joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x40b0e0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x40b0e4]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call sym.__amsg_exit
jmp 0x4011d3
mov eax, dword [0x40b0e4]
test eax, eax
jne 0x4011c9
mov dword [0x40b0e4], 1
mov dword [esp + 4], 0x40e014
mov dword [esp], 0x40e00c
call sym.__initterm
jmp 0x4011d3
mov dword [0x40b01c], 1
mov eax, dword [0x40b0e4]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x40e008
mov dword [esp], section..CRT
call sym.__initterm
mov dword [0x40b0e4], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x40b0e0
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call sym.__pei386_runtime_relocator
mov dword [esp], sym.__gnu_exception_handler_4
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x40b0a0], eax
mov dword [esp], sym.___mingw_invalidParameterHandler
call sym.__set_invalid_parameter_handler
call sym.__fpreset
mov eax, dword [0x40b004]
mov dword [esp + 4], 0x40b008
mov dword [esp], eax
call sym._duplicate_ppstrings
call sym.___main
mov eax, dword [0x406028]
mov edx, dword [0x40b00c]
mov dword [eax], edx
mov ecx, dword [0x40b00c]
mov edx, dword [0x40b008]
mov eax, dword [0x40b004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._main
mov dword [0x40b014], eax
mov eax, dword [0x40b018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x40b014]
mov dword [esp], eax
call sym._exit
mov eax, dword [0x40b01c]
test eax, eax
jne 0x4012de
call sym.__cexit
mov eax, dword [0x40b014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40b078], 1
mov dword [0x40b07c], 1
mov dword [0x40b080], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret
Function at 0x402820
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x4033f4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x403413
mov eax, 0
jmp 0x403457
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x403436
mov eax, 0
jmp 0x403457
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x403452
mov eax, 0
jmp 0x403457
mov eax, 1
leave
ret

Function at 0x403459
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4034b8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4034b0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4034b0
mov eax, dword [ebp - 4]
jmp 0x4034cc
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40348d
mov eax, 0
leave
ret
Function at 0x401d00
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x74
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 8
cmp eax, 0
je 0x401d2f
mov dword [ebp - 0x34], 0x40000000
mov dword [ebp - 0x38], 2
jmp 0x401d3d
mov dword [ebp - 0x34], 0x80000000
mov dword [ebp - 0x38], 3
mov eax, dword [ebp - 0x10]
add eax, 0x34
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov esi, esp
mov dword [esi + 0x10], edx
mov dword [esi + 4], ecx
mov dword [esi], eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0x80
mov dword [esi + 0xc], 0
mov dword [esi + 8], 1
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x134], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x134], ecx
jne 0x401e09
call sub.KERNEL32.DLL_GetLastError
sub eax, 2
mov dword [ebp - 0x3c], eax
jne 0x401dc1
jmp 0x401da1
lea eax, str.Image__s_does_not_exist_n
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0040c1c8
mov dword [ebp - 0x40], eax
jmp 0x401de8
call sub.KERNEL32.DLL_GetLastError
lea ecx, str.Error__08lx_opening__s_n
mov edx, dword [ebp - 0x10]
add edx, 0x34
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040c1c8
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x48], eax
jmp 0x401ec8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 8
cmp eax, 0
je 0x401e3d
lea eax, [0x415268]
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0040c1c8
mov dword [ebp - 0x4c], eax
jmp 0x401ec1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x134]
mov ecx, dword [ebp - 0x10]
add ecx, 0x138
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_GetFileSizeEx
sub esp, 8
mov ecx, 8
mov edx, 0x2c
lea esi, [ebp - 0x30]
