joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405720
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov ebx, eax
mov eax, dword [esp + 0x20]
mov esi, ecx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push ecx
push 0
push ebx
push edx
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x40584b
test ebx, ebx
je 0x4057f7
cmp word [ebx], 0
je 0x4057f7
cmp byte [esi + 0x128], 0
je 0x405789
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x405790
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov eax, ebp
call fcn.0040ba40
mov esi, eax
call fcn.0040bb90
mov eax, ebp
call fcn.0040ba40
push 0x4418d0
mov esi, eax
push 0x441f54
mov edx, esi
call fcn.0040c340
mov ecx, dword [esp + 0x28]
add ecx, 4
push ecx
push 0x441f54
mov edx, esi
call fcn.0040c340
push 0x441820
push 0x441f54
mov edx, esi
call fcn.0040c340
push ebx
push 0x441f54
mov edx, esi
call fcn.0040c340
add esp, 0x20
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
cmp byte [esi + 0x128], 0
lea ebx, [esi + 0x18]
jne 0x405806
mov ebx, dword [esi + 0x14]
mov eax, ebp
call fcn.0040ba40
mov esi, eax
call fcn.0040bb90
mov eax, ebp
call fcn.0040ba40
mov esi, eax
push 0x4418d0
push 0x441f54
mov edx, esi
call fcn.0040c340
add ebx, 4
push ebx
push 0x441f54
mov edx, esi
call fcn.0040c340
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
cmp edx, dword [esp + 0x24]
je 0x4058e5
test ebx, ebx
je 0x40589d
cmp word [ebx], 0
je 0x40589d
cmp byte [esi + 0x128], 0
je 0x405875
add esi, 0x18
mov dword [esp + 0x20], esi
jmp 0x40587c
mov eax, dword [esi + 0x14]
mov dword [esp + 0x20], eax
mov eax, ebp
call fcn.0040ba40
xor edi, edi
mov esi, eax
call fcn.0040bb90
mov eax, ebp
call fcn.0040ba40
push 0x4418e0
jmp 0x4057aa
cmp byte [esi + 0x128], 0
je 0x4058ab
add esi, 0x18
jmp 0x4058ae
mov esi, dword [esi + 0x14]
mov eax, ebp
call fcn.0040ba40
mov edi, eax
push 0x4418e0
push 0x441f54
mov edx, edi
call fcn.0040c340
add esi, 4
push esi
push 0x441f54
mov edx, edi
call fcn.0040c340
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov al, 1
pop ebx
pop ecx
ret 0x10
Function at 0x4069b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4364ab
mov eax, dword fs:[0]
push eax
sub esp, 0x330
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x32c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 0x344]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x354]
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x142]
push ecx
mov word [esp + 0x144], ax
call fcn.00429980
add esp, 0xc
lea edx, [esp + 0x138]
push edx
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x406a64
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
mov eax, esi
call fcn.0040ba40
mov esi, eax
push 0x441c84
push 0x441f54
mov edx, esi
call fcn.0040c340
push edi
push 0x4421a0
mov edx, esi
call fcn.0040c340
add esp, 0x10
xor al, al
jmp 0x406b5d
lea eax, [esp + 0x138]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406a70
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x136], 0x5c
jne 0x406aad
lea eax, [esp + 0x138]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406a94
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x136], cx
lea edi, [esp + 0x14]
call fcn.0040bd50
lea ebx, [esp + 0x138]
mov edx, ebx
test edx, edx
jne 0x406ac8
mov ebx, 0x442128
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406ad0
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
mov ecx, edi
lea esi, [esp + 0x1c]
mov dword [esp + 0x18], eax
call fcn.0040c6d0
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x406b03
mov eax, dword [esp + 0x1c]
lea ecx, [edi + edi]
push ecx
add eax, 4
push ebx
push eax
call fcn.00429cf0
add esp, 0xc
cmp byte [esp + 0x130], 0
lea eax, [esp + 0x20]
jne 0x406b26
mov eax, dword [esp + 0x1c]
add eax, 4
lea edx, [ebp + 0x130]
