joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408f00
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x40a53e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
xor ebx, ebx
mov dword [esp + 0x24], ebx
call sub.MFC42.DLL_CString::CString_2
lea edi, [esi + 4]
mov byte [esp + 0x24], 1
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ebp, [esi + 8]
mov byte [esp + 0x24], 2
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::CString_2
push 0x40eb00
mov ecx, esi
mov byte [esp + 0x28], 4
call fcn.0040963e
push 0x40eb00
mov ecx, ebp
call fcn.0040963e
push 0x40eb00
mov ecx, edi
call fcn.0040963e
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebx, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [esp + 0x14], eax
mov ebp, 1
mov edi, 0x41
mov eax, dword [esp + 0x14]
test eax, ebp
je 0x408fe5
push edi
lea ecx, [esp + 0x14]
push str._c:_
push ecx
call sub.MFC42.DLL_CString::Format
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebx
push eax
push edi
push edi
lea eax, [esp + 0x1c]
push str.::0:_c:_c:_u_n
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.0040966e
inc dword [esi + 0xc]
shl ebp, 1
inc edi
cmp edi, 0x5a
jle 0x408f9f
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004096a4
mov ecx, esi
call fcn.00409040
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 4
Function at 0x409580
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov eax, dword [esp + 0x18]
push 0
test eax, eax
je 0x4095e9
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret 4
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret 4
Function at 0x402c3c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x402c4e
call fcn.004179c4
mov eax, dword [0x41b40f]
shl eax, 2
mov dword [0x41b413], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
mov dword [0x41b417], edx
call fcn.004101e0
pop edx
call fcn.0040e054
call fcn.004101e4
push 0x41b3b8
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x41b417], eax
push 0
jmp 0x418eec
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, dword [esp + 0x6c]
mov eax, dword [esi + 0x10]
and eax, 1
mov dword [0x420620], eax
call fcn.00415028
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.004154f4
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call fcn.00411458
mov eax, dword [esi + 0x44]
mov dword [esp], eax
call fcn.00411468
mov dword [0x428888], 1
mov dword [0x42888c], esi
lea eax, [esp + 0x10]
mov dword [0x428854], eax
call fcn.004197f8
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x428858], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x428860], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00417e7c
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
mov edi, dword [esi + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00417ecc
mov dword [esp + 4], 0
mov dword [esp], 0x428888
call fcn.00418d34
test byte [esi + 0x10], 1
je 0x418fd7
mov eax, dword [0x428860]
nop word cs:[eax + eax]
inc eax
mov cl, byte [eax - 1]
cmp cl, 9
je 0x418fbc
cmp cl, 0x22
je 0x418ffb
cmp cl, 0x20
je 0x418fbc
dec eax
mov edx, 0x20
jmp 0x419010
mov eax, dword [0x42886c]
mov ecx, dword [0x428870]
mov edx, dword [0x428874]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [esi + 0x18]
jmp 0x419093
mov cl, byte [eax]
mov edx, 0x22
jmp 0x419010
mov cl, byte [eax + 1]
inc eax
xor ch, ch
test cl, cl
je 0x419024
cmp cl, 9
je 0x419022
movsx edi, cl
cmp edi, edx
jne 0x41900c
mov ch, cl
lea edi, [eax + 1]
cmp ch, 0x22
cmovne edi, eax
jmp 0x41903d
inc edi
mov al, byte [edi]
cmp al, 9
je 0x41903c
cmp al, 0x20
je 0x41903c
mov ebx, dword [esi + 0x18]
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
mov eax, 0xa
test byte [esp + 0x44], 1
je 0x41907b
movzx eax, word [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], 0
call ebx
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.00417c98
add esp, 0x5c
pop esi
pop edi
pop ebx
ret
Function at 0x40556c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, 0x2038
call fcn.0040e058
sub esp, 0x2038