mov edi, dword [ebp - 0x10]
add edi, 0x138
mov dword [esp], edi
mov dword [esp + 4], 8
mov dword [esp + 8], 0x2c
mov dword [esp + 0xc], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], edx
call fcn.004064ac
lea ecx, str._s___s_bytes_n
lea edx, [ebp - 0x30]
mov esi, dword [ebp - 0x10]
add esi, 0x34
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], edx
mov dword [ebp - 0x5c], eax
call fcn.0040c1c8
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add esp, 0x74
pop esi
pop edi
pop ebp
ret
Function at 0x4036dc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4036ee
call fcn.00411604
mov eax, dword [0x4155fb]
shl eax, 2
mov dword [0x4155ff], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
mov dword [0x415603], edx
call fcn.0040a784
pop edx
call fcn.00408630
call fcn.0040a788
push 0x4155a4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x415603], eax
push 0
jmp 0x412b2c
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, dword [esp + 0x6c]
mov eax, dword [esi + 0x10]
and eax, 1
mov dword [0x417aac], eax
call fcn.0040ed20
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x20]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.0040f134
mov eax, dword [esi + 0x28]
mov dword [esp], eax
call fcn.0040b8c8
mov eax, dword [esi + 0x44]
mov dword [esp], eax
call fcn.0040b8d8
mov dword [0x41fd00], 1
mov dword [0x41fd04], esi
lea eax, [esp + 0x10]
mov dword [0x41fccc], eax
call fcn.00413438
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x41fcd0], eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x41fcd8], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00411abc
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x38]
mov edx, dword [esi + 0x3c]
mov edi, dword [esi + 0x40]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00411b0c
mov dword [esp + 4], 0
mov dword [esp], 0x41fd00
call fcn.00412974
test byte [esi + 0x10], 1
je 0x412c17
mov eax, dword [0x41fcd8]
nop word cs:[eax + eax]
inc eax
mov cl, byte [eax - 1]
cmp cl, 9
je 0x412bfc
cmp cl, 0x22
je 0x412c3b
cmp cl, 0x20
je 0x412bfc
dec eax
mov edx, 0x20
jmp 0x412c50
mov eax, dword [0x41fce4]
mov ecx, dword [0x41fce8]
mov edx, dword [0x41fcec]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [esi + 0x18]
jmp 0x412cd3
mov cl, byte [eax]
mov edx, 0x22
jmp 0x412c50
mov cl, byte [eax + 1]
inc eax
xor ch, ch
test cl, cl
je 0x412c64
cmp cl, 9
je 0x412c62
movsx edi, cl
cmp edi, edx
jne 0x412c4c
mov ch, cl
lea edi, [eax + 1]
cmp ch, 0x22
cmovne edi, eax
jmp 0x412c7d
inc edi
mov al, byte [edi]
cmp al, 9
je 0x412c7c
cmp al, 0x20
je 0x412c7c
mov ebx, dword [esi + 0x18]
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov esi, eax
lea eax, [esp + 0x18]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
mov eax, 0xa
test byte [esp + 0x44], 1
je 0x412cbb
movzx eax, word [esp + 0x48]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], 0
call ebx
sub esp, 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call fcn.004118d8
add esp, 0x5c
pop esi
pop edi
pop ebx
ret
Function at 0x4078f8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x28c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x260]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040abe4
lea ecx, [0x415aa0]
lea edx, [ebp - 0x260]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x268], eax
call fcn.00406b68
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, esp
mov dword [esi + 8], ecx
mov dword [esi], edx
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 1
mov dword [esi + 4], 0
mov dword [ebp - 0x26c], eax
call sub.KERNEL32.DLL_FindFirstFileExA
sub esp, 0x18
mov ecx, 0xffffffff
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], ecx
jne 0x4079aa
mov dword [ebp - 0xc], 0
jmp 0x407b2b
mov dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x15c]
and eax, 0x10
cmp eax, 0
je 0x407ae1
lea eax, [0x415aa2]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040ab94
cmp eax, 0
je 0x407adf
lea eax, [0x415aa4]
lea ecx, [ebp - 0x15c]
add ecx, 0x2c
