joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cf0
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov eax, dword [0x408004]
xor eax, esp
mov dword [esp + 0x94], eax
xorps xmm0, xmm0
mov dword [esp + 0x40], 1
movaps xmmword [esp + 0x68], xmm0
mov eax, 0x400
movaps xmm0, xmmword [0x406940]
push esi
push edi
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 4
mov dword [esp + 0x54], 8
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 2
movaps xmmword [esp + 0x60], xmm0
mov dword [esp + 0x18], eax
xor esi, esi
shr eax, 0xa
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], eax
nop
xorps xmm0, xmm0
xor edi, edi
movsd qword [esp + 0x30], xmm0
mov dword [esp + 0x24], edi
nop
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
push 0x13
push dword [esp + edi*4 + 0x40]
mov dword [esp + 0x30], eax
push 0
push 0
push 0x10
rdtsc
mov dword [esp + 0x30], eax
lea eax, [esp + 0xa0]
push eax
push 0x10
lea eax, [esp + 0x7c]
mov dword [esp + 0x3c], edx
push eax
push 0x10
lea eax, [esp + 0x94]
push eax
push dword [esp + esi*4 + 0x70]
push dword [esp + 0x44]
push 3
call sym.Argon2OptBench.exe_argon2_hash
add esp, 0x34
rdtsc
mov edi, eax
mov esi, edx
sub edi, dword [esp + 0x1c]
push 0
push dword [esp + 0x1c]
sbb esi, dword [esp + 0x28]
push esi
push edi
call fcn.00405a80
mov dword [esp + 0x20], edx
mov ecx, edi
mov edx, esi
mov dword [esp + 0x1c], eax
call fcn.00405eb0
mulsd xmm0, qword [0x406928]
movsd qword [esp + 0x58], xmm0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
movd xmm1, dword [esp + 0x28]
cvtdq2pd xmm1, xmm1
mov edi, dword [esp + 0x24]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
mov eax, dword [esp + edi*4 + 0x3c]
subsd xmm2, xmm1
divsd xmm2, qword [0x406930]
addsd xmm2, qword [esp + 0x30]
movsd qword [esp + 0x30], xmm2
sub eax, 0
je 0x401e5e
sub eax, 1
je 0x401e57
sub eax, 1
je 0x401e50
xor esi, esi
jmp 0x401e63
mov esi, str.Argon2id
jmp 0x401e63
mov esi, str.Argon2i
jmp 0x401e63
mov esi, str.Argon2d
movsd xmm0, qword [esp + 0x58]
sub esp, 8
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
movsd qword [esp], xmm0
call fcn.00405eb0
mov eax, dword [esp + 0x1c]
sub esp, 8
cvtsd2ss xmm0, xmm0
mulss xmm0, dword [0x406924]
cvtss2sd xmm0, xmm0
movsd qword [esp], xmm0
push dword [esp + eax*4 + 0x58]
push dword [esp + 0x40]
push 3
push esi
push str._s__d_iterations___d_MiB__d_threads:___2.2f_cpb__2.2f_Mcycles__n
call fcn.00401cb0
mov esi, dword [esp + 0x38]
inc edi
add esp, 0x24
mov dword [esp + 0x24], edi
cmp edi, 3
jb 0x401d80
movsd xmm0, qword [esp + 0x30]
sub esp, 8
movsd qword [esp], xmm0
push str._2.4f_seconds_n_n
call fcn.00401cb0
inc esi
add esp, 0xc
mov dword [esp + 0x14], esi
cmp esi, 4
jb 0x401d70
mov eax, dword [esp + 0x18]
add eax, eax
mov dword [esp + 0x18], eax
cmp eax, 0x400000
jbe 0x401d61
mov ecx, dword [esp + 0x9c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00404d7d
mov esp, ebp
pop ebp
ret
Function at 0x403020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x81c
mov eax, dword [0x408004]
xor eax, esp
mov dword [esp + 0x818], eax
push ebx
mov eax, ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], eax
push esi
push edi
test eax, eax
je 0x403218
test edx, edx
je 0x403218
mov ebx, dword [edx + 0x14]
lea edi, [esp + 0x20]
mov edx, dword [edx]
mov eax, ebx
shl eax, 0xa
mov ecx, 0x100
mov dword [esp + 0x10], eax
lea esi, [edx - 0x400]
add esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
mov edi, dword [ecx + 0x18]
cmp edi, 1
jbe 0x403164
mov eax, ebx
lea esi, [esp + 0x430]
imul ebx, ebx, 0xfffffc00
add edx, 0xfffffff8
shl eax, 0xb
sub esi, eax
add edx, eax
sub esi, dword [ecx]
dec edi
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
nop dword [eax]
lea ecx, [esp + 0x20]
xor eax, eax
cmp ecx, edx
ja 0x4030f0