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405595
jmp 0x4056bc
cmp dword [0x420db8], 0
jne 0x4055a6
call fcn.004056cc
mov eax, esp
mov dword [eax], 0xfffffff5
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [0x420db8]
mov ecx, eax
add ecx, 0xfffffffe
sub ecx, 2
mov dword [ebp - 0x2018], eax
mov dword [ebp - 0x201c], ecx
jb 0x405677
jmp 0x4055da
mov eax, dword [ebp - 0x2018]
sub eax, 1
mov dword [ebp - 0x2020], eax
jne 0x4056bc
jmp 0x4055f1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00410658
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2014], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x2014]
mov esi, esp
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi + 0x14], 0x1000
mov dword [esi + 4], 0
mov dword [esi], 0
call sub.KERNEL32.DLL_MultiByteToWideChar
sub esp, 0x18
lea ecx, [ebp - 0x2010]
mov dword [ebp - 0x2014], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x2014]
lea esi, [ebp - 0x2014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteConsoleW
sub esp, 0x14
mov dword [ebp - 0x2024], eax
jmp 0x4056bc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.00410658
mov dword [ebp - 0x2014], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x2014]
lea esi, [ebp - 0x2014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [ebp - 0x2028], eax
add esp, 0x2038
pop esi
pop edi
pop ebp
ret

Function at 0x4056cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, esp
mov dword [eax], 0xfffffff5
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov dword [ebp - 4], eax
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_GetFileType
sub esp, 4
mov dword [ebp - 0xc], eax
mov ecx, eax
sub eax, 3
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
je 0x40578e
jmp 0x405707
mov eax, dword [ebp - 0x10]
sub eax, 2
mov dword [ebp - 0x18], eax
je 0x40575a
jmp 0x405714
mov eax, dword [ebp - 0x10]
sub eax, 1
mov dword [ebp - 0x1c], eax
jne 0x405790
jmp 0x405721
mov dword [0x420db8], 3
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
mov edx, esp
mov dword [edx + 0xc], ecx
mov dword [edx], eax
mov dword [edx + 0x10], 0
mov dword [edx + 8], 3
mov dword [edx + 4], 0x41b8d0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [ebp - 0x20], eax
jmp 0x40579a
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_GetConsoleMode
sub esp, 8
cmp eax, 0
je 0x405782
mov dword [0x420db8], 1
jmp 0x40578c
mov dword [0x420db8], 2
jmp 0x40579a
jmp 0x405790
mov dword [0x420db8], 2
add esp, 0x34
pop ebp
ret
Function at 0x4057ac
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov eax, 0x104c
call fcn.0040e058
sub esp, 0x104c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4057d5
jmp 0x405992
cmp dword [0x420db8], 0
jne 0x4057e6
call fcn.004056cc
mov eax, esp
mov dword [eax], 0xfffffff5
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [0x420db8]
mov ecx, eax
sub ecx, 3
mov dword [ebp - 0x1018], eax
mov dword [ebp - 0x101c], ecx
je 0x40591f
jmp 0x405817
mov eax, dword [ebp - 0x1018]
sub eax, 2
mov dword [ebp - 0x1020], eax
je 0x40588b
jmp 0x40582a
mov eax, dword [ebp - 0x1018]
sub eax, 1
mov dword [ebp - 0x1024], eax
jne 0x405992
jmp 0x405841
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004102cc
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1014]
lea esi, [ebp - 0x1014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteConsoleW
sub esp, 0x14
mov dword [ebp - 0x1028], eax
jmp 0x405992
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.004102cc
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1014]
mov esi, esp
mov dword [esi + 0x10], ecx
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0x1000
mov dword [esi + 4], 0
mov dword [esi], 0
call sub.KERNEL32.DLL_WideCharToMultiByte
sub esp, 0x20
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1014]
lea esi, [ebp - 0x1014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [ebp - 0x102c], eax
jmp 0x405992
mov eax, 0x1000
lea ecx, [ebp - 0x1010]
mov edx, dword [ebp - 0xc]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], 0x1000