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040ab94
cmp eax, 0
je 0x407adf
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0040abe4
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
add ecx, 0x2c
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [ebp - 0x270], eax
call fcn.00406b68
lea ecx, [ebp - 0x15c]
lea edx, [ebp - 0x260]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
mov dword [ebp - 0x274], eax
call esi
cmp eax, 0
jne 0x407a86
jmp 0x407b0a
mov eax, dword [ebp - 0x264]
add eax, 1
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x14], 0
je 0x407add
mov eax, 1
lea ecx, [ebp - 0x260]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov dword [esp], ecx
mov dword [esp + 4], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], esi
mov dword [ebp - 0x278], eax
call fcn.004078f8
mov ecx, dword [ebp - 0x264]
add ecx, eax
mov dword [ebp - 0x264], ecx
jmp 0x407adf
jmp 0x407ae1
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.KERNEL32.DLL_FindNextFileA
sub esp, 8
cmp eax, 0
jne 0x407b05
jmp 0x407b0a
jmp 0x4079b4
mov eax, dword [ebp - 0x160]
mov ecx, esp
mov dword [ecx], eax
call sub.KERNEL32.DLL_FindClose
sub esp, 4
mov ecx, dword [ebp - 0x264]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0xc]
add esp, 0x28c
pop esi
pop edi
pop ebp
ret
Function at 0x407b38
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x13c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x14], eax
mov eax, esp
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x100
mov dword [eax], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x14]
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [ebp - 0x12c], eax
call fcn.00406fa8
lea eax, [ebp - 0x118]
lea ecx, [ebp - 0x120]
mov edx, esp
mov dword [edx + 4], ecx
mov dword [edx], eax
call sub.VERSION.DLL_GetFileVersionInfoSizeA
sub esp, 8
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
ja 0x407bbe
mov dword [ebp - 0x10], 0
jmp 0x407d00
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call fcn.004083d8
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x120]
mov edx, dword [ebp - 0x18]
mov esi, esp
mov dword [esi + 0xc], edx
mov dword [esi + 8], eax
mov dword [esi], ecx
mov dword [esi + 4], 0
call sub.VERSION.DLL_GetFileVersionInfoA
sub esp, 0x10
lea ecx, [ebp - 0x11c]
mov edx, dword [ebp - 0x18]
lea esi, [ebp - 0x120]
mov edi, esp
mov dword [edi + 0xc], esi
mov dword [edi + 8], ecx
mov dword [edi], edx
mov dword [edi + 4], 0x415aa8
mov dword [ebp - 0x130], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x407c63
cmp dword [ebp - 0x120], 4
jne 0x407c63
mov eax, dword [ebp - 0x11c]
movzx eax, word [eax]
shl eax, 0x10
mov ecx, dword [ebp - 0x11c]
movzx ecx, word [ecx + 2]
or eax, ecx
mov dword [ebp - 0x124], eax
jmp 0x407c6d
mov dword [ebp - 0x124], 0x40904e4
lea eax, [0x415ac1]
lea ecx, [ebp - 0x118]
mov edx, dword [ebp - 0x124]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0040c570
lea ecx, [ebp - 0x11c]
lea edx, [ebp - 0x118]
mov esi, dword [ebp - 0x18]
lea edi, [ebp - 0x120]
mov ebx, esp
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [ebx], esi
mov dword [ebp - 0x134], eax
call sub.VERSION.DLL_VerQueryValueA
sub esp, 0x10
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x407cec
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x11c]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.0040abe4
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.004083e8
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add esp, 0x13c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x409410
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF_]
mov byte [0x4163de], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF_]
mov byte [0x4163dd], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF_]
mov byte [0x4163dc], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF_]
mov byte [0x4163db], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF_]
mov byte [0x4163da], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF_]