call fcn.0040bf70
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x406b5b
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x20]
cmp eax, edx
je 0x406b5b
push eax
call fcn.004229f3
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x32c]
xor ecx, esp
call fcn.004223b0
add esp, 0x33c
ret 4
Function at 0x407640
Capabilities:
Accept command line arguments

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
mov esi, eax
call edi
call edi
lea edx, [esi + 0x4d4]
call fcn.0040bf70
cmp byte [esi + 0x5f0], 0
lea eax, [esi + 0x4e0]
jne 0x40766e
mov eax, dword [esi + 0x4dc]
add esi, 0x5f8
add eax, 4
mov edx, esi
call fcn.0040bf70
mov eax, esi
call fcn.0040c670
pop edi
mov al, 1
pop esi
ret
Function at 0x40b0f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp byte [eax + 0x11c], 0
je 0x40b0fe
add eax, 0xc
jmp 0x40b101
mov eax, dword [eax + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40b113
xor al, al
ret
shr eax, 4
not eax
and eax, 1
ret
Function at 0x40b420
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4367d6
mov eax, dword fs:[0]
push eax
sub esp, 0x124
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 0x138]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x148]
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40b465
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40b483
mov eax, dword [esi + 8]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x40b52d
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
mov eax, esi
call fcn.0040b0f0
test al, al
je 0x40b52d
cmp byte [esi + 0x11c], 0
je 0x40b4ba
add esi, 0xc
jmp 0x40b4bd
mov esi, dword [esi + 8]
lea edi, [esp + 0x14]
call fcn.0040bd50
lea eax, [esi + 4]
mov edx, edi
call fcn.0040bf70
mov eax, ebp
mov dword [esp + 0x140], 1
call fcn.0040ba40
mov edi, ebx
mov esi, eax
call fcn.0040bb90
mov eax, ebp
call fcn.0040ba40
mov esi, eax
push 0x442100
lea eax, [esp + 0x18]
call fcn.0040bca0
cmp byte [esp + 0x130], 0
mov dword [esp + 0x14], vtable.t_str.0
jne 0x40b529
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40b529
push eax
call fcn.004229f3
add esp, 4
xor al, al
jmp 0x40b52f
mov al, 1
mov ecx, dword [esp + 0x138]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret 4
Function at 0x40b5a0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x436791
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x248], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 0x260]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x270]
mov esi, ecx
call fcn.0040b120
test al, al
jne 0x40b739
lea eax, [esp + 0x138]
call fcn.0040abc0
push esi
lea ebx, [esp + 0x13c]
mov dword [esp + 0x26c], 2
call fcn.0040b7c0
test al, al
je 0x40b640
mov eax, ebx
call fcn.0040ae90
test al, al
jne 0x40b640
push 0
push ebp
mov ecx, ebx
call fcn.0040b5a0
test al, al
jne 0x40b640
mov eax, ebx
call fcn.0040ae60
xor al, al
jmp 0x40b73b
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x40b64f
mov eax, dword [esi + 8]
push 0
add eax, 4
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x40b6fb
cmp byte [esi + 0x11c], al
je 0x40b670
add esi, 0xc
jmp 0x40b673
mov esi, dword [esi + 8]
lea edi, [esp + 0x14]
call fcn.0040bd50
lea eax, [esi + 4]
mov edx, edi
call fcn.0040bf70
push 0x442118
mov ebx, ebp
mov byte [esp + 0x26c], 4
call fcn.0040bb60
mov esi, eax
mov eax, edi
call fcn.0040bca0
cmp byte [esp + 0x130], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x14], esi
jne 0x40b6cb
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
cmp eax, ecx
je 0x40b6cb
push eax
call fcn.004229f3
add esp, 4
cmp byte [esp + 0x254], 0
mov dword [esp + 0x138], esi
jne 0x40b6f7
mov eax, dword [esp + 0x140]
lea edx, [esp + 0x144]
cmp eax, edx
je 0x40b6f7
push eax
call fcn.004229f3
add esp, 4
xor al, al
jmp 0x40b73b
mov eax, esi
call fcn.0040b990
mov eax, esi
call fcn.0040b8f0
cmp byte [esp + 0x254], 0
mov dword [esp + method.t_str.virtual_0], vtable.t_str.0
jne 0x40b739
mov eax, dword [esp + 0x140]
lea ecx, [esp + 0x144]
cmp eax, ecx
je 0x40b739
push eax
call fcn.004229f3
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x260]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x248]
xor ecx, esp
call fcn.004223b0
add esp, 0x258
ret 8
Function at 0x40c770
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push edi
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x40c7a7
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push eax
call fcn.00424233
mov ecx, dword [esp + 0x10]
add esp, 4
mov ebx, eax
push ebx
push ecx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40c829
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x441820
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40c829
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xa]
mov word [esi], cx
movzx edx, word [eax + 8]
mov word [esi + 2], dx
movzx ecx, word [eax + 0xe]
mov word [esi + 4], cx
movzx edx, word [eax + 0xc]
mov word [esi + 6], dx
test ebp, ebp
je 0x40c824
movzx ecx, word [eax + 0x12]
mov word [ebp], cx
movzx edx, word [eax + 0x10]
mov word [ebp + 2], dx
movzx ecx, word [eax + 0x16]
mov word [ebp + 4], cx
movzx edx, word [eax + 0x14]
mov word [ebp + 6], dx
mov byte [esp + 0xb], 1
test ebx, ebx
je 0x40c836
push ebx
call fcn.004229f3
add esp, 4
mov al, byte [esp + 0xb]
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x40c840
Capabilities:
Get common file path

Disassembly:
sub esp, 0x21c
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
mov ebp, dword [esp + 0x224]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1e]
push ecx
mov word [esp + 0x20], ax
call fcn.00429980
add esp, 0xc
push 0x104
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
test eax, eax
jne 0x40c8a2
xor al, al
pop ebp
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.004223b0
add esp, 0x21c
ret
push esi
push edi
push str.kernel32.dll
lea eax, [esp + 0x20]
push 0x104
push eax
call fcn.00423873
lea ecx, [esp + 0x18]
push ecx
lea esi, [esp + 0x24]
lea edi, [esp + 0x2c]
call fcn.0040c770
add esp, 0x10
pop edi
pop esi
test al, al
je 0x40c88a
movzx edx, word [esp + 0xc]
movzx eax, word [esp + 0xe]
movzx ecx, word [esp + 0x10]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
xor edx, edx
mov eax, 2
mov dword [ebx], 0x114
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x10], eax
mov word [ebx + 0x14], dx
test ebp, ebp
je 0x40c92b
movzx ecx, word [esp + 4]
movzx edx, word [esp + 6]
mov dword [ebp + 4], ecx
movzx ecx, word [esp + 8]
mov dword [ebp + 8], edx
xor edx, edx
mov dword [ebp], 0x114
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov word [ebp + 0x14], dx
mov ecx, dword [esp + 0x21c]
pop ebp
xor ecx, esp
mov al, 1
call fcn.004223b0
add esp, 0x21c
ret
Function at 0x40cdb0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x220
mov eax, dword [0x449250]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x228]
push ebp
mov ebp, dword [esp + 0x228]
cmp word [ebp], 0x5c
mov dword [esp + 4], eax
je 0x40ce08
push ebp
push 0x104
push eax
call fcn.004247f3
add esp, 0xc
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.004223b0
add esp, 0x220
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
push 0
push 0
call edi
mov esi, eax
test esi, esi
jne 0x40ce34
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x21c]
xor ecx, esp
call fcn.004223b0
add esp, 0x220
ret
lea eax, [esi + esi + 2]
push ebx
push eax
call fcn.00424233
add esp, 4
mov ebx, eax
push ebx
lea ecx, [esi + 1]
push ecx
mov dword [esp + 0x1c], ebx
call edi
cmp eax, esi
ja 0x40cf78
test eax, eax
je 0x40cf78
mov edx, dword [0x44302c]
mov ax, word [0x443030]
xor ecx, ecx
push 0x206
mov dword [esp + 0x20], edx
push ecx
lea edx, [esp + 0x2e]
push edx
mov edi, ebx
mov word [esp + 0x2c], ax
mov word [esp + 0x30], cx
call fcn.00429980
add esp, 0xc
xor bl, bl
mov ax, word [edi]
push 0x104
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x24]
push edx
mov word [esp + 0x28], ax
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceW]
test eax, eax
je 0x40cef1
lea eax, [esp + 0x24]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cec0
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x104
jae 0x40cef1
push esi
lea eax, [esp + 0x28]
push eax
push ebp
call fcn.0042413e
add esp, 0xc
test eax, eax
sete bl
test bl, bl
jne 0x40cf40
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cef6
sub eax, edx
sar eax, 1
je 0x40cf66
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40cf10
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x40ce92
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004229f3
add esp, 4
movzx eax, bl
jmp 0x40cf83
mov eax, dword [esp + 0x10]
lea ecx, [ebp + esi*2]
push ecx
lea edx, [esp + 0x20]
push edx
push str._s_s
push 0x103
push 0x104
push eax
call fcn.004224f6
add esp, 0x18
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004229f3
add esp, 4
movzx eax, bl
jmp 0x40cf83
push ebx
call fcn.004229f3
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop ebx
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004223b0
add esp, 0x220
ret
Function at 0x40eba0
Capabilities:
Set file attributes

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov esi, eax
mov eax, dword [ebp + 0x130]
mov edx, dword [eax + 0x18]
lea edi, [ebp + 0x130]
push esi
push ebx
mov ecx, edi
call edx
test al, al
jne 0x40ebf1
mov eax, ebx
call fcn.0040ba40
push 0x4420f0
push 0x441f54
mov edx, eax
call fcn.0040c340
add esp, 8
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
push ebx
push edi
call fcn.00417900
test al, al
je 0x40ebca
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
push ecx
mov dword [ebp + 0x34c], edi
xor edi, edi
push eax
push ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edi
mov dword [ebp + 8], eax
call fcn.0040e930
add esp, 0x14
test al, al
jne 0x40ec7d
cmp byte [esi + 0x11c], al
je 0x40ec41
add esi, 0xc
jmp 0x40ec44
mov esi, dword [esi + 8]
mov eax, ebx
call fcn.0040ba40
mov edi, eax
push 0x4431c4
push 0x441f54
mov edx, edi
call fcn.0040c340
add esi, 4
push esi
push 0x441f54
mov edx, edi
call fcn.0040c340
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push edi
push 0x80
push ebx
push edi
push edx
push eax
mov eax, esi
call fcn.0040c2b0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp + 4], eax
mov edi, 1
cmp eax, 0xffffffff
jne 0x40ed23
mov edi, edi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [esp + 0x24], eax
cmp eax, 0x20
jne 0x40ecdb
cmp edi, 3
jge 0x40ed64
cmp byte [ebp + 0x350], 0
je 0x40ecf8
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x40ecf8
cmp eax, 5
jne 0x40ed39
cmp edi, 3
jge 0x40ed64
push 0x80
mov eax, esi
call fcn.0040c2b0
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push 0
push 0x80
push ebx
push 0
push ecx
push edx
mov eax, esi
call fcn.0040c2b0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
inc edi
mov dword [ebp + 4], eax
cmp eax, 0xffffffff
je 0x40ecb0
lea edx, [ebp + 0xc]
mov eax, esi
call fcn.0040af40
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
test eax, eax
jne 0x40ed64
cmp byte [esi + 0x11c], al
je 0x40ed4a
add esi, 0xc
jmp 0x40ed4d
mov esi, dword [esi + 8]
mov eax, dword [esp + 0x20]
push 0x4431d4
call fcn.00405520
add esi, 4
push esi
jmp 0x40ebd6
cmp byte [esi + 0x11c], 0
lea ebx, [esi + 0xc]
jne 0x40ed73
mov ebx, dword [esi + 8]
mov ebp, dword [esp + 0x20]
mov eax, ebp
call fcn.0040ba40
mov edi, dword [esp + 0x24]
