joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40184f
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x830], ecx
mov eax, dword [ebp - 0x830]
movzx eax, byte [eax + 4]
test eax, eax
je 0x40187b
jmp 0x401a22
mov eax, dword [ebp - 0x830]
mov byte [eax + 4], 1
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.00412550
add esp, 0xc
and dword [ebp - 0x82c], 0
lea eax, [ebp - 0x82c]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x401914
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x82c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4018e5
cmp dword [ebp - 0x82c], 0
je 0x4018e3
push dword [ebp - 0x82c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x401914
push 2
pop eax
imul eax, eax, 0
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0x410
jae 0x4018ff
jmp 0x401904
call fcn.00410458
xor eax, eax
mov ecx, dword [ebp - 0x834]
mov word [ebp + ecx - 0x414], ax
push 0x428908
lea eax, [ebp - 0x414]
push eax
call fcn.00413d31
pop ecx
pop ecx
push 0x42890c
lea eax, [ebp - 0x414]
push eax
call fcn.00413d31
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40197b
push 2
pop eax
imul eax, eax, 0
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0x410
jae 0x401966
jmp 0x40196b
call fcn.00410458
xor eax, eax
mov ecx, dword [ebp - 0x838]
mov word [ebp + ecx - 0x414], ax
push 0x412
push 0
lea eax, [ebp - 0x828]
push eax
call fcn.00412550
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call fcn.00413d62
pop ecx
test eax, eax
jbe 0x4019f4
push 0x207
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00413cee
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call fcn.00413d62
pop ecx
test eax, eax
jbe 0x4019f4
push 0x428908
lea eax, [ebp - 0x828]
push eax
call fcn.00413d31
pop ecx
pop ecx
push str.HaoZip.hzv
lea eax, [ebp - 0x828]
push eax
call fcn.00413d31
pop ecx
pop ecx
call fcn.00402820
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x828]
push eax
call fcn.00413d62
pop ecx
test eax, eax
jbe 0x401a22
lea eax, [ebp - 0x828]
push eax
mov ecx, dword [ebp - 0x83c]
call fcn.00402900
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00410326
leave
ret
Function at 0x401e6a
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00412550
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.HaozipExt32.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401ee0
or eax, 0xffffffff
jmp 0x401f84
push edi
mov dword [ebp - 0x228], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x228]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x228], 2
mov edi, eax
jge 0x401f0b
push 0xfffffffffffffffe
pop eax
jmp 0x401f83
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
push ebx
push str._reg
push dword [edi + 4]
call esi
test eax, eax
jne 0x401f3f
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00401f93
lea ecx, [ebp - 0x224]
call fcn.00401d48
jmp 0x401f6a
push str._unreg
push dword [edi + 4]
call esi
test eax, eax
jne 0x401f7f
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00401f93
lea ecx, [ebp - 0x224]
call fcn.00401dd9
lea ecx, [ebp - 0x224]
mov bl, al
call fcn.00401cd6
test bl, bl
je 0x401f7f
xor eax, eax
jmp 0x401f82
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00410326
leave
ret 0x10
Function at 0x4054b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.00412550
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40552e
cmp dword [esp + 0x14], 6
jb 0x40552e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, 0x80000001
call fcn.00405320
add esp, 0xc
test al, al
je 0x40552e
cmp word [esi], 0
jne 0x405586
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, 0x80000000
call fcn.00405320
add esp, 0xc
test al, al
je 0x40555a
cmp word [esi], 0
jne 0x405586
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, 0x80000001
call fcn.00405320
add esp, 0xc
test al, al
je 0x40559b
cmp word [esi], 0
je 0x40559b
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00410326
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.00410326
mov esp, ebp
pop ebp
ret
Function at 0x405b50
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x283c]
mov eax, 0x283c
call fcn.00420cc0
push 0xffffffffffffffff
push 0x4217a8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp + 0x2838], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x2000
xor ebx, ebx
lea eax, [ebp + 0x630]
push ebx
push eax
call fcn.00412550
add esp, 0xc
mov eax, 0x22
mov word [ebp + 0x630], ax
test esi, esi
je 0x405d51
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 1
jl 0x405d51
push esi
call edi
cmp eax, 0xffa
jge 0x405d51
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp + 0x630]
push eax
call esi
push 0x428ff0
lea eax, [ebp + 0x630]
push eax
call esi
push 0x428ff4
lea ecx, [ebp - 0x2c]
call fcn.00401f93
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push eax
call fcn.0040b470
mov ecx, eax
call fcn.0040b530
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00401cbb
test esi, esi
je 0x405d51
push str.ShellExecuteW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x405d51
lea ecx, [ebp]
call fcn.004055b0
xor edi, edi
lea esi, [ebp]
cmp word [esi], 0
je 0x405c76
push 1
push 0
lea eax, [ebp + 0x630]
push eax
push esi
push str.open
push 0
call dword [ebp - 0x10]
cmp eax, 0x20
ja 0x405c84
inc edi
add esi, 0x210
cmp edi, 3
jl 0x405c55
jmp 0x405ca6
imul ebx, edi, 0x210
cmp dword [ebp + ebx + 0x208], 0
mov ebx, dword [ebp + ebx + 0x20c]
jne 0x405c9e
add ebx, 0x10
test ebx, ebx
jne 0x405d4d
mov edi, dword [ebp - 0x10]
lea eax, [ebp + 0x630]
push 1
push 0
push 0
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x405d48
mov dword [ebp - 0x14], str._programfiles_x86__Internet_Exploreriexplore.exe
xor esi, esi
mov dword [ebp - 0x10], str._programfiles_Internet_Exploreriexplore.exe
nop dword [eax + eax]
push 0x208
lea eax, [ebp + 0x2630]
push 0
push eax
call fcn.00412550
add esp, 0xc
lea eax, [ebp + 0x2630]
push 0x103
push eax
push dword [ebp + esi*4 - 0x14]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp + 0x2630]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405d3e
push 1
push 0
lea eax, [ebp + 0x630]
push eax
lea eax, [ebp + 0x2630]
push eax
push str.open
push 0
call edi
cmp eax, 0x20
ja 0x405d48
inc esi
cmp esi, 2
jb 0x405ce0
mov eax, ebx
jmp 0x405d53
mov ebx, 0x10
mov eax, ebx
jmp 0x405d53
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2838]
xor ecx, ebp
call fcn.00410326
lea esp, [ebp + 0x283c]
pop ebp
ret
Function at 0x40a380
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x42d008]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.00412550
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x40a417
cmp dword [esp + 8], 6
jb 0x40a417
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.00410326
add esp, 0x118
ret

Function at 0x40a430
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421de0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x42d008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00401f93
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.0040b470
mov ecx, eax
call fcn.0040b530
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401cbb
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00401f93
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.0040b470
mov ecx, eax
call fcn.0040b530
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401cbb
test ebx, ebx
je 0x40a545
test esi, esi
je 0x40a545
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ae80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421e18
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401cd3
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x40aebe
xor al, al
jmp 0x40afd9
push ecx
lea ecx, [ebp - 0x28]
call fcn.004037e0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.0040ca90
lea ecx, [ebp - 0x28]
call fcn.00401cb0
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40afc6