mov byte [0x4163d9], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF_]
mov byte [0x4163d8], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEF_]
mov byte [0x4163d7], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x40951b
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x40951d
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x409530
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.00409dfa
cmp dword [0x415c74], ecx
jne 0x409635
mov ecx, fcn.0040a17e
cmp dword [0x415c78], ecx
jne 0x409635
mov ecx, fcn.0040a376
cmp dword [0x415c7c], ecx
jne 0x409635
mov ecx, fcn.0040a690
cmp dword [0x415c80], ecx
jne 0x409635
mov ecx, 0x408730
cmp dword [0x415c84], ecx
jne 0x409635
xor eax, eax
mov ecx, 0x408740
cmp dword [0x415c88], ecx
jne 0x409635
mov ecx, dword [0x4196bc]
test ecx, ecx
jne 0x409635
call fcn.00409410
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x409635
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0x4196bc], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.00409dfa
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret
Function at 0x40b1e8
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x3c]
cmp dword [0x4168d8], esi
jbe 0x40b220
mov edx, dword [esp + 0x44]
lea ecx, [edx + 1]
xor eax, eax
cmp ecx, 2
jb 0x40b22c
mov eax, dword [esi*4 + 0x4168dc]
test ah, 0x40
je 0x40b234
xor edi, edi
test ah, 2
je 0x40b240
xor eax, eax
jmp 0x40b22c
mov dword [esp], 0xfffffffa
call fcn.0040be34
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
jmp 0x40b620
test edx, edx
jne 0x40b248
xor eax, eax
jmp 0x40b22c
mov ebx, dword [esp + 0x40]
sub edx, edi
mov dword [esp + 0x10], edx
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call 0x40b620
mov ebp, eax
test ebp, ebp
je 0x40b3a1
mov dword [esp + 0x18], edi
mov eax, 0xffffffff
cmp ebp, 0xffffffff
je 0x40b22c
mov dword [esp + 8], ebp
mov dword [esp], ebx
mov dword [esp + 4], 0x1a
call fcn.0040a88c
test eax, eax
je 0x40b2a4
or byte [esi*4 + 0x4168dd], 2
mov ebp, eax
sub ebp, ebx
je 0x40b39d
mov dword [esp + 0x1c], eax
lea edi, [ebp + ebx - 1]
cmp byte [ebp + ebx - 1], 0xd
jne 0x40b2d7
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], 1
call 0x40b620
mov ecx, eax
mov eax, 0xffffffff
cmp ecx, 0xffffffff
je 0x40b22c
mov dword [esp + 0x24], edi
lea eax, [ebx + ebp]
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], ebp
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x14], ebx
jmp 0x40b2fd
add edi, ebp
inc ebx
mov esi, ebx
mov ebp, dword [esp + 0x20]
mov eax, ebp
sub eax, esi
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 4], 0xd
call fcn.0040a88c
mov ebx, eax
test ebx, ebx
cmove ebx, ebp
mov ebp, ebx
sub ebp, esi
cmp esi, edi
je 0x40b338
mov dword [esp + 8], ebp
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.0040a950
mov eax, dword [esp + 0x24]
cmp ebx, eax
jb 0x40b2f8
mov ebx, dword [esp + 0x14]
sub edi, ebx
add ebp, edi
mov edi, dword [esp + 0x18]
add edi, ebp
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x10]
jae 0x40b379
cmp dword [esp + 0x1c], 0
sete al
mov esi, dword [esp + 0x3c]
test byte [esi*4 + 0x4168dd], 0x20
sete cl
test ebp, ebp
jne 0x40b3a1
and cl, al
jne 0x40b38d
jmp 0x40b3a1
cmp dword [esp + 0x1c], 0
sete al
test ebp, ebp
mov esi, dword [esp + 0x3c]
jne 0x40b3a1
test al, al
je 0x40b3a1
add ebx, ebp
mov edx, dword [esp + 0x44]
cmp edi, edx
jb 0x40b24c
jmp 0x40b3a1
mov edi, dword [esp + 0x18]
mov eax, edi
jmp 0x40b22c
push esi
sub esp, 0x18
mov eax, dword [esp + 0x20]
cmp dword [0x4168d8], eax
jbe 0x40b66d
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax*4 + 0x41b960]
lea esi, [esp + 0x14]
mov dword [esp + 0xc], esi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_ReadFile
sub esp, 0x14
cmp eax, 1
jne 0x40b67b
mov eax, dword [esp + 0x14]
jmp 0x40b691
mov dword [esp], 6
call fcn.0040be34
jmp 0x40b691
call sub.KERNEL32.DLL_GetLastError
mov ecx, eax
xor eax, eax
cmp ecx, 0x6d
je 0x40b691
mov dword [esp], ecx
call fcn.0040be34
add esp, 0x18
pop esi
ret