joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411901
Capabilities:
Resolve function by hash

Disassembly:
push 0x4012f0
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], al
dec ebp
xor eax, ebx
or al, 0x4c
push es
inc ebp
lcall 0xe566, 0xac73e783
cmp al, 0
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x6b], ch
push 0x445a7961
imul eax, dword [eax], 0
add byte [eax], al
add byte cs:[eax], al
add byte [eax], al
push es
add byte [eax], al
add byte [eax + 0x37], bh
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax], ah
das
inc eax
add byte [edi], al
add byte [eax], al
add ah, bl
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x700402e], al
add byte [eax], al
add byte [esi + ebp], bh
inc eax
add byte [edi], al
add byte [eax], al
add ah, dh
sub eax, 0x70040
add byte [eax], al
mov al, 0x2d
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2d], ch
inc eax
add byte [edi], al
add byte [eax], al
add byte [ebp + 0x70040], ah
add byte [eax], al
shr byte [eax + eax*2], 1
add byte [edi], al
add byte [eax], al
add byte [esp + ebp + 0x70040], cl
add byte [eax], al
and al, 0x2c
inc eax
add byte [edi], al
add byte [eax], al
add al, bl
sub eax, dword [eax]
pop es
add byte [eax], al
add byte [ebx + ebp + 0x70040], dl
add byte [eax], al
cmp al, 0x2b
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2a], dh
inc eax
add byte [esi + 0x42], dl
xor eax, 0x2a263621
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, byte [eax]
or dword [eax + eax], eax
add byte [eax], al
add byte [eax], al
add byte [esi + edx], ch
inc eax
add ah, bl
sbb dword [eax], eax
add al, 0xf8
xor byte [ecx], al
add bh, bh
invalid
push ebx
push esi
push edi
push ebp
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4118c7
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4118be
cmp edi, 0x6a4abc5b
mov ebp, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4118b6
call 0x411901
or eax, 0x776c6873
popal
jo 0x411951
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x411901
mov edi, 0xec0e4e8e
call fcn.00411a57
mov edx, dword [esp]
inc edx
push edx
call eax
push ebp
mov ebp, eax
mov edi, 0x2de87c46
call fcn.00411a57
pop ebp
call fcn.00411a49
mov edx, dword [esp]
inc edx
xor ebx, ebx
push ebx
push ebx
push ebx
push edx
call eax
test eax, eax
jne 0x41194e
mov edi, 0xca2bd06b
call fcn.00411a57
call fcn.00411958
xor ebx, ebx
push ebx
push ebx
push ebp
push ecx
push ebx
push ebx
call eax
pop eax
pop ebp
pop edi
pop esi
pop ebx
jmp 0x401220
Function at 0x401930
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00402690
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00402690
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x401990
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x401ab0
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4019c4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401a47
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4019b0
mov dword [esp], ebx
call fcn.00402320
mov edi, eax
test eax, eax
je 0x401ad7
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402430
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ab7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a40
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401a50
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401930
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4019ce
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401930
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401930
lea esi, [esi]
nop
Function at 0x401f90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x401fe5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401fde
test esi, esi
je 0x401fde
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401fc0
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x409ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov edi, ecx
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0x14], ebx
sete al
xor edx, edx
cmp dword [esp + 0x18], ebx
sete dl
cmp eax, edx
jne 0x40a0cd
mov edx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a0c5
cmp dword [edi + 0x78], ebx
jne 0x40a045
pop ebp
pop edi
mov al, 1
pop ebx
ret 0x10
mov eax, dword [esp + 0x18]
cmp eax, ebx
jbe 0x40a0c5
add eax, 2
push esi
push eax
call fcn.0043e26f
