joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425320
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x508
cmp dword [ebp + 8], 0
push esi
je 0x425429
cmp dword [ebp + 0xc], 0x20
jb 0x425429
mov esi, 0x400
lea eax, [ebp - 0x508]
push esi
push 0
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 8]
push eax
push 0x434d58
push str.Software360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x425429
lea eax, [ebp - 0x508]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, 0x40
pop ecx
jne 0x425429
push edi
lea eax, [ebp - 0x508]
push 0x20
push eax
mov edi, 0x80
lea eax, [ebp - 0x88]
push edi
push eax
call fcn.0042542e
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0042422f
push esi
lea eax, [ebp - 0x508]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x508]
push esi
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.0042518a
add esp, 0x18
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x508]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
pop edi
jne 0x425429
lea eax, [ebp - 0x88]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042422f
neg eax
sbb eax, eax
inc eax
jmp 0x42542b
xor eax, eax
pop esi
leave
ret

Function at 0x426120
Capabilities:
Hash data with md5

Disassembly:
push esi
xor eax, eax
lea esi, [ecx + 0x5c]
push 0x40
push eax
push esi
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
call fcn.00426bc7
mov byte [esi], 0x80
pop esi
ret
Function at 0x4092a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], ecx
mov eax, dword [ebp - 0x64]
cmp dword [eax + 0x3c], 0
je 0x4092e0
mov ecx, dword [ebp - 0x64]
movzx edx, byte [ecx + 0x42]
test edx, edx
jne 0x4092ec
mov al, 1
jmp 0x409491
mov dword [ebp - 0x10], 8
call fcn.00405980
push eax
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 4]
call eax
mov word [ebp - 0x3a], ax
call fcn.00405980
mov word [ebp - 0x3c], ax
lea ecx, [ebp - 0x3a]
push ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.00405960
add esp, 8
movzx eax, al
test eax, eax
je 0x409331
xor al, al
jmp 0x409491
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.004088d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.00408990
mov ecx, eax
call fcn.004095b0
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.00402490
add esi, eax
push esi
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00408990
mov ecx, eax
call fcn.004095b0
push eax
mov ecx, dword [ebp - 0x64]
add ecx, 0x44
push ecx
mov edx, dword [ebp - 0x64]
mov ecx, dword [edx + 0x3c]
call fcn.00406140
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
je 0x4093ac
cmp dword [ebp - 0x68], 1
je 0x4093b3
cmp dword [ebp - 0x68], 3
je 0x40944d
jmp 0x409465
mov eax, dword [ebp - 0x64]
mov byte [eax + 0x42], 0
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00408990
mov ecx, eax
call fcn.004095b0
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x409416
mov eax, dword [ebp - 0x64]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00408990
mov ecx, eax
call fcn.004095b0
push eax
call fcn.004150b3
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x409416
mov byte [ebp - 0x5d], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402450
mov al, byte [ebp - 0x5d]
jmp 0x409491
mov ecx, dword [ebp - 0x64]
movzx edx, byte [ecx + 0x42]
test edx, edx
jne 0x409439
mov byte [ebp - 0x5e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402450
mov al, byte [ebp - 0x5e]
jmp 0x409491
cmp dword [ebp - 0x38], 0
jne 0x40944b
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.00408910
jmp 0x40947d
mov byte [ebp - 0x5f], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402450
mov al, byte [ebp - 0x5f]
jmp 0x409491
mov byte [ebp - 0x60], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00402450
mov al, byte [ebp - 0x60]
jmp 0x409491
jmp 0x409344
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x40a430
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffff
je 0x40a462
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x40a4f0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x678], ecx
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [ebp - 0x678]
add ecx, 0x24
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
je 0x40a64c
cmp dword [ebp - 0x23c], 0
jne 0x40a54c
cmp dword [ebp - 0x238], 0x500000
jbe 0x40a63f
mov edx, dword [ebp - 0x678]
add edx, 0x24
push edx
push 0x104
lea eax, [ebp - 0x468]
push eax
call fcn.0040a320
add esp, 0xc
mov ecx, dword [ebp - 0x678]
add ecx, 0x24
push ecx
push 0x104
lea edx, [ebp - 0x670]
push edx
call fcn.0040a320
add esp, 0xc
push 0x47a7bc
push 0x104
lea eax, [ebp - 0x468]
push eax
call fcn.0040a280
add esp, 0xc
push 0x47a7c4
push 0x104
lea ecx, [ebp - 0x670]
push ecx
call fcn.0040a280
add esp, 0xc
mov dword [ebp - 0x674], 0
jmp 0x40a5d5
mov edx, dword [ebp - 0x674]
add edx, 1
mov dword [ebp - 0x674], edx
cmp dword [ebp - 0x674], 3
jge 0x40a604
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40a5f1
jmp 0x40a604
cmp dword [ebp - 0x674], 2
jge 0x40a602
push 0x28
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40a5c6
lea ecx, [ebp - 0x670]
push ecx
lea edx, [ebp - 0x468]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x678]
add ecx, 0x24
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov edx, dword [ebp - 0x678]
add edx, 0x24
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x40a660
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x481288]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 0x18], eax
mov ecx, dword [ebp - 0x214]
call fcn.0040acc0
mov edx, dword [ebp - 0x214]
mov dword [edx + 0x1c], eax
mov ecx, dword [ebp - 0x214]
call fcn.0040ad30
mov ecx, dword [ebp - 0x214]
mov dword [ecx + 0x20], eax
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00415680
add esp, 0xc
push str.QQ2010
push 0x104
lea eax, [ebp - 0x210]
push eax
call fcn.0040a320
add esp, 0xc
push str..tlg
push 0x104
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040a280
add esp, 0xc
mov edx, dword [ebp - 0x214]
mov word [edx + 0x24], 0
push 1
push 0x1a
mov eax, dword [ebp - 0x214]
add eax, 0x24
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov ecx, dword [ebp - 0x214]
movzx edx, word [ecx + 0x24]
test edx, edx
je 0x40a774
mov eax, dword [ebp - 0x214]
add eax, 0x24
push eax
call fcn.00414d31
add esp, 4
mov ecx, dword [ebp - 0x214]
movzx edx, word [ecx + eax*2 + 0x22]
cmp edx, 0x5c
je 0x40a774
push 0x47a7e8
push 0x104
mov eax, dword [ebp - 0x214]
add eax, 0x24
push eax
call fcn.0040a280
add esp, 0xc
push 0x47a7ec
push 0x104
mov ecx, dword [ebp - 0x214]
add ecx, 0x24
push ecx
call fcn.0040a280
add esp, 0xc
push 0
mov edx, dword [ebp - 0x214]
add edx, 0x24
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Logs_
push 0x104
mov eax, dword [ebp - 0x214]
add eax, 0x24
push eax
call fcn.0040a280
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x214]
add ecx, 0x24
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea edx, [ebp - 0x210]
push edx
push 0x104
mov eax, dword [ebp - 0x214]
add eax, 0x24
push eax
call fcn.0040a280
add esp, 0xc
push str.NoTXLog
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a815
mov ecx, dword [ebp - 0x214]
mov byte [ecx + 0x23f], 1
jmp 0x40a820
mov ecx, dword [ebp - 0x214]
call fcn.0040a4f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004151d0
mov esp, ebp
pop ebp
ret
Function at 0x40a920
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0x30
push 0x2c
push 0
lea eax, [ebp - 0x5c]
push eax
call fcn.00415680
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x38], str.TXLOGGER_BYCORETEAM
mov dword [ebp - 0x58], 0x40a8d0
push 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetClassInfoExW]
test eax, eax
je 0x40a980
xor eax, eax
jmp 0x40a9d3
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
mov edx, dword [ebp - 0x4c]
push edx
push 0
push 0xfffffffffffffffd
push 0x64
push 0x64
push 0
push 0
push 0
push str.loger_command_window
mov eax, dword [ebp - 0x38]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 0x230], eax
push 0
mov edx, dword [ebp - 0x64]
mov eax, dword [edx + 0x230]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ecx + 0x230]
mov esp, ebp
pop ebp
ret
Function at 0x40a9e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a226
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x481288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
call fcn.0040a470
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x240
call fcn.0040b230
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x23d], 1
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x22c], 0
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x230], 0
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x23c], 1
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x234], 4
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x238], 0x3e8
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x23e], 1
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x23f], 0
lea ecx, [ebp - 0x1c]
call fcn.0040b230
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00431060
mov byte [ebp - 4], 3
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00409fd0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.004310c0
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x1c]
call fcn.00404d30
mov dword [ebp - 0x24], eax
jmp 0x40aadd
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jae 0x40abc3
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040b280
mov ecx, eax
call fcn.004312a0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40abbe
mov ecx, dword [ebp - 0x28]
movzx edx, word [ecx]
cmp edx, 0x2f
jne 0x40ab48
mov eax, dword [ebp - 0x28]
mov cx, word [eax + 2]
push ecx
call fcn.0041699d
add esp, 4
test eax, eax
je 0x40ab48
mov edx, dword [ebp - 0x28]
movzx eax, word [edx + 4]
test eax, eax
jne 0x40ab48
mov ecx, dword [ebp - 0x28]
movzx edx, word [ecx + 2]
sub edx, 0x30
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x234], edx
jmp 0x40abbe
push 0xa
push str._loglevel:
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00416366
add esp, 0xc
test eax, eax
jne 0x40ab79
mov edx, dword [ebp - 0x28]
add edx, 0x14
push edx
call fcn.004155f7
add esp, 4
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x234], eax
jmp 0x40abbe
push 8
push str._logbuf:
mov edx, dword [ebp - 0x28]
push edx
call fcn.00416366
add esp, 0xc
test eax, eax
jne 0x40abbe
mov eax, dword [ebp - 0x28]
add eax, 0x10
push eax
call fcn.004155f7
add esp, 4
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x238], eax
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x238], 1
ja 0x40abbe
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x23d], 0
jmp 0x40aad4
mov ecx, dword [ebp - 0x30]
call fcn.0040a920
test eax, eax
jne 0x40abd9
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 0x23c], 0
mov ecx, dword [ebp - 0x30]
call fcn.0040a660
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040b260
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40c350
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a1d6
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x481288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov dword [eax], 4
mov ecx, dword [ebp - 0x30]
mov byte [ecx + 4], 1
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x34], 0x32
mov ecx, dword [ebp - 0x30]
add ecx, 0x38
call fcn.0040caa0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x44
call fcn.0040cc10
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x24], 0
lea ecx, [ebp - 0x1c]
call fcn.0040b230
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00431060
mov byte [ebp - 4], 3
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.00409fd0
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
call fcn.004310c0
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x1c]
call fcn.00404d30
mov dword [ebp - 0x24], eax
jmp 0x40c43d
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jae 0x40c4bf
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040b280
mov ecx, eax
call fcn.004312a0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40c4ba
push 6
push str._perf:
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00416366
add esp, 0xc
test eax, eax
jne 0x40c48e
mov edx, dword [ebp - 0x28]
add edx, 0xc
push edx
call fcn.004155f7
add esp, 4
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
jmp 0x40c4ba
push 8
push str._perflm:
mov edx, dword [ebp - 0x28]
push edx
call fcn.00416366
add esp, 0xc
test eax, eax
jne 0x40c4ba
mov eax, dword [ebp - 0x28]
add eax, 0x10
push eax
call fcn.004155f7
add esp, 4
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x34], eax
jmp 0x40c434
mov edx, dword [ebp - 0x30]
add edx, 8
push edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp - 0x30]
cmp dword [eax], 0
jbe 0x40c4e1
mov ecx, dword [ebp - 0x30]
call fcn.0040c9a0
call fcn.00432610
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1c]
call fcn.0040b260
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e770
Capabilities:
Accept command line arguments
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a18b
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x481288]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
add ecx, 0xc
call fcn.0040eb30
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x30], 0
lea ecx, [ebp - 0x1c]
call fcn.0040b230
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00431060
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.00409fd0
add esp, 8
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004310c0
mov dword [ebp - 0x20], 1
lea ecx, [ebp - 0x1c]
call fcn.00404d30
mov dword [ebp - 0x24], eax
jmp 0x40e80c
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x24]
jae 0x40e85e
mov edx, dword [ebp - 0x20]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0040b280
mov ecx, eax
call fcn.004312a0
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x40e85c
push 6
push str._perf:
mov eax, dword [ebp - 0x28]
push eax
call fcn.00416366
add esp, 0xc
test eax, eax
jne 0x40e85c
mov ecx, dword [ebp - 0x28]
add ecx, 0xc
push ecx
call fcn.004155f7
add esp, 4
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x30], eax
jmp 0x40e803
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x100
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 8], 0
mov edx, dword [ebp - 0x30]
cmp dword [edx + 0x30], 0
jbe 0x40e892
mov eax, dword [ebp - 0x30]
add eax, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040b260
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x415135
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x415162
call fcn.0041c8a5
mov dword [eax], esi
call fcn.0041c892
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041622d
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x41513e
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x415191
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041c8b8
pop ecx
call fcn.0041c892
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4151b8
test al, 1
je 0x4151b8
test byte [esp + 0xc], 2
je 0x4151b8
call fcn.0041c8a5
mov dword [eax], 5
call fcn.0041c892
mov dword [eax], 0xd
jmp 0x415188
xor eax, eax
pop esi
ret

Function at 0x4151d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x481288]
jne 0x4151da
repz ret
jmp fcn.0041f147
Function at 0x417cb3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x417cf0
cmp dword [ebp + 0x14], edi
je 0x417cf0
cmp ecx, edi
jne 0x417cf7
call fcn.0041c892
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0041622d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x417d0b
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x417d2c
cmp ebx, 0xffffffff
je 0x417d1b
push ebx
push edi
push ecx
call fcn.00415680
add esp, 0xc
cmp esi, edi
je 0x417cd8
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x417cd8
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x417d48
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x417d4f
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x417e40
test word [esi + 0xc], 0x10c
je 0x417da3
mov eax, dword [esi + 4]
test eax, eax
je 0x417da3
jl 0x417ea1
cmp ebx, eax
mov edi, ebx
jb 0x417d74
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x417e48
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004155fc
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x417e38
cmp ebx, dword [ebp - 0xc]
jb 0x417e10
cmp dword [ebp - 0xc], 0
je 0x417dcd
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x417dc2
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x417dc9
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x417dd8
mov eax, SysReAllocString
cmp ebx, eax
ja 0x417dd8
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x417e74
push eax
push dword [ebp - 8]
push esi
call fcn.0041e8ec
pop ecx
push eax
call fcn.00424dfd
add esp, 0xc
test eax, eax
je 0x417eb3
cmp eax, 0xffffffff
je 0x417ea1
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x417e38
push esi
call fcn.00423c05
cmp eax, 0xffffffff
pop ecx
je 0x417ea5
cmp dword [ebp - 4], 0
je 0x417e74
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x417d57
mov eax, dword [ebp + 0x14]
jmp 0x417cf2
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x417e5f
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00415680
add esp, 0xc
call fcn.0041c892
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x417ce8
cmp dword [ebp + 0xc], 0xffffffff
je 0x417e8a
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00415680
add esp, 0xc
call fcn.0041c892
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x417ce8
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x417cf2
or dword [esi + 0xc], 0x10
jmp 0x417ea5