mov dword [ebp - 0x1030], eax
call fcn.0040755c
lea eax, [ebp - 0x1010]
mov dword [esp], eax
call fcn.00410658
lea ecx, [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1014]
lea esi, [ebp - 0x1014]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov dword [edi + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [ebp - 0x1034], eax
add esp, 0x104c
pop esi
pop edi
pop ebp
ret
Function at 0x406bc8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x260]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0041060c
lea ecx, [0x41b8d8]
lea edx, [ebp - 0x260]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x268], eax
call fcn.00405e38
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, esp
mov dword [esi + 8], ecx
mov dword [esi], edx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 1
mov dword [esi + 4], 0
mov dword [ebp - 0x26c], eax
call sub.KERNEL32.DLL_FindFirstFileExA
sub esp, 0x18
mov ecx, 0xffffffff
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], ecx
jne 0x406c7a
mov dword [ebp - 0xc], 0
jmp 0x406dfb
mov dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x15c]
and eax, 0x10
cmp eax, 0
je 0x406db1
lea eax, [0x41b8da]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004105bc
cmp eax, 0
je 0x406daf
lea eax, [0x41b8dc]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.004105bc
cmp eax, 0
je 0x406daf
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0041060c
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
add ecx, 0x2c
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x270], eax
call fcn.00405e38
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [ebp - 0x274], eax
call esi
cmp eax, 0
jne 0x406d56
jmp 0x406dda
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x14], 0
je 0x406dad
mov eax, 1
lea ecx, [ebp - 0x260]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [ebp - 0x278], eax
call fcn.00406bc8
mov ecx, dword [ebp - 0x264]
add ecx, eax
mov dword [ebp - 0x264], ecx
jmp 0x406daf
jmp 0x406db1
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_FindNextFileA
sub esp, 8
cmp eax, 0
jne 0x406dd5
jmp 0x406dda
jmp 0x406c84
mov eax, dword [ebp - 0x160]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_FindClose
sub esp, 4
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0xc]
add esp, 0x28c
pop esi
pop edi
pop ebp
ret
Function at 0x406e08
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x100
mov dword [eax], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x12c], eax
call fcn.00406278
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x120]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.VERSION.DLL_GetFileVersionInfoSizeA
sub esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
ja 0x406e8e
mov dword [ebp - 0x10], 0
jmp 0x406fd0
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call fcn.0040ddfc
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [ebp - 0x18]
mov esi, esp
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi], ecx
mov dword [esi + 4], 0
call sub.VERSION.DLL_GetFileVersionInfoA
sub esp, 0x10
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x18]
lea esi, [ebp - 0x120]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], ecx
mov dword [edi], edx
mov dword [edi + 4], 0x41b8e0
mov dword [ebp - 0x130], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x406f33
cmp dword [ebp - 0x120], 4
jne 0x406f33
mov eax, dword [ebp - 0x11c]
movzx eax, word [eax]
shl eax, 0x10
mov ecx, dword [ebp - 0x11c]
movzx ecx, word [ecx + 2]
or eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x406f3d
mov dword [ebp - 0x124], 0x40904e4
lea eax, [0x41b8f9]
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x124]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00412850
lea ecx, [ebp - 0x11c]
lea edx, [ebp - 0x118]
mov esi, dword [ebp - 0x18]
lea edi, [ebp - 0x120]
mov ebx, esp
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [ebx], esi
mov dword [ebp - 0x134], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x406fbc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0041060c
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.0040de0c
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40ee6c
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x41ef46], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x41ef45], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x41ef44], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x41ef43], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x41ef42], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x41ef41], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x41ef40], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEF]
mov byte [0x41ef3f], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x40ef77
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x40ef79
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x40ef8c
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.0040f856
cmp dword [0x41e7dc], ecx
jne 0x40f091
mov ecx, fcn.0040fbda
cmp dword [0x41e7e0], ecx
jne 0x40f091
mov ecx, fcn.0040fdd2
cmp dword [0x41e7e4], ecx
jne 0x40f091
mov ecx, fcn.004100ec
cmp dword [0x41e7e8], ecx
jne 0x40f091
mov ecx, 0x40e18c
cmp dword [0x41e7ec], ecx
jne 0x40f091
xor eax, eax
mov ecx, 0x40e19c
cmp dword [0x41e7f0], ecx
jne 0x40f091
mov ecx, dword [0x422234]
test ecx, ecx
jne 0x40f091
call fcn.0040ee6c
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x40f091
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0x422234], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.0040f856
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret
Function at 0x410a8c
Capabilities:
Check if file exists

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x48]
test ah, 0xc0
je 0x410aa0
mov ebx, eax
jmp 0x410aaf
mov ecx, dword [0x41f510]
mov ebx, 0xc000
and ebx, dword [ecx]
or ebx, eax
mov edi, ebx
shr edi, 1
and edi, 0x4000
xor edi, 0x4000
or edi, ebx
mov eax, ebx
and eax, 0x700
cmp eax, 0x1ff
ja 0x410add
cmp eax, 0x100
jne 0x410b23
mov ebp, 4
jmp 0x410b28
cmp eax, 0x2ff
ja 0x410aed
cmp eax, 0x200
jne 0x410b23
jmp 0x410b15
cmp eax, 0x4ff
ja 0x410b02
cmp eax, 0x300
jne 0x410b23
mov ebp, 2
jmp 0x410b28
mov ebp, 1
cmp eax, 0x500
je 0x410b28
cmp eax, 0x600
jne 0x410b1c
mov ebp, 5
jmp 0x410b28
cmp eax, 0x700
je 0x410b28
mov ebp, 3
mov eax, ebx
and eax, 0x100
mov dword [esp + 0x1c], eax
je 0x410b60
lea eax, [esp + 0x4c]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
and eax, dword [0x41ef8c]
mov edx, 1
mov ecx, 0x80
test al, 0x80
cmove ecx, edx
jmp 0x410b77
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetFileAttributesA
sub esp, 4
xor ecx, ecx
cmp eax, 0xffffffff
cmovne ecx, eax
mov eax, 0x80000000
mov edx, ebx
and edx, 3
je 0x410b99
cmp edx, 2
jne 0x410b8f
mov eax, 0xc0000000
jmp 0x410b99
cmp edx, 1
jne 0x410bbf
mov eax, 0x40000000
mov edx, ebx
mov esi, edx
and ebx, 0x70
xor edx, edx
cmp ebx, 0x10
je 0x410bd5
cmp ebx, 0x30
jne 0x410bb3
mov edx, 2
jmp 0x410bd5
cmp ebx, 0x20
jne 0x410bd0
mov edx, 1
jmp 0x410bd5
mov dword [esp], 1
call fcn.00411fd8
jmp 0x410cab
mov edx, 3
mov ebx, esi
test bl, 4
je 0x410be7
cmp eax, 0x80000000
sete dl
movzx edx, dl
mov dword [esp + 0x24], 0xc
mov dword [esp + 0x28], 0
shr ebx, 7
and ebx, 1
xor ebx, 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x24]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
mov dword [esp + 0x18], 0
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
je 0x410c84
mov dword [esp], esi
call fcn.004109fc
mov dword [esp], esi
mov ecx, edi
or ecx, 0x2000
test eax, eax
cmove ecx, edi
and ecx, 0xfffff8ff
mov dword [esp + 4], ecx
call fcn.00411c18
cmp eax, 0xffffffff
jne 0x410cab
mov dword [esp], 4
call fcn.00411fd8
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov eax, 0xffffffff
jmp 0x410cab
call sub.KERNEL32.DLL_GetLastError
movzx eax, ax
cmp eax, 0x6e
jne 0x410ca3
mov ecx, 0x50
mov eax, 2
cmp dword [esp + 0x1c], 0
cmovne eax, ecx
mov dword [esp], eax
call fcn.00411fd8
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret