joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401094
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
push edi
call fcn.00401000
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
mov eax, dword [esi + 0x1b4]
xor edi, edi
cmp eax, edi
je 0x4010ba
push eax
call ebx
mov dword [esi + 0x1b4], edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1b4], eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x401a96
push edi
push edi
call fcn.00432b4c
add esp, 0x18
cmp eax, 0xffffffff
je 0x4010e8
push eax
call ebx
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4018f2
Capabilities:
Create thread

Disassembly:
push 0x64
mov eax, 0x44ad52
call fcn.00433612
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x70], ecx
push eax
mov ecx, esi
mov ebx, edx
call fcn.00403214
push dword [ebp - 0x6c]
lea edi, [esi + 0x1c]
mov ecx, edi
call fcn.00403214
push dword [ebp - 0x70]
lea ecx, [esi + 0x38]
call fcn.00403214
mov eax, dword [ebp + 0x1c]
push ebx
lea ecx, [esi + 0x158]
mov dword [esi + 0x1b0], eax
call fcn.00404e1f
push dword [ebp - 0x68]
lea ecx, [esi + 0x174]
call fcn.00404e1f
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x190], eax
lea eax, [esi + 0x1ac]
push eax
xor ebx, ebx
push ebx
push esi
push 0x401bad
push ebx
push ebx
call fcn.00432b4c
add esp, 0x18
cmp eax, 0xffffffff
je 0x401984
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x18], bl
je 0x401a8c
cmp byte [esi + 0x1d8], bl
jne 0x401a8c
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 7
call fcn.00404e5e
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 4], ebx
call fcn.0042503b
pop ecx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.00404e5e
sub esp, 0x1c
lea eax, [ebp - 0x64]
mov ecx, esp
mov dword [ebp - 0x68], esp
push eax
mov byte [ebp - 4], 2
lea ebx, [ebp - 0x2c]
call fcn.00402ba3
call fcn.004061b9
mov eax, dword [ebp - 0x28]
add esp, 0x1c
cmp dword [ebp - 0x14], 8
jae 0x4019f2
lea eax, [ebp - 0x28]
cmp dword [edi + 0x18], 8
jb 0x4019fd
mov edi, dword [edi + 4]
jmp 0x401a00
add edi, 4
cmp dword [esi + 0x18], 8
jb 0x401a0b
mov ebx, dword [esi + 4]
jmp 0x401a0e
lea ebx, [esi + 4]
push eax
push edi
lea edi, [ebp - 0x48]
call fcn.004060f6
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
pop ecx
pop ecx
jae 0x401a26
lea eax, [ebp - 0x44]
push eax
call fcn.0042523e
xor ebx, ebx
pop ecx
test al, al
je 0x401a6b
push ebx
push ebx
push ebx
push 0x458770
mov edi, esi
call fcn.004020aa
test eax, eax
jne 0x401a6b
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404e7c
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.00404e7c
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00404e7c
mov al, 1
jmp 0x401a8e
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404e7c
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.00404e7c
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00404e7c
xor al, al
call fcn.00433695
ret 0x18
Function at 0x401c68
Capabilities:
Copy file

Disassembly:
push ebp
sub esp, 0x5c
lea ebp, [esp - 4]
mov eax, dword [0x465d44]
xor eax, ebp
mov dword [ebp + 0x5c], eax
push 0x38
mov eax, 0x44a75b
call fcn.004335a9
mov eax, dword [ebp + 0x68]
xor ebx, ebx
push ebx
lea ecx, [ebp + 0x40]
mov dword [ebp], eax
mov dword [ebp + 0x58], 7
call fcn.00404e5e
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0xf8]
cmp eax, ebx
jbe 0x401cfb
lea eax, [esi + 0xe4]
cmp dword [eax + 0x18], 8
jb 0x401cbc
mov eax, dword [eax + 4]
jmp 0x401cbf
add eax, 4
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.00424fcc
push edi
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 1
call fcn.00404607
add esp, 0x14
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 2
call fcn.00403181
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00404e7c
lea ecx, [ebp - 0x44]
jmp 0x401d34
lea eax, [ebp - 0x28]
push eax
call fcn.00425188
push edi
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 3
call fcn.00404607
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x40]
mov byte [ebp - 4], 4
call fcn.00403181
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.00404e7c
lea ecx, [ebp - 0x28]
push ebx
push 1
mov byte [ebp - 4], bl
call fcn.00404e7c
push dword [ebp]
lea ecx, [ebp + 8]
call fcn.00402b81
push edi
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x24]
push eax
mov byte [ebp - 4], 5
call fcn.00404607
mov ecx, dword [ebp + 0x28]
add esp, 0xc
cmp dword [ebp + 0x3c], 8
jae 0x401d6b
lea ecx, [ebp + 0x28]
cmp dword [ebp + 0x58], 8
mov eax, dword [ebp + 0x44]
jae 0x401d77
lea eax, [ebp + 0x44]
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
test eax, eax
push 1
lea ecx, [ebp + 0x24]
setne byte [ebp + 7]
call fcn.00404e7c
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00404e7c
push ebx
push 1
lea ecx, [ebp + 0x40]
call fcn.00404e7c
mov al, byte [ebp + 7]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x5c]
xor ecx, ebp
call fcn.004310bf
add ebp, 0x60
leave
ret 4
Function at 0x401f07
Capabilities:
Create thread

Disassembly:
push 0x4c
mov eax, 0x44abd1
call fcn.00433612
mov eax, dword [ebp + 8]
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x4c], ecx
cmp byte [ebp + 0xc], bl
je 0x401f82
cmp eax, ebx
je 0x401f35
push eax
lea ecx, [esi + 0x74]
call fcn.00403214
cmp edi, ebx
je 0x401f45
push edi
lea ecx, [esi + 0x90]
call fcn.00403214
cmp dword [ebp - 0x4c], ebx
je 0x401f58
push dword [ebp - 0x4c]
lea ecx, [esi + 0xac]
call fcn.00403214
lea eax, [ebp - 0x50]
push eax
push ebx
push esi
push 0x402052
push ebx
push ebx
call fcn.00432b4c
add esp, 0x18
cmp eax, 0xffffffff
je 0x40204a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40204a
mov eax, dword [esi + 0x1b4]
cmp eax, ebx
je 0x401f95
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.00404e5e
mov dword [ebp - 4], ebx
cmp dword [esi + 0x34], 8
jb 0x401fb3
mov ebx, dword [esi + 0x20]
jmp 0x401fb6
lea ebx, [esi + 0x20]
cmp dword [esi + 0x18], 8
jb 0x401fc1
mov edi, dword [esi + 4]
jmp 0x401fc4
lea edi, [esi + 4]
lea ecx, [ebp - 0x2c]
call fcn.00405db1
xor ebx, ebx
cmp byte [esi + 0x1b8], bl
jne 0x401fee
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x401fe2
lea eax, [ebp - 0x28]
push eax
mov eax, esi
call fcn.00401dc9
test al, al
je 0x40203f
push str.XLLiveUD.exe
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00404607
add esp, 0xc
mov byte [ebp - 4], 1
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x402013
lea eax, [ebp - 0x44]
push eax
lea ecx, [esi + 0x100]
call fcn.00403214
push dword [ebp - 0x4c]
mov edi, esi
push dword [ebp - 0x54]
push dword [ebp - 0x50]
push 0x4589e4
call fcn.004020aa
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00404e7c
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404e7c
call fcn.00433695
ret 8
Function at 0x405db1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x465d44]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
push eax
push 0x104
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.00403214
push str.XLLiveUD_
mov ecx, esi
call fcn.00402bc9
push edi
mov ecx, esi
call fcn.00402bc9
push 0x458b44
mov ecx, esi
call fcn.00402bc9
push ebx
mov ecx, esi
call fcn.00402bc9
push 0x458b48
mov ecx, esi
call fcn.00402bc9
cmp dword [esi + 0x18], 8
jb 0x405e26
mov esi, dword [esi + 4]
jmp 0x405e29
add esi, 4
call fcn.00405e3b
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004310bf
leave
ret
Function at 0x4060f6
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x465d44]
xor eax, ebp
mov dword [ebp + 0x398], eax
mov eax, dword [ebp + 0x3a4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x406148
lea eax, [ebp - 0x78]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x78]
push eax
mov ecx, edi
call fcn.00403214
push str.Thunder_NetworkXLLiveUD_
mov ecx, edi
call fcn.00402bc9
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x190], ax
lea eax, [ebp + 0x192]
push eax
call fcn.004310d0
push dword [ebp - 0x80]
lea eax, [ebp + 0x190]
push dword [ebp - 0x7c]
push ebx
push str._s__s__s_StartupInfo.xml
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
lea eax, [ebp + 0x190]
push eax
mov ecx, edi
call fcn.00402bc9
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
call fcn.004310bf
add ebp, 0x39c
leave
ret

Function at 0x406916
Capabilities:
Create thread
Resume thread

Disassembly:
push 0x20c
mov eax, 0x44a957
call fcn.00433612
xor ebx, ebx
push ebx
push 1
mov dword [ebp - 0x214], esi
lea edi, [esi + 8]
call fcn.00404747
pop ecx
pop ecx
cmp eax, ebx
je 0x406942
mov dword [eax], edi
jmp 0x406944
xor eax, eax
mov dword [edi], eax
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
lea eax, [esi + 0x20]
push eax
mov dword [ebp - 4], 1
call fcn.00406e0a
lea eax, [esi + 0x38]
push eax
mov byte [ebp - 4], 2
call fcn.00406e0a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov dword [esi + 0x54], eax
lea eax, [ebp - 0x210]
push 0x458c38
push eax
call fcn.004071d7
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push ebx
push ebx
push ebx
call edi
push ebx
push ebx
push ebx
push ebx
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x58], eax
lea eax, [esi + 4]
push eax
push 4
push esi
push 0x4068fc
push ebx
push ebx
call fcn.00432b4c
add esp, 0x18
push eax
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
call fcn.00433695
ret

Function at 0x409b50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [esp + 0x214]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xe]
push ecx
mov word [esp + 0x10], ax
call fcn.004310d0
add esp, 0xc
push 0x104
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsSameRootW]
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.004310bf
add esp, 0x20c
ret 4
Function at 0x40a6a0
Capabilities:
Copy file

Disassembly:
sub esp, 0x414
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
mov ebx, dword [esp + 0x420]
push esi
mov esi, dword [esp + 0x428]
push edi
mov edi, dword [esp + 0x424]
push 0x208
lea eax, [esp + 0x218]
push 0
push eax
call fcn.004310d0
push 0x208
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004310d0
add esp, 0x18
push str.Program
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [esp + 0x14]
push edx
call edi
push esi
lea eax, [esp + 0x10]
push eax
mov ecx, eax
push ecx
call edi
push esi
push ebx
lea edx, [esp + 0x21c]
push edx
call edi
push 0
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [esp + 0x41c]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
inc eax
call fcn.004310bf
add esp, 0x414
ret
Function at 0x40c210
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x446348
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x465d44]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov dword [esp + 0x20], eax
jle 0x40c407
mov dword [esp + 0x1c], 0x3d
mov ebp, 7
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + ebx*4]
xor edx, edx
mov eax, ecx
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], edi
mov word [esp + 0x60], dx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x40c2a0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x64]
call fcn.0040376d
push edi
xor eax, eax
push 0x44f5d0
lea ecx, [esp + 0x48]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x60], ebp
mov dword [esp + 0x5c], edi
mov word [esp + 0x4c], ax
call fcn.0040376d
xor ecx, ecx
push edi
mov word [esp + 0x2c], cx
push 0x44f5d0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x8c], 1
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], edi
call fcn.0040376d
push 1
push edi
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x68]
mov byte [esp + 0x90], 2
call fcn.0040a8b0
mov esi, eax
cmp esi, 0xffffffff
jne 0x40c347
push eax
push 1
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x4c]
call fcn.004036c4
push edi
push 0x44f5d0
lea ecx, [esp + 0x2c]
call fcn.0040376d
jmp 0x40c378
cmp esi, 1
jbe 0x40c378
lea ecx, [esi - 1]
push ecx
push 1
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x4c]
call fcn.004036c4
inc esi
cmp esi, dword [esp + 0x70]
jae 0x40c378
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x30]
call fcn.004036c4
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0040c060
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, eax
call fcn.00403181
mov esi, 8
cmp dword [esp + 0x3c], esi
jb 0x40c3ad
mov eax, dword [esp + 0x28]
push eax
call fcn.00430dfa
add esp, 4
xor ecx, ecx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], edi
mov word [esp + 0x28], cx
cmp dword [esp + 0x58], esi
jb 0x40c3cf
mov edx, dword [esp + 0x44]
push edx
call fcn.00430dfa
add esp, 4
xor eax, eax
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], edi
mov word [esp + 0x44], ax
mov dword [esp + 0x84], 0xffffffff
cmp dword [esp + 0x74], esi
jb 0x40c3fc
mov ecx, dword [esp + 0x60]
push ecx
call fcn.00430dfa
add esp, 4
inc ebx
cmp ebx, dword [esp + 0x14]
jl 0x40c27f
xor eax, eax
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.004310bf
add esp, 0x74
ret
Function at 0x40c820
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov eax, 0x28de80
mov ecx, 0x278d00
push ebx
push ebp
push esi
mov dword [esp + 0x48], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x64], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], ecx
push edi
mov ecx, 0x7bc
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x74], ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0x24ea00
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x263b80
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
jle 0x40c8fb
jmp 0x40c8b0
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul edx, edx, 0x64
mov eax, ecx
sub eax, edx
jne 0x40c8d9
mov eax, 0x51eb851f
mul ecx
shr edx, 7
imul edx, edx, 0x190
mov eax, ecx
sub eax, edx
jmp 0x40c8dc
test cl, 3
sete al
test al, al
je 0x40c8eb
add edi, 0x1e28500
jmp 0x40c8f1
add edi, 0x1e13380
adc ebx, 0
inc ecx
cmp ecx, dword [esp + 0x74]
jl 0x40c8b0
mov ebp, dword [esp + 0x78]
mov esi, 1
cmp ebp, esi
jle 0x40c92f
mov ecx, dword [esp + 0x74]
push ecx
call fcn.0040c7c0
add esp, 4
mov cl, al
test cl, cl
je 0x40c921
mov eax, dword [esp + esi*4 + 0xc]
jmp 0x40c925
mov eax, dword [esp + esi*4 + 0x3c]
cdq
add edi, eax
adc ebx, edx
inc esi
cmp esi, ebp
jl 0x40c917
mov eax, dword [esp + 0x7c]
imul eax, eax, 0x15180
sub eax, 0x15180
mov ecx, dword [esp + 0x84]
cdq
mov esi, eax
mov eax, dword [esp + 0x80]
imul eax, eax, 0xe10
mov ebp, edx
cdq
add esi, eax
adc ebp, edx
mov eax, ecx
shl eax, 4
sub eax, ecx
add eax, eax
add eax, eax
cdq
add esi, eax
mov eax, dword [esp + 0x88]
adc ebp, edx
cdq
add esi, eax
adc ebp, edx
add esi, edi
pop edi
adc ebp, ebx
mov eax, esi
pop esi
mov edx, ebp
pop ebp
pop ebx
add esp, 0x60
ret
Function at 0x40ce20
Capabilities:
Get disk size
Get file size

Disassembly:
sub esp, 0x224
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, ecx
cmp dword [eax + 0x10c], 8
jb 0x40ce47
mov eax, dword [eax + 0xf8]
jmp 0x40ce4c
add eax, 0xf8
push ebx
push ebp
push esi
push edi
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
push 0x208
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.004310d0
add esp, 0xc
push 0x104
lea eax, [esp + 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0x80
push 3
push 0
push 0
push 0x80
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea edx, [esp + 0x10]
mov esi, eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
jl 0x40cedc
jg 0x40ced8
cmp dword [esp + 0x20], ebp
jbe 0x40cedc
xor eax, eax
jmp 0x40cee1
mov eax, 1
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004310bf
add esp, 0x224
ret

Function at 0x40d0e0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x418
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, ecx
call fcn.00421d30
test eax, eax
je 0x40d1a5
push 0x208
lea eax, [esp + 0xc]
push 0
push eax
call fcn.004310d0
add esp, 0xc
push 0x104
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x21
lea edx, [esp + 0xc]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call fcn.004201b0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0041ee90
push 0x208
lea edx, [esp + 0x22c]
push 0
push edx
call fcn.004310d0
add esp, 0x24
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, dword [esp + 4]
push eax
push ecx
lea edx, [esp + 0x218]
push str.SIGN.IE0_x__s
push edx
call fcn.00431b0c
push 0x21
lea eax, [esp + 0x224]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocString
call fcn.004201b0
add esp, 0x20
cmp dword [esi + 0x10c], 8
jb 0x40d1b6
mov eax, dword [esi + 0xf8]
jmp 0x40d1bc
lea eax, [esi + 0xf8]
push 1
push 1
push 0
push eax
call fcn.0041f340
add esp, 0x10
call fcn.00413ae0
mov ecx, eax
call fcn.00413b50
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40de00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x446208
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x465d44]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
sub esp, 0x1c
xor esi, esi
mov dword [esp + 0x24], esi
lea eax, [ecx + 0xb4]
mov ecx, esp
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
push esi
xor edx, edx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], esi
push eax
mov word [ecx + 4], dx
call fcn.00403181
mov dword [esp + 0x30], esi
mov esi, dword [esp + 0x38]
push esi
call fcn.00410ec0
mov ecx, eax
mov dword [esp + 0x34], 0xffffffff
call fcn.00411180
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4

Function at 0x40e1d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
xor edi, edi
test eax, eax
je 0x40e1e9
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40e217
push 0
push ecx
mov eax, esp
push 0
push 0
push 0
mov dword [eax], edi
push ecx
mov eax, esp
mov dword [eax], edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov ecx, esi
call fcn.0040de90
mov edi, eax
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ebx, [esi + 0x3c]
push edi
mov ecx, ebx
call fcn.004144b0
cmp dword [esi + 0xb0], 8
jb 0x40e23f
mov esi, dword [esi + 0x9c]
push esi
mov ecx, ebx
call fcn.00418670
xor eax, eax
pop edi
pop esi
pop ebx
ret
add esi, 0x9c
push esi
mov ecx, ebx
call fcn.00418670
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x40f5a0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4466bb
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x465d44]
xor eax, esp
mov dword [esp + 0x42c], eax
push esi
mov eax, dword [0x465d44]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
push str.ThunderUninstall09477AF2_30C3_48b0_9CD2_022DE5C9B8EA
push 0
push 1
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x40f5fe
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x40f787
push str.ThunderUninstall09477AF2_30C3_48b0_9CD2_022DE5C9B8EA
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, esi
mov dword [esi + 0xf0], eax
call fcn.0040df10
mov ecx, esi
call fcn.0040ce20
test eax, eax
je 0x40f5f4
mov ecx, esi
call fcn.0040e260
mov ecx, esi
call fcn.0040d670
xor eax, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
mov word [esp + 0xc], ax
push 0x208
push eax
lea ecx, [esp + 0x234]
push ecx
mov dword [esp + 0x44c], eax
call fcn.004310d0
add esp, 0xc
push 0x104
lea edx, [esp + 0x230]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x230]
push ecx
call fcn.0041f240
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x36]
push eax
mov word [esp + 0x38], dx
call fcn.004310d0
add esp, 0x14
lea ecx, [esp + 0x24]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.ThunderUninstallDump_
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.XLBugHandler.dll__XL_SetBugReportRootDir_4]
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x40f6e2
lea eax, [esp + 0xc]
mov ecx, dword [0x468560]
mov edx, dword [ecx]
push eax
push 0x44fa34
push str._bug
push edx
push 0x44fc04
call dword [sym.imp.XLBugHandler.dll__XL_InitBugHandler_20]
push 1
call dword [sym.imp.XLBugHandler.dll__XL_SetReportShowMode_4]
push 1
call dword [sym.imp.XLBugHandler.dll__XL_SetAlwaysSendReport_4]
mov ecx, esi
call fcn.0040cf00
test eax, eax
je 0x40f72c
lea ecx, [esp + 8]
call fcn.00404ec7
mov eax, 0x80004005
jmp 0x40f787
mov ecx, esi
call fcn.0040ca20
push 0x40ca50
call dword [sym.imp.XLLuaRuntime.dll_XLLRT_ErrorHandle]
push 0x3e
mov ecx, esi
call fcn.0040ede0
mov ecx, esi
call fcn.0040cf60
cmp dword [esi + 0xcc], 8
jb 0x40f75f
mov eax, dword [esi + 0xb8]
jmp 0x40f765
lea eax, [esi + 0xb8]
push 0x44f664
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40f7ae
mov ecx, esi
call fcn.0040e1d0
lea ecx, [esp + 8]
call fcn.00404ec7
xor eax, eax
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.004310bf
add esp, 0x43c
ret 4
push 0x44fbf0
call fcn.00418810
mov ecx, eax
call fcn.00418860
mov esi, eax
test esi, esi
je 0x40f77c
lea ecx, [esp + 8]
call fcn.00404ec7
mov eax, esi
jmp 0x40f787

Function at 0x40f7e0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
ret
Function at 0x410e90
Capabilities:
Check mutex on windows

Disassembly:
push str.GlobalSoftwareCenter
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x410eb6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410eb6
mov eax, 1
ret
xor eax, eax
ret