lea ebx, [esp + 0x418]
lea ecx, [edx - 0x3f8]
cmp ebx, ecx
mov ebx, dword [esp + 0x10]
jb 0x4030f0
nop
mov ecx, dword [edx + eax*8 - 0x3f8]
xor dword [esp + eax*8 + 0x20], ecx
mov ecx, dword [edx + eax*8 - 0x3f4]
xor dword [esp + eax*8 + 0x24], ecx
inc eax
cmp eax, 0x80
jl 0x4030d0
jmp 0x403155
lea ecx, [edx - 0x3d8]
nop word [eax + eax]
movups xmm0, xmmword [esp + eax*8 + 0x20]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ecx - 0x60]
pxor xmm1, xmm0
movups xmmword [esp + eax*8 + 0x20], xmm1
movups xmm0, xmmword [esp + eax*8 + 0x30]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmmword [esp + eax*8 + 0x30], xmm1
add eax, 8
movups xmm0, xmmword [ecx + esi - 0x50]
movups xmm1, xmmword [ecx - 0x40]
pxor xmm1, xmm0
movups xmmword [ecx + esi - 0x50], xmm1
movups xmm0, xmmword [ecx + esi - 0x40]
movups xmm1, xmmword [ecx - 0x30]
pxor xmm1, xmm0
movups xmmword [ecx + esi - 0x40], xmm1
cmp eax, 0x80
jl 0x403100
add esi, dword [esp + 0x18]
add edx, ebx
sub edi, 1
jne 0x4030b0
mov ecx, 0x100
lea esi, [esp + 0x20]
lea edi, [esp + 0x420]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x420]
push 0x400
push eax
mov edx, dword [edi + 4]
mov ecx, dword [edi]
call fcn.00402d60
add esp, 8
lea eax, [esp + 0x20]
mov ecx, 0x400
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4031a0
mov ecx, 0x400
lea eax, [esp + 0x420]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4031b7
mov eax, dword [esp + 0x14]
mov edx, dword [eax + 0xc]
mov esi, dword [eax]
shl edx, 0xa
test esi, esi
je 0x4031eb
mov ecx, edx
mov eax, esi
test edx, edx
je 0x4031eb
nop word [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4031e0
mov eax, dword [edi + 0x40]
test eax, eax
je 0x40320e
push edx
push esi
call eax
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x818]
xor ecx, esp
call fcn.00404d7d
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00404d7d
mov esp, ebp
pop ebp
ret
Function at 0x4037a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, edx
mov eax, 0xaaaaaaab
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mul ecx
shr edx, 1
lea esi, [edx*4]
lea eax, [edx + edx*2]
mov dword [ebp - 0x10], esi
mov edx, ecx
sub edx, eax
sub edx, 1
je 0x4037d5
sub edx, 1
jne 0x4037db
inc esi
add esi, 2
mov dword [ebp - 0x10], esi
cmp ebx, esi
ja 0x4037e9
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
xor esi, esi
test ecx, ecx
je 0x40391d
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
dec ecx
shl edx, 8
inc ebx
add esi, 8
mov dword [ebp + 0xc], ecx
add edx, eax
mov dword [ebp + 8], ebx
cmp esi, 6
jb 0x4038a0
sub esi, 6
mov ebx, edx
mov ecx, esi
shr ebx, cl
and ebx, 0x3f
mov dword [ebp - 4], ebx
lea eax, [ebx - 0x1a]
add ebx, 0xffffffcc
shr eax, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, eax
xor ecx, 0x3e
shr ebx, 8
neg ecx
xor eax, 0x3f
shr ecx, 8
neg eax
not cl
shr eax, 8
and cl, 0xfb
not al
or cl, al
mov eax, dword [ebp - 4]
and ecx, 0xffffff2f
mov dword [ebp - 8], ecx
lea ecx, [eax - 0x3e]
sub al, 4
shr ecx, 8
and cl, al
mov al, bl
not al
and cl, al
mov al, byte [ebp - 0xc]
or byte [ebp - 8], cl
not al
mov ecx, dword [ebp - 4]
add ecx, 0x47
and cl, al
mov eax, dword [ebp - 8]
and cl, bl
or al, cl
mov ecx, dword [ebp - 4]
add cl, 0x41
and cl, byte [ebp - 0xc]
or al, cl
mov byte [edi], al
inc edi
cmp esi, 6
jae 0x403814
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ecx, ecx
jne 0x4037f8
test esi, esi
je 0x40391d
mov ecx, 6
sub ecx, esi
shl edx, cl
and edx, 0x3f
mov ecx, edx
xor ecx, 0x3e
neg ecx
lea eax, [edx - 0x1a]
shr ecx, 8
shr eax, 8
lea ebx, [edx - 0x34]
mov dword [ebp - 0xc], eax
not cl
mov eax, edx
shr ebx, 8
xor eax, 0x3f
and cl, 0xfb
neg eax
shr eax, 8
not al
or cl, al
lea eax, [edx - 4]
and ecx, 0xffffff2f
mov dword [ebp + 0xc], ecx
lea ecx, [edx - 0x3e]
