joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477e40
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x482f3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x10
call fcn.00479f12
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0x28]
add ecx, 0x14
call fcn.00479f12
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
add edx, 0x18
push edx
mov ecx, dword [ebp - 0x28]
add ecx, 0x18
call fcn.00479f12
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [eax + 0x20], edx
mov eax, dword [ebp + 8]
add eax, 0x24
mov ecx, dword [ebp - 0x28]
add ecx, 0x24
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov dword [ebp - 0x24], 3
mov ecx, dword [ebp - 0x28]
add ecx, 0x30
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 0x30
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00479f12
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
add edx, 4
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
ja 0x477f1e
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
mov dword [ecx + 0x3c], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x40], eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x44]
mov dword [ecx + 0x44], eax
mov dword [ebp - 0x18], 3
mov ecx, dword [ebp - 0x28]
add ecx, 0x48
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
add edx, 0x48
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.00479f12
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
add edx, 4
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
ja 0x477f8c
mov ecx, dword [ebp + 8]
add ecx, 0x54
mov edx, dword [ebp - 0x28]
add edx, 0x54
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ecx + 8]
mov dword [edx + 8], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x49afa1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x49afa1
lcall 0x5de5, 0x8b10c483
jmp loc.00a85768
Function at 0x4023a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4023b9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4023f6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4023f2
nop word [eax + eax]
cmp esi, edx
jae 0x4023f6
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4023e0
cmp esi, edx
jb 0x4023fd
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x402dd0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x64b9b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x654a88], 0
push esi
mov esi, ecx
je 0x402e0e
cmp dword [0x654a58], 0
je 0x402e0e
cmp dword [0x654a5c], 0
je 0x402e0e
cmp dword [0x654a8c], 0
jne 0x402f09
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.005949a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x20c]
lea ecx, [esi + 8]
lea edi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402e52
sub edx, edi
lea eax, [ebp - 0x20c]
sar edx, 1
push edx
push eax
call fcn.00403a30
lea edx, [ebp - 0x20c]
lea ecx, [esi + 4]
lea esi, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x402e80
sub edx, esi
lea eax, [ebp - 0x20c]
sar edx, 1
push edx
push eax
call fcn.00403a30
push str.LYSDK2.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x402f08
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.LYSDK_LidInit
push edi
call esi
push str.LYSDK_LidClose
push edi
mov dword [0x654a88], eax
call esi
push str.LYSDK_LidGetLoginStatus
push edi
mov dword [0x654a58], eax
call esi
push str.LYSDK_LidLogin
push edi
mov dword [0x654a5c], eax
call esi
push str.LYSDK_LidLogout
push edi
mov dword [0x654a8c], eax
call esi
call fcn.00402f20
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0057b967
mov esp, ebp
pop ebp
ret
Function at 0x404d90
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x404df3
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404df3
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x404de5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetWebViewFactory
push eax
call edi
test eax, eax
je 0x404dcd
call eax
mov dword [esi + 4], eax
push str.IWebViewToIWebViewEx
push dword [esi]
call edi
push str.IsSupportedWebViewEngine
push dword [esi]
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
xor eax, eax
cmp dword [esi + 4], eax
pop edi
setne al
pop esi
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4065c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bfd77
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x665e28], 0
jne 0x406619
push 0x4c
call fcn.0057bbbe
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00409f00
mov dword [ebp - 4], 0xffffffff
mov dword [0x665e28], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a2c0
mov dword [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40663d
xor esi, esi
jmp 0x406711
push dword [ebp - 0x10]
lea ecx, [edi + 0x170]
call fcn.00404d90
mov dword [edi + 0x194], eax
test eax, eax
je 0x406686
mov ecx, dword [edi + 0x164]
cmp dword [ecx - 0xc], 0
je 0x40670b
push 0
push ecx
mov esi, esp
add ecx, 0xfffffff0
mov dword [ebp - 0x14], esi
call fcn.00403970
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00406030
jmp 0x40670b
mov ecx, dword [edi + 0x1a4]
mov edx, 0x2711
call fcn.00436680
mov ecx, dword [edi + 0x154]
mov eax, dword [ecx]
call dword [eax + 0x130]
mov ecx, dword [edi + 0x150]
push 0
mov eax, dword [ecx]
call dword [eax + 0xcc]
mov ecx, dword [edi + 0x15c]
push 0
mov eax, dword [ecx]
call dword [eax + 0xcc]
mov ecx, dword [edi + 0x158]
push 1
mov eax, dword [ecx]
call dword [eax + 0xcc]
mov ecx, dword [edi + 0x160]
test ecx, ecx
je 0x4066e8
mov eax, dword [ecx]
push 0
call dword [eax + 0xcc]
mov ecx, dword [edi + 0x180]
test ecx, ecx
je 0x4066fa
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x14]
mov ecx, edi
mov dword [edi + 0x198], 3
call fcn.00429560
mov esi, dword [edi + 0x194]
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x406733
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4093f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c015a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 2
call fcn.00402810
mov ecx, eax
test ecx, ecx
jne 0x409465
push 0x80004005
call fcn.004022b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x18], eax
mov byte [ebp - 4], 3
call fcn.00402810
mov ecx, eax
test ecx, ecx
jne 0x409489
push 0x80004005
call fcn.004022b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 4
call fcn.00402810
mov ecx, eax
test ecx, ecx
jne 0x4094ad
push 0x80004005
call fcn.004022b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x20], eax
mov byte [ebp - 4], 5
call fcn.00402810
mov ecx, eax
test ecx, ecx
jne 0x4094d1
push 0x80004005
call fcn.004022b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x24], eax
lea esi, [edi + 0x28]
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0040c9c0
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x409530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0192
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x30]
call fcn.0040c150
mov eax, dword [ebx + 0x28]
lea ecx, [ebx + 0x28]
push eax
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0040c410
push dword [ebx + 0x28]
call fcn.0057b962
mov edx, dword [ebx + 0x24]
or esi, 0xffffffff
add esp, 4
sub edx, 0x10
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40959a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x20]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4095b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x1c]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4095ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebx + 0x18]
mov eax, esi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4095e8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edi, dword [ebx + 0x14]
test edi, edi
je 0x409615
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x409615
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x409615
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], 1
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x409642
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x409642
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x409642
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov dword [ebp - 4], 2
mov edi, dword [ebx + 4]
test edi, edi
je 0x40966e
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x40966e
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x40966e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409f00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0394
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], eax
mov byte [ebp - 4], 1
lea ecx, [esi + 0x28]
push esi
mov dword [esi], vtable.CWebViewMgr.0
mov dword [esi + 4], vtable.CWebViewMgr.1.0
call fcn.0040bc70
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
call fcn.00402810
mov ecx, eax
test ecx, ecx
jne 0x409f9d
push 0x80004005
call fcn.004022b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x44], eax
mov byte [ebp - 4], 4
lea eax, [esi + 0x24]
push dword [ebp - 0x10]
mov dword [esi + 0x3c], 0
push eax
push 0x64c420
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
call fcn.0040cc80
add esp, 0xc
movzx eax, ax
lea ecx, [esi + 4]
push 0
push eax
push 0
push 0
push 0x56000000
push 0
push 0
push 0xfffffffffffffffd
call fcn.0040cbd0
mov eax, dword [esi + 0x2c]
mov dword [eax + 0x38], 0x40b9e0
mov dword [eax + 0x3c], 0
mov eax, dword [esi + 0x2c]
mov dword [eax + 0x30], 0x40b980
mov dword [eax + 0x34], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40a1f0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c03c9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
xor edx, edx
mov dword [ebp - 0x14], 0
mov esi, dword [ebp + 8]
mov ecx, esi
push str.webview
call fcn.0046fff0
add esp, 4
mov dword [ebp - 4], 0
push dword [esi]
mov dword [ebp - 0x14], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a25b
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.cef
mov edx, esi
lea ecx, [ebp - 0x10]
call fcn.00407900
add esp, 4
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40a284
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40a29f
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40a430
Capabilities:
Delete file
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0438
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.load_local_cef._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [ebp - 0x14]
mov edi, 1
push eax
mov dword [ebp - 0x18], edi
call fcn.0040a1f0
xor esi, esi
mov dword [ebp - 4], 0
or ebx, 0xffffffff
cmp dword [str.cefcef.7z], esi
je 0x40a54d
mov eax, 0x61fa24
mov edi, dword [eax]
test edi, edi
je 0x40a54a
sub esp, 8
mov ecx, esp
push edi
call fcn.004032f0
call fcn.0040a7a0
test eax, eax
jne 0x40a4b7
mov dword [ebp - 0x18], eax
jmp 0x40a534
test esi, esi
jne 0x40a534
push 0x621c28
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.00407900
add esp, 4
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00407900
add esp, 4
mov byte [ebp - 4], 3
mov eax, ebx
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a4fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
call fcn.0048ca60
test eax, eax
jne 0x40a516
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a534
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
inc esi
cmp dword [esi*4 + 0x61fa24], 0
lea eax, [esi*4 + 0x61fa24]
jne 0x40a491
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40a56c
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a580
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0480
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040a1f0
mov dword [ebp - 4], 0
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
or edi, 0xffffffff
test eax, eax
je 0x40a6f8
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40a6f8
xor esi, esi
push 0x621c28
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.00407900
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
push dword [esi + 0x61fa48]
mov edx, eax
call fcn.00407900
mov byte [ebp - 4], 0
add esp, 4
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a629
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x14]
call ebx
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
test eax, eax
mov eax, edi
je 0x40a6e6
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a650
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, 0x30
jb 0x40a5e1
push str.ceflibcef.dll
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.00407900
add esp, 4
lea edx, [ebp - 0x18]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call fcn.004778d0
mov byte [ebp - 4], 3
mov ecx, dword [0x665c20]
test ecx, ecx
jne 0x40a692
push 0x80004005
call fcn.004022b0
push ecx
push dword [eax]
call fcn.0059b7f6
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x1c]
test eax, eax
mov eax, edi
setne bl
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a6c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x18]
movzx esi, bl
add edx, 0xfffffff0
xor esi, 1
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a6fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40a6fa
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a6f8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x40a719
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b8b0
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c06d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebx + 0x44]
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40b937
lea eax, [ebp - 0x10]
push eax
call fcn.0040a1f0
mov dword [ebp - 4], edi
mov edx, dword [eax]
mov ecx, dword [ebx + 0x44]
call fcn.0048ca60
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
neg edi
sbb edi, edi
add edx, 0xfffffff0
inc edi
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x40b926
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0x44]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebx + 0x44]
call fcn.00403450
push 0
push edi
push 0xdadb
push dword [ebx + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40e6d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0x40e6ee
mov eax, 0x8000ffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
lea edi, [esi + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x40e718
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40e712
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0x40e825
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 0
push 0
mov byte [edi + 0x18], 1
call ebx
mov dword [esi + 0x40], eax
test eax, eax
jne 0x40e74e
cmp byte [edi + 0x18], al
je 0x40e742
push edi
mov byte [edi + 0x18], al
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
call fcn.0040e3f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x40e783
call fcn.0040e3f0
push ecx
mov ecx, esi
mov edi, eax
call fcn.0040e530
test eax, eax
jns 0x40e823
test edi, edi
cmovns edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push edi
mov ecx, esi
call fcn.0040e600
mov dword [esp + 0xc], eax
test eax, eax
jns 0x40e7b1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.0040e530
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call ebx
mov ebx, eax
test ebx, ebx
je 0x40e75e
push 0
push 0
push ebx
mov ecx, esi
call fcn.0040e600
mov edi, eax
test edi, edi
jns 0x40e7eb
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esi
call fcn.0040e530
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x40e8c0
push 0
push 0
call fcn.005a44ca
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x40e75e
push 0xffffffffffffffff
push dword [esi + 0x40]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40e823
call fcn.0040e3f0
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret