax, eax
pop esi
leave
ret 4
Function at 0x40b777
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x43d768]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x40b80f
push 0x432fa4
push 4
push eax
call fcn.0041ac88
push eax
call fcn.00404db0
add esp, 0x10
push ebx
push edi
call fcn.0041c035
mov edi, dword [eax]
call fcn.0041c035
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0041bfd2
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.0041c035
cmp dword [eax], ebx
je 0x40b826
call fcn.0041c035
push dword [eax]
call fcn.0040b6f8
pop ecx
jmp 0x40b82d
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x40b7ba
jmp 0x40b8b4
call fcn.0041c035
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x40b8b0
cmp dword [ebp - 0x234], esi
jae 0x40b8b0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.0041a6b0
add esp, 0xc
push 0x432d04
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40b89f
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40b89f
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x40b89f
push ebx
push ebx
push esi
jmp 0x40b8a8
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40b8b2
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00419ef4
leave
ret

Function at 0x40e74e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40e772
cmp dword [edi + 0x54], 0
jne 0x40e772
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0040fb15
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040e70f
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x414f57
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x414f9e
call fcn.0040fb15
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x414f9e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x414fba
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.00414acf
mov esi, eax
test edi, edi
je 0x414fb8
test ebx, ebx
je 0x414fb8
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x419ef4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43d768]
jne 0x419efe
repz ret
jmp fcn.0042033c

Function at 0x4261b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041efb0
and dword [ebp - 4], 0
cmp dword [0x444f08], 0
mov ebx, eax
jne 0x426267
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x426318
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x426318
push eax
call fcn.0041ef3e
mov dword [esp], 0x435704
push edi
mov dword [0x444f08], eax
call esi
push eax
call fcn.0041ef3e
mov dword [esp], 0x4356f0
push edi
mov dword [0x444f0c], eax
call esi
push eax
call fcn.0041ef3e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x444f10], eax
call esi
push eax
call fcn.0041ef3e
pop ecx
mov dword [0x444f18], eax
test eax, eax
je 0x426267
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041ef3e
pop ecx
mov dword [0x444f14], eax
mov eax, dword [0x444f14]
cmp eax, ebx
je 0x4262bf
cmp dword [0x444f18], ebx
je 0x4262bf
push eax
call fcn.0041efb9
push dword [0x444f18]
mov esi, eax
call fcn.0041efb9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4262bf
test edi, edi
je 0x4262bf
call esi
test eax, eax
je 0x4262b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4262b6
test byte [ebp - 0xc], 1
jne 0x4262bf
or dword [ebp + 0x10], 0x200000
jmp 0x4262f8
mov eax, dword [0x444f0c]
cmp eax, ebx
je 0x4262f8
push eax
call fcn.0041efb9
pop ecx
test eax, eax
je 0x4262f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4262f8
mov eax, dword [0x444f10]
cmp eax, ebx
je 0x4262f8
push eax
call fcn.0041efb9
pop ecx
test eax, eax
je 0x4262f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444f08]
call fcn.0041efb9
pop ecx
test eax, eax
je 0x426318
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42631a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e420
Capabilities:
Connect pipe
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x84]
test al, al
jne 0x40d442
mov eax, dword [esi + 0x58]
test eax, eax
je 0x40d412
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov dword [esi + 0x58], 0
mov eax, dword [esi + 0x54]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40d42a
push eax
call edi
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x98]
test eax, eax
je 0x40d441
push eax
call edi
mov dword [esi + 0x98], 0
pop edi
pop esi
ret
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0xc8], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x90], eax
mov eax, dword [esi + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x40d90d
mov ecx, dword [esi + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x80], 1
pop esi
ret
mov edx, dword [esi + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
jne 0x40d934
mov eax, dword [esi + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x80], 1
pop esi
ret
mov cl, byte [esi + 0x84]
test cl, cl
jne 0x40d947
push 2
mov ecx, esi
call fcn.0040d450
pop esi
ret
push esi
mov esi, ecx
cmp dword [esi + 0x9c], 1
jne 0x40e330
cmp dword [esi + 0xa0], 0
je 0x40e330
cmp dword [esi + 0xa8], 0
je 0x40e330
cmp dword [esi + 0xac], 0
je 0x40e330
cmp dword [esi + 0xb0], 0
jne 0x40e35b
mov eax, dword [esi + 0x98]
push eax
mov dword [esi + 0x80], 0xa
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x40e411
mov dword [esi + 0x80], 1
pop esi
ret
push edi
push 0x40
call fcn.0042315c
add esp, 4
test eax, eax
je 0x40e3a0
mov edx, dword [esi + 0xb0]
lea ecx, [esi + 0xb4]
push ecx
mov ecx, dword [esi + 0xac]
push edx
mov edx, dword [esi + 0xa8]
push ecx
mov ecx, dword [esi + 0xa4]
push edx
mov edx, dword [esi + 0xa0]
push ecx
push edx
push esi
mov ecx, eax
call fcn.0040e690
mov edi, eax
jmp 0x40e3a2
xor edi, edi
mov ecx, edi
call fcn.0040e580
test al, al
jne 0x40e3d4
mov eax, dword [esi + 0x98]
push eax
mov dword [esi + 0x80], 0xa
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x40e3e9
mov dword [esi + 0x80], 1
jmp 0x40e3e9
push edi
mov ecx, esi
call fcn.0040e260
test al, al
jne 0x40e400
push 0xa
mov ecx, esi
call fcn.0040d450
test edi, edi
je 0x40e410
mov ecx, edi
call fcn.0040e6f0
push edi
call fcn.0042305c
add esp, 4
pop edi
pop esi
ret
mov dword [esi + 0xc8], edi
mov dword [esi + 0x80], 7
pop edi
pop esi
ret
mov al, byte [ecx + 0x84]
test al, al
je 0x40e442
mov dword [ecx + 0x80], 1
mov ecx, dword [ecx + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
ret
mov eax, dword [ecx + 0x80]
dec eax
cmp eax, 9
ja case.default.0x40e44e
jmp dword [eax*4 + 0x40e494]
jmp 0x40d3f0
jmp fcn.0040d510
jmp fcn.0040d5a0
jmp fcn.0040d620
jmp fcn.0040d6b0
jmp 0x40e300
jmp fcn.0040d730
jmp fcn.0040d7b0
jmp fcn.0040d840
jmp 0x40d8c0
mov dword [ecx + 0x80], 1
ret
Function at 0x40e464
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0x84]
test al, al
jne 0x40d442
mov eax, dword [esi + 0x58]
test eax, eax
je 0x40d412
push eax
call dword [sym.imp.KERNEL32.dll_UnregisterWait]
mov dword [esi + 0x58], 0
mov eax, dword [esi + 0x54]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40d42a
push eax
call edi
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x98]
test eax, eax
je 0x40d441
push eax
call edi
mov dword [esi + 0x98], 0
pop edi
pop esi
ret
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0xc8], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x90], eax
mov eax, dword [esi + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x40d90d
mov ecx, dword [esi + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x80], 1
pop esi
ret
mov edx, dword [esi + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
test eax, eax
jne 0x40d934
mov eax, dword [esi + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [esi + 0x80], 1
pop esi
ret
mov cl, byte [esi + 0x84]
test cl, cl
jne 0x40d947
push 2
mov ecx, esi
call fcn.0040d450
pop esi
ret
push esi
mov esi, ecx
cmp dword [esi + 0x9c], 1
jne 0x40e330
cmp dword [esi + 0xa0], 0
je 0x40e330
cmp dword [esi + 0xa8], 0
je 0x40e330
cmp dword [esi + 0xac], 0
je 0x40e330
cmp dword [esi + 0xb0], 0
jne 0x40e35b
mov eax, dword [esi + 0x98]
push eax
mov dword [esi + 0x80], 0xa
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x40e411
mov dword [esi + 0x80], 1
pop esi
ret
push edi
push 0x40
call fcn.0042315c
add esp, 4
test eax, eax
je 0x40e3a0
mov edx, dword [esi + 0xb0]
lea ecx, [esi + 0xb4]
push ecx
mov ecx, dword [esi + 0xac]
push edx
mov edx, dword [esi + 0xa8]
push ecx
mov ecx, dword [esi + 0xa4]
push edx
mov edx, dword [esi + 0xa0]
push ecx
push edx
push esi
mov ecx, eax
call fcn.0040e690
mov edi, eax
jmp 0x40e3a2
xor edi, edi
mov ecx, edi
call fcn.0040e580
test al, al
jne 0x40e3d4
mov eax, dword [esi + 0x98]
push eax
mov dword [esi + 0x80], 0xa
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x40e3e9
mov dword [esi + 0x80], 1
jmp 0x40e3e9
push edi
mov ecx, esi
call fcn.0040e260
test al, al
jne 0x40e400
push 0xa
mov ecx, esi
call fcn.0040d450
test edi, edi
je 0x40e410
mov ecx, edi
call fcn.0040e6f0
push edi
call fcn.0042305c
add esp, 4
pop edi
pop esi
ret
mov dword [esi + 0xc8], edi
mov dword [esi + 0x80], 7
pop edi
pop esi
ret
mov al, byte [ecx + 0x84]
test al, al
je 0x40e442
mov dword [ecx + 0x80], 1
mov ecx, dword [ecx + 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
ret
mov eax, dword [ecx + 0x80]
dec eax
cmp eax, 9
ja case.default.0x40e44e
jmp dword [eax*4 + 0x40e494]
jmp 0x40d3f0
jmp fcn.0040d510
jmp fcn.0040d5a0
jmp fcn.0040d620
jmp fcn.0040d6b0
jmp 0x40e300
jmp fcn.0040d730
jmp fcn.0040d7b0
jmp fcn.0040d840
jmp 0x40d8c0
mov dword [ecx + 0x80], 1
ret