shr ecx, 8
and cl, al
mov al, bl
not al
and cl, al
mov al, byte [ebp - 0xc]
or byte [ebp + 0xc], cl
not al
lea ecx, [edx + 0x47]
add dl, 0x41
and dl, byte [ebp - 0xc]
and cl, al
mov eax, dword [ebp + 0xc]
and cl, bl
or al, cl
or al, dl
mov byte [edi], al
inc edi
mov eax, dword [ebp - 0x10]
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409978
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a4b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a64
push ebx
push 0x409a70
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403388
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00402750
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004033e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4099f8
mov al, 0x69
call fcn.0040961c
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040994c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a01
call fcn.0040994c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a52
lea eax, [ebp - 4]
call fcn.0040316c
ret

Function at 0x409b04
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
jmp 0x409bad
cmp dword [esi + 0x10], 0x1000
jne 0x409b99
test byte [esi + 0x15], 1
jne 0x409b99
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b58
cmp eax, 2
je 0x409b58
cmp eax, 0x10
je 0x409b58
cmp eax, 0x20
jne 0x409b6d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b6d
mov bl, 1
xor ebp, ebp
jmp 0x409b7e
mov eax, dword [esi]
add eax, ebp
call fcn.00409afc
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b71
test bl, bl
je 0x409b99
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409bb8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b30
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10002fc5
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10002fc5
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10002fc5
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.10002fc5
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10
Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10002fc5
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8
Function at 0x4025d5
Capabilities:
Access the windows event log

Disassembly:
push 0x24
mov eax, 0x435629
call fcn.00434148
mov esi, edx
mov edi, ecx
push 0x43dba0
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov ebx, eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x2c]
push str.Description:_A_.NET_application_failed._n
call fcn.00403b7d
push 0x43db9c
push esi
push str.Application:
lea ecx, [ebp - 0x2c]
call fcn.00403b7d
mov ecx, eax
call fcn.00403b7d
mov ecx, eax
call fcn.00403b7d
mov esi, 0x43db9c
lea ecx, [ebp - 0x2c]
push esi
push edi
push str.Path:
call fcn.00403b7d
mov ecx, eax
call fcn.00403b7d
mov ecx, eax
call fcn.00403b7d
push str.Message:
lea ecx, [ebp - 0x2c]
call fcn.00403b7d
cmp dword [0x45252c], 8
mov ecx, 0x452518
push esi
cmovae ecx, dword [0x452518]
push dword [0x452528]
push ecx
mov ecx, eax
call fcn.00403f1f
mov ecx, eax
call fcn.00403b7d
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
xor ecx, ecx
push ecx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push ecx
push 1
push ecx
push 0x3ff
push ecx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4026fc
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4026f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4026f3
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0042f05f
pop ecx
pop ecx
call fcn.004340f7
ret
Function at 0x404eb2
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x4359ae
call fcn.00434115
mov ebx, 0x4537bc
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
xor edx, edx
xor ecx, ecx
call fcn.00404bd1
push ecx
lea ecx, [ebp - 0x1c]
lea esi, [eax + 1]
push esi
call fcn.00405063
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov edx, esi
push eax
push dword [ebp + 8]
call fcn.00404bd1
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
mov esi, dword [edi + 8]
test esi, esi
jne 0x404f1f
mov ecx, dword [ebp - 0x1c]
call fcn.0040257d
jmp 0x404f2d
push dword [ebp - 0x1c]
mov ecx, esi
call dword [0x43b2c4]
call esi
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x453998], 0
je 0x404f65
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
pop ecx
cmp dword [0x4537d4], eax
jne 0x404f59
cmp dword [edi + 8], 0
je 0x404f65
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.00404b9e
lea ecx, [ebp - 0x1c]
call fcn.00405041
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004340e3
ret
Function at 0x4098c4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
push edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4098dc
mov eax, dword [esi]
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x409920
cmp dword [esi + 0x14], 8
jb 0x409904
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_map_file._CreateFileW__s__failed_with_error__d
call fcn.00404eb2
add esp, 0xc
xor eax, eax
jmp 0x4099d8
cmp dword [ebp - 4], edi
je 0x409962
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x40995a
cmp dword [esi + 0x14], 8
jb 0x40993c
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_map_file._GetFileSizeEx__s__failed_with_error__d
call fcn.00404eb2
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409919
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
push edi
push edi
push edi
push dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x409996
cmp dword [esi + 0x14], 8
jb 0x40997f
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_map_file._CreateFileMappingW__s__failed_with_error__d
call fcn.00404eb2
add esp, 0xc
jmp 0x4099cf
push edi
push edi
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x4099c6
cmp dword [esi + 0x14], 8
jb 0x4099b1
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Failed_to_map_file._MapViewOfFile__s__failed_with_error__d
call fcn.00404eb2
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40a63b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
xor edx, edx
push edi
mov edi, ecx
mov eax, esi
mov dword [esi + 0x10], edx
cmp dword [esi + 0x14], 8
jb 0x40a654
mov eax, dword [esi]
push edx
push edx
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a69d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x40a699
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
push ecx
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.00404eb2
add esp, 0xc
xor al, al
jmp 0x40a6fd
push ebx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0042f2e9
pop ecx
push dword [ebp - 4]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x40a6eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
push ecx
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.00404eb2
add esp, 0xc
xor al, al
jmp 0x40a6fc
push ebx
mov ecx, esi
call fcn.00403ef8
push ebx
call fcn.0042f2e4
pop ecx
mov al, 1
pop ebx
pop edi
pop esi
leave
ret

Function at 0x40a701
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x45200c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x218]
mov esi, ecx
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40a794
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00403ef8
xor dl, dl
mov ecx, esi
call fcn.0040a8bc
test al, al
je 0x40a794
mov edx, str..net
mov ecx, esi
call fcn.0040540d
xor dl, dl
mov ecx, esi
call fcn.0040a8bc
test al, al
je 0x40a765
mov al, 1
jmp 0x40a796
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x40a76f
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40a789
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40a794
xor dl, dl
mov ecx, esi
call fcn.0040a8bc
jmp 0x40a796
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042f021
leave
ret