mov esi, eax
call fcn.0040bb90
mov eax, ebp
call fcn.0040ba40
mov esi, eax
push 0x4431c4
push 0x441f54
mov edx, esi
call fcn.0040c340
add ebx, 4
push ebx
push 0x441f54
mov edx, esi
call fcn.0040c340
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
Function at 0x40eea0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x40eec9
test ebx, ebx
je 0x40eebf
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x40ef4f
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x40eefa
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x18]
call fcn.0040ba40
mov esi, eax
call fcn.0040bb90
push 0
call ebp
mov eax, dword [esp + 0x18]
call fcn.0040ba40
mov esi, eax
push 0x4431f4
push 0x441f54
mov edx, esi
call fcn.0040c340
add ebx, 4
push ebx
push 0x441f54
mov edx, esi
call fcn.0040c340
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40ef59
mov dword [ebx], eax
test eax, eax
jne 0x40eebf
cmp byte [esi + 0x128], al
je 0x40ef6e
add esi, 0x18
jmp 0x40ef71
mov esi, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
call fcn.0040ba40
mov edi, eax
push 0x443204
push 0x441f54
mov edx, edi
call fcn.0040c340
add esi, 4
push esi
push 0x441f54
mov edx, edi
call fcn.0040c340
add esp, 0x10
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x40efb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x40f04d
push ebx
lea ebx, [esi + 0x18]
cmp byte [esi + 0x128], al
jne 0x40eff8
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
mov eax, dword [esp + 0x18]
call fcn.0040ba40
mov esi, eax
call fcn.0040bb90
push 0
call ebp
mov eax, dword [esp + 0x18]
call fcn.0040ba40
mov esi, eax
push 0x443224
push 0x441f54
mov edx, esi
call fcn.0040c340
add ebx, 4
push ebx
push 0x441f54
mov edx, esi
call fcn.0040c340
add esp, 0x10
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x40f057
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc
Function at 0x4109e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x435f08
mov eax, dword fs:[0]
push eax
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.item
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.00424233
mov dword [eax + 0x24], fcn.004245d8
mov dword [eax + 0x28], fcn.004229f3
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configRuntimeFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x410ae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x435f08
mov eax, dword fs:[0]
push eax
mov eax, dword [0x449250]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov byte [eax + 4], cl
mov dword [eax + 8], str.item
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x20], fcn.00424233
mov dword [eax + 0x24], fcn.004245d8
mov dword [eax + 0x28], fcn.004229f3
mov dword [eax + 0x2c], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], vtable.n_config::t_arraySection_class_t_configGameFile::t_item_.0
mov dword [eax + 0x30], ecx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 8

Function at 0x411220
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebp
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
cmp eax, ebx
jne 0x411256
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push esi
push eax
call fcn.00424233
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push ecx
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4112b4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push eax
push 0x441820
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4112b4
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xa]
movzx edx, word [eax + 8]
mov word [edi], cx
movzx ecx, word [eax + 0xe]
mov word [edi + 2], dx
movzx edx, word [eax + 0xc]
mov word [edi + 4], cx
mov word [edi + 6], dx
mov byte [esp + 0xf], 1
cmp esi, ebx
je 0x4112c1
push esi
call fcn.004229f3
add esp, 4
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret