joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412eda
Capabilities:
Terminate process

Disassembly:
call fcn.004b1000
jmp 0x412eda
push 0x58
push 0x419330
call fcn.004138c8
xor ebx, ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x41e22c
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x412f2c
cmp eax, esi
jne 0x412f1f
xor esi, esi
inc esi
mov edi, esi
jmp 0x412f2f
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412f03
xor esi, esi
inc esi
cmp dword [0x41e230], esi
jne 0x412f41
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x412f7b
cmp dword [0x41e230], ebx
jne 0x412f75
mov dword [0x41e230], esi
push 0x401024
push 0x401018
call fcn.004130b9
pop ecx
pop ecx
test eax, eax
je 0x412f7b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4130a9
mov dword [0x41decc], esi
cmp dword [0x41e230], esi
jne 0x412f9e
push 0x401014
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x41e230], 2
test edi, edi
jne 0x412fab
xor eax, eax
mov ecx, 0x41e22c
xchg dword [ecx], eax
cmp dword [0x41e23c], 0
je 0x412fd7
push 0x41e23c
call fcn.00413720
pop ecx
test eax, eax
je 0x412fd7
push ebx
push 2
push ebx
mov esi, dword [0x41e23c]
mov ecx, esi
call dword [0x41f2f0]
call esi
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x413035
test cl, cl
je 0x413004
test edi, edi
jne 0x413035
test cl, cl
je 0x413004
cmp cl, 0x20
ja 0x413004
inc esi
mov dword [ebp - 0x1c], esi
mov cl, byte [esi]
jmp 0x412ff3
test byte [ebp - 0x3c], 1
je 0x413010
movzx eax, word [ebp - 0x38]
jmp 0x413013
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x41dec8], eax
cmp dword [0x41dee0], 0
jne 0x41308e
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x413046
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x413059
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x412fe4
cmp dword [0x41decc], 0
jne 0x4130a2
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x41dec8]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x413604
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x419370
call fcn.004138c8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x413664
cmp eax, 0xffffffff
je 0x413664
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x41365d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x41365d
cmp edx, 0x10000000
jae 0x41365d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x41365a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4136d0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x41370e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x413706
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x413710
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4136f6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4137e0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x413811
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x413811
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x413811
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x413cd9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x413d00
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x413d45
mov ecx, dword [ebp - 4]
jmp 0x413d06
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test esi, esi
je 0x413d33
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x413d45
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x1c]
jne 0x413d45
xor eax, eax
inc eax
jmp 0x413d47
xor eax, eax
pop esi
leave
ret 0x18

Function at 0x413d4c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x413d71
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x413da1
mov eax, dword [ebp - 4]
jmp 0x413d77
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 0
push dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x413d9c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
je 0x413da5
xor eax, eax
jmp 0x413da8
xor eax, eax
inc eax
pop esi
leave
ret 0x18
Function at 0x401120
Capabilities:
Create tcp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x419014]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x40118e
mov eax, dword [esp]
cmp al, 2
jne 0x401188
shr eax, 8
cmp al, 2
jne 0x401188
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x419630], eax
cmp eax, 0xffffffff
je 0x40118e
mov eax, 1
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
xor eax, eax
xor ecx, esp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret

Function at 0x4011b0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419014]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 2
mov esi, ecx
push edx
mov word [ebp - 0x24], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
mov eax, esi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011e0
push 0
push 0
push 0xf
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
sar eax, 1
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
pop esi
cmp eax, 0x10
jae 0x401247
mov byte [ebp + eax - 0x14], 0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push 0x10
push eax
push dword [0x419630]
call dword [sym.imp.WS2_32.dll_connect]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret
call fcn.0040d8b0
int3
Function at 0x4024d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40eb3e
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x419014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], edi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x21c]
push 0x4110dc
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push 0x4110dc
lea ecx, [esi + 0x80]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
test eax, eax
je 0x40258e
push dword [esi + 0x80]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x4110dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push 0x410e3c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
add esp, 0xc
lea eax, [ebp - 0x21c]
mov ecx, edi
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404d40
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f244
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x419014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x4110dc
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push 0x4110dc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push str._s.
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
add esp, 0xc
mov dword [ebp - 0x1c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
movq qword [ebp - 0x24], xmm0
call dword [sym.imp.mfc140u.dll_CFileFind::CFileFind]
push 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x34]
push dword [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_CFileFind::FindFile]
test eax, eax
setne cl
mov byte [ebp - 0x35], cl
test eax, eax
je 0x404eb5
test cl, cl
je 0x404e57
mov esi, dword [sym.imp.mfc140u.dll_CFileFind::GetFilePath]
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_CFileFind::FindNextFileW]
test eax, eax
lea ecx, [ebp - 0x34]
setne byte [ebp - 0x35]
call dword [sym.imp.mfc140u.dll_CFileFind::IsDots]
test eax, eax
jne 0x404e51
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x34]
push 0x10
mov eax, dword [eax + 0x40]
call eax
test eax, eax
je 0x404e31
push ecx
push esp
lea ecx, [ebp - 0x34]
call esi
mov ecx, edi
call fcn.00404d40
jmp 0x404e51
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
lea ecx, [ebp - 0x3c]
setne byte [ebp - 0x35]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
cmp byte [ebp - 0x35], 0
jne 0x404df4
lea ecx, [ebp - 0x34]
call dword [sym.imp.mfc140u.dll_CFileFind::Close]
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne byte [ebp - 0x35]
test eax, eax
jne 0x404eb5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
movzx eax, byte [edi + 0x480]
push str.DeleteDirectoryFile___remove_directory_failure____d_._r_n
push eax
call fcn.00407340
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jg 0x404eb5
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne byte [ebp - 0x35]
test eax, eax
je 0x404e75
lea ecx, [ebp - 0x34]
call dword [0x410530]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov al, byte [ebp - 0x35]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret 4
Function at 0x406270
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f607
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x419014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], esi
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 2
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x21c]
push 0x4110dc
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push 0x4110dc
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__8]
test eax, eax
je 0x406325
push dword [ebp + 0xc]
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x4110dc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push 0x410e3c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
add esp, 0xc
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f63c
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x419014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
push 0x4110dc
mov dword [ebp - 0x220], esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x220], 1
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x224], 0x208
lea eax, [ebp - 0x228]
push eax
push 0x20119
push 0
push 0x412d48
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406477
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
push 0
push str.ComputerName
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40646b
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push 0x410e3c
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
add esp, 0xc
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__1]
push eax
mov ecx, esi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__11]
lea ecx, [ebp - 0x21c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret 4
Function at 0x406fd0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x416d40
push 0x40dc38
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x419014]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x444], ecx
push 0x413680
push 0
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
push 0x208
push 0
lea eax, [ebp - 0x228]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x14
push str.C:ProgramData_scEscpplog
push 0x104
lea eax, [ebp - 0x228]
push eax
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
call edi
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40706c
push eax
lea eax, [ebp - 0x228]
push eax
call esi
push 0x208
push 0
lea eax, [ebp - 0x430]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x43a]
push eax
movzx eax, word [ebp - 0x43e]
push eax
movzx eax, word [ebp - 0x440]
push eax
push str._04d__02d__02d
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.00406ef0
push 0x413424
push 0x104
lea eax, [ebp - 0x228]
push eax
call edi
add esp, 0x24
lea eax, [ebp - 0x430]
push eax
push 0x104
lea eax, [ebp - 0x228]
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x407106
push eax
lea eax, [ebp - 0x228]
push eax
call esi
push str._scEscppPrintChaser.log
push 0x104
lea eax, [ebp - 0x228]
push eax
call edi
add esp, 0xc
mov dword [ebp - 4], 0
push 0x41370c
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 8
mov esi, eax
test esi, esi
je 0x40715c
push dword [ebp - 0x444]
push 0x410e3c
push esi
call fcn.00406f40
add esp, 0xc
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov dword [ebp - 4], 0xfffffffe
call fcn.00407184
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret
Function at 0x407190
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x416d60
push 0x40dc38
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x419014]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x440], ecx
push 0x413680
push 0
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
push 0x208
push 0
lea eax, [ebp - 0x224]
push eax
call sub.VCRUNTIME140.dll_memset
push str.C:ProgramData_scEscpplog
push 0x104
lea eax, [ebp - 0x224]
push eax
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
call edi
add esp, 0x20
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407229
push eax
lea eax, [ebp - 0x224]
push eax
call esi
push 0x208
push 0
lea eax, [ebp - 0x42c]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x436]
push eax
movzx eax, word [ebp - 0x43a]
push eax
movzx eax, word [ebp - 0x43c]
push eax
push str._04d__02d__02d
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.00406ef0
push 0x413424
push 0x104
lea eax, [ebp - 0x224]
push eax
call edi
lea eax, [ebp - 0x42c]
push eax
push 0x104
lea eax, [ebp - 0x224]
push eax
call edi
add esp, 0x30
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4072c0
push eax
lea eax, [ebp - 0x224]
push eax
call esi
push str._scEscppPrintChaserSSO.log
push 0x104
lea eax, [ebp - 0x224]
push eax
call edi
add esp, 0xc
mov dword [ebp - 4], 0
push 0x41370c
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 8
mov esi, eax
test esi, esi
je 0x407313
push dword [ebp - 0x440]
push 0x410e3c
push esi
call fcn.00406f40
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x10
mov dword [ebp - 4], 0xfffffffe
call fcn.0040733b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret
Function at 0x407340
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40f7c1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x419014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 1
jne 0x40744e
push 0x4110dc
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__9]
lea eax, [ebp + 0x10]
mov dword [ebp - 4], 0
push eax
push ecx
push dword [ebp + 0xc]
xor edx, edx
xor ecx, ecx
call fcn.00406f60
add esp, 8
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
lea esi, [eax + 1]
push esi
call fcn.00407600
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 1
push eax
push ecx
push dword [ebp + 0xc]
mov edx, esi
mov esi, dword [ebp - 0x20]
mov ecx, esi
call fcn.00406f60
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x24]
push esi
push eax
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push str.__02d:_02d:_02d___s
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__7]
add esp, 0x18
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0x14]
call fcn.00406fd0
test esi, esi
je 0x407445
mov ecx, dword [ebp - 0x18]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffe
cmp ecx, 0x1000
jb 0x40743b
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40743b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.0040d98a
add esp, 8
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d77e
mov esp, ebp
pop ebp
ret