lea ecx, [ebp - 0x40]
call fcn.00401cc0
mov byte [ebp - 4], 1
mov edx, ecx
lea ecx, [ebp - 0x28]
call fcn.0040d5f0
test al, al
je 0x40af1e
lea ecx, [ebp - 0x40]
call fcn.00401cb0
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401cbb
cmp esi, 0xffffffff
jne 0x40afc6
lea ecx, [ebp - 0x28]
call fcn.00401cd3
mov edx, dword [eax + 0x10]
cmp edx, 2
jbe 0x40afc2
call fcn.00401cd3
mov ecx, eax
mov esi, dword [eax + 0x14]
cmp esi, 8
jb 0x40af54
mov ecx, dword [eax]
cmp word [ecx + edx*2 - 2], 0x5c
je 0x40af6b
cmp esi, 8
jb 0x40af63
mov eax, dword [eax]
cmp word [eax + edx*2 - 2], 0x2f
jne 0x40afc2
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.0040ca90
lea ecx, [ebp - 0x28]
call fcn.00401cb0
push eax
call edi
mov esi, eax
cmp esi, 0xffffffff
jne 0x40afc6
lea ecx, [ebp - 0x40]
call fcn.00401cc0
mov byte [ebp - 4], 2
mov edx, ecx
lea ecx, [ebp - 0x28]
call fcn.0040d5f0
test al, al
je 0x40afb1
lea ecx, [ebp - 0x40]
call fcn.00401cb0
push eax
call edi
mov esi, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401cbb
cmp esi, 0xffffffff
jne 0x40afc6
xor bl, bl
jmp 0x40afc8
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401cbb
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410326
mov esp, ebp
pop ebp
ret
Function at 0x40b000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421e58
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401cd3
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x40b03d
xor al, al
jmp 0x40b161
push ecx
lea ecx, [ebp - 0x28]
call fcn.004037e0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.0040ca90
lea ecx, [ebp - 0x28]
call fcn.00401cb0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40b0aa
lea ecx, [ebp - 0x40]
call fcn.00401cc0
mov byte [ebp - 4], 1
mov edx, ecx
lea ecx, [ebp - 0x28]
call fcn.0040d5f0
test al, al
je 0x40b099
lea ecx, [ebp - 0x40]
call fcn.00401cb0
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401cbb
cmp ebx, 0xffffffff
je 0x40b0b3
test bl, 0x10
je 0x40b14e
lea ecx, [ebp - 0x28]
call fcn.00401cd3
mov edx, dword [eax + 0x10]
cmp edx, 2
jbe 0x40b14a
call fcn.00401cd3
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x40b0d6
mov ecx, dword [eax]
cmp word [ecx + edx*2 - 2], 0x5c
je 0x40b0ee
cmp dword [eax + 0x14], 8
jb 0x40b0e6
mov eax, dword [eax]
cmp word [eax + edx*2 - 2], 0x2f
jne 0x40b14a
mov edx, 0x20
lea ecx, [ebp - 0x28]
call fcn.0040ca90
lea ecx, [ebp - 0x28]
call fcn.00401cb0
push eax
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40b145
lea ecx, [ebp - 0x40]
call fcn.00401cc0
mov byte [ebp - 4], 2
mov edx, ecx
lea ecx, [ebp - 0x28]
call fcn.0040d5f0
test al, al
je 0x40b134
lea ecx, [ebp - 0x40]
call fcn.00401cb0
push eax
call esi
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401cbb
cmp ebx, 0xffffffff
je 0x40b14a
test bl, 0x10
je 0x40b14e
xor bl, bl
jmp 0x40b150
mov bl, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401cbb
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410326
mov esp, ebp
pop ebp
ret
Function at 0x40b180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421e90
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00401cd3
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x40b1bc
xor al, al
jmp 0x40b247
push ecx
lea ecx, [ebp - 0x28]
call fcn.004037e0
mov dword [ebp - 4], 0
mov edx, 4
lea ecx, [ebp - 0x28]
call fcn.0040ca90
lea ecx, [ebp - 0x28]
call fcn.00401cb0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40b22b
lea ecx, [ebp - 0x40]
call fcn.00401cc0
mov byte [ebp - 4], 1
mov edx, ecx
lea ecx, [ebp - 0x28]
call fcn.0040d5f0
test al, al
je 0x40b21a
lea ecx, [ebp - 0x40]
call fcn.00401cb0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00401cbb
cmp ebx, 0xffffffff
je 0x40b234
test bl, 0x10
je 0x40b234
mov bl, 1
jmp 0x40b236
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401cbb
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410326
mov esp, ebp
pop ebp
ret
Function at 0x40b270
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421ee0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00401cd3
mov edi, eax
cmp dword [edi + 0x10], 0
jne 0x40b2b1
xor al, al
jmp 0x40b451
call fcn.0040b180
test al, al
je 0x40b2c1
mov al, 1
jmp 0x40b451
push 0
mov ecx, ebx
call fcn.00401cb0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call esi
test eax, eax
jne 0x40b30f
lea ecx, [ebp - 0x28]
call fcn.00401cc0
mov dword [ebp - 4], 0
mov edx, ecx
mov ecx, ebx
call fcn.0040d5f0
test al, al
je 0x40b300
push 0
lea ecx, [ebp - 0x28]
call fcn.00401cb0
push eax
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401cbb
mov ecx, ebx
call fcn.0040b180
test al, al
jne 0x40b2ba
mov eax, dword [edi + 0x10]
xor esi, esi
mov dword [ebp - 0x44], eax
test eax, eax
je 0x40b3f1
nop word [eax + eax]
mov ecx, dword [edi + 0x14]
mov eax, edi
cmp ecx, 8
jb 0x40b33c
mov eax, dword [edi]
mov edx, 0x2f
cmp dx, word [eax + esi*2]
mov edx, 0x5c
je 0x40b35f
mov eax, edi
cmp ecx, 8
jb 0x40b355
mov eax, dword [edi]
cmp dx, word [eax + esi*2]
jne 0x40b3e7
push esi
push 0
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00404b20
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.00401cd3
mov eax, dword [eax + 0x10]
test eax, eax
je 0x40b3d8
call fcn.0040ae80
test al, al
jne 0x40b3d8
push 0
lea ecx, [ebp - 0x28]
call fcn.00401cb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b3d8
lea ecx, [ebp - 0x40]
call fcn.00401cc0
mov byte [ebp - 4], 2
mov edx, ecx
lea ecx, [ebp - 0x28]
call fcn.0040d5f0
test al, al
je 0x40b3cc
push 0
lea ecx, [ebp - 0x40]
call fcn.00401cb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00401cbb
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401cbb
inc esi
cmp esi, dword [ebp - 0x44]
jb 0x40b330
mov ecx, ebx
call fcn.0040ae80
test al, al
jne 0x40b44a
push 0
mov ecx, ebx
call fcn.00401cb0
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push eax
call esi
test eax, eax
jne 0x40b44a
lea ecx, [ebp - 0x40]
call fcn.00401cc0
mov dword [ebp - 4], 3
mov edx, ecx
mov ecx, ebx
call fcn.0040d5f0
test al, al
je 0x40b43b
push 0
lea ecx, [ebp - 0x40]
call fcn.00401cb0
push eax
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00401cbb
mov ecx, ebx
call fcn.0040b180
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410326
mov esp, ebp
pop ebp
ret
Function at 0x40c5a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x422300
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42d008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
test eax, eax
je 0x40c5e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx], 0
push 0x2c
mov word [ebx + 4], 0
mov dword [ebp - 0x14], 0
call fcn.004107da
mov esi, eax
lea ecx, [ebp - 0x30]
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [esi], 0
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0xc
mov dword [esi + 0xc], edi
push str.Advapi32.dll
mov dword [esi + 0x10], 0
call fcn.00401f93
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.0040b470
mov ecx, eax
call fcn.0040b530
mov dword [esi + 0x28], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00401cbb
sub esp, 8
lea ecx, [ebp - 0x14]
push edi
call fcn.0040d8c0
mov esi, dword [ebp - 0x14]
mov dword [esi], eax
mov dword [ebp - 4], 1
cmp dword [esi], 0
je 0x40c67b
lea edx, [esi + 8]
jmp 0x40c67d
xor edx, edx
mov ecx, dword [ebp - 0x18]
call fcn.00401cd3
mov eax, dword [eax + 0x10]
test eax, eax
je 0x40c693
call fcn.00401cb0
jmp 0x40c695
xor eax, eax
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebx], eax
test eax, eax
je 0x40c6b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c6b6
mov byte [ebx + 5], 1
cmp dword [ebx], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x40c6df
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40c6f4
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004107cc
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00410326
mov esp, ebp
pop ebp
ret 4