joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4311d8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x43e0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [edi + 0x15c]
mov eax, edi
call fcn.004069a0
mov esi, eax
cmp esi, 0xffffffff
je 0x406943
mov ebx, dword [edi + 0x160]
mov eax, edi
call fcn.004069a0
cmp eax, 0xffffffff
je 0x406943
xor ebx, ebx
mov dword [ebp - 0x40], ebx
cmp dword [edi + 0x154], ebx
jbe 0x406947
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], esi
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x406943
mov ecx, dword [ebp - 0x34]
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push ecx
push eax
call esi
xor edx, edx
cmp eax, 0xffffffff
setne dl
cmp edx, ebx
je 0x406943
mov edx, dword [edi]
push ebx
lea eax, [ebp - 0x30]
push eax
push 4
lea ecx, [ebp - 0x3c]
push ecx
push edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], 4
jne 0x406943
mov ebx, dword [ebp - 0x3c]
mov eax, edi
call fcn.004069a0
cmp eax, 0xffffffff
je 0x40691d
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
mov edx, edi
call fcn.004065f0
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x4068b5
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0x10
jb 0x40691d
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0041e95a
add esp, 4
jmp 0x40691d
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x40693b
mov ecx, dword [ebp - 0x38]
push ebx
push ebx
push ecx
push eax
call esi
xor edx, edx
cmp eax, 0xffffffff
setne dl
cmp edx, ebx
je 0x40693b
mov edx, dword [edi]
push ebx
lea eax, [ebp - 0x30]
push eax
push 2
lea ecx, [ebp - 0x44]
push ecx
push edx
mov dword [ebp - 0x44], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], 2
jne 0x40693b
cmp dword [ebp - 0x18], 0x10
mov ebx, dword [ebp - 0x2c]
jae 0x4068fa
lea ebx, [ebp - 0x2c]
mov ax, word [edi + 0x14c]
add ax, word [ebp - 0x44]
movzx ecx, ax
push ecx
call fcn.00406580
lea esi, [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00406550
mov eax, dword [ebp - 0x40]
add dword [ebp - 0x34], 4
add dword [ebp - 0x38], 2
inc eax
mov dword [ebp - 0x40], eax
cmp eax, dword [edi + 0x154]
jae 0x406947
xor ebx, ebx
jmp 0x406822
lea esi, [ebp - 0x2c]
call fcn.00406550
xor eax, eax
jmp 0x40694c
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e965
mov esp, ebp
pop ebp
ret
Function at 0x407660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
sub esp, 8
cmp esi, eax
je 0x4076c5
cmp dword [ebp + 8], eax
je 0x4076c5
cmp edi, eax
je 0x4076c5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x40
push edi
push esi
mov dword [0x4414d8], 1
call ebx
test eax, eax
je 0x4076be
mov ecx, dword [ebp + 8]
push edi
push ecx
push esi
call fcn.004217f0
mov eax, dword [ebp - 4]
add esp, 0xc
lea edx, [ebp - 8]
push edx
push eax
push edi
push esi
call ebx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4076d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
sub ebx, ecx
push esi
mov dword [ebp - 4], ebx
push edi
mov ebx, 1
or edx, 0xffffffff
xor edi, edi
xor esi, esi
sub ebx, ecx
mov eax, ecx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 4]
mov bl, byte [ebx + eax]
cmp bl, byte [eax]
je 0x40770a
cmp edx, 0xffffffff
jne 0x407705
mov edx, esi
mov edi, dword [ebp - 8]
add edi, eax
inc esi
inc eax
cmp esi, 7
jb 0x4076f4
xor eax, eax
cmp edi, eax
je 0x407771
lea ebx, [edx + ecx]
mov ecx, dword [ebp + 8]
lea esi, [edx + ecx]
cmp esi, eax
je 0x407773
cmp ebx, eax
je 0x407773
lea edx, [ebp - 4]
push edx
push 0x40
push edi
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [0x4414d8], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x407771
push edi
push ebx
push esi
call fcn.004217f0
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407a10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 8], 0
jle 0x407a8b
mov edi, edx
sub ecx, esi
lea eax, [edx + edx]
neg edi
sub ecx, edx
mov dword [ebp - 0x10], eax
add edi, edi
lea eax, [esi + edx]
dec ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
movzx ebx, byte [eax]
xor esi, esi
test ebx, ebx
jle 0x407a65
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
cmp byte [eax + ecx], dl
je 0x407a5f
cmp dl, 0xcc
jne 0x407a71
inc esi
inc ecx
cmp esi, ebx
jl 0x407a50
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
add dword [ebp - 4], edi
add ecx, 2
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp + 8]
jl 0x407a42
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407df0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x43e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
push 0x2a
push ecx
lea eax, [ebp - 0x5f]
push eax
mov dword [ebp - 0xc8], 0x55ff8b27
mov dword [ebp - 0xc4], 0x6aec8b
mov dword [ebp - 0xc0], 0xff2c75ff
mov dword [ebp - 0xbc], 0x75ff2875
mov dword [ebp - 0xb8], 0x2075ff24
mov dword [ebp - 0xb4], 0xff1c75ff
mov dword [ebp - 0xb0], 0x75ff1875
mov dword [ebp - 0xac], 0x1075ff14
mov dword [ebp - 0xa8], 0xff0c75ff
mov dword [ebp - 0xa4], 0x6a0875
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], 0xcce93000
mov dword [ebp - 0x94], 0x6acccccc
mov dword [ebp - 0x90], 0x2c75ff00
mov dword [ebp - 0x8c], 0xff2875ff
mov dword [ebp - 0x88], 0x75ff2475
mov dword [ebp - 0x84], 0x1c75ff20
mov dword [ebp - 0x80], 0xff1875ff
mov dword [ebp - 0x7c], 0x75ff1475
mov dword [ebp - 0x78], 0xc75ff10
mov dword [ebp - 0x74], 0x6a0875ff
mov dword [ebp - 0x70], 0xcccce800
mov dword [ebp - 0x6c], 0xc25dcccc
mov dword [ebp - 0x68], 0x8b060028
mov dword [ebp - 0x64], 0xec8b55ff
mov byte [ebp - 0x60], 0x5d
call fcn.00420a30
xor eax, eax
push 0x30
push eax
lea ecx, [ebp - 0xf8]
push ecx
mov dword [ebp - 0x35], 0xcccce90d
mov dword [ebp - 0x31], 0xff5dcccc
mov dword [ebp - 0x2d], 0xcccccc25
mov word [ebp - 0x29], 0x90cc
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
call fcn.00420a30
add esp, 0x18
push 0x438924
lea eax, [edi + 0x428]
call fcn.00406a00
cmp eax, 0xffffffff
je 0x407f99
mov ecx, dword [edi + 0x428]
cmp ecx, 0xffffffff
je 0x407f99
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
test eax, eax
je 0x407f99
mov esi, 0x30
lea edx, [ebp - 0xf8]
lea eax, [edi + 0x428]
call fcn.00406ac0
lea eax, [ebp - 0xc8]
lea ebx, [ebp - 0xf8]
lea ecx, [ebp - 0xc7]
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], eax
sub ebx, ecx
lea ecx, [ecx]
movzx esi, byte [eax]
xor edx, edx
test esi, esi
jle 0x407fe2
inc eax
lea ebx, [ebx]
mov cl, byte [eax]
cmp byte [ebx + eax], cl
je 0x407fdc
cmp cl, 0xcc
jne 0x408008
inc edx
inc eax
cmp edx, esi
jl 0x407fd0
push 0x31
push 4
push 0x438924
lea edx, [ebp - 0xc8]
mov ecx, edi
call fcn.00407aa0
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e965
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0xfc]
inc ecx
add eax, 0x62
sub ebx, 0x62
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], eax
cmp ecx, 2
jb 0x407fc0
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0041e965
mov esp, ebp
pop ebp
ret
Function at 0x4080d0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [eax + 0x414]
push esi
test eax, eax
je 0x4080fc
push str.CreateProcessInternalW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x408105
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
sub esi, eax
mov dword [ebp - 8], 0
lea ebx, [eax + 7]
sub esi, 8
push edi
lea esp, [esp]
movzx edi, byte [ebx]
cmp edi, 7
jge 0x40824d
xor edx, edx
test edi, edi
jle 0x40814b
lea eax, [ebx + 1]
mov cl, byte [eax]
cmp byte [esi + eax], cl
je 0x408145
cmp cl, 0xcc
jne 0x40824d
inc edx
inc eax
cmp edx, edi
jl 0x408135
mov eax, dword [ebp - 0xc]
push eax
call fcn.00407910
mov ecx, dword [ebp - 4]
test dword [ecx + 0x5ac], eax
je 0x4082ab
push 7
call fcn.0041e974
mov ebx, eax
add esp, 4
xor eax, eax
test ebx, ebx
je 0x4082ad
mov edi, dword [ebp - 4]
mov dword [ebx], eax
mov word [ebx + 4], ax
mov byte [ebx + 6], al
push str.CreateProcessInternalW
lea eax, [edi + 0x428]
call fcn.00406a00
cmp eax, 0xffffffff
je 0x40828a
mov ecx, dword [edi + 0x428]
cmp ecx, 0xffffffff
je 0x40828a
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor edx, edx
cmp eax, 0xffffffff
setne dl
mov eax, edx
test eax, eax
je 0x40828a
mov esi, 7
mov edx, ebx
lea eax, [edi + 0x428]
call fcn.00406ac0
test eax, eax
je 0x40828a
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], eax
dec ecx
movzx edi, byte [eax]
cmp edi, 7
jge 0x408271
xor esi, esi
test edi, edi
jle 0x408218
inc eax
mov dl, byte [eax]
cmp byte [ecx + eax], dl
je 0x408212
cmp dl, 0xcc
jne 0x40826e
inc esi
inc eax
cmp esi, edi
jl 0x408206
mov eax, dword [ebp - 0xc]
push eax
mov ecx, ebx
call fcn.004076d0
push ebx
mov esi, eax
call fcn.0041ea08
add esp, 8
test esi, esi
je 0x40829e
push 0x8004dcb
call fcn.0040b120
add esp, 4
pop edi
pop ebx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
inc eax
add ebx, 0xe
sub esi, 0xe
mov dword [ebp - 8], eax
cmp eax, 2
jl 0x408120
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
inc edx
add eax, 0xe
sub ecx, 0xe
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
cmp edx, 2
jl 0x4081f7
push ebx
call fcn.0041ea08
add esp, 4
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x8004dcc
call fcn.0040b120
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x408360
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431870
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x43e0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408435
mov ecx, dword [ebp + 8]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408435
mov eax, dword [0x43e060]
mov edx, dword [eax + 0xc]
mov ecx, 0x43e060
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 1
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0xa
div ecx
lea edi, [ebp - 0x10]
push edx
push esi
push str._s._d
call fcn.00405780
mov esi, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
add esp, 0xc
push 1
push esi
push edx
call edi
test eax, eax
je 0x408415
push 4
push 0
push esi
call edi
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408435
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40845b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408470
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4323e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
mov eax, dword [0x43e0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.0040c7b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.00405330
add eax, 0x10
mov dword [esi], eax
call fcn.00408360
lea eax, [ebp - 0x18]
add esp, 4
push eax
call fcn.0040cba0
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [eax]
mov esi, dword [ebp - 0x10]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x408528
cmp dword [esi + 0xc], 0
lea ebx, [esi + 0xc]
jl 0x40851b
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40851b
call fcn.00405330
mov dword [ebp - 0x14], eax
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x408510
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
mov dword [ebp - 0x10], ecx
jmp 0x408528
mov ebx, dword [ecx - 0xc]
push ecx
lea edx, [ebp - 0x10]
push edx
call fcn.00405280
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40854b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.00405330
add eax, 0x10
mov dword [esi], eax
call fcn.00408360
add esp, 4
call fcn.0040c930
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, str.SpesmarlHjcrpkpesNjzupwkTbqrlzsPlrkjpzExnfpqeq
mov byte [ebp - 4], 2
call fcn.0040dcd0
mov eax, dword [eax]
add esp, 4
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x80000001
call fcn.00405a90
test eax, eax
mov eax, dword [ebp - 0x18]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4085cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x24]
test bl, bl
je 0x40860d
lea ecx, [ebp - 0x18]
push ecx
mov ecx, str.SalffSthslKx
call fcn.0040dcd0
mov eax, dword [eax]
add esp, 4
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40860d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x408618
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40863e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408980
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x432908
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x43e0b0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.00408470
lea eax, [esp + 0x10]
push eax
call fcn.0040a310
add esp, 4
mov dword [esp + 0x28], 0
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 0xc]
test eax, eax
je 0x4089ee
call fcn.00409b00
test eax, eax
je 0x4089ee
mov edx, dword [esp + 0x10]
push 3
push 0
push 0x65
xor ecx, ecx
call fcn.00409780
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call fcn.0040a970
add esp, 4
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], 0
je 0x408a32
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408a32
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x408a32
push 4
push eax
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x18]
call fcn.0040a0f0
mov byte [esp + 0x28], 2
mov ecx, dword [eax]
mov esi, dword [esp + 0x10]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
je 0x408a93
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x408a85
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x408a85
call fcn.00405330
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x408a7c
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [esp + 0x10], ebx
jmp 0x408a93
mov ebx, dword [ecx - 0xc]
push ecx
lea ecx, [esp + 0x14]
push ecx
call fcn.00405280
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x408ab8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x10]
cmp dword [esi - 0xc], 0
je 0x408adf
call fcn.00409b00
test eax, eax
je 0x408adf
mov edx, dword [esp + 0x10]
push 3
push 0
push 0x65
xor ecx, ecx
call fcn.00409780
add esp, 0xc
call fcn.004086c0
mov byte [esp + 0x28], 0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408b31
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409010
Capabilities:
Terminate thread

Disassembly:
push ebx
push edi
xor edi, edi
cmp dword [esi + 0x218], edi
je 0x409034
push 1
push edi
push 0x65
lea edx, [esi + 4]
xor ecx, ecx
mov dword [esi + 0x218], edi
call fcn.00409780
add esp, 0xc
mov eax, dword [esi + 0x210]
cmp eax, edi
je 0x409052
cmp dword [esi + 0x214], edi
jbe 0x409052
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0x20c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x409070
push eax
call ebx
mov dword [esi + 0x20c], 0xffffffff
mov eax, dword [esi + 0x210]
cmp eax, edi
je 0x409090
cmp dword [esi + 0x214], edi
jbe 0x409090
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x218], edi
mov eax, dword [esi + 0x210]
cmp eax, edi
je 0x4090a3
push eax
call ebx
mov dword [esi + 0x210], edi
mov dword [esi + 0x214], edi
pop edi
pop ebx
ret
Function at 0x4090b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43182b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x43e0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [0x43e060]
mov eax, dword [edx + 0xc]
mov ecx, 0x43e060
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 4], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
mov ebx, 0x104
sub eax, ebx
or eax, ecx
jge 0x409133
mov eax, ebx
lea ecx, [ebp - 0x22c]
call fcn.004055c0
mov esi, dword [ebp - 0x22c]
cmp dword [esi - 8], ebx
jge 0x409142
push 0x80070057
call fcn.00401540
xor ecx, ecx
push esi
push ecx
push ecx
push 0x1a
mov dword [esi - 0xc], ebx
push ecx
mov word [esi + 0x208], cx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0041f064
add esp, 8
test eax, eax
js 0x409138
cmp eax, dword [esi - 8]
jg 0x409138
push 0x1b
xor edx, edx
mov dword [esi - 0xc], eax
push str.TencentLogslasterror.log
lea ebx, [ebp - 0x22c]
mov word [esi + eax*2], dx
call fcn.00405500
mov ebx, dword [ebp - 0x22c]
push 0x438aec
push ebx
call fcn.0041fb06
mov esi, eax
add esp, 8
test esi, esi
je 0x409214
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x21e]
push edi
push eax
movzx eax, word [ebp - 0x21a]
push eax
movzx eax, word [ebp - 0x220]
push ecx
movzx ecx, word [ebp - 0x222]
push edx
movzx edx, word [ebp - 0x226]
push eax
movzx eax, word [ebp - 0x228]
push ecx
push edx
push eax
push 0x438af0
push esi
call fcn.0041f97c
push esi
call fcn.0041fbb4
add esp, 0x30
lea eax, [ebx - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409237
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e965
mov esp, ebp
pop ebp
ret

Function at 0x4096e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x218], 0
je 0x4096f6
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 8]
push eax
push 0x438aac
lea ecx, [esi + 4]
push 0x104
push ecx
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov edx, dword [ebp + 0xc]
add esp, 0x10
cmp dword [esi + 0x218], 0
mov dword [esi + 0x220], edx
je 0x40972d
mov eax, 1
pop esi
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi + 0x224], eax
lea eax, [esi + 0x214]
push eax
push 0
push esi
push 0x409300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esi + 0x210], eax
pop esi
mov eax, ecx
pop ebp
ret 8