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x40a0bc
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
push esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a0b3
mov eax, dword [esp + 0x1c]
mov byte [esi + eax], bl
mov ecx, dword [esp + 0x1c]
mov byte [esi + ecx + 1], bl
cmp dword [edi + 0x7c], 8
jb 0x40a096
mov eax, dword [edi + 0x68]
jmp 0x40a099
lea eax, [edi + 0x68]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push ecx
push esi
mov ecx, edi
call fcn.00409dc0
mov bl, al
push esi
call fcn.0043eee7
add esp, 4
pop esi
pop ebp
pop edi
mov al, bl
pop ebx
ret 0x10
pop ebp
pop edi
mov al, bl
pop ebx
ret 0x10
pop edi
mov al, bl
pop ebx
ret 0x10

Function at 0x40a0e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x468d80]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0043f950
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a1b8
cmp dword [esi + 0x28], 8
jb 0x40a131
mov eax, dword [esi + 0x14]
jmp 0x40a134
lea eax, [esi + 0x14]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x4583d0
push eax
call edi
test eax, eax
jne 0x40a166
cmp dword [esp + 0xc], 5
pop edi
sete al
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043eed8
add esp, 0x118
ret
cmp dword [esi + 0x28], 8
jb 0x40a171
mov esi, dword [esi + 0x14]
jmp 0x40a174
add esi, 0x14
push 0x4583c8
push esi
call edi
test eax, eax
jne 0x40a19f
cmp dword [esp + 0xc], 5
pop edi
setne al
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043eed8
add esp, 0x118
ret
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043eed8
add esp, 0x118
ret
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
xor al, al
call fcn.0043eed8
add esp, 0x118
ret
Function at 0x40bf90
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
xor al, al
cmp dword [ebx + 0x78], 0
mov byte [esp + 7], al
je 0x40c097
cmp dword [ebx + 0x60], 8
jb 0x40bfb1
mov eax, dword [ebx + 0x4c]
jmp 0x40bfb4
lea eax, [ebx + 0x4c]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x40c093
push ebp
push esi
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ebp, [esi + 1]
push ebp
call fcn.0043e26f
mov edi, eax
add esp, 4
test edi, edi
je 0x40c085
mov ecx, dword [esp + 0x14]
push 0
lea eax, [esp + 0x1c]
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40c085
cmp dword [esp + 0x18], esi
jne 0x40c085
xor ecx, ecx
lea eax, [esi + 2]
mov edx, 2
mul edx
seto cl
mov byte [edi + esi], 0
neg ecx
or ecx, eax
push ecx
call fcn.0043e26f
mov esi, eax
add esp, 4
test esi, esi
je 0x40c07c
mov eax, dword [esp + 0x20]
push ebp
push esi
push 0xffffffffffffffff
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x40c073
cmp dword [ebx + 0x7c], 8
jb 0x40c063
mov eax, dword [ebx + 0x68]
jmp 0x40c066
lea eax, [ebx + 0x68]
push eax
push esi
mov ecx, ebx
call fcn.0040be90
mov byte [esp + 0x13], al
push esi
call fcn.0043eee7
add esp, 4
push edi
call fcn.0043eee7
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov al, byte [esp + 7]
pop ebx
add esp, 0xc
ret 4
Function at 0x40c680
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0x5c], 0
push edi
je 0x40c7e6
mov ebx, 8
cmp dword [esi + 0x44], ebx
jb 0x40c69e
mov eax, dword [esi + 0x30]
jmp 0x40c6a1
lea eax, [esi + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x458420
push eax
call edi
test eax, eax
jne 0x40c6f2
cmp dword [esi + 0x60], ebx
jb 0x40c6bd
mov eax, dword [esi + 0x4c]
jmp 0x40c6c0
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c6ec
cmp dword [esi + 0x60], ebx
jb 0x40c6d5
mov esi, dword [esi + 0x4c]
jmp 0x40c6d8
add esi, 0x4c
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40c6ec
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
cmp dword [esi + 0x44], ebx
jb 0x40c6fc
mov eax, dword [esi + 0x30]
jmp 0x40c6ff
lea eax, [esi + 0x30]
push str.folder
push eax
call edi
test eax, eax
jne 0x40c738
cmp dword [esi + 0x60], ebx
jb 0x40c724
mov esi, dword [esi + 0x4c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
ret
add esi, 0x4c
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
ret
cmp dword [esi + 0x44], ebx
jb 0x40c742
mov eax, dword [esi + 0x30]
jmp 0x40c745
lea eax, [esi + 0x30]
push str.contentasutf
push eax
call edi
test eax, eax
jne 0x40c791
cmp dword [esi + 0x60], ebx
jb 0x40c75b
mov eax, dword [esi + 0x4c]
jmp 0x40c75e
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c7e6
cmp dword [esi + 0x60], ebx
jb 0x40c773
mov eax, dword [esi + 0x4c]
jmp 0x40c776
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40c7e6
push 0xfde9
mov ecx, esi
call fcn.0040bf90
pop edi
pop esi
pop ebx
ret
cmp dword [esi + 0x44], ebx
jb 0x40c79b
mov eax, dword [esi + 0x30]
jmp 0x40c79e
lea eax, [esi + 0x30]
push str.contentasansi
push eax
call edi
test eax, eax
jne 0x40c7e6
cmp dword [esi + 0x60], ebx
jb 0x40c7b4
mov eax, dword [esi + 0x4c]
jmp 0x40c7b7
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c7e6
cmp dword [esi + 0x60], ebx
jb 0x40c7cc
mov eax, dword [esi + 0x4c]
jmp 0x40c7cf
lea eax, [esi + 0x4c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40c7e6
push eax
mov ecx, esi
call fcn.0040bf90
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x40cc10
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
mov ecx, dword [esi + 0xa8]
sub ecx, dword [esi + 0xa4]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x40cc01
push 0
push 0
push esi
push 0x40cb70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0xc], eax
test eax, eax
je 0x40cc01
lea ecx, [esp + 0xc]
push ecx
mov ecx, edi
call fcn.0040ca10
pop edi
pop esi
ret 4
jmp 0x40cbb0
Function at 0x40dc80
Capabilities:
Create thread

Disassembly:
cmp dword [esp + 4], 0
push esi
push edi
mov esi, edx
mov edi, ecx
jle 0x40dcbd
push 8
call fcn.0043e8c6
add esp, 4
test eax, eax
je 0x40dca2
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x40dca4
xor eax, eax
push 0
push 0
push eax
push 0x40dc20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
ret 4
pop edi
or eax, 0xffffffff
pop esi
ret 4

Function at 0x40dcd0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x620
mov eax, dword [0x468d80]
xor eax, esp
mov dword [esp + 0x61c], eax
push esi
push 0x30b
lea eax, [esp + 0xc]
push eax
mov esi, ecx
push 0
mov dword [esi + 0x10], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40ddfc
push edi
xor ecx, ecx
push ecx
push ecx
push 3
push ecx
push 1
push 0x80000000
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x63e], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40ddfb
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esi + 4], eax
jle 0x40dd46
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
test ecx, ecx
jle 0x40dd54
cmp ecx, eax
jle 0x40dd54
mov dword [esi + 8], eax
mov ecx, dword [esi + 8]
test ecx, ecx
jge 0x40dd66
neg ecx
cmp ecx, eax
jle 0x40dd66
neg eax
mov dword [esi + 8], eax
mov ecx, dword [esi + 8]
xor eax, eax
cmp byte [esi], al
setne al
dec eax
and eax, 2
push eax
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40ddfb
cmp byte [esi + 0xc], 0
mov eax, dword [esi + 4]
je 0x40dd8e
inc eax
push eax
mov dword [esi + 0x14], eax
call fcn.0043e26f
add esp, 4
mov dword [esi + 0x10], eax
test eax, eax
je 0x40ddfb
mov ecx, dword [esi + 4]
push 0
lea edx, [esp + 0xc]
push edx
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40ddeb
mov edx, dword [esp + 8]
cmp edx, dword [esi + 4]
jne 0x40ddeb
mov eax, dword [esi + 0x10]
push eax
call fcn.0043eee7
add esp, 4
pop edi
mov dword [esi + 0x10], 0
pop esi
mov ecx, dword [esp + 0x61c]
xor ecx, esp
call fcn.0043eed8
add esp, 0x620
ret
cmp byte [esi + 0xc], 0
je 0x40ddfb
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0x10]
mov byte [ecx + edx], 0
pop edi
mov ecx, dword [esp + 0x620]
pop esi
xor ecx, esp
call fcn.0043eed8
add esp, 0x620
ret

Function at 0x40dec0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x468d80]
xor eax, esp
mov dword [esp + 0x114], eax
cmp byte [0x468520], 0
je 0x40df2c
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.0043f950
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov byte [0x468520], 0
setae al
mov byte [0x46ad28], al
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0043eed8
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
mov al, byte [0x46ad28]
xor ecx, esp
call fcn.0043eed8
add esp, 0x118
ret
Function at 0x40e5b0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
push ebp
mov ebp, edx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 0xc]
je 0x40e653
push esi
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40e652
push ebx
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0043e26f
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40e649
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40e640
cmp edi, dword [esp + 0x10]
jne 0x40e640
push ebp
mov edx, edi
mov ecx, ebx
call fcn.0040e280
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [esp + 0x18]
push edx
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.0043eee7
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x40e8c0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x452396
mov eax, dword fs:[0]
push eax
mov eax, 0x2030
call fcn.00440690
mov eax, dword [0x468d80]
xor eax, esp
mov dword [esp + 0x202c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x468d80]
xor eax, esp
push eax
lea eax, [esp + 0x2044]
mov dword fs:[0], eax
mov esi, ecx
mov edi, 7
xor ebx, ebx
lea ebp, [esi + 4]
xor eax, eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov dword [esp + 0x20], esi
mov word [ebp], ax
mov dword [esp + 0x204c], ebx
call fcn.0040e660
push 0x1ffe
lea edx, [esp + 0x46]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x4c], cx
call fcn.0043f950
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
push 0x80000001
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40eac0
xor ecx, ecx
push 0x29
mov word [esp + 0x2c], cx
push str.123374DE290_123F_4565_9164_39C4925E467B
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x2000
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], ebx
call fcn.00408a00
push ebx
push 0x4587b0
push 3
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x205c], 1
call fcn.004096f0
cmp dword [esp + 0x3c], 8
mov eax, dword [esp + 0x28]
jae 0x40e9bd
lea eax, [esp + 0x28]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x20]
push edx
push ebx
push eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40eaac
push str._USERPROFILE_
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
cmp eax, ebx
je 0x40ea82
lea edx, [esp + 0x40]
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, edx
lea edx, [eax + 2]
jmp 0x40ea10
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40ea10
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.00408a00
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push edi
mov ecx, esi
call fcn.00408640
push ebx
push 0x28
lea ecx, [esp + 0x48]
push ecx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x40]
push edx
push edi
mov ecx, esi
call fcn.0040e890
cmp dword [esi + 0x18], 8
jb 0x40ea67
mov eax, dword [ebp]
jmp 0x40ea69
mov eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40ea79
test al, 0x10
jne 0x40eaac
mov ecx, esi
call fcn.0040e660
jmp 0x40eaac
lea eax, [esp + 0x40]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40ea90
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.00408a00
cmp dword [esp + 0x3c], 8
jb 0x40eac0
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0043e5e6
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2044]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x202c]
xor ecx, esp
call fcn.0043eed8
add esp, 0x203c
ret
Function at 0x40f000
Capabilities:
Get common file path
Get startup folder

Disassembly:
push 0xffffffffffffffff
push 0x45246b
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x468d80]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
push edi
mov eax, dword [0x468d80]
xor eax, esp
push eax
lea eax, [esp + 0x45c]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
push 0x1a
lea eax, [esp + 0x50]
push eax
push ebx
mov esi, ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [esp + 0x48]
push ecx
call edi
push 0x10
xor edx, edx
push 0x45868c
lea ecx, [esp + 0x34]
mov dword [esp + 0x4c], 7
mov dword [esp + 0x48], ebx
mov word [esp + 0x38], dx
call fcn.00408a00
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x464], ebx
call fcn.0040eb90
cmp dword [eax + 0x18], 8
jb 0x40f09c
mov eax, dword [eax + 4]
jmp 0x40f09f
add eax, 4
push eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [esp + 0x28], 8
jb 0x40f0bf
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0043e5e6
add esp, 4
lea edx, [esp + 0x48]
push edx
call edi
mov edx, esi
lea ecx, [esp + 0x48]
call fcn.0040eca0
cmp dword [esp + 0x44], 8
mov bl, al
jb 0x40f0e7
mov eax, dword [esp + 0x30]
push eax
call fcn.0043e5e6
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x45c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.0043eed8
add esp, 